@indigoai-us/hq-cli 5.254.0 → 5.256.0

package/dist/utils/vault-api.d.ts

@@ -67,10 +67,14 @@ export declare function getCompanyUid(token: string, companySlug: string | undef
  * pass it when the caller is bound to another API (an enrolled agent's
  * `apiBaseUrl`) so its token never goes to the default host.
  */
-baseUrl?: string): Promise<string>;
+baseUrl?: string, options?: {
+    allowOfflineScopeFallback?: boolean;
+}): Promise<string>;
 export declare function resolveCallerPersonUid(token: string, baseUrl?: string): Promise<string>;
 export declare function getEntityUid(token: string, opts: {
     personal?: boolean;
     companySlug?: string;
+}, options?: {
+    allowOfflineScopeFallback?: boolean;
 }): Promise<string>;
 //# sourceMappingURL=vault-api.d.ts.map

package/dist/utils/vault-api.js

@@ -1,4 +1,4 @@
-import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
+import { DEFAULT_VAULT_API_URL, cognitoCachePrincipalUid } from './cognito-session.js';
 import { CLI_VERSION } from '../cli-version.js';
 import { Sentry } from '../sentry.js';
 import { AuthError } from './auth-error.js';
@@ -8,6 +8,8 @@ import { networkTransportErrorCode } from './network-transport-error.js';
 import { planGateErrorFromResponse } from './plan-gate-error.js';
 import { markExpectedUserError } from './expected-cli-error.js';
 import { redactErrorText } from './redact-error-text.js';
+import { isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError } from './secret-load-availability.js';
+import { readCachedScopeUid, writeCachedScopeUid } from './secrets-cache.js';
 /**
  * Identity / company resolution lookups must never hang forever. These small
  * GETs run BEFORE a command does its real work (e.g. `hq secrets env` resolves
@@ -47,8 +49,9 @@ function identityLookupTimeoutMs() {
  * call .json()/.text()/.arrayBuffer(). Non-JSON and non-ok responses are
  * returned untouched (streamed binary downloads must never be buffered).
  *
- * Never throws. On any error: return the original response if its body has
- * not been consumed, otherwise the re-wrapped one.
+ * On inspection errors, return the original response by default to preserve
+ * existing behavior. Secret-load callers opt into rethrowing body read errors
+ * so the load path can classify a broken stream for offline-cache fallback.
  *
  * Why not response.clone()? Cloning tees the undici body stream; when a
  * caller never consumes the original Response body (many commands only check
@@ -56,7 +59,7 @@ function identityLookupTimeoutMs() {
  * referenced and the process (or vitest worker / spawned CLI child) never
  * exits on Linux CI. Reading once + re-wrapping fully drains the stream.
  */
-async function peekPlanLimitStatus(response) {
+async function peekPlanLimitStatus(response, options = {}) {
     try {
         if (!response.ok)
             return response;
@@ -64,14 +67,7 @@ async function peekPlanLimitStatus(response) {
         if (!ct.includes('application/json') && !ct.includes('+json')) {
             return response;
         }
-        let buf;
-        try {
-            buf = await response.arrayBuffer();
-        }
-        catch {
-            // Body may be locked/errored; original is the only thing we can return.
-            return response;
-        }
+        const buf = await response.arrayBuffer();
         try {
             const text = new TextDecoder().decode(buf);
             try {
@@ -92,9 +88,11 @@ async function peekPlanLimitStatus(response) {
             headers: response.headers,
         });
     }
-    catch {
-        // Outer safety net: never throw from the peek path. If we never consumed
-        // the body, the original is still usable.
+    catch (err) {
+        // Only secret-load callers need the body-read error for offline fallback.
+        // Other endpoints retain the pre-existing best-effort peek behavior.
+        if (options.throwOnBodyReadError)
+            throw err;
         return response;
     }
 }
@@ -238,7 +236,21 @@ export async function vaultApiFetch(opts) {
             throw planGate.error;
         return planGate.response;
     }
-    return peekPlanLimitStatus(response);
+    const isSecretLoad = method === "POST" && /^\/secrets\/[^/]+\/load$/.test(path);
+    try {
+        return await peekPlanLimitStatus(response, {
+            throwOnBodyReadError: isSecretLoad,
+        });
+    }
+    catch (err) {
+        // A successful /load response whose JSON stream breaks is a transient
+        // transport failure for offline-cache purposes, even when undici has
+        // already reduced its cause to a generic body-reader TypeError.
+        if (isSecretLoad) {
+            throw new SecretLoadUnavailableError("Failed to read the secret load response body", { cause: err });
+        }
+        throw err;
+    }
 }
 /**
  * Public (NONE-auth) GET against the vault API — no bearer token. The
@@ -324,6 +336,9 @@ async function resolveCompanyByUid(token, uid, baseUrl) {
     if (!res.ok) {
         raiseIfUnauthorized(res);
         const body = (await res.json().catch(() => ({})));
+        if (isUnavailableSecretLoadHttpStatus(res.status)) {
+            throw new SecretLoadUnavailableError(`Failed to resolve company '${uid}': ${formatSlugLookupReason(res, body)}`);
+        }
         throw new Error(`Failed to resolve company '${uid}': ${formatSlugLookupReason(res, body)}`);
     }
     const data = (await res.json());
@@ -492,6 +507,9 @@ async function resolveCompanyUid(token, ref, baseUrl) {
             ? " This is a temporary lookup failure, not a missing company. Retry the command."
             : "";
         const error = new Error(redactedSlugLookupMessage(`Failed to resolve company slug '${ref}': ${reason}.${hint}`));
+        if (retryable && (mine.kind === "transient" || isUnavailableSecretLoadHttpStatus(res.status))) {
+            throw new SecretLoadUnavailableError(error.message);
+        }
         throw retryable ? error : markExpectedUserError(error);
     }
     const data = (await res.json());
@@ -506,6 +524,9 @@ async function resolveCompanyFromMemberships(token, baseUrl) {
     });
     if (!res.ok) {
         const error = new Error("Failed to fetch memberships — run `hq login` and try again");
+        if (isUnavailableSecretLoadHttpStatus(res.status)) {
+            throw new SecretLoadUnavailableError(error.message);
+        }
         throw res.status === 401 ? markExpectedUserError(error) : error;
     }
     const data = (await res.json());
@@ -529,7 +550,7 @@ export async function getCompanyUid(token, companySlug,
  * pass it when the caller is bound to another API (an enrolled agent's
  * `apiBaseUrl`) so its token never goes to the default host.
  */
-baseUrl) {
+baseUrl, options = {}) {
     // Vault API keys are company-bound. Entity slug resolution has no keyed
     // route, so under hqk_ we accept an explicit cmp_ uid (or HQ_COMPANY_UID)
     // and otherwise fall through to keyed GET /v1/keys/membership/me.
@@ -544,10 +565,29 @@ baseUrl) {
         }
         return resolveCompanyFromMemberships(token, baseUrl);
     }
-    if (companySlug) {
-        return resolveCompanyUid(token, companySlug, baseUrl);
+    if (!options.allowOfflineScopeFallback) {
+        return companySlug
+            ? resolveCompanyUid(token, companySlug, baseUrl)
+            : resolveCompanyFromMemberships(token, baseUrl);
+    }
+    const scopeKey = `company:${companySlug ?? "<active-membership>"}`;
+    const principalUid = cognitoCachePrincipalUid(token);
+    try {
+        const uid = companySlug
+            ? await resolveCompanyUid(token, companySlug, baseUrl)
+            : await resolveCompanyFromMemberships(token, baseUrl);
+        if (principalUid)
+            writeCachedScopeUid(scopeKey, principalUid, uid);
+        return uid;
+    }
+    catch (err) {
+        if (!principalUid || !isSecretLoadUnavailable(err))
+            throw err;
+        const cachedUid = readCachedScopeUid(scopeKey, principalUid);
+        if (!cachedUid)
+            throw err;
+        return cachedUid;
     }
-    return resolveCompanyFromMemberships(token, baseUrl);
 }
 // Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
 // createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
@@ -559,6 +599,9 @@ export async function resolveCallerPersonUid(token, baseUrl) {
         signal: AbortSignal.timeout(identityLookupTimeoutMs()),
     });
     if (!res.ok) {
+        if (isUnavailableSecretLoadHttpStatus(res.status)) {
+            throw new SecretLoadUnavailableError("Failed to fetch person entity — run `hq login` and try again");
+        }
         throw new Error("Failed to fetch person entity — run `hq login` and try again");
     }
     const data = (await res.json());
@@ -578,10 +621,26 @@ export async function resolveCallerPersonUid(token, baseUrl) {
 // Resolves the scope UID (cmp_* or prs_*) for a secrets command. Precedence:
 // `--personal` → caller's canonical person entity; else `--company <slug>` →
 // resolved company UID; else fallback to single active company membership.
-export async function getEntityUid(token, opts) {
+export async function getEntityUid(token, opts, options = {}) {
     if (opts.personal) {
-        return resolveCallerPersonUid(token);
+        if (!options.allowOfflineScopeFallback)
+            return resolveCallerPersonUid(token);
+        const principalUid = cognitoCachePrincipalUid(token);
+        try {
+            const uid = await resolveCallerPersonUid(token);
+            if (principalUid)
+                writeCachedScopeUid("personal", principalUid, uid);
+            return uid;
+        }
+        catch (err) {
+            if (!principalUid || !isSecretLoadUnavailable(err))
+                throw err;
+            const cachedUid = readCachedScopeUid("personal", principalUid);
+            if (!cachedUid)
+                throw err;
+            return cachedUid;
+        }
     }
-    return getCompanyUid(token, opts.companySlug);
+    return getCompanyUid(token, opts.companySlug, undefined, options);
 }
 //# sourceMappingURL=vault-api.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.254.0",
+  "version": "5.256.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {