@indigoai-us/hq-cli 5.255.0 → 5.257.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.257.0] — 2026-09-28
+
+### Added
+
+- Add `hq lanes hold` to record company-scoped repository merge holds and
+  refuse recognized merge commands while the `lanes.repo-merge-hold` gate is
+  enabled. Hold history and release reasons stay in the local record. Checks
+  fail open with a named error when they cannot parse a command or read a hold,
+  and recognize pull-request URLs plus assignment, `env`, and `timeout` forms.
+
+## [5.256.0] — 2026-09-28
+
 ## [5.255.0] — 2026-09-28
 
 ### Changed
@@ -26,6 +38,7 @@
 - `hq db sql --remote` is hidden because remote SQL is not available in this
   CLI build. Existing scripts get a clear error, and local SQL remains
   available without `--remote`.
+- `hq secrets` and `hq run` now use cached secrets during a temporary server outage, up to each secret’s configured cache lifetime. The default is three hours; revoked and high-security secrets still fail closed.
 
 ## [5.253.0] — 2026-09-27
 

package/dist/command-catalog.generated.d.ts

@@ -7375,6 +7375,102 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Emit JSON instead of the team page text";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "hold";
+        readonly description: "Set and enforce repository merge holds";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "set";
+            readonly description: "Set or replace a repository merge hold";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <repo>";
+            readonly arguments: readonly [{
+                readonly name: "repo";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Company that owns this repository hold";
+            }, {
+                readonly flags: "--reason <text>";
+                readonly description: "Why merges are held";
+            }, {
+                readonly flags: "--until <time>";
+                readonly description: "Expiry as an ISO timestamp or duration such as 4h";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "list";
+            readonly description: "List active and expired repository merge holds";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print JSON";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "show";
+            readonly description: "Show a repository merge hold";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <repo>";
+            readonly arguments: readonly [{
+                readonly name: "repo";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "release";
+            readonly description: "Release an existing repository merge hold";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <repo>";
+            readonly arguments: readonly [{
+                readonly name: "repo";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--reason <text>";
+                readonly description: "Why the hold is being released";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "check";
+            readonly description: "Refuse merge commands targeting an actively held repository";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--command <shell-command>";
+                readonly description: "Command to inspect without executing it";
+            }, {
+                readonly flags: "--json";
+                readonly description: "Print JSON";
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "outpost-pruner";
         readonly description: "Inspect, install, and run safe outpost worktree pruning";

package/dist/command-catalog.generated.js

@@ -9534,6 +9534,130 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "hold",
+                "description": "Set and enforce repository merge holds",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "set",
+                        "description": "Set or replace a repository merge hold",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <repo>",
+                        "arguments": [
+                            {
+                                "name": "repo",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company that owns this repository hold"
+                            },
+                            {
+                                "flags": "--reason <text>",
+                                "description": "Why merges are held"
+                            },
+                            {
+                                "flags": "--until <time>",
+                                "description": "Expiry as an ISO timestamp or duration such as 4h"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "list",
+                        "description": "List active and expired repository merge holds",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "Print JSON"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "show",
+                        "description": "Show a repository merge hold",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <repo>",
+                        "arguments": [
+                            {
+                                "name": "repo",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "release",
+                        "description": "Release an existing repository merge hold",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <repo>",
+                        "arguments": [
+                            {
+                                "name": "repo",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--reason <text>",
+                                "description": "Why the hold is being released"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "check",
+                        "description": "Refuse merge commands targeting an actively held repository",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--command <shell-command>",
+                                "description": "Command to inspect without executing it"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Print JSON"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "outpost-pruner",
                 "description": "Inspect, install, and run safe outpost worktree pruning",

package/dist/commands/integrations-import.js

@@ -350,7 +350,9 @@ export function registerImportCommands(integrations) {
         }
         const secretNames = [...Object.values({ ...(manifest.env ?? {}), ...(manifest.headers ?? {}) }), ...(manifest.args ?? [])]
             .flatMap((value) => [...value.matchAll(/\$\{secret:([A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]*)*)\}/g)].map((match) => match[1]));
-        const secrets = await loadRevealedSecrets(token, companyUid, secretNames);
+        const secrets = await loadRevealedSecrets(token, companyUid, secretNames, undefined, {
+            allowOfflineFallback: false,
+        });
         const result = registerServer({
             name: safeName,
             manifest,

package/dist/commands/lanes-hold.d.ts

@@ -0,0 +1,41 @@
+import type { Command } from "commander";
+import type { LaneCompanyRef } from "../lib/lanes/types.js";
+export declare const LANES_REPO_MERGE_HOLD_FLAG = "lanes.repo-merge-hold";
+export declare const REPO_MERGE_HOLDS_REL: string;
+declare const HOLD_SCHEMA_VERSION = "hq-lanes-repo-merge-hold.v1";
+interface HoldHistoryEntry {
+    set_at: string;
+    until: string;
+    reason: string;
+    set_by_lane: string | null;
+    set_by_session: string | null;
+    released_at?: string;
+    released_reason?: string;
+}
+export interface RepoMergeHold {
+    schema_version: typeof HOLD_SCHEMA_VERSION;
+    repo: string;
+    company: LaneCompanyRef;
+    reason: string;
+    set_at: string;
+    until: string;
+    set_by_lane: string | null;
+    set_by_session: string | null;
+    released_at?: string;
+    released_reason?: string;
+    history: HoldHistoryEntry[];
+}
+export interface LaneRepoMergeHoldDeps {
+    hqRoot: () => string;
+    resolveCompany: (company?: string) => Promise<LaneCompanyRef>;
+    now: () => Date;
+    env: NodeJS.ProcessEnv;
+    mergeHoldEnabled?: (company: LaneCompanyRef) => boolean | Promise<boolean>;
+}
+type WrapHandler = <Args extends unknown[]>(action: (...args: Args) => Promise<void>) => (...args: Args) => Promise<void>;
+export declare function repoMergeHoldPath(hqRoot: string, repo: string): string;
+/** Serialize the read-modify-write cycle so concurrent set/release calls cannot overwrite each other. */
+export declare function withRepoMergeHoldRecordLock<T>(recordPath: string, action: () => T | Promise<T>): Promise<T>;
+export declare function registerLaneRepoMergeHoldCommand(lanes: Command, deps: LaneRepoMergeHoldDeps, wrap: WrapHandler): void;
+export {};
+//# sourceMappingURL=lanes-hold.d.ts.map