@indigoai-us/hq-cli 5.255.0 → 5.257.0

package/dist/commands/lanes.js

@@ -21,6 +21,7 @@ import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { registerLaneChecksCommand } from "./lanes-checks.js";
 import { registerLaneReportCommands } from "./lanes-report.js";
 import { registerLaneTrackerImportCommand } from "./lanes-import.js";
+import { registerLaneRepoMergeHoldCommand } from "./lanes-hold.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
@@ -6892,6 +6893,12 @@ export function registerLanesCommand(parent, deps = {}) {
             return body;
         },
     }, wrap);
+    registerLaneRepoMergeHoldCommand(lanes, {
+        hqRoot: ctx.hqRoot,
+        resolveCompany: ctx.resolveCompany,
+        now: ctx.now,
+        env: ctx.env,
+    }, wrap);
     registerOutpostPrunerCommand(lanes);
     const noStoryOption = new Option("--no-story <reason>", "Create a lane without a story and record why");
     noStoryOption.attributeName = () => "noStory";

package/dist/commands/pack-install.js

@@ -1421,7 +1421,9 @@ export async function makeInstallSecretResolver(secretNames, company) {
                 return () => null;
             [scopeUid] = scopes;
         }
-        const authorized = await loadRevealedSecrets(token, scopeUid, names);
+        const authorized = await loadRevealedSecrets(token, scopeUid, names, undefined, {
+            allowOfflineFallback: false,
+        });
         return (name) => authorized.get(name) ?? null;
     }
     catch {

package/dist/commands/run.js

@@ -2,9 +2,10 @@ import { spawn } from 'node:child_process';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { internal } from 'varlock';
-import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { cognitoCachePrincipalUid, ensureCognitoToken } from '../utils/cognito-session.js';
 import { apiKeyCapabilityGateMessage, peekHqApiKey, } from '../utils/resolve-vault-credential.js';
 import { computeSha256 } from '../utils/integrity.js';
+import { isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from '../utils/secret-load-availability.js';
 import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
 import { discoverSchemas } from '../run/discover-schemas.js';
 import { installHqPlugin, prewarmHqSecrets } from '../run/hq-plugin.js';
@@ -82,7 +83,9 @@ export function registerRunCommand(program) {
                 throw new Error('company slug not set. Add # @hqCompany("slug") to your .env.schema or pass --company <slug>.');
             }
             const token = await ensureCognitoToken();
-            const uid = await getCompanyUid(token, slug);
+            const uid = await getCompanyUid(token, slug, undefined, {
+                allowOfflineScopeFallback: true,
+            });
             const usage = await buildRunUsage(opts.script, opts.scriptId);
             const fetchBatch = async (companyUid, names, requestUsage) => {
                 const res = await vaultApiFetch({
@@ -99,6 +102,9 @@ export function registerRunCommand(program) {
                         : typeof body.error === 'string'
                             ? body.error
                             : res.statusText;
+                    if (isUnavailableSecretLoadHttpStatus(res.status)) {
+                        throw new SecretLoadUnavailableError(`Failed to batch-load secrets: ${message}`);
+                    }
                     if (res.status >= 400 &&
                         res.status < 500 &&
                         typeof body.code === 'string') {
@@ -110,6 +116,8 @@ export function registerRunCommand(program) {
             };
             const pluginOpts = {
                 companyOverride: opts.company,
+                principalUid: cognitoCachePrincipalUid(token) ?? undefined,
+                allowOfflineFallback: true,
                 resolveCompanyUid: async () => uid,
                 usage,
                 fetchBatch,

package/dist/commands/secrets.d.ts

@@ -31,6 +31,7 @@ export interface SecretMetadata {
         requiredAttestation?: string;
     };
     cacheTtlMs?: number;
+    revokedAt?: string | null;
 }
 export interface SecretLoadSuccessRow extends SecretMetadata {
     name: string;
@@ -59,7 +60,9 @@ export declare function parseDestinationUrl(raw: string): {
 };
 export declare function collectSecretNames(value: string, previous?: string[]): string[];
 export declare function scrubSandboxOutput(text: string, secretNames?: string[]): string;
-export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage): Promise<Map<string, string>>;
+export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
+    allowOfflineFallback?: boolean;
+}): Promise<Map<string, string>>;
 /**
  * Emit `hq secrets env` output and terminate deterministically.
  *

package/dist/commands/secrets.js

@@ -3,13 +3,14 @@ import * as readline from "node:readline";
 import { spawn } from "node:child_process";
 import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
-import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { cognitoCachePrincipalUid, ensureCognitoToken } from "../utils/cognito-session.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { computeSha256 } from "../utils/integrity.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
+import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "../utils/secret-load-availability.js";
 import { SandboxRunnerClient, } from "../utils/sandbox-runner-client.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 /**
@@ -533,11 +534,11 @@ function renderPolicyScripts(scripts) {
 // `env` through it stops those callers from emitting the warning while keeping
 // identical UX and error text.
 //
-// Every value use through exec/env/reveal is server-authorized, including when
-// an encrypted disk-cache entry exists. The cache remains write-through for
-// explicitly offline install-time consumers; these commands never trust it as
-// an authorization decision. This means a policy, ACL, tier, or script-approval
-// change takes effect on their next use even though there is no push revocation.
+// Every value use through exec/env/reveal is server-authorized when online,
+// including when an encrypted disk-cache entry exists. Only explicitly opted-in
+// exec/env callers may use principal-bound values during classified outages;
+// install authorization and reveal remain online-only. This means a policy,
+// ACL, tier, or script-approval change takes effect on the next online use.
 // Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
 // with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
 // path used — never swallows a failure.
@@ -585,13 +586,16 @@ async function loadRevealedSecretsViaApiKey(token, keys) {
     }
     return resolved;
 }
-export async function loadRevealedSecrets(token, companyUid, keys, usage) {
+export async function loadRevealedSecrets(token, companyUid, keys, usage, options = {}) {
     if (token.startsWith(HQ_API_KEY_PREFIX)) {
         return loadRevealedSecretsViaApiKey(token, keys);
     }
     const resolved = new Map();
     const requested = [...new Set(keys)];
-    const cachedCandidates = new Set(requested.filter((name) => hasCacheEntry(companyUid, name)));
+    const principalUid = cognitoCachePrincipalUid(token);
+    const cachedCandidates = new Set(principalUid
+        ? requested.filter((name) => hasCacheEntry(companyUid, name, principalUid))
+        : []);
     try {
         // The batch endpoint is the only non-capturing authorization path that also
         // evaluates the supplied usage metadata. It covers warm and cold names in
@@ -618,6 +622,9 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
                     body.highSecurity === true) {
                     throw new Error(highSecuritySandboxOnlyMessage());
                 }
+                if (isUnavailableSecretLoadHttpStatus(res.status)) {
+                    throw new SecretLoadUnavailableError(`Failed to batch-load secrets: ${message}`);
+                }
                 if (res.status >= 400 &&
                     res.status < 500 &&
                     typeof body.code === "string") {
@@ -646,6 +653,14 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
                     throw new Error("Invalid secret load response from vault");
                 }
                 seenNames.add(s.name);
+                if (s.revokedAt != null) {
+                    errorsByName.set(s.name, {
+                        code: "revoked",
+                        message: `Secret '${s.name}' has been revoked`,
+                    });
+                    removeCacheEntry(companyUid, s.name);
+                    continue;
+                }
                 if (s.value == null) {
                     errorsByName.set(s.name, {
                         code: "not_returned",
@@ -660,7 +675,7 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
                     typeof s.version === "number" &&
                     Number.isSafeInteger(s.version) &&
                     s.version > 0
-                    ? readCache(companyUid, s.name, s.version, cacheTtlMs)
+                    ? readCache(companyUid, s.name, principalUid, s.version, cacheTtlMs)
                     : null;
                 if (cached !== null) {
                     resolved.set(s.name, cached);
@@ -670,10 +685,12 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
                     if (typeof s.version === "number" &&
                         Number.isSafeInteger(s.version) &&
                         s.version > 0) {
-                        writeCache(companyUid, s.name, s.value, cacheTtlMs, s.version);
+                        if (principalUid) {
+                            writeCache(companyUid, s.name, principalUid, s.value, cacheTtlMs, s.version);
+                        }
                     }
-                    else {
-                        writeCache(companyUid, s.name, s.value, cacheTtlMs);
+                    else if (principalUid) {
+                        writeCache(companyUid, s.name, principalUid, s.value, cacheTtlMs);
                     }
                 }
                 else {
@@ -730,9 +747,29 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
         return resolved;
     }
     catch (err) {
+        if (isSecretLoadUnavailable(err) && options.allowOfflineFallback === true) {
+            const offline = new Map();
+            for (const key of requested) {
+                const cached = cachedCandidates.has(key)
+                    ? readCache(companyUid, key, principalUid)
+                    : null;
+                if (cached === null) {
+                    // Keep the same failure behavior for a cache miss, while leaving any
+                    // still-valid entries untouched for a later retry.
+                    throw err;
+                }
+                offline.set(key, cached);
+            }
+            console.error(CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE);
+            return offline;
+        }
+        if (isSecretLoadUnavailable(err)) {
+            throw err;
+        }
         // A transport failure, stale session, malformed response, or a later chunk
-        // failure must not leave values written by this attempted operation available
-        // to offline cache readers. Evict the whole request before failing closed.
+        // failure is an explicit denial or unusable response. Evict the whole
+        // request before failing closed. Transient no-answer/5xx/429 failures above
+        // preserve entries and only use values still valid under their stored TTL.
         for (const key of requested) {
             removeCacheEntry(companyUid, key);
         }
@@ -979,7 +1016,7 @@ export function registerSecretsCommand(program) {
             let revealError = null;
             if (opts.reveal) {
                 try {
-                    revealedValue = (await loadRevealedSecrets(token, companyUid, [name], await buildSecretUsage("reveal"))).get(name);
+                    revealedValue = (await loadRevealedSecrets(token, companyUid, [name], await buildSecretUsage("reveal"), { allowOfflineFallback: false })).get(name);
                 }
                 catch (err) {
                     revealError = err instanceof Error ? err.message : String(err);
@@ -1460,10 +1497,10 @@ export function registerSecretsCommand(program) {
             const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets exec", secretsCredentialOptions());
             const companyUid = cred.kind === "api-key"
                 ? "__api_key__"
-                : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
+                : await getEntityUid(cred.token, scopeOpts(secrets.opts()), { allowOfflineScopeFallback: true });
             const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
-                : undefined);
+                : undefined, { allowOfflineFallback: true });
             const secretEnv = {};
             for (const key of keys) {
                 const value = revealed.get(key);
@@ -1511,10 +1548,10 @@ export function registerSecretsCommand(program) {
             const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
             const companyUid = cred.kind === "api-key"
                 ? "__api_key__"
-                : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
+                : await getEntityUid(cred.token, scopeOpts(secrets.opts()), { allowOfflineScopeFallback: true });
             const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("env", opts.script, opts.scriptId)
-                : undefined);
+                : undefined, { allowOfflineFallback: true });
             let payload = "";
             for (const key of keys) {
                 const value = revealed.get(key);

package/dist/lib/lanes/registry-flag.d.ts

@@ -17,6 +17,7 @@ export interface ReadLanesFlagOptions {
     getToken?: () => string | Promise<string>;
     reportFailure?: (error: unknown) => void;
 }
+export declare function readLanesFlagLocalOverride(flagKey: string, env?: NodeJS.ProcessEnv): boolean | null;
 /**
  * Read a lanes flag once for each company identity in this CLI process. The
  * cache contains only an in-flight or settled boolean promise; it is never

package/dist/lib/lanes/registry-flag.js

@@ -3,6 +3,9 @@ import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
 import { FLAG_REGISTRY_DEFAULT_ENDPOINT, resolveFlagRegistryEndpoint, } from "../flag-registry-endpoint.js";
 export const LANES_FLAG_API_DEFAULT_ENDPOINT = FLAG_REGISTRY_DEFAULT_ENDPOINT;
 export const LANES_FLAG_READ_TIMEOUT_MS = 5_000;
+export function readLanesFlagLocalOverride(flagKey, env = process.env) {
+    return readLocalOverride(flagKey, env);
+}
 const registryReads = new Map();
 class MissingFlagTokenError extends Error {
     constructor() {
@@ -37,7 +40,7 @@ function cacheKey(flagKey, company, endpoint) {
  */
 export async function readLanesRegistryFlag(flagKey, options = {}) {
     const env = options.env ?? process.env;
-    const localOverride = readLocalOverride(flagKey, env);
+    const localOverride = readLanesFlagLocalOverride(flagKey, env);
     if (localOverride !== null)
         return localOverride;
     const endpoint = resolveFlagRegistryEndpoint(undefined, env);

package/dist/run/hq-plugin.d.ts

@@ -1,6 +1,10 @@
 import type { SecretLoadResponse, SecretUsage } from '../commands/secrets.js';
 export interface InstallHqPluginOpts {
     companyOverride?: string;
+    /** Local cache identity derived from the current Cognito person/agent token. */
+    principalUid?: string;
+    /** Only hq run opts into encrypted offline values. */
+    allowOfflineFallback?: boolean;
     resolveCompanyUid: (slug: string) => Promise<string>;
     usage?: SecretUsage;
     fetchBatch: (uid: string, names: string[], usage?: SecretUsage) => Promise<SecretLoadResponse>;

package/dist/run/hq-plugin.js

@@ -1,5 +1,6 @@
 import { ResolutionError } from 'varlock/plugin-lib';
-import { DEFAULT_SECRETS_CACHE_TTL_MS, writeCache, removeCacheEntry, } from '../utils/secrets-cache.js';
+import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, writeCache, removeCacheEntry, } from '../utils/secrets-cache.js';
+import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, } from '../utils/secret-load-availability.js';
 function normalizeCacheTtlMs(secret) {
     if (secret.tier === 'sensitive' ||
         secret.tier === 'nuclear' ||
@@ -169,6 +170,14 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
                 throw new Error('Invalid secret load response from vault');
             }
             seenNames.add(s.name);
+            if (s.revokedAt != null) {
+                errorsByName.set(s.name, {
+                    code: 'revoked',
+                    message: `Secret '${s.name}' has been revoked`,
+                });
+                removeCacheEntry(uid, s.name);
+                continue;
+            }
             if (s.value == null) {
                 errorsByName.set(s.name, {
                     code: 'not_returned',
@@ -180,8 +189,8 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
             returnedNames.add(s.name);
             state.loadedSecretsByName.set(s.name, s.value);
             const cacheTtlMs = normalizeCacheTtlMs(s);
-            if (cacheTtlMs > 0) {
-                writeCache(uid, s.name, s.value, cacheTtlMs, s.version);
+            if (cacheTtlMs > 0 && opts.principalUid) {
+                writeCache(uid, s.name, opts.principalUid, s.value, cacheTtlMs, s.version);
             }
             else {
                 removeCacheEntry(uid, s.name);
@@ -219,6 +228,24 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
     catch (err) {
         state.loadedSecretsByName.clear();
         state.errorsByName = new Map();
+        if (isSecretLoadUnavailable(err) && opts.allowOfflineFallback === true && opts.principalUid) {
+            const cached = new Map();
+            for (const name of uniqueNames) {
+                const value = hasCacheEntry(uid, name, opts.principalUid)
+                    ? readCache(uid, name, opts.principalUid)
+                    : null;
+                if (value === null) {
+                    throw err;
+                }
+                cached.set(name, value);
+            }
+            state.loadedSecretsByName = cached;
+            state.uid = uid;
+            console.error(CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE);
+            return;
+        }
+        if (isSecretLoadUnavailable(err))
+            throw err;
         for (const name of uniqueNames) {
             removeCacheEntry(uid, name);
         }

package/dist/utils/cognito-session.d.ts

@@ -173,6 +173,8 @@ export declare function cognitoSubjectFromToken(token: string | undefined): {
     sub: string | null;
     entityUid: string | null;
 };
+/** Stable local cache identity for a Cognito person or agent principal. */
+export declare function cognitoCachePrincipalUid(token: string | undefined): string | null;
 /** Stable subject key. Null when neither sub nor entity uid is present. */
 export declare function cognitoSubjectKey(tokens: {
     idToken?: string;

package/dist/utils/cognito-session.js

@@ -434,6 +434,11 @@ export function cognitoSubjectFromToken(token) {
     const entityUid = typeof entity === "string" && entity.length > 0 ? entity : null;
     return { sub, entityUid };
 }
+/** Stable local cache identity for a Cognito person or agent principal. */
+export function cognitoCachePrincipalUid(token) {
+    const claims = cognitoSubjectFromToken(token);
+    return claims.entityUid ?? claims.sub;
+}
 /** Stable subject key. Null when neither sub nor entity uid is present. */
 export function cognitoSubjectKey(tokens) {
     if (!tokens)

package/dist/utils/secret-load-availability.d.ts

@@ -0,0 +1,8 @@
+export declare class SecretLoadUnavailableError extends Error {
+    readonly serverUnavailable = true;
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare function isUnavailableSecretLoadHttpStatus(status: number): boolean;
+export declare function isSecretLoadUnavailable(err: unknown): boolean;
+export declare const CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE = "using cached secrets; server unavailable";
+//# sourceMappingURL=secret-load-availability.d.ts.map

package/dist/utils/secret-load-availability.js

@@ -0,0 +1,54 @@
+export class SecretLoadUnavailableError extends Error {
+    serverUnavailable = true;
+    constructor(message, options) {
+        super(message, options);
+        this.name = "SecretLoadUnavailableError";
+    }
+}
+const TRANSIENT_NETWORK_CODES = new Set([
+    "ECONNABORTED",
+    "ECONNREFUSED",
+    "ECONNRESET",
+    "EHOSTUNREACH",
+    "ENETUNREACH",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "ETIMEDOUT",
+    "EPIPE",
+    "UND_ERR_ABORTED",
+    "UND_ERR_CONNECT_TIMEOUT",
+    "UND_ERR_HEADERS_TIMEOUT",
+    "UND_ERR_BODY_TIMEOUT",
+    "UND_ERR_SOCKET",
+]);
+export function isUnavailableSecretLoadHttpStatus(status) {
+    return status === 408 || status === 429 || (status >= 500 && status <= 599);
+}
+export function isSecretLoadUnavailable(err) {
+    if (err instanceof SecretLoadUnavailableError)
+        return true;
+    const seen = new Set();
+    let current = err;
+    for (let depth = 0; depth < 4 && current && !seen.has(current); depth += 1) {
+        seen.add(current);
+        if (typeof current !== "object")
+            break;
+        const record = current;
+        if (typeof record.code === "string" &&
+            TRANSIENT_NETWORK_CODES.has(record.code)) {
+            return true;
+        }
+        if (record.name === "TimeoutError" || record.name === "AbortError") {
+            return true;
+        }
+        if (record instanceof TypeError &&
+            typeof record.message === "string" &&
+            /fetch failed|network error/i.test(record.message)) {
+            return true;
+        }
+        current = record.cause;
+    }
+    return false;
+}
+export const CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE = "using cached secrets; server unavailable";
+//# sourceMappingURL=secret-load-availability.js.map

package/dist/utils/secrets-cache.d.ts

@@ -1,12 +1,16 @@
 export declare const DEFAULT_SECRETS_CACHE_TTL_MS: number;
-export declare function readCache(companyUid: string, name: string, expectedVersion?: number, maxAgeMs?: number): string | null;
+export declare function readCache(companyUid: string, name: string, principalUid: string, expectedVersion?: number, maxAgeMs?: number): string | null;
 /**
  * Returns whether an unexpired entry exists without decrypting its plaintext.
  * Callers use this only to decide whether to reauthorize a possible cache hit;
  * they must complete that authorization before calling {@link readCache}.
  */
-export declare function hasCacheEntry(companyUid: string, name: string): boolean;
-export declare function writeCache(companyUid: string, name: string, value: string, ttlMs?: number, version?: number): void;
+export declare function hasCacheEntry(companyUid: string, name: string, principalUid: string): boolean;
+export declare function writeCache(companyUid: string, name: string, principalUid: string, value: string, ttlMs?: number, version?: number): void;
+/** Persist the last successfully resolved scope for a principal, encrypted and authenticated. */
+export declare function writeCachedScopeUid(scopeKey: string, principalUid: string, scopeUid: string): void;
+/** Return a still-valid scope UID only for the principal that wrote it. */
+export declare function readCachedScopeUid(scopeKey: string, principalUid: string): string | null;
 /**
  * List the scope UIDs (`cmp_*` / `prs_*` subdirectories) that currently have a
  * secrets-cache directory on disk. Install-time MCP registration may use an