@indigoai-us/hq-cli 5.345.148 → 5.345.150

package/dist/commands/secrets.d.ts

@@ -13,6 +13,11 @@ export { vaultApiFetch, getCompanyUid, getEntityUid };
  */
 export declare const HQ_PRO_RESOURCE_SURFACES: readonly ["api", "bot_invite", "bot_join_now", "calendar_auto_schedule", "calendar_preferences", "cli_secrets_set", "console_secrets_form", "deploy_precheck", "external_connection", "factory_install", "integrations_connect", "oauth_callback", "plan_limit_check", "secrets_input_link", "web"];
 export declare const CLI_SECRETS_SET_SURFACE = "cli_secrets_set";
+interface SecretAclPrincipal {
+    granteeType: "email" | "group" | "company-wide" | "person";
+    granteeId: string;
+}
+export declare function parseSecretAclPrincipal(principal: string): SecretAclPrincipal | null;
 export interface SecretInjectionRecipe {
     header: string;
     scheme: "raw" | "bearer";

package/dist/commands/secrets.js

@@ -60,7 +60,7 @@ import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
 import { secretsExecChildExitCode } from "../utils/child-wrapper-exit.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
-import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
+import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN, OUTPOST_UID_PATTERN, } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
@@ -277,7 +277,7 @@ function promptSecretInteractively() {
         process.stdin.resume();
     });
 }
-function parseSecretAclPrincipal(principal) {
+export function parseSecretAclPrincipal(principal) {
     const p = principal.trim();
     if (p === "@all") {
         // Company-wide grant: every active member of the company. The server
@@ -290,7 +290,12 @@ function parseSecretAclPrincipal(principal) {
     if (GROUP_ID_PATTERN.test(p)) {
         return { granteeType: "group", granteeId: p };
     }
-    console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, or a group id matching grp_<alphanumeric, underscore, hyphen>`));
+    if (OUTPOST_UID_PATTERN.test(p)) {
+        // The company Outpost rides the person grantee slot; the server checks
+        // that this id is the company's active Outpost.
+        return { granteeType: "person", granteeId: p };
+    }
+    console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a group id matching grp_<alphanumeric, underscore, hyphen>, or a company Outpost id (out_…)`));
     return null;
 }
 function describeSecretAclPrincipal(principal) {
@@ -1312,8 +1317,8 @@ export function registerSecretsCommand(program) {
     });
     secrets
         .command("share <path>")
-        .description("Share a secret with an email address, group, or the entire company (@all)")
-        .requiredOption("--with <principal>", "Email address, group id, or @all (entire company) to share with")
+        .description("Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)")
+        .requiredOption("--with <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to share with")
         .requiredOption("--permission <level>", "Permission level: read | write | admin")
         .action(async (path, opts) => {
         try {
@@ -1376,7 +1381,7 @@ export function registerSecretsCommand(program) {
     secrets
         .command("unshare <path>")
         .description("Remove a grant from a secret")
-        .requiredOption("--from <principal>", "Email address, group id, or @all (entire company) to remove")
+        .requiredOption("--from <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to remove")
         .action(async (path, opts) => {
         try {
             rejectIfPersonal(secrets.opts(), "unshare");

package/dist/hook-engine-path.js

@@ -11,14 +11,21 @@ export function hookEnginePathArgs(argv) {
 }
 export async function runHookEnginePath(args) {
     try {
-        if (args.some(arg => !['--repair', '--help', '-h'].includes(arg))) {
-            throw new Error('Usage: hq core hook-engine-path [--repair]');
+        if (args.some(arg => !['--repair', '--help', '-h', '--for-registration'].includes(arg))) {
+            throw new Error('Usage: hq core hook-engine-path [--repair] [--for-registration]');
         }
         if (args.includes('--help') || args.includes('-h')) {
-            console.log('Usage: hq core hook-engine-path [--repair]\nResolve and pin the installed native hook engine offline.');
+            console.log('Usage: hq core hook-engine-path [--repair] [--for-registration]\nResolve and pin the installed native hook engine offline.\n--for-registration prints a path only when the launcher flag is enabled.');
             return;
         }
         const { installHookEngine, hookEngineRequired, HOOK_ENGINE_REPAIR } = await import('./lib/hook-engine/resolve.js');
+        if (args.includes('--for-registration')) {
+            const { launcherEnabled } = await import('./lib/hook-engine/registration.js');
+            if (!launcherEnabled()) {
+                process.exitCode = 1;
+                return;
+            }
+        }
         const binary = installHookEngine({ repair: args.includes('--repair') });
         if (binary)
             console.log(binary);