@indigoai-us/hq-cli 5.342.0 → 5.342.2

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.342.2] — 2026-10-04
+- Load the shared `secrets env` action without importing the full secrets command module on the enabled fast route.
+
+## [5.342.1] — 2026-10-04
+- `hq lanes` now continues envelope numbering beyond 999 and records unexpected reconcile admission failures as a distinct queued reason with error details.
+- Reconcile skips configured Codex homes absent on the current host and reports a note; other filesystem errors remain visible as store errors. `--dry-run` no longer compresses rollouts or advances the retention schedule.
+
 ## [5.342.0] — 2026-10-04
 
 - Keep `hq integrations call` alive through slow provider calls with bounded async-job polling, safe idempotent retry guidance on timeout, and validation of terminal responses.

package/dist/commands/lanes.js

@@ -5089,8 +5089,12 @@ async function runList(ctx, opts) {
                 ? {
                     state: "remote",
                     remote_state: lane.state,
-                    queued_reason: lane.queued_reason === "low_disk" ? lane.queued_reason : undefined,
-                    queued_details: lane.queued_reason === "low_disk" ? lane.queued_details : undefined,
+                    queued_reason: lane.queued_reason === "low_disk" || lane.queued_reason === "admit_failed"
+                        ? lane.queued_reason
+                        : undefined,
+                    queued_details: lane.queued_reason === "low_disk" || lane.queued_reason === "admit_failed"
+                        ? lane.queued_details
+                        : undefined,
                 }
                 : {}),
             overdue,
@@ -5142,7 +5146,9 @@ function formatLaneListHuman(lanes) {
             : "no story: " + (lane.no_story_reason ?? "reason not recorded");
         const queueLabel = (lane.state === "queued" || lane.remote_state === "queued") && lane.queued_reason === "low_disk"
             ? `  queued: low_disk (HQ ${lane.queued_details?.reason === "low_disk" ? lane.queued_details.hq_free_bytes : "?"} bytes; provider ${lane.queued_details?.reason === "low_disk" ? lane.queued_details.provider_free_bytes : "?"} bytes free)`
-            : "";
+            : (lane.state === "queued" || lane.remote_state === "queued") && lane.queued_reason === "admit_failed"
+                ? `  queued: admit_failed (${lane.queued_details?.reason === "admit_failed" ? `${lane.queued_details.error}: ${lane.queued_details.message}` : "details unavailable"})`
+                : "";
         return lane.lane_id + "  " + lane.state + "  " + lane.provider + "  " + lane.project_id +
             "  " + storyLabel + queueLabel;
     });
@@ -5199,9 +5205,11 @@ async function runStatus(ctx, opts) {
 async function runCapacity(ctx) {
     const hqRoot = ctx.hqRoot();
     const host = laneHostFromCtx(ctx);
+    const admissionHost = reconcileHostFromCtx(ctx);
+    const lanes = loadAllLanes(hqRoot);
     const snapshot = buildHostCapacitySnapshot({
         host,
-        lanes: loadAllLanes(hqRoot),
+        lanes,
         config: loadLanesConfig(hqRoot),
         existsSync: ctx.existsSync,
         probe: ctx.probeProvider,
@@ -5209,7 +5217,16 @@ async function runCapacity(ctx) {
         hostname: ctx.hostname(),
         now: ctx.now(),
     });
-    printJson(snapshot);
+    printJson({
+        ...snapshot,
+        queued_lanes: lanes
+            .filter((lane) => lane.state === "queued" && laneRunsHere(lane, admissionHost))
+            .map((lane) => ({
+            lane_id: lane.lane_id,
+            queued_reason: lane.queued_reason ?? null,
+            ...(lane.queued_details !== undefined ? { queued_details: lane.queued_details } : {}),
+        })),
+    });
 }
 async function runGcRollouts(ctx, opts) {
     const hqRoot = ctx.hqRoot();
@@ -5395,8 +5412,8 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane, resolveLaneTarget
             ...storedLane,
             state: "remote",
             remote_state: storedLane.state,
-            queued_reason: storedLane.queued_reason === "low_disk" ? storedLane.queued_reason : undefined,
-            queued_details: storedLane.queued_reason === "low_disk" ? storedLane.queued_details : undefined,
+            queued_reason: storedLane.queued_reason,
+            queued_details: storedLane.queued_details,
         }
         : storedLane;
     const askDeliveryFailed = readJsonFile(askDeliveryFailedPath(hqRoot, laneId));

package/dist/commands/secrets-public-types.test-d.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secrets-public-types.test-d.d.ts.map

package/dist/commands/secrets-public-types.test-d.js

@@ -0,0 +1,18 @@
+const scriptUsage = {
+    scriptId: "fixture-script",
+    path: "scripts/example.sh",
+    sha256: "0".repeat(64),
+    attestationLevel: "verified",
+};
+const metadata = {
+    tier: "standard",
+    cacheTtlMs: 1_000,
+};
+const loadedSecret = {
+    ...metadata,
+    name: "FIXTURE_NAME",
+    value: "fixture-only",
+};
+void [scriptUsage, metadata, loadedSecret];
+export {};
+//# sourceMappingURL=secrets-public-types.test-d.js.map

package/dist/commands/secrets.d.ts

@@ -1,5 +1,7 @@
 import type { Command } from "commander";
-import { writeSync } from "node:fs";
+export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
+export type { SecretLoadResponse, SecretScriptLockMode, SecretTier, SecretUsage, SecretUsageChannel } from "../secrets-env-action.js";
+export type { SecretScriptUsage, SecretMetadata, SecretLoadSuccessRow } from "../secrets-env-action.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
@@ -10,42 +12,6 @@ export { vaultApiFetch, getCompanyUid, getEntityUid };
  */
 export declare const HQ_PRO_RESOURCE_SURFACES: readonly ["api", "bot_invite", "bot_join_now", "calendar_auto_schedule", "calendar_preferences", "cli_secrets_set", "console_secrets_form", "deploy_precheck", "external_connection", "factory_install", "integrations_connect", "oauth_callback", "plan_limit_check", "secrets_input_link", "web"];
 export declare const CLI_SECRETS_SET_SURFACE = "cli_secrets_set";
-export type SecretTier = "standard" | "sensitive" | "nuclear";
-export type SecretScriptLockMode = "off" | "enforced";
-export type SecretUsageChannel = "run" | "exec" | "env" | "sandbox" | "reveal" | "submit-link";
-export interface SecretScriptUsage {
-    scriptId: string;
-    path: string;
-    sha256: string;
-    attestationLevel: string;
-}
-export interface SecretUsage {
-    channel: SecretUsageChannel;
-    reason?: string;
-    script?: SecretScriptUsage;
-}
-export interface SecretMetadata {
-    tier?: SecretTier;
-    scriptLock?: {
-        mode?: SecretScriptLockMode;
-        requiredAttestation?: string;
-    };
-    cacheTtlMs?: number;
-    revokedAt?: string | null;
-}
-export interface SecretLoadSuccessRow extends SecretMetadata {
-    name: string;
-    value?: string;
-    version?: number;
-}
-export interface SecretLoadResponse {
-    secrets: SecretLoadSuccessRow[];
-    errors: Array<{
-        name: string;
-        code: string;
-        message?: string;
-    }>;
-}
 export interface SecretInjectionRecipe {
     header: string;
     scheme: "raw" | "bearer";
@@ -60,48 +26,5 @@ export declare function parseDestinationUrl(raw: string): {
 };
 export declare function collectSecretNames(value: string, previous?: string[]): string[];
 export declare function scrubSandboxOutput(text: string, secretNames?: string[]): string;
-export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
-    allowOfflineFallback?: boolean;
-}): Promise<Map<string, string>>;
-/**
- * Emit `hq secrets env` output and terminate deterministically.
- *
- * The process MUST exit even when the consuming pipe has gone away. The
- * orphaned-process leak (personal/projects/hq-secrets-process-leak) was caused
- * by relying on `process.stdout.write(payload, () => process.exit(0))`: when the
- * parent shell reading `source <(hq secrets env …)` is killed on timeout, the
- * stdout pipe loses its reader, the write callback never fires, `process.exit(0)`
- * is never reached, and — because `env` forces no other exit — the process parks
- * in `epoll_pwait(-1)` forever, reparented to PID 1. Hundreds accumulated this
- * way, exhausting swap and driving load into triple digits.
- *
- * Writing synchronously to fd 1 and then exiting unconditionally removes every
- * dependency on the event loop draining and on the reader still being attached:
- * - a live reader receives the export lines (synchronous write reaches the
- *   kernel pipe buffer before we exit, so nothing is truncated);
- * - a dead reader surfaces as EPIPE, which we swallow — the secret is already
- *   resolved and there is nothing left to deliver, so a clean exit is correct;
- * - EAGAIN (stdout in non-blocking mode with a momentarily full buffer) is
- *   retried a bounded number of times. `env` payloads are a few short export
- *   lines, far under the 64 KiB pipe buffer, so this effectively never spins.
- *
- * `exit` and `write` are injectable for tests; production uses the real ones.
- */
-export declare function emitEnvExportsAndExit(payload: string, exit?: (code: number) => never, write?: typeof writeSync): never;
-/**
- * Shared `secrets env` action for Commander and the default-off lightweight
- * entrypoint. The fast entrypoint still runs the same credential, usage-audit,
- * server authorization, cache-fallback, redaction, and output code.
- */
-export declare function runSecretsEnvCommand(opts: {
-    only: string[];
-    script?: string;
-    scriptId?: string;
-}, parentScope: {
-    company?: string;
-    personal?: boolean;
-}, options?: {
-    fallbackOnAuthFailure?: boolean;
-}): Promise<"handled" | "fallback">;
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map