@indigoai-us/hq-cli 5.345.150 → 5.345.152

package/dist/commands/cloud.js

@@ -28,6 +28,7 @@ import { maybeShowCliInviteNudge } from "../lib/cli-invite-nudge.js";
 import { createPlanLimitRefusalTracker, describeRefusedCount, describeRefusedFiles, mergePlanLimitRefusals, renderPlanLimitRefusalLines, trackingProgressRecorder, } from "../lib/billing/plan-limit-refusals.js";
 import { formatPlanGateError, planGateErrorFromVaultError, } from "../utils/plan-gate-error.js";
 import { personalTargetedPushPathsEnabled } from "./personal-targeted-push-flag.js";
+import { CLOUD_OFF_EXIT_CODE, VaultSyncOffError, assertEntityVaultSyncAllowed, refuseSyncForOffVaults, writeVaultRefusal, } from "./cloud-off-gate.js";
 import { resolveExplicitPersonalPushPaths } from "./personal-targeted-push-paths.js";
 /**
  * Terminal-failure signal for the sync fanout runners. The runners
@@ -295,6 +296,12 @@ function narrowNudgeExceedsSize(hqRoot, ref) {
     const threshold = resolveNarrowHintMinBytes({ hqRoot });
     return companyFolderExceedsThreshold(companyDir, threshold);
 }
+/** True when a membership's vault is switched off on this computer (US-016). */
+function isSkippedCompany(skip, slug, companyUid) {
+    if (!skip || skip.size === 0)
+        return false;
+    return skip.has(slug.toLowerCase()) || skip.has(companyUid.toLowerCase());
+}
 export async function pullAll(options, deps) {
     const memberships = await deps.vaultClient.listMyMemberships();
     const persons = await deps.vaultClient.listPersonEntities();
@@ -311,6 +318,8 @@ export async function pullAll(options, deps) {
         catch {
             // Best-effort — keep UID as the row label rather than aborting the run.
         }
+        if (isSkippedCompany(options.skipCompanies, slug, m.companyUid))
+            continue;
         plan.push({
             slug,
             companyUid: m.companyUid,
@@ -464,6 +473,8 @@ export async function pushAll(options, deps) {
         catch {
             // Best-effort — keep UID as the row label.
         }
+        if (isSkippedCompany(options.skipCompanies, slug, m.companyUid))
+            continue;
         plan.push({
             slug,
             companyUid: m.companyUid,
@@ -804,6 +815,13 @@ export function registerCloudCommands(program) {
         "a toggle, and so CLI users can opt out one-off. Ignored outside " +
         "`--all`.")
         .action(async (paths, options) => {
+        const skips = refuseSyncForOffVaults("push", {
+            all: options.all,
+            personal: options.personal,
+            company: options.company,
+            hqRoot: options.hqRoot,
+            credsFromStdin: options.credsFromStdin,
+        }, { json: options.json === true });
         try {
             configureSyncLockTimeout(options.lockTimeout);
             assertSingleSelector(options, "push");
@@ -833,7 +851,7 @@ export function registerCloudCommands(program) {
             // `--all` the flag has no effect (logged above as part of the
             // option's help text).
             await withSyncHealthReport(async () => {
-                const refused = await runPushAll(options.hqRoot, options.message, options.onConflict, options.personal === false);
+                const refused = await runPushAll(options.hqRoot, options.message, options.onConflict, skips.skipPersonal, skips.skipCompanies);
                 // A plan-limit refusal is not a sync failure, but the push did
                 // not upload everything it was asked to: exit non-zero.
                 if (refused)
@@ -891,6 +909,9 @@ export function registerCloudCommands(program) {
                 catch (e) {
                     throw new Error(`--creds-from-stdin: failed to parse stdin as JSON: ${e instanceof Error ? e.message : String(e)}`);
                 }
+                // Sync switches (US-016): with no --company the target is only
+                // known now. Check it before any login or transfer.
+                assertEntityVaultSyncAllowed("push", entityContext, options.hqRoot);
                 // Upload creds are pre-vended in entityContext, but prefix filtering
                 // still needs vault-service membership/grant resolution.
                 const accessToken = await ensureSyncCognitoToken();
@@ -1085,6 +1106,11 @@ export function registerCloudCommands(program) {
             }
         }
         catch (err) {
+            if (err instanceof VaultSyncOffError) {
+                // Not a sync failure: the target vault is switched off.
+                writeVaultRefusal(err.refusal, { json: jsonMode });
+                process.exit(CLOUD_OFF_EXIT_CODE);
+            }
             if (syncHealth)
                 await syncHealth.failed();
             const message = formatSyncFailure(err);
@@ -1128,6 +1154,12 @@ export function registerCloudCommands(program) {
         "disk and only un-tracked from sync; clean out-of-scope files are " +
         "quarantined under .hq/scope-quarantine/ (recoverable).")
         .action(async (options) => {
+        const skips = refuseSyncForOffVaults("pull", {
+            all: options.all,
+            personal: options.personal,
+            company: options.company,
+            hqRoot: options.hqRoot,
+        });
         try {
             configureSyncLockTimeout(options.lockTimeout);
             assertSingleSelector(options, "pull");
@@ -1140,7 +1172,7 @@ export function registerCloudCommands(program) {
             // `options.personal === false` is Commander's auto-negation of
             // `--personal`; in `--all` mode that means "drop the personal
             // leg from the fanout" (see `--no-personal` option above).
-            await withSyncHealthReport(() => runPullAll(options.hqRoot, options.onConflict, options.modeAll === true, options.personal === false, options.forceScopeShrink === true));
+            await withSyncHealthReport(() => runPullAll(options.hqRoot, options.onConflict, options.modeAll === true, skips.skipPersonal, options.forceScopeShrink === true, skips.skipCompanies));
             return;
         }
         if (options.personal) {
@@ -1352,6 +1384,12 @@ export function registerCloudCommands(program) {
         "anyway. Dirty files are KEPT on disk (only un-tracked); clean " +
         "out-of-scope files are quarantined under .hq/scope-quarantine/.")
         .action(async (options) => {
+        const skips = refuseSyncForOffVaults("now", {
+            all: options.all,
+            personal: options.personal,
+            company: options.company,
+            hqRoot: options.hqRoot,
+        });
         try {
             configureSyncLockTimeout(options.lockTimeout);
             assertSingleSelector(options, "now");
@@ -1360,7 +1398,7 @@ export function registerCloudCommands(program) {
                 // of `--personal`; in `--all` mode that means "drop the
                 // personal leg from both legs of the bidirectional fanout"
                 // (see `--no-personal` option above).
-                await withSyncHealthReport(() => runNowAll(options.hqRoot, options.message, options.onConflict, options.modeAll === true, options.personal === false, options.forceScopeShrink === true));
+                await withSyncHealthReport(() => runNowAll(options.hqRoot, options.message, options.onConflict, options.modeAll === true, skips.skipPersonal, options.forceScopeShrink === true, skips.skipCompanies));
                 return;
             }
             await withSyncHealthReport(() => runNowSingle(options.hqRoot, options.company, options.personal === true, options.message, options.onConflict, options.modeAll === true, options.forceScopeShrink === true));
@@ -1446,13 +1484,19 @@ export async function runSyncDoctorReconcileConflicts(hqRoot, yes) {
         console.log(chalk.dim("  Re-run with --yes to apply the plan above."));
     }
 }
-async function runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink) {
+/** Banner lines for the vaults an `--all` run leaves out. */
+function logVaultSkips(skipPersonal, skipCompanies) {
+    if (skipPersonal)
+        console.log(`  Personal: skipped (sync is off for it, or --no-personal)`);
+    if (skipCompanies && skipCompanies.size > 0) {
+        console.log(`  Skipped:  ${[...skipCompanies].sort().join(", ")} (sync is off on this computer)`);
+    }
+}
+async function runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink, skipCompanies) {
     console.log(chalk.bold("\nHQ Sync — Pull (all)"));
     console.log(`  HQ root:  ${hqRoot}`);
     console.log(`  Strategy: ${onConflict ?? "(interactive)"}`);
-    if (skipPersonal) {
-        console.log(`  Personal: skipped (--no-personal)`);
-    }
+    logVaultSkips(skipPersonal, skipCompanies);
     console.log("");
     let result;
     try {
@@ -1480,6 +1524,7 @@ async function runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, for
             ...(modeAllOverride ? { modeAllOverride: true } : {}),
             ...(skipPersonal ? { skipPersonal: true } : {}),
             ...(forceScopeShrink ? { forceScopeShrink: true } : {}),
+            ...(skipCompanies && skipCompanies.size > 0 ? { skipCompanies } : {}),
         }, {
             vaultClient: adapter,
             // DEV-1768: resolve each company's REAL pull scope (mode + prefixSet)
@@ -1587,13 +1632,11 @@ export async function runPullPersonal(hqRoot, onConflict) {
  * limit refused across every target (null when none were), so the caller can
  * refuse to report success; hard failures still throw {@link SyncExitError}.
  */
-async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
+async function runPushAll(hqRoot, message, onConflict, skipPersonal, skipCompanies) {
     console.log(chalk.bold("\nHQ Sync — Push (all)"));
     console.log(`  HQ root:  ${hqRoot}`);
     console.log(`  Strategy: ${onConflict ?? "(interactive)"}`);
-    if (skipPersonal) {
-        console.log(`  Personal: skipped (--no-personal)`);
-    }
+    logVaultSkips(skipPersonal, skipCompanies);
     console.log("");
     let result;
     try {
@@ -1618,6 +1661,7 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
             ...(onConflict ? { onConflict } : {}),
             ...(message ? { message } : {}),
             ...(skipPersonal ? { skipPersonal: true } : {}),
+            ...(skipCompanies && skipCompanies.size > 0 ? { skipCompanies } : {}),
         }, {
             vaultClient: adapter,
             resolveScope: (companyUid, slug) => resolvePullScope(realClient, companyUid, slug, hqRoot),
@@ -1998,24 +2042,22 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         throw new SyncExitError(1);
     }
 }
-async function runNowAll(hqRoot, message, onConflict, modeAllOverride, skipPersonal, forceScopeShrink) {
+async function runNowAll(hqRoot, message, onConflict, modeAllOverride, skipPersonal, forceScopeShrink, skipCompanies) {
     console.log(chalk.bold("\nHQ Sync — Now (all)"));
     console.log(`  HQ root:  ${hqRoot}`);
     console.log(`  Strategy: ${onConflict ?? "(interactive)"}`);
-    if (skipPersonal) {
-        console.log(`  Personal: skipped (--no-personal)`);
-    }
+    logVaultSkips(skipPersonal, skipCompanies);
     console.log("");
     // Push first (matches runner), then pull. Re-uses the per-leg orchestrators
     // so the per-target rendering, error isolation, and exit codes are
     // identical to running `push --all` then `pull --all` back-to-back.
     console.log(chalk.dim("→ push --all"));
-    const refused = await runPushAll(hqRoot, message, onConflict, skipPersonal);
+    const refused = await runPushAll(hqRoot, message, onConflict, skipPersonal, skipCompanies);
     console.log(chalk.dim("\n→ pull --all"));
     // US-011: forward --mode-all so the strict refusal applies to the
     // pull leg (push doesn't need a narrow-hint — the narrow ritual is
     // pull-side).
-    await runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink);
+    await runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink, skipCompanies);
     if (refused) {
         // A refused push does not stop the pull, but the run must not end looking
         // like a clean sync. Its per-target details were printed above.

package/dist/commands/core-handoff.js

@@ -13,6 +13,7 @@ import { defaultBackgroundDependencies, runBackgroundLauncher, } from "../lib/se
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
+import { CLOUD_OFF_EXIT_CODE } from "./cloud-off-gate.js";
 import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { fingerprintTrailerArgs, offlineFingerprint } from "../lib/fingerprint/offline.js";
 import { compactJson, isRecord, jqTruthy, prettyJson, runHandoffOpenSteps, shellDate, } from "./core-handoff-open-steps.js";
@@ -1057,7 +1058,11 @@ export function runHandoffPostWorker(args, context) {
                 stdout: typeof pushed.stdout === "string" ? pushed.stdout : "",
                 stderr: typeof pushed.stderr === "string" ? pushed.stderr : "",
             });
-            log(pushed.status === 0 ? `workspace-sync: pushed companies/${company}/workspace` : `workspace-sync: failed companies/${company}/workspace`);
+            log(pushed.status === 0
+                ? `workspace-sync: pushed companies/${company}/workspace`
+                : pushed.status === CLOUD_OFF_EXIT_CODE
+                    ? `workspace-sync: skipped (sync is off) companies/${company}/workspace`
+                    : `workspace-sync: failed companies/${company}/workspace`);
         }
     }
     else if (threadFile && fs.existsSync(threadFile))

package/dist/commands/files.js

@@ -4,7 +4,7 @@ import * as readline from "node:readline";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
-import { GROUP_ID_PATTERN, EMAIL_PATTERN, isPrivateFolderPattern, normalizeFilePrefix, toSharedFolderGlob, } from "./_patterns.js";
+import { GROUP_ID_PATTERN, EMAIL_PATTERN, isPrivateFolderPattern, normalizeFilePrefix, OUTPOST_UID_PATTERN, toSharedFolderGlob, } from "./_patterns.js";
 import { looksLikeCompanyUid } from "../utils/vault-api.js";
 import { AuthError } from "../utils/auth-error.js";
 import { formatAccessDenied, offerAccessLadder, } from "../utils/access-denied-hint.js";
@@ -159,7 +159,7 @@ export function registerFilesCommand(program) {
     files
         .command("share [paths...]")
         .description("Share file paths. foo/ is a private folder (children stay creator-only); quote the shared-folder glob 'foo/*' so the shell passes it literally. Without --with: mint a share-session URL and open it in the browser. With --with: grant access directly to a person, group, or @all.")
-        .option("--with <principal>", "Email address, group id, or '@all' to share with every active company member")
+        .option("--with <principal>", "Email address, group id, company Outpost id (out_...), or '@all' to share with every active company member")
         .option("--permission <level>", "Permission level (only with --with): read | write")
         .option("--full", "Grant access to the ENTIRE vault (the '*' wildcard prefix) — no need to quote a glob. Requires --with; defaults to write permission.")
         .option("--expires <duration>", "Token expiry duration for share-session URL (e.g. 15m, 1h, 24h). Default 15m. Max 24h.")
@@ -268,7 +268,7 @@ export function registerFilesCommand(program) {
     files
         .command("unshare <prefix>")
         .description("Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.")
-        .option("--with <principal>", "Person uid, agent uid, email address, group id, or '@all' to remove the grant")
+        .option("--with <principal>", "Person uid, agent uid, company Outpost id (out_...), email address, group id, or '@all' to remove the grant")
         .action(async (prefix, opts) => {
         try {
             // Unshare MUTATES access with no preview. Anchored content paths remain
@@ -286,9 +286,14 @@ export function registerFilesCommand(program) {
             const isEmail = !isAll && EMAIL_PATTERN.test(principal);
             const isGroup = !isAll && GROUP_ID_PATTERN.test(principal);
             const isAgent = !isAll && !isEmail && !isGroup && AGENT_UID_PATTERN.test(principal);
-            const isPerson = !isAll && !isEmail && !isGroup && !isAgent && PERSON_UID_PATTERN.test(principal);
+            // A company Outpost (out_<ULID>) rides the person grantee slot on the wire.
+            const isPerson = !isAll &&
+                !isEmail &&
+                !isGroup &&
+                !isAgent &&
+                (PERSON_UID_PATTERN.test(principal) || OUTPOST_UID_PATTERN.test(principal));
             if (opts.with && !isAll && !isEmail && !isGroup && !isPerson && !isAgent) {
-                console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a person uid matching prs_<alphanumeric>, an agent uid matching agt_<alphanumeric>, or a group id matching grp_<alphanumeric>`));
+                console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a person uid matching prs_<alphanumeric>, an agent uid matching agt_<alphanumeric>, a company Outpost id (out_<ULID>), or a group id matching grp_<alphanumeric>`));
                 process.exit(1);
             }
             // The vault ACL API stores first-class agent access on its backwards-
@@ -481,6 +486,9 @@ export function registerFilesCommand(program) {
                 if (e.granteeType === "company-wide") {
                     return "Everyone in company (including guests)";
                 }
+                if (e.granteeType === "person" && OUTPOST_UID_PATTERN.test(e.granteeId)) {
+                    return `Outpost (${e.granteeId})`;
+                }
                 return e.granteeId;
             }
             function printEntryTable(rows, showSource) {
@@ -773,9 +781,17 @@ async function runDirectGrant(params) {
     const isAll = principal === "@all";
     const isEmail = !isAll && EMAIL_PATTERN.test(principal);
     const isGroup = !isAll && GROUP_ID_PATTERN.test(principal);
-    const isPerson = !isAll && !isEmail && !isGroup && PERSON_UID_PATTERN.test(principal);
+    // A company Outpost (out_<ULID>) gets member-equivalent file access and
+    // rides the person grantee slot on the wire: { granteeType: "person",
+    // granteeId: "out_..." }. hq-pro validates out_ grantees (active binding,
+    // same company) from the paired server change; older servers store it as an
+    // inert person grant.
+    const isPerson = !isAll &&
+        !isEmail &&
+        !isGroup &&
+        (PERSON_UID_PATTERN.test(principal) || OUTPOST_UID_PATTERN.test(principal));
     if (!isAll && !isEmail && !isGroup && !isPerson) {
-        console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a person uid, or a group id matching grp_<alphanumeric>`));
+        console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a person uid, a company Outpost id (out_<ULID>), or a group id matching grp_<alphanumeric>`));
         process.exit(1);
     }
     const granteeType = isAll

package/dist/commands/meetings.js

@@ -658,9 +658,13 @@ export function registerMeetingsCommand(program) {
         try {
             const token = await ensureCognitoToken();
             const companySlug = meetings.opts().company;
-            const query = {};
-            if (companySlug)
-                query.companyId = await getCompanyUid(token, companySlug);
+            // Always name a company. With no companyId the backend files the bot
+            // under Personal, which can never record, so an entitled user would
+            // get the HQ Workforce upgrade prompt. Without --company this uses the
+            // caller's only active company, or asks them to pick one.
+            const query = {
+                companyId: await getCompanyUid(token, companySlug),
+            };
             const res = await vaultApiFetch({
                 token,
                 method: "POST",

package/dist/commands/rescue.d.ts

@@ -20,6 +20,7 @@
  * `HQ_NO_UPDATE_CHECK=1`; always best-effort.
  */
 import { Command } from 'commander';
+import { retrustCodexHooksAfterRescue } from '../utils/hook-trust.js';
 export interface RescueTarget {
     source: string;
     /** undefined → let the script apply its own default ref (`main`). */
@@ -45,6 +46,12 @@ export declare function shouldAttemptSelfUpdate(opts: {
     check?: boolean;
     selfUpdate?: boolean;
 }): boolean;
+/**
+ * Re-trust HQ's Codex hooks after a rescue that changed files on disk.
+ * Exported for tests. Best-effort: a trust failure is reported but never
+ * changes the rescue's exit status, because the core update itself succeeded.
+ */
+export declare function retrustHooksAfterRescue(hqRoot: string, retrust?: typeof retrustCodexHooksAfterRescue): Promise<void>;
 /** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
 export declare function getLatestReleaseTag(repo: string, token?: string): Promise<string>;
 /** Resolve a tag to its commit SHA, dereferencing annotated tags. */

package/dist/commands/rescue.js

@@ -1,4 +1,3 @@
-import { spawnSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
@@ -6,8 +5,8 @@ import chalk from 'chalk';
 import { rescue } from '@indigoai-us/hq-cloud';
 import { findHqRoot } from '../utils/manifest.js';
 import { selfUpdateAndReexec } from '../utils/self-update.js';
-const PROD_SOURCE = 'indigoai-us/hq-core';
-const STAGING_SOURCE = 'indigoai-us/hq-core-staging';
+import { retrustCodexHooksAfterRescue } from '../utils/hook-trust.js';
+import { PROD_SOURCE, STAGING_SOURCE, resolveGhToken } from '../utils/shipped-codex-hooks.js';
 /**
  * Resolve the source repo + ref from the user's flags. Pure + exported for
  * tests. `latestTag` is the resolved latest release tag (prod only); ignored
@@ -28,20 +27,27 @@ export function resolveRescueTarget(opts, latestTag) {
 export function shouldAttemptSelfUpdate(opts) {
     return opts.selfUpdate !== false && !opts.check;
 }
-/** Resolve a GitHub token: prefer `gh auth token`, fall back to env. */
-function resolveGhToken() {
+/**
+ * Re-trust HQ's Codex hooks after a rescue that changed files on disk.
+ * Exported for tests. Best-effort: a trust failure is reported but never
+ * changes the rescue's exit status, because the core update itself succeeded.
+ */
+export async function retrustHooksAfterRescue(hqRoot, retrust = retrustCodexHooksAfterRescue) {
+    let root = hqRoot;
     try {
-        const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
-        if (res.status === 0) {
-            const tok = res.stdout.trim();
-            if (tok)
-                return tok;
-        }
+        root = fs.realpathSync(hqRoot);
     }
     catch {
-        // gh not installed — fall through to env.
+        // Keep the path as given; trust reports its own failure if it is unusable.
+    }
+    const result = await retrust(root);
+    if (result.status === 'trusted') {
+        console.log(`rescue: re-trusted ${result.trusted} Codex HQ hook${result.trusted === 1 ? '' : 's'}`);
+    }
+    else if (result.status === 'failed') {
+        console.warn(chalk.yellow(`rescue: could not re-trust Codex HQ hooks: ${result.reason ?? 'unknown error'}. ` +
+            'Codex will skip changed HQ hooks until you run `hq reindex`.'));
     }
-    return process.env.GH_TOKEN || process.env.GITHUB_TOKEN || undefined;
 }
 function ghHeaders(token) {
     const headers = {
@@ -178,6 +184,9 @@ export function registerRescueCommand(program) {
                 cloudUpdate: opts.cloudUpdate,
                 ghToken: token,
             });
+            if (status === 0 && !opts.check) {
+                await retrustHooksAfterRescue(hqRoot);
+            }
             process.exit(status);
         }
         catch (error) {

package/dist/commands/secrets.d.ts

@@ -3,6 +3,13 @@ export { readSessionCompanyLock } from "../lib/session-company-lock.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
 export type { SecretLoadResponse, SecretScriptLockMode, SecretTier, SecretUsage, SecretUsageChannel } from "../secrets-env-action.js";
 export type { SecretScriptUsage, SecretMetadata, SecretLoadSuccessRow } from "../secrets-env-action.js";
+/**
+ * Exit code for `hq secrets exec` run with no session id and no explicit
+ * company. 78 is EX_CONFIG from sysexits.h: the caller's invocation is missing
+ * required configuration, so retrying the same command will not help.
+ */
+export declare const SECRETS_EXEC_UNATTENDED_NO_COMPANY_EXIT = 78;
+export declare const SECRETS_EXEC_UNATTENDED_NO_COMPANY_MESSAGE: string;
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
@@ -17,6 +24,12 @@ interface SecretAclPrincipal {
     granteeType: "email" | "group" | "company-wide" | "person";
     granteeId: string;
 }
+/**
+ * hq-pro refuses any Outpost grant above read with 400
+ * OUTPOST_GRANT_READ_ONLY. The CLI refuses it first with the same message.
+ */
+export declare const OUTPOST_GRANT_READ_ONLY_CODE = "OUTPOST_GRANT_READ_ONLY";
+export declare const OUTPOST_GRANT_READ_ONLY_MESSAGE = "Company Outposts can only be given read access to a secret.";
 export declare function parseSecretAclPrincipal(principal: string): SecretAclPrincipal | null;
 export interface SecretInjectionRecipe {
     header: string;

package/dist/commands/secrets.js

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import * as yaml from "js-yaml";
 import { assertApiKeyCompany, buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
 import { readSessionCompanyLock } from "../lib/session-company-lock.js";
+import { sessionIdFromEnv } from "../lib/core-utils/session-id.js";
 export { readSessionCompanyLock } from "../lib/session-company-lock.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
 function companyUidForSlug(root, slug) {
@@ -53,6 +54,16 @@ async function resolveApiKeyCompanyWithinLock(input) {
 }
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
+/**
+ * Exit code for `hq secrets exec` run with no session id and no explicit
+ * company. 78 is EX_CONFIG from sysexits.h: the caller's invocation is missing
+ * required configuration, so retrying the same command will not help.
+ */
+export const SECRETS_EXEC_UNATTENDED_NO_COMPANY_EXIT = 78;
+export const SECRETS_EXEC_UNATTENDED_NO_COMPANY_MESSAGE = "hq secrets exec has no session id (HQ_SESSION_ID, CLAUDE_CODE_SESSION_ID, CLAUDE_SESSION_ID, " +
+    "CODEX_SESSION_ID, CODEX_THREAD_ID and GROK_SESSION_ID are all unset), so it will not borrow a company " +
+    "from whichever interactive session last wrote workspace/sessions/.current. " +
+    "Pass --company <slug> (or --personal), or set HQ_SESSION_ID to the session this job runs under.";
 import { removeCacheEntry, clearAllCache } from "../utils/secrets-cache.js";
 import { isHqCliChild, releaseChildWrapperPackageUseLeaseAfterStart } from "../utils/child-wrapper-lease.js";
 import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
@@ -63,7 +74,7 @@ import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN, OUTPOST_UID_PATTERN, } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
-import { formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
+import { formatApiKeyCapabilityDenial, peekHqApiKey, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
 import { runSandboxJobAfterSubmission } from "../utils/secrets-sandbox-resident.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 /**
@@ -277,6 +288,12 @@ function promptSecretInteractively() {
         process.stdin.resume();
     });
 }
+/**
+ * hq-pro refuses any Outpost grant above read with 400
+ * OUTPOST_GRANT_READ_ONLY. The CLI refuses it first with the same message.
+ */
+export const OUTPOST_GRANT_READ_ONLY_CODE = "OUTPOST_GRANT_READ_ONLY";
+export const OUTPOST_GRANT_READ_ONLY_MESSAGE = "Company Outposts can only be given read access to a secret.";
 export function parseSecretAclPrincipal(principal) {
     const p = principal.trim();
     if (p === "@all") {
@@ -1164,11 +1181,23 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
-            const multiCompanyLockEnabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG);
-            const sessionLock = multiCompanyLockEnabled ? readSessionCompanyLock(process.env) : undefined;
             const parentScope = secrets.opts();
             const inheritedCompany = parentScope.company;
             const requestedCompany = _opts.company ?? inheritedCompany;
+            // A launchd or cron job has no session id. Session resolution would then
+            // fall back to workspace/sessions/.current, which names whichever
+            // interactive session last ran a hook, and the job would read that
+            // session's company's same-named secret. Without a session id the caller
+            // must name its scope. HQ_API_KEY is exempt: the key is bound to one
+            // company and never reads the session lock below.
+            const hasCallerSession = Boolean(sessionIdFromEnv(process.env));
+            if (!hasCallerSession && !requestedCompany && !parentScope.personal && peekHqApiKey() === undefined) {
+                console.error(chalk.red("Error:"), SECRETS_EXEC_UNATTENDED_NO_COMPANY_MESSAGE);
+                process.exit(SECRETS_EXEC_UNATTENDED_NO_COMPANY_EXIT);
+            }
+            const multiCompanyLockEnabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG);
+            // Only the caller's own session id may supply a lock; never .current.
+            const sessionLock = multiCompanyLockEnabled && hasCallerSession ? readSessionCompanyLock(process.env) : undefined;
             const hasLockedCompanies = (sessionLock?.companies.length ?? 0) > 0;
             const lockRoot = hasLockedCompanies ? resolveDefaultHqRoot({ env: process.env }) : undefined;
             const selectedCompany = (hasLockedCompanies && requestedCompany && looksLikeCompanyUid(requestedCompany)
@@ -1319,7 +1348,7 @@ export function registerSecretsCommand(program) {
         .command("share <path>")
         .description("Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)")
         .requiredOption("--with <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to share with")
-        .requiredOption("--permission <level>", "Permission level: read | write | admin")
+        .option("--permission <level>", "Permission level: read | write | admin (required, except for a company Outpost, which can only be given read and defaults to it)")
         .action(async (path, opts) => {
         try {
             rejectIfPersonal(secrets.opts(), "share");
@@ -1327,7 +1356,8 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
             }
-            if (!["read", "write", "admin"].includes(opts.permission)) {
+            if (opts.permission !== undefined &&
+                !["read", "write", "admin"].includes(opts.permission)) {
                 console.error(chalk.red(`Invalid permission '${opts.permission}': must be one of read, write, admin`));
                 process.exit(1);
             }
@@ -1335,6 +1365,16 @@ export function registerSecretsCommand(program) {
             if (!principal) {
                 process.exit(1);
             }
+            const isOutpost = OUTPOST_UID_PATTERN.test(principal.granteeId);
+            if (opts.permission === undefined && !isOutpost) {
+                console.error(chalk.red("Missing --permission: must be one of read, write, admin"));
+                process.exit(1);
+            }
+            const permission = opts.permission ?? "read";
+            if (isOutpost && permission !== "read") {
+                console.error(chalk.red(OUTPOST_GRANT_READ_ONLY_MESSAGE));
+                process.exit(1);
+            }
             const target = await resolveSecretsTarget("secrets:share", "secrets share", secrets.opts());
             const res = await vaultApiFetch({
                 token: target.token,
@@ -1344,12 +1384,15 @@ export function registerSecretsCommand(program) {
                     path,
                     granteeType: principal.granteeType,
                     granteeId: principal.granteeId,
-                    permission: opts.permission,
+                    permission,
                 },
             });
             if (!res.ok) {
                 const body = await res.json().catch(() => ({}));
-                if (res.status === 401) {
+                if (res.status === 400 && body.code === OUTPOST_GRANT_READ_ONLY_CODE) {
+                    console.error(chalk.red(OUTPOST_GRANT_READ_ONLY_MESSAGE));
+                }
+                else if (res.status === 401) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
@@ -1371,7 +1414,7 @@ export function registerSecretsCommand(program) {
                 }
                 process.exit(1);
             }
-            console.log(chalk.green(`Shared '${path}' with ${describeSecretAclPrincipal(principal)} (${opts.permission})`));
+            console.log(chalk.green(`Shared '${path}' with ${describeSecretAclPrincipal(principal)} (${permission})`));
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));