@indigoai-us/hq-cli 5.12.4 → 5.13.0

package/src/commands/secrets.test.ts

@@ -0,0 +1,96 @@
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+  type MockInstance,
+} from "vitest";
+
+vi.mock("../utils/cognito-session.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    ensureCognitoToken: vi.fn(async () => "test-token"),
+  };
+});
+
+vi.mock("../utils/vault-api.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    getEntityUid: vi.fn(async () => "prs_alice"),
+    vaultApiFetch: vi.fn(async () =>
+      new Response(
+        JSON.stringify({
+          url: "https://hq.example/secrets-input/tok_secret",
+          expiresAt: "2026-05-12T12:00:00.000Z",
+          secretName: "MY_KEY",
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      ),
+    ),
+  };
+});
+
+import { Command } from "commander";
+import { registerSecretsCommand } from "./secrets.js";
+import { getEntityUid, vaultApiFetch } from "../utils/vault-api.js";
+
+let logSpy: MockInstance<typeof console.log>;
+let errSpy: MockInstance<typeof console.error>;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+  errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function buildProgram(): Command {
+  const program = new Command();
+  program.exitOverride();
+  program.configureOutput({
+    writeOut: () => undefined,
+    writeErr: () => undefined,
+  });
+  registerSecretsCommand(program);
+  return program;
+}
+
+describe("secrets generate-link", () => {
+  it("mints one-time submission links for personal secrets", async () => {
+    const program = buildProgram();
+
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "--personal",
+      "generate-link",
+      "MY_KEY",
+      "--expires",
+      "30m",
+    ]);
+
+    expect(getEntityUid).toHaveBeenCalledWith("test-token", {
+      personal: true,
+      companySlug: undefined,
+    });
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/name/MY_KEY",
+      method: "POST",
+      body: { expiresInMs: 30 * 60 * 1000 },
+      query: { action: "generate-token" },
+    });
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Secret input link generated"),
+    );
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+});

package/src/commands/secrets.ts

@@ -615,8 +615,6 @@ export function registerSecretsCommand(program: Command): void {
     .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
     .action(async (name: string, opts: { expires: string }) => {
       try {
-        rejectIfPersonal(secrets.opts(), "generate-link");
-
         if (!SECRET_NAME_PATTERN.test(name)) {
           console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
           process.exit(1);

package/src/index.ts

@@ -35,6 +35,16 @@ import {
   refreshVersionCache,
 } from "./utils/version-check.js";
 
+// Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes the pipe early.
+const onPipeError = (err: NodeJS.ErrnoException): void => {
+  if (err.code === "EPIPE") {
+    process.exit(0);
+  }
+  throw err;
+};
+process.stdout.on("error", onPipeError);
+process.stderr.on("error", onPipeError);
+
 initSentry();
 maybeWarnNewVersion();