@indigoai-us/hq-cli 5.345.151 → 5.345.153

package/dist/commands/lanes-questions.js

@@ -1,4 +1,5 @@
 import * as path from "node:path";
+import { isQuestionImported } from "../lib/lanes/imported-question.js";
 import { buildOutpostQuestionAnswerCommand, buildOutpostQuestionCancelCommand, buildOutpostQuestionShowCommand, dispatchErrorMessage } from "../lib/lanes/outpost-dispatch.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
@@ -639,6 +640,7 @@ export function createLaneQuestionsHandlers(deps) {
                 const visibleQuestion = deliveredLocalQuestions.get(q.question_id) ?? q;
                 const row = {
                     ...visibleQuestion,
+                    ...(isQuestionImported(hqRoot, q.question_id) ? { status_display: "moved to hq decide", moved_to: "hq decide" } : {}),
                     priority: visibleQuestion.priority ?? null,
                     priority_display: visibleQuestion.priority ?? "-",
                     audience: resolveAudience(hqRoot, visibleQuestion, ctx),
@@ -741,6 +743,7 @@ export function createLaneQuestionsHandlers(deps) {
             ok: true,
             action: "questions.show",
             question,
+            ...(isQuestionImported(hqRoot, question.question_id) ? { status_display: "moved to hq decide", moved_to: "hq decide" } : {}),
             audience: resolveAudience(hqRoot, question, ctx),
             body,
         });

package/dist/commands/lanes-resume.js

@@ -4,7 +4,7 @@ import { appendCappedHistory, isFailedQuotaKeepAliveLane, providerSessionPortabl
 import { parseCliEffort } from "../lib/lanes/effort.js";
 import { parseOutpostHireGrantContext } from "../lib/lanes/hire-grant-dispatch.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
-import { laneStories, laneStory, storyWarning } from "../lib/lanes/stories.js";
+import { attributedStoryRow, laneStories, storiesAfterAttribution, storyWarning } from "../lib/lanes/stories.js";
 import { artifactIdentityKeys, rollbackStorySwitchAttribution, storySwitchNotice } from "../lib/lanes/story-switch.js";
 import { markSpawnFailure, spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { appendProjectFocusOverride, removeProjectFocusOverride } from "../lib/lanes/story-ledger.js";
@@ -359,15 +359,13 @@ export function createLaneResumeHandlers(deps) {
                 const already = current.attribution_history.some((entry) => entry.message_id === messageId);
                 if (already)
                     return current;
-                const existingStory = laneStory(current, projectId, storyId);
+                const addedStory = attributedStoryRow(current, projectId, storyId, at);
                 storySwitchRollback = {
                     message_id: messageId,
                     project_id: current.project_id,
                     story_id: current.story_id,
                     no_story_reason: current.no_story_reason,
-                    ...(!existingStory ? {
-                        added_story: { project_id: projectId, story_id: storyId, status: "in_progress", added_at: at, updated_at: at },
-                    } : {}),
+                    ...(addedStory ? { added_story: addedStory } : {}),
                     story_switch_unacknowledged: current.story_switch_unacknowledged,
                 };
                 return {
@@ -375,12 +373,7 @@ export function createLaneResumeHandlers(deps) {
                     project_id: projectId,
                     story_id: storyId,
                     no_story_reason: storyId ? undefined : current.no_story_reason,
-                    stories: laneStory(current, projectId, storyId)
-                        ? laneStories(current)
-                        : [
-                            ...laneStories(current),
-                            { project_id: projectId, story_id: storyId, status: "in_progress", added_at: at, updated_at: at },
-                        ],
+                    stories: storiesAfterAttribution(current, projectId, storyId, at),
                     attribution_history: appendCappedHistory(current.attribution_history, {
                         project_id: projectId,
                         story_id: storyId,

package/dist/commands/lanes-stories.js

@@ -44,6 +44,9 @@ export function createLaneStoryHandlers(deps) {
         };
     }
     function addCarriedStory(lane, projectId, storyId, at) {
+        if (!storyId.trim()) {
+            throw new LanesError("missing_story", "A story id is required to add a story to a lane", { lane_id: lane.lane_id });
+        }
         if (laneStory(lane, projectId, storyId)) {
             throw new LanesError("story_already_on_lane", `Story ${projectId}/${storyId} is already carried by lane ${lane.lane_id}`, {
                 lane_id: lane.lane_id,

package/dist/commands/rescue.d.ts

@@ -20,6 +20,7 @@
  * `HQ_NO_UPDATE_CHECK=1`; always best-effort.
  */
 import { Command } from 'commander';
+import { retrustCodexHooksAfterRescue } from '../utils/hook-trust.js';
 export interface RescueTarget {
     source: string;
     /** undefined → let the script apply its own default ref (`main`). */
@@ -45,6 +46,12 @@ export declare function shouldAttemptSelfUpdate(opts: {
     check?: boolean;
     selfUpdate?: boolean;
 }): boolean;
+/**
+ * Re-trust HQ's Codex hooks after a rescue that changed files on disk.
+ * Exported for tests. Best-effort: a trust failure is reported but never
+ * changes the rescue's exit status, because the core update itself succeeded.
+ */
+export declare function retrustHooksAfterRescue(hqRoot: string, retrust?: typeof retrustCodexHooksAfterRescue): Promise<void>;
 /** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
 export declare function getLatestReleaseTag(repo: string, token?: string): Promise<string>;
 /** Resolve a tag to its commit SHA, dereferencing annotated tags. */

package/dist/commands/rescue.js

@@ -1,4 +1,3 @@
-import { spawnSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
@@ -6,8 +5,8 @@ import chalk from 'chalk';
 import { rescue } from '@indigoai-us/hq-cloud';
 import { findHqRoot } from '../utils/manifest.js';
 import { selfUpdateAndReexec } from '../utils/self-update.js';
-const PROD_SOURCE = 'indigoai-us/hq-core';
-const STAGING_SOURCE = 'indigoai-us/hq-core-staging';
+import { retrustCodexHooksAfterRescue } from '../utils/hook-trust.js';
+import { PROD_SOURCE, STAGING_SOURCE, resolveGhToken } from '../utils/shipped-codex-hooks.js';
 /**
  * Resolve the source repo + ref from the user's flags. Pure + exported for
  * tests. `latestTag` is the resolved latest release tag (prod only); ignored
@@ -28,20 +27,27 @@ export function resolveRescueTarget(opts, latestTag) {
 export function shouldAttemptSelfUpdate(opts) {
     return opts.selfUpdate !== false && !opts.check;
 }
-/** Resolve a GitHub token: prefer `gh auth token`, fall back to env. */
-function resolveGhToken() {
+/**
+ * Re-trust HQ's Codex hooks after a rescue that changed files on disk.
+ * Exported for tests. Best-effort: a trust failure is reported but never
+ * changes the rescue's exit status, because the core update itself succeeded.
+ */
+export async function retrustHooksAfterRescue(hqRoot, retrust = retrustCodexHooksAfterRescue) {
+    let root = hqRoot;
     try {
-        const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
-        if (res.status === 0) {
-            const tok = res.stdout.trim();
-            if (tok)
-                return tok;
-        }
+        root = fs.realpathSync(hqRoot);
     }
     catch {
-        // gh not installed — fall through to env.
+        // Keep the path as given; trust reports its own failure if it is unusable.
+    }
+    const result = await retrust(root);
+    if (result.status === 'trusted') {
+        console.log(`rescue: re-trusted ${result.trusted} Codex HQ hook${result.trusted === 1 ? '' : 's'}`);
+    }
+    else if (result.status === 'failed') {
+        console.warn(chalk.yellow(`rescue: could not re-trust Codex HQ hooks: ${result.reason ?? 'unknown error'}. ` +
+            'Codex will skip changed HQ hooks until you run `hq reindex`.'));
     }
-    return process.env.GH_TOKEN || process.env.GITHUB_TOKEN || undefined;
 }
 function ghHeaders(token) {
     const headers = {
@@ -178,6 +184,9 @@ export function registerRescueCommand(program) {
                 cloudUpdate: opts.cloudUpdate,
                 ghToken: token,
             });
+            if (status === 0 && !opts.check) {
+                await retrustHooksAfterRescue(hqRoot);
+            }
             process.exit(status);
         }
         catch (error) {

package/dist/commands/run.js

@@ -149,11 +149,20 @@ export function registerRunCommand(program) {
             // error instead of hanging on varlock's never-settling promise, in case
             // the shape-dependent guard above ever silently degrades.
             await resolveEnvValuesOrThrow(graph);
-            const schemaErrors = Object.entries(graph.configSchema)
-                .filter(([, item]) => item.errors?.length > 0);
-            if (schemaErrors.length > 0) {
-                const msgs = schemaErrors.flatMap(([k, item]) => item.errors.map((e) => `  ${k}: ${e.message ?? String(e)}`));
-                process.stderr.write(`Error: failed to resolve env vars:\n${msgs.join('\n')}\n`);
+            // varlock's item.errors includes warning-severity entries (isWarning),
+            // e.g. "Value is very short! Is it actually sensitive?" for a short
+            // sensitive value. Print those and carry on; only real errors are fatal.
+            const schemaItems = Object.entries(graph.configSchema);
+            const itemMessages = (wantWarnings) => schemaItems.flatMap(([k, item]) => (item.errors ?? [])
+                .filter((e) => Boolean(e?.isWarning) === wantWarnings)
+                .map((e) => `  ${k}: ${e?.message ?? String(e)}`));
+            const warningMsgs = itemMessages(true);
+            if (warningMsgs.length > 0) {
+                process.stderr.write(`Warning: env var checks reported warnings:\n${warningMsgs.join('\n')}\n`);
+            }
+            const errorMsgs = itemMessages(false);
+            if (errorMsgs.length > 0) {
+                process.stderr.write(`Error: failed to resolve env vars:\n${errorMsgs.join('\n')}\n`);
                 process.exit(1);
             }
             const resolvedEnv = graph.getResolvedEnvObject();

package/dist/commands/secrets.d.ts

@@ -3,6 +3,13 @@ export { readSessionCompanyLock } from "../lib/session-company-lock.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
 export type { SecretLoadResponse, SecretScriptLockMode, SecretTier, SecretUsage, SecretUsageChannel } from "../secrets-env-action.js";
 export type { SecretScriptUsage, SecretMetadata, SecretLoadSuccessRow } from "../secrets-env-action.js";
+/**
+ * Exit code for `hq secrets exec` run with no session id and no explicit
+ * company. 78 is EX_CONFIG from sysexits.h: the caller's invocation is missing
+ * required configuration, so retrying the same command will not help.
+ */
+export declare const SECRETS_EXEC_UNATTENDED_NO_COMPANY_EXIT = 78;
+export declare const SECRETS_EXEC_UNATTENDED_NO_COMPANY_MESSAGE: string;
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
@@ -17,6 +24,12 @@ interface SecretAclPrincipal {
     granteeType: "email" | "group" | "company-wide" | "person";
     granteeId: string;
 }
+/**
+ * hq-pro refuses any Outpost grant above read with 400
+ * OUTPOST_GRANT_READ_ONLY. The CLI refuses it first with the same message.
+ */
+export declare const OUTPOST_GRANT_READ_ONLY_CODE = "OUTPOST_GRANT_READ_ONLY";
+export declare const OUTPOST_GRANT_READ_ONLY_MESSAGE = "Company Outposts can only be given read access to a secret.";
 export declare function parseSecretAclPrincipal(principal: string): SecretAclPrincipal | null;
 export interface SecretInjectionRecipe {
     header: string;

package/dist/commands/secrets.js

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import * as yaml from "js-yaml";
 import { assertApiKeyCompany, buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
 import { readSessionCompanyLock } from "../lib/session-company-lock.js";
+import { sessionIdFromEnv } from "../lib/core-utils/session-id.js";
 export { readSessionCompanyLock } from "../lib/session-company-lock.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
 function companyUidForSlug(root, slug) {
@@ -53,6 +54,16 @@ async function resolveApiKeyCompanyWithinLock(input) {
 }
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
+/**
+ * Exit code for `hq secrets exec` run with no session id and no explicit
+ * company. 78 is EX_CONFIG from sysexits.h: the caller's invocation is missing
+ * required configuration, so retrying the same command will not help.
+ */
+export const SECRETS_EXEC_UNATTENDED_NO_COMPANY_EXIT = 78;
+export const SECRETS_EXEC_UNATTENDED_NO_COMPANY_MESSAGE = "hq secrets exec has no session id (HQ_SESSION_ID, CLAUDE_CODE_SESSION_ID, CLAUDE_SESSION_ID, " +
+    "CODEX_SESSION_ID, CODEX_THREAD_ID and GROK_SESSION_ID are all unset), so it will not borrow a company " +
+    "from whichever interactive session last wrote workspace/sessions/.current. " +
+    "Pass --company <slug> (or --personal), or set HQ_SESSION_ID to the session this job runs under.";
 import { removeCacheEntry, clearAllCache } from "../utils/secrets-cache.js";
 import { isHqCliChild, releaseChildWrapperPackageUseLeaseAfterStart } from "../utils/child-wrapper-lease.js";
 import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
@@ -63,7 +74,7 @@ import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN, OUTPOST_UID_PATTERN, } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
-import { formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
+import { formatApiKeyCapabilityDenial, peekHqApiKey, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
 import { runSandboxJobAfterSubmission } from "../utils/secrets-sandbox-resident.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 /**
@@ -277,6 +288,12 @@ function promptSecretInteractively() {
         process.stdin.resume();
     });
 }
+/**
+ * hq-pro refuses any Outpost grant above read with 400
+ * OUTPOST_GRANT_READ_ONLY. The CLI refuses it first with the same message.
+ */
+export const OUTPOST_GRANT_READ_ONLY_CODE = "OUTPOST_GRANT_READ_ONLY";
+export const OUTPOST_GRANT_READ_ONLY_MESSAGE = "Company Outposts can only be given read access to a secret.";
 export function parseSecretAclPrincipal(principal) {
     const p = principal.trim();
     if (p === "@all") {
@@ -1164,11 +1181,23 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
-            const multiCompanyLockEnabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG);
-            const sessionLock = multiCompanyLockEnabled ? readSessionCompanyLock(process.env) : undefined;
             const parentScope = secrets.opts();
             const inheritedCompany = parentScope.company;
             const requestedCompany = _opts.company ?? inheritedCompany;
+            // A launchd or cron job has no session id. Session resolution would then
+            // fall back to workspace/sessions/.current, which names whichever
+            // interactive session last ran a hook, and the job would read that
+            // session's company's same-named secret. Without a session id the caller
+            // must name its scope. HQ_API_KEY is exempt: the key is bound to one
+            // company and never reads the session lock below.
+            const hasCallerSession = Boolean(sessionIdFromEnv(process.env));
+            if (!hasCallerSession && !requestedCompany && !parentScope.personal && peekHqApiKey() === undefined) {
+                console.error(chalk.red("Error:"), SECRETS_EXEC_UNATTENDED_NO_COMPANY_MESSAGE);
+                process.exit(SECRETS_EXEC_UNATTENDED_NO_COMPANY_EXIT);
+            }
+            const multiCompanyLockEnabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG);
+            // Only the caller's own session id may supply a lock; never .current.
+            const sessionLock = multiCompanyLockEnabled && hasCallerSession ? readSessionCompanyLock(process.env) : undefined;
             const hasLockedCompanies = (sessionLock?.companies.length ?? 0) > 0;
             const lockRoot = hasLockedCompanies ? resolveDefaultHqRoot({ env: process.env }) : undefined;
             const selectedCompany = (hasLockedCompanies && requestedCompany && looksLikeCompanyUid(requestedCompany)
@@ -1319,7 +1348,7 @@ export function registerSecretsCommand(program) {
         .command("share <path>")
         .description("Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)")
         .requiredOption("--with <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to share with")
-        .requiredOption("--permission <level>", "Permission level: read | write | admin")
+        .option("--permission <level>", "Permission level: read | write | admin (required, except for a company Outpost, which can only be given read and defaults to it)")
         .action(async (path, opts) => {
         try {
             rejectIfPersonal(secrets.opts(), "share");
@@ -1327,7 +1356,8 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
             }
-            if (!["read", "write", "admin"].includes(opts.permission)) {
+            if (opts.permission !== undefined &&
+                !["read", "write", "admin"].includes(opts.permission)) {
                 console.error(chalk.red(`Invalid permission '${opts.permission}': must be one of read, write, admin`));
                 process.exit(1);
             }
@@ -1335,6 +1365,16 @@ export function registerSecretsCommand(program) {
             if (!principal) {
                 process.exit(1);
             }
+            const isOutpost = OUTPOST_UID_PATTERN.test(principal.granteeId);
+            if (opts.permission === undefined && !isOutpost) {
+                console.error(chalk.red("Missing --permission: must be one of read, write, admin"));
+                process.exit(1);
+            }
+            const permission = opts.permission ?? "read";
+            if (isOutpost && permission !== "read") {
+                console.error(chalk.red(OUTPOST_GRANT_READ_ONLY_MESSAGE));
+                process.exit(1);
+            }
             const target = await resolveSecretsTarget("secrets:share", "secrets share", secrets.opts());
             const res = await vaultApiFetch({
                 token: target.token,
@@ -1344,12 +1384,15 @@ export function registerSecretsCommand(program) {
                     path,
                     granteeType: principal.granteeType,
                     granteeId: principal.granteeId,
-                    permission: opts.permission,
+                    permission,
                 },
             });
             if (!res.ok) {
                 const body = await res.json().catch(() => ({}));
-                if (res.status === 401) {
+                if (res.status === 400 && body.code === OUTPOST_GRANT_READ_ONLY_CODE) {
+                    console.error(chalk.red(OUTPOST_GRANT_READ_ONLY_MESSAGE));
+                }
+                else if (res.status === 401) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
@@ -1371,7 +1414,7 @@ export function registerSecretsCommand(program) {
                 }
                 process.exit(1);
             }
-            console.log(chalk.green(`Shared '${path}' with ${describeSecretAclPrincipal(principal)} (${opts.permission})`));
+            console.log(chalk.green(`Shared '${path}' with ${describeSecretAclPrincipal(principal)} (${permission})`));
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));