@indigoai-us/hq-cli 5.345.169 → 5.345.171

package/dist/commands/lanes-loop.js

@@ -3,6 +3,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { readLane, retryUpdateLane, updateLane } from "../lib/lanes/store.js";
 import { LanesError, isLaneVersionConflict } from "../lib/lanes/errors.js";
+import { liveNodeBinary } from "../lib/lanes/node-binary.js";
 import { readLatestEnvelopeRecord } from "../lib/lanes/watcher.js";
 import { spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { raiseLaneQuestion } from "../lib/lanes/questions.js";
@@ -33,6 +34,44 @@ export function settleLoopLaneIdle(hqRoot, laneId) {
 export function prepareIdleLoopLaneForResume(hqRoot, laneId) {
     return casLoopLaneState(hqRoot, laneId, "running", "done");
 }
+/**
+ * LanesError codes from the resume admission path that mean admission could
+ * not run right now and a later admission can retry: the admission or store
+ * lock timed out (store_lock_timeout), the lane changed while admission was
+ * checked (lane_admission_conflict), or a lane record CAS miss
+ * (version_conflict). Any other resume error is permanent and is rethrown.
+ */
+export const TRANSIENT_LOOP_ADMISSION_ERRORS = new Set([
+    "store_lock_timeout",
+    "lane_admission_conflict",
+    "version_conflict",
+]);
+/**
+ * Park a loop phase whose resume was refused before an engine launched. The
+ * lane becomes `queued` with `admit_failed` and the error, and carries the
+ * phase as `pending_resume`, so admission can launch it later and the lane is
+ * never left looking active with no engine.
+ */
+export function deferRefusedLoopPhase(hqRoot, laneId, at, error, phase) {
+    return retryUpdateLane(hqRoot, laneId, "command", (record) => ({
+        ...record,
+        state: "queued",
+        queued_reason: "admit_failed",
+        queued_details: { reason: "admit_failed", error: error.error, message: error.message || error.error },
+        queued_at: at,
+        admission_reserved_at: undefined,
+        pending_resume: {
+            ...(phase.sessionId ? { session_id: phase.sessionId } : { fresh_thread: true }),
+            trigger: "resume",
+            caller: "loop",
+            resumed_from: "done",
+            text: phase.text,
+            compact: true,
+            working_directory: phase.workingDirectory,
+            at,
+        },
+    }));
+}
 function casLoopLaneState(hqRoot, laneId, from, to) {
     for (let attempt = 0;; attempt += 1) {
         const current = readLane(hqRoot, laneId);
@@ -67,8 +106,8 @@ export function startLaneLoopController(ctx, laneId, initialAdmission = false) {
     const args = [entry, "lanes", "_loop-worker", laneId];
     const env = { ...ctx.env, HQ_LANE_LOOP_CONTROLLER: "1", ...(initialAdmission ? { HQ_LANE_LOOP_INITIAL: "1" } : {}) };
     const child = ctx.spawnProcess
-        ? ctx.spawnProcess(process.execPath, args, { cwd: ctx.hqRoot(), detached: true, windowsHide: true, stdio: ["ignore", 1, 2], env })
-        : spawn(process.execPath, args, { cwd: ctx.hqRoot(), detached: true, stdio: "ignore", env });
+        ? ctx.spawnProcess(liveNodeBinary(), args, { cwd: ctx.hqRoot(), detached: true, windowsHide: true, stdio: ["ignore", 1, 2], env })
+        : spawn(liveNodeBinary(), args, { cwd: ctx.hqRoot(), detached: true, stdio: "ignore", env });
     child.unref();
     if (child.pid === undefined)
         throw new LanesError("loop_controller_spawn_failed", "Loop controller did not start", { lane_id: laneId });
@@ -208,15 +247,34 @@ export async function runLaneLoopController(ctx, laneId, deps) {
                 else {
                     if (current.state === "running")
                         current = prepareIdleLoopLaneForResume(hqRoot, laneId);
-                    await deps.resumeLane(laneId, {
-                        text: `Read ${briefPath} and follow it as the complete instruction for this phase.`,
-                        project: current.project_id,
-                        ...(storyId ? { story: storyId } : {}),
-                        freshThread: fresh,
-                        ...(sessionId ? { loopSessionId: sessionId } : {}),
-                        ...(repairError !== undefined ? { loopHandoffRepair: true } : {}),
-                        workingDirectory: worktree,
-                    });
+                    const resumeText = `Read ${briefPath} and follow it as the complete instruction for this phase.`;
+                    try {
+                        await deps.resumeLane(laneId, {
+                            text: resumeText,
+                            project: current.project_id,
+                            ...(storyId ? { story: storyId } : {}),
+                            freshThread: fresh,
+                            ...(sessionId ? { loopSessionId: sessionId } : {}),
+                            ...(repairError !== undefined ? { loopHandoffRepair: true } : {}),
+                            workingDirectory: worktree,
+                        });
+                    }
+                    catch (error) {
+                        // Transient admission refusal before any engine launched (for
+                        // example a store lock timeout). The envelope is already active, so keep it
+                        // and park the lane as queued with a reason `hq lanes show`
+                        // displays; the next admission launches this phase from
+                        // pending_resume and the wait below picks up its result.
+                        if (!(error instanceof LanesError) ||
+                            !TRANSIENT_LOOP_ADMISSION_ERRORS.has(error.error) ||
+                            readLane(hqRoot, laneId).state !== "done")
+                            throw error;
+                        deferRefusedLoopPhase(hqRoot, laneId, ctx.now().toISOString(), error, {
+                            text: resumeText,
+                            sessionId: fresh ? undefined : sessionId ?? current.provider_session_id,
+                            workingDirectory: worktree,
+                        });
+                    }
                 }
                 let interruptPromise;
                 const abortPhase = () => {

package/dist/commands/lanes.js

@@ -508,9 +508,17 @@ function livenessDepsFromCtx(ctx) {
  * envelopes; every other lane spawns its worker directly. Every admission path
  * (reconcile, in-process queue drain, hq lanes admit) goes through here so a
  * loop lane never runs its brief without a controller.
+ *
+ * A queued loop lane whose controller is still alive is a deferred phase: the
+ * controller already activated the envelope and is waiting for its engine.
+ * That lane spawns the phase worker from pending_resume; starting a second
+ * controller would lose the runner lease and leave the lane running with no
+ * engine (feedback_865fe8a0).
  */
 function startAdmittedLane(ctx, root, candidate) {
-    if (candidate.loop_mode !== true || candidate.state !== "queued") {
+    const deferredLoopPhase = candidate.loop_mode === true && candidate.pending_resume !== undefined &&
+        loopControllerIsAlive(runDir(root, candidate.lane_id));
+    if (candidate.loop_mode !== true || candidate.state !== "queued" || deferredLoopPhase) {
         const admissionHost = reconcileHostFromCtx(ctx);
         return spawnLaneWorker(root, candidate, {
             env: ctx.env,

package/dist/commands/mesh.js

@@ -2070,11 +2070,16 @@ async function runContextOrganize(opts) {
             !opts.untracked);
     if (isList) {
         let fetchCandidates;
+        let resolveCompanyUid;
         let offline = Boolean(opts.offline);
         if (!offline) {
             try {
                 const token = await requireToken();
                 fetchCandidates = createCandidatesFetcher({ token });
+                resolveCompanyUid = async (slug) => {
+                    const membership = await resolveActiveMembershipCompany(token, slug, AbortSignal.timeout(ONLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS));
+                    return membership?.companyUid ?? null;
+                };
             }
             catch {
                 offline = true;
@@ -2084,6 +2089,7 @@ async function runContextOrganize(opts) {
             sessionId,
             root,
             fetchCandidates,
+            resolveCompanyUid,
             offline,
         });
         if (opts.json || opts.machine) {

package/dist/commands/rescue.d.ts

@@ -21,6 +21,7 @@
  */
 import { Command } from 'commander';
 import { retrustCodexHooksAfterRescue } from '../utils/hook-trust.js';
+import { repairDanglingReleaseLinks } from '../lib/doctor/checks/release-links.js';
 export interface RescueTarget {
     source: string;
     /** undefined → let the script apply its own default ref (`main`). */
@@ -52,6 +53,14 @@ export declare function shouldAttemptSelfUpdate(opts: {
  * changes the rescue's exit status, because the core update itself succeeded.
  */
 export declare function retrustHooksAfterRescue(hqRoot: string, retrust?: typeof retrustCodexHooksAfterRescue): Promise<void>;
+/**
+ * Repair HQ-managed release links (`.agents/skills`, `.codex/claude`, ...)
+ * that do not resolve after a rescue, for example because they were laid at
+ * the rescue's temp extraction folder, which is then deleted
+ * (feedback_2ab63e50). Exported for tests. Best-effort: a failure is reported
+ * but never changes the rescue's exit status.
+ */
+export declare function repairReleaseLinksAfterRescue(hqRoot: string, repair?: typeof repairDanglingReleaseLinks): void;
 /** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
 export declare function getLatestReleaseTag(repo: string, token?: string): Promise<string>;
 /** Resolve a tag to its commit SHA, dereferencing annotated tags. */

package/dist/commands/rescue.js

@@ -6,6 +6,7 @@ import { rescue } from '@indigoai-us/hq-cloud';
 import { findHqRoot } from '../utils/manifest.js';
 import { selfUpdateAndReexec } from '../utils/self-update.js';
 import { retrustCodexHooksAfterRescue } from '../utils/hook-trust.js';
+import { repairDanglingReleaseLinks } from '../lib/doctor/checks/release-links.js';
 import { PROD_SOURCE, STAGING_SOURCE, resolveGhToken } from '../utils/shipped-codex-hooks.js';
 /**
  * Resolve the source repo + ref from the user's flags. Pure + exported for
@@ -49,6 +50,35 @@ export async function retrustHooksAfterRescue(hqRoot, retrust = retrustCodexHook
             'Codex will skip changed HQ hooks until you run `hq reindex`.'));
     }
 }
+/**
+ * Repair HQ-managed release links (`.agents/skills`, `.codex/claude`, ...)
+ * that do not resolve after a rescue, for example because they were laid at
+ * the rescue's temp extraction folder, which is then deleted
+ * (feedback_2ab63e50). Exported for tests. Best-effort: a failure is reported
+ * but never changes the rescue's exit status.
+ */
+export function repairReleaseLinksAfterRescue(hqRoot, repair = repairDanglingReleaseLinks) {
+    try {
+        for (const entry of repair(hqRoot)) {
+            if (entry.action === 'repointed') {
+                console.log(`rescue: repointed dangling link ${entry.rel} -> ${entry.linkText ?? entry.target}`);
+            }
+            else if (entry.action === 'removed') {
+                console.log(`rescue: removed dangling link ${entry.rel} (its target is missing)`);
+            }
+            else if (entry.action === 'skipped') {
+                console.log(`rescue: left dangling link ${entry.rel} alone: ${entry.reason ?? 'not an HQ-managed target'}`);
+            }
+            else {
+                console.warn(chalk.yellow(`rescue: could not repair ${entry.rel}: ${entry.reason ?? 'unknown error'}. Run \`hq doctor --fix\`.`));
+            }
+        }
+    }
+    catch (err) {
+        console.warn(chalk.yellow(`rescue: could not repair dangling release links: ${err instanceof Error ? err.message : 'unknown error'}. ` +
+            'Run `hq doctor --fix`.'));
+    }
+}
 function ghHeaders(token) {
     const headers = {
         Accept: 'application/vnd.github+json',
@@ -185,6 +215,7 @@ export function registerRescueCommand(program) {
                 ghToken: token,
             });
             if (status === 0 && !opts.check) {
+                repairReleaseLinksAfterRescue(hqRoot);
                 await retrustHooksAfterRescue(hqRoot);
             }
             process.exit(status);

package/dist/commands/run.js

@@ -1,3 +1,5 @@
+import { assertInjectedNamesAllowed, assertLiteralNamesAllowed, assertScriptUnchanged, planScriptBinding, selectChildLaunch } from '../utils/script-bound-exec.js';
+import { parseStrictSchemaFiles } from '../run/script-bound-schema.js';
 import { spawn } from 'node:child_process';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
@@ -33,6 +35,47 @@ export async function buildRunUsage(scriptPath, scriptId) {
         },
     };
 }
+/**
+ * `hq run --script` resolution: read the schema files strictly, fetch only the
+ * hq() secrets, and return literals plus secret values. No varlock graph.
+ */
+async function resolveStrictSchema(paths, companyUid, usage, fetchBatch) {
+    const strict = parseStrictSchemaFiles(paths);
+    // Refuse proxy, CA/TLS, pager/editor, HOME/XDG and loader names before any
+    // fetch, so a schema literal cannot redirect what the bound script calls.
+    // Literals must be on the small --script allowlist; hq() names keep the
+    // denylist check (creating a secret needs vault write).
+    assertLiteralNamesAllowed(Object.keys(strict.statics));
+    assertInjectedNamesAllowed(strict.secrets.keys());
+    const names = [...new Set(strict.secrets.values())];
+    if (names.length > 100) {
+        throw new Error(`hq run supports at most 100 hq() resolvers per schema; got ${names.length}`);
+    }
+    const values = new Map();
+    if (names.length > 0) {
+        const data = await fetchBatch(companyUid, names, usage);
+        if (!Array.isArray(data?.secrets) || !Array.isArray(data?.errors)) {
+            throw new Error('Invalid secret load response from vault');
+        }
+        const firstError = data.errors[0];
+        if (firstError) {
+            throw new Error(`Failed to fetch secret '${firstError.name}': ${firstError.message ?? firstError.code}`);
+        }
+        for (const row of data.secrets) {
+            if (row && typeof row.name === 'string' && typeof row.value === 'string' && row.revokedAt == null) {
+                values.set(row.name, row.value);
+            }
+        }
+    }
+    const env = { ...strict.statics };
+    for (const [key, name] of strict.secrets) {
+        const value = values.get(name);
+        if (value === undefined)
+            throw new Error(`Failed to fetch secret '${name}': not returned by vault`);
+        env[key] = value;
+    }
+    return env;
+}
 export function registerRunCommand(program) {
     program
         .command('run')
@@ -89,8 +132,19 @@ export function registerRunCommand(program) {
             const uid = await getCompanyUid(token, slug, undefined, {
                 allowOfflineScopeFallback: true,
             });
+            // feedback_0e6abcb8: with --script, script-locked secrets may reach
+            // only the approved script itself. Resolve the command now; a refusal
+            // is applied once the vault says which secrets are locked.
+            const scriptPlan = opts.check ? undefined : await planScriptBinding(opts.script, childArgs);
             const usage = await buildRunUsage(opts.script, opts.scriptId);
+            if (scriptPlan?.bound) {
+                await assertScriptUnchanged(scriptPlan.bound, usage?.script?.sha256);
+            }
+            const requestedNames = new Set();
+            const lockModes = new Map();
             const fetchBatch = async (companyUid, names, requestUsage) => withRunSecretReadTelemetry(companyUid, async () => {
+                for (const name of names)
+                    requestedNames.add(name);
                 const res = await vaultApiFetch({
                     token,
                     path: `/secrets/${encodeURIComponent(companyUid)}/load`,
@@ -115,7 +169,12 @@ export function registerRunCommand(program) {
                     }
                     throw new Error(`Failed to batch-load secrets: ${message}`);
                 }
-                return res.json();
+                const data = await res.json();
+                for (const row of Array.isArray(data?.secrets) ? data.secrets : []) {
+                    if (row && typeof row.name === 'string')
+                        lockModes.set(row.name, row.scriptLock?.mode);
+                }
+                return data;
             });
             const pluginOpts = {
                 companyOverride: opts.company,
@@ -127,61 +186,77 @@ export function registerRunCommand(program) {
             };
             // LAST entry = highest precedence; .env.local files trail .env.schema files so any .env.local beats any schema regardless of depth.
             const paths = [...schemaPaths, ...envLocalPaths];
-            let state;
-            const graph = await internal.loadEnvGraph({
-                entryFilePaths: paths,
-                // hq run owns its short-lived in-memory resolution. Varlock's default
-                // cache auto-detection can write ~/.config/varlock and initialize
-                // the native local-encryption helper, neither of which belongs on
-                // this command path.
-                skipCache: true,
-                afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
-            });
-            // Refuse to resolve a graph varlock never finished loading (a malformed
-            // .env.schema / .env.local): resolving an unprocessed item whose key is
-            // also in process.env reaches varlock's `expected dataType to be set`
-            // invariant as a FLOATED, never-settling rejection — the CLI then exits
-            // 0 with the command never run (HQ-CLI-W). Run this BEFORE prewarm so a
-            // bad file can never trigger a secret fetch.
-            assertEnvGraphLoaded(graph);
-            await prewarmHqSecrets(graph, pluginOpts, state);
-            // Defence in depth: convert a floated resolution rejection into a thrown
-            // error instead of hanging on varlock's never-settling promise, in case
-            // the shape-dependent guard above ever silently degrades.
-            await resolveEnvValuesOrThrow(graph);
-            // varlock's item.errors includes warning-severity entries (isWarning),
-            // e.g. "Value is very short! Is it actually sensitive?" for a short
-            // sensitive value. Print those and carry on; only real errors are fatal.
-            const schemaItems = Object.entries(graph.configSchema);
-            const itemMessages = (wantWarnings) => schemaItems.flatMap(([k, item]) => (item.errors ?? [])
-                .filter((e) => Boolean(e?.isWarning) === wantWarnings)
-                .map((e) => `  ${k}: ${e?.message ?? String(e)}`));
-            const warningMsgs = itemMessages(true);
-            if (warningMsgs.length > 0) {
-                process.stderr.write(`Warning: env var checks reported warnings:\n${warningMsgs.join('\n')}\n`);
+            let resolvedEnv;
+            if (opts.script) {
+                // feedback_0e6abcb8: with --script, never build a varlock graph. Its
+                // exec()/plugin/import resolvers would run in this process while the
+                // fetched secrets are in memory, before the script binding is
+                // checked. The strict reader accepts only hq() items and literals.
+                resolvedEnv = await resolveStrictSchema(paths, uid, usage, fetchBatch);
             }
-            const errorMsgs = itemMessages(false);
-            if (errorMsgs.length > 0) {
-                process.stderr.write(`Error: failed to resolve env vars:\n${errorMsgs.join('\n')}\n`);
-                process.exit(1);
+            else {
+                let state;
+                const graph = await internal.loadEnvGraph({
+                    entryFilePaths: paths,
+                    // hq run owns its short-lived in-memory resolution. Varlock's default
+                    // cache auto-detection can write ~/.config/varlock and initialize
+                    // the native local-encryption helper, neither of which belongs on
+                    // this command path.
+                    skipCache: true,
+                    afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
+                });
+                // Refuse to resolve a graph varlock never finished loading (a malformed
+                // .env.schema / .env.local): resolving an unprocessed item whose key is
+                // also in process.env reaches varlock's `expected dataType to be set`
+                // invariant as a FLOATED, never-settling rejection — the CLI then exits
+                // 0 with the command never run (HQ-CLI-W). Run this BEFORE prewarm so a
+                // bad file can never trigger a secret fetch.
+                assertEnvGraphLoaded(graph);
+                await prewarmHqSecrets(graph, pluginOpts, state);
+                // Defence in depth: convert a floated resolution rejection into a thrown
+                // error instead of hanging on varlock's never-settling promise, in case
+                // the shape-dependent guard above ever silently degrades.
+                await resolveEnvValuesOrThrow(graph);
+                // varlock's item.errors includes warning-severity entries (isWarning),
+                // e.g. "Value is very short! Is it actually sensitive?" for a short
+                // sensitive value. Print those and carry on; only real errors are fatal.
+                const schemaItems = Object.entries(graph.configSchema);
+                const itemMessages = (wantWarnings) => schemaItems.flatMap(([k, item]) => (item.errors ?? [])
+                    .filter((e) => Boolean(e?.isWarning) === wantWarnings)
+                    .map((e) => `  ${k}: ${e?.message ?? String(e)}`));
+                const warningMsgs = itemMessages(true);
+                if (warningMsgs.length > 0) {
+                    process.stderr.write(`Warning: env var checks reported warnings:\n${warningMsgs.join('\n')}\n`);
+                }
+                const errorMsgs = itemMessages(false);
+                if (errorMsgs.length > 0) {
+                    process.stderr.write(`Error: failed to resolve env vars:\n${errorMsgs.join('\n')}\n`);
+                    process.exit(1);
+                }
+                resolvedEnv = graph.getResolvedEnvObject();
             }
-            const resolvedEnv = graph.getResolvedEnvObject();
             const varCount = Object.keys(resolvedEnv).length;
             process.stderr.write(`Loaded ${varCount} env vars from .env.schema (company: ${slug})\n`);
             if (opts.check) {
                 process.exit(0);
             }
-            const [childCmd, ...restArgs] = childArgs;
+            // Script-locked (or unknown) secrets go only to a private, re-hashed
+            // copy of the approved script; unlocked secrets keep the command as is.
+            const launch = selectChildLaunch(scriptPlan, [...requestedNames], lockModes, usage?.script?.sha256, childArgs, process.env, resolvedEnv);
+            const childCmd = launch.file;
+            const restArgs = launch.args;
             const child = spawn(childCmd, restArgs, {
                 stdio: 'inherit',
-                env: { ...process.env, ...resolvedEnv },
+                env: launch.env,
             });
             child.once('spawn', () => releaseChildWrapperPackageUseLeaseAfterStart("childWrapper", isHqCliChild(childCmd, restArgs)));
             child.on('error', (err) => {
                 process.stderr.write(`Error: failed to start command '${childCmd}': ${err.message}\n`);
+                launch.cleanup();
                 process.exit(1);
             });
             child.on('close', (code, signal) => {
+                launch.cleanup();
                 if (signal) {
                     process.kill(process.pid, signal);
                 }

package/dist/commands/scan.d.ts

@@ -6,7 +6,10 @@
  *   hq scan secrets --json        findings as JSON
  *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
  *                                 scan files with that repo's committed
- *                                 .gitleaks.toml allowlists (used by pr-check)
+ *                                 .gitleaks.toml allowlists
+ *   hq scan secrets --range <base>[..<head>] [--repo <dir>]
+ *                                 scan the lines a branch added since <base>,
+ *                                 every commit included (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -24,6 +27,7 @@ interface ScanSecretsOptions {
     repo?: string;
     snapshotRoot?: string;
     allowlistRev?: string;
+    range?: string;
 }
 export declare function runScanSecrets(paths: string[], opts: ScanSecretsOptions, cwd?: string): number;
 export declare function registerScanCommand(program: Command): void;

package/dist/commands/scan.js

@@ -6,7 +6,10 @@
  *   hq scan secrets --json        findings as JSON
  *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
  *                                 scan files with that repo's committed
- *                                 .gitleaks.toml allowlists (used by pr-check)
+ *                                 .gitleaks.toml allowlists
+ *   hq scan secrets --range <base>[..<head>] [--repo <dir>]
+ *                                 scan the lines a branch added since <base>,
+ *                                 every commit included (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -18,6 +21,7 @@
  * Output names the rule, file and line; secret values are never printed.
  */
 import { ScanConfigError } from "../lib/secret-scan/repo-config.js";
+import { scanRange } from "../lib/secret-scan/range.js";
 import { ScanInputError, scanFiles, scanStaged } from "../lib/secret-scan/staged.js";
 function report(findings, scope) {
     if (!findings.length)
@@ -38,7 +42,14 @@ export function runScanSecrets(paths, opts, cwd = process.cwd()) {
             throw new ScanInputError("--snapshot-root needs --repo");
         if (opts.allowlistRev !== undefined && opts.repo === undefined)
             throw new ScanInputError("--allowlist-rev needs --repo");
-        findings = paths.length && !opts.staged ? scanFiles(paths, { repo: opts.repo, snapshotRoot: opts.snapshotRoot, allowlistRev: opts.allowlistRev }) : scanStaged(cwd);
+        if (opts.range !== undefined) {
+            if (paths.length || opts.staged)
+                throw new ScanInputError("--range scans a commit range; do not pass files or --staged");
+            if (opts.snapshotRoot !== undefined || opts.allowlistRev !== undefined) {
+                throw new ScanInputError("--range reads .gitleaks.toml from the range base; drop --snapshot-root and --allowlist-rev");
+            }
+        }
+        findings = opts.range !== undefined ? scanRange(opts.repo ?? cwd, opts.range) : paths.length && !opts.staged ? scanFiles(paths, { repo: opts.repo, snapshotRoot: opts.snapshotRoot, allowlistRev: opts.allowlistRev }) : scanStaged(cwd);
     }
     catch (err) {
         const msg = err instanceof ScanInputError || err instanceof ScanConfigError ? err.message : `scan failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -51,7 +62,7 @@ export function runScanSecrets(paths, opts, cwd = process.cwd()) {
         process.stdout.write(`${JSON.stringify({ ok: findings.length === 0, findings })}\n`);
     }
     else {
-        report(findings, paths.length && !opts.staged ? "the given files" : "staged changes");
+        report(findings, opts.range !== undefined ? `the lines added in ${opts.range}` : paths.length && !opts.staged ? "the given files" : "staged changes");
     }
     return findings.length ? 1 : 0;
 }
@@ -63,9 +74,10 @@ export function registerScanCommand(program) {
         .argument("[files...]", "Scan these files instead of the staged changes")
         .option("--staged", "Scan the staged changes (default when no files are given)")
         .option("--json", "Print findings as JSON")
-        .option("--repo <dir>", "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths")
+        .option("--repo <dir>", "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths. With --range: the repo to scan (default: the current directory)")
         .option("--snapshot-root <dir>", "With --repo: files under <dir>/<commit>/<path> are matched as <path>")
         .option("--allowlist-rev <rev>", "With --repo: read .gitleaks.toml from this commit instead of HEAD")
+        .option("--range <range>", "Scan the lines added in <base>..<head> (head defaults to HEAD), every commit included, with the base's .gitleaks.toml allowlists and the repo's [[rules]]")
         .action((files, opts) => {
         process.exitCode = runScanSecrets(files ?? [], opts);
     });

package/dist/commands/secrets.js

@@ -1,3 +1,4 @@
+import { assertScriptUnchanged, planScriptBinding, selectChildLaunch } from "../utils/script-bound-exec.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
@@ -77,6 +78,7 @@ import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, format
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { formatApiKeyCapabilityDenial, peekHqApiKey, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
 import { runSandboxJobAfterSubmission } from "../utils/secrets-sandbox-resident.js";
+import { renderSecretInputLink, SECRET_LINK_FORMATS, } from "../lib/secret-input-link.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 /**
  * Mirrors `RESOURCE_SURFACES` in hq-pro
@@ -1370,6 +1372,10 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
+            // feedback_0e6abcb8: with --script, a script-locked secret may reach
+            // only the approved script itself. Resolve the command now; a refusal
+            // is applied once the vault says which secrets are locked.
+            const scriptPlan = await planScriptBinding(_opts.script, childArgs);
             const parentScope = { ...secrets.opts() };
             const inheritedCompany = parentScope.company;
             let requestedCompany = _opts.company ?? inheritedCompany;
@@ -1466,9 +1472,14 @@ export function registerSecretsCommand(program) {
                     secret_names: keys,
                 });
             }
-            const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
+            const execUsage = cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
-                : undefined, { allowOfflineFallback: true });
+                : undefined;
+            if (scriptPlan?.bound) {
+                await assertScriptUnchanged(scriptPlan.bound, execUsage?.script?.sha256);
+            }
+            const lockModes = new Map();
+            const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, execUsage, { allowOfflineFallback: true, lockModes });
             // API-key auth has no signed-in person identity for the CLI telemetry
             // endpoint. Do not attribute that read to an unrelated cached session.
             let revealed;
@@ -1489,18 +1500,24 @@ export function registerSecretsCommand(program) {
                 }
                 secretEnv[key] = value;
             }
-            const [childCmd, ...childCmdArgs] = childArgs;
+            // Script-locked (or unknown) secrets go only to a private, re-hashed
+            // copy of the approved script; unlocked secrets keep the command as is.
+            const launch = selectChildLaunch(scriptPlan, keys, lockModes, execUsage?.script?.sha256, childArgs, process.env, secretEnv);
+            const childCmd = launch.file;
+            const childCmdArgs = launch.args;
             const { spawn } = await import("node:child_process");
             const child = spawn(childCmd, childCmdArgs, {
                 stdio: "inherit",
-                env: { ...process.env, ...secretEnv },
+                env: launch.env,
             });
             child.once("spawn", () => releaseChildWrapperPackageUseLeaseAfterStart("childWrapper", isHqCliChild(childCmd, childCmdArgs)));
             child.on("error", (err) => {
                 console.error(chalk.red(`Failed to start command '${childCmd}': ${err.message}`));
+                launch.cleanup();
                 process.exit(1);
             });
             child.on("close", (code, signal) => {
+                launch.cleanup();
                 if (signal) {
                     process.kill(process.pid, signal);
                 }
@@ -1525,8 +1542,19 @@ export function registerSecretsCommand(program) {
         .command("generate-link <name>")
         .description("Generate a one-time link for someone to submit a secret value")
         .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
+        .option("--format <format>", "Output format: text (default; OSC-8 hyperlink on a supporting TTY, plain URL otherwise; FORCE_HYPERLINK=1/0 overrides detection on a TTY only), markdown (one Markdown link line on stdout, details on stderr), json")
+        .option("--json", "Print { url, expiresAt, secretName } as JSON (same as --format json)")
         .action(async (name, opts) => {
         try {
+            const format = (opts.json ? "json" : (opts.format ?? "text"));
+            if (!SECRET_LINK_FORMATS.includes(format)) {
+                console.error(chalk.red(`Invalid format '${opts.format}': must be one of ${SECRET_LINK_FORMATS.join(", ")}`));
+                process.exit(1);
+            }
+            if (opts.json && opts.format !== undefined && opts.format !== "json") {
+                console.error(chalk.red(`--json conflicts with --format ${opts.format}`));
+                process.exit(1);
+            }
             if (!SECRET_NAME_PATTERN.test(name)) {
                 console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
@@ -1556,11 +1584,24 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const data = (await res.json());
-            console.log(chalk.green("Secret input link generated:"));
-            console.log(`\n  ${data.url}\n`);
-            console.log(chalk.dim(`  Secret:  ${data.secretName}`));
-            console.log(chalk.dim(`  Expires: ${data.expiresAt}`));
-            console.log(chalk.dim("  One-time use — link is invalidated after first submission."));
+            const rendered = renderSecretInputLink(data, {
+                format,
+                isTTY: process.stdout.isTTY === true,
+                env: process.env,
+            });
+            if (format === "text") {
+                const [heading, link, ...meta] = rendered.stdout;
+                console.log(chalk.green(heading));
+                console.log(link);
+                for (const line of meta)
+                    console.log(chalk.dim(line));
+            }
+            else {
+                for (const line of rendered.stdout)
+                    console.log(line);
+                for (const line of rendered.stderr)
+                    console.error(chalk.dim(line));
+            }
         }
         catch (err) {
             // Same shared plan-limit renderer as `secrets set` (see main.ts).