@indigoai-us/hq-cli 5.77.6 → 5.77.8

package/src/commands/secrets.test.ts

@@ -1723,6 +1723,46 @@ describe("secrets reveal and policy controls", () => {
     expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
   });
 
+  it("script approve hashes the local file while approving a remote runtime path", async () => {
+    const scriptPath = join(tempDir, "approved.sh");
+    const remotePath =
+      "/home/ec2-user/hq-agent/companies/acme/scripts/approved.sh";
+    const scriptBody = "#!/usr/bin/env bash\necho approved remotely\n";
+    writeFileSync(scriptPath, scriptBody);
+    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "script",
+      "approve",
+      "LOCKED",
+      "--id",
+      "deploy-script",
+      "--script",
+      scriptPath,
+      "--remote-path",
+      remotePath,
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/policy/scripts",
+      method: "POST",
+      body: {
+        path: "LOCKED",
+        scriptId: "deploy-script",
+        scriptPath: remotePath,
+        sha256: expectedSha,
+        attestationLevel: "self-asserted-hash",
+      },
+    });
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
+  });
+
   it("script revoke hits the revoke endpoint", async () => {
     vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
 

package/src/commands/secrets.ts

@@ -1360,6 +1360,10 @@ export function registerSecretsCommand(program: Command): void {
     .description("Approve a script for a secret path")
     .requiredOption("--id <scriptId>", "Stable script identifier")
     .requiredOption("--script <path>", "Path to the local script file")
+    .option(
+      "--remote-path <path>",
+      "Script path reported by the target runtime (defaults to the local path)",
+    )
     .option(
       "--attestation <level>",
       "Attestation level",
@@ -1367,7 +1371,12 @@ export function registerSecretsCommand(program: Command): void {
     )
     .action(async (
       secretPath: string,
-      opts: { id: string; script: string; attestation: string },
+      opts: {
+        id: string;
+        script: string;
+        remotePath?: string;
+        attestation: string;
+      },
     ) => {
       try {
         rejectIfPersonal(secrets.opts(), "script approve");
@@ -1395,7 +1404,7 @@ export function registerSecretsCommand(program: Command): void {
           body: {
             path: secretPath,
             scriptId: usage.script?.scriptId,
-            scriptPath: usage.script?.path,
+            scriptPath: opts.remotePath ?? usage.script?.path,
             sha256: usage.script?.sha256,
             attestationLevel: usage.script?.attestationLevel,
           },

package/src/utils/version-gate.test.ts

@@ -436,4 +436,180 @@ describe("enforceVersionGate — hard-update path", () => {
     expect(exitSpy).toHaveBeenCalledWith(75);
     expect(runner).toHaveBeenCalledWith("sudo", expect.arrayContaining(["-n"]));
   });
+
+  it("cleans a stale partial install and retries once when the unprivileged install fails with ENOTEMPTY", async () => {
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = vi
+      .spyOn(process, "exit")
+      .mockImplementation(((code?: number) => {
+        throw new Error(`__process_exit__:${code ?? 0}`);
+      }) as never);
+    // The reported failure: `npm install -g --prefix <toolchain> …` fails with
+    // ENOTEMPTY renaming a partial `hq-cli`. sudo does NOT fix a corrupt dir —
+    // only removing the stale artifacts and reinstalling does. Before this fix
+    // the gate exhausted npm→sudo→exit 75, leaving `hq` broken (ENOENT).
+    let npmCalls = 0;
+    const runner = vi.fn().mockImplementation((cmd: string) => {
+      if (cmd === "sudo") return { ok: false, detail: "ENOTEMPTY" };
+      npmCalls += 1;
+      return npmCalls === 1 ? { ok: false, detail: "ENOTEMPTY" } : { ok: true };
+    });
+    const prefix =
+      "/Users/x/Library/Application Support/Indigo HQ/toolchain/npm-global";
+    const cleanStale = vi
+      .fn()
+      .mockReturnValue([`${prefix}/lib/node_modules/@indigoai-us/.hq-cli-0DY3ww6z`]);
+    const { __test__ } = await loadModule();
+
+    expect(() =>
+      __test__.enforceUpdateRequired(
+        {
+          clientId: "hq-cli",
+          currentVersion: "5.10.0",
+          minVersion: "5.20.0",
+          latestVersion: "5.24.0",
+          updateRequired: true,
+          updateRecommended: false,
+          updateCommand: "npm install -g @indigoai-us/hq-cli@latest",
+        },
+        { resolvePrefix: () => prefix, runner, cleanStale },
+      ),
+    ).toThrow(/__process_exit__:0/); // recovers after the cleanup + retry
+
+    expect(exitSpy).toHaveBeenCalledWith(0);
+    expect(cleanStale).toHaveBeenCalledWith(prefix);
+    const installArgs = [
+      "install",
+      "-g",
+      "--prefix",
+      prefix,
+      "@indigoai-us/hq-cli@latest",
+    ];
+    // primary attempt + one retry after the stale artifacts were removed
+    expect(
+      runner.mock.calls.filter((c) => c[0] === "npm").length,
+    ).toBe(2);
+    expect(runner).toHaveBeenCalledWith("npm", installArgs);
+    // sudo must NOT be reached — the ENOTEMPTY was fixed by cleanup, not perms
+    expect(runner).not.toHaveBeenCalledWith("sudo", expect.anything());
+  });
+
+  it("does NOT reinstall-after-clean when nothing stale exists (plain EACCES falls straight to sudo)", async () => {
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = vi
+      .spyOn(process, "exit")
+      .mockImplementation(((code?: number) => {
+        throw new Error(`__process_exit__:${code ?? 0}`);
+      }) as never);
+    const runner = vi
+      .fn()
+      .mockImplementation((cmd: string) =>
+        cmd === "sudo" ? { ok: true } : { ok: false, detail: "EACCES" },
+      );
+    const cleanStale = vi.fn().mockReturnValue([]); // healthy prefix, nothing to remove
+    const { __test__ } = await loadModule();
+
+    expect(() =>
+      __test__.enforceUpdateRequired(
+        {
+          clientId: "hq-cli",
+          currentVersion: "5.10.0",
+          minVersion: "5.20.0",
+          latestVersion: "5.24.0",
+          updateRequired: true,
+          updateRecommended: false,
+          updateCommand: "npm install -g @indigoai-us/hq-cli@latest",
+        },
+        { resolvePrefix: () => "/usr", runner, cleanStale },
+      ),
+    ).toThrow(/__process_exit__:0/); // sudo retry succeeds
+
+    expect(exitSpy).toHaveBeenCalledWith(0);
+    expect(cleanStale).toHaveBeenCalledWith("/usr");
+    // exactly ONE npm attempt (no redundant reinstall), then sudo
+    expect(runner.mock.calls.filter((c) => c[0] === "npm").length).toBe(1);
+    expect(runner).toHaveBeenCalledWith("sudo", expect.arrayContaining(["-n"]));
+  });
+});
+
+describe("cleanStalePartialInstall", () => {
+  type FakeTree = {
+    dirs: Record<string, string[]>;
+    packageJson: Record<string, string | null>;
+    existing: Set<string>;
+  };
+
+  function makeFakeFs(tree: FakeTree) {
+    const removed: string[] = [];
+    const fs = {
+      readdirSync: (dir: string) => {
+        if (dir in tree.dirs) return tree.dirs[dir]!;
+        throw new Error(`ENOENT: ${dir}`);
+      },
+      existsSync: (target: string) => tree.existing.has(target),
+      readFileSync: (target: string) => {
+        const pkgDir = target.replace(/\/package\.json$/, "");
+        const content = tree.packageJson[pkgDir];
+        if (content == null) throw new Error(`ENOENT: ${target}`);
+        return content;
+      },
+      rmSync: (target: string) => {
+        removed.push(target);
+      },
+    };
+    return { fs, removed };
+  }
+
+  it("removes the npm staging dir and a partial package dir, but keeps unrelated entries", async () => {
+    const { __test__ } = await loadModule();
+    const prefix = "/p";
+    const scopeDir = "/p/lib/node_modules/@indigoai-us";
+    const { fs, removed } = makeFakeFs({
+      dirs: {
+        [scopeDir]: [".hq-cli-0DY3ww6z", "hq-cli", "some-other-pkg"],
+      },
+      packageJson: { [`${scopeDir}/hq-cli`]: null }, // partial: package.json unreadable
+      existing: new Set([`${scopeDir}/hq-cli`]),
+    });
+
+    const result = __test__.cleanStalePartialInstall(prefix, fs);
+
+    expect(result).toContain(`${scopeDir}/.hq-cli-0DY3ww6z`);
+    expect(result).toContain(`${scopeDir}/hq-cli`);
+    expect(removed).not.toContain(`${scopeDir}/some-other-pkg`);
+  });
+
+  it("never touches a healthy install (valid package.json with matching name)", async () => {
+    const { __test__ } = await loadModule();
+    const scopeDir = "/p/lib/node_modules/@indigoai-us";
+    const { fs, removed } = makeFakeFs({
+      dirs: { [scopeDir]: ["hq-cli"] }, // no staging leftovers
+      packageJson: {
+        [`${scopeDir}/hq-cli`]: JSON.stringify({
+          name: "@indigoai-us/hq-cli",
+          version: "5.24.0",
+        }),
+      },
+      existing: new Set([`${scopeDir}/hq-cli`]),
+    });
+
+    const result = __test__.cleanStalePartialInstall("/p", fs);
+
+    expect(result).toEqual([]);
+    expect(removed).toEqual([]);
+  });
+
+  it("also cleans a staging dir under the bare <prefix>/node_modules layout", async () => {
+    const { __test__ } = await loadModule();
+    const scopeDir = "/p/node_modules/@indigoai-us";
+    const { fs } = makeFakeFs({
+      dirs: { [scopeDir]: [".hq-cli-abc123"] },
+      packageJson: {},
+      existing: new Set(),
+    });
+
+    const result = __test__.cleanStalePartialInstall("/p", fs);
+
+    expect(result).toEqual([`${scopeDir}/.hq-cli-abc123`]);
+  });
 });

package/src/utils/version-gate.ts

@@ -29,7 +29,7 @@
  */
 
 import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
@@ -104,6 +104,109 @@ export function buildPrefixedInstallArgv(prefix: string): string[] {
   return ["install", "-g", "--prefix", prefix, LATEST_PACKAGE_SPEC];
 }
 
+/**
+ * Filesystem surface used by {@link cleanStalePartialInstall}. Injected so the
+ * cleanup logic is unit-testable without touching a real global prefix.
+ */
+export interface StaleInstallFs {
+  readdirSync: (dir: string) => string[];
+  existsSync: (target: string) => boolean;
+  readFileSync: (target: string, encoding: "utf-8") => string;
+  rmSync: (target: string, options: { recursive: boolean; force: boolean }) => void;
+}
+
+const nodeStaleInstallFs: StaleInstallFs = {
+  readdirSync: (dir) => readdirSync(dir),
+  existsSync,
+  readFileSync: (target, encoding) => readFileSync(target, encoding),
+  rmSync,
+};
+
+function isHealthyPackageDir(pkgDir: string, fs: StaleInstallFs): boolean {
+  try {
+    const pkg = JSON.parse(
+      fs.readFileSync(path.join(pkgDir, "package.json"), "utf-8"),
+    ) as { name?: unknown };
+    return pkg.name === CLI_NAME;
+  } catch {
+    return false; // missing / unreadable / malformed package.json ⇒ partial
+  }
+}
+
+/**
+ * Remove leftover artifacts from an interrupted `npm install -g` so a retry can
+ * succeed. npm unpacks a package into a `.<pkg>-<rand>` staging dir alongside
+ * the final location and then renames it into place; if a previous run was
+ * killed mid-rename (or a half-written package dir survives), every subsequent
+ * install fails with `ENOTEMPTY` because npm cannot atomically rename over the
+ * non-empty leftover. npm does not self-heal this — the stale dir must be
+ * removed first.
+ *
+ * To stay safe we only ever delete:
+ *   - dot-prefixed npm staging dirs for THIS package (`.hq-cli-*`), and
+ *   - a package dir whose `package.json` is missing/unreadable or whose `name`
+ *     is not exactly {@link CLI_NAME} (i.e. a genuinely partial/foreign dir).
+ *
+ * A healthy install (valid `package.json`, `name === CLI_NAME`) is never
+ * touched, so an ordinary version bump still flows through npm untouched.
+ *
+ * Returns the list of removed paths — empty when there was nothing to clean, so
+ * callers can gate a reinstall retry on `removed.length > 0`.
+ */
+export function cleanStalePartialInstall(
+  prefix: string,
+  fs: StaleInstallFs = nodeStaleInstallFs,
+): string[] {
+  const removed: string[] = [];
+  const slash = CLI_NAME.indexOf("/");
+  const scope = slash === -1 ? null : CLI_NAME.slice(0, slash);
+  const leaf = slash === -1 ? CLI_NAME : CLI_NAME.slice(slash + 1);
+  const stagingPrefix = `.${leaf}-`;
+
+  // Global npm keeps packages under `<prefix>/lib/node_modules` (unix) while a
+  // bare `--prefix` dir (windows / some sandboxes) uses `<prefix>/node_modules`.
+  const nmRoots = [
+    path.join(prefix, "lib", "node_modules"),
+    path.join(prefix, "node_modules"),
+  ];
+
+  for (const nmRoot of nmRoots) {
+    // For a scoped package the staging dir + final dir both live inside the
+    // scope dir (`.../@indigoai-us/.hq-cli-<rand>`, `.../@indigoai-us/hq-cli`).
+    const parentDir = scope ? path.join(nmRoot, scope) : nmRoot;
+    let entries: string[];
+    try {
+      entries = fs.readdirSync(parentDir);
+    } catch {
+      continue; // this node_modules / scope dir doesn't exist here
+    }
+
+    for (const entry of entries) {
+      if (!entry.startsWith(stagingPrefix)) continue;
+      const target = path.join(parentDir, entry);
+      try {
+        fs.rmSync(target, { recursive: true, force: true });
+        removed.push(target);
+      } catch {
+        // best-effort: a dir we can't remove (perms) just means the retry
+        // still fails and we fall through to the sudo / manual path.
+      }
+    }
+
+    const pkgDir = path.join(parentDir, leaf);
+    if (fs.existsSync(pkgDir) && !isHealthyPackageDir(pkgDir, fs)) {
+      try {
+        fs.rmSync(pkgDir, { recursive: true, force: true });
+        removed.push(pkgDir);
+      } catch {
+        // best-effort (see above)
+      }
+    }
+  }
+
+  return removed;
+}
+
 /**
  * Hit POST /v1/client-version/check. Returns the parsed body on 200, or
  * `null` on any failure (caller treats as "no gate"). Tight 3s timeout —
@@ -213,6 +316,7 @@ function enforceUpdateRequired(
     performUpdateString?: (command: string) => UpdateResult;
     resolvePrefix?: () => string | null;
     runner?: UpdateRunner;
+    cleanStale?: (prefix: string) => string[];
   } = {},
 ): never {
   const banner = chalk.red.bold(
@@ -262,6 +366,27 @@ function enforceUpdateRequired(
           : performUpdate(command!, runner);
       })();
 
+  // A partial/corrupt global install leaves npm unable to atomically rename its
+  // freshly-unpacked package over a leftover directory, so the install above
+  // fails with ENOTEMPTY (e.g. a prior interrupted `npm install -g` left a
+  // half-written `hq-cli` package dir or a `.hq-cli-<rand>` staging dir under
+  // the prefix's node_modules). npm cannot self-heal this. Remove the stale
+  // artifacts and retry the install ONCE. Guarded on `cleaned.length > 0` so a
+  // plain EACCES on an otherwise-healthy prefix falls straight through to the
+  // sudo retry below without a redundant reinstall attempt.
+  if (!result.ok && prefix) {
+    const cleaner = deps.cleanStale ?? cleanStalePartialInstall;
+    const cleaned = cleaner(prefix);
+    if (cleaned.length > 0) {
+      console.error(
+        chalk.dim(
+          `  Removing stale partial install artifacts and retrying: ${cleaned.join(", ")}`,
+        ),
+      );
+      result = performUpdateCommand("npm", primaryArgs, runner);
+    }
+  }
+
   // A root-owned global install (e.g. a system `/usr` install where the CLI runs
   // unprivileged — the outpost agent boxes) can't rewrite the prefix's bin dir,
   // so the install above fails with EACCES (`rename /usr/bin/hq`). Retry ONCE
@@ -341,6 +466,7 @@ export const __test__ = {
   ENDPOINT_PATH,
   FETCH_TIMEOUT_MS,
   buildPrefixedInstallArgv,
+  cleanStalePartialInstall,
   enforceUpdateRequired,
   npmPrefixFromPackageDir,
   performUpdate,