@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/commands/onboard-identity-guard.d.ts

@@ -24,7 +24,7 @@
  * the checkpoint adopted a person the caller no longer owns. The resume command
  * uses it to surface a recoverable, actionable error instead of looping.
  */
-import type { OnboardingCheckpoint } from "../lib/onboarding/index.js";
+import type { OnboardingCheckpoint } from "@indigoai-us/hq-onboarding";
 export type OnboardingIdentityCheck = {
     kind: "ok";
 } | {

package/dist/commands/onboard.js

@@ -19,15 +19,12 @@
  * browser-OAuth flow opens automatically.
  */
 import chalk from "chalk";
-import { runOnboardCli, readCheckpoint } from "../lib/onboarding/index.js";
-import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoIdToken, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
+import { runOnboardCli, readCheckpoint } from "@indigoai-us/hq-onboarding";
+import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 import { createDefaultVaultClient } from "./cloud-provision.js";
 import { detectOnboardingIdentityMismatch } from "./onboard-identity-guard.js";
 import { planOnboardJoin } from "./onboard-join.js";
 import { buildCreateCompanyWarning } from "./onboard-warning.js";
-import { resolveCreateCompanyIdentity } from "./onboard-create-identity.js";
-import { peekIdToken } from "../utils/id-token.js";
-import { addBotToNewCompany, botToAddAfterCreateCompany } from "./onboard-bot-membership.js";
 // ---------------------------------------------------------------------------
 // Command registration
 // ---------------------------------------------------------------------------
@@ -42,18 +39,11 @@ export function registerOnboardCommand(program) {
         "a same-named company makes a separate one you'd be alone in.")
         .requiredOption("--slug <slug>", "Company slug (used as bucket name suffix)")
         .requiredOption("--name <name>", "Company display name")
-        .option("--email <email>", "Your email (default: your HQ sign-in's email; must match it)")
-        .option("--person-name <name>", "Your display name (default: the name on your HQ sign-in)")
+        .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
+        .requiredOption("--person-name <name>", "Your display name")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
-        .action(async (flags) => {
+        .action(async (options) => {
         try {
-            const idToken = await ensureCognitoIdToken();
-            const resolved = resolveCreateCompanyIdentity(flags, peekIdToken(idToken));
-            if (!resolved.ok) {
-                console.error(chalk.red(`\n✗ ${resolved.message}`));
-                process.exit(1);
-            }
-            const options = { ...flags, ...resolved.identity };
             console.log(chalk.bold(`\nHQ Onboard — Create Company`));
             console.log(`  Company:  ${options.name} (${options.slug})`);
             console.log(`  Person:   ${options.personName} <${options.email}>`);
@@ -73,15 +63,6 @@ export function registerOnboardCommand(program) {
                 console.error(chalk.red(`\n✗ Onboarding failed: ${result.error}`));
                 process.exit(1);
             }
-            // Created from a local bot's conversation: keep that bot in the company.
-            const bot = botToAddAfterCreateCompany(process.env, result.result?.companyUid);
-            if (bot) {
-                const added = await addBotToNewCompany({ ...bot, token: accessToken });
-                if (added.ok)
-                    console.log(chalk.green(`✓ Added your bot (${bot.agentUid}) to ${options.name} as a member`));
-                else
-                    console.log(chalk.yellow(`! Could not add your bot (${bot.agentUid}) to ${options.name}: ${added.reason}. Invite it later with: hq members invite ${bot.agentUid} --company ${options.slug} --role member`));
-            }
         }
         catch (err) {
             console.error(chalk.red("\n✗ Error:"), err instanceof Error ? err.message : String(err));

package/dist/commands/pack-install.js

@@ -1421,9 +1421,7 @@ export async function makeInstallSecretResolver(secretNames, company) {
                 return () => null;
             [scopeUid] = scopes;
         }
-        const authorized = await loadRevealedSecrets(token, scopeUid, names, undefined, {
-            allowOfflineFallback: false,
-        });
+        const authorized = await loadRevealedSecrets(token, scopeUid, names);
         return (name) => authorized.get(name) ?? null;
     }
     catch {

package/dist/commands/packs.js

@@ -23,21 +23,11 @@ import { spawnSync } from 'child_process';
 import chalk from 'chalk';
 import semverSatisfies from 'semver/functions/satisfies.js';
 import { findHqRoot } from '../utils/manifest.js';
-import { resolveHqRoot as resolveDetectedHqRoot } from './doctor.js';
 import { classify, resolveLatest, resolveLatestMarketplace, runScanPackages, installPack, } from './pack-install.js';
 import { contributionLinks, linkStatus, listInstalledPacks, findDependentPacks, readPackManifest, unwirePack, unwirePackMcp, readHqVersion, readRecommendedPackages, packagesDir, } from '../utils/pack-contributions.js';
 function resolveRoot(opts) {
     return opts.hqRoot ? path.resolve(opts.hqRoot) : findHqRoot();
 }
-function resolvePackListRoot(opts) {
-    if (opts.hqRoot)
-        return path.resolve(opts.hqRoot);
-    const hqRoot = resolveDetectedHqRoot(process.cwd());
-    if (!hqRoot) {
-        throw new Error('hq packages: not inside an HQ tree. Run this command from inside your HQ root or pass --hq-root <path>.');
-    }
-    return hqRoot;
-}
 /** JSON when --json or when piped (non-TTY); human-readable on a terminal. */
 function wantsJson(opts) {
     return opts.json === true || !process.stdout.isTTY;
@@ -387,7 +377,7 @@ export function registerPacksListCommand(parent) {
         .option('--eval-conditionals', 'Evaluate catalog conditional predicates (runs bash)')
         .action(async (opts) => {
         try {
-            const view = await buildListView(resolvePackListRoot(opts), !!opts.checkUpdates, !!opts.evalConditionals, !!opts.refresh);
+            const view = await buildListView(resolveRoot(opts), !!opts.checkUpdates, !!opts.evalConditionals, !!opts.refresh);
             if (wantsJson(opts))
                 emitJson(view);
             else

package/dist/commands/people.d.ts

@@ -17,13 +17,9 @@ import { resolveNameToEmail, type PersonRecord } from "../utils/people.js";
 export type FetchPeopleRoster = (hqRoot: string, companySlug: string) => Promise<PersonRecord[]>;
 interface PeopleCommandDeps {
     fetchRoster?: FetchPeopleRoster;
-    /** Test seam for the shared active-membership ambiguity resolver. */
-    resolveMissingManifestMemberships?: () => Promise<void>;
-    companySelectionGuidanceEnabled?: () => boolean;
 }
 interface PeopleLookupOpts {
     localOnly?: boolean;
-    membershipOnly?: boolean;
     json?: boolean;
 }
 export declare function activeMemberToPersonRecord(m: ActiveMember): PersonRecord | null;

package/dist/commands/people.js

@@ -19,7 +19,6 @@ import { findHqRoot } from "../utils/manifest.js";
 import { manifestPath } from "./cloud-provision.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
-import { companyErrorsSdkWarningEnabled } from "../lib/company-errors-sdk-warning-flag.js";
 import { listActiveMembers } from "./members.js";
 import { assertSafeCompanySlug, listCompanyPeople, searchPeople, resolveNameToEmail, companyPeopleDir, } from "../utils/people.js";
 function slugify(value) {
@@ -42,8 +41,6 @@ export function activeMemberToPersonRecord(m) {
         slug,
         name,
         email,
-        personUid: m.personUid,
-        companyUid: m.companyUid,
         role: m.role || undefined,
         type: "internal",
         source: `hq-pro membership: /membership/company/${m.companyUid}`,
@@ -109,29 +106,6 @@ export function resolveCompanySlug(hqRoot, explicit) {
     throw new Error("Multiple companies found — re-run with --company <slug> to pick one:\n" +
         slugs.map((s) => `  --company ${s}`).join("\n"));
 }
-async function resolvePeopleCompanySlug(hqRoot, explicit, localOnly, deps) {
-    try {
-        return resolveCompanySlug(hqRoot, explicit);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        const ambiguous = message.includes("companies/manifest.yaml not found") ||
-            message.startsWith("Multiple companies found");
-        const enabled = (deps.companySelectionGuidanceEnabled ?? companyErrorsSdkWarningEnabled)();
-        if (!explicit && !localOnly && enabled && ambiguous) {
-            const resolveMemberships = deps.resolveMissingManifestMemberships ??
-                (async () => {
-                    const token = await ensureCognitoToken();
-                    await getCompanyUid(token, undefined);
-                });
-            // The shared resolver throws members-style guidance for multiple active
-            // companies. A single membership cannot provide a local slug without a
-            // manifest, so preserve the existing missing-manifest error in that case.
-            await resolveMemberships();
-        }
-        throw error;
-    }
-}
 /** Resolve the HQ root: explicit override (tests) → cwd walk-up. */
 function resolveHqRoot(opts) {
     return opts.hqRoot ?? findHqRoot();
@@ -173,13 +147,6 @@ async function tryFetchRoster(fetchRoster, hqRoot, slug) {
     }
 }
 export async function resolvePersonWithRosterFallback(input) {
-    if (input.opts?.membershipOnly) {
-        if (input.opts.localOnly)
-            throw new Error('--membership-only cannot be combined with --local-only');
-        // No local fallback: callers need authoritative IDs and must see transport errors.
-        const roster = await (input.fetchRoster ?? fetchMembershipRoster)(input.hqRoot, input.slug);
-        return resolveNameToEmail(roster, input.name);
-    }
     const localPeople = listCompanyPeople(input.hqRoot, input.slug);
     const local = resolveNameToEmail(localPeople, input.name);
     if (local.status !== "not_found" || input.opts?.localOnly)
@@ -216,7 +183,7 @@ export function registerPeopleCommand(program, deps = {}) {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
-            const slug = await resolvePeopleCompanySlug(hqRoot, scope.company, opts.localOnly, deps);
+            const slug = resolveCompanySlug(hqRoot, scope.company);
             let records = listCompanyPeople(hqRoot, slug);
             if (!opts.localOnly) {
                 const roster = await tryFetchRoster(deps.fetchRoster ?? fetchMembershipRoster, hqRoot, slug);
@@ -247,7 +214,7 @@ export function registerPeopleCommand(program, deps = {}) {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
-            const slug = await resolvePeopleCompanySlug(hqRoot, scope.company, opts.localOnly, deps);
+            const slug = resolveCompanySlug(hqRoot, scope.company);
             const matches = await searchPeopleWithRosterFallback({
                 hqRoot,
                 slug,
@@ -272,14 +239,13 @@ export function registerPeopleCommand(program, deps = {}) {
     people
         .command("resolve <name>")
         .description("Resolve a person name to their email address")
-        .option("--membership-only", "Resolve from authoritative company membership, ignoring local records")
         .option("--json", "Output JSON instead of plain text")
         .option("--local-only", "Skip network fallback; resolve only from the local people roster")
         .action(async (name, opts) => {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
-            const slug = await resolvePeopleCompanySlug(hqRoot, scope.company, opts.localOnly, deps);
+            const slug = resolveCompanySlug(hqRoot, scope.company);
             const result = await resolvePersonWithRosterFallback({
                 hqRoot,
                 slug,

package/dist/commands/publish.d.ts

@@ -130,7 +130,7 @@ export declare function unwrapListing(body: Record<string, unknown>): ListingRes
  * locally-resolved author handle — falling back gracefully when the server
  * omits either field.
  */
-export declare function buildListingNotice(status: number, body: Record<string, unknown>, packName: string, packVersion: string, selectedHandle?: string): string;
+export declare function buildListingNotice(status: number, body: Record<string, unknown>, packName: string, packVersion: string): string;
 /**
  * The exact JSON body the deployed `POST /v1/listings` handler expects. Field
  * shapes mirror the server contract: `type` ∈ {skill,worker}, `contributes` is
@@ -151,12 +151,6 @@ export interface ListingRequest {
      * caller is staff (`@getindigo.ai`) and the server has the capability enabled.
      */
     publishAsHandle?: string;
-    /**
-     * OPTIONAL explicit choice among the caller's OWN claimed creator handles
-     * (`hq publish --handle <h>`). The server refuses a handle the caller does
-     * not own (403 CREATOR_HANDLE_NOT_OWNED) instead of falling back.
-     */
-    ownedCreatorHandle?: string;
     /** Base64-encoded gzip pack tarball (pack.tar.gz bytes). */
     tarball: string;
 }
@@ -202,7 +196,6 @@ export interface PublishResult {
  */
 export declare function runPublish(targetPath: string, deps: PublishDeps, opts?: {
     publishAsHandle?: string;
-    creatorHandle?: string;
 }): Promise<PublishResult>;
 export declare function registerPublishCommand(program: Command): void;
 //# sourceMappingURL=publish.d.ts.map

package/dist/commands/publish.js

@@ -231,7 +231,7 @@ export function unwrapListing(body) {
  * locally-resolved author handle — falling back gracefully when the server
  * omits either field.
  */
-export function buildListingNotice(status, body, packName, packVersion, selectedHandle) {
+export function buildListingNotice(status, body, packName, packVersion) {
     if (status === 409) {
         throw new Error(`${packName}@${packVersion} is already published (duplicate version). ` +
             `Bump the version in package.yaml and re-run \`hq publish\`.`);
@@ -246,10 +246,6 @@ export function buildListingNotice(status, body, packName, packVersion, selected
     }
     if (status === 401 || status === 403) {
         const code = typeof body.code === 'string' ? body.code : '';
-        if (code === 'CREATOR_HANDLE_NOT_OWNED') {
-            const h = selectedHandle ?? '(unknown)';
-            throw new Error(`You do not own the creator handle ${h}. Claim it first with hq creators apply --handle ${h}.`);
-        }
         if (code === 'NOT_VERIFIED_CREATOR') {
             throw new Error('Only verified creators can publish to the marketplace. ' +
                 'Run `hq creators apply --reason "..."` to request verified-creator access; ' +
@@ -291,12 +287,6 @@ export async function runPublish(targetPath, deps, opts = {}) {
     const publishAsHandle = typeof opts.publishAsHandle === 'string' && opts.publishAsHandle.length > 0
         ? opts.publishAsHandle
         : undefined;
-    const selectedHandle = typeof opts.creatorHandle === 'string' && opts.creatorHandle.trim().length > 0
-        ? opts.creatorHandle.trim().replace(/^@/, '')
-        : undefined;
-    if (publishAsHandle && selectedHandle) {
-        throw new Error('Use either --as or --handle, not both. Nothing was uploaded.');
-    }
     // Resolve a payload dir. We stamp/validate against a temp copy so we never
     // mutate the user's working tree's package.yaml.
     const absTarget = path.resolve(process.cwd(), targetPath);
@@ -345,13 +335,12 @@ export async function runPublish(targetPath, deps, opts = {}) {
             // server is authoritative for attribution either way). Normal: our
             // resolved handle is a backwards-compat fallback under the server's
             // claimed-handle lookup.
-            creatorHandle: publishAsHandle ?? selectedHandle ?? author.handle,
+            creatorHandle: publishAsHandle ?? author.handle,
             ...(publishAsHandle ? { publishAsHandle } : {}),
-            ...(selectedHandle ? { ownedCreatorHandle: selectedHandle } : {}),
             tarball: Buffer.from(tarballBytes).toString('base64'),
         };
         const { status, body } = await deps.upload({ token, listing });
-        const notice = buildListingNotice(status, body, pkg.name, pkg.version, selectedHandle);
+        const notice = buildListingNotice(status, body, pkg.name, pkg.version);
         // Unwrap the `{ listing }` success envelope the server sends so attribution
         // reads the server's resolved handle (fall back to top-level for compat).
         const serverHandle = unwrapListing(body).creatorHandle?.trim();
@@ -373,8 +362,6 @@ export function registerPublishCommand(program) {
         .option('--as <handle>', 'Publish on behalf of a seeded, unclaimed creator by handle (HQ staff only). ' +
         'The listing is attributed to that creator instead of you.')
         .option('--on-behalf <handle>', 'Alias for --as.')
-        .option('--handle <handle>', 'Publish as one of your own claimed creator handles (for accounts that own more than one). ' +
-        'Defaults to your first claimed handle.')
         .action(async (targetPath, options) => {
         try {
             const publishAsHandle = options.as ?? options.onBehalf;
@@ -403,7 +390,7 @@ export function registerPublishCommand(program) {
                 },
                 hqRoot,
                 hqVersion: readHqVersion(hqRoot),
-            }, { publishAsHandle, creatorHandle: options.handle });
+            }, { publishAsHandle });
             console.log(chalk.green(result.notice));
             // Only print the locally-resolved author as a fallback when the server
             // did NOT return its own resolved handle (already in the notice).

package/dist/commands/reindex.js

@@ -1,11 +1,10 @@
 /**
- * hq reindex — surface namespaced skills and commands, clean up retired
- * personal-overlay mirror links, capture coding-harness session logs, regenerate
- * the workers registry, and converge HQ-owned hook trust for Codex, Grok, and
- * Claude Code.
+ * hq reindex — surface namespaced skills, mirror the personal overlay into
+ * core/, regenerate the workers registry, and converge HQ-owned hook trust for
+ * Codex, Grok, and Claude Code.
  *
- * Thin wrapper over @indigoai-us/hq-cloud's native TypeScript reindex(), which
- * runs against the HQ root. This command is what the hq-core
+ * Thin wrapper over @indigoai-us/hq-cloud's reindex(), which execs the bundled
+ * scripts/reindex.sh against the HQ root. This command is what the hq-core
  * reindex hook shim calls on Stop / PostToolUse, and what sync()/rescue() call
  * after they change on-disk sources.
  *
@@ -39,24 +38,6 @@ const HOOK_CHECK_RELATIVE_PATH = path.join('core', 'scripts', 'check-hq-hooks.sh
 const WORKTREE_STALE_AFTER_MS = 12 * 60 * 60 * 1_000;
 const WORKTREE_GIT_TIMEOUT_MS = 2_000;
 const WORKTREE_HOOK_SWEEP_BUDGET_MS = 5_000;
-/**
- * Ceiling for the shipped hook checker. Sized for the SLOWEST legitimate case,
- * not the fast one: an older core whose checker still runs an unscoped
- * `hq doctor`, on a loaded host, takes tens of seconds. Undercutting that would
- * convert a working checker into a permanent timeout. A wedged checker is still
- * bounded, which is the point.
- */
-const HOOK_CHECK_TIMEOUT_MS = 60_000;
-/** Ceiling override, in milliseconds. Present so tests need not wait a minute. */
-function hookCheckTimeoutMs() {
-    const raw = process.env.HQ_HOOK_CHECK_TIMEOUT_MS?.trim();
-    if (raw) {
-        const parsed = Number(raw);
-        if (Number.isFinite(parsed) && parsed > 0)
-            return parsed;
-    }
-    return HOOK_CHECK_TIMEOUT_MS;
-}
 /** Resolve the same root the repair/check commands must operate on. */
 function resolveHqRoot(repoRoot) {
     const root = repoRoot ?? findHqRoot();
@@ -354,37 +335,16 @@ function hasCommandHook(value) {
  * Run the release health checker when it is available. Its diagnostics cover
  * runtime/configuration issues outside the safe repair scope; the JSON check
  * below additionally recognizes UserPromptSubmit, which older checkers omit.
- *
- * Bounded, because reindex runs from Stop / PostToolUse lifecycle hooks and the
- * checker shells into `hq doctor`: an unbounded wait here is an unbounded stall
- * in front of the agent.
- *
- * An overrun is reported as a FAILED check, not as an absent one. Those two
- * look identical to `spawnSync` (both surface as an error) but mean opposite
- * things: absent is "this tree ships no checker, nothing more to learn", while
- * an overrun is "the checker exists and we did not hear back". Collapsing the
- * second into the first would let the slowest trees — exactly the ones running
- * an older, unscoped checker — report healthy while the drift only this checker
- * detects goes unseen.
  */
 function runShippedHookCheck(hqRoot) {
     const checker = path.join(hqRoot, HOOK_CHECK_RELATIVE_PATH);
     if (!fs.existsSync(checker))
         return undefined;
-    const budgetMs = hookCheckTimeoutMs();
     try {
         const result = spawnSync('bash', [checker, '--root', hqRoot], {
             encoding: 'utf8',
             stdio: 'pipe',
-            timeout: budgetMs,
         });
-        if (result.error?.code === 'ETIMEDOUT') {
-            return {
-                status: 1,
-                output: `the shipped ${HOOK_CHECK_RELATIVE_PATH} check did not finish within ` +
-                    `${Math.round(budgetMs / 1000)}s, so hook health could not be determined`,
-            };
-        }
         if (result.error)
             return undefined;
         return {
@@ -396,17 +356,8 @@ function runShippedHookCheck(hqRoot) {
         return undefined;
     }
 }
-/**
- * Classify the tree's hook configuration, cheapest signal first.
- *
- * The shipped checker runs LAST and only when everything else looks healthy.
- * That ordering is not a micro-optimisation: its result is consulted in exactly
- * one branch — the final healthy/minor decision — so on a tree that is already
- * extreme or already minor it is a subprocess whose answer is discarded. Since
- * reindex fires on every Stop / PostToolUse hook, that was the single most
- * expensive discarded result in the command.
- */
 function inspectHookHealth(hqRoot) {
+    const checkerResult = runShippedHookCheck(hqRoot);
     const settingsPath = path.join(hqRoot, '.claude', 'settings.json');
     if (!fs.existsSync(settingsPath)) {
         return { state: 'extreme', reason: '.claude/settings.json is missing' };
@@ -435,7 +386,6 @@ function inspectHookHealth(hqRoot) {
             reason: `missing command hook wiring for ${HOOK_EVENTS.filter((event) => !commandEvents.includes(event)).join(', ')}`,
         };
     }
-    const checkerResult = runShippedHookCheck(hqRoot);
     if (checkerResult !== undefined && checkerResult.status !== 0) {
         return {
             state: 'minor',

package/dist/commands/rescue.d.ts

@@ -45,9 +45,5 @@ export declare function shouldAttemptSelfUpdate(opts: {
     check?: boolean;
     selfUpdate?: boolean;
 }): boolean;
-/** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
-export declare function getLatestReleaseTag(repo: string, token?: string): Promise<string>;
-/** Resolve a tag to its commit SHA, dereferencing annotated tags. */
-export declare function resolveTagSha(repo: string, tag: string, token?: string): Promise<string>;
 export declare function registerRescueCommand(program: Command): void;
 //# sourceMappingURL=rescue.d.ts.map

package/dist/commands/rescue.js

@@ -53,48 +53,38 @@ function ghHeaders(token) {
         headers.Authorization = `Bearer ${token}`;
     return headers;
 }
-// Thirty seconds gives GitHub time to respond while keeping the recovery command bounded.
-const GITHUB_REQUEST_TIMEOUT_MS = 30_000;
-async function githubJsonRequest(url, token) {
-    const signal = AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS);
-    try {
-        const response = await fetch(url, { headers: ghHeaders(token), signal });
-        if (!response.ok)
-            return { response };
-        const body = (await response.json());
-        return { response, body };
-    }
-    catch (error) {
-        if (signal.aborted)
-            throw new Error('GitHub request timed out', { cause: error });
-        throw error;
-    }
-}
 /** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
-export async function getLatestReleaseTag(repo, token) {
-    const { response, body } = await githubJsonRequest(`https://api.github.com/repos/${repo}/releases/latest`, token);
-    if (!response.ok) {
-        throw new Error(`GitHub releases/latest for ${repo}: HTTP ${response.status}`);
+async function getLatestReleaseTag(repo, token) {
+    const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
+        headers: ghHeaders(token),
+    });
+    if (!res.ok) {
+        throw new Error(`GitHub releases/latest for ${repo}: HTTP ${res.status}`);
     }
-    if (!body?.tag_name)
+    const body = (await res.json());
+    if (!body.tag_name)
         throw new Error(`no tag_name in latest release for ${repo}`);
     return body.tag_name;
 }
 /** Resolve a tag to its commit SHA, dereferencing annotated tags. */
-export async function resolveTagSha(repo, tag, token) {
-    const { response: refRes, body: ref } = await githubJsonRequest(`https://api.github.com/repos/${repo}/git/ref/tags/${encodeURIComponent(tag)}`, token);
+async function resolveTagSha(repo, tag, token) {
+    const refRes = await fetch(`https://api.github.com/repos/${repo}/git/ref/tags/${encodeURIComponent(tag)}`, { headers: ghHeaders(token) });
     if (!refRes.ok)
         throw new Error(`git/ref/tags/${tag} for ${repo}: HTTP ${refRes.status}`);
-    const obj = ref?.object;
+    const ref = (await refRes.json());
+    const obj = ref.object;
     if (!obj?.sha)
         throw new Error(`no object.sha for tag ${tag} in ${repo}`);
     if (obj.type !== 'tag')
         return obj.sha; // lightweight tag → already a commit
     // Annotated tag → dereference to the commit it points at.
-    const { response: tagRes, body: annotated } = await githubJsonRequest(`https://api.github.com/repos/${repo}/git/tags/${obj.sha}`, token);
+    const tagRes = await fetch(`https://api.github.com/repos/${repo}/git/tags/${obj.sha}`, {
+        headers: ghHeaders(token),
+    });
     if (!tagRes.ok)
         throw new Error(`git/tags/${obj.sha} for ${repo}: HTTP ${tagRes.status}`);
-    if (!annotated?.object?.sha)
+    const annotated = (await tagRes.json());
+    if (!annotated.object?.sha)
         throw new Error(`annotated tag ${tag} has no target sha`);
     return annotated.object.sha;
 }

package/dist/commands/run.js

@@ -2,16 +2,14 @@ import { spawn } from 'node:child_process';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { internal } from 'varlock';
-import { cognitoCachePrincipalUid, ensureCognitoToken } from '../utils/cognito-session.js';
+import { ensureCognitoToken } from '../utils/cognito-session.js';
 import { apiKeyCapabilityGateMessage, peekHqApiKey, } from '../utils/resolve-vault-credential.js';
 import { computeSha256 } from '../utils/integrity.js';
-import { isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from '../utils/secret-load-availability.js';
 import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
 import { discoverSchemas } from '../run/discover-schemas.js';
 import { installHqPlugin, prewarmHqSecrets } from '../run/hq-plugin.js';
 import { assertEnvGraphLoaded, resolveEnvValuesOrThrow, EnvGraphLoadError, EnvResolutionError, } from '../run/env-graph-guard.js';
 import { hadFatalRejection } from '../unhandled-rejection-boundary.js';
-import { withRunSecretReadTelemetry } from './run-feature-telemetry.js';
 const SECRET_LOAD_TIMEOUT_MS = 30_000;
 export async function buildRunUsage(scriptPath, scriptId) {
     if (scriptId && !scriptPath) {
@@ -84,11 +82,9 @@ export function registerRunCommand(program) {
                 throw new Error('company slug not set. Add # @hqCompany("slug") to your .env.schema or pass --company <slug>.');
             }
             const token = await ensureCognitoToken();
-            const uid = await getCompanyUid(token, slug, undefined, {
-                allowOfflineScopeFallback: true,
-            });
+            const uid = await getCompanyUid(token, slug);
             const usage = await buildRunUsage(opts.script, opts.scriptId);
-            const fetchBatch = async (companyUid, names, requestUsage) => withRunSecretReadTelemetry(companyUid, async () => {
+            const fetchBatch = async (companyUid, names, requestUsage) => {
                 const res = await vaultApiFetch({
                     token,
                     path: `/secrets/${encodeURIComponent(companyUid)}/load`,
@@ -103,9 +99,6 @@ export function registerRunCommand(program) {
                         : typeof body.error === 'string'
                             ? body.error
                             : res.statusText;
-                    if (isUnavailableSecretLoadHttpStatus(res.status)) {
-                        throw new SecretLoadUnavailableError(`Failed to batch-load secrets: ${message}`);
-                    }
                     if (res.status >= 400 &&
                         res.status < 500 &&
                         typeof body.code === 'string') {
@@ -114,11 +107,9 @@ export function registerRunCommand(program) {
                     throw new Error(`Failed to batch-load secrets: ${message}`);
                 }
                 return res.json();
-            });
+            };
             const pluginOpts = {
                 companyOverride: opts.company,
-                principalUid: cognitoCachePrincipalUid(token) ?? undefined,
-                allowOfflineFallback: true,
                 resolveCompanyUid: async () => uid,
                 usage,
                 fetchBatch,
@@ -128,11 +119,6 @@ export function registerRunCommand(program) {
             let state;
             const graph = await internal.loadEnvGraph({
                 entryFilePaths: paths,
-                // hq run owns its short-lived in-memory resolution. Varlock's default
-                // cache auto-detection can write ~/.config/varlock and initialize
-                // the native local-encryption helper, neither of which belongs on
-                // this command path.
-                skipCache: true,
                 afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
             });
             // Refuse to resolve a graph varlock never finished loading (a malformed

package/dist/commands/safe-extract.d.ts

@@ -32,7 +32,6 @@
  *     actually written (we do NOT rely solely on the pre-flight scan or on the
  *     tar binary's own protections).
  */
-import { execFileSync } from 'child_process';
 export interface ExtractCaps {
     /** Max total uncompressed bytes across all entries. Default 256 MiB. */
     maxUncompressedBytes: number;
@@ -110,13 +109,9 @@ export declare function resolveContainedPath(targetDir: string, entryName: strin
 export declare function assertLinkTargetContained(packDir: string, entryAbs: string, linkTarget: string): void;
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
- * argv form, never a shell string, keeps hostile filenames out of shell syntax.
- * Windows drive paths use a basename relative to the archive directory by
- * default. GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows'
- * bundled bsdtar accepts the same relative argv without GNU-only `--force-local`.
- * Callers can still explicitly opt out with `useRelativeWindowsDrivePath: false`.
+ * argv form — never a shell string — so a hostile filename can't break out.
  */
-export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtractOptions, 'platform' | 'useRelativeWindowsDrivePath' | 'execFileSync'>): TarEntry[];
+export declare function listTarball(tarballPath: string): TarEntry[];
 /**
  * Pre-flight validation against the entry headers. Enforces (a) containment of
  * every entry name under `targetDir`, (b) containment of every link target
@@ -134,10 +129,6 @@ export declare function validateEntries(entries: TarEntry[], targetDir: string,
 export declare function assertExtractContained(stagingDir: string): void;
 export interface SafeExtractOptions {
     caps?: ExtractCaps;
-    /** Test seams for platform-specific argv construction; runtime gating uses hq-flags. */
-    platform?: NodeJS.Platform;
-    useRelativeWindowsDrivePath?: boolean;
-    execFileSync?: typeof execFileSync;
     /**
      * Test seam: invoked AFTER `tar` extracts into the staging dir but BEFORE
      * the post-extract sweep / atomic rename. Throwing here simulates a failure