@indigoai-us/hq-cli 5.342.1 → 5.342.3

package/dist/lib/flag-registry-worker.js

@@ -20,7 +20,9 @@ async function refresh() {
             endpoint,
             ...(companyUid ? { companyUid } : {}),
             ...(companyIdentifiers.length ? { companyIdentifiers } : {}),
-            getToken: () => loadCachedTokens()?.idToken ?? "",
+            getToken: () => typeof data.idToken === "string" && data.idToken.length > 0
+                ? data.idToken
+                : loadCachedTokens()?.idToken ?? "",
             refreshIntervalMs: 0,
             onError: () => { },
         });
@@ -28,9 +30,12 @@ async function refresh() {
         const snapshot = client.snapshot();
         if (snapshot)
             parentPort.postMessage(snapshot);
+        else
+            parentPort.postMessage({ status: "snapshot_unavailable" });
     }
     catch {
         // The parent is deliberately fail-open and has the legacy fallback.
+        parentPort?.postMessage({ status: "snapshot_unavailable" });
     }
 }
 void refresh();

package/dist/lib/flag-registry.d.ts

@@ -15,11 +15,18 @@ export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 export type FlagReader = Pick<FlagClient, "isEnabled">;
 interface WorkerLike {
     on(event: "message", listener: (value: unknown) => void): unknown;
-    on(event: "error", listener: () => void): unknown;
+    on(event: "error", listener: (error: Error) => void): unknown;
+    ref?(): unknown;
     unref(): void;
 }
 export interface FlagRegistryDependencies {
     endpoint?: string;
+    /** An explicit `--company` scope, which takes precedence over ambient binding. */
+    companyScope?: string;
+    /** CLI argv used to resolve explicit company scope before the command parser runs. */
+    argv?: readonly string[];
+    /** Optional machine ID token already cached by the CLI, never logged or persisted. */
+    idToken?: string;
     createWorker?: (filename: string | URL, options: WorkerOptions) => WorkerLike;
     sentry?: FlagRegistrySentry;
     /** Test seam for exercising the no-source fail-open path. */
@@ -31,6 +38,10 @@ export interface CompanyFlagGateDependencies {
     requestTimeoutMs?: number;
     createClient?: typeof createFlagClient;
 }
+/** Extract only a CLI-level --company option; values after `--` belong to child commands. */
+export declare function explicitCompanyScopeFromArgv(argv: readonly string[]): string | undefined;
+/** Wait briefly for the current company refresh to persist or report completion. */
+export declare function waitForFlagRegistryRefresh(timeoutMs?: number, companyUid?: string): Promise<void>;
 /** Create the same snapshot-backed reader used by process gates. */
 export declare function createProcessSnapshotReader(companyIdentifiers: string[], getSnapshot?: () => FlagSnapshot | null, env?: NodeJS.ProcessEnv): FlagReader;
 /**

package/dist/lib/flag-registry.js

@@ -10,6 +10,7 @@ import { createFlagClient, isFlagSnapshot, readLocalOverride, resolveFlag, } fro
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
 import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
 import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
+import { registerFlagRegistryRefreshWaiter } from "./flag-registry-refresh-wait.js";
 import { writeFlagSnapshotFile } from "./flag-snapshot-file.js";
 function captureFlagRegistryException(error, tags, sentry) {
     if (!sentry)
@@ -19,12 +20,74 @@ function captureFlagRegistryException(error, tags, sentry) {
 export { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
 export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
+/** Extract only a CLI-level --company option; values after `--` belong to child commands. */
+export function explicitCompanyScopeFromArgv(argv) {
+    for (let index = 2; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === "--")
+            return undefined;
+        if (argument === "--company") {
+            const value = argv[index + 1]?.trim();
+            return value && !value.startsWith("-") ? value : undefined;
+        }
+        if (argument.startsWith("--company=")) {
+            const value = argument.slice("--company=".length).trim();
+            return value || undefined;
+        }
+    }
+    return undefined;
+}
 function normalizedCompanyUid(value) {
     const candidate = value?.trim() ?? "";
     return COMPANY_UID_RE.test(candidate) ? candidate : undefined;
 }
 let heldSnapshot = null;
 let processReader = null;
+let refreshCompletion = Promise.resolve();
+let completeRefresh = null;
+let refreshWorker = null;
+let refreshCompanyUid;
+let refreshPendingSnapshot = null;
+let refreshSentry;
+/** Wait briefly for the current company refresh to persist or report completion. */
+export async function waitForFlagRegistryRefresh(timeoutMs = 500, companyUid) {
+    const resolvedCompanyUid = normalizedCompanyUid(companyUid);
+    if (resolvedCompanyUid)
+        refreshCompanyUid = resolvedCompanyUid;
+    if (refreshPendingSnapshot && refreshCompanyUid) {
+        try {
+            writeFlagSnapshotFile(refreshCompanyUid, refreshPendingSnapshot.flags);
+        }
+        catch (error) {
+            captureFlagRegistryException(error instanceof Error ? error : new Error(String(error)), {
+                component: "flag-snapshot-cache-write",
+                company_uid_present: "true",
+            }, refreshSentry);
+        }
+        refreshPendingSnapshot = null;
+        completeRefresh?.();
+        completeRefresh = null;
+    }
+    if (!completeRefresh)
+        return;
+    const worker = refreshWorker;
+    worker?.ref?.();
+    let timer;
+    try {
+        await Promise.race([
+            refreshCompletion,
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, Math.max(0, timeoutMs));
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        worker?.unref();
+    }
+}
+registerFlagRegistryRefreshWaiter(waitForFlagRegistryRefresh);
 function processLocalOverride(flagKey, env = process.env) {
     return readLocalOverride(flagKey, env);
 }
@@ -61,10 +124,37 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
     if (processReader)
         return processReader;
     const endpoint = resolveFlagRegistryEndpoint(dependencies.endpoint, process.env);
-    const company = resolveProcessFlagCompanyContext();
+    const companyScope = dependencies.companyScope ?? explicitCompanyScopeFromArgv(dependencies.argv ?? []);
+    const companyEnv = companyScope
+        ? {
+            ...process.env,
+            HQ_COMPANY_UID: COMPANY_UID_RE.test(companyScope)
+                ? companyScope
+                : "",
+            HQ_COMPANY_SLUG: COMPANY_UID_RE.test(companyScope)
+                ? ""
+                : companyScope,
+        }
+        : process.env;
+    const company = resolveProcessFlagCompanyContext(companyEnv);
     const sentry = dependencies.sentry;
     const companyUid = company.companyUid;
     const companyIdentifiers = [companyUid, company.companySlug].filter((value) => Boolean(value));
+    refreshCompletion = Promise.resolve();
+    completeRefresh = null;
+    refreshWorker = null;
+    refreshCompanyUid = companyUid;
+    refreshPendingSnapshot = null;
+    refreshSentry = sentry;
+    if (companyUid || company.companySlug) {
+        refreshCompletion = new Promise((resolve) => {
+            completeRefresh = resolve;
+        });
+    }
+    const finishRefresh = () => {
+        completeRefresh?.();
+        completeRefresh = null;
+    };
     processReader = processSnapshotReader(companyIdentifiers);
     try {
         const embeddedSource = dependencies.workerSource ?? FLAG_REGISTRY_WORKER_SOURCE;
@@ -76,6 +166,7 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                 worker: "flag-registry",
                 flag_worker_failure: "embedded_source_unavailable",
             });
+            finishRefresh();
             return processReader;
         }
         // This source is embedded at build time, so it remains available while an
@@ -85,6 +176,9 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                 endpoint,
                 ...(companyUid ? { companyUid } : {}),
                 ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
+                ...((companyUid || company.companySlug) && dependencies.idToken
+                    ? { idToken: dependencies.idToken }
+                    : {}),
             },
             eval: true,
         };
@@ -100,12 +194,22 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                 return createWorker(embeddedSource, workerOptions);
             })
             : createWorker(embeddedSource, workerOptions);
+        refreshWorker = worker;
+        let released = false;
+        const releaseWorker = () => {
+            if (released)
+                return;
+            released = true;
+            worker.unref();
+        };
         worker.on("message", (value) => {
             if (isFlagSnapshot(value)) {
                 heldSnapshot = value;
-                if (companyUid) {
+                if (completeRefresh)
+                    refreshPendingSnapshot = value;
+                if (refreshCompanyUid && refreshPendingSnapshot) {
                     try {
-                        writeFlagSnapshotFile(companyUid, value.flags);
+                        writeFlagSnapshotFile(refreshCompanyUid, value.flags);
                     }
                     catch (error) {
                         captureFlagRegistryException(error instanceof Error ? error : new Error(String(error)), {
@@ -113,18 +217,28 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                             company_uid_present: "true",
                         }, sentry);
                     }
+                    refreshPendingSnapshot = null;
+                    finishRefresh();
                 }
             }
+            else {
+                finishRefresh();
+            }
+            releaseWorker();
         });
         // A failed background refresh must stay invisible to an offline CLI.
-        worker.on("error", () => { });
+        worker.on("error", () => {
+            finishRefresh();
+            releaseWorker();
+        });
         // Attach listeners first: Worker.on() re-refs the worker, so unref must be
         // last for the parent process to remain free to exit immediately.
-        worker.unref();
+        releaseWorker();
     }
     catch {
         // Construction can fail in restricted Node runtimes. The reader is still
         // safe: it has no snapshot, so it resolves through the legacy vocabulary.
+        finishRefresh();
     }
     return processReader;
 }
@@ -198,5 +312,11 @@ export function currentFlagSnapshot() {
 export function _resetFlagRegistryForTests() {
     heldSnapshot = null;
     processReader = null;
+    refreshCompletion = Promise.resolve();
+    completeRefresh = null;
+    refreshWorker = null;
+    refreshCompanyUid = undefined;
+    refreshPendingSnapshot = null;
+    refreshSentry = undefined;
 }
 //# sourceMappingURL=flag-registry.js.map

package/dist/main.js

@@ -37,7 +37,7 @@ import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
 import { isAuthError } from "./utils/auth-error.js";
 import { browserLoginAbandonedMessage } from "./utils/browser-login-abandoned.js";
 import { callbackPortBusyMessage, DEFAULT_CALLBACK_PORT } from "./utils/callback-port-busy.js";
-import { DEFAULT_COGNITO } from "./utils/cognito-session.js";
+import { DEFAULT_COGNITO, isMachineIdentity, loadMachineCachedTokens, } from "./utils/cognito-session.js";
 import { isCompanySelectionError } from "./utils/company-selection-error.js";
 import { canOfferTeamUpgrade, formatPlanGateError, offerTeamUpgrade, offerUpgradeLink, planGateErrorFromVaultError, } from "./utils/plan-gate-error.js";
 import { upgradeToTeam } from "./utils/team-upgrade.js";
@@ -170,7 +170,13 @@ export async function runCli() {
     const isAuthLogin = process.argv[2] === "auth" && process.argv[3] === "login";
     if (!isAuthLogin) {
         runGlobalNetworkLifecycle(process.argv, () => {
-            void kickFlagRegistryReadiness({ sentry: Sentry });
+            void kickFlagRegistryReadiness({
+                sentry: Sentry,
+                argv: process.argv,
+                ...(isMachineIdentity()
+                    ? { idToken: loadMachineCachedTokens()?.idToken }
+                    : {}),
+            });
         });
     }
     // Set when a self-update re-exec'd this command on a newer CLI: the child

package/dist/secrets-env-action.d.ts

@@ -0,0 +1,103 @@
+import { writeSync } from "node:fs";
+/**
+ * A browser login is safe only when a person can answer it. This mirrors the
+ * repository's existing terminal convention in `canOfferTeamUpgrade`: both
+ * stdin and stderr must be TTYs, and CI is always non-interactive.
+ */
+export declare function secretsCredentialOptions(): {
+    interactive: boolean;
+};
+export interface SecretsScopeOpts {
+    company?: string;
+    personal?: boolean;
+}
+export declare function scopeOpts(opts: SecretsScopeOpts): {
+    personal: boolean;
+    companySlug: string | undefined;
+};
+export type SecretTier = "standard" | "sensitive" | "nuclear";
+export type SecretScriptLockMode = "off" | "enforced";
+export type SecretUsageChannel = "run" | "exec" | "env" | "sandbox" | "reveal" | "submit-link";
+export interface SecretScriptUsage {
+    scriptId: string;
+    path: string;
+    sha256: string;
+    attestationLevel: string;
+}
+export interface SecretUsage {
+    channel: SecretUsageChannel;
+    reason?: string;
+    script?: SecretScriptUsage;
+}
+export interface SecretMetadata {
+    tier?: SecretTier;
+    scriptLock?: {
+        mode?: SecretScriptLockMode;
+        requiredAttestation?: string;
+    };
+    cacheTtlMs?: number;
+    revokedAt?: string | null;
+}
+export interface SecretLoadSuccessRow extends SecretMetadata {
+    name: string;
+    value?: string;
+    version?: number;
+}
+export interface SecretLoadResponse {
+    secrets: SecretLoadSuccessRow[];
+    errors: Array<{
+        name: string;
+        code: string;
+        message?: string;
+    }>;
+}
+export declare function highSecuritySandboxOnlyMessage(secretName?: string): string;
+export declare function normalizeSecretTier(tier?: string): SecretTier;
+export declare function normalizeScriptLockMode(mode?: string): SecretScriptLockMode;
+export declare function extractApiMessage(body: Record<string, unknown>, fallback: string): string;
+export declare function buildSecretUsage(channel: SecretUsageChannel, scriptPath?: string, scriptId?: string, attestationLevel?: string): Promise<SecretUsage>;
+export declare function parseSecretNameList(input: string[] | undefined): string[];
+export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
+    allowOfflineFallback?: boolean;
+}): Promise<Map<string, string>>;
+/**
+ * Emit `hq secrets env` output and terminate deterministically.
+ *
+ * The process MUST exit even when the consuming pipe has gone away. The
+ * orphaned-process leak (personal/projects/hq-secrets-process-leak) was caused
+ * by relying on `process.stdout.write(payload, () => process.exit(0))`: when the
+ * parent shell reading `source <(hq secrets env …)` is killed on timeout, the
+ * stdout pipe loses its reader, the write callback never fires, `process.exit(0)`
+ * is never reached, and — because `env` forces no other exit — the process parks
+ * in `epoll_pwait(-1)` forever, reparented to PID 1. Hundreds accumulated this
+ * way, exhausting swap and driving load into triple digits.
+ *
+ * Writing synchronously to fd 1 and then exiting unconditionally removes every
+ * dependency on the event loop draining and on the reader still being attached:
+ * - a live reader receives the export lines (synchronous write reaches the
+ *   kernel pipe buffer before we exit, so nothing is truncated);
+ * - a dead reader surfaces as EPIPE, which we swallow — the secret is already
+ *   resolved and there is nothing left to deliver, so a clean exit is correct;
+ * - EAGAIN (stdout in non-blocking mode with a momentarily full buffer) is
+ *   retried a bounded number of times. `env` payloads are a few short export
+ *   lines, far under the 64 KiB pipe buffer, so this effectively never spins.
+ *
+ * `exit` and `write` are injectable for tests; production uses the real ones.
+ */
+export declare function emitEnvExportsAndExit(payload: string, exit?: (code: number) => never, write?: typeof writeSync): never;
+/**
+ * Shared `secrets env` action for Commander and the default-off lightweight
+ * entrypoint. The fast entrypoint still runs the same credential, usage-audit,
+ * server authorization, cache-fallback, redaction, and output code.
+ */
+export declare function runSecretsEnvCommand(opts: {
+    only: string[];
+    script?: string;
+    scriptId?: string;
+}, parentScope: {
+    company?: string;
+    personal?: boolean;
+}, options?: {
+    fallbackOnAuthFailure?: boolean;
+}): Promise<"handled" | "fallback">;
+//# sourceMappingURL=secrets-env-action.d.ts.map