@seekrit/cli 0.23.1 → 0.23.3

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
@@ -1976,7 +1976,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.23.1";
+var version = "0.23.3";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -4574,6 +4574,79 @@ async function materializeForRun(options) {
 		};
 	}
 }
+/**
+* Every live descendant of `root`, from a single `ps(1)` snapshot of the
+* process table. We follow the parent chain rather than the process group
+* because a process that calls setsid(2)/setpgid(2) leaves the group — nodemon
+* does exactly that for the script it watches — while the parent chain still
+* leads to it. Returns nothing if `ps` is unavailable; callers fall back to
+* signalling the immediate child.
+*/
+function descendantsOf(root) {
+	const ps = spawnSync("ps", [
+		"-A",
+		"-o",
+		"pid=,ppid=,pgid="
+	], { encoding: "utf8" });
+	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
+	const childrenOf = /* @__PURE__ */ new Map();
+	const groupOf = /* @__PURE__ */ new Map();
+	const isId = (value) => value !== void 0 && Number.isInteger(value);
+	for (const line of ps.stdout.split("\n")) {
+		const [pid, ppid, pgid] = line.trim().split(/\s+/, 3).map(Number);
+		if (!isId(pid) || !isId(ppid) || !isId(pgid)) continue;
+		const siblings = childrenOf.get(ppid);
+		if (siblings) siblings.push(pid);
+		else childrenOf.set(ppid, [pid]);
+		groupOf.set(pid, pgid);
+	}
+	const ourGroup = groupOf.get(process.pid);
+	const found = [];
+	const queue = [root];
+	const seen = new Set(queue);
+	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
+		if (seen.has(kid)) continue;
+		seen.add(kid);
+		found.push({
+			pid: kid,
+			escaped: ourGroup === void 0 || groupOf.get(kid) !== ourGroup
+		});
+		queue.push(kid);
+	}
+	return found;
+}
+/** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
+function isAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** How long a signalled escapee gets to exit on its own before SIGKILL. */
+const ESCAPEE_GRACE_MS = 2e3;
+/**
+* Give already-signalled processes that left our group a moment to finish
+* shutting down, then SIGKILL the holdouts. We are the last process that knows
+* their pids: the tty won't hang them up, and once their parent exits they
+* reparent to init, out of reach of any walk down from our own child — which is
+* how one survives for days, invisible to `ps -a` for want of a tty. Only
+* processes that already ignored a termination signal are killed; the command
+* itself and anything still in our group shut down at their own pace.
+*/
+async function reapEscapees(pids) {
+	if (pids.size === 0) return;
+	const deadline = Date.now() + ESCAPEE_GRACE_MS;
+	let live = [...pids].filter(isAlive);
+	while (live.length > 0 && Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, 50));
+		live = live.filter(isAlive);
+	}
+	for (const pid of live) try {
+		process.kill(pid, "SIGKILL");
+	} catch {}
+}
 program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
 	const [cmd, ...args] = commandParts;
 	if (!cmd) fail("no command given");
@@ -4582,6 +4655,7 @@ program.command("run").description("run a command with decrypted secrets injecte
 		for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
 		printExplain(provenance);
 	}
+	const posix = process.platform !== "win32";
 	const child = spawn(cmd, args, {
 		stdio: "inherit",
 		env: {
@@ -4595,11 +4669,21 @@ program.command("run").description("run a command with decrypted secrets injecte
 		"SIGHUP",
 		"SIGQUIT"
 	];
+	const escapees = /* @__PURE__ */ new Set();
 	const forward = (signal) => {
-		if (child.exitCode === null && child.signalCode === null) child.kill(signal);
+		if (child.exitCode !== null || child.signalCode !== null) return;
+		child.kill(signal);
+		if (!posix || !child.pid) return;
+		for (const { pid, escaped } of descendantsOf(child.pid)) {
+			if (escaped) escapees.add(pid);
+			try {
+				process.kill(pid, signal);
+			} catch {}
+		}
 	};
 	for (const signal of signals) process.on(signal, forward);
-	child.on("exit", (code, signal) => {
+	child.on("exit", async (code, signal) => {
+		await reapEscapees(escapees);
 		for (const s of signals) process.off(s, forward);
 		if (signal) process.kill(process.pid, signal);
 		else process.exit(code ?? 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.23.1",
+  "version": "0.23.3",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,8 +27,8 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/core": "0.0.1",
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",