@indigoai-us/hq-cli 5.97.1 → 5.97.2

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+## [5.97.2]
+
+### Fixed
+
+- `hq secrets env` no longer leaks processes that never exit. Two independent
+  defects combined: the identity/company resolution lookups the command runs
+  before its real work used unbounded `fetch` calls, so a vault gateway that
+  accepted the connection but never responded left the request in-flight
+  forever; and because the CLI exits by draining the event loop rather than
+  calling `process.exit`, that one referenced socket kept the whole process
+  alive. Callers wrap the command in `source <(…)` / `$(…)`, which bash never
+  reaps, so each wedged process was orphaned to PID 1 — on one build box 592 of
+  them accumulated, holding ~23.5 GB and starving unrelated work. Every vault
+  identity lookup now carries a 15s timeout (a stuck backend becomes a normal,
+  catchable error), and `secrets env` now writes its output in one flush and
+  exits deterministically in the flush callback (no truncation of a piped
+  consumer, no reliance on the event loop draining).
+
 ## [5.97.1]
 
 ### Fixed

package/dist/commands/secrets.js

@@ -1397,6 +1397,7 @@ export function registerSecretsCommand(program) {
             const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("env", opts.script, opts.scriptId)
                 : undefined);
+            let payload = "";
             for (const key of keys) {
                 const value = revealed.get(key);
                 // loadRevealedSecrets throws on any unresolved key, so a miss here is
@@ -1405,8 +1406,18 @@ export function registerSecretsCommand(program) {
                     throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
                 }
                 const out = redact ? "[REDACTED]" : value;
-                process.stdout.write(`export ${key}=${shellSingleQuote(out)}\n`);
-            }
+                payload += `export ${key}=${shellSingleQuote(out)}\n`;
+            }
+            // Deterministically terminate once stdout has flushed. Unlike `exec`
+            // (which exits on its child's close), `env` has nothing to exit on and
+            // otherwise relies on the event loop draining — so a single lingering
+            // handle (e.g. a slow keep-alive socket to the vault) would keep this
+            // process alive forever, the mechanism behind the orphaned-process leak.
+            // Exit inside the write callback, which fires only after the bytes reach
+            // the pipe/file, so a `source <(hq secrets env …)` consumer never loses
+            // the export lines — a bare process.exit() would truncate buffered
+            // stdout on a pipe.
+            process.stdout.write(payload, () => process.exit(0));
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));

package/dist/utils/vault-api.js

@@ -4,6 +4,19 @@ import { AuthError } from './auth-error.js';
 import { CompanySelectionError } from './company-selection-error.js';
 import { recordPlanLimitStatus } from '../lib/plan-limit-nag.js';
 import { networkTransportErrorCode } from './network-transport-error.js';
+/**
+ * Identity / company resolution lookups must never hang forever. These small
+ * GETs run BEFORE a command does its real work (e.g. `hq secrets env` resolves
+ * the caller's person/company uid first). Without a bound, a vault gateway that
+ * accepts the TCP connection but never sends a response leaves the fetch
+ * in-flight, and because the CLI exits by draining the event loop (not
+ * `process.exit`), that one referenced socket keeps the whole process alive
+ * indefinitely — the mechanism behind the orphaned `hq secrets --personal env`
+ * process leak. Bounding each resolver fetch turns an immortal hang into a
+ * normal, catchable error. Scoped to identity lookups on purpose: this is NOT a
+ * whole-process watchdog.
+ */
+const IDENTITY_LOOKUP_TIMEOUT_MS = 15_000;
 /**
  * Best-effort peek of a 2xx JSON body for plan-limit status (US-016).
  *
@@ -234,6 +247,7 @@ async function resolveCompanyByUid(token, uid) {
     const res = await vaultApiFetch({
         token,
         path: `/entity/${encodeURIComponent(uid)}`,
+        signal: AbortSignal.timeout(IDENTITY_LOOKUP_TIMEOUT_MS),
     });
     if (!res.ok) {
         raiseIfUnauthorized(res);
@@ -266,6 +280,7 @@ async function resolveSlugInCallerNamespace(token, slug) {
         token,
         path: '/entity/check-slug/me',
         query: { type: 'company', slug },
+        signal: AbortSignal.timeout(IDENTITY_LOOKUP_TIMEOUT_MS),
     });
     if (!res.ok) {
         raiseIfUnauthorized(res);
@@ -300,6 +315,7 @@ async function resolveCompanyUid(token, ref) {
     const res = await vaultApiFetch({
         token,
         path: `/entity/by-slug/company/${encodeURIComponent(ref)}`,
+        signal: AbortSignal.timeout(IDENTITY_LOOKUP_TIMEOUT_MS),
     });
     if (!res.ok) {
         raiseIfUnauthorized(res);
@@ -326,6 +342,7 @@ async function resolveCompanyFromMemberships(token) {
     const res = await vaultApiFetch({
         token,
         path: '/membership/me',
+        signal: AbortSignal.timeout(IDENTITY_LOOKUP_TIMEOUT_MS),
     });
     if (!res.ok) {
         throw new Error("Failed to fetch memberships — run `hq login` and try again");
@@ -370,6 +387,7 @@ export async function resolveCallerPersonUid(token, baseUrl) {
         token,
         path: '/entity/by-type/person',
         baseUrl,
+        signal: AbortSignal.timeout(IDENTITY_LOOKUP_TIMEOUT_MS),
     });
     if (!res.ok) {
         throw new Error("Failed to fetch person entity — run `hq login` and try again");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.97.1",
+  "version": "5.97.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {