@indigoai-us/hq-cli 5.345.170 → 5.345.171

package/dist/commands/run.js

@@ -1,3 +1,5 @@
+import { assertInjectedNamesAllowed, assertLiteralNamesAllowed, assertScriptUnchanged, planScriptBinding, selectChildLaunch } from '../utils/script-bound-exec.js';
+import { parseStrictSchemaFiles } from '../run/script-bound-schema.js';
 import { spawn } from 'node:child_process';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
@@ -33,6 +35,47 @@ export async function buildRunUsage(scriptPath, scriptId) {
         },
     };
 }
+/**
+ * `hq run --script` resolution: read the schema files strictly, fetch only the
+ * hq() secrets, and return literals plus secret values. No varlock graph.
+ */
+async function resolveStrictSchema(paths, companyUid, usage, fetchBatch) {
+    const strict = parseStrictSchemaFiles(paths);
+    // Refuse proxy, CA/TLS, pager/editor, HOME/XDG and loader names before any
+    // fetch, so a schema literal cannot redirect what the bound script calls.
+    // Literals must be on the small --script allowlist; hq() names keep the
+    // denylist check (creating a secret needs vault write).
+    assertLiteralNamesAllowed(Object.keys(strict.statics));
+    assertInjectedNamesAllowed(strict.secrets.keys());
+    const names = [...new Set(strict.secrets.values())];
+    if (names.length > 100) {
+        throw new Error(`hq run supports at most 100 hq() resolvers per schema; got ${names.length}`);
+    }
+    const values = new Map();
+    if (names.length > 0) {
+        const data = await fetchBatch(companyUid, names, usage);
+        if (!Array.isArray(data?.secrets) || !Array.isArray(data?.errors)) {
+            throw new Error('Invalid secret load response from vault');
+        }
+        const firstError = data.errors[0];
+        if (firstError) {
+            throw new Error(`Failed to fetch secret '${firstError.name}': ${firstError.message ?? firstError.code}`);
+        }
+        for (const row of data.secrets) {
+            if (row && typeof row.name === 'string' && typeof row.value === 'string' && row.revokedAt == null) {
+                values.set(row.name, row.value);
+            }
+        }
+    }
+    const env = { ...strict.statics };
+    for (const [key, name] of strict.secrets) {
+        const value = values.get(name);
+        if (value === undefined)
+            throw new Error(`Failed to fetch secret '${name}': not returned by vault`);
+        env[key] = value;
+    }
+    return env;
+}
 export function registerRunCommand(program) {
     program
         .command('run')
@@ -89,8 +132,19 @@ export function registerRunCommand(program) {
             const uid = await getCompanyUid(token, slug, undefined, {
                 allowOfflineScopeFallback: true,
             });
+            // feedback_0e6abcb8: with --script, script-locked secrets may reach
+            // only the approved script itself. Resolve the command now; a refusal
+            // is applied once the vault says which secrets are locked.
+            const scriptPlan = opts.check ? undefined : await planScriptBinding(opts.script, childArgs);
             const usage = await buildRunUsage(opts.script, opts.scriptId);
+            if (scriptPlan?.bound) {
+                await assertScriptUnchanged(scriptPlan.bound, usage?.script?.sha256);
+            }
+            const requestedNames = new Set();
+            const lockModes = new Map();
             const fetchBatch = async (companyUid, names, requestUsage) => withRunSecretReadTelemetry(companyUid, async () => {
+                for (const name of names)
+                    requestedNames.add(name);
                 const res = await vaultApiFetch({
                     token,
                     path: `/secrets/${encodeURIComponent(companyUid)}/load`,
@@ -115,7 +169,12 @@ export function registerRunCommand(program) {
                     }
                     throw new Error(`Failed to batch-load secrets: ${message}`);
                 }
-                return res.json();
+                const data = await res.json();
+                for (const row of Array.isArray(data?.secrets) ? data.secrets : []) {
+                    if (row && typeof row.name === 'string')
+                        lockModes.set(row.name, row.scriptLock?.mode);
+                }
+                return data;
             });
             const pluginOpts = {
                 companyOverride: opts.company,
@@ -127,61 +186,77 @@ export function registerRunCommand(program) {
             };
             // LAST entry = highest precedence; .env.local files trail .env.schema files so any .env.local beats any schema regardless of depth.
             const paths = [...schemaPaths, ...envLocalPaths];
-            let state;
-            const graph = await internal.loadEnvGraph({
-                entryFilePaths: paths,
-                // hq run owns its short-lived in-memory resolution. Varlock's default
-                // cache auto-detection can write ~/.config/varlock and initialize
-                // the native local-encryption helper, neither of which belongs on
-                // this command path.
-                skipCache: true,
-                afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
-            });
-            // Refuse to resolve a graph varlock never finished loading (a malformed
-            // .env.schema / .env.local): resolving an unprocessed item whose key is
-            // also in process.env reaches varlock's `expected dataType to be set`
-            // invariant as a FLOATED, never-settling rejection — the CLI then exits
-            // 0 with the command never run (HQ-CLI-W). Run this BEFORE prewarm so a
-            // bad file can never trigger a secret fetch.
-            assertEnvGraphLoaded(graph);
-            await prewarmHqSecrets(graph, pluginOpts, state);
-            // Defence in depth: convert a floated resolution rejection into a thrown
-            // error instead of hanging on varlock's never-settling promise, in case
-            // the shape-dependent guard above ever silently degrades.
-            await resolveEnvValuesOrThrow(graph);
-            // varlock's item.errors includes warning-severity entries (isWarning),
-            // e.g. "Value is very short! Is it actually sensitive?" for a short
-            // sensitive value. Print those and carry on; only real errors are fatal.
-            const schemaItems = Object.entries(graph.configSchema);
-            const itemMessages = (wantWarnings) => schemaItems.flatMap(([k, item]) => (item.errors ?? [])
-                .filter((e) => Boolean(e?.isWarning) === wantWarnings)
-                .map((e) => `  ${k}: ${e?.message ?? String(e)}`));
-            const warningMsgs = itemMessages(true);
-            if (warningMsgs.length > 0) {
-                process.stderr.write(`Warning: env var checks reported warnings:\n${warningMsgs.join('\n')}\n`);
+            let resolvedEnv;
+            if (opts.script) {
+                // feedback_0e6abcb8: with --script, never build a varlock graph. Its
+                // exec()/plugin/import resolvers would run in this process while the
+                // fetched secrets are in memory, before the script binding is
+                // checked. The strict reader accepts only hq() items and literals.
+                resolvedEnv = await resolveStrictSchema(paths, uid, usage, fetchBatch);
             }
-            const errorMsgs = itemMessages(false);
-            if (errorMsgs.length > 0) {
-                process.stderr.write(`Error: failed to resolve env vars:\n${errorMsgs.join('\n')}\n`);
-                process.exit(1);
+            else {
+                let state;
+                const graph = await internal.loadEnvGraph({
+                    entryFilePaths: paths,
+                    // hq run owns its short-lived in-memory resolution. Varlock's default
+                    // cache auto-detection can write ~/.config/varlock and initialize
+                    // the native local-encryption helper, neither of which belongs on
+                    // this command path.
+                    skipCache: true,
+                    afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
+                });
+                // Refuse to resolve a graph varlock never finished loading (a malformed
+                // .env.schema / .env.local): resolving an unprocessed item whose key is
+                // also in process.env reaches varlock's `expected dataType to be set`
+                // invariant as a FLOATED, never-settling rejection — the CLI then exits
+                // 0 with the command never run (HQ-CLI-W). Run this BEFORE prewarm so a
+                // bad file can never trigger a secret fetch.
+                assertEnvGraphLoaded(graph);
+                await prewarmHqSecrets(graph, pluginOpts, state);
+                // Defence in depth: convert a floated resolution rejection into a thrown
+                // error instead of hanging on varlock's never-settling promise, in case
+                // the shape-dependent guard above ever silently degrades.
+                await resolveEnvValuesOrThrow(graph);
+                // varlock's item.errors includes warning-severity entries (isWarning),
+                // e.g. "Value is very short! Is it actually sensitive?" for a short
+                // sensitive value. Print those and carry on; only real errors are fatal.
+                const schemaItems = Object.entries(graph.configSchema);
+                const itemMessages = (wantWarnings) => schemaItems.flatMap(([k, item]) => (item.errors ?? [])
+                    .filter((e) => Boolean(e?.isWarning) === wantWarnings)
+                    .map((e) => `  ${k}: ${e?.message ?? String(e)}`));
+                const warningMsgs = itemMessages(true);
+                if (warningMsgs.length > 0) {
+                    process.stderr.write(`Warning: env var checks reported warnings:\n${warningMsgs.join('\n')}\n`);
+                }
+                const errorMsgs = itemMessages(false);
+                if (errorMsgs.length > 0) {
+                    process.stderr.write(`Error: failed to resolve env vars:\n${errorMsgs.join('\n')}\n`);
+                    process.exit(1);
+                }
+                resolvedEnv = graph.getResolvedEnvObject();
             }
-            const resolvedEnv = graph.getResolvedEnvObject();
             const varCount = Object.keys(resolvedEnv).length;
             process.stderr.write(`Loaded ${varCount} env vars from .env.schema (company: ${slug})\n`);
             if (opts.check) {
                 process.exit(0);
             }
-            const [childCmd, ...restArgs] = childArgs;
+            // Script-locked (or unknown) secrets go only to a private, re-hashed
+            // copy of the approved script; unlocked secrets keep the command as is.
+            const launch = selectChildLaunch(scriptPlan, [...requestedNames], lockModes, usage?.script?.sha256, childArgs, process.env, resolvedEnv);
+            const childCmd = launch.file;
+            const restArgs = launch.args;
             const child = spawn(childCmd, restArgs, {
                 stdio: 'inherit',
-                env: { ...process.env, ...resolvedEnv },
+                env: launch.env,
             });
             child.once('spawn', () => releaseChildWrapperPackageUseLeaseAfterStart("childWrapper", isHqCliChild(childCmd, restArgs)));
             child.on('error', (err) => {
                 process.stderr.write(`Error: failed to start command '${childCmd}': ${err.message}\n`);
+                launch.cleanup();
                 process.exit(1);
             });
             child.on('close', (code, signal) => {
+                launch.cleanup();
                 if (signal) {
                     process.kill(process.pid, signal);
                 }

package/dist/commands/scan.d.ts

@@ -6,7 +6,10 @@
  *   hq scan secrets --json        findings as JSON
  *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
  *                                 scan files with that repo's committed
- *                                 .gitleaks.toml allowlists (used by pr-check)
+ *                                 .gitleaks.toml allowlists
+ *   hq scan secrets --range <base>[..<head>] [--repo <dir>]
+ *                                 scan the lines a branch added since <base>,
+ *                                 every commit included (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -24,6 +27,7 @@ interface ScanSecretsOptions {
     repo?: string;
     snapshotRoot?: string;
     allowlistRev?: string;
+    range?: string;
 }
 export declare function runScanSecrets(paths: string[], opts: ScanSecretsOptions, cwd?: string): number;
 export declare function registerScanCommand(program: Command): void;

package/dist/commands/scan.js

@@ -6,7 +6,10 @@
  *   hq scan secrets --json        findings as JSON
  *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
  *                                 scan files with that repo's committed
- *                                 .gitleaks.toml allowlists (used by pr-check)
+ *                                 .gitleaks.toml allowlists
+ *   hq scan secrets --range <base>[..<head>] [--repo <dir>]
+ *                                 scan the lines a branch added since <base>,
+ *                                 every commit included (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -18,6 +21,7 @@
  * Output names the rule, file and line; secret values are never printed.
  */
 import { ScanConfigError } from "../lib/secret-scan/repo-config.js";
+import { scanRange } from "../lib/secret-scan/range.js";
 import { ScanInputError, scanFiles, scanStaged } from "../lib/secret-scan/staged.js";
 function report(findings, scope) {
     if (!findings.length)
@@ -38,7 +42,14 @@ export function runScanSecrets(paths, opts, cwd = process.cwd()) {
             throw new ScanInputError("--snapshot-root needs --repo");
         if (opts.allowlistRev !== undefined && opts.repo === undefined)
             throw new ScanInputError("--allowlist-rev needs --repo");
-        findings = paths.length && !opts.staged ? scanFiles(paths, { repo: opts.repo, snapshotRoot: opts.snapshotRoot, allowlistRev: opts.allowlistRev }) : scanStaged(cwd);
+        if (opts.range !== undefined) {
+            if (paths.length || opts.staged)
+                throw new ScanInputError("--range scans a commit range; do not pass files or --staged");
+            if (opts.snapshotRoot !== undefined || opts.allowlistRev !== undefined) {
+                throw new ScanInputError("--range reads .gitleaks.toml from the range base; drop --snapshot-root and --allowlist-rev");
+            }
+        }
+        findings = opts.range !== undefined ? scanRange(opts.repo ?? cwd, opts.range) : paths.length && !opts.staged ? scanFiles(paths, { repo: opts.repo, snapshotRoot: opts.snapshotRoot, allowlistRev: opts.allowlistRev }) : scanStaged(cwd);
     }
     catch (err) {
         const msg = err instanceof ScanInputError || err instanceof ScanConfigError ? err.message : `scan failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -51,7 +62,7 @@ export function runScanSecrets(paths, opts, cwd = process.cwd()) {
         process.stdout.write(`${JSON.stringify({ ok: findings.length === 0, findings })}\n`);
     }
     else {
-        report(findings, paths.length && !opts.staged ? "the given files" : "staged changes");
+        report(findings, opts.range !== undefined ? `the lines added in ${opts.range}` : paths.length && !opts.staged ? "the given files" : "staged changes");
     }
     return findings.length ? 1 : 0;
 }
@@ -63,9 +74,10 @@ export function registerScanCommand(program) {
         .argument("[files...]", "Scan these files instead of the staged changes")
         .option("--staged", "Scan the staged changes (default when no files are given)")
         .option("--json", "Print findings as JSON")
-        .option("--repo <dir>", "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths")
+        .option("--repo <dir>", "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths. With --range: the repo to scan (default: the current directory)")
         .option("--snapshot-root <dir>", "With --repo: files under <dir>/<commit>/<path> are matched as <path>")
         .option("--allowlist-rev <rev>", "With --repo: read .gitleaks.toml from this commit instead of HEAD")
+        .option("--range <range>", "Scan the lines added in <base>..<head> (head defaults to HEAD), every commit included, with the base's .gitleaks.toml allowlists and the repo's [[rules]]")
         .action((files, opts) => {
         process.exitCode = runScanSecrets(files ?? [], opts);
     });

package/dist/commands/secrets.js

@@ -1,3 +1,4 @@
+import { assertScriptUnchanged, planScriptBinding, selectChildLaunch } from "../utils/script-bound-exec.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
@@ -77,6 +78,7 @@ import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, format
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { formatApiKeyCapabilityDenial, peekHqApiKey, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
 import { runSandboxJobAfterSubmission } from "../utils/secrets-sandbox-resident.js";
+import { renderSecretInputLink, SECRET_LINK_FORMATS, } from "../lib/secret-input-link.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 /**
  * Mirrors `RESOURCE_SURFACES` in hq-pro
@@ -1370,6 +1372,10 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
+            // feedback_0e6abcb8: with --script, a script-locked secret may reach
+            // only the approved script itself. Resolve the command now; a refusal
+            // is applied once the vault says which secrets are locked.
+            const scriptPlan = await planScriptBinding(_opts.script, childArgs);
             const parentScope = { ...secrets.opts() };
             const inheritedCompany = parentScope.company;
             let requestedCompany = _opts.company ?? inheritedCompany;
@@ -1466,9 +1472,14 @@ export function registerSecretsCommand(program) {
                     secret_names: keys,
                 });
             }
-            const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
+            const execUsage = cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
-                : undefined, { allowOfflineFallback: true });
+                : undefined;
+            if (scriptPlan?.bound) {
+                await assertScriptUnchanged(scriptPlan.bound, execUsage?.script?.sha256);
+            }
+            const lockModes = new Map();
+            const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, execUsage, { allowOfflineFallback: true, lockModes });
             // API-key auth has no signed-in person identity for the CLI telemetry
             // endpoint. Do not attribute that read to an unrelated cached session.
             let revealed;
@@ -1489,18 +1500,24 @@ export function registerSecretsCommand(program) {
                 }
                 secretEnv[key] = value;
             }
-            const [childCmd, ...childCmdArgs] = childArgs;
+            // Script-locked (or unknown) secrets go only to a private, re-hashed
+            // copy of the approved script; unlocked secrets keep the command as is.
+            const launch = selectChildLaunch(scriptPlan, keys, lockModes, execUsage?.script?.sha256, childArgs, process.env, secretEnv);
+            const childCmd = launch.file;
+            const childCmdArgs = launch.args;
             const { spawn } = await import("node:child_process");
             const child = spawn(childCmd, childCmdArgs, {
                 stdio: "inherit",
-                env: { ...process.env, ...secretEnv },
+                env: launch.env,
             });
             child.once("spawn", () => releaseChildWrapperPackageUseLeaseAfterStart("childWrapper", isHqCliChild(childCmd, childCmdArgs)));
             child.on("error", (err) => {
                 console.error(chalk.red(`Failed to start command '${childCmd}': ${err.message}`));
+                launch.cleanup();
                 process.exit(1);
             });
             child.on("close", (code, signal) => {
+                launch.cleanup();
                 if (signal) {
                     process.kill(process.pid, signal);
                 }
@@ -1525,8 +1542,19 @@ export function registerSecretsCommand(program) {
         .command("generate-link <name>")
         .description("Generate a one-time link for someone to submit a secret value")
         .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
+        .option("--format <format>", "Output format: text (default; OSC-8 hyperlink on a supporting TTY, plain URL otherwise; FORCE_HYPERLINK=1/0 overrides detection on a TTY only), markdown (one Markdown link line on stdout, details on stderr), json")
+        .option("--json", "Print { url, expiresAt, secretName } as JSON (same as --format json)")
         .action(async (name, opts) => {
         try {
+            const format = (opts.json ? "json" : (opts.format ?? "text"));
+            if (!SECRET_LINK_FORMATS.includes(format)) {
+                console.error(chalk.red(`Invalid format '${opts.format}': must be one of ${SECRET_LINK_FORMATS.join(", ")}`));
+                process.exit(1);
+            }
+            if (opts.json && opts.format !== undefined && opts.format !== "json") {
+                console.error(chalk.red(`--json conflicts with --format ${opts.format}`));
+                process.exit(1);
+            }
             if (!SECRET_NAME_PATTERN.test(name)) {
                 console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
@@ -1556,11 +1584,24 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const data = (await res.json());
-            console.log(chalk.green("Secret input link generated:"));
-            console.log(`\n  ${data.url}\n`);
-            console.log(chalk.dim(`  Secret:  ${data.secretName}`));
-            console.log(chalk.dim(`  Expires: ${data.expiresAt}`));
-            console.log(chalk.dim("  One-time use — link is invalidated after first submission."));
+            const rendered = renderSecretInputLink(data, {
+                format,
+                isTTY: process.stdout.isTTY === true,
+                env: process.env,
+            });
+            if (format === "text") {
+                const [heading, link, ...meta] = rendered.stdout;
+                console.log(chalk.green(heading));
+                console.log(link);
+                for (const line of meta)
+                    console.log(chalk.dim(line));
+            }
+            else {
+                for (const line of rendered.stdout)
+                    console.log(line);
+                for (const line of rendered.stderr)
+                    console.error(chalk.dim(line));
+            }
         }
         catch (err) {
             // Same shared plan-limit renderer as `secrets set` (see main.ts).