@indigoai-us/hq-cli 5.47.1 → 5.47.3

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+### Fixed
+
+- **`hq secrets exec` / `hq secrets env` load via the batch endpoint, killing
+  the spurious "Secret not found" Sentry warning (HQ-4H).** Both commands used
+  to fetch each `--only` key with a single-secret GET
+  (`/secrets/{uid}/name/{name}?reveal=true`). Every GET that 404s makes
+  vault-service capture an (unattributed) `"Secret not found"` warning — the
+  right signal for `hq secrets get <name>` (a caller that genuinely needed
+  THAT secret), but pure noise for a multi-key load where a missing / renamed
+  / rotated key is a per-key outcome the command already reports cleanly. They
+  now use the batch-load endpoint (`POST /secrets/{uid}/load`), which returns
+  `200` with a per-name `errors[]` array and never captures — the same path
+  `hq run` already uses (which is why `hq run` never tripped HQ-4H). Identical
+  UX and error text; `hq secrets get` is unchanged (its 404 is a genuine
+  signal and stays captured).
+
 ## [5.44.0]
 
 ### Added

package/dist/commands/secrets.d.ts

@@ -2,5 +2,6 @@ import { Command } from "commander";
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
+export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[]): Promise<Map<string, string>>;
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7e988c72-7dae-5ad2-aaa3-2c5b430fa5ae")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bdef03fd-2f30-5034-8f32-23a5eb77cc3d")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -124,6 +124,81 @@ function promptSecretInteractively() {
         process.stdin.resume();
     });
 }
+// Maximum names per batch-load request. Mirrors hq-pro's MAX_BATCH_NAMES so a
+// large --only list is chunked client-side rather than 400'd whole by the
+// server (the legacy per-key GET path had no such cap).
+const MAX_BATCH_NAMES = 100;
+// HQ-4H — load + decrypt secrets through the BATCH-LOAD endpoint
+// (`POST /secrets/{companyUid}/load`) instead of one single-secret GET per key.
+//
+// Every single-secret GET that 404s makes vault-service emit an unattributed
+// "Secret not found" Sentry *warning* — each `response(404, …)` is captured at
+// the response boundary (hq-pro `_error-response.ts`). That capture is the
+// right signal for `hq secrets get <name>` ("a caller genuinely needed THIS
+// secret and it was missing"), but it is pure noise for a multi-key load where
+// a missing / renamed / rotated key is a per-key outcome `exec`/`env` already
+// report cleanly to the user. The batch-load endpoint returns 200 with a
+// per-name `errors[]` array and never captures — the same path `hq run` uses,
+// which is exactly why `hq run` never contributed to HQ-4H. Routing `exec` and
+// `env` through it stops those callers from emitting the warning while keeping
+// identical UX and error text.
+//
+// Cache-first (so warm keys cost no request), chunked at MAX_BATCH_NAMES, and
+// throws on the FIRST unresolved key with the same `Failed to fetch secret
+// '<k>': <reason>` shape the per-key GET path used — never swallows a failure.
+export async function loadRevealedSecrets(token, companyUid, keys) {
+    const resolved = new Map();
+    const missing = [];
+    for (const key of keys) {
+        const cached = readCache(companyUid, key);
+        if (cached !== null) {
+            resolved.set(key, cached);
+        }
+        else if (!missing.includes(key)) {
+            missing.push(key);
+        }
+    }
+    for (let i = 0; i < missing.length; i += MAX_BATCH_NAMES) {
+        const chunk = missing.slice(i, i + MAX_BATCH_NAMES);
+        const res = await vaultApiFetch({
+            token,
+            path: `/secrets/${encodeURIComponent(companyUid)}/load`,
+            method: "POST",
+            body: { names: chunk },
+        });
+        if (!res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            throw new Error(`Failed to batch-load secrets: ${body.error ?? res.statusText}`);
+        }
+        const data = (await res.json());
+        for (const s of data.secrets ?? []) {
+            if (s.value == null) {
+                throw new Error(`Secret '${s.name}' has no value (reveal may not be permitted).`);
+            }
+            writeCache(companyUid, s.name, s.value);
+            resolved.set(s.name, s.value);
+        }
+        const errorsByName = new Map();
+        for (const e of data.errors ?? []) {
+            errorsByName.set(e.name, { code: e.code, message: e.message });
+        }
+        // Any requested key in this chunk the server did not return is a per-key
+        // failure — surface it with the same prefix the single-GET path used so
+        // callers (and scripts grepping stderr) see no behavior change.
+        for (const key of chunk) {
+            if (resolved.has(key))
+                continue;
+            const err = errorsByName.get(key);
+            const reason = err?.code === "not_found"
+                ? "Secret not found"
+                : err?.code === "forbidden"
+                    ? err.message ?? "No read permission"
+                    : err?.message ?? err?.code ?? "not returned by vault";
+            throw new Error(`Failed to fetch secret '${key}': ${reason}`);
+        }
+    }
+    return resolved;
+}
 export function registerSecretsCommand(program) {
     const secrets = program
         .command("secrets")
@@ -403,29 +478,15 @@ export function registerSecretsCommand(program) {
             }
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
-            const revealed = await Promise.all(keys.map(async (key) => {
-                const cached = readCache(companyUid, key);
-                if (cached !== null) {
-                    return { key, value: cached };
-                }
-                const res = await vaultApiFetch({
-                    token,
-                    path: buildSecretNamePath(companyUid, key),
-                    query: { reveal: "true" },
-                });
-                if (!res.ok) {
-                    const body = await res.json().catch(() => ({}));
-                    throw new Error(`Failed to fetch secret '${key}': ${body.error ?? res.statusText}`);
-                }
-                const data = (await res.json());
-                if (data.secret.value == null) {
-                    throw new Error(`Secret '${key}' has no value (reveal may not be permitted).`);
-                }
-                writeCache(companyUid, key, data.secret.value);
-                return { key, value: data.secret.value };
-            }));
+            const revealed = await loadRevealedSecrets(token, companyUid, keys);
             const secretEnv = {};
-            for (const { key, value } of revealed) {
+            for (const key of keys) {
+                const value = revealed.get(key);
+                // loadRevealedSecrets throws on any unresolved key, so a miss here is
+                // unreachable — guard rather than inject an `undefined` into the env.
+                if (value === undefined) {
+                    throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
+                }
                 secretEnv[key] = value;
             }
             const [childCmd, ...childCmdArgs] = childArgs;
@@ -472,28 +533,14 @@ export function registerSecretsCommand(program) {
             }
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
-            const revealed = await Promise.all(keys.map(async (key) => {
-                const cached = readCache(companyUid, key);
-                if (cached !== null) {
-                    return { key, value: cached };
-                }
-                const res = await vaultApiFetch({
-                    token,
-                    path: buildSecretNamePath(companyUid, key),
-                    query: { reveal: "true" },
-                });
-                if (!res.ok) {
-                    const body = await res.json().catch(() => ({}));
-                    throw new Error(`Failed to fetch secret '${key}': ${body.error ?? res.statusText}`);
-                }
-                const data = (await res.json());
-                if (data.secret.value == null) {
-                    throw new Error(`Secret '${key}' has no value (reveal may not be permitted).`);
-                }
-                writeCache(companyUid, key, data.secret.value);
-                return { key, value: data.secret.value };
-            }));
-            for (const { key, value } of revealed) {
+            const revealed = await loadRevealedSecrets(token, companyUid, keys);
+            for (const key of keys) {
+                const value = revealed.get(key);
+                // loadRevealedSecrets throws on any unresolved key, so a miss here is
+                // unreachable — guard rather than print an `undefined` export line.
+                if (value === undefined) {
+                    throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
+                }
                 const out = redact ? "[REDACTED]" : value;
                 process.stdout.write(`export ${key}=${shellSingleQuote(out)}\n`);
             }
@@ -754,4 +801,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=7e988c72-7dae-5ad2-aaa3-2c5b430fa5ae
+//# debugId=bdef03fd-2f30-5034-8f32-23a5eb77cc3d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.47.1",
+  "version": "5.47.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -15,7 +15,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "^6.11.0",
+    "@indigoai-us/hq-cloud": "^6.11.1",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",

package/src/commands/secrets.test.ts

@@ -34,9 +34,21 @@ vi.mock("../utils/vault-api.js", async (importOriginal) => {
   };
 });
 
+vi.mock("../utils/secrets-cache.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    // Default: cold cache (every key is a miss → forces a batch-load request).
+    // Tests that exercise the warm path override readCache per-case.
+    readCache: vi.fn(() => null),
+    writeCache: vi.fn(() => undefined),
+  };
+});
+
 import { Command } from "commander";
-import { registerSecretsCommand } from "./secrets.js";
+import { registerSecretsCommand, loadRevealedSecrets } from "./secrets.js";
 import { getEntityUid, vaultApiFetch } from "../utils/vault-api.js";
+import { readCache, writeCache } from "../utils/secrets-cache.js";
 
 let logSpy: MockInstance<typeof console.log>;
 let errSpy: MockInstance<typeof console.error>;
@@ -159,3 +171,118 @@ describe("secrets generate-link", () => {
     expect(errSpy).not.toHaveBeenCalled();
   });
 });
+
+// HQ-4H — `hq secrets exec`/`env` load secrets through the BATCH-LOAD endpoint
+// (`POST /secrets/{uid}/load`), which returns 200 + per-name `errors[]` and
+// never fires the server's "Secret not found" Sentry warning. The old per-key
+// path single-GET'd `/secrets/{uid}/name/{name}?reveal=true`, and EVERY such
+// 404 made vault-service capture an (unattributable) warning. These tests pin
+// that the caller no longer touches the capturing GET route — the differential
+// at the client boundary that "stops the caller from emitting the error event".
+describe("secrets exec/env batch-load (HQ-4H)", () => {
+  function jsonRes(body: unknown, status = 200): Response {
+    return new Response(JSON.stringify(body), {
+      status,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  // A path that contains the single-secret GET segment — the route whose 404
+  // fires the capture. The whole fix is that we never call it from exec/env.
+  const CAPTURING_GET = expect.objectContaining({
+    path: expect.stringContaining("/name/"),
+  });
+
+  beforeEach(() => {
+    vi.mocked(readCache).mockReturnValue(null);
+  });
+
+  it("loads via /load (POST) and never the capturing single-secret GET", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [
+          { name: "MY_KEY", value: "v1" },
+          { name: "OTHER", value: "v2" },
+        ],
+        errors: [],
+      }),
+    );
+
+    const out = await loadRevealedSecrets("test-token", "prs_alice", [
+      "MY_KEY",
+      "OTHER",
+    ]);
+
+    expect(out.get("MY_KEY")).toBe("v1");
+    expect(out.get("OTHER")).toBe("v2");
+    expect(vaultApiFetch).toHaveBeenCalledTimes(1);
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/load",
+      method: "POST",
+      body: { names: ["MY_KEY", "OTHER"] },
+    });
+    // The crux: the capturing GET route is never touched.
+    expect(vaultApiFetch).not.toHaveBeenCalledWith(CAPTURING_GET);
+    expect(writeCache).toHaveBeenCalledWith("prs_alice", "MY_KEY", "v1");
+    expect(writeCache).toHaveBeenCalledWith("prs_alice", "OTHER", "v2");
+  });
+
+  it("a missing key fails cleanly WITHOUT hitting the GET-404 capture path", async () => {
+    // Batch-load reports absence as a 200 body `errors[]` entry — no 404, no
+    // server capture. The old code GET'd `/name/MISSING` → 404 → warning.
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [],
+        errors: [{ name: "MISSING", code: "not_found" }],
+      }),
+    );
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", ["MISSING"]),
+    ).rejects.toThrow("Failed to fetch secret 'MISSING': Secret not found");
+
+    expect(vaultApiFetch).toHaveBeenCalledTimes(1);
+    expect(vaultApiFetch).toHaveBeenCalledWith(
+      expect.objectContaining({ path: "/secrets/prs_alice/load", method: "POST" }),
+    );
+    expect(vaultApiFetch).not.toHaveBeenCalledWith(CAPTURING_GET);
+  });
+
+  it("a forbidden key surfaces as a clean per-key error", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [],
+        errors: [
+          { name: "LOCKED", code: "forbidden", message: "No read permission" },
+        ],
+      }),
+    );
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", ["LOCKED"]),
+    ).rejects.toThrow("Failed to fetch secret 'LOCKED': No read permission");
+    expect(vaultApiFetch).not.toHaveBeenCalledWith(CAPTURING_GET);
+  });
+
+  it("warm-cache keys cost no request at all", async () => {
+    vi.mocked(readCache).mockReturnValue("cached-value");
+
+    const out = await loadRevealedSecrets("test-token", "prs_alice", [
+      "CACHED",
+    ]);
+
+    expect(out.get("CACHED")).toBe("cached-value");
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("a non-2xx batch response throws the batch-load error", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ error: "Internal server error" }, 500),
+    );
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", ["K"]),
+    ).rejects.toThrow("Failed to batch-load secrets: Internal server error");
+  });
+});

package/src/commands/secrets.ts

@@ -152,6 +152,97 @@ function promptSecretInteractively(): Promise<string> {
   });
 }
 
+// Maximum names per batch-load request. Mirrors hq-pro's MAX_BATCH_NAMES so a
+// large --only list is chunked client-side rather than 400'd whole by the
+// server (the legacy per-key GET path had no such cap).
+const MAX_BATCH_NAMES = 100;
+
+// HQ-4H — load + decrypt secrets through the BATCH-LOAD endpoint
+// (`POST /secrets/{companyUid}/load`) instead of one single-secret GET per key.
+//
+// Every single-secret GET that 404s makes vault-service emit an unattributed
+// "Secret not found" Sentry *warning* — each `response(404, …)` is captured at
+// the response boundary (hq-pro `_error-response.ts`). That capture is the
+// right signal for `hq secrets get <name>` ("a caller genuinely needed THIS
+// secret and it was missing"), but it is pure noise for a multi-key load where
+// a missing / renamed / rotated key is a per-key outcome `exec`/`env` already
+// report cleanly to the user. The batch-load endpoint returns 200 with a
+// per-name `errors[]` array and never captures — the same path `hq run` uses,
+// which is exactly why `hq run` never contributed to HQ-4H. Routing `exec` and
+// `env` through it stops those callers from emitting the warning while keeping
+// identical UX and error text.
+//
+// Cache-first (so warm keys cost no request), chunked at MAX_BATCH_NAMES, and
+// throws on the FIRST unresolved key with the same `Failed to fetch secret
+// '<k>': <reason>` shape the per-key GET path used — never swallows a failure.
+export async function loadRevealedSecrets(
+  token: string,
+  companyUid: string,
+  keys: string[],
+): Promise<Map<string, string>> {
+  const resolved = new Map<string, string>();
+  const missing: string[] = [];
+  for (const key of keys) {
+    const cached = readCache(companyUid, key);
+    if (cached !== null) {
+      resolved.set(key, cached);
+    } else if (!missing.includes(key)) {
+      missing.push(key);
+    }
+  }
+
+  for (let i = 0; i < missing.length; i += MAX_BATCH_NAMES) {
+    const chunk = missing.slice(i, i + MAX_BATCH_NAMES);
+    const res = await vaultApiFetch({
+      token,
+      path: `/secrets/${encodeURIComponent(companyUid)}/load`,
+      method: "POST",
+      body: { names: chunk },
+    });
+    if (!res.ok) {
+      const body = (await res.json().catch(() => ({}))) as Record<string, string>;
+      throw new Error(
+        `Failed to batch-load secrets: ${body.error ?? res.statusText}`,
+      );
+    }
+    const data = (await res.json()) as {
+      secrets: Array<{ name: string; value?: string }>;
+      errors: Array<{ name: string; code: string; message?: string }>;
+    };
+
+    for (const s of data.secrets ?? []) {
+      if (s.value == null) {
+        throw new Error(
+          `Secret '${s.name}' has no value (reveal may not be permitted).`,
+        );
+      }
+      writeCache(companyUid, s.name, s.value);
+      resolved.set(s.name, s.value);
+    }
+
+    const errorsByName = new Map<string, { code: string; message?: string }>();
+    for (const e of data.errors ?? []) {
+      errorsByName.set(e.name, { code: e.code, message: e.message });
+    }
+    // Any requested key in this chunk the server did not return is a per-key
+    // failure — surface it with the same prefix the single-GET path used so
+    // callers (and scripts grepping stderr) see no behavior change.
+    for (const key of chunk) {
+      if (resolved.has(key)) continue;
+      const err = errorsByName.get(key);
+      const reason =
+        err?.code === "not_found"
+          ? "Secret not found"
+          : err?.code === "forbidden"
+            ? err.message ?? "No read permission"
+            : err?.message ?? err?.code ?? "not returned by vault";
+      throw new Error(`Failed to fetch secret '${key}': ${reason}`);
+    }
+  }
+
+  return resolved;
+}
+
 export function registerSecretsCommand(program: Command): void {
   const secrets = program
     .command("secrets")
@@ -527,36 +618,16 @@ export function registerSecretsCommand(program: Command): void {
           scopeOpts(secrets.opts()),
         );
 
-        const revealed = await Promise.all(
-          keys.map(async (key) => {
-            const cached = readCache(companyUid, key);
-            if (cached !== null) {
-              return { key, value: cached };
-            }
-            const res = await vaultApiFetch({
-              token,
-              path: buildSecretNamePath(companyUid, key),
-              query: { reveal: "true" },
-            });
-            if (!res.ok) {
-              const body = await res.json().catch(() => ({}));
-              throw new Error(
-                `Failed to fetch secret '${key}': ${(body as Record<string, string>).error ?? res.statusText}`,
-              );
-            }
-            const data = (await res.json()) as {
-              secret: { name: string; value?: string };
-            };
-            if (data.secret.value == null) {
-              throw new Error(`Secret '${key}' has no value (reveal may not be permitted).`);
-            }
-            writeCache(companyUid, key, data.secret.value);
-            return { key, value: data.secret.value };
-          }),
-        );
+        const revealed = await loadRevealedSecrets(token, companyUid, keys);
 
         const secretEnv: Record<string, string> = {};
-        for (const { key, value } of revealed) {
+        for (const key of keys) {
+          const value = revealed.get(key);
+          // loadRevealedSecrets throws on any unresolved key, so a miss here is
+          // unreachable — guard rather than inject an `undefined` into the env.
+          if (value === undefined) {
+            throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
+          }
           secretEnv[key] = value;
         }
 
@@ -620,35 +691,15 @@ export function registerSecretsCommand(program: Command): void {
           scopeOpts(secrets.opts()),
         );
 
-        const revealed = await Promise.all(
-          keys.map(async (key) => {
-            const cached = readCache(companyUid, key);
-            if (cached !== null) {
-              return { key, value: cached };
-            }
-            const res = await vaultApiFetch({
-              token,
-              path: buildSecretNamePath(companyUid, key),
-              query: { reveal: "true" },
-            });
-            if (!res.ok) {
-              const body = await res.json().catch(() => ({}));
-              throw new Error(
-                `Failed to fetch secret '${key}': ${(body as Record<string, string>).error ?? res.statusText}`,
-              );
-            }
-            const data = (await res.json()) as {
-              secret: { name: string; value?: string };
-            };
-            if (data.secret.value == null) {
-              throw new Error(`Secret '${key}' has no value (reveal may not be permitted).`);
-            }
-            writeCache(companyUid, key, data.secret.value);
-            return { key, value: data.secret.value };
-          }),
-        );
+        const revealed = await loadRevealedSecrets(token, companyUid, keys);
 
-        for (const { key, value } of revealed) {
+        for (const key of keys) {
+          const value = revealed.get(key);
+          // loadRevealedSecrets throws on any unresolved key, so a miss here is
+          // unreachable — guard rather than print an `undefined` export line.
+          if (value === undefined) {
+            throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
+          }
           const out = redact ? "[REDACTED]" : value;
           process.stdout.write(`export ${key}=${shellSingleQuote(out)}\n`);
         }