@indigoai-us/hq-cli 5.74.0 → 5.76.0

package/dist/commands/mcp-registration.d.ts

@@ -429,11 +429,10 @@ export interface McpManifest {
 /**
  * Resolve a `${secret:NAME}` reference to its plaintext value, or return `null`
  * when the secret is unavailable (un-minted / TTL-expired / no company context).
- * Production binds this to `secrets-cache.ts` (`readCache(companyUid, NAME)`,
- * AES-256-GCM, 0600, 5-min TTL); TESTS inject a pure map so they NEVER read the
- * real encrypted cache. Returning `null` for a referenced secret is a hard error
- * at emit (we refuse to write a broken header), distinct from a name with no
- * reference at all.
+ * Production binds this to an in-memory map populated by a fresh vault `/load`
+ * authorization response; tests inject a pure map. Returning `null` for a
+ * referenced secret is a hard error at emit (we refuse to write a broken
+ * header), distinct from a name with no reference at all.
  */
 export type SecretResolver = (name: string) => string | null;
 /** True iff `value` contains at least one `${secret:NAME}` reference. */

package/dist/commands/mcp-registration.js

@@ -848,7 +848,8 @@ function restoreSafely(realTarget, backupDir) {
 //
 // SECRET SAFETY (the hard rule from the PRD authModel / US-002 AC):
 //   - `${secret:NAME}` resolves ONLY here, at emit, via the injected
-//     {@link SecretResolver} (production = the AES-256-GCM `secrets-cache.ts`).
+//     {@link SecretResolver}. Production injects values returned by a fresh
+//     server authorization; the encrypted disk cache is never a value fallback.
 //   - The RESOLVED value lands in `~/.claude.json` — a 0600 user-global file that
 //     is NOT synced/committed — because the runtime needs the real header to work.
 //   - The resolved value is REDACTED from every return value and never echoed; we
@@ -885,9 +886,9 @@ export function resolveSecretRefs(value, resolve, secretSink) {
     return value.replace(SECRET_REF_RE, (_match, name) => {
         const resolved = resolve(name);
         if (resolved === null || resolved === undefined) {
-            throw new McpManifestError(`cannot resolve \${secret:${name}} at emit — the secret is not in the cache ` +
-                '(mint it via the pack onboarding / `hq run`, then re-install). HQ refuses to ' +
-                'write a half-resolved header.');
+            throw new McpManifestError(`cannot resolve \${secret:${name}} at emit — the secret was not available ` +
+                'after online vault authorization (check login, company scope, and access, ' +
+                'then re-install). HQ refuses to write a half-resolved header.');
         }
         if (resolved.length > 0)
             secretSink.add(resolved);

package/dist/commands/outposts.d.ts

@@ -23,13 +23,27 @@
 import { Command } from "commander";
 import { spawnSync } from "node:child_process";
 import { type BillingErrorPayload } from "../utils/billing-gate.js";
+/**
+ * hq-pro's per-person cap envelope on a `409` provision block. Unlike every
+ * other `/outpost/*` failure this body carries NO `message`/`error` field —
+ * only the cap facts — so it has to be decoded structurally or the reason
+ * degrades to a bare `res.statusText` ("Conflict").
+ */
+export interface OutpostCappedPayload {
+    limit: number;
+    outposts: OutpostSummary[];
+}
+/** Decode hq-pro's `{ capped, limit, outposts }` cap envelope, if present. */
+export declare function parseCappedPayload(body: unknown): OutpostCappedPayload | undefined;
 /** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
 export declare class OutpostHttpError extends Error {
     status: number;
     step?: string;
     /** hq-pro's billing envelope on a `402 billing_required` provision block. */
     billing?: BillingErrorPayload;
-    constructor(status: number, message: string, step?: string, billing?: BillingErrorPayload);
+    /** hq-pro's cap envelope on a `409` provision block. */
+    capped?: OutpostCappedPayload;
+    constructor(status: number, message: string, step?: string, billing?: BillingErrorPayload, capped?: OutpostCappedPayload);
 }
 /** Row summary from `GET /outpost/list`. */
 export interface OutpostSummary {
@@ -59,9 +73,11 @@ export declare function outpostRequest<T>(opts: {
 /**
  * Provision the caller's Outpost. Sends the cached Cognito refresh token so the
  * box can authenticate AS the caller (the same body the console's
- * `provisionMyOutpost` sends). Idempotent server-side: a caller already at their
- * per-person cap gets their existing box back rather than a duplicate. The
- * refresh token is sent over HTTPS and NEVER printed.
+ * `provisionMyOutpost` sends). No duplicate is ever created: a caller already at
+ * their per-person cap gets a `409` whose body lists their existing boxes —
+ * thrown here as an `OutpostHttpError` carrying `capped` (hq-pro checks the cap
+ * BEFORE activation billing, so a capped call is never charged). The refresh
+ * token is sent over HTTPS and NEVER printed.
  */
 export declare function provisionOutpost(token: string, input: {
     refreshToken: string;
@@ -120,6 +136,8 @@ export interface OutpostExecSubmission {
     instanceId: string;
     commandId: string;
     outputPrefix: string;
+    /** Shell budget applied server-side (AWS-RunShellScript executionTimeout). */
+    executionTimeoutSeconds?: number;
 }
 /** Poll response from `mode: "result"`; streams arrive only when terminal. */
 export interface OutpostExecAsyncResult {
@@ -134,7 +152,7 @@ export interface OutpostExecAsyncResult {
     truncated?: boolean;
 }
 export declare function stageExecInput(token: string, outpostId?: string): Promise<OutpostExecStage>;
-export declare function submitExec(token: string, command: string, outpostId?: string): Promise<OutpostExecSubmission>;
+export declare function submitExec(token: string, command: string, outpostId?: string, timeoutSeconds?: number): Promise<OutpostExecSubmission>;
 export declare function fetchExecResult(token: string, commandId: string, outpostId?: string): Promise<OutpostExecAsyncResult>;
 /** Preserve a single command string; safely join argv when Commander split it. */
 export declare function joinCommandParts(commandParts: string[]): string;

package/dist/commands/outposts.js

@@ -32,18 +32,33 @@ import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { OUTPOST_PRICE_CENTS, confirmChargeOrExit, parseBillingPayload, surfaceBillingRequired, } from "../utils/billing-gate.js";
+/** Decode hq-pro's `{ capped, limit, outposts }` cap envelope, if present. */
+export function parseCappedPayload(body) {
+    if (!body || typeof body !== "object")
+        return undefined;
+    const b = body;
+    if (b.capped !== true)
+        return undefined;
+    return {
+        limit: typeof b.limit === "number" ? b.limit : 0,
+        outposts: Array.isArray(b.outposts) ? b.outposts : [],
+    };
+}
 /** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
 export class OutpostHttpError extends Error {
     status;
     step;
     /** hq-pro's billing envelope on a `402 billing_required` provision block. */
     billing;
-    constructor(status, message, step, billing) {
+    /** hq-pro's cap envelope on a `409` provision block. */
+    capped;
+    constructor(status, message, step, billing, capped) {
         super(message);
         this.name = "OutpostHttpError";
         this.status = status;
         this.step = step;
         this.billing = billing;
+        this.capped = capped;
     }
 }
 /**
@@ -62,16 +77,18 @@ export async function outpostRequest(opts) {
             : typeof body.error === "string"
                 ? body.error
                 : res.statusText;
-        throw new OutpostHttpError(res.status, message, body.step, parseBillingPayload(body));
+        throw new OutpostHttpError(res.status, message, body.step, parseBillingPayload(body), parseCappedPayload(body));
     }
     return (await res.json());
 }
 /**
  * Provision the caller's Outpost. Sends the cached Cognito refresh token so the
  * box can authenticate AS the caller (the same body the console's
- * `provisionMyOutpost` sends). Idempotent server-side: a caller already at their
- * per-person cap gets their existing box back rather than a duplicate. The
- * refresh token is sent over HTTPS and NEVER printed.
+ * `provisionMyOutpost` sends). No duplicate is ever created: a caller already at
+ * their per-person cap gets a `409` whose body lists their existing boxes —
+ * thrown here as an `OutpostHttpError` carrying `capped` (hq-pro checks the cap
+ * BEFORE activation billing, so a capped call is never charged). The refresh
+ * token is sent over HTTPS and NEVER printed.
  */
 export async function provisionOutpost(token, input) {
     return outpostRequest({
@@ -162,12 +179,16 @@ export async function stageExecInput(token, outpostId) {
         query: outpostId ? { outpostId } : undefined,
     });
 }
-export async function submitExec(token, command, outpostId) {
+export async function submitExec(token, command, outpostId, timeoutSeconds) {
     return outpostRequest({
         token,
         path: "/outpost/exec",
         method: "POST",
-        body: { mode: "submit", command },
+        body: {
+            mode: "submit",
+            command,
+            ...(timeoutSeconds !== undefined ? { timeoutSeconds } : {}),
+        },
         query: outpostId ? { outpostId } : undefined,
     });
 }
@@ -296,6 +317,24 @@ function ensureTrailingNewline(s) {
 // ---------------------------------------------------------------------------
 // Command registration
 // ---------------------------------------------------------------------------
+/**
+ * Explain a `409` per-person cap. hq-pro checks the cap BEFORE activation
+ * billing, so nothing was charged — worth saying, since the caller just
+ * confirmed a recurring charge to get here.
+ */
+function surfaceOutpostCapped(capped) {
+    const owned = capped.outposts.length;
+    console.error(chalk.yellow(`You're already at your Outpost limit (${owned} of ${capped.limit}). ` +
+        `No new box was provisioned and you have not been charged.`));
+    for (const o of capped.outposts) {
+        const detail = [o.state, o.instanceName, o.region]
+            .filter(Boolean)
+            .join("  ");
+        console.error(`  ${o.outpostId}  ${detail}`);
+    }
+    console.error(chalk.dim("Inspect it: hq outposts status"));
+    console.error(chalk.dim("Or tear it down first: hq outposts destroy --id <id> --yes"));
+}
 function fail(err) {
     if (err instanceof OutpostHttpError) {
         console.error(chalk.red(err.message));
@@ -611,7 +650,17 @@ function authGitHubViaVault(deps) {
         "unset GITHUB_TOKEN",
         'printf "%s" "$TOKEN" | gh auth login --with-token',
     ].join("\n");
-    const authed = runBestEffort(deps, "hq", ["secrets", "--personal", "exec", "--only", "GITHUB_TOKEN", "--", "bash", "-c", ghLogin], "GitHub auth via vault");
+    const authed = runBestEffort(deps, "hq", [
+        "secrets",
+        "--personal",
+        "exec",
+        "--only",
+        "GITHUB_TOKEN",
+        "--",
+        "bash",
+        "-c",
+        ghLogin,
+    ], "GitHub auth via vault");
     if (authed) {
         // Let plain `git clone https://github.com/...` reuse gh's token so private
         // repos don't prompt for a username/password.
@@ -666,7 +715,15 @@ async function replicaSyncOutpost(opts, deps) {
         console.warn("replica-sync: auth refresh failed — skipping this cycle (token likely expired).");
         return;
     }
-    runBestEffort(deps, "hq", ["sync", "pull", "--personal", "--hq-root", hqRoot, "--on-conflict", "keep"], "personal vault pull");
+    runBestEffort(deps, "hq", [
+        "sync",
+        "pull",
+        "--personal",
+        "--hq-root",
+        hqRoot,
+        "--on-conflict",
+        "keep",
+    ], "personal vault pull");
     // rescue lays down the core kernel and expects companies/ to exist.
     deps.mkdirp(path.join(hqRoot, "companies"));
     runBestEffort(deps, "hq", ["rescue", "--hq-root", hqRoot, "--yes"], "HQ kernel rescue");
@@ -718,9 +775,17 @@ export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
         .option("--yes", "Confirm the $80/month charge (required to provision)")
         .action(async function (opts) {
         try {
+            // Reject an unrecognized runtime rather than resolving it to claude:
+            // `--runtime codx` would otherwise hand back a silently Claude box.
+            if (opts.runtime !== undefined &&
+                opts.runtime !== "claude" &&
+                opts.runtime !== "codex") {
+                console.error(chalk.red(`Invalid --runtime '${opts.runtime}': must be 'claude' or 'codex'.`));
+                process.exit(1);
+            }
             const agentRuntime = opts.runtime === "codex"
                 ? "codex"
-                : opts.runtime
+                : opts.runtime === "claude"
                     ? "claude"
                     : undefined;
             let diskSizeGb;
@@ -763,6 +828,14 @@ export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
                     await surfaceBillingRequired(token, err.billing);
                     process.exit(1);
                 }
+                // Already at the per-person cap → say so and name the box they own,
+                // not a bare "Conflict".
+                if (err instanceof OutpostHttpError &&
+                    err.status === 409 &&
+                    err.capped) {
+                    surfaceOutpostCapped(err.capped);
+                    process.exit(1);
+                }
                 throw err;
             }
         }
@@ -835,8 +908,18 @@ export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
     });
     outposts
         .command("exec <command...>")
-        .description("Run a shell command on an Outpost and print its output (use -- before flags meant for the remote command)")
+        .description("Run a shell command on an Outpost and print its output (use -- before flags meant for the remote command). " +
+        "Default is synchronous (API Gateway ~20s cap). Use --async for long jobs, or --detach to print the commandId and return immediately.")
         .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--async", "Submit via the async transport and wait for completion (bypasses the ~20s sync cap; shell budget defaults to 48h)")
+        .option("--detach", "Submit via the async transport, print commandId, and return immediately (pair with `hq outposts exec-result --wait`)")
+        .option("--timeout-seconds <n>", "Async shell budget in seconds (AWS-RunShellScript executionTimeout; 1..172800). Implies --async unless --detach is set.", (v) => {
+        const n = Number(v);
+        if (!Number.isInteger(n)) {
+            throw new Error("--timeout-seconds must be an integer");
+        }
+        return n;
+    })
         .option("--json", "Emit raw JSON")
         .action(async function (commandParts, opts) {
         try {
@@ -845,9 +928,94 @@ export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
                 console.error(chalk.red("No command given. Usage: hq outposts exec -- <command>"));
                 process.exit(1);
             }
+            if (opts.async && opts.detach) {
+                console.error(chalk.red("Use either --async (submit + wait) or --detach (submit only), not both."));
+                process.exit(1);
+            }
+            // --timeout-seconds only applies to the async path; bare use implies --async.
+            const useAsync = Boolean(opts.async) ||
+                Boolean(opts.detach) ||
+                opts.timeoutSeconds !== undefined;
+            if (opts.timeoutSeconds !== undefined) {
+                if (!Number.isInteger(opts.timeoutSeconds) ||
+                    opts.timeoutSeconds < 1 ||
+                    opts.timeoutSeconds > 172_800) {
+                    console.error(chalk.red("--timeout-seconds must be an integer between 1 and 172800 (48h, the AWS-RunShellScript max)"));
+                    process.exit(1);
+                }
+            }
             const token = await ensureCognitoToken();
             // Run from the box's HQ folder by default (works over both SSM and SSH).
             const remoteCommand = withRemoteHqDir(command);
+            if (useAsync) {
+                try {
+                    const submitted = await submitExec(token, remoteCommand, opts.id, opts.timeoutSeconds);
+                    if (opts.detach) {
+                        const output = {
+                            commandId: submitted.commandId,
+                            ...(submitted.executionTimeoutSeconds !== undefined
+                                ? { executionTimeoutSeconds: submitted.executionTimeoutSeconds }
+                                : opts.timeoutSeconds !== undefined
+                                    ? { executionTimeoutSeconds: opts.timeoutSeconds }
+                                    : {}),
+                        };
+                        if (opts.json) {
+                            process.stdout.write(JSON.stringify(output) + "\n");
+                        }
+                        else {
+                            printKeyValues(output);
+                            console.error(chalk.dim("Submitted. Poll with: hq outposts exec-result --command-id " +
+                                submitted.commandId +
+                                (opts.id ? ` --id ${opts.id}` : "") +
+                                " --wait"));
+                        }
+                        return;
+                    }
+                    // --async (or --timeout-seconds without --detach): wait for terminal.
+                    if (!opts.json) {
+                        console.error(chalk.dim(`Submitted ${submitted.commandId}; waiting for completion…`));
+                    }
+                    const result = await waitForExecResult(token, submitted.commandId, opts.id);
+                    if (opts.json) {
+                        process.stdout.write(JSON.stringify({
+                            commandId: submitted.commandId,
+                            done: result.done,
+                            status: result.status,
+                            exitCode: result.exitCode ?? null,
+                            stdout: result.stdout ?? "",
+                            stderr: result.stderr ?? "",
+                            truncated: result.truncated ?? false,
+                        }, null, 2) + "\n");
+                    }
+                    else {
+                        if (result.stdout)
+                            process.stdout.write(result.stdout);
+                        if (result.stderr)
+                            process.stderr.write(result.stderr);
+                        if (result.truncated) {
+                            console.error(chalk.yellow("(output truncated — redirect to a file on the box for full output)"));
+                        }
+                        if (result.status !== "Success" && result.exitCode === null) {
+                            console.error(chalk.yellow(`(command ended with SSM status: ${result.status})`));
+                        }
+                    }
+                    process.exitCode =
+                        typeof result.exitCode === "number" ? result.exitCode : 0;
+                    return;
+                }
+                catch (err) {
+                    // Async requires EC2/SSM. Lightsail has no async channel — refuse
+                    // rather than silently falling back to a live SSH hold, which is
+                    // the exact timeout failure mode --async is meant to escape.
+                    if (err instanceof OutpostHttpError &&
+                        err.step === "platform-unsupported") {
+                        console.error(chalk.red("Async exec requires an EC2 Outpost (SSM). This box is Lightsail — " +
+                            "re-provision on EC2, or run a short sync command / SSH session instead."));
+                        process.exit(1);
+                    }
+                    throw err;
+                }
+            }
             try {
                 const result = await execOutpost(token, remoteCommand, opts.id);
                 if (opts.json) {
@@ -940,8 +1108,15 @@ export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
     });
     outposts
         .command("exec-submit <command...>")
-        .description("Submit an asynchronous shell command to an Outpost")
+        .description("Submit an asynchronous shell command to an Outpost (returns immediately with commandId; shell budget defaults to 48h)")
         .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--timeout-seconds <n>", "Shell budget in seconds (AWS-RunShellScript executionTimeout; 1..172800)", (v) => {
+        const n = Number(v);
+        if (!Number.isInteger(n)) {
+            throw new Error("--timeout-seconds must be an integer");
+        }
+        return n;
+    })
         .option("--json", "Emit raw JSON")
         .action(async function (commandParts, opts) {
         try {
@@ -950,9 +1125,27 @@ export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
                 console.error(chalk.red("No command given. Usage: hq outposts exec-submit -- <command>"));
                 process.exit(1);
             }
+            if (opts.timeoutSeconds !== undefined) {
+                if (!Number.isInteger(opts.timeoutSeconds) ||
+                    opts.timeoutSeconds < 1 ||
+                    opts.timeoutSeconds > 172_800) {
+                    console.error(chalk.red("--timeout-seconds must be an integer between 1 and 172800 (48h)"));
+                    process.exit(1);
+                }
+            }
             const token = await ensureCognitoToken();
-            const submitted = await submitExec(token, command, opts.id);
-            const output = { commandId: submitted.commandId };
+            // exec-submit is the raw fire-and-forget path — do NOT wrap with
+            // withRemoteHqDir here (callers that want the HQ cwd use `exec --async`
+            // or prefix their own cd). Matches the existing contract.
+            const submitted = await submitExec(token, command, opts.id, opts.timeoutSeconds);
+            const output = {
+                commandId: submitted.commandId,
+                ...(submitted.executionTimeoutSeconds !== undefined
+                    ? { executionTimeoutSeconds: submitted.executionTimeoutSeconds }
+                    : opts.timeoutSeconds !== undefined
+                        ? { executionTimeoutSeconds: opts.timeoutSeconds }
+                        : {}),
+            };
             if (opts.json) {
                 process.stdout.write(JSON.stringify(output) + "\n");
             }

package/dist/commands/pack-install.d.ts

@@ -305,26 +305,21 @@ export declare function renderMcpServerLine(payloadDir: string, item: string): s
  */
 export declare function confirmMcp(pkg: PackManifest, payloadDir: string, allowMcp: boolean): Promise<boolean>;
 /**
- * Build the install-time {@link SecretResolver} bound to the HQ vault's local
- * secrets-cache (`~/.hq/secrets-cache/<scope>/<NAME>`, AES-256-GCM, 0600, TTL'd).
+ * Build an install-time {@link SecretResolver} from a fresh server authorization
+ * decision. The encrypted cache may identify one unambiguous scope, but its
+ * plaintext is never trusted or read to register an MCP server.
  *
- * Active-company resolution at install time is INDIRECT by design: `hq install`
- * has no `--company` flag and runs OFFLINE (no token), so we cannot resolve a
- * single active company UID the way `hq run` / `hq secrets` do (via
- * `getEntityUid` over the network). Instead we probe EVERY cached scope
- * (`cmp_*`/`prs_*` — whichever has minted secrets locally) for the requested
- * name and return the first hit. This naturally resolves to whichever company
- * context just provisioned the secret (e.g. the one `/connect-shopify` minted
- * `VYG_API_KEY` under), without guessing, and works whether the vault scoped the
- * key under a company or person entity.
+ * With `--company`, the caller-selected company is resolved normally. Without
+ * it, exactly one cache scope may identify the intended company/person context;
+ * multiple scopes are ambiguous and fail closed. The requested names are then
+ * loaded through the same server-authorized endpoint as exec/env/run. Offline,
+ * expired-session, forbidden, not-found, script-lock, and malformed-response
+ * outcomes all produce an empty resolver, so MCP registration is deferred.
  *
- * On MISS across all scopes (no cache, expired TTL, or key never minted) it
- * returns `null` — which is exactly what {@link registerMcpServers}'s
- * unresolvable-secret path keys off to defer that server gracefully. With no
- * cached scopes at all (`listSecretCacheScopes()` → `[]`) it simply returns
- * `null` for every name, the desired graceful-deferral behavior.
+ * The returned synchronous resolver contains only values from that fresh
+ * authorization response. No cached value is a fallback.
  */
-export declare function makeInstallSecretResolver(): SecretResolver;
+export declare function makeInstallSecretResolver(secretNames: string[], company?: string): Promise<SecretResolver>;
 /**
  * Install the fetched payload to `<hqRoot>/core/packages/<pkg.name>/` (HQ
  * v12+ layout). The HQ template (`hq-core` / `hq-core-staging`) ships
@@ -381,6 +376,8 @@ export declare function runScanPackages(hqRoot: string, opts?: {
 }): void;
 export interface InstallPackOptions {
     allowHooks?: boolean;
+    /** Company context for online authorization of install-time MCP secret refs. */
+    company?: string;
     /**
      * US-010 install-time MCP trust prompt bypass (CI/ambient-trust). Mirrors
      * `allowHooks`: when set, `confirmMcp` skips the prompt and prints a yellow

package/dist/commands/pack-install.js

@@ -49,9 +49,11 @@ import { findHqRoot } from '../utils/manifest.js';
 import { readHqVersion, routeContribution, listInstalledPacks } from '../utils/pack-contributions.js';
 import { CONTRIBUTION_TABLE, payloadFor } from '../utils/contribution-table.js';
 import { safeExtractTarball } from './safe-extract.js';
-import { vaultApiFetchPublic } from '../utils/vault-api.js';
+import { getCompanyUid, vaultApiFetchPublic } from '../utils/vault-api.js';
+import { ensureCognitoToken } from '../utils/cognito-session.js';
 import { redactSecrets, SECRET_REDACTION, registerMcpServers, McpManifestError, } from './mcp-registration.js';
-import { readCache, listSecretCacheScopes } from '../utils/secrets-cache.js';
+import { listSecretCacheScopes } from '../utils/secrets-cache.js';
+import { loadRevealedSecrets } from './secrets.js';
 const PACK_UPDATE_CACHE_TTL_MS = 12 * 60 * 60 * 1000;
 const PACK_UPDATE_FETCH_TIMEOUT_MS = 3_000;
 const gitLsRemoteMemo = new Map();
@@ -1349,34 +1351,56 @@ function evalConditional(expr) {
 // key) still SUCCEEDS, skipping only the server whose secret is not yet present.
 // ---------------------------------------------------------------------------
 /**
- * Build the install-time {@link SecretResolver} bound to the HQ vault's local
- * secrets-cache (`~/.hq/secrets-cache/<scope>/<NAME>`, AES-256-GCM, 0600, TTL'd).
+ * Build an install-time {@link SecretResolver} from a fresh server authorization
+ * decision. The encrypted cache may identify one unambiguous scope, but its
+ * plaintext is never trusted or read to register an MCP server.
  *
- * Active-company resolution at install time is INDIRECT by design: `hq install`
- * has no `--company` flag and runs OFFLINE (no token), so we cannot resolve a
- * single active company UID the way `hq run` / `hq secrets` do (via
- * `getEntityUid` over the network). Instead we probe EVERY cached scope
- * (`cmp_*`/`prs_*` — whichever has minted secrets locally) for the requested
- * name and return the first hit. This naturally resolves to whichever company
- * context just provisioned the secret (e.g. the one `/connect-shopify` minted
- * `VYG_API_KEY` under), without guessing, and works whether the vault scoped the
- * key under a company or person entity.
+ * With `--company`, the caller-selected company is resolved normally. Without
+ * it, exactly one cache scope may identify the intended company/person context;
+ * multiple scopes are ambiguous and fail closed. The requested names are then
+ * loaded through the same server-authorized endpoint as exec/env/run. Offline,
+ * expired-session, forbidden, not-found, script-lock, and malformed-response
+ * outcomes all produce an empty resolver, so MCP registration is deferred.
  *
- * On MISS across all scopes (no cache, expired TTL, or key never minted) it
- * returns `null` — which is exactly what {@link registerMcpServers}'s
- * unresolvable-secret path keys off to defer that server gracefully. With no
- * cached scopes at all (`listSecretCacheScopes()` → `[]`) it simply returns
- * `null` for every name, the desired graceful-deferral behavior.
+ * The returned synchronous resolver contains only values from that fresh
+ * authorization response. No cached value is a fallback.
  */
-export function makeInstallSecretResolver() {
-    return (name) => {
-        for (const scope of listSecretCacheScopes()) {
-            const value = readCache(scope, name);
-            if (value !== null)
-                return value;
+export async function makeInstallSecretResolver(secretNames, company) {
+    const names = [...new Set(secretNames)];
+    if (names.length === 0)
+        return () => null;
+    try {
+        const token = await ensureCognitoToken({ interactive: false });
+        let scopeUid;
+        if (company) {
+            scopeUid = await getCompanyUid(token, company);
         }
-        return null;
-    };
+        else {
+            const scopes = listSecretCacheScopes();
+            if (scopes.length !== 1)
+                return () => null;
+            [scopeUid] = scopes;
+        }
+        const authorized = await loadRevealedSecrets(token, scopeUid, names);
+        return (name) => authorized.get(name) ?? null;
+    }
+    catch {
+        return () => null;
+    }
+}
+const INSTALL_SECRET_REF_RE = /\$\{secret:([A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*)\}/g;
+function collectManifestSecretNames(manifest) {
+    const names = new Set();
+    for (const value of [
+        ...Object.values(manifest.headers ?? {}),
+        ...Object.values(manifest.env ?? {}),
+    ]) {
+        INSTALL_SECRET_REF_RE.lastIndex = 0;
+        for (let match = INSTALL_SECRET_REF_RE.exec(value); match; match = INSTALL_SECRET_REF_RE.exec(value)) {
+            names.add(match[1]);
+        }
+    }
+    return [...names];
 }
 /**
  * Load + shape-validate + parse a pack's per-server MCP manifest from disk.
@@ -1424,13 +1448,13 @@ function extractDeferredSecretName(message) {
  *   - ANY OTHER error               → RE-THROW (abort install). Only the
  *     unresolvable-secret case is swallowed.
  */
-function wireMcpServers(pkg, destDir) {
-    const resolveSecret = makeInstallSecretResolver();
+async function wireMcpServers(pkg, destDir, company) {
     const loadManifest = (name) => loadMcpManifestFrom(destDir, name);
     const registered = [];
     const skipped = [];
     for (const name of pkg.contributes.mcp ?? []) {
         try {
+            const resolveSecret = await makeInstallSecretResolver(collectManifestSecretNames(loadManifest(name)), company);
             // Per-server call: registerMcpServers throws on the FIRST unresolvable
             // secret, so calling it one name at a time lets us catch + continue.
             registerMcpServers(pkg.name, [name], { loadManifest, resolveSecret });
@@ -1676,7 +1700,7 @@ export async function installPack(source, opts = {}) {
         // Per-server secret-deferral keeps a fresh install (key not yet minted) at
         // exit 0, deferring only the unresolvable server (see wireMcpServers).
         if (Array.isArray(pkg.contributes.mcp) && pkg.contributes.mcp.length > 0) {
-            const { registered, skipped } = wireMcpServers(pkg, destDir);
+            const { registered, skipped } = await wireMcpServers(pkg, destDir, opts.company);
             // One-line summary (server NAMES only — never resolved secret VALUES).
             say(chalk.dim(`  MCP servers: registered [${registered.join(', ')}]; ` +
                 `skipped [${skipped.join(', ')}].`));

package/dist/commands/pkg-install.js

@@ -29,7 +29,7 @@ export function registerPackageInstallCommand(parent) {
         .command('install <source>')
         .description('Install a package. Sources: bare slug (registry, Cognito-gated), ' +
         '@scope/name[@ver] (npm pack), git URL[#ref], or local path.')
-        .option('--company <co>', 'Scope the package to a specific company (registry flow only)')
+        .option('--company <co>', 'Scope package secret authorization to a specific company')
         .option('--allow-hooks', 'Skip the hooks confirmation prompt (content-pack flow)')
         .option('--allow-mcp', 'Skip the MCP server confirmation prompt (content-pack flow)')
         .option('--branch', 'Follow a ref instead of SHA-pinning (git content-pack flow)')
@@ -37,6 +37,7 @@ export function registerPackageInstallCommand(parent) {
         try {
             if (sourceMatchesPackPattern(source)) {
                 await installPack(source, {
+                    company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
                     followBranch: opts.branch,
@@ -48,6 +49,7 @@ export function registerPackageInstallCommand(parent) {
                 // would fail at registry setup. Resolve it through the marketplace
                 // listings transport — the live install path — instead.
                 await installPack(`${MARKETPLACE_PREFIX}${source}`, {
+                    company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
                     followBranch: opts.branch,

package/dist/commands/run.d.ts

@@ -1,3 +1,5 @@
 import { Command } from 'commander';
+import type { SecretUsage } from './secrets.js';
+export declare function buildRunUsage(scriptPath?: string, scriptId?: string): Promise<SecretUsage | undefined>;
 export declare function registerRunCommand(program: Command): void;
 //# sourceMappingURL=run.d.ts.map