@indigoai-us/hq-cli 5.342.1 → 5.342.3

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [5.342.3] — 2026-10-04
+- `hq secrets env` now waits briefly for the company flag snapshot refresh before its synchronous exit, allowing the fast-path gate to use a persisted snapshot on later invocations.
+
+## [5.342.2] — 2026-10-04
+- Load the shared `secrets env` action without importing the full secrets command module on the enabled fast route.
+
 ## [5.342.1] — 2026-10-04
 - `hq lanes` now continues envelope numbering beyond 999 and records unexpected reconcile admission failures as a distinct queued reason with error details.
 - Reconcile skips configured Codex homes absent on the current host and reports a note; other filesystem errors remain visible as store errors. `--dry-run` no longer compresses rollouts or advances the retention schedule.

package/dist/commands/secrets-env-exit.d.ts

@@ -0,0 +1,6 @@
+import { writeSync } from "node:fs";
+/** Write the resolved exports synchronously and exit even if the pipe is closed. */
+export declare function emitEnvExportsAndExit(payload: string, exit?: (code: number) => never, write?: typeof writeSync): never;
+/** Wait for a company snapshot before the synchronous env-command exit. */
+export declare function finishEnvExportsAndExit(payload: string, waitForSnapshot?: (timeoutMs?: number, companyUid?: string) => Promise<void>, exit?: (code: number) => never, write?: typeof writeSync, shouldWaitForSnapshot?: boolean, companyUid?: string): Promise<never>;
+//# sourceMappingURL=secrets-env-exit.d.ts.map

package/dist/commands/secrets-env-exit.js

@@ -0,0 +1,28 @@
+import { writeSync } from "node:fs";
+import { waitForRegisteredFlagRegistryRefresh } from "../lib/flag-registry-refresh-wait.js";
+/** Write the resolved exports synchronously and exit even if the pipe is closed. */
+export function emitEnvExportsAndExit(payload, exit = process.exit, write = writeSync) {
+    const buf = Buffer.from(payload, "utf8");
+    const MAX_EAGAIN_RETRIES = 10_000;
+    let offset = 0;
+    let eagainRetries = 0;
+    while (offset < buf.length) {
+        try {
+            offset += write(1, buf, offset, buf.length - offset);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "EAGAIN" && eagainRetries++ < MAX_EAGAIN_RETRIES)
+                continue;
+            break;
+        }
+    }
+    return exit(0);
+}
+/** Wait for a company snapshot before the synchronous env-command exit. */
+export async function finishEnvExportsAndExit(payload, waitForSnapshot = waitForRegisteredFlagRegistryRefresh, exit = process.exit, write = writeSync, shouldWaitForSnapshot = true, companyUid) {
+    if (shouldWaitForSnapshot)
+        await waitForSnapshot(500, companyUid);
+    return emitEnvExportsAndExit(payload, exit, write);
+}
+//# sourceMappingURL=secrets-env-exit.js.map

package/dist/commands/secrets-public-types.test-d.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secrets-public-types.test-d.d.ts.map

package/dist/commands/secrets-public-types.test-d.js

@@ -0,0 +1,18 @@
+const scriptUsage = {
+    scriptId: "fixture-script",
+    path: "scripts/example.sh",
+    sha256: "0".repeat(64),
+    attestationLevel: "verified",
+};
+const metadata = {
+    tier: "standard",
+    cacheTtlMs: 1_000,
+};
+const loadedSecret = {
+    ...metadata,
+    name: "FIXTURE_NAME",
+    value: "fixture-only",
+};
+void [scriptUsage, metadata, loadedSecret];
+export {};
+//# sourceMappingURL=secrets-public-types.test-d.js.map

package/dist/commands/secrets.d.ts

@@ -1,5 +1,7 @@
 import type { Command } from "commander";
-import { writeSync } from "node:fs";
+export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
+export type { SecretLoadResponse, SecretScriptLockMode, SecretTier, SecretUsage, SecretUsageChannel } from "../secrets-env-action.js";
+export type { SecretScriptUsage, SecretMetadata, SecretLoadSuccessRow } from "../secrets-env-action.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
@@ -10,42 +12,6 @@ export { vaultApiFetch, getCompanyUid, getEntityUid };
  */
 export declare const HQ_PRO_RESOURCE_SURFACES: readonly ["api", "bot_invite", "bot_join_now", "calendar_auto_schedule", "calendar_preferences", "cli_secrets_set", "console_secrets_form", "deploy_precheck", "external_connection", "factory_install", "integrations_connect", "oauth_callback", "plan_limit_check", "secrets_input_link", "web"];
 export declare const CLI_SECRETS_SET_SURFACE = "cli_secrets_set";
-export type SecretTier = "standard" | "sensitive" | "nuclear";
-export type SecretScriptLockMode = "off" | "enforced";
-export type SecretUsageChannel = "run" | "exec" | "env" | "sandbox" | "reveal" | "submit-link";
-export interface SecretScriptUsage {
-    scriptId: string;
-    path: string;
-    sha256: string;
-    attestationLevel: string;
-}
-export interface SecretUsage {
-    channel: SecretUsageChannel;
-    reason?: string;
-    script?: SecretScriptUsage;
-}
-export interface SecretMetadata {
-    tier?: SecretTier;
-    scriptLock?: {
-        mode?: SecretScriptLockMode;
-        requiredAttestation?: string;
-    };
-    cacheTtlMs?: number;
-    revokedAt?: string | null;
-}
-export interface SecretLoadSuccessRow extends SecretMetadata {
-    name: string;
-    value?: string;
-    version?: number;
-}
-export interface SecretLoadResponse {
-    secrets: SecretLoadSuccessRow[];
-    errors: Array<{
-        name: string;
-        code: string;
-        message?: string;
-    }>;
-}
 export interface SecretInjectionRecipe {
     header: string;
     scheme: "raw" | "bearer";
@@ -60,48 +26,5 @@ export declare function parseDestinationUrl(raw: string): {
 };
 export declare function collectSecretNames(value: string, previous?: string[]): string[];
 export declare function scrubSandboxOutput(text: string, secretNames?: string[]): string;
-export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
-    allowOfflineFallback?: boolean;
-}): Promise<Map<string, string>>;
-/**
- * Emit `hq secrets env` output and terminate deterministically.
- *
- * The process MUST exit even when the consuming pipe has gone away. The
- * orphaned-process leak (personal/projects/hq-secrets-process-leak) was caused
- * by relying on `process.stdout.write(payload, () => process.exit(0))`: when the
- * parent shell reading `source <(hq secrets env …)` is killed on timeout, the
- * stdout pipe loses its reader, the write callback never fires, `process.exit(0)`
- * is never reached, and — because `env` forces no other exit — the process parks
- * in `epoll_pwait(-1)` forever, reparented to PID 1. Hundreds accumulated this
- * way, exhausting swap and driving load into triple digits.
- *
- * Writing synchronously to fd 1 and then exiting unconditionally removes every
- * dependency on the event loop draining and on the reader still being attached:
- * - a live reader receives the export lines (synchronous write reaches the
- *   kernel pipe buffer before we exit, so nothing is truncated);
- * - a dead reader surfaces as EPIPE, which we swallow — the secret is already
- *   resolved and there is nothing left to deliver, so a clean exit is correct;
- * - EAGAIN (stdout in non-blocking mode with a momentarily full buffer) is
- *   retried a bounded number of times. `env` payloads are a few short export
- *   lines, far under the 64 KiB pipe buffer, so this effectively never spins.
- *
- * `exit` and `write` are injectable for tests; production uses the real ones.
- */
-export declare function emitEnvExportsAndExit(payload: string, exit?: (code: number) => never, write?: typeof writeSync): never;
-/**
- * Shared `secrets env` action for Commander and the default-off lightweight
- * entrypoint. The fast entrypoint still runs the same credential, usage-audit,
- * server authorization, cache-fallback, redaction, and output code.
- */
-export declare function runSecretsEnvCommand(opts: {
-    only: string[];
-    script?: string;
-    scriptId?: string;
-}, parentScope: {
-    company?: string;
-    personal?: boolean;
-}, options?: {
-    fallbackOnAuthFailure?: boolean;
-}): Promise<"handled" | "fallback">;
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map