@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/commands/safe-extract.js

@@ -203,34 +203,18 @@ export function assertLinkTargetContained(packDir, entryAbs, linkTarget) {
             `"${linkTarget}" -> "${resolvedTarget}", outside pack dir "${path.resolve(packDir)}".`);
     }
 }
-function tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath) {
-    if (platform === 'win32' &&
-        useRelativeWindowsDrivePath &&
-        /^[A-Za-z]:[\\/]/.test(tarballPath)) {
-        return {
-            archiveArg: path.win32.basename(tarballPath),
-            cwd: path.win32.dirname(tarballPath),
-        };
-    }
-    return { archiveArg: tarballPath };
-}
+// ---------------------------------------------------------------------------
+// Pre-flight: list entries, enforce containment + caps WITHOUT extracting
+// ---------------------------------------------------------------------------
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
- * argv form, never a shell string, keeps hostile filenames out of shell syntax.
- * Windows drive paths use a basename relative to the archive directory by
- * default. GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows'
- * bundled bsdtar accepts the same relative argv without GNU-only `--force-local`.
- * Callers can still explicitly opt out with `useRelativeWindowsDrivePath: false`.
+ * argv form — never a shell string — so a hostile filename can't break out.
  */
-export function listTarball(tarballPath, opts = {}) {
-    const platform = opts.platform ?? process.platform;
-    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? true;
-    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
-    const out = (opts.execFileSync ?? execFileSync)('tar', ['-tvf', location.archiveArg], {
+export function listTarball(tarballPath) {
+    const out = execFileSync('tar', ['-tvf', tarballPath], {
         encoding: 'utf-8',
         maxBuffer: 64 * 1024 * 1024,
         stdio: ['ignore', 'pipe', 'pipe'],
-        ...(location.cwd ? { cwd: location.cwd } : {}),
     });
     return parseTarListing(out);
 }
@@ -327,17 +311,8 @@ export function safeExtractTarball(tarballPath, finalDir, opts = {}) {
     if (fs.existsSync(finalDir)) {
         throw new Error(`safeExtractTarball: refusing to extract over existing dir "${finalDir}".`);
     }
-    // Resolve once so listing and extraction use the same archive location.
-    const platform = opts.platform ?? process.platform;
-    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? true;
-    const exec = opts.execFileSync ?? execFileSync;
-    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
     // 1. Pre-flight against headers (no bytes written yet).
-    const entries = listTarball(tarballPath, {
-        platform,
-        useRelativeWindowsDrivePath,
-        execFileSync: exec,
-    });
+    const entries = listTarball(tarballPath);
     validateEntries(entries, finalDir, caps);
     // 2. Sibling staging dir on the same filesystem so the rename is atomic.
     const parent = path.dirname(path.resolve(finalDir));
@@ -347,10 +322,7 @@ export function safeExtractTarball(tarballPath, finalDir, opts = {}) {
         // `--no-same-owner` avoids chown surprises when run as root; argv form, no
         // shell. We deliberately re-extract here (not the pre-flight listing) and
         // re-validate after, rather than trusting tar to honor any single flag.
-        exec('tar', ['-xzf', location.archiveArg, '-C', stagingDir, '--no-same-owner'], {
-            stdio: 'inherit',
-            ...(location.cwd ? { cwd: location.cwd } : {}),
-        });
+        execFileSync('tar', ['-xzf', tarballPath, '-C', stagingDir, '--no-same-owner'], { stdio: 'inherit' });
         // 3. Independent backstop sweep over what actually landed.
         assertExtractContained(stagingDir);
         // 4. Failure-injection seam (tests).

package/dist/commands/scaffold-fast.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Fast-path manifest for relocated scaffold scripts, kept deliberately
+ * dependency-light.
+ *
+ * `main.ts` eagerly imports the CLI's entire (~60-module) command graph, so any
+ * command routed through it pays seconds of startup — fine for a human typing a
+ * command, ruinous for the hot plumbing this hosts: `hq core hq-session` is
+ * called several times per skill/hook, and `hq core checkpoint-stop-gate` runs
+ * on every turn's Stop. The entrypoint routes those directly to
+ * `runBundledScript` instead, and this module holds the tiny parser + table that
+ * routing needs WITHOUT importing anything heavy. `core.ts` names the same
+ * assets, and a test pins the two lists together so they cannot drift.
+ */
+export type FastScaffoldScript = {
+    /** Direct subcommand name — `hq core <name>`. */
+    name: string;
+    /** Path under `assets/scaffold/`, e.g. `core/scripts/foo.sh`. */
+    asset: string;
+};
+/** The relocated scripts that qualify for the entrypoint fast path. */
+export declare const FAST_SCAFFOLD_SCRIPTS: readonly FastScaffoldScript[];
+export type ParsedFastCore = {
+    /** The bundled asset to run. */
+    asset: string;
+    /** `--hq-root <path>` value, if the caller passed the group option. */
+    hqRootArg?: string;
+    /** Everything after the command name, passed to the script verbatim. */
+    args: string[];
+};
+/**
+ * Parse `hq core [--hq-root <path>] <name> [args...]` when `<name>` is a
+ * fast-path script. Returns null for anything else so the caller defers to the
+ * full CLI. Mirrors the `core` group's single `--hq-root` option (both the
+ * `--hq-root <path>` and `--hq-root=<path>` forms) and its `root: "live"`
+ * binding; every remaining token is passed through untouched, exactly as the
+ * commander registration does with allowUnknownOption + a variadic argument.
+ */
+export declare function parseFastCore(argv: readonly string[]): ParsedFastCore | null;
+/** Whether this invocation is a fast-path scaffold dispatch. */
+export declare function isFastCoreRequest(argv: readonly string[]): boolean;
+//# sourceMappingURL=scaffold-fast.d.ts.map

package/dist/commands/scaffold-fast.js

@@ -0,0 +1,57 @@
+/**
+ * Fast-path manifest for relocated scaffold scripts, kept deliberately
+ * dependency-light.
+ *
+ * `main.ts` eagerly imports the CLI's entire (~60-module) command graph, so any
+ * command routed through it pays seconds of startup — fine for a human typing a
+ * command, ruinous for the hot plumbing this hosts: `hq core hq-session` is
+ * called several times per skill/hook, and `hq core checkpoint-stop-gate` runs
+ * on every turn's Stop. The entrypoint routes those directly to
+ * `runBundledScript` instead, and this module holds the tiny parser + table that
+ * routing needs WITHOUT importing anything heavy. `core.ts` names the same
+ * assets, and a test pins the two lists together so they cannot drift.
+ */
+/** The relocated scripts that qualify for the entrypoint fast path. */
+export const FAST_SCAFFOLD_SCRIPTS = [
+    { name: "checkpoint-stop-gate", asset: "core/scripts/checkpoint-stop-gate.sh" },
+    { name: "hq-session", asset: "core/scripts/hq-session.sh" },
+];
+/**
+ * Parse `hq core [--hq-root <path>] <name> [args...]` when `<name>` is a
+ * fast-path script. Returns null for anything else so the caller defers to the
+ * full CLI. Mirrors the `core` group's single `--hq-root` option (both the
+ * `--hq-root <path>` and `--hq-root=<path>` forms) and its `root: "live"`
+ * binding; every remaining token is passed through untouched, exactly as the
+ * commander registration does with allowUnknownOption + a variadic argument.
+ */
+export function parseFastCore(argv) {
+    // argv is process.argv: [node, hq, core, ...rest].
+    if (argv[2] !== "core")
+        return null;
+    let i = 3;
+    let hqRootArg;
+    const head = argv[i];
+    if (head === "--hq-root") {
+        const value = argv[i + 1];
+        if (typeof value !== "string")
+            return null;
+        hqRootArg = value;
+        i += 2;
+    }
+    else if (typeof head === "string" && head.startsWith("--hq-root=")) {
+        hqRootArg = head.slice("--hq-root=".length);
+        i += 1;
+    }
+    const name = argv[i];
+    if (typeof name !== "string")
+        return null;
+    const entry = FAST_SCAFFOLD_SCRIPTS.find((candidate) => candidate.name === name);
+    if (!entry)
+        return null;
+    return { asset: entry.asset, hqRootArg, args: argv.slice(i + 1) };
+}
+/** Whether this invocation is a fast-path scaffold dispatch. */
+export function isFastCoreRequest(argv) {
+    return parseFastCore(argv) !== null;
+}
+//# sourceMappingURL=scaffold-fast.js.map

package/dist/commands/secrets.d.ts

@@ -1,4 +1,4 @@
-import type { Command } from "commander";
+import { Command } from "commander";
 import { writeSync } from "node:fs";
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
@@ -31,7 +31,6 @@ export interface SecretMetadata {
         requiredAttestation?: string;
     };
     cacheTtlMs?: number;
-    revokedAt?: string | null;
 }
 export interface SecretLoadSuccessRow extends SecretMetadata {
     name: string;
@@ -60,9 +59,7 @@ export declare function parseDestinationUrl(raw: string): {
 };
 export declare function collectSecretNames(value: string, previous?: string[]): string[];
 export declare function scrubSandboxOutput(text: string, secretNames?: string[]): string;
-export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
-    allowOfflineFallback?: boolean;
-}): Promise<Map<string, string>>;
+export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage): Promise<Map<string, string>>;
 /**
  * Emit `hq secrets env` output and terminate deterministically.
  *
@@ -88,20 +85,5 @@ export declare function loadRevealedSecrets(token: string, companyUid: string, k
  * `exit` and `write` are injectable for tests; production uses the real ones.
  */
 export declare function emitEnvExportsAndExit(payload: string, exit?: (code: number) => never, write?: typeof writeSync): never;
-/**
- * Shared `secrets env` action for Commander and the default-off lightweight
- * entrypoint. The fast entrypoint still runs the same credential, usage-audit,
- * server authorization, cache-fallback, redaction, and output code.
- */
-export declare function runSecretsEnvCommand(opts: {
-    only: string[];
-    script?: string;
-    scriptId?: string;
-}, parentScope: {
-    company?: string;
-    personal?: boolean;
-}, options?: {
-    fallbackOnAuthFailure?: boolean;
-}): Promise<"handled" | "fallback">;
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.js

@@ -1,16 +1,16 @@
 import chalk from "chalk";
+import * as readline from "node:readline";
+import { spawn } from "node:child_process";
 import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
-import { cognitoCachePrincipalUid, ensureCognitoToken } from "../utils/cognito-session.js";
-import { isAuthError } from "../utils/auth-error.js";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { computeSha256 } from "../utils/integrity.js";
-import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
-import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "../utils/secret-load-availability.js";
+import { SandboxRunnerClient, } from "../utils/sandbox-runner-client.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 /**
  * Mirrors `RESOURCE_SURFACES` in hq-pro
@@ -43,19 +43,7 @@ export const CLI_SECRETS_SET_SURFACE = "cli_secrets_set";
  */
 async function requireCognitoTokenForSecrets(commandLabel, capability = null) {
     requireApiKeyCapability(capability, commandLabel, { routeAvailable: false });
-    return ensureCognitoToken(secretsCredentialOptions());
-}
-/**
- * A browser login is safe only when a person can answer it. This mirrors the
- * repository's existing terminal convention in `canOfferTeamUpgrade`: both
- * stdin and stderr must be TTYs, and CI is always non-interactive.
- */
-function secretsCredentialOptions() {
-    return {
-        interactive: process.stdin.isTTY === true &&
-            process.stderr.isTTY === true &&
-            !process.env.CI,
-    };
+    return ensureCognitoToken();
 }
 function scopeOpts(opts) {
     if (opts.personal && opts.company) {
@@ -108,7 +96,7 @@ function resolveApiKeyCompanyUid(scope, commandLabel) {
     return ref;
 }
 async function resolveSecretsTarget(capability, commandLabel, scopeOptions) {
-    const cred = await resolveVaultCredentialForCapability(capability, commandLabel, secretsCredentialOptions());
+    const cred = await resolveVaultCredentialForCapability(capability, commandLabel);
     const scope = scopeOpts(scopeOptions);
     const isApiKey = cred.kind === "api-key";
     const companyUid = isApiKey
@@ -157,16 +145,14 @@ function parseDuration(input) {
     return null;
 }
 function confirmPrompt(message) {
-    return import("node:readline").then(({ createInterface }) => {
-        const rl = createInterface({
-            input: process.stdin,
-            output: process.stdout,
-        });
-        return new Promise((resolve) => {
-            rl.question(`${message} [y/N] `, (answer) => {
-                rl.close();
-                resolve(answer.trim().toLowerCase() === "y");
-            });
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(`${message} [y/N] `, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase() === "y");
         });
     });
 }
@@ -190,23 +176,12 @@ function promptSecretInteractively() {
         let value = "";
         process.stdin.setEncoding("utf8");
         const cleanup = () => {
-            try {
-                if (process.stdin.isTTY) {
-                    try {
-                        process.stdin.setRawMode(false);
-                    }
-                    catch (error) {
-                        if (error?.code !== "EBADF") {
-                            throw error;
-                        }
-                    }
-                }
-            }
-            finally {
-                process.stdin.removeListener("data", onData);
-                process.stdin.removeListener("end", onEnd);
-                process.stdin.pause();
+            if (process.stdin.isTTY) {
+                process.stdin.setRawMode(false);
             }
+            process.stdin.removeListener("data", onData);
+            process.stdin.removeListener("end", onEnd);
+            process.stdin.pause();
         };
         const onEnd = () => {
             cleanup();
@@ -535,11 +510,11 @@ function renderPolicyScripts(scripts) {
 // `env` through it stops those callers from emitting the warning while keeping
 // identical UX and error text.
 //
-// Every value use through exec/env/reveal is server-authorized when online,
-// including when an encrypted disk-cache entry exists. Only explicitly opted-in
-// exec/env callers may use principal-bound values during classified outages;
-// install authorization and reveal remain online-only. This means a policy,
-// ACL, tier, or script-approval change takes effect on the next online use.
+// Every value use through exec/env/reveal is server-authorized, including when
+// an encrypted disk-cache entry exists. The cache remains write-through for
+// explicitly offline install-time consumers; these commands never trust it as
+// an authorization decision. This means a policy, ACL, tier, or script-approval
+// change takes effect on their next use even though there is no push revocation.
 // Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
 // with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
 // path used — never swallows a failure.
@@ -587,16 +562,13 @@ async function loadRevealedSecretsViaApiKey(token, keys) {
     }
     return resolved;
 }
-export async function loadRevealedSecrets(token, companyUid, keys, usage, options = {}) {
+export async function loadRevealedSecrets(token, companyUid, keys, usage) {
     if (token.startsWith(HQ_API_KEY_PREFIX)) {
         return loadRevealedSecretsViaApiKey(token, keys);
     }
     const resolved = new Map();
     const requested = [...new Set(keys)];
-    const principalUid = cognitoCachePrincipalUid(token);
-    const cachedCandidates = new Set(principalUid
-        ? requested.filter((name) => hasCacheEntry(companyUid, name, principalUid))
-        : []);
+    const cachedCandidates = new Set(requested.filter((name) => hasCacheEntry(companyUid, name)));
     try {
         // The batch endpoint is the only non-capturing authorization path that also
         // evaluates the supplied usage metadata. It covers warm and cold names in
@@ -623,9 +595,6 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage, option
                     body.highSecurity === true) {
                     throw new Error(highSecuritySandboxOnlyMessage());
                 }
-                if (isUnavailableSecretLoadHttpStatus(res.status)) {
-                    throw new SecretLoadUnavailableError(`Failed to batch-load secrets: ${message}`);
-                }
                 if (res.status >= 400 &&
                     res.status < 500 &&
                     typeof body.code === "string") {
@@ -654,14 +623,6 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage, option
                     throw new Error("Invalid secret load response from vault");
                 }
                 seenNames.add(s.name);
-                if (s.revokedAt != null) {
-                    errorsByName.set(s.name, {
-                        code: "revoked",
-                        message: `Secret '${s.name}' has been revoked`,
-                    });
-                    removeCacheEntry(companyUid, s.name);
-                    continue;
-                }
                 if (s.value == null) {
                     errorsByName.set(s.name, {
                         code: "not_returned",
@@ -676,7 +637,7 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage, option
                     typeof s.version === "number" &&
                     Number.isSafeInteger(s.version) &&
                     s.version > 0
-                    ? readCache(companyUid, s.name, principalUid, s.version, cacheTtlMs)
+                    ? readCache(companyUid, s.name, s.version, cacheTtlMs)
                     : null;
                 if (cached !== null) {
                     resolved.set(s.name, cached);
@@ -686,12 +647,10 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage, option
                     if (typeof s.version === "number" &&
                         Number.isSafeInteger(s.version) &&
                         s.version > 0) {
-                        if (principalUid) {
-                            writeCache(companyUid, s.name, principalUid, s.value, cacheTtlMs, s.version);
-                        }
+                        writeCache(companyUid, s.name, s.value, cacheTtlMs, s.version);
                     }
-                    else if (principalUid) {
-                        writeCache(companyUid, s.name, principalUid, s.value, cacheTtlMs);
+                    else {
+                        writeCache(companyUid, s.name, s.value, cacheTtlMs);
                     }
                 }
                 else {
@@ -748,29 +707,9 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage, option
         return resolved;
     }
     catch (err) {
-        if (isSecretLoadUnavailable(err) && options.allowOfflineFallback === true) {
-            const offline = new Map();
-            for (const key of requested) {
-                const cached = cachedCandidates.has(key)
-                    ? readCache(companyUid, key, principalUid)
-                    : null;
-                if (cached === null) {
-                    // Keep the same failure behavior for a cache miss, while leaving any
-                    // still-valid entries untouched for a later retry.
-                    throw err;
-                }
-                offline.set(key, cached);
-            }
-            console.error(CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE);
-            return offline;
-        }
-        if (isSecretLoadUnavailable(err)) {
-            throw err;
-        }
         // A transport failure, stale session, malformed response, or a later chunk
-        // failure is an explicit denial or unusable response. Evict the whole
-        // request before failing closed. Transient no-answer/5xx/429 failures above
-        // preserve entries and only use values still valid under their stored TTL.
+        // failure must not leave values written by this attempted operation available
+        // to offline cache readers. Evict the whole request before failing closed.
         for (const key of requested) {
             removeCacheEntry(companyUid, key);
         }
@@ -821,61 +760,6 @@ export function emitEnvExportsAndExit(payload, exit = process.exit, write = writ
     }
     return exit(0);
 }
-/**
- * Shared `secrets env` action for Commander and the default-off lightweight
- * entrypoint. The fast entrypoint still runs the same credential, usage-audit,
- * server authorization, cache-fallback, redaction, and output code.
- */
-export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
-    let secretLoadStarted = false;
-    try {
-        const redact = process.stdout.isTTY;
-        if (redact) {
-            console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
-        }
-        const keys = parseSecretNameList(opts.only);
-        const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
-        const companyUid = cred.kind === "api-key"
-            ? "__api_key__"
-            : await getEntityUid(cred.token, scopeOpts(parentScope), {
-                allowOfflineScopeFallback: true,
-            });
-        const usage = cred.kind === "cognito"
-            ? await buildSecretUsage("env", opts.script, opts.scriptId)
-            : undefined;
-        secretLoadStarted = true;
-        const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, usage, { allowOfflineFallback: true });
-        let payload = "";
-        for (const key of keys) {
-            const value = revealed.get(key);
-            // loadRevealedSecrets throws on any unresolved key, so a miss here is
-            // unreachable — guard rather than print an `undefined` export line.
-            if (value === undefined) {
-                throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
-            }
-            const out = redact ? "[REDACTED]" : value;
-            payload += `export ${key}=${shellSingleQuote(out)}\n`;
-        }
-        // Write synchronously and exit unconditionally — never depend on the
-        // event loop draining or the stdout write callback firing. See
-        // emitEnvExportsAndExit for the full rationale (orphaned-process leak).
-        emitEnvExportsAndExit(payload);
-        return "handled";
-    }
-    catch (err) {
-        if (options.fallbackOnAuthFailure &&
-            !secretLoadStarted &&
-            (isAuthError(err) ||
-                (err instanceof Error &&
-                    (/^No valid HQ session\b/.test(err.message) ||
-                        /^HQ_API_KEY must start with /.test(err.message))))) {
-            return "fallback";
-        }
-        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-        process.exit(1);
-        return "handled";
-    }
-}
 export function registerSecretsCommand(program) {
     const secrets = program
         .command("secrets")
@@ -989,11 +873,6 @@ export function registerSecretsCommand(program) {
             }
         }
         catch (err) {
-            // A plan-limit refusal goes to main.ts's shared renderer, which prints
-            // the reason, usage, fix options and upgrade link, offers the upgrade
-            // interactively, and exits non-zero.
-            if (isPlanGateError(err))
-                throw err;
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
             process.exit(1);
         }
@@ -1004,7 +883,7 @@ export function registerSecretsCommand(program) {
         .option("--reveal", "Include the decrypted secret value")
         .action(async (name, opts) => {
         try {
-            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets get", secretsCredentialOptions());
+            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets get");
             if (cred.kind === "api-key") {
                 if (!opts.reveal) {
                     console.error(chalk.red("HQ_API_KEY is set; `hq secrets get` without --reveal is not supported for API keys. " +
@@ -1077,7 +956,7 @@ export function registerSecretsCommand(program) {
             let revealError = null;
             if (opts.reveal) {
                 try {
-                    revealedValue = (await loadRevealedSecrets(token, companyUid, [name], await buildSecretUsage("reveal"), { allowOfflineFallback: false })).get(name);
+                    revealedValue = (await loadRevealedSecrets(token, companyUid, [name], await buildSecretUsage("reveal"))).get(name);
                 }
                 catch (err) {
                     revealError = err instanceof Error ? err.message : String(err);
@@ -1505,7 +1384,6 @@ export function registerSecretsCommand(program) {
             const token = await requireCognitoTokenForSecrets("secrets sandbox", "secrets:read");
             const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
             const companyUid = await getEntityUid(token, scope);
-            const { SandboxRunnerClient } = await import("../utils/sandbox-runner-client.js");
             const client = new SandboxRunnerClient();
             const started = await client.startJob(token, {
                 companyUid,
@@ -1556,23 +1434,13 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
-            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets exec", secretsCredentialOptions());
+            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets exec");
             const companyUid = cred.kind === "api-key"
                 ? "__api_key__"
-                : await getEntityUid(cred.token, scopeOpts(secrets.opts()), { allowOfflineScopeFallback: true });
-            const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
+                : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
+            const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
-                : undefined, { allowOfflineFallback: true });
-            // API-key auth has no signed-in person identity for the CLI telemetry
-            // endpoint. Do not attribute that read to an unrelated cached session.
-            let revealed;
-            if (cred.kind === "cognito") {
-                const { withCliFeatureUsed } = await import("../utils/cli-telemetry.js");
-                revealed = await withCliFeatureUsed("secret_read", readSecrets, companyUid);
-            }
-            else {
-                revealed = await readSecrets();
-            }
+                : undefined);
             const secretEnv = {};
             for (const key of keys) {
                 const value = revealed.get(key);
@@ -1584,7 +1452,6 @@ export function registerSecretsCommand(program) {
                 secretEnv[key] = value;
             }
             const [childCmd, ...childCmdArgs] = childArgs;
-            const { spawn } = await import("node:child_process");
             const child = spawn(childCmd, childCmdArgs, {
                 stdio: "inherit",
                 env: { ...process.env, ...secretEnv },
@@ -1612,7 +1479,39 @@ export function registerSecretsCommand(program) {
         .option("--script <path>", "Attach local script identity for script-locked secrets")
         .option("--script-id <id>", "Stable script identifier approved by policy")
         .action(async (opts) => {
-        await runSecretsEnvCommand(opts, secrets.opts());
+        try {
+            const redact = process.stdout.isTTY;
+            if (redact) {
+                console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
+            }
+            const keys = parseSecretNameList(opts.only);
+            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env");
+            const companyUid = cred.kind === "api-key"
+                ? "__api_key__"
+                : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
+            const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
+                ? await buildSecretUsage("env", opts.script, opts.scriptId)
+                : undefined);
+            let payload = "";
+            for (const key of keys) {
+                const value = revealed.get(key);
+                // loadRevealedSecrets throws on any unresolved key, so a miss here is
+                // unreachable — guard rather than print an `undefined` export line.
+                if (value === undefined) {
+                    throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
+                }
+                const out = redact ? "[REDACTED]" : value;
+                payload += `export ${key}=${shellSingleQuote(out)}\n`;
+            }
+            // Write synchronously and exit unconditionally — never depend on the
+            // event loop draining or the stdout write callback firing. See
+            // emitEnvExportsAndExit for the full rationale (orphaned-process leak).
+            emitEnvExportsAndExit(payload);
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
     });
     secrets
         .command("generate-link <name>")
@@ -1656,9 +1555,6 @@ export function registerSecretsCommand(program) {
             console.log(chalk.dim("  One-time use — link is invalidated after first submission."));
         }
         catch (err) {
-            // Same shared plan-limit renderer as `secrets set` (see main.ts).
-            if (isPlanGateError(err))
-                throw err;
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
             process.exit(1);
         }