@indigoai-us/hq-cli 5.47.9 → 5.47.11

package/src/run/hq-plugin.test.ts

@@ -16,6 +16,7 @@ import {
 vi.mock('../utils/secrets-cache.js', () => {
   const store = new Map<string, string>();
   return {
+    DEFAULT_SECRETS_CACHE_TTL_MS: 300000,
     readCache: (uid: string, name: string): string | null =>
       store.get(`${uid}\0${name}`) ?? null,
     writeCache: (uid: string, name: string, value: string): void => {
@@ -73,6 +74,36 @@ describe('hq-plugin', () => {
     expect(graph.getResolvedEnvObject().FOO).toBe('fixture-value');
   });
 
+  it('zero-cache secrets still resolve from in-memory prewarm state within a single run', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async (_uid, names) => ({
+        secrets: names.map((name) => ({
+          name,
+          value: 'memory-only-value',
+          cacheTtlMs: 0,
+        })),
+        errors: [],
+      }),
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+    await prewarmHqSecrets(graph, mocks, state);
+    await graph.resolveEnvValues();
+
+    expect(graph.getResolvedEnvObject().FOO).toBe('memory-only-value');
+  });
+
   it('missing-company-error: throws when no @hqCompany and no companyOverride', async () => {
     const schemaPath = path.join(tmpDir, '.env.schema');
     // Schema has hq() resolver but no @hqCompany annotation and no opts.companyOverride

package/src/run/hq-plugin.ts

@@ -1,20 +1,34 @@
 import { ResolutionError } from 'varlock/plugin-lib';
 import type { Resolver } from 'varlock/plugin-lib';
-import { readCache, writeCache } from '../utils/secrets-cache.js';
+import {
+  DEFAULT_SECRETS_CACHE_TTL_MS,
+  readCache,
+  writeCache,
+} from '../utils/secrets-cache.js';
+import type { SecretLoadResponse, SecretUsage } from '../commands/secrets.js';
+
+function normalizeCacheTtlMs(cacheTtlMs?: number): number {
+  return typeof cacheTtlMs === 'number'
+    ? cacheTtlMs
+    : DEFAULT_SECRETS_CACHE_TTL_MS;
+}
 
 export interface InstallHqPluginOpts {
   companyOverride?: string;
   resolveCompanyUid: (slug: string) => Promise<string>;
-  fetchBatch: (uid: string, names: string[]) => Promise<{
-    secrets: Array<{ name: string; value: string }>;
-    errors: Array<{ name: string; code: string; message?: string }>;
-  }>;
+  usage?: SecretUsage;
+  fetchBatch: (
+    uid: string,
+    names: string[],
+    usage?: SecretUsage,
+  ) => Promise<SecretLoadResponse>;
 }
 
 export interface PluginState {
   schemaCompanySlug: string | null;
   uid: string | null;
   errorsByName: Map<string, { code: string; message?: string }>;
+  loadedSecretsByName: Map<string, string>;
 }
 
 export function installHqPlugin(graph: any /* EnvGraph */, opts: InstallHqPluginOpts) {
@@ -22,6 +36,7 @@ export function installHqPlugin(graph: any /* EnvGraph */, opts: InstallHqPlugin
     schemaCompanySlug: null,
     uid: null,
     errorsByName: new Map(),
+    loadedSecretsByName: new Map(),
   };
 
   // varlock@1.0.0's plugin-lib.js omits the Resolver export (d.ts/JS mismatch);
@@ -80,6 +95,10 @@ export function installHqPlugin(graph: any /* EnvGraph */, opts: InstallHqPlugin
         if (pluginState.uid == null) {
           throw new ResolutionError('Internal error: prewarmHqSecrets was not called before resolveEnvValues');
         }
+        const inMemory = pluginState.loadedSecretsByName.get(secretName);
+        if (inMemory != null) {
+          return inMemory;
+        }
         const cached = readCache(pluginState.uid, secretName); // string | null
         if (cached == null) {
           throw new ResolutionError(`Internal error: pre-warm did not populate cache for "${secretName}"`);
@@ -160,10 +179,17 @@ export async function prewarmHqSecrets(
       `hq run supports at most 100 hq() resolvers per schema; got ${uniqueNames.length}`,
     );
   }
-  const result = await opts.fetchBatch(uid, uniqueNames);
+  const result = await opts.fetchBatch(uid, uniqueNames, opts.usage);
 
   for (const s of result.secrets) {
-    writeCache(uid, s.name, s.value);
+    if (s.value == null) {
+      continue;
+    }
+    state.loadedSecretsByName.set(s.name, s.value);
+    const cacheTtlMs = normalizeCacheTtlMs(s.cacheTtlMs);
+    if (cacheTtlMs > 0) {
+      writeCache(uid, s.name, s.value, cacheTtlMs);
+    }
   }
   const errorsByName = new Map<string, { code: string; message?: string }>();
   for (const e of result.errors) {

package/src/utils/integrity.ts

@@ -10,23 +10,28 @@ import { resolveDefaultHqRoot } from './cognito-session.js';
 /**
  * Verify a file's SHA256 hash matches the expected value.
  */
-export async function verifySha256(
-  filePath: string,
-  expectedHash: string
-): Promise<boolean> {
+export async function computeSha256(filePath: string): Promise<string> {
   return new Promise((resolve, reject) => {
     const hash = crypto.createHash('sha256');
     const stream = fs.createReadStream(filePath);
 
     stream.on('data', (chunk) => hash.update(chunk));
-    stream.on('end', () => {
-      const computed = hash.digest('hex');
-      resolve(computed === expectedHash.toLowerCase());
-    });
+    stream.on('end', () => resolve(hash.digest('hex')));
     stream.on('error', reject);
   });
 }
 
+/**
+ * Verify a file's SHA256 hash matches the expected value.
+ */
+export async function verifySha256(
+  filePath: string,
+  expectedHash: string
+): Promise<boolean> {
+  const computed = await computeSha256(filePath);
+  return computed === expectedHash.toLowerCase();
+}
+
 /**
  * Verify an RSA signature of a SHA256 hash using the registry public key.
  * The public key is expected at packages/.keys/registry-public.pem.

package/src/utils/secrets-cache.ts

@@ -5,10 +5,15 @@ import * as os from "node:os";
 
 const CACHE_DIR = path.join(os.homedir(), ".hq", "secrets-cache");
 const KEY_PATH = path.join(CACHE_DIR, ".key");
-const TTL_MS = 5 * 60 * 1000;
+const CACHE_FORMAT_MAGIC = Buffer.from("HQSC");
+const CACHE_FORMAT_MAGIC_BYTES = CACHE_FORMAT_MAGIC.length;
+const LEGACY_TIMESTAMP_BYTES = 8;
+const TIMESTAMP_BYTES = 8;
+const TTL_BYTES = 8;
 const ALGORITHM = "aes-256-gcm";
 const IV_BYTES = 12;
 const AUTH_TAG_BYTES = 16;
+export const DEFAULT_SECRETS_CACHE_TTL_MS = 5 * 60 * 1000;
 
 function ensureCacheDir(companyUid: string): void {
   const dir = path.join(CACHE_DIR, companyUid);
@@ -52,19 +57,40 @@ export function readCache(companyUid: string, name: string): string | null {
     return null;
   }
 
-  // Format: [8 bytes timestamp][12 bytes IV][16 bytes authTag][...ciphertext]
-  const headerLen = 8 + IV_BYTES + AUTH_TAG_BYTES;
-  if (raw.length < headerLen) return null;
+  let timestampMs: number;
+  let ttlMs: number;
+  let ivStart: number;
+  let authTagStart: number;
+  let ciphertextStart: number;
 
-  const timestampMs = Number(raw.readBigInt64BE(0));
-  if (Date.now() - timestampMs > TTL_MS) {
+  if (
+    raw.length >=
+      CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES + TTL_BYTES + IV_BYTES + AUTH_TAG_BYTES &&
+    raw.subarray(0, CACHE_FORMAT_MAGIC_BYTES).equals(CACHE_FORMAT_MAGIC)
+  ) {
+    timestampMs = Number(raw.readBigInt64BE(CACHE_FORMAT_MAGIC_BYTES));
+    ttlMs = Number(raw.readBigInt64BE(CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES));
+    ivStart = CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES + TTL_BYTES;
+    authTagStart = ivStart + IV_BYTES;
+    ciphertextStart = authTagStart + AUTH_TAG_BYTES;
+  } else {
+    const headerLen = LEGACY_TIMESTAMP_BYTES + IV_BYTES + AUTH_TAG_BYTES;
+    if (raw.length < headerLen) return null;
+    timestampMs = Number(raw.readBigInt64BE(0));
+    ttlMs = DEFAULT_SECRETS_CACHE_TTL_MS;
+    ivStart = LEGACY_TIMESTAMP_BYTES;
+    authTagStart = ivStart + IV_BYTES;
+    ciphertextStart = authTagStart + AUTH_TAG_BYTES;
+  }
+
+  if (ttlMs <= 0 || Date.now() - timestampMs > ttlMs) {
     try { fs.unlinkSync(filePath); } catch { /* ok */ }
     return null;
   }
 
-  const iv = raw.subarray(8, 8 + IV_BYTES);
-  const authTag = raw.subarray(8 + IV_BYTES, headerLen);
-  const ciphertext = raw.subarray(headerLen);
+  const iv = raw.subarray(ivStart, authTagStart);
+  const authTag = raw.subarray(authTagStart, ciphertextStart);
+  const ciphertext = raw.subarray(ciphertextStart);
 
   let key: Buffer;
   try {
@@ -84,9 +110,15 @@ export function readCache(companyUid: string, name: string): string | null {
   }
 }
 
-export function writeCache(companyUid: string, name: string, value: string): void {
+export function writeCache(
+  companyUid: string,
+  name: string,
+  value: string,
+  ttlMs = DEFAULT_SECRETS_CACHE_TTL_MS,
+): void {
   try {
     if (!validateInputs(companyUid, name)) return;
+    if (ttlMs <= 0) return;
     ensureCacheDir(companyUid);
     const key = getOrCreateKey();
     const iv = crypto.randomBytes(IV_BYTES);
@@ -96,8 +128,10 @@ export function writeCache(companyUid: string, name: string, value: string): voi
 
     const timestamp = Buffer.alloc(8);
     timestamp.writeBigInt64BE(BigInt(Date.now()));
+    const ttl = Buffer.alloc(8);
+    ttl.writeBigInt64BE(BigInt(ttlMs));
 
-    const out = Buffer.concat([timestamp, iv, authTag, encrypted]);
+    const out = Buffer.concat([CACHE_FORMAT_MAGIC, timestamp, ttl, iv, authTag, encrypted]);
     const filePath = path.join(CACHE_DIR, companyUid, name);
     fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
     const tmpPath = `${filePath}.tmp.${process.pid}`;