@indigoai-us/hq-cli 5.12.3 → 5.12.5

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [5.12.4] — 2026-05-12
+
+### Changed
+
+- **`hq files acl <prefix>` now uses a single round-trip.** Previously the
+  command issued `GET /acl` and `GET /acl/tree` in parallel to gather the
+  prefix's own row metadata (creator, open/restricted, effective permission)
+  alongside inherited/descendant grants. The server now folds `directRow`
+  and `effectivePermission` into the `/acl/tree` response, so the CLI makes
+  a single request and dedupes the company-ACL fetch on the server side.
+  Output formatting is unchanged.
+
 ## [5.12.3] — 2026-05-12
 
 ### Added

package/dist/commands/files.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="50b160eb-d996-5ac2-8efc-b1791b469f3a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7a4bfaa9-c578-5cd8-8955-ec965faada13")}catch(e){}}();
 import chalk from "chalk";
 import open from "open";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
@@ -205,64 +205,49 @@ export function registerFilesCommand(program) {
             const token = await ensureCognitoToken();
             const companySlug = files.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            // Fetch the prefix's own ACL row (creator, open flag, effective
-            // permission) and the inherited/descendant tree in parallel so the
-            // user sees every grant that affects this prefix in one shot.
-            const [aclRes, treeRes] = await Promise.all([
-                vaultApiFetch({
-                    token,
-                    path: `/files/${encodeURIComponent(companyUid)}/acl`,
-                    query: { prefix: canonicalPrefix },
-                }),
-                vaultApiFetch({
-                    token,
-                    path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
-                    query: { prefix: canonicalPrefix },
-                }),
-            ]);
-            async function readErrorBody(res) {
-                return (await res.json().catch(() => ({})));
-            }
-            // Auth/server failures from either call are treated identically — bail
-            // out with a single message rather than printing a half-rendered view.
-            for (const res of [aclRes, treeRes]) {
-                if (res.ok || res.status === 404)
-                    continue;
-                const body = await readErrorBody(res);
-                if (res.status === 401) {
+            // `/acl/tree` carries the prefix's own row metadata (directRow) and the
+            // caller's effectivePermission alongside direct/inherited/children, so
+            // a single request returns everything the "files acl" view needs.
+            const treeRes = await vaultApiFetch({
+                token,
+                path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
+                query: { prefix: canonicalPrefix },
+            });
+            if (!treeRes.ok) {
+                const body = (await treeRes.json().catch(() => ({})));
+                if (treeRes.status === 401) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
-                else if (res.status === 403) {
+                else if (treeRes.status === 403) {
                     console.error(chalk.red("Not authorized to view this file prefix's ACL"));
                 }
-                else if (res.status >= 500) {
-                    console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+                else if (treeRes.status >= 500) {
+                    console.error(chalk.red(`Server error: ${body.error ?? treeRes.statusText}`));
                 }
                 else {
                     console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
                 }
                 process.exit(1);
             }
-            const acl = aclRes.ok ? (await aclRes.json()).acl : null;
-            const tree = treeRes.ok ? (await treeRes.json()) : null;
-            // No own row AND nothing inherited or granted below — original
-            // "no ACL record" exit path.
-            if (!acl && (!tree || (tree.inherited.length === 0 && tree.children.length === 0))) {
+            const tree = (await treeRes.json());
+            const row = tree.directRow;
+            // No own row AND nothing inherited or granted below — preserve the
+            // original "no ACL record" exit path.
+            if (!row && tree.inherited.length === 0 && tree.children.length === 0) {
                 console.error(chalk.red(`No ACL record exists for '${canonicalPrefix}'`));
                 process.exit(1);
             }
-            const aclPrefix = acl?.path ?? acl?.prefix ?? tree?.prefix ?? canonicalPrefix;
-            const aclStatus = acl?.open ? "open" : "restricted";
-            console.log(chalk.green(`ACL for ${aclPrefix} (${aclStatus})`));
-            if (acl) {
-                console.log(`Creator: ${acl.creatorUid}`);
-                if (acl.effectivePermission) {
-                    console.log(`Your effective permission: ${acl.effectivePermission}`);
-                }
+            const aclStatus = row?.open ? "open" : "restricted";
+            console.log(chalk.green(`ACL for ${tree.prefix} (${aclStatus})`));
+            if (row) {
+                console.log(`Creator: ${row.creatorUid}`);
             }
             else {
                 console.log(chalk.gray("No direct ACL row — access flows from the inherited/descendant grants below."));
             }
+            if (tree.effectivePermission) {
+                console.log(`Your effective permission: ${tree.effectivePermission}`);
+            }
             // Display labels for grantee identifiers — `company-wide` entries
             // store `granteeId === ""` on the wire, but a blank cell is confusing
             // in tabular output, so we render a human-readable phrase instead.
@@ -303,12 +288,12 @@ export function registerFilesCommand(program) {
                     console.log(cols.join("  "));
                 }
             }
-            const directEntries = acl?.entries ?? tree?.direct ?? [];
+            const directEntries = tree.direct;
             if (directEntries.length === 0) {
-                if (acl?.open) {
+                if (row?.open) {
                     console.log(chalk.gray("Open ACL — all active members have read access."));
                 }
-                else if (acl) {
+                else if (row) {
                     console.log(chalk.gray("No explicit grants on this prefix — only creator has access."));
                 }
             }
@@ -316,11 +301,11 @@ export function registerFilesCommand(program) {
                 console.log("\nDirect entries (granted on this prefix):");
                 printEntryTable(directEntries, false);
             }
-            if (tree && tree.inherited.length > 0) {
+            if (tree.inherited.length > 0) {
                 console.log("\nInherited (granted on an ancestor prefix):");
                 printEntryTable(tree.inherited, true);
             }
-            if (tree && tree.children.length > 0) {
+            if (tree.children.length > 0) {
                 console.log("\nGranted on descendant prefixes (do not affect this prefix's access):");
                 printEntryTable(tree.children, true);
             }
@@ -471,4 +456,4 @@ async function runShareSession(params) {
     }
 }
 //# sourceMappingURL=files.js.map
-//# debugId=50b160eb-d996-5ac2-8efc-b1791b469f3a
+//# debugId=7a4bfaa9-c578-5cd8-8955-ec965faada13

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="217ceadb-01cd-5778-9cc0-6f6d895d8d67")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b75c8495-7e0e-53f8-a0d2-c92a993e6492")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -467,7 +467,6 @@ export function registerSecretsCommand(program) {
         .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
         .action(async (name, opts) => {
         try {
-            rejectIfPersonal(secrets.opts(), "generate-link");
             if (!SECRET_NAME_PATTERN.test(name)) {
                 console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
@@ -713,4 +712,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=217ceadb-01cd-5778-9cc0-6f6d895d8d67
+//# debugId=b75c8495-7e0e-53f8-a0d2-c92a993e6492

package/dist/index.js

@@ -37,7 +37,7 @@ const program = new Command();
 program
     .name("hq")
     .description("HQ management CLI — modules, packages, and cloud sync")
-    .version("5.12.3");
+    .version("5.12.4");
 // Module management subcommand group
 const modulesCmd = program
     .command("modules")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.12.3",
+  "version": "5.12.5",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/files.ts

@@ -271,37 +271,23 @@ export function registerFilesCommand(program: Command): void {
         const companySlug = files.opts().company as string | undefined;
         const companyUid = await getCompanyUid(token, companySlug);
 
-        // Fetch the prefix's own ACL row (creator, open flag, effective
-        // permission) and the inherited/descendant tree in parallel so the
-        // user sees every grant that affects this prefix in one shot.
-        const [aclRes, treeRes] = await Promise.all([
-          vaultApiFetch({
-            token,
-            path: `/files/${encodeURIComponent(companyUid)}/acl`,
-            query: { prefix: canonicalPrefix },
-          }),
-          vaultApiFetch({
-            token,
-            path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
-            query: { prefix: canonicalPrefix },
-          }),
-        ]);
-
-        async function readErrorBody(res: Response): Promise<Record<string, string>> {
-          return (await res.json().catch(() => ({}))) as Record<string, string>;
-        }
+        // `/acl/tree` carries the prefix's own row metadata (directRow) and the
+        // caller's effectivePermission alongside direct/inherited/children, so
+        // a single request returns everything the "files acl" view needs.
+        const treeRes = await vaultApiFetch({
+          token,
+          path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
+          query: { prefix: canonicalPrefix },
+        });
 
-        // Auth/server failures from either call are treated identically — bail
-        // out with a single message rather than printing a half-rendered view.
-        for (const res of [aclRes, treeRes]) {
-          if (res.ok || res.status === 404) continue;
-          const body = await readErrorBody(res);
-          if (res.status === 401) {
+        if (!treeRes.ok) {
+          const body = (await treeRes.json().catch(() => ({}))) as Record<string, string>;
+          if (treeRes.status === 401) {
             console.error(chalk.red("Not authenticated — please run `hq login`"));
-          } else if (res.status === 403) {
+          } else if (treeRes.status === 403) {
             console.error(chalk.red("Not authorized to view this file prefix's ACL"));
-          } else if (res.status >= 500) {
-            console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+          } else if (treeRes.status >= 500) {
+            console.error(chalk.red(`Server error: ${body.error ?? treeRes.statusText}`));
           } else {
             console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
           }
@@ -315,53 +301,43 @@ export function registerFilesCommand(program: Command): void {
           grantedBy: string;
           grantedAt: string;
         };
-        type AclResponse = {
-          acl: {
-            itemType: string;
-            companyUid: string;
-            // Server returns `path` (the FileAcl field name); older builds
-            // used `prefix`. Read both so the CLI works against either.
-            path?: string;
-            prefix?: string;
-            creatorUid: string;
-            open?: boolean;
-            entries: AclEntry[];
-            effectivePermission?: string | null;
-            createdAt: string;
-            updatedAt: string;
-          };
-        };
         type TreeResponse = {
           prefix: string;
           direct: AclEntry[];
           inherited: Array<AclEntry & { sourcePrefix: string }>;
           children: Array<AclEntry & { sourcePrefix: string }>;
+          directRow: {
+            creatorUid: string;
+            open: boolean;
+            createdAt: string;
+            updatedAt: string;
+          } | null;
+          effectivePermission: string | null;
         };
 
-        const acl = aclRes.ok ? (await aclRes.json() as AclResponse).acl : null;
-        const tree = treeRes.ok ? (await treeRes.json()) as TreeResponse : null;
+        const tree = (await treeRes.json()) as TreeResponse;
+        const row = tree.directRow;
 
-        // No own row AND nothing inherited or granted below — original
-        // "no ACL record" exit path.
-        if (!acl && (!tree || (tree.inherited.length === 0 && tree.children.length === 0))) {
+        // No own row AND nothing inherited or granted below — preserve the
+        // original "no ACL record" exit path.
+        if (!row && tree.inherited.length === 0 && tree.children.length === 0) {
           console.error(chalk.red(`No ACL record exists for '${canonicalPrefix}'`));
           process.exit(1);
         }
 
-        const aclPrefix = acl?.path ?? acl?.prefix ?? tree?.prefix ?? canonicalPrefix;
-        const aclStatus = acl?.open ? "open" : "restricted";
+        const aclStatus = row?.open ? "open" : "restricted";
 
-        console.log(chalk.green(`ACL for ${aclPrefix} (${aclStatus})`));
-        if (acl) {
-          console.log(`Creator: ${acl.creatorUid}`);
-          if (acl.effectivePermission) {
-            console.log(`Your effective permission: ${acl.effectivePermission}`);
-          }
+        console.log(chalk.green(`ACL for ${tree.prefix} (${aclStatus})`));
+        if (row) {
+          console.log(`Creator: ${row.creatorUid}`);
         } else {
           console.log(chalk.gray(
             "No direct ACL row — access flows from the inherited/descendant grants below.",
           ));
         }
+        if (tree.effectivePermission) {
+          console.log(`Your effective permission: ${tree.effectivePermission}`);
+        }
 
         // Display labels for grantee identifiers — `company-wide` entries
         // store `granteeId === ""` on the wire, but a blank cell is confusing
@@ -405,11 +381,11 @@ export function registerFilesCommand(program: Command): void {
           }
         }
 
-        const directEntries = acl?.entries ?? tree?.direct ?? [];
+        const directEntries = tree.direct;
         if (directEntries.length === 0) {
-          if (acl?.open) {
+          if (row?.open) {
             console.log(chalk.gray("Open ACL — all active members have read access."));
-          } else if (acl) {
+          } else if (row) {
             console.log(chalk.gray("No explicit grants on this prefix — only creator has access."));
           }
         } else {
@@ -417,12 +393,12 @@ export function registerFilesCommand(program: Command): void {
           printEntryTable(directEntries, false);
         }
 
-        if (tree && tree.inherited.length > 0) {
+        if (tree.inherited.length > 0) {
           console.log("\nInherited (granted on an ancestor prefix):");
           printEntryTable(tree.inherited, true);
         }
 
-        if (tree && tree.children.length > 0) {
+        if (tree.children.length > 0) {
           console.log("\nGranted on descendant prefixes (do not affect this prefix's access):");
           printEntryTable(tree.children, true);
         }

package/src/commands/secrets.test.ts

@@ -0,0 +1,96 @@
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+  type MockInstance,
+} from "vitest";
+
+vi.mock("../utils/cognito-session.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    ensureCognitoToken: vi.fn(async () => "test-token"),
+  };
+});
+
+vi.mock("../utils/vault-api.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    getEntityUid: vi.fn(async () => "prs_alice"),
+    vaultApiFetch: vi.fn(async () =>
+      new Response(
+        JSON.stringify({
+          url: "https://hq.example/secrets-input/tok_secret",
+          expiresAt: "2026-05-12T12:00:00.000Z",
+          secretName: "MY_KEY",
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      ),
+    ),
+  };
+});
+
+import { Command } from "commander";
+import { registerSecretsCommand } from "./secrets.js";
+import { getEntityUid, vaultApiFetch } from "../utils/vault-api.js";
+
+let logSpy: MockInstance<typeof console.log>;
+let errSpy: MockInstance<typeof console.error>;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+  errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function buildProgram(): Command {
+  const program = new Command();
+  program.exitOverride();
+  program.configureOutput({
+    writeOut: () => undefined,
+    writeErr: () => undefined,
+  });
+  registerSecretsCommand(program);
+  return program;
+}
+
+describe("secrets generate-link", () => {
+  it("mints one-time submission links for personal secrets", async () => {
+    const program = buildProgram();
+
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "--personal",
+      "generate-link",
+      "MY_KEY",
+      "--expires",
+      "30m",
+    ]);
+
+    expect(getEntityUid).toHaveBeenCalledWith("test-token", {
+      personal: true,
+      companySlug: undefined,
+    });
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/name/MY_KEY",
+      method: "POST",
+      body: { expiresInMs: 30 * 60 * 1000 },
+      query: { action: "generate-token" },
+    });
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Secret input link generated"),
+    );
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+});

package/src/commands/secrets.ts

@@ -615,8 +615,6 @@ export function registerSecretsCommand(program: Command): void {
     .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
     .action(async (name: string, opts: { expires: string }) => {
       try {
-        rejectIfPersonal(secrets.opts(), "generate-link");
-
         if (!SECRET_NAME_PATTERN.test(name)) {
           console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
           process.exit(1);

package/src/index.ts

@@ -43,7 +43,7 @@ const program = new Command();
 program
   .name("hq")
   .description("HQ management CLI — modules, packages, and cloud sync")
-  .version("5.12.3");
+  .version("5.12.4");
 
 // Module management subcommand group
 const modulesCmd = program