@indigoai-us/hq-cli 5.342.1 → 5.342.3

package/dist/secrets-env-action.js

@@ -0,0 +1,459 @@
+import chalk from "chalk";
+import { writeSync } from "node:fs";
+import * as nodePath from "node:path";
+import { cognitoCachePrincipalUid } from "./utils/cognito-session.js";
+import { isAuthError } from "./utils/auth-error.js";
+import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntry, writeCache, } from "./utils/secrets-cache.js";
+import { computeSha256 } from "./utils/integrity.js";
+import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
+import { finishEnvExportsAndExit } from "./commands/secrets-env-exit.js";
+import { getEntityUid, vaultApiFetch } from "./utils/vault-api.js";
+import { HQ_API_KEY_PREFIX, resolveVaultCredentialForCapability, } from "./utils/resolve-vault-credential.js";
+import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "./utils/secret-load-availability.js";
+const MAX_BATCH_NAMES = 100;
+const SECRET_LOAD_TIMEOUT_MS = 30_000;
+/**
+ * A browser login is safe only when a person can answer it. This mirrors the
+ * repository's existing terminal convention in `canOfferTeamUpgrade`: both
+ * stdin and stderr must be TTYs, and CI is always non-interactive.
+ */
+export function secretsCredentialOptions() {
+    return {
+        interactive: process.stdin.isTTY === true &&
+            process.stderr.isTTY === true &&
+            !process.env.CI,
+    };
+}
+export function scopeOpts(opts) {
+    if (opts.personal && opts.company) {
+        console.error(chalk.red("Error: --personal cannot be combined with --company."));
+        process.exit(1);
+    }
+    return { personal: !!opts.personal, companySlug: opts.company };
+}
+function shellSingleQuote(value) {
+    return "'" + value.replace(/'/g, "'\\''") + "'";
+}
+export function highSecuritySandboxOnlyMessage(secretName) {
+    const sandboxExample = secretName
+        ? `hq secrets sandbox --only ${secretName} -- <command>`
+        : "hq secrets sandbox --only <secret> -- <command>";
+    return `High-security secrets can run only in the sandbox (use \`${sandboxExample}\`) or through the HQ secret proxy. Local injection and script locks (\`--script\`) are not supported.`;
+}
+export function normalizeSecretTier(tier) {
+    return tier === "sensitive" || tier === "nuclear" ? tier : "standard";
+}
+export function normalizeScriptLockMode(mode) {
+    return mode === "enforced" ? "enforced" : "off";
+}
+function normalizeCacheTtlMs(metadata) {
+    // Controlled rows must never reach the offline cache even if a mixed-version
+    // or malformed response carries a positive TTL. The server is authoritative
+    // for access, but the client still has enough policy metadata to fail safe.
+    if (metadata.tier === "sensitive" ||
+        metadata.tier === "nuclear" ||
+        metadata.scriptLock?.mode === "enforced") {
+        return 0;
+    }
+    if (metadata.cacheTtlMs === undefined) {
+        return DEFAULT_SECRETS_CACHE_TTL_MS;
+    }
+    return typeof metadata.cacheTtlMs === "number" &&
+        Number.isFinite(metadata.cacheTtlMs) &&
+        metadata.cacheTtlMs > 0
+        ? metadata.cacheTtlMs
+        : 0;
+}
+export function extractApiMessage(body, fallback) {
+    const message = typeof body.message === "string" ? body.message : undefined;
+    const error = typeof body.error === "string" ? body.error : undefined;
+    return message ?? error ?? fallback;
+}
+export async function buildSecretUsage(channel, scriptPath, scriptId, attestationLevel = "self-asserted-hash") {
+    if (scriptId && !scriptPath) {
+        throw new Error("--script-id requires --script");
+    }
+    if (!scriptPath) {
+        return { channel };
+    }
+    const resolvedPath = nodePath.resolve(scriptPath);
+    return {
+        channel,
+        script: {
+            scriptId: scriptId ?? resolvedPath,
+            path: resolvedPath,
+            sha256: await computeSha256(resolvedPath),
+            attestationLevel,
+        },
+    };
+}
+export function parseSecretNameList(input) {
+    const keys = input ?? [];
+    if (keys.length === 0) {
+        console.error(chalk.red("Error: --only requires at least one secret name."));
+        process.exit(1);
+    }
+    for (const key of keys) {
+        if (!SECRET_NAME_PATTERN.test(key)) {
+            console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$`));
+            process.exit(1);
+        }
+    }
+    return keys;
+}
+// HQ-4H — load + decrypt secrets through the BATCH-LOAD endpoint
+// (`POST /secrets/{companyUid}/load`) instead of one single-secret GET per key.
+//
+// Every single-secret GET that 404s makes vault-service emit an unattributed
+// "Secret not found" Sentry *warning* — each `response(404, …)` is captured at
+// the response boundary (hq-pro `_error-response.ts`). That capture is the
+// right signal for `hq secrets get <name>` ("a caller genuinely needed THIS
+// secret and it was missing"), but it is pure noise for a multi-key load where
+// a missing / renamed / rotated key is a per-key outcome `exec`/`env` already
+// report cleanly to the user. The batch-load endpoint returns 200 with a
+// per-name `errors[]` array and never captures — the same path `hq run` uses,
+// which is exactly why `hq run` never contributed to HQ-4H. Routing `exec` and
+// `env` through it stops those callers from emitting the warning while keeping
+// identical UX and error text.
+//
+// Every value use through exec/env/reveal is server-authorized when online,
+// including when an encrypted disk-cache entry exists. Only explicitly opted-in
+// exec/env callers may use principal-bound values during classified outages;
+// install authorization and reveal remain online-only. This means a policy,
+// ACL, tier, or script-approval change takes effect on the next online use.
+// Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
+// with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
+// path used — never swallows a failure.
+async function loadRevealedSecretsViaApiKey(token, keys) {
+    const resolved = new Map();
+    const requested = [...new Set(keys)];
+    const cacheScope = "__api_key__";
+    for (const name of requested) {
+        const res = await vaultApiFetch({
+            token,
+            path: "/v1/keys/secrets/fetch",
+            method: "POST",
+            body: { name },
+            signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            if (res.status === 404) {
+                throw new Error(`Failed to fetch secret '${name}': Secret not found`);
+            }
+            if (res.status === 403) {
+                const message = typeof body.error === "string"
+                    ? body.error
+                    : typeof body.message === "string"
+                        ? body.message
+                        : "No read permission";
+                if (body.highSecurity === true) {
+                    throw new Error(highSecuritySandboxOnlyMessage(name));
+                }
+                throw new Error(`Failed to fetch secret '${name}': ${message}`);
+            }
+            if (res.status === 401) {
+                throw new Error(`Failed to fetch secret '${name}': Invalid or missing API key`);
+            }
+            throw new Error(`Failed to fetch secret '${name}': ${extractApiMessage(body, res.statusText)}`);
+        }
+        const secret = typeof body.secret === "object" && body.secret !== null
+            ? body.secret
+            : null;
+        if (typeof secret?.value !== "string") {
+            throw new Error(`Failed to fetch secret '${name}': malformed fetch response`);
+        }
+        removeCacheEntry(cacheScope, name);
+        resolved.set(name, secret.value);
+    }
+    return resolved;
+}
+export async function loadRevealedSecrets(token, companyUid, keys, usage, options = {}) {
+    if (token.startsWith(HQ_API_KEY_PREFIX)) {
+        return loadRevealedSecretsViaApiKey(token, keys);
+    }
+    const resolved = new Map();
+    const requested = [...new Set(keys)];
+    const principalUid = cognitoCachePrincipalUid(token);
+    const cachedCandidates = new Set(principalUid
+        ? requested.filter((name) => hasCacheEntry(companyUid, name, principalUid))
+        : []);
+    try {
+        // The batch endpoint is the only non-capturing authorization path that also
+        // evaluates the supplied usage metadata. It covers warm and cold names in
+        // bounded requests, then a warm name may use its locally authenticated
+        // plaintext only when the returned version and current policy TTL agree.
+        for (let i = 0; i < requested.length; i += MAX_BATCH_NAMES) {
+            const chunk = requested.slice(i, i + MAX_BATCH_NAMES);
+            const chunkNames = new Set(chunk);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/load`,
+                method: "POST",
+                body: usage ? { names: chunk, usage } : { names: chunk },
+                signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+            });
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                const message = extractApiMessage(body, res.statusText);
+                // High-security refusal surfaced at the batch level (rather than
+                // per-name): point the caller at the sandbox/proxy and never leak
+                // plaintext. A local script attestation is not an override.
+                if (body.code === "high_security_denied" ||
+                    body.code === "high_security_sandbox_only" ||
+                    body.highSecurity === true) {
+                    throw new Error(highSecuritySandboxOnlyMessage());
+                }
+                if (isUnavailableSecretLoadHttpStatus(res.status)) {
+                    throw new SecretLoadUnavailableError(`Failed to batch-load secrets: ${message}`);
+                }
+                if (res.status >= 400 &&
+                    res.status < 500 &&
+                    typeof body.code === "string") {
+                    throw new Error(message);
+                }
+                if (res.status === 403) {
+                    throw new Error(`Failed to fetch secret '${chunk[0]}': No read permission`);
+                }
+                throw new Error(`Failed to batch-load secrets: ${message}`);
+            }
+            const data = (await res.json());
+            if (!Array.isArray(data.secrets) || !Array.isArray(data.errors)) {
+                throw new Error("Invalid secret load response from vault");
+            }
+            const errorsByName = new Map();
+            const seenNames = new Set();
+            for (const rawSecret of data.secrets) {
+                if (!rawSecret || typeof rawSecret !== "object") {
+                    throw new Error("Invalid secret load response from vault");
+                }
+                const s = rawSecret;
+                if (typeof s.name !== "string" ||
+                    !chunkNames.has(s.name) ||
+                    seenNames.has(s.name) ||
+                    (s.value != null && typeof s.value !== "string")) {
+                    throw new Error("Invalid secret load response from vault");
+                }
+                seenNames.add(s.name);
+                if (s.revokedAt != null) {
+                    errorsByName.set(s.name, {
+                        code: "revoked",
+                        message: `Secret '${s.name}' has been revoked`,
+                    });
+                    removeCacheEntry(companyUid, s.name);
+                    continue;
+                }
+                if (s.value == null) {
+                    errorsByName.set(s.name, {
+                        code: "not_returned",
+                        message: `Secret '${s.name}' has no value (reveal may not be permitted).`,
+                    });
+                    removeCacheEntry(companyUid, s.name);
+                    continue;
+                }
+                const cacheTtlMs = normalizeCacheTtlMs(s);
+                const cached = cachedCandidates.has(s.name) &&
+                    cacheTtlMs > 0 &&
+                    typeof s.version === "number" &&
+                    Number.isSafeInteger(s.version) &&
+                    s.version > 0
+                    ? readCache(companyUid, s.name, principalUid, s.version, cacheTtlMs)
+                    : null;
+                if (cached !== null) {
+                    resolved.set(s.name, cached);
+                    continue;
+                }
+                if (cacheTtlMs > 0) {
+                    if (typeof s.version === "number" &&
+                        Number.isSafeInteger(s.version) &&
+                        s.version > 0) {
+                        if (principalUid) {
+                            writeCache(companyUid, s.name, principalUid, s.value, cacheTtlMs, s.version);
+                        }
+                    }
+                    else if (principalUid) {
+                        writeCache(companyUid, s.name, principalUid, s.value, cacheTtlMs);
+                    }
+                }
+                else {
+                    removeCacheEntry(companyUid, s.name);
+                }
+                resolved.set(s.name, s.value);
+            }
+            for (const rawError of data.errors) {
+                if (!rawError || typeof rawError !== "object") {
+                    throw new Error("Invalid secret load response from vault");
+                }
+                const e = rawError;
+                if (typeof e.name !== "string" ||
+                    !chunkNames.has(e.name) ||
+                    seenNames.has(e.name) ||
+                    typeof e.code !== "string" ||
+                    (e.message !== undefined && typeof e.message !== "string")) {
+                    throw new Error("Invalid secret load response from vault");
+                }
+                seenNames.add(e.name);
+                errorsByName.set(e.name, { code: e.code, message: e.message });
+                resolved.delete(e.name);
+                removeCacheEntry(companyUid, e.name);
+            }
+            // Any requested key in this chunk the server did not return is a per-key
+            // failure — surface it with the same prefix the single-GET path used so
+            // callers (and scripts grepping stderr) see no behavior change.
+            let firstFailure = null;
+            for (const key of chunk) {
+                if (resolved.has(key))
+                    continue;
+                removeCacheEntry(companyUid, key);
+                const err = errorsByName.get(key);
+                // Every caller of loadRevealedSecrets injects or prints the plaintext
+                // locally (`secrets get --reveal`, `secrets exec`, `secrets env`). Both
+                // high-security denial shapes therefore receive the same explicit
+                // sandbox/proxy guidance, even if the caller supplied `--script`.
+                if (err?.code === "high_security_denied" ||
+                    err?.code === "high_security_sandbox_only") {
+                    firstFailure ??= new Error(highSecuritySandboxOnlyMessage(key));
+                    continue;
+                }
+                const reason = err?.code === "not_found"
+                    ? "Secret not found"
+                    : err?.code === "forbidden"
+                        ? err.message ?? "No read permission"
+                        : err?.message ?? err?.code ?? "not returned by vault";
+                firstFailure ??= new Error(`Failed to fetch secret '${key}': ${reason}`);
+            }
+            if (firstFailure) {
+                throw firstFailure;
+            }
+        }
+        return resolved;
+    }
+    catch (err) {
+        if (isSecretLoadUnavailable(err) && options.allowOfflineFallback === true) {
+            const offline = new Map();
+            for (const key of requested) {
+                const cached = cachedCandidates.has(key)
+                    ? readCache(companyUid, key, principalUid)
+                    : null;
+                if (cached === null) {
+                    // Keep the same failure behavior for a cache miss, while leaving any
+                    // still-valid entries untouched for a later retry.
+                    throw err;
+                }
+                offline.set(key, cached);
+            }
+            console.error(CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE);
+            return offline;
+        }
+        if (isSecretLoadUnavailable(err)) {
+            throw err;
+        }
+        // A transport failure, stale session, malformed response, or a later chunk
+        // failure is an explicit denial or unusable response. Evict the whole
+        // request before failing closed. Transient no-answer/5xx/429 failures above
+        // preserve entries and only use values still valid under their stored TTL.
+        for (const key of requested) {
+            removeCacheEntry(companyUid, key);
+        }
+        throw err;
+    }
+}
+/**
+ * Emit `hq secrets env` output and terminate deterministically.
+ *
+ * The process MUST exit even when the consuming pipe has gone away. The
+ * orphaned-process leak (personal/projects/hq-secrets-process-leak) was caused
+ * by relying on `process.stdout.write(payload, () => process.exit(0))`: when the
+ * parent shell reading `source <(hq secrets env …)` is killed on timeout, the
+ * stdout pipe loses its reader, the write callback never fires, `process.exit(0)`
+ * is never reached, and — because `env` forces no other exit — the process parks
+ * in `epoll_pwait(-1)` forever, reparented to PID 1. Hundreds accumulated this
+ * way, exhausting swap and driving load into triple digits.
+ *
+ * Writing synchronously to fd 1 and then exiting unconditionally removes every
+ * dependency on the event loop draining and on the reader still being attached:
+ * - a live reader receives the export lines (synchronous write reaches the
+ *   kernel pipe buffer before we exit, so nothing is truncated);
+ * - a dead reader surfaces as EPIPE, which we swallow — the secret is already
+ *   resolved and there is nothing left to deliver, so a clean exit is correct;
+ * - EAGAIN (stdout in non-blocking mode with a momentarily full buffer) is
+ *   retried a bounded number of times. `env` payloads are a few short export
+ *   lines, far under the 64 KiB pipe buffer, so this effectively never spins.
+ *
+ * `exit` and `write` are injectable for tests; production uses the real ones.
+ */
+export function emitEnvExportsAndExit(payload, exit = process.exit, write = writeSync) {
+    const buf = Buffer.from(payload, "utf8");
+    const MAX_EAGAIN_RETRIES = 10_000;
+    let offset = 0;
+    let eagainRetries = 0;
+    while (offset < buf.length) {
+        try {
+            offset += write(1, buf, offset, buf.length - offset);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "EAGAIN" && eagainRetries++ < MAX_EAGAIN_RETRIES)
+                continue;
+            // EPIPE (reader gone) or retries exhausted: the output cannot be
+            // delivered, but the process must never hang. Stop and exit cleanly.
+            break;
+        }
+    }
+    return exit(0);
+}
+/**
+ * Shared `secrets env` action for Commander and the default-off lightweight
+ * entrypoint. The fast entrypoint still runs the same credential, usage-audit,
+ * server authorization, cache-fallback, redaction, and output code.
+ */
+export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
+    let secretLoadStarted = false;
+    try {
+        const redact = process.stdout.isTTY;
+        if (redact) {
+            console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
+        }
+        const keys = parseSecretNameList(opts.only);
+        const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
+        const companyUid = cred.kind === "api-key"
+            ? "__api_key__"
+            : await getEntityUid(cred.token, scopeOpts(parentScope), {
+                allowOfflineScopeFallback: true,
+            });
+        const usage = cred.kind === "cognito"
+            ? await buildSecretUsage("env", opts.script, opts.scriptId)
+            : undefined;
+        secretLoadStarted = true;
+        const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, usage, { allowOfflineFallback: true });
+        let payload = "";
+        for (const key of keys) {
+            const value = revealed.get(key);
+            // loadRevealedSecrets throws on any unresolved key, so a miss here is
+            // unreachable — guard rather than print an `undefined` export line.
+            if (value === undefined) {
+                throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
+            }
+            const out = redact ? "[REDACTED]" : value;
+            payload += `export ${key}=${shellSingleQuote(out)}\n`;
+        }
+        // Persist an already-running company snapshot before the synchronous
+        // export write exits the process. Personal exports do not wait.
+        await finishEnvExportsAndExit(payload, undefined, process.exit, undefined, !parentScope.personal, companyUid);
+        return "handled";
+    }
+    catch (err) {
+        if (options.fallbackOnAuthFailure &&
+            !secretLoadStarted &&
+            (isAuthError(err) ||
+                (err instanceof Error &&
+                    (/^No valid HQ session\b/.test(err.message) ||
+                        /^HQ_API_KEY must start with /.test(err.message))))) {
+            return "fallback";
+        }
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+        return "handled";
+    }
+}
+//# sourceMappingURL=secrets-env-action.js.map

package/dist/secrets-env-fast-path.js

@@ -8,7 +8,7 @@ export async function runSecretsEnvFastPath(request) {
         ]);
         adoptAgentIdentityEnv(agentKitPaths(os.homedir(), process.env), process.env);
     }
-    const { runSecretsEnvCommand } = await import("./commands/secrets.js");
+    const { runSecretsEnvCommand } = await import("./secrets-env-action.js");
     return runSecretsEnvCommand(request.options, request.scope, {
         fallbackOnAuthFailure: true,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.1",
+  "version": "5.342.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {