@indigoai-us/hq-cli 5.345.149 → 5.345.151

package/dist/commands/secrets.js

@@ -60,7 +60,7 @@ import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
 import { secretsExecChildExitCode } from "../utils/child-wrapper-exit.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
-import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
+import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN, OUTPOST_UID_PATTERN, } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
@@ -277,7 +277,7 @@ function promptSecretInteractively() {
         process.stdin.resume();
     });
 }
-function parseSecretAclPrincipal(principal) {
+export function parseSecretAclPrincipal(principal) {
     const p = principal.trim();
     if (p === "@all") {
         // Company-wide grant: every active member of the company. The server
@@ -290,7 +290,12 @@ function parseSecretAclPrincipal(principal) {
     if (GROUP_ID_PATTERN.test(p)) {
         return { granteeType: "group", granteeId: p };
     }
-    console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, or a group id matching grp_<alphanumeric, underscore, hyphen>`));
+    if (OUTPOST_UID_PATTERN.test(p)) {
+        // The company Outpost rides the person grantee slot; the server checks
+        // that this id is the company's active Outpost.
+        return { granteeType: "person", granteeId: p };
+    }
+    console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a group id matching grp_<alphanumeric, underscore, hyphen>, or a company Outpost id (out_…)`));
     return null;
 }
 function describeSecretAclPrincipal(principal) {
@@ -1312,8 +1317,8 @@ export function registerSecretsCommand(program) {
     });
     secrets
         .command("share <path>")
-        .description("Share a secret with an email address, group, or the entire company (@all)")
-        .requiredOption("--with <principal>", "Email address, group id, or @all (entire company) to share with")
+        .description("Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)")
+        .requiredOption("--with <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to share with")
         .requiredOption("--permission <level>", "Permission level: read | write | admin")
         .action(async (path, opts) => {
         try {
@@ -1376,7 +1381,7 @@ export function registerSecretsCommand(program) {
     secrets
         .command("unshare <path>")
         .description("Remove a grant from a secret")
-        .requiredOption("--from <principal>", "Email address, group id, or @all (entire company) to remove")
+        .requiredOption("--from <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to remove")
         .action(async (path, opts) => {
         try {
             rejectIfPersonal(secrets.opts(), "unshare");