@indigoai-us/hq-cli 5.342.2 → 5.342.3

package/dist/lib/flag-registry-worker.js

@@ -20,7 +20,9 @@ async function refresh() {
             endpoint,
             ...(companyUid ? { companyUid } : {}),
             ...(companyIdentifiers.length ? { companyIdentifiers } : {}),
-            getToken: () => loadCachedTokens()?.idToken ?? "",
+            getToken: () => typeof data.idToken === "string" && data.idToken.length > 0
+                ? data.idToken
+                : loadCachedTokens()?.idToken ?? "",
             refreshIntervalMs: 0,
             onError: () => { },
         });
@@ -28,9 +30,12 @@ async function refresh() {
         const snapshot = client.snapshot();
         if (snapshot)
             parentPort.postMessage(snapshot);
+        else
+            parentPort.postMessage({ status: "snapshot_unavailable" });
     }
     catch {
         // The parent is deliberately fail-open and has the legacy fallback.
+        parentPort?.postMessage({ status: "snapshot_unavailable" });
     }
 }
 void refresh();

package/dist/lib/flag-registry.d.ts

@@ -15,11 +15,18 @@ export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 export type FlagReader = Pick<FlagClient, "isEnabled">;
 interface WorkerLike {
     on(event: "message", listener: (value: unknown) => void): unknown;
-    on(event: "error", listener: () => void): unknown;
+    on(event: "error", listener: (error: Error) => void): unknown;
+    ref?(): unknown;
     unref(): void;
 }
 export interface FlagRegistryDependencies {
     endpoint?: string;
+    /** An explicit `--company` scope, which takes precedence over ambient binding. */
+    companyScope?: string;
+    /** CLI argv used to resolve explicit company scope before the command parser runs. */
+    argv?: readonly string[];
+    /** Optional machine ID token already cached by the CLI, never logged or persisted. */
+    idToken?: string;
     createWorker?: (filename: string | URL, options: WorkerOptions) => WorkerLike;
     sentry?: FlagRegistrySentry;
     /** Test seam for exercising the no-source fail-open path. */
@@ -31,6 +38,10 @@ export interface CompanyFlagGateDependencies {
     requestTimeoutMs?: number;
     createClient?: typeof createFlagClient;
 }
+/** Extract only a CLI-level --company option; values after `--` belong to child commands. */
+export declare function explicitCompanyScopeFromArgv(argv: readonly string[]): string | undefined;
+/** Wait briefly for the current company refresh to persist or report completion. */
+export declare function waitForFlagRegistryRefresh(timeoutMs?: number, companyUid?: string): Promise<void>;
 /** Create the same snapshot-backed reader used by process gates. */
 export declare function createProcessSnapshotReader(companyIdentifiers: string[], getSnapshot?: () => FlagSnapshot | null, env?: NodeJS.ProcessEnv): FlagReader;
 /**

package/dist/lib/flag-registry.js

@@ -10,6 +10,7 @@ import { createFlagClient, isFlagSnapshot, readLocalOverride, resolveFlag, } fro
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
 import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
 import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
+import { registerFlagRegistryRefreshWaiter } from "./flag-registry-refresh-wait.js";
 import { writeFlagSnapshotFile } from "./flag-snapshot-file.js";
 function captureFlagRegistryException(error, tags, sentry) {
     if (!sentry)
@@ -19,12 +20,74 @@ function captureFlagRegistryException(error, tags, sentry) {
 export { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
 export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
+/** Extract only a CLI-level --company option; values after `--` belong to child commands. */
+export function explicitCompanyScopeFromArgv(argv) {
+    for (let index = 2; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === "--")
+            return undefined;
+        if (argument === "--company") {
+            const value = argv[index + 1]?.trim();
+            return value && !value.startsWith("-") ? value : undefined;
+        }
+        if (argument.startsWith("--company=")) {
+            const value = argument.slice("--company=".length).trim();
+            return value || undefined;
+        }
+    }
+    return undefined;
+}
 function normalizedCompanyUid(value) {
     const candidate = value?.trim() ?? "";
     return COMPANY_UID_RE.test(candidate) ? candidate : undefined;
 }
 let heldSnapshot = null;
 let processReader = null;
+let refreshCompletion = Promise.resolve();
+let completeRefresh = null;
+let refreshWorker = null;
+let refreshCompanyUid;
+let refreshPendingSnapshot = null;
+let refreshSentry;
+/** Wait briefly for the current company refresh to persist or report completion. */
+export async function waitForFlagRegistryRefresh(timeoutMs = 500, companyUid) {
+    const resolvedCompanyUid = normalizedCompanyUid(companyUid);
+    if (resolvedCompanyUid)
+        refreshCompanyUid = resolvedCompanyUid;
+    if (refreshPendingSnapshot && refreshCompanyUid) {
+        try {
+            writeFlagSnapshotFile(refreshCompanyUid, refreshPendingSnapshot.flags);
+        }
+        catch (error) {
+            captureFlagRegistryException(error instanceof Error ? error : new Error(String(error)), {
+                component: "flag-snapshot-cache-write",
+                company_uid_present: "true",
+            }, refreshSentry);
+        }
+        refreshPendingSnapshot = null;
+        completeRefresh?.();
+        completeRefresh = null;
+    }
+    if (!completeRefresh)
+        return;
+    const worker = refreshWorker;
+    worker?.ref?.();
+    let timer;
+    try {
+        await Promise.race([
+            refreshCompletion,
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, Math.max(0, timeoutMs));
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        worker?.unref();
+    }
+}
+registerFlagRegistryRefreshWaiter(waitForFlagRegistryRefresh);
 function processLocalOverride(flagKey, env = process.env) {
     return readLocalOverride(flagKey, env);
 }
@@ -61,10 +124,37 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
     if (processReader)
         return processReader;
     const endpoint = resolveFlagRegistryEndpoint(dependencies.endpoint, process.env);
-    const company = resolveProcessFlagCompanyContext();
+    const companyScope = dependencies.companyScope ?? explicitCompanyScopeFromArgv(dependencies.argv ?? []);
+    const companyEnv = companyScope
+        ? {
+            ...process.env,
+            HQ_COMPANY_UID: COMPANY_UID_RE.test(companyScope)
+                ? companyScope
+                : "",
+            HQ_COMPANY_SLUG: COMPANY_UID_RE.test(companyScope)
+                ? ""
+                : companyScope,
+        }
+        : process.env;
+    const company = resolveProcessFlagCompanyContext(companyEnv);
     const sentry = dependencies.sentry;
     const companyUid = company.companyUid;
     const companyIdentifiers = [companyUid, company.companySlug].filter((value) => Boolean(value));
+    refreshCompletion = Promise.resolve();
+    completeRefresh = null;
+    refreshWorker = null;
+    refreshCompanyUid = companyUid;
+    refreshPendingSnapshot = null;
+    refreshSentry = sentry;
+    if (companyUid || company.companySlug) {
+        refreshCompletion = new Promise((resolve) => {
+            completeRefresh = resolve;
+        });
+    }
+    const finishRefresh = () => {
+        completeRefresh?.();
+        completeRefresh = null;
+    };
     processReader = processSnapshotReader(companyIdentifiers);
     try {
         const embeddedSource = dependencies.workerSource ?? FLAG_REGISTRY_WORKER_SOURCE;
@@ -76,6 +166,7 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                 worker: "flag-registry",
                 flag_worker_failure: "embedded_source_unavailable",
             });
+            finishRefresh();
             return processReader;
         }
         // This source is embedded at build time, so it remains available while an
@@ -85,6 +176,9 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                 endpoint,
                 ...(companyUid ? { companyUid } : {}),
                 ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
+                ...((companyUid || company.companySlug) && dependencies.idToken
+                    ? { idToken: dependencies.idToken }
+                    : {}),
             },
             eval: true,
         };
@@ -100,12 +194,22 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                 return createWorker(embeddedSource, workerOptions);
             })
             : createWorker(embeddedSource, workerOptions);
+        refreshWorker = worker;
+        let released = false;
+        const releaseWorker = () => {
+            if (released)
+                return;
+            released = true;
+            worker.unref();
+        };
         worker.on("message", (value) => {
             if (isFlagSnapshot(value)) {
                 heldSnapshot = value;
-                if (companyUid) {
+                if (completeRefresh)
+                    refreshPendingSnapshot = value;
+                if (refreshCompanyUid && refreshPendingSnapshot) {
                     try {
-                        writeFlagSnapshotFile(companyUid, value.flags);
+                        writeFlagSnapshotFile(refreshCompanyUid, value.flags);
                     }
                     catch (error) {
                         captureFlagRegistryException(error instanceof Error ? error : new Error(String(error)), {
@@ -113,18 +217,28 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                             company_uid_present: "true",
                         }, sentry);
                     }
+                    refreshPendingSnapshot = null;
+                    finishRefresh();
                 }
             }
+            else {
+                finishRefresh();
+            }
+            releaseWorker();
         });
         // A failed background refresh must stay invisible to an offline CLI.
-        worker.on("error", () => { });
+        worker.on("error", () => {
+            finishRefresh();
+            releaseWorker();
+        });
         // Attach listeners first: Worker.on() re-refs the worker, so unref must be
         // last for the parent process to remain free to exit immediately.
-        worker.unref();
+        releaseWorker();
     }
     catch {
         // Construction can fail in restricted Node runtimes. The reader is still
         // safe: it has no snapshot, so it resolves through the legacy vocabulary.
+        finishRefresh();
     }
     return processReader;
 }
@@ -198,5 +312,11 @@ export function currentFlagSnapshot() {
 export function _resetFlagRegistryForTests() {
     heldSnapshot = null;
     processReader = null;
+    refreshCompletion = Promise.resolve();
+    completeRefresh = null;
+    refreshWorker = null;
+    refreshCompanyUid = undefined;
+    refreshPendingSnapshot = null;
+    refreshSentry = undefined;
 }
 //# sourceMappingURL=flag-registry.js.map

package/dist/main.js

@@ -37,7 +37,7 @@ import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
 import { isAuthError } from "./utils/auth-error.js";
 import { browserLoginAbandonedMessage } from "./utils/browser-login-abandoned.js";
 import { callbackPortBusyMessage, DEFAULT_CALLBACK_PORT } from "./utils/callback-port-busy.js";
-import { DEFAULT_COGNITO } from "./utils/cognito-session.js";
+import { DEFAULT_COGNITO, isMachineIdentity, loadMachineCachedTokens, } from "./utils/cognito-session.js";
 import { isCompanySelectionError } from "./utils/company-selection-error.js";
 import { canOfferTeamUpgrade, formatPlanGateError, offerTeamUpgrade, offerUpgradeLink, planGateErrorFromVaultError, } from "./utils/plan-gate-error.js";
 import { upgradeToTeam } from "./utils/team-upgrade.js";
@@ -170,7 +170,13 @@ export async function runCli() {
     const isAuthLogin = process.argv[2] === "auth" && process.argv[3] === "login";
     if (!isAuthLogin) {
         runGlobalNetworkLifecycle(process.argv, () => {
-            void kickFlagRegistryReadiness({ sentry: Sentry });
+            void kickFlagRegistryReadiness({
+                sentry: Sentry,
+                argv: process.argv,
+                ...(isMachineIdentity()
+                    ? { idToken: loadMachineCachedTokens()?.idToken }
+                    : {}),
+            });
         });
     }
     // Set when a self-update re-exec'd this command on a newer CLI: the child

package/dist/secrets-env-action.js

@@ -6,6 +6,7 @@ import { isAuthError } from "./utils/auth-error.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntry, writeCache, } from "./utils/secrets-cache.js";
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
+import { finishEnvExportsAndExit } from "./commands/secrets-env-exit.js";
 import { getEntityUid, vaultApiFetch } from "./utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, resolveVaultCredentialForCapability, } from "./utils/resolve-vault-credential.js";
 import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "./utils/secret-load-availability.js";
@@ -436,10 +437,9 @@ export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
             const out = redact ? "[REDACTED]" : value;
             payload += `export ${key}=${shellSingleQuote(out)}\n`;
         }
-        // Write synchronously and exit unconditionally — never depend on the
-        // event loop draining or the stdout write callback firing. See
-        // emitEnvExportsAndExit for the full rationale (orphaned-process leak).
-        emitEnvExportsAndExit(payload);
+        // Persist an already-running company snapshot before the synchronous
+        // export write exits the process. Personal exports do not wait.
+        await finishEnvExportsAndExit(payload, undefined, process.exit, undefined, !parentScope.personal, companyUid);
         return "handled";
     }
     catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.2",
+  "version": "5.342.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {