@indigoai-us/hq-cli 5.345.82 → 5.345.84

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [5.345.84] — 2026-10-11
+- `hq secrets exec` and `hq secrets env` with `HQ_API_KEY` now refuse a
+  `--company` (or `HQ_COMPANY_UID`) that the key was not minted for. They
+  exit 1 with "HQ_API_KEY belongs to a different company than <uid>". They
+  used to ignore the flag and inject the key company's same-named secret.
+  A company slug under an API key is also refused, with a request for the
+  `cmp_` uid. Without `--company`, the key's own company is used as before.
+
+## [5.345.83] — 2026-10-11
+- HQ-root scaffolds now package the shared runtime used by generated shell forwarders.
+- Lanes hook installation now replaces stale hq-cli drain registrations across
+  Claude settings and Codex config, including entries whose old install path no
+  longer exists. Other hooks are preserved, duplicate drains are removed, and a
+  repeat install leaves the registration file byte-identical.
+
 ## [5.345.82] — 2026-10-11
 - Session-start health no longer treats an ordinary HQ Core upgrade warning
   as an unrepaired doctor finding. `hq doctor` still shows the upgrade;

package/assets/scaffold/core/scripts/lib/forwarder.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# Shared runtime for generated hq CLI forwarders.
+
+forwarder_exec() {
+  local script_name="$1" min_cli="$2" root_mode="$3" command="$4" stdin_closed="$5"
+  shift 5
+  local forwarder_library_dir="${BASH_SOURCE[0]%/*}"
+  local path_rule index value path_option path_value
+  local -a forwarded_args path_rules path_options path_values converted_values command_parts
+  forwarded_args=("$@")
+  local forwarded_arg_count=$#
+
+  if [ "$root_mode" = live-project ]; then
+    HQ_ROOT="${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-$(cd "$SCRIPT_DIR/../.." && pwd)}}"
+  elif [ "$root_mode" = live ]; then
+    HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+  fi
+
+  if ! command -v hq >/dev/null 2>&1; then
+    printf "%s: requires the hq CLI — this script's implementation now ships with it.\n" "$script_name" >&2
+    printf 'Install it with: npm install -g @indigoai-us/hq-cli\n' >&2
+    exit 127
+  fi
+
+  [ "$forwarder_library_dir" != "${BASH_SOURCE[0]}" ] || forwarder_library_dir=.
+  if [ -f "$forwarder_library_dir/hq-cli-floor.sh" ]; then
+    # shellcheck source=lib/hq-cli-floor.sh
+    . "$forwarder_library_dir/hq-cli-floor.sh"
+    hq_cli_floor_check "$script_name" "$min_cli"
+  fi
+
+  if [ "$stdin_closed" = true ]; then
+    if ! { true 3<&0; } 2>/dev/null; then
+      export HQ_CORE_STDIN_CLOSED=1
+    fi
+  fi
+
+  if [ "$root_mode" = live ] || [ "$root_mode" = live-project ]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      HQ_ROOT="$(cygpath -m "$HQ_ROOT")"
+    fi
+  fi
+
+  if command -v cygpath >/dev/null 2>&1; then
+    IFS=';' read -r -a path_rules <<< "$PATH_OPERANDS"
+    for path_rule in "${path_rules[@]}"; do
+      case "$path_rule" in
+        none) ;;
+        position:*)
+          index="${path_rule#position:}"
+          if (( index < forwarded_arg_count )); then convert_forwarded_path "$index"; fi
+          ;;
+        first-nonoption)
+          for ((index = 0; index < forwarded_arg_count; index++)); do
+            case "${forwarded_args[index]}" in --*) ;; *) convert_forwarded_path "$index"; break ;; esac
+          done
+          ;;
+        all-nonoptions)
+          for ((index = 0; index < forwarded_arg_count; index++)); do
+            case "${forwarded_args[index]}" in --*) ;; *) convert_forwarded_path "$index" ;; esac
+          done
+          ;;
+        options:*)
+          IFS=, read -r -a path_options <<< "${path_rule#options:}"
+          for ((index = 0; index < forwarded_arg_count; index++)); do
+            for path_option in "${path_options[@]}"; do
+              case "${forwarded_args[index]}" in
+                "$path_option")
+                  index=$((index + 1))
+                  if (( index < forwarded_arg_count )); then convert_forwarded_path "$index"; fi
+                  break
+                  ;;
+                "$path_option"=*)
+                  value="${forwarded_args[index]#*=}"
+                  case "$value" in /*) forwarded_args[index]="${path_option}=$(cygpath -m "$value")" ;; esac
+                  break
+                  ;;
+              esac
+            done
+          done
+          ;;
+        comma:*)
+          path_option="${path_rule#comma:}"
+          for ((index = 0; index < forwarded_arg_count; index++)); do
+            case "${forwarded_args[index]}" in
+              "$path_option")
+                index=$((index + 1))
+                if (( index < forwarded_arg_count )); then
+                  IFS=, read -r -a path_values <<< "${forwarded_args[index]}"
+                  converted_values=()
+                  for path_value in "${path_values[@]}"; do
+                    case "$path_value" in /*) converted_values+=("$(cygpath -m "$path_value")") ;; *) converted_values+=("$path_value") ;; esac
+                  done
+                  value="$(IFS=,; printf '%s' "${converted_values[*]}")"
+                  forwarded_args[index]="$value"
+                fi
+                break
+                ;;
+              "$path_option"=*)
+                value="${forwarded_args[index]#*=}"
+                case "$value" in
+                  /*,*|/*)
+                    IFS=, read -r -a path_values <<< "$value"
+                    converted_values=()
+                    for path_value in "${path_values[@]}"; do
+                      case "$path_value" in /*) converted_values+=("$(cygpath -m "$path_value")") ;; *) converted_values+=("$path_value") ;; esac
+                    done
+                    value="$(IFS=,; printf '%s' "${converted_values[*]}")"
+                    forwarded_args[index]="${path_option}=$value"
+                    ;;
+                esac
+                break
+                ;;
+            esac
+          done
+          ;;
+        *) printf 'unknown path_operands rule: %s\n' "$path_rule" >&2; exit 70 ;;
+      esac
+    done
+  fi
+
+  IFS=' ' read -r -a command_parts <<< "$command"
+  if [ "$root_mode" = live ] || [ "$root_mode" = live-project ]; then
+    if [ "$forwarded_arg_count" -gt 0 ]; then
+      MSYS2_ARG_CONV_EXCL='*' exec hq core --hq-root "$HQ_ROOT" "${command_parts[@]}" "${forwarded_args[@]}"
+    else
+      MSYS2_ARG_CONV_EXCL='*' exec hq core --hq-root "$HQ_ROOT" "${command_parts[@]}"
+    fi
+  elif [ "$forwarded_arg_count" -gt 0 ]; then
+    MSYS2_ARG_CONV_EXCL='*' exec hq core "${command_parts[@]}" "${forwarded_args[@]}"
+  else
+    MSYS2_ARG_CONV_EXCL='*' exec hq core "${command_parts[@]}"
+  fi
+}
+
+convert_forwarded_path() {
+  local arg_index="$1"
+  local value="${forwarded_args[$arg_index]}"
+  case "$value" in
+    /*) forwarded_args[$arg_index]="$(cygpath -m "$value")" ;;
+  esac
+}

package/dist/commands/core.js

@@ -268,6 +268,7 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/lib/session-scope-capability.sh", root: "live", summary: "Session scope-capability lib sourced by hq-session" },
     { asset: "core/scripts/lib/session-id.sh", root: "live", summary: "Session-id resolver lib sourced by hq-session" },
     { asset: "core/scripts/lib/hq-cli-floor.sh", root: "live", summary: "Shared CLI version-floor helper sourced by generated forwarders" },
+    { asset: "core/scripts/lib/forwarder.sh", root: "live", summary: "Shared runtime sourced by generated scaffold forwarders" },
     { asset: "core/scripts/lib/work-mesh-enqueue.sh", root: "live", summary: "Work Mesh Live spool enqueue lib sourced by hooks" },
     { asset: "core/scripts/lib/work-mesh-live-hook.sh", root: "live", summary: "Work Mesh Live hook helpers sourced by rebind" },
     { asset: "core/scripts/lib/work-mesh-live-rebind.sh", root: "live", summary: "Work Mesh Live session rebind library sourced by hooks and the native rollback command" },

package/dist/commands/secrets.js

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
-import { buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
+import { assertApiKeyCompany, buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
 export function readSessionCompanyLock(env = process.env) {
     const root = resolveDefaultHqRoot({ env });
@@ -1284,8 +1284,17 @@ export function registerSecretsCommand(program) {
                     ...(requestedCompany ? { requestedCompany } : {}),
                 })
                 : undefined;
+            // Without a session lock, an explicit --company / HQ_COMPANY_UID must
+            // still match the key's company: it used to be ignored, and the key's
+            // own same-named secret was injected instead.
+            const unlockedApiKeyCompanyRef = cred.kind === "api-key" && !hasLockedCompanies
+                ? requestedApiKeyCompany(requestedCompany)
+                : undefined;
             const companyUid = cred.kind === "api-key"
-                ? (apiKeyCompany?.companyUid ?? "__api_key__")
+                ? (apiKeyCompany?.companyUid
+                    ?? (unlockedApiKeyCompanyRef
+                        ? await assertApiKeyCompany(cred.token, unlockedApiKeyCompanyRef, "secrets exec")
+                        : "__api_key__"))
                 : await getEntityUid(cred.token, secretScope, { allowOfflineScopeFallback: true });
             const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)

package/dist/lib/lanes/hooks-install.js

@@ -149,9 +149,18 @@ function isInstalledDrainEntry(entryPath) {
  * Both paths target the same hq-cli drain entry, so recognize an installed
  * package entry alongside the exact entry belonging to this CLI invocation.
  */
-function drainCommandsMatch(candidate, expected) {
-    if (candidate === expected)
-        return true;
+function drainCommandsMatch(candidate, expected, requireInstalledPaths = false) {
+    if (candidate === expected) {
+        if (!requireInstalledPaths)
+            return true;
+        const withoutProviderEnv = candidate.startsWith("HQ_LANE_PROVIDER=grok ")
+            ? candidate.slice("HQ_LANE_PROVIDER=grok ".length)
+            : candidate;
+        const currentArgv = parseShellQuotedArguments(withoutProviderEnv);
+        return currentArgv !== null && currentArgv.length === 2 &&
+            path.parse(currentArgv[0]).name.toLowerCase() === "node" &&
+            fs.existsSync(currentArgv[0]) && fs.existsSync(currentArgv[1]);
+    }
     const withoutProviderEnv = candidate.startsWith("HQ_LANE_PROVIDER=grok ")
         ? candidate.slice("HQ_LANE_PROVIDER=grok ".length)
         : candidate;
@@ -162,9 +171,9 @@ function drainCommandsMatch(candidate, expected) {
         return false;
     if (!isInstalledDrainEntry(argv[1]))
         return false;
-    return fs.existsSync(argv[0]) && fs.existsSync(argv[1]);
+    return !requireInstalledPaths || (fs.existsSync(argv[0]) && fs.existsSync(argv[1]));
 }
-function groupsContainDrainCommand(groups, expected) {
+function groupsContainDrainCommand(groups, expected, requireInstalledPaths = false) {
     if (!Array.isArray(groups))
         return false;
     return groups.some((group) => {
@@ -173,29 +182,51 @@ function groupsContainDrainCommand(groups, expected) {
         return group.hooks.some((hook) => isPlainObject(hook) &&
             hook.type === "command" &&
             typeof hook.command === "string" &&
-            drainCommandsMatch(hook.command, expected));
+            drainCommandsMatch(hook.command, expected, requireInstalledPaths));
     });
 }
-function tomlHasDrainCommand(parsed, expected) {
+function tomlHasDrainCommand(parsed, expected, requireInstalledPaths = false) {
     const hooks = isPlainObject(parsed.hooks) ? parsed.hooks : null;
     return hooks !== null &&
-        ["PreToolUse", "PostToolUse", "Stop"].every((event) => groupsContainDrainCommand(hooks[event], expected));
+        ["PreToolUse", "PostToolUse", "Stop"].every((event) => groupsContainDrainCommand(hooks[event], expected, requireInstalledPaths));
 }
-function removeCommandFromGroups(groups, command) {
+function removeDrainCommandsFromGroups(groups, expected, legacyCommand) {
     let changed = false;
+    let keptCurrent = false;
     const next = groups.flatMap((group) => {
         if (!isPlainObject(group) || !Array.isArray(group.hooks))
             return [group];
-        const hooks = group.hooks.filter((hook) => !(isPlainObject(hook) &&
-            hook.type === "command" &&
-            hook.command === command));
+        const hooks = group.hooks.filter((hook) => {
+            if (!isPlainObject(hook) || hook.type !== "command" || typeof hook.command !== "string")
+                return true;
+            const isCurrent = hook.command === expected;
+            const isDrain = isCurrent || drainCommandsMatch(hook.command, expected) || hook.command === legacyCommand;
+            if (isCurrent && !keptCurrent) {
+                keptCurrent = true;
+                return true;
+            }
+            if (isDrain)
+                changed = true;
+            return !isDrain;
+        });
         if (hooks.length === group.hooks.length)
             return [group];
-        changed = true;
         return hooks.length === 0 ? [] : [{ ...group, hooks }];
     });
     return { groups: next, changed };
 }
+function groupHasExactlyOneCommand(groups, command) {
+    let count = 0;
+    for (const group of groups) {
+        if (!isPlainObject(group) || !Array.isArray(group.hooks))
+            continue;
+        for (const hook of group.hooks) {
+            if (isPlainObject(hook) && hook.type === "command" && hook.command === command)
+                count += 1;
+        }
+    }
+    return count === 1;
+}
 export function renderDrainHookJson(shPath, provider = "grok") {
     const command = drainHookCommand(shPath, provider);
     const registration = {
@@ -237,21 +268,18 @@ export function mergeClaudeSettingsHook(existingText, command, settingsPath, leg
         }
         eventGroups.set(event, groups);
     }
-    const pre = eventGroups.get("PreToolUse");
-    if (!Array.isArray(pre)) {
-        throw new LanesError("settings_unparseable", `${settingsPath} has a non-array "hooks.PreToolUse"; refusing to rewrite it`, { path: settingsPath });
-    }
-    const migration = legacyCommand && legacyCommand !== command
-        ? removeCommandFromGroups(pre, legacyCommand)
-        : { groups: pre, changed: false };
-    const allRegistered = events.every((event) => groupsContainCommand(eventGroups.get(event), command));
-    if (allRegistered && !migration.changed) {
+    const cleanups = new Map(events.map((event) => [
+        event,
+        removeDrainCommandsFromGroups(eventGroups.get(event), command, legacyCommand),
+    ]));
+    if (events.every((event) => groupHasExactlyOneCommand(cleanups.get(event).groups, command) &&
+        !cleanups.get(event).changed)) {
         return { text: existingText ?? "", changed: false };
     }
     const nextHooks = { ...hooks };
     for (const event of events) {
-        const groups = event === "PreToolUse" ? migration.groups : eventGroups.get(event);
-        nextHooks[event] = groupsContainCommand(groups, command) ? groups : [
+        const groups = cleanups.get(event).groups;
+        nextHooks[event] = groupHasExactlyOneCommand(groups, command) ? groups : [
             ...groups,
             { hooks: [{ type: "command", command, timeout: DRAIN_HOOK_TIMEOUT_SECONDS }] },
         ];
@@ -405,6 +433,145 @@ function parseTomlOrThrow(text, configPath, stage) {
     }
     return parsed;
 }
+function renderTomlInline(value) {
+    if (typeof value === "string")
+        return tomlBasicString(value);
+    if (typeof value === "boolean" || typeof value === "number")
+        return String(value);
+    if (Array.isArray(value))
+        return `[${value.map(renderTomlInline).join(", ")}]`;
+    if (isPlainObject(value)) {
+        const fields = Object.entries(value).map(([key, entry]) => `${JSON.stringify(key)} = ${renderTomlInline(entry)}`);
+        return `{ ${fields.join(", ")} }`;
+    }
+    throw new LanesError("config_toml_migration_failed", "Could not safely render an inline Codex hook while removing stale lane drains");
+}
+function isDrainHookValue(hook, expected, legacyCommand) {
+    return isPlainObject(hook) && hook.type === "command" && typeof hook.command === "string" &&
+        (drainCommandsMatch(hook.command, expected) || hook.command === legacyCommand);
+}
+function removeStaleCodexDrainHooks(text, parsed, expected, legacyCommand, configPath) {
+    const hooks = isPlainObject(parsed.hooks) ? parsed.hooks : {};
+    const lines = text.split("\n");
+    const spans = [];
+    let changed = false;
+    for (const event of ["PreToolUse", "PostToolUse", "Stop"]) {
+        const groups = Array.isArray(hooks[event]) ? hooks[event] : [];
+        const parentIndexes = lines.flatMap((line, index) => {
+            const header = tomlHeader(line);
+            return header?.array && header.path === `hooks.${event}` ? [index] : [];
+        });
+        if (parentIndexes.length !== groups.length) {
+            throw new LanesError("config_toml_migration_failed", `Could not safely map ${event} drain hooks in ${configPath}; refusing to add a second drain`, { path: configPath, event, groups: groups.length, headers: parentIndexes.length });
+        }
+        let keptCurrent = false;
+        for (let groupIndex = 0; groupIndex < parentIndexes.length; groupIndex += 1) {
+            const start = parentIndexes[groupIndex];
+            let end = start + 1;
+            for (; end < lines.length; end += 1) {
+                const header = tomlHeader(lines[end]);
+                if (!header)
+                    continue;
+                if (header.array && header.path === `hooks.${event}`)
+                    break;
+                if (header.path.startsWith(`hooks.${event}.`))
+                    continue;
+                break;
+            }
+            const hookHeaders = lines.flatMap((line, index) => {
+                if (index <= start || index >= end)
+                    return [];
+                const header = tomlHeader(line);
+                return header?.array && header.path === `hooks.${event}.hooks` ? [index] : [];
+            });
+            const group = groups[groupIndex];
+            const groupHooks = isPlainObject(group) && Array.isArray(group.hooks) ? group.hooks : [];
+            if (hookHeaders.length !== groupHooks.length) {
+                const keptInlineHooks = [];
+                let inlineNeedsEdit = false;
+                for (const hook of groupHooks) {
+                    const command = isPlainObject(hook) && hook.type === "command" && typeof hook.command === "string"
+                        ? hook.command
+                        : undefined;
+                    if (!command) {
+                        keptInlineHooks.push(hook);
+                        continue;
+                    }
+                    const current = command === expected;
+                    const drain = isDrainHookValue(hook, expected, legacyCommand);
+                    if (!drain || (current && !keptCurrent)) {
+                        if (current)
+                            keptCurrent = true;
+                        keptInlineHooks.push(hook);
+                    }
+                    else {
+                        inlineNeedsEdit = true;
+                    }
+                }
+                if (!inlineNeedsEdit)
+                    continue;
+                if (hookHeaders.length === 0) {
+                    const hooksLine = lines.findIndex((line, index) => index > start && index < end && /^\s*hooks\s*=/.test(line));
+                    if (hooksLine === -1) {
+                        throw new LanesError("config_toml_migration_failed", `Could not safely find inline ${event} hooks in ${configPath}; refusing to add a second drain`, { path: configPath, event, groupIndex });
+                    }
+                    changed = true;
+                    if (keptInlineHooks.length === 0) {
+                        spans.push({ start, end });
+                    }
+                    else {
+                        const indent = /^\s*/.exec(lines[hooksLine])?.[0] ?? "";
+                        lines[hooksLine] = `${indent}hooks = ${renderTomlInline(keptInlineHooks)}`;
+                    }
+                    continue;
+                }
+                throw new LanesError("config_toml_migration_failed", `Could not safely map ${event} hook entries in ${configPath}; refusing to add a second drain`, { path: configPath, event, groupIndex, hooks: groupHooks.length, headers: hookHeaders.length });
+            }
+            const removeHooks = [];
+            for (let hookIndex = 0; hookIndex < hookHeaders.length; hookIndex += 1) {
+                const hookStart = hookHeaders[hookIndex];
+                let hookEnd = hookStart + 1;
+                for (; hookEnd < end; hookEnd += 1) {
+                    const header = tomlHeader(lines[hookEnd]);
+                    if (header?.array && header.path === `hooks.${event}.hooks`)
+                        break;
+                    if (header && !header.path.startsWith(`hooks.${event}.hooks.`))
+                        break;
+                }
+                const hook = groupHooks[hookIndex];
+                const command = isPlainObject(hook) && hook.type === "command" && typeof hook.command === "string"
+                    ? hook.command
+                    : undefined;
+                if (!command)
+                    continue;
+                const current = command === expected;
+                const drain = drainCommandsMatch(command, expected) || command === legacyCommand;
+                if (!drain || (current && !keptCurrent)) {
+                    if (current)
+                        keptCurrent = true;
+                    continue;
+                }
+                removeHooks.push({ start: hookStart, end: hookEnd });
+            }
+            if (removeHooks.length === 0)
+                continue;
+            changed = true;
+            if (removeHooks.length === hookHeaders.length) {
+                spans.push({ start, end });
+            }
+            else {
+                spans.push(...removeHooks);
+            }
+        }
+    }
+    if (!changed)
+        return { text, changed: false };
+    for (const span of spans.sort((a, b) => b.start - a.start)) {
+        lines.splice(span.start, span.end - span.start);
+    }
+    const cleaned = lines.join("\n");
+    return { text: cleaned, changed: true };
+}
 /**
  * Set `hooks = true` inside `[features]` by editing lines, so the operator's
  * comments and layout survive. A `[features]` header that exists gets the
@@ -442,12 +609,21 @@ export function mergeCodexConfigHook(existingText, command, configPath, legacyCo
     const original = existingText ?? "";
     const parsed = parseTomlOrThrow(original, configPath, "before merge");
     const migration = removeLegacyCodexHook(original, parsed, legacyCommand, configPath);
-    const textAfterMigration = migration.text;
+    const parsedAfterMigration = parseTomlOrThrow(migration.text, configPath, "after legacy hook removal");
+    const drainCleanup = removeStaleCodexDrainHooks(migration.text, parsedAfterMigration, command, legacyCommand, configPath);
+    const changedByCleanup = migration.changed || drainCleanup.changed;
+    const textAfterMigration = drainCleanup.text;
     const current = parseTomlOrThrow(textAfterMigration, configPath, "after legacy hook removal");
     const hasPreToolCommand = tomlHasCommand(current, command);
     const hasCommand = tomlHasDrainCommand(current, command);
     const featureOn = tomlHooksFeatureEnabled(current);
-    if (hasCommand && featureOn && !migration.changed) {
+    if (hasCommand && featureOn && !changedByCleanup &&
+        ["PreToolUse", "PostToolUse", "Stop"].every((event) => {
+            const groups = isPlainObject(current.hooks) && Array.isArray(current.hooks[event])
+                ? current.hooks[event]
+                : [];
+            return groupHasExactlyOneCommand(groups, command);
+        })) {
         return { text: original, changed: false };
     }
     let text = textAfterMigration;
@@ -509,7 +685,7 @@ export function probeDrainHookRegistration(provider, providerHome) {
             const toml = parseToml(text);
             return {
                 ...base,
-                registered: isPlainObject(toml) && tomlHasDrainCommand(toml, command) && tomlHooksFeatureEnabled(toml),
+                registered: isPlainObject(toml) && tomlHasDrainCommand(toml, command, true) && tomlHooksFeatureEnabled(toml),
             };
         }
         const json = JSON.parse(text);
@@ -517,7 +693,7 @@ export function probeDrainHookRegistration(provider, providerHome) {
         return {
             ...base,
             registered: hooks !== null &&
-                (parsed === "grok" ? ["PreToolUse"] : ["PreToolUse", "PostToolUse", "Stop"]).every((event) => groupsContainDrainCommand(hooks[event], command)),
+                (parsed === "grok" ? ["PreToolUse"] : ["PreToolUse", "PostToolUse", "Stop"]).every((event) => groupsContainDrainCommand(hooks[event], command, true)),
         };
     }
     catch (err) {

package/dist/secrets-env-action.d.ts

@@ -57,6 +57,23 @@ export declare function normalizeScriptLockMode(mode?: string): SecretScriptLock
 export declare function extractApiMessage(body: Record<string, unknown>, fallback: string): string;
 export declare function buildSecretUsage(channel: SecretUsageChannel, scriptPath?: string, scriptId?: string, attestationLevel?: string): Promise<SecretUsage>;
 export declare function parseSecretNameList(input: string[] | undefined): string[];
+/**
+ * The company a caller explicitly asked for while authenticating with
+ * HQ_API_KEY: `--company`, else HQ_COMPANY_UID. Undefined means "the key's own
+ * company", which needs no check.
+ */
+export declare function requestedApiKeyCompany(flagCompany: string | undefined): string | undefined;
+/**
+ * Refuse an explicitly requested company that the API key is not bound to.
+ *
+ * A vault API key can only read its own company's secrets. Before this check,
+ * `hq secrets exec --company <other>` under HQ_API_KEY ignored the flag and
+ * injected the key company's same-named secret with exit 0, which read as a
+ * cross-company leak (P0 triage, 2026-10-11). The probe is the keyed list
+ * route, which the server 403s with "not scoped to this company" on mismatch.
+ * Returns the verified uid; throws before any secret is fetched otherwise.
+ */
+export declare function assertApiKeyCompany(token: string, requested: string, commandLabel: string): Promise<string>;
 export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
     allowOfflineFallback?: boolean;
 }): Promise<Map<string, string>>;

package/dist/secrets-env-action.js

@@ -7,7 +7,7 @@ import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntr
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
 import { finishEnvExportsAndExit } from "./commands/secrets-env-exit.js";
-import { getEntityUid, vaultApiFetch } from "./utils/vault-api.js";
+import { getEntityUid, looksLikeCompanyUid, vaultApiFetch } from "./utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, resolveVaultCredentialForCapability, } from "./utils/resolve-vault-credential.js";
 import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "./utils/secret-load-availability.js";
 const MAX_BATCH_NAMES = 100;
@@ -124,16 +124,22 @@ export function parseSecretNameList(input) {
 // Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
 // with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
 // path used — never swallows a failure.
-async function loadRevealedSecretsViaApiKey(token, keys) {
+//
+// When the caller names a company uid, it rides in the body so the server can
+// refuse a key bound to a different company. Without it the fetch route reads
+// from the key's own company, which made `--company <other>` silently return
+// the key company's same-named secret (P0 triage, 2026-10-11).
+async function loadRevealedSecretsViaApiKey(token, keys, companyUid) {
     const resolved = new Map();
     const requested = [...new Set(keys)];
     const cacheScope = "__api_key__";
+    const scopedCompanyUid = companyUid && looksLikeCompanyUid(companyUid) ? companyUid : undefined;
     for (const name of requested) {
         const res = await vaultApiFetch({
             token,
             path: "/v1/keys/secrets/fetch",
             method: "POST",
-            body: { name },
+            body: scopedCompanyUid ? { name, companyUid: scopedCompanyUid } : { name },
             signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
         });
         const body = (await res.json().catch(() => ({})));
@@ -168,9 +174,52 @@ async function loadRevealedSecretsViaApiKey(token, keys) {
     }
     return resolved;
 }
+/**
+ * The company a caller explicitly asked for while authenticating with
+ * HQ_API_KEY: `--company`, else HQ_COMPANY_UID. Undefined means "the key's own
+ * company", which needs no check.
+ */
+export function requestedApiKeyCompany(flagCompany) {
+    const ref = flagCompany?.trim() || process.env.HQ_COMPANY_UID?.trim();
+    return ref ? ref : undefined;
+}
+/**
+ * Refuse an explicitly requested company that the API key is not bound to.
+ *
+ * A vault API key can only read its own company's secrets. Before this check,
+ * `hq secrets exec --company <other>` under HQ_API_KEY ignored the flag and
+ * injected the key company's same-named secret with exit 0, which read as a
+ * cross-company leak (P0 triage, 2026-10-11). The probe is the keyed list
+ * route, which the server 403s with "not scoped to this company" on mismatch.
+ * Returns the verified uid; throws before any secret is fetched otherwise.
+ */
+export async function assertApiKeyCompany(token, requested, commandLabel) {
+    if (!looksLikeCompanyUid(requested)) {
+        throw new Error(`HQ_API_KEY is set; '${commandLabel}' --company must be the company uid (cmp_…) the key ` +
+            `was minted for (resolving a slug needs a Cognito session). Got '${requested}'. ` +
+            `Omit --company to use the key's own company.`);
+    }
+    const response = await vaultApiFetch({
+        token,
+        path: `/v1/keys/secrets/${encodeURIComponent(requested)}`,
+    });
+    if (response.ok)
+        return requested;
+    if (response.status === 401)
+        throw new Error("HQ_API_KEY is invalid or no longer active.");
+    const body = (await response.json().catch(() => ({})));
+    const message = typeof body.error === "string" ? body.error : "";
+    if (response.status === 403 && /not scoped to this company/i.test(message)) {
+        throw new Error(`HQ_API_KEY belongs to a different company than ${requested}. An API key can only read ` +
+            `its own company's secrets. Omit --company (and HQ_COMPANY_UID) to use the key's company, ` +
+            `or use a key minted for ${requested}.`);
+    }
+    throw new Error(`Could not verify that HQ_API_KEY belongs to ${requested} (HTTP ${response.status}` +
+        `${message ? `: ${message}` : ""}).`);
+}
 export async function loadRevealedSecrets(token, companyUid, keys, usage, options = {}) {
     if (token.startsWith(HQ_API_KEY_PREFIX)) {
-        return loadRevealedSecretsViaApiKey(token, keys);
+        return loadRevealedSecretsViaApiKey(token, keys, companyUid);
     }
     const resolved = new Map();
     const requested = [...new Set(keys)];
@@ -416,8 +465,13 @@ export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
         }
         const keys = parseSecretNameList(opts.only);
         const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
+        const apiKeyCompanyRef = cred.kind === "api-key"
+            ? requestedApiKeyCompany(parentScope.company)
+            : undefined;
         const companyUid = cred.kind === "api-key"
-            ? "__api_key__"
+            ? (apiKeyCompanyRef
+                ? await assertApiKeyCompany(cred.token, apiKeyCompanyRef, "secrets env")
+                : "__api_key__")
             : await getEntityUid(cred.token, scopeOpts(parentScope), {
                 allowOfflineScopeFallback: true,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.82",
+  "version": "5.345.84",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {