@indigoai-us/hq-cloud 6.11.15 → 6.11.17

package/src/skill-telemetry.test.ts

@@ -9,6 +9,7 @@ import {
   codexRowTurnId,
   parseCodexSessionMeta,
   collectAndSendSkillTelemetry,
+  readFileRegion,
 } from "./skill-telemetry.js";
 import type { SkillInvocationBatch } from "./vault-client.js";
 
@@ -1157,3 +1158,96 @@ describe("collectAndSendSkillTelemetry — companyUid attribution", () => {
     await fs.rm(tmp, { recursive: true, force: true });
   });
 });
+
+describe("readFileRegion — HQ-SYNC-WEB-15 (SIGABRT on >2GiB single read)", () => {
+  const INT32_MAX = 2 ** 31 - 1;
+
+  it("never issues a single read whose length exceeds Int32, even for a multi-GiB region", async () => {
+    // The original code did `fh.read(buf, 0, currentSize - offset, offset)` in
+    // one shot. Once a session log's unread tail passed ~2 GiB, the length
+    // argument was no longer an Int32, so Node's native fs.read asserted
+    // (`args[3]->IsInt32()`) and SIGABRT'd the whole runner. Simulate a 3 GiB
+    // region with a recording fake handle (no real allocation) and prove every
+    // native read length stays within Int32.
+    const THREE_GIB = 3 * 1024 * 1024 * 1024;
+    const lengths: number[] = [];
+    let cursor = 0;
+    const fakeFh = {
+      read: vi.fn(
+        async (_buf: Buffer, _off: number, length: number, position: number) => {
+          lengths.push(length);
+          expect(position).toBe(cursor); // contiguous, in order
+          cursor += length;
+          return { bytesRead: length };
+        },
+      ),
+    };
+
+    const total = await readFileRegion(
+      fakeFh as unknown as Parameters<typeof readFileRegion>[0],
+      Buffer.alloc(0), // recording fake never touches the buffer
+      0,
+      THREE_GIB,
+    );
+
+    expect(total).toBe(THREE_GIB);
+    expect(lengths.length).toBeGreaterThan(1); // it actually chunked
+    for (const len of lengths) {
+      expect(len).toBeGreaterThan(0);
+      expect(len).toBeLessThanOrEqual(INT32_MAX);
+    }
+    expect(lengths.reduce((a, b) => a + b, 0)).toBe(THREE_GIB);
+  });
+
+  it("reads an entire real region correctly across multiple chunks", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "readregion-"));
+    const filePath = path.join(tmp, "data.bin");
+    const payload = Buffer.from("abcdefghijklmnopqrstuvwxyz0123456789", "utf-8");
+    await fs.writeFile(filePath, payload);
+
+    const fh = await fs.open(filePath, "r");
+    try {
+      const buf = Buffer.alloc(payload.length);
+      // Tiny chunk size forces the loop to iterate many times.
+      const read = await readFileRegion(fh, buf, 0, payload.length, 7);
+      expect(read).toBe(payload.length);
+      expect(buf.equals(payload)).toBe(true);
+    } finally {
+      await fh.close();
+    }
+
+    // Reading a sub-region from an offset also lands correctly.
+    const fh2 = await fs.open(filePath, "r");
+    try {
+      const buf = Buffer.alloc(10);
+      const read = await readFileRegion(fh2, buf, 5, 10, 4);
+      expect(read).toBe(10);
+      expect(buf.toString("utf-8")).toBe(payload.toString("utf-8", 5, 15));
+    } finally {
+      await fh2.close();
+    }
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("stops cleanly on a short/zero read (file truncated since stat)", async () => {
+    // Ask for 100 bytes but the file only holds 30: the handle yields bytes up
+    // to what's left, then signals EOF with a 0-byte read.
+    let remaining = 30;
+    const fakeFh = {
+      read: vi.fn(async (_b: Buffer, _o: number, length: number) => {
+        const n = Math.min(length, remaining);
+        remaining -= n;
+        return { bytesRead: n };
+      }),
+    };
+    const got = await readFileRegion(
+      fakeFh as unknown as Parameters<typeof readFileRegion>[0],
+      Buffer.alloc(0),
+      0,
+      100,
+      8,
+    );
+    expect(got).toBe(30);
+  });
+});

package/src/skill-telemetry.ts

@@ -594,6 +594,51 @@ async function listJsonlFiles(root: string): Promise<string[]> {
 // session context without slurping a multi-MiB transcript.
 const CODEX_META_PREFIX_BYTES = 64 * 1024;
 
+/**
+ * Largest length passed to a single `FileHandle.read()`. Node's native fs.read
+ * asserts `args[3]->IsInt32()` on the length argument, so a single read whose
+ * length exceeds 2**31-1 (≈2 GiB) does NOT throw a catchable error — it aborts
+ * the whole process with SIGABRT. A skill/session log whose unread tail had
+ * grown past ~2 GiB crashed the entire `hq sync` runner this way
+ * (Sentry HQ-SYNC-WEB-15). 256 MiB stays comfortably within Int32 while keeping
+ * the read-loop iteration count small.
+ */
+const MAX_FS_READ_CHUNK_BYTES = 256 * 1024 * 1024;
+
+/** Minimal structural view of the `FileHandle.read` we depend on. */
+type ReadableFileHandle = {
+  read(
+    buffer: Buffer,
+    offset: number,
+    length: number,
+    position: number,
+  ): Promise<{ bytesRead: number }>;
+};
+
+/**
+ * Read `length` bytes from `fh` starting at byte `position` into `buf`, issuing
+ * native reads no larger than `chunkBytes` so the length argument never exceeds
+ * Int32 and trips the SIGABRT-on-assert path (HQ-SYNC-WEB-15). Returns the total
+ * bytes actually read — which may be < `length` if the file was truncated
+ * between `stat` and this read (a 0-byte read means EOF, so we stop).
+ */
+export async function readFileRegion(
+  fh: ReadableFileHandle,
+  buf: Buffer,
+  position: number,
+  length: number,
+  chunkBytes: number = MAX_FS_READ_CHUNK_BYTES,
+): Promise<number> {
+  let filled = 0;
+  while (filled < length) {
+    const chunk = Math.min(chunkBytes, length - filled);
+    const { bytesRead } = await fh.read(buf, filled, chunk, position + filled);
+    if (bytesRead === 0) break; // EOF / truncated since stat — stop cleanly.
+    filled += bytesRead;
+  }
+  return filled;
+}
+
 /** Read cwd + sessionId from a Codex rollout's leading `session_meta` line.
  *  Always reads from offset 0 (independent of the byte cursor). Best-effort:
  *  any error → empty context (events then fail the hqRoot scope filter, which
@@ -605,7 +650,7 @@ async function readCodexSessionContext(
     const fh = await fs.open(filePath, "r");
     try {
       const buf = Buffer.alloc(CODEX_META_PREFIX_BYTES);
-      const { bytesRead } = await fh.read(buf, 0, CODEX_META_PREFIX_BYTES, 0);
+      const bytesRead = await readFileRegion(fh, buf, 0, CODEX_META_PREFIX_BYTES);
       const firstLine = buf.toString("utf-8", 0, bytesRead).split("\n", 1)[0]?.trim();
       if (!firstLine) return {};
       return parseCodexSessionMeta(JSON.parse(firstLine)) ?? {};
@@ -791,8 +836,11 @@ export async function collectAndSendSkillTelemetry(
       try {
         const length = Math.max(0, currentSize - offset);
         const buf = Buffer.alloc(length);
-        await fh.read(buf, 0, length, offset);
-        content = buf.toString("utf-8");
+        // Chunked: a single fh.read() with length > Int32 aborts the process
+        // with SIGABRT (HQ-SYNC-WEB-15). `bytesRead` may be < length if the
+        // file was truncated since stat — bound the decode to it.
+        const bytesRead = await readFileRegion(fh, buf, offset, length);
+        content = buf.toString("utf-8", 0, bytesRead);
       } finally {
         await fh.close();
       }

package/src/vault-client.ts

@@ -114,6 +114,30 @@ export interface EntityInfo {
   createdAt: string;
 }
 
+/**
+ * Pick the caller's OWN entity for the `--personal` slot when the runner is an
+ * agent machine identity (username `machine-agt_*`, idToken
+ * `custom:entityType=agent` / `custom:entityUid=agt_*`).
+ *
+ * The person-only `pickCanonicalPersonEntity` filters `type === "person"`, so
+ * an agent's own entity (`type: "agent"`) is dropped and `--personal` for an
+ * agent emits `setup-needed` — never reaching the STS vend / S3 read (the
+ * US-004 hard-gate finding). This selector resolves the agent's own entity by
+ * matching `selfUid` (the `custom:entityUid` claim) against the self-listing
+ * the agent sees, so the personal slot resolves to `hq-vault-agt-<uid>`.
+ *
+ * Returns null when no entity matches the claimed self-uid (the caller then
+ * falls back to the person-only pick / `setup-needed`, exactly as before).
+ */
+export function pickAgentSelfEntity(
+  list: EntityInfo[],
+  selfUid: string,
+): EntityInfo | null {
+  if (!selfUid) return null;
+  const own = list.find((e) => e.uid === selfUid && e.type === "agent");
+  return own ?? null;
+}
+
 export function pickCanonicalPersonEntity(
   list: EntityInfo[],
 ): EntityInfo | null {