@indigoai-us/hq-cli 5.345.196 → 5.345.198

package/dist/lib/bot/session.js

@@ -38,6 +38,31 @@ export function clearBotSession(dir, scope = "dm") {
         /* already gone */
     }
 }
+const isScopeValue = (value) => typeof value === "string" || value === null;
+function writeCompanyScopeMarker(dir, marker) {
+    const tmp = path.join(dir, `.company-scope.${randomUUID()}.tmp`);
+    try {
+        fs.writeFileSync(tmp, `${JSON.stringify(marker)}\n`, { mode: 0o600 });
+        fs.renameSync(tmp, path.join(dir, "company-scope.json"));
+    }
+    finally {
+        fs.rmSync(tmp, { force: true });
+    }
+}
+/** Move every session and DM history file into a fresh private archive folder. */
+function archiveConversations(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const names = fs.readdirSync(dir).filter((name) => /^(?:session|dm-history)(?:-[A-Za-z0-9_-]+)?\.json$/.test(name));
+    if (!names.length)
+        return { names };
+    const archiveRoot = path.join(dir, "company-scope-archives");
+    fs.mkdirSync(archiveRoot, { recursive: true, mode: 0o700 });
+    const archiveDir = path.join(archiveRoot, randomUUID());
+    fs.mkdirSync(archiveDir, { mode: 0o700 });
+    for (const name of names)
+        fs.renameSync(path.join(dir, name), path.join(archiveDir, name));
+    return { names, archiveDir };
+}
 /**
  * Run once at startup, before reading or appending conversation state. A scope
  * change must never resume a prior company's model session or replay its DM
@@ -46,13 +71,14 @@ export function clearBotSession(dir, scope = "dm") {
  * Legacy personal bots retain their existing history; company bots require
  * positive scope evidence and archive legacy, unproven conversations once.
  */
-export function ensureBotCompanyScope(dir, companyScopeKey) {
+export function ensureBotCompanyScope(dir, companyScopeKey, options = {}) {
     const marker = path.join(dir, "company-scope.json");
     const hasMarker = fs.existsSync(marker);
-    if (!hasMarker && companyScopeKey === undefined)
+    const inferred = companyScopeKey === undefined ? options.inferredSlug : undefined;
+    if (!hasMarker && companyScopeKey === undefined && inferred === undefined)
         return { reset: false };
     const expected = companyScopeKey ?? null;
-    let provenPreviousScope = false;
+    let previous = null;
     if (hasMarker) {
         // Read errors fail closed. Invalid JSON is unproven provenance and resets.
         const body = fs.readFileSync(marker, "utf8");
@@ -63,16 +89,22 @@ export function ensureBotCompanyScope(dir, companyScopeKey) {
         catch {
             parsed = null;
         }
-        provenPreviousScope = Boolean(parsed && typeof parsed === "object" &&
-            parsed.v === 1 &&
-            (typeof parsed.companyScopeKey === "string" ||
-                parsed.companyScopeKey === null));
-        if (parsed && typeof parsed === "object" &&
-            parsed.v === 1 &&
-            parsed.companyScopeKey === expected) {
-            return { reset: false };
+        previous = parsed && typeof parsed === "object" && parsed.v === 1
+            ? parsed
+            : null;
+        if (inferred === undefined && previous !== null) {
+            if (previous.companyScopeKey === expected)
+                return { reset: false };
+            if (typeof previous.companyScopeKey === "string" && options.equivalentKeys?.includes(previous.companyScopeKey)) {
+                // The same scope under an older key: record the current key and keep everything.
+                writeCompanyScopeMarker(dir, { v: 1, companyScopeKey: expected });
+                return { reset: false };
+            }
         }
     }
+    const provenPreviousScope = previous !== null && isScopeValue(previous.companyScopeKey);
+    if (inferred !== undefined)
+        return ensureInferredScope(dir, hasMarker, previous, inferred);
     // A known company switch must settle recovery under its previous scope.
     // Legacy bots have no scope evidence: isolate their model context below,
     // but leave delivery/job markers intact for the existing recovery path.
@@ -84,26 +116,41 @@ export function ensureBotCompanyScope(dir, companyScopeKey) {
     }
     if (!provenPreviousScope)
         omitInflightRecoveryHistory(dir, pending);
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const names = fs.readdirSync(dir).filter((name) => /^(?:session|dm-history)(?:-[A-Za-z0-9_-]+)?\.json$/.test(name));
-    let archiveDir;
-    if (names.length) {
-        const archiveRoot = path.join(dir, "company-scope-archives");
-        fs.mkdirSync(archiveRoot, { recursive: true, mode: 0o700 });
-        archiveDir = path.join(archiveRoot, randomUUID());
-        fs.mkdirSync(archiveDir, { mode: 0o700 });
-        for (const name of names)
-            fs.renameSync(path.join(dir, name), path.join(archiveDir, name));
-    }
+    const { names, archiveDir } = archiveConversations(dir);
     // Commit the new provenance only after every old conversation was isolated.
-    const tmp = path.join(dir, `.company-scope.${randomUUID()}.tmp`);
-    try {
-        fs.writeFileSync(tmp, `${JSON.stringify({ v: 1, companyScopeKey: expected })}\n`, { mode: 0o600 });
-        fs.renameSync(tmp, marker);
+    writeCompanyScopeMarker(dir, { v: 1, companyScopeKey: expected });
+    return { reset: names.length > 0, ...(archiveDir ? { archiveDir } : {}) };
+}
+/**
+ * The personal-bot path of ensureBotCompanyScope: the recorded inferred slug
+ * must match, or the conversations are archived. The explicit companyScopeKey
+ * field is carried over exactly as the explicit rule would leave it (absent,
+ * or null once the bot has had a marker), so a later explicit bind behaves as
+ * it did before inferred locks existed.
+ */
+function ensureInferredScope(dir, hasMarker, previous, inferred) {
+    const previousInferred = previous !== null && isScopeValue(previous.inferredCompanySlug) ? previous.inferredCompanySlug : undefined;
+    const previousExplicit = previous !== null && isScopeValue(previous.companyScopeKey) ? previous.companyScopeKey : undefined;
+    const recordsNull = hasMarker && !(previousExplicit === undefined && previousInferred !== undefined);
+    const next = { v: 1, ...(recordsNull ? { companyScopeKey: null } : {}), inferredCompanySlug: inferred };
+    // No inferred record yet: a legacy personal bot (no marker, or an
+    // explicit-unbound one) keeps its history, as it did before inferred locks.
+    if (!hasMarker || (previousExplicit === null && previousInferred === undefined)) {
+        writeCompanyScopeMarker(dir, next);
+        return { reset: false };
     }
-    finally {
-        fs.rmSync(tmp, { force: true });
+    if (previousInferred === inferred && typeof previousExplicit !== "string")
+        return { reset: false };
+    const pending = readInflightTurns(dir, { strictIo: true });
+    // Leaving an explicit company keeps the explicit rule: settle its work first.
+    // A change in the HQ's company list cannot be undone from bot.json, so it
+    // never blocks the start; saved work is settled without the old history.
+    if (typeof previousExplicit === "string" && pending.length > 0) {
+        throw new Error("Bot company settings changed with pending work. Restore the previous company settings and settle pending work before switching companies.");
     }
+    omitInflightRecoveryHistory(dir, pending);
+    const { names, archiveDir } = archiveConversations(dir);
+    writeCompanyScopeMarker(dir, next);
     return { reset: names.length > 0, ...(archiveDir ? { archiveDir } : {}) };
 }
 //# sourceMappingURL=session.js.map

package/dist/lib/core-utils/manifest-slugs.d.ts

@@ -0,0 +1,2 @@
+export declare function parseManifestSlugs(text: string): string[];
+//# sourceMappingURL=manifest-slugs.d.ts.map

package/dist/lib/core-utils/manifest-slugs.js

@@ -0,0 +1,26 @@
+/** Leaf module: company slugs from companies/manifest.yaml, shared by the resolver and the bot runtime. */
+const keepSlug = (slug) => slug !== "" && slug !== "_template" && slug !== "companies" && slug !== "unaffiliated_repos";
+export function parseManifestSlugs(text) {
+    const slugs = new Set();
+    let wrapped = false;
+    for (const rawLine of text.split("\n")) {
+        const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+        if (/^companies:[ \t]*$/.test(line)) {
+            wrapped = true;
+            continue;
+        }
+        if (wrapped && /^[^ \t][^:]*:[ \t]*$/.test(line))
+            wrapped = false;
+        if (wrapped) {
+            const match = line.match(/^ {2}([A-Za-z][A-Za-z0-9_-]*):/);
+            if (match && keepSlug(match[1]))
+                slugs.add(match[1]);
+            continue;
+        }
+        const match = line.match(/^([A-Za-z][A-Za-z0-9_-]*):/);
+        if (match && keepSlug(match[1]))
+            slugs.add(match[1]);
+    }
+    return [...slugs];
+}
+//# sourceMappingURL=manifest-slugs.js.map

package/dist/lib/signals/steps/extract.d.ts

@@ -3,6 +3,13 @@ import type { SignalsStep } from "./types.js";
 export declare const EXTRACT_SIGNAL_TYPES: readonly ["action_item", "commitment", "decision", "risk", "question", "key_point", "participant_contribution", "summary"];
 export declare const DEFAULT_WORKLIST_LIMIT = 20;
 export declare const DEFAULT_TURN_TIMEOUT_MS: number;
+export declare const WORKLIST_ITEM_TIMEOUT_MS = 10000;
+/**
+ * The listing call may look up one ACL per item over the network (an item
+ * with no audience in its frontmatter), so its budget grows with the cap: the
+ * fixed script budget plus WORKLIST_ITEM_TIMEOUT_MS per item.
+ */
+export declare function worklistTimeoutMs(limit: number): number;
 export declare const CODEX_PERMISSION_PROFILE = "hq_signals_extract";
 export declare const CANDIDATE_WRAPPER_NAME = "write-candidate.sh";
 /** The only tools a claude turn may use: Read inside the channel folder and the pinned wrapper. */

package/dist/lib/signals/steps/extract.js

@@ -73,6 +73,15 @@ const ENTITY_TYPES = ["person", "project", "company", "concept"];
 export const DEFAULT_WORKLIST_LIMIT = 20;
 export const DEFAULT_TURN_TIMEOUT_MS = 10 * 60_000;
 const SCRIPT_TIMEOUT_MS = 60_000;
+export const WORKLIST_ITEM_TIMEOUT_MS = 10_000;
+/**
+ * The listing call may look up one ACL per item over the network (an item
+ * with no audience in its frontmatter), so its budget grows with the cap: the
+ * fixed script budget plus WORKLIST_ITEM_TIMEOUT_MS per item.
+ */
+export function worklistTimeoutMs(limit) {
+    return SCRIPT_TIMEOUT_MS + Math.max(0, limit) * WORKLIST_ITEM_TIMEOUT_MS;
+}
 export const CODEX_PERMISSION_PROFILE = "hq_signals_extract";
 export const CANDIDATE_WRAPPER_NAME = "write-candidate.sh";
 /** The only tools a claude turn may use: Read inside the channel folder and the pinned wrapper. */
@@ -678,7 +687,7 @@ export function createExtractStep(options = {}) {
                         continue;
                     }
                 }
-                const wl = ctx.spawn("bash", [worklist, ...base, "--limit", String(limit)], { cwd: ctx.hqRoot, env, timeoutMs: SCRIPT_TIMEOUT_MS });
+                const wl = ctx.spawn("bash", [worklist, ...base, "--limit", String(limit)], { cwd: ctx.hqRoot, env, timeoutMs: worklistTimeoutMs(limit) });
                 if (wl.error || wl.status !== 0) {
                     failures.push({ file: `sources/${ch.channel}`, error: `worklist failed: ${(wl.error?.message ?? wl.stderr.trim()).slice(0, 200) || `exit ${String(wl.status)}`}` });
                     continue;
@@ -758,7 +767,7 @@ export function createExtractStep(options = {}) {
                     itemsOut += v.kept;
                     const md = ctx.spawn("bash", [worklist, ...base, "--mark-done", item.file], { cwd: ctx.hqRoot, env, timeoutMs: SCRIPT_TIMEOUT_MS });
                     if (md.error || md.status !== 0) {
-                        failures.push({ file: item.file, error: `mark-done failed: ${md.stderr.trim().slice(0, 200)}` });
+                        failures.push({ file: item.file, error: `mark-done failed: ${(md.error?.message ?? md.stderr.trim()).slice(0, 200) || `exit ${String(md.status)}`}` });
                         continue;
                     }
                     processedAny = true;

package/dist/secrets-env-action.d.ts

@@ -74,6 +74,76 @@ export declare function requestedApiKeyCompany(flagCompany: string | undefined):
  * Returns the verified uid; throws before any secret is fetched otherwise.
  */
 export declare function assertApiKeyCompany(token: string, requested: string, commandLabel: string): Promise<string>;
+/** The out_* uid and bound company a company Outpost token carries. */
+export interface CompanyOutpostIdentity {
+    outpostUid: string;
+    companyUid: string;
+}
+/**
+ * The company Outpost identity named by the token this command will send, or
+ * null for any other token (person, agent, owner-delegated outpost, API key).
+ *
+ * hq-cloud says whether this process is a machine identity but exposes no
+ * accessor for the bound company, and hq-pro routes on the claims of the
+ * token it receives, so the route choice reads them from that token. The
+ * claims are not verified here; hq-pro verifies the token and re-checks the
+ * live Outpost binding on every request. A token with any company Outpost
+ * marker but no usable company or out_* uid fails closed rather than falling
+ * through to the person routes.
+ */
+export declare function companyOutpostIdentityFromToken(token: string): CompanyOutpostIdentity | null;
+/**
+ * True when this process will authenticate as a company Outpost: hq-cli picks
+ * machine tokens and hq-cloud's machine identity (a delegated session file or
+ * a credentials file) is a company Outpost. Local state only, no network.
+ * Used before a credential is resolved, where there is no token to read yet.
+ */
+export declare function callerIsCompanyOutpost(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The company uid a company Outpost reads secrets from. The token names its
+ * bound company, so an omitted `--company` uses it with no lookup. An explicit
+ * `--company` must name that same company: a uid is compared locally, and a
+ * slug is checked with GET /entity/check-slug/me, the one slug lookup hq-pro
+ * answers for a company Outpost (it reports a conflict only for the bound
+ * company). Any other company, and `--personal`, is refused.
+ */
+export declare function resolveCompanyOutpostSecretsCompany(token: string, outpost: CompanyOutpostIdentity, scope: {
+    personal?: boolean;
+    companySlug?: string;
+}): Promise<string>;
+/**
+ * The company uid a `secrets exec` / `env` / `get` call reads from. A company
+ * Outpost token takes its company from the token (see
+ * {@link resolveCompanyOutpostSecretsCompany}); every other Cognito token keeps
+ * the existing {@link getEntityUid} resolution unchanged.
+ */
+export declare function resolveSecretsReadCompanyUid(token: string, scope: {
+    personal?: boolean;
+    companySlug?: string;
+}, options?: {
+    allowOfflineScopeFallback?: boolean;
+}): Promise<string>;
+/**
+ * The message for a 403 a company Outpost gets on the single-secret GET, or
+ * null when the status/body is not one of these denials.
+ *
+ * - No code: hq-pro answers a plain "read permission required" both when the
+ *   secret is not shared with this Outpost and when the Outpost's live binding
+ *   to its company is not active, and the response does not say which.
+ * - `reveal_disabled` / `env_disabled`: the secret is script-locked. The
+ *   Outpost route evaluates the read with no script attestation, so a
+ *   script-locked secret can never be read by an Outpost job.
+ */
+export declare function companyOutpostReadDenialMessage(name: string, status: number, body: Record<string, unknown>, companyUid: string, outpost: CompanyOutpostIdentity): string | null;
+/**
+ * Fail closed when HQ_MACHINE_SESSION_FILE is set but hq-cloud cannot use the
+ * file. The parent that set it chose that identity for this process, so an
+ * unreadable or malformed file must stop the read with a message naming the
+ * file, never fall through to another identity or a generic scope error.
+ * An expired but well-formed session passes here; the token request reports
+ * the expiry.
+ */
+export declare function assertDelegatedMachineSessionUsable(): void;
 export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
     allowOfflineFallback?: boolean;
     /** Filled with each returned row's scriptLock.mode (undefined when absent). */

package/dist/secrets-env-action.js

@@ -2,11 +2,14 @@ import chalk from "chalk";
 import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
 import { cognitoCachePrincipalUid } from "./utils/cognito-session.js";
-import { isAuthError } from "./utils/auth-error.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntry, writeCache, } from "./utils/secrets-cache.js";
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
 import { finishEnvExportsAndExit } from "./commands/secrets-env-exit.js";
+import { DELEGATED_MACHINE_SESSION_ENV, delegatedMachineSessionFilePath, loadDelegatedMachineSession, loadMachineCreds, } from "@indigoai-us/hq-cloud";
+import { AuthError, isAuthError } from "./utils/auth-error.js";
+import { peekIdToken } from "./utils/id-token.js";
+import { wantsMachineCognitoTokens } from "./utils/machine-principal-state.js";
 import { getEntityUid, looksLikeCompanyUid, vaultApiFetch } from "./utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, resolveVaultCredentialForCapability, } from "./utils/resolve-vault-credential.js";
 import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "./utils/secret-load-availability.js";
@@ -221,10 +224,224 @@ export async function assertApiKeyCompany(token, requested, commandLabel) {
     throw new Error(`Could not verify that HQ_API_KEY belongs to ${requested} (HTTP ${response.status}` +
         `${message ? `: ${message}` : ""}).`);
 }
+const COMPANY_OUTPOST_UID_PATTERN = /^out_[0-9A-HJKMNP-TV-Z]{26}$/;
+const COMPANY_UID_PATTERN = /^cmp_[A-Za-z0-9]+$/;
+/**
+ * The company Outpost identity named by the token this command will send, or
+ * null for any other token (person, agent, owner-delegated outpost, API key).
+ *
+ * hq-cloud says whether this process is a machine identity but exposes no
+ * accessor for the bound company, and hq-pro routes on the claims of the
+ * token it receives, so the route choice reads them from that token. The
+ * claims are not verified here; hq-pro verifies the token and re-checks the
+ * live Outpost binding on every request. A token with any company Outpost
+ * marker but no usable company or out_* uid fails closed rather than falling
+ * through to the person routes.
+ */
+export function companyOutpostIdentityFromToken(token) {
+    if (token.startsWith(HQ_API_KEY_PREFIX))
+        return null;
+    const claims = peekIdToken(token);
+    const has = (key) => Object.prototype.hasOwnProperty.call(claims, key);
+    if (claims["custom:entityType"] !== "company-outpost" &&
+        !has("custom:ownerCompanyUid") &&
+        !has("custom:companyOutpostId")) {
+        return null;
+    }
+    const outpostUid = claims["custom:entityUid"];
+    const companyUid = claims["custom:ownerCompanyUid"];
+    if (claims["custom:entityType"] !== "company-outpost" ||
+        typeof outpostUid !== "string" ||
+        !COMPANY_OUTPOST_UID_PATTERN.test(outpostUid) ||
+        typeof companyUid !== "string" ||
+        !COMPANY_UID_PATTERN.test(companyUid)) {
+        throw new Error("This HQ session carries company Outpost markers but does not name its Outpost (out_…) " +
+            "and company (cmp_…). Refusing to read secrets with it.");
+    }
+    return { outpostUid, companyUid };
+}
+/**
+ * True when this process will authenticate as a company Outpost: hq-cli picks
+ * machine tokens and hq-cloud's machine identity (a delegated session file or
+ * a credentials file) is a company Outpost. Local state only, no network.
+ * Used before a credential is resolved, where there is no token to read yet.
+ */
+export function callerIsCompanyOutpost(env = process.env) {
+    try {
+        return wantsMachineCognitoTokens({}, env) && loadMachineCreds()?.entityType === "company-outpost";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The company uid a company Outpost reads secrets from. The token names its
+ * bound company, so an omitted `--company` uses it with no lookup. An explicit
+ * `--company` must name that same company: a uid is compared locally, and a
+ * slug is checked with GET /entity/check-slug/me, the one slug lookup hq-pro
+ * answers for a company Outpost (it reports a conflict only for the bound
+ * company). Any other company, and `--personal`, is refused.
+ */
+export async function resolveCompanyOutpostSecretsCompany(token, outpost, scope) {
+    if (scope.personal) {
+        throw new Error("A company Outpost session has no personal vault. Drop --personal; it reads its company's secrets.");
+    }
+    const ref = scope.companySlug?.trim();
+    if (!ref || ref === outpost.companyUid)
+        return outpost.companyUid;
+    const notBound = () => new Error(`Company '${ref}' is not the company this Outpost (${outpost.outpostUid}) is bound to ` +
+        `(${outpost.companyUid}). A company Outpost can read only its own company's secrets.`);
+    if (looksLikeCompanyUid(ref) || /^(prs|agt|out)_/.test(ref))
+        throw notBound();
+    const res = await vaultApiFetch({
+        token,
+        path: "/entity/check-slug/me",
+        query: { type: "company", slug: ref },
+        signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        if (res.status === 401)
+            throw companyOutpostSessionRejected();
+        const message = `Failed to resolve company '${ref}' for this Outpost: ${extractApiMessage(body, `HTTP ${res.status}`)}`;
+        if (isUnavailableSecretLoadHttpStatus(res.status))
+            throw new SecretLoadUnavailableError(message);
+        throw new Error(message);
+    }
+    if (body.available === false && body.conflictingCompanyUid === outpost.companyUid) {
+        return outpost.companyUid;
+    }
+    throw notBound();
+}
+function companyOutpostSessionRejected() {
+    return new AuthError("HQ rejected this company Outpost session (HTTP 401). The job runner refreshes " +
+        "HQ_MACHINE_SESSION_FILE; re-run the job, and if it persists check the Outpost's binding.");
+}
+/**
+ * The company uid a `secrets exec` / `env` / `get` call reads from. A company
+ * Outpost token takes its company from the token (see
+ * {@link resolveCompanyOutpostSecretsCompany}); every other Cognito token keeps
+ * the existing {@link getEntityUid} resolution unchanged.
+ */
+export async function resolveSecretsReadCompanyUid(token, scope, options = {}) {
+    const outpost = companyOutpostIdentityFromToken(token);
+    if (outpost)
+        return resolveCompanyOutpostSecretsCompany(token, outpost, scope);
+    return getEntityUid(token, scope, options);
+}
+/**
+ * The message for a 403 a company Outpost gets on the single-secret GET, or
+ * null when the status/body is not one of these denials.
+ *
+ * - No code: hq-pro answers a plain "read permission required" both when the
+ *   secret is not shared with this Outpost and when the Outpost's live binding
+ *   to its company is not active, and the response does not say which.
+ * - `reveal_disabled` / `env_disabled`: the secret is script-locked. The
+ *   Outpost route evaluates the read with no script attestation, so a
+ *   script-locked secret can never be read by an Outpost job.
+ */
+export function companyOutpostReadDenialMessage(name, status, body, companyUid, outpost) {
+    if (status !== 403)
+        return null;
+    if (body.code === undefined) {
+        return (`Failed to fetch secret '${name}': ${extractApiMessage(body, "No read permission")}. ` +
+            `Either the secret is not shared with this Outpost (${outpost.outpostUid}), or the Outpost's ` +
+            `binding to ${companyUid} is not active. To share it: ` +
+            `hq secrets --company ${companyUid} share ${name} --with ${outpost.outpostUid}`);
+    }
+    if (body.code === "reveal_disabled" || body.code === "env_disabled") {
+        return (`Failed to fetch secret '${name}': it is script-locked, and company Outpost jobs cannot ` +
+            `read script-locked secrets (the Outpost secret route carries no script attestation).`);
+    }
+    return null;
+}
+/**
+ * Fail closed when HQ_MACHINE_SESSION_FILE is set but hq-cloud cannot use the
+ * file. The parent that set it chose that identity for this process, so an
+ * unreadable or malformed file must stop the read with a message naming the
+ * file, never fall through to another identity or a generic scope error.
+ * An expired but well-formed session passes here; the token request reports
+ * the expiry.
+ */
+export function assertDelegatedMachineSessionUsable() {
+    const file = delegatedMachineSessionFilePath();
+    if (file === null)
+        return;
+    if (loadDelegatedMachineSession() !== null)
+        return;
+    throw new Error(`${DELEGATED_MACHINE_SESSION_ENV} names ${file}, but that file is not a usable delegated machine ` +
+        `session (missing, unreadable, malformed, or its tokens do not describe the identity it claims). ` +
+        `Refusing to read secrets; the job runner must rewrite the session file.`);
+}
+function encodeSecretNamePath(name) {
+    // Encode each segment so structural `/` separators stay route separators
+    // for GET /secrets/{companyUid}/name/{proxy+} (same as `hq secrets get`).
+    return name.split("/").map(encodeURIComponent).join("/");
+}
+/**
+ * Read each key with GET /secrets/{companyUid}/name/{name}?reveal=true, the
+ * only secrets route hq-pro serves to a company Outpost. Throws on the first
+ * key that does not resolve, with the same `Failed to fetch secret '<k>':
+ * <reason>` shape as the batch path. Values are never written to the local
+ * secrets cache and there is no offline fallback: the Outpost reads only what
+ * the server authorizes on each run.
+ *
+ * The route evaluates the read as a plain reveal with no script usage, so a
+ * script-locked or high-security secret is refused by the server; the denial
+ * is surfaced as is (high-security gets the sandbox guidance).
+ */
+async function loadRevealedSecretsForCompanyOutpost(token, outpost, companyUid, keys, lockModes) {
+    if (companyUid !== outpost.companyUid) {
+        throw new Error(`This company Outpost (${outpost.outpostUid}) is bound to ${outpost.companyUid} ` +
+            `and cannot read secrets from ${companyUid}.`);
+    }
+    const resolved = new Map();
+    for (const name of [...new Set(keys)]) {
+        const res = await vaultApiFetch({
+            token,
+            path: `/secrets/${encodeURIComponent(companyUid)}/name/${encodeSecretNamePath(name)}`,
+            query: { reveal: "true" },
+            signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            if (body.highSecurity === true ||
+                body.code === "high_security_denied" ||
+                body.code === "high_security_sandbox_only") {
+                throw new Error(highSecuritySandboxOnlyMessage(name));
+            }
+            if (res.status === 401)
+                throw companyOutpostSessionRejected();
+            if (res.status === 404) {
+                throw new Error(`Failed to fetch secret '${name}': Secret not found`);
+            }
+            const message = extractApiMessage(body, res.statusText || `HTTP ${res.status}`);
+            if (isUnavailableSecretLoadHttpStatus(res.status)) {
+                throw new SecretLoadUnavailableError(`Failed to fetch secret '${name}': ${message}`);
+            }
+            throw new Error(companyOutpostReadDenialMessage(name, res.status, body, companyUid, outpost) ??
+                `Failed to fetch secret '${name}': ${message}`);
+        }
+        const secret = typeof body.secret === "object" && body.secret !== null
+            ? body.secret
+            : null;
+        if (!secret || secret.name !== name || typeof secret.value !== "string") {
+            throw new Error(`Failed to fetch secret '${name}': malformed fetch response`);
+        }
+        const mode = secret.scriptLock?.mode;
+        lockModes?.set(name, typeof mode === "string" ? mode : undefined);
+        resolved.set(name, secret.value);
+    }
+    return resolved;
+}
 export async function loadRevealedSecrets(token, companyUid, keys, usage, options = {}) {
     if (token.startsWith(HQ_API_KEY_PREFIX)) {
         return loadRevealedSecretsViaApiKey(token, keys, companyUid, options.lockModes);
     }
+    const outpost = companyOutpostIdentityFromToken(token);
+    if (outpost) {
+        return loadRevealedSecretsForCompanyOutpost(token, outpost, companyUid, keys, options.lockModes);
+    }
     const resolved = new Map();
     const requested = [...new Set(keys)];
     const principalUid = cognitoCachePrincipalUid(token);
@@ -469,6 +686,7 @@ export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
             console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
         }
         const keys = parseSecretNameList(opts.only);
+        assertDelegatedMachineSessionUsable();
         const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
         const apiKeyCompanyRef = cred.kind === "api-key"
             ? requestedApiKeyCompany(parentScope.company)
@@ -477,7 +695,7 @@ export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
             ? (apiKeyCompanyRef
                 ? await assertApiKeyCompany(cred.token, apiKeyCompanyRef, "secrets env")
                 : "__api_key__")
-            : await getEntityUid(cred.token, scopeOpts(parentScope), {
+            : await resolveSecretsReadCompanyUid(cred.token, scopeOpts(parentScope), {
                 allowOfflineScopeFallback: true,
             });
         const usage = cred.kind === "cognito"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.196",
+  "version": "5.345.198",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -27,6 +27,8 @@
   ],
   "scripts": {
     "build": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs && node scripts/bundle-sync-runner.mjs",
+    "release:preflight": "node scripts/check-fleet-local-pin-published.mjs",
+    "release:tag": "node scripts/check-fleet-local-pin-published.mjs --release-tag",
     "prepublishOnly": "npm run build",
     "pretypecheck": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.typetest.json",
@@ -114,11 +116,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.196",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.196",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.196",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.196",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.196",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.196"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.198",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.198",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.198",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.198",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.198",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.198"
   }
 }