@indigoai-us/hq-cli 5.345.83 → 5.345.84

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.345.84] — 2026-10-11
+- `hq secrets exec` and `hq secrets env` with `HQ_API_KEY` now refuse a
+  `--company` (or `HQ_COMPANY_UID`) that the key was not minted for. They
+  exit 1 with "HQ_API_KEY belongs to a different company than <uid>". They
+  used to ignore the flag and inject the key company's same-named secret.
+  A company slug under an API key is also refused, with a request for the
+  `cmp_` uid. Without `--company`, the key's own company is used as before.
+
 ## [5.345.83] — 2026-10-11
 - HQ-root scaffolds now package the shared runtime used by generated shell forwarders.
 - Lanes hook installation now replaces stale hq-cli drain registrations across

package/dist/commands/secrets.js

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
-import { buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
+import { assertApiKeyCompany, buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
 export function readSessionCompanyLock(env = process.env) {
     const root = resolveDefaultHqRoot({ env });
@@ -1284,8 +1284,17 @@ export function registerSecretsCommand(program) {
                     ...(requestedCompany ? { requestedCompany } : {}),
                 })
                 : undefined;
+            // Without a session lock, an explicit --company / HQ_COMPANY_UID must
+            // still match the key's company: it used to be ignored, and the key's
+            // own same-named secret was injected instead.
+            const unlockedApiKeyCompanyRef = cred.kind === "api-key" && !hasLockedCompanies
+                ? requestedApiKeyCompany(requestedCompany)
+                : undefined;
             const companyUid = cred.kind === "api-key"
-                ? (apiKeyCompany?.companyUid ?? "__api_key__")
+                ? (apiKeyCompany?.companyUid
+                    ?? (unlockedApiKeyCompanyRef
+                        ? await assertApiKeyCompany(cred.token, unlockedApiKeyCompanyRef, "secrets exec")
+                        : "__api_key__"))
                 : await getEntityUid(cred.token, secretScope, { allowOfflineScopeFallback: true });
             const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)

package/dist/secrets-env-action.d.ts

@@ -57,6 +57,23 @@ export declare function normalizeScriptLockMode(mode?: string): SecretScriptLock
 export declare function extractApiMessage(body: Record<string, unknown>, fallback: string): string;
 export declare function buildSecretUsage(channel: SecretUsageChannel, scriptPath?: string, scriptId?: string, attestationLevel?: string): Promise<SecretUsage>;
 export declare function parseSecretNameList(input: string[] | undefined): string[];
+/**
+ * The company a caller explicitly asked for while authenticating with
+ * HQ_API_KEY: `--company`, else HQ_COMPANY_UID. Undefined means "the key's own
+ * company", which needs no check.
+ */
+export declare function requestedApiKeyCompany(flagCompany: string | undefined): string | undefined;
+/**
+ * Refuse an explicitly requested company that the API key is not bound to.
+ *
+ * A vault API key can only read its own company's secrets. Before this check,
+ * `hq secrets exec --company <other>` under HQ_API_KEY ignored the flag and
+ * injected the key company's same-named secret with exit 0, which read as a
+ * cross-company leak (P0 triage, 2026-10-11). The probe is the keyed list
+ * route, which the server 403s with "not scoped to this company" on mismatch.
+ * Returns the verified uid; throws before any secret is fetched otherwise.
+ */
+export declare function assertApiKeyCompany(token: string, requested: string, commandLabel: string): Promise<string>;
 export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
     allowOfflineFallback?: boolean;
 }): Promise<Map<string, string>>;

package/dist/secrets-env-action.js

@@ -7,7 +7,7 @@ import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntr
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
 import { finishEnvExportsAndExit } from "./commands/secrets-env-exit.js";
-import { getEntityUid, vaultApiFetch } from "./utils/vault-api.js";
+import { getEntityUid, looksLikeCompanyUid, vaultApiFetch } from "./utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, resolveVaultCredentialForCapability, } from "./utils/resolve-vault-credential.js";
 import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "./utils/secret-load-availability.js";
 const MAX_BATCH_NAMES = 100;
@@ -124,16 +124,22 @@ export function parseSecretNameList(input) {
 // Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
 // with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
 // path used — never swallows a failure.
-async function loadRevealedSecretsViaApiKey(token, keys) {
+//
+// When the caller names a company uid, it rides in the body so the server can
+// refuse a key bound to a different company. Without it the fetch route reads
+// from the key's own company, which made `--company <other>` silently return
+// the key company's same-named secret (P0 triage, 2026-10-11).
+async function loadRevealedSecretsViaApiKey(token, keys, companyUid) {
     const resolved = new Map();
     const requested = [...new Set(keys)];
     const cacheScope = "__api_key__";
+    const scopedCompanyUid = companyUid && looksLikeCompanyUid(companyUid) ? companyUid : undefined;
     for (const name of requested) {
         const res = await vaultApiFetch({
             token,
             path: "/v1/keys/secrets/fetch",
             method: "POST",
-            body: { name },
+            body: scopedCompanyUid ? { name, companyUid: scopedCompanyUid } : { name },
             signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
         });
         const body = (await res.json().catch(() => ({})));
@@ -168,9 +174,52 @@ async function loadRevealedSecretsViaApiKey(token, keys) {
     }
     return resolved;
 }
+/**
+ * The company a caller explicitly asked for while authenticating with
+ * HQ_API_KEY: `--company`, else HQ_COMPANY_UID. Undefined means "the key's own
+ * company", which needs no check.
+ */
+export function requestedApiKeyCompany(flagCompany) {
+    const ref = flagCompany?.trim() || process.env.HQ_COMPANY_UID?.trim();
+    return ref ? ref : undefined;
+}
+/**
+ * Refuse an explicitly requested company that the API key is not bound to.
+ *
+ * A vault API key can only read its own company's secrets. Before this check,
+ * `hq secrets exec --company <other>` under HQ_API_KEY ignored the flag and
+ * injected the key company's same-named secret with exit 0, which read as a
+ * cross-company leak (P0 triage, 2026-10-11). The probe is the keyed list
+ * route, which the server 403s with "not scoped to this company" on mismatch.
+ * Returns the verified uid; throws before any secret is fetched otherwise.
+ */
+export async function assertApiKeyCompany(token, requested, commandLabel) {
+    if (!looksLikeCompanyUid(requested)) {
+        throw new Error(`HQ_API_KEY is set; '${commandLabel}' --company must be the company uid (cmp_…) the key ` +
+            `was minted for (resolving a slug needs a Cognito session). Got '${requested}'. ` +
+            `Omit --company to use the key's own company.`);
+    }
+    const response = await vaultApiFetch({
+        token,
+        path: `/v1/keys/secrets/${encodeURIComponent(requested)}`,
+    });
+    if (response.ok)
+        return requested;
+    if (response.status === 401)
+        throw new Error("HQ_API_KEY is invalid or no longer active.");
+    const body = (await response.json().catch(() => ({})));
+    const message = typeof body.error === "string" ? body.error : "";
+    if (response.status === 403 && /not scoped to this company/i.test(message)) {
+        throw new Error(`HQ_API_KEY belongs to a different company than ${requested}. An API key can only read ` +
+            `its own company's secrets. Omit --company (and HQ_COMPANY_UID) to use the key's company, ` +
+            `or use a key minted for ${requested}.`);
+    }
+    throw new Error(`Could not verify that HQ_API_KEY belongs to ${requested} (HTTP ${response.status}` +
+        `${message ? `: ${message}` : ""}).`);
+}
 export async function loadRevealedSecrets(token, companyUid, keys, usage, options = {}) {
     if (token.startsWith(HQ_API_KEY_PREFIX)) {
-        return loadRevealedSecretsViaApiKey(token, keys);
+        return loadRevealedSecretsViaApiKey(token, keys, companyUid);
     }
     const resolved = new Map();
     const requested = [...new Set(keys)];
@@ -416,8 +465,13 @@ export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
         }
         const keys = parseSecretNameList(opts.only);
         const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
+        const apiKeyCompanyRef = cred.kind === "api-key"
+            ? requestedApiKeyCompany(parentScope.company)
+            : undefined;
         const companyUid = cred.kind === "api-key"
-            ? "__api_key__"
+            ? (apiKeyCompanyRef
+                ? await assertApiKeyCompany(cred.token, apiKeyCompanyRef, "secrets env")
+                : "__api_key__")
             : await getEntityUid(cred.token, scopeOpts(parentScope), {
                 allowOfflineScopeFallback: true,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.83",
+  "version": "5.345.84",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {