@indigoai-us/hq-cli 5.47.9 → 5.47.11

package/dist/utils/secrets-cache.js

@@ -1,15 +1,20 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="263d7b10-622e-56c3-8c82-ebb294510b1b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fd3738da-3061-5784-bb7c-02021291aecc")}catch(e){}}();
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 const CACHE_DIR = path.join(os.homedir(), ".hq", "secrets-cache");
 const KEY_PATH = path.join(CACHE_DIR, ".key");
-const TTL_MS = 5 * 60 * 1000;
+const CACHE_FORMAT_MAGIC = Buffer.from("HQSC");
+const CACHE_FORMAT_MAGIC_BYTES = CACHE_FORMAT_MAGIC.length;
+const LEGACY_TIMESTAMP_BYTES = 8;
+const TIMESTAMP_BYTES = 8;
+const TTL_BYTES = 8;
 const ALGORITHM = "aes-256-gcm";
 const IV_BYTES = 12;
 const AUTH_TAG_BYTES = 16;
+export const DEFAULT_SECRETS_CACHE_TTL_MS = 5 * 60 * 1000;
 function ensureCacheDir(companyUid) {
     const dir = path.join(CACHE_DIR, companyUid);
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -53,21 +58,40 @@ export function readCache(companyUid, name) {
     catch {
         return null;
     }
-    // Format: [8 bytes timestamp][12 bytes IV][16 bytes authTag][...ciphertext]
-    const headerLen = 8 + IV_BYTES + AUTH_TAG_BYTES;
-    if (raw.length < headerLen)
-        return null;
-    const timestampMs = Number(raw.readBigInt64BE(0));
-    if (Date.now() - timestampMs > TTL_MS) {
+    let timestampMs;
+    let ttlMs;
+    let ivStart;
+    let authTagStart;
+    let ciphertextStart;
+    if (raw.length >=
+        CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES + TTL_BYTES + IV_BYTES + AUTH_TAG_BYTES &&
+        raw.subarray(0, CACHE_FORMAT_MAGIC_BYTES).equals(CACHE_FORMAT_MAGIC)) {
+        timestampMs = Number(raw.readBigInt64BE(CACHE_FORMAT_MAGIC_BYTES));
+        ttlMs = Number(raw.readBigInt64BE(CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES));
+        ivStart = CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES + TTL_BYTES;
+        authTagStart = ivStart + IV_BYTES;
+        ciphertextStart = authTagStart + AUTH_TAG_BYTES;
+    }
+    else {
+        const headerLen = LEGACY_TIMESTAMP_BYTES + IV_BYTES + AUTH_TAG_BYTES;
+        if (raw.length < headerLen)
+            return null;
+        timestampMs = Number(raw.readBigInt64BE(0));
+        ttlMs = DEFAULT_SECRETS_CACHE_TTL_MS;
+        ivStart = LEGACY_TIMESTAMP_BYTES;
+        authTagStart = ivStart + IV_BYTES;
+        ciphertextStart = authTagStart + AUTH_TAG_BYTES;
+    }
+    if (ttlMs <= 0 || Date.now() - timestampMs > ttlMs) {
         try {
             fs.unlinkSync(filePath);
         }
         catch { /* ok */ }
         return null;
     }
-    const iv = raw.subarray(8, 8 + IV_BYTES);
-    const authTag = raw.subarray(8 + IV_BYTES, headerLen);
-    const ciphertext = raw.subarray(headerLen);
+    const iv = raw.subarray(ivStart, authTagStart);
+    const authTag = raw.subarray(authTagStart, ciphertextStart);
+    const ciphertext = raw.subarray(ciphertextStart);
     let key;
     try {
         key = getOrCreateKey();
@@ -89,10 +113,12 @@ export function readCache(companyUid, name) {
         return null;
     }
 }
-export function writeCache(companyUid, name, value) {
+export function writeCache(companyUid, name, value, ttlMs = DEFAULT_SECRETS_CACHE_TTL_MS) {
     try {
         if (!validateInputs(companyUid, name))
             return;
+        if (ttlMs <= 0)
+            return;
         ensureCacheDir(companyUid);
         const key = getOrCreateKey();
         const iv = crypto.randomBytes(IV_BYTES);
@@ -101,7 +127,9 @@ export function writeCache(companyUid, name, value) {
         const authTag = cipher.getAuthTag();
         const timestamp = Buffer.alloc(8);
         timestamp.writeBigInt64BE(BigInt(Date.now()));
-        const out = Buffer.concat([timestamp, iv, authTag, encrypted]);
+        const ttl = Buffer.alloc(8);
+        ttl.writeBigInt64BE(BigInt(ttlMs));
+        const out = Buffer.concat([CACHE_FORMAT_MAGIC, timestamp, ttl, iv, authTag, encrypted]);
         const filePath = path.join(CACHE_DIR, companyUid, name);
         fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
         const tmpPath = `${filePath}.tmp.${process.pid}`;
@@ -135,4 +163,4 @@ export function clearAllCache() {
     return { removed };
 }
 //# sourceMappingURL=secrets-cache.js.map
-//# debugId=263d7b10-622e-56c3-8c82-ebb294510b1b
+//# debugId=fd3738da-3061-5784-bb7c-02021291aecc

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.47.9",
+  "version": "5.47.11",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/members.test.ts

@@ -1,5 +1,5 @@
 /**
- * Unit tests for `hq members invite|list|revoke` (members.ts).
+ * Unit tests for `hq members invite|list|revoke|set-role` (members.ts).
  *
  * Coverage:
  *   - detectTarget — pure validation for email vs personUid vs invalid
@@ -7,10 +7,31 @@
  *   - inviteMember — email + personUid targets, --paths gating, HTTP errors
  *   - listPendingInvites — happy path + 403
  *   - revokeInvite — happy path + 404
+ *   - set-role CLI surface — forwards membershipKey/newRole and surfaces 403
  */
 
+import { Command } from "commander";
 import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from "vitest";
 
+vi.mock("../utils/cognito-session.js", async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import("../utils/cognito-session.js")>();
+  return {
+    ...original,
+    ensureCognitoToken: vi.fn(async () => "test-token"),
+  };
+});
+
+vi.mock("../utils/vault-api.js", async (importOriginal) => {
+  const original = await importOriginal<typeof import("../utils/vault-api.js")>();
+  return {
+    ...original,
+    getCompanyUid: vi.fn(async () => "cmp_acme"),
+  };
+});
+
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { getCompanyUid } from "../utils/vault-api.js";
 import {
   InviteHttpError,
   detectTarget,
@@ -18,6 +39,7 @@ import {
   getCallerPersonUid,
   inviteMember,
   listPendingInvites,
+  registerMembersCommand,
   resendInvite,
   resolveRevokeTargetToMembershipKey,
   revokeInvite,
@@ -31,15 +53,27 @@ function jsonResponse(status: number, body: unknown): Response {
 }
 
 let fetchSpy: MockInstance<typeof fetch>;
+const mockEnsureCognitoToken = vi.mocked(ensureCognitoToken);
+const mockGetCompanyUid = vi.mocked(getCompanyUid);
 
 beforeEach(() => {
+  vi.clearAllMocks();
   fetchSpy = vi.spyOn(globalThis, "fetch");
+  mockEnsureCognitoToken.mockResolvedValue("test-token");
+  mockGetCompanyUid.mockResolvedValue("cmp_acme");
 });
 
 afterEach(() => {
   vi.restoreAllMocks();
 });
 
+function buildMembersProgram(): Command {
+  const program = new Command();
+  program.name("hq").exitOverride();
+  registerMembersCommand(program);
+  return program;
+}
+
 // ---------------------------------------------------------------------------
 // detectTarget
 // ---------------------------------------------------------------------------
@@ -731,6 +765,63 @@ describe("revokeInvite", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// registerMembersCommand set-role
+// ---------------------------------------------------------------------------
+
+describe("registerMembersCommand set-role", () => {
+  it("forwards membershipKey + newRole to /membership/role", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    await buildMembersProgram().parseAsync(
+      ["members", "--company", "acme", "set-role", "agt_ops#cmp_acme", "admin"],
+      { from: "user" },
+    );
+
+    expect(mockEnsureCognitoToken).toHaveBeenCalledTimes(1);
+    expect(mockGetCompanyUid).toHaveBeenCalledWith("test-token", "acme");
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+
+    const call = fetchSpy.mock.calls[0];
+    expect(String(call[0])).toMatch(/\/membership\/role$/);
+    expect(call[1]?.method).toBe("POST");
+    const body = JSON.parse((call[1]?.body as string) ?? "{}");
+    expect(body).toEqual({
+      companyUid: "cmp_acme",
+      membershipKey: "agt_ops#cmp_acme",
+      newRole: "admin",
+    });
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Updated role for 'agt_ops#cmp_acme' to admin"),
+    );
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+
+  it("surfaces a backend 403 verbatim and exits non-zero", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(403, { error: "Only owners can change member roles." }),
+    );
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+    vi.spyOn(console, "log").mockImplementation(() => undefined);
+    vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+      throw new Error(`__EXIT__:${code ?? 0}`);
+    }) as never);
+
+    await expect(
+      buildMembersProgram().parseAsync(
+        ["members", "--company", "acme", "set-role", "agt_ops#cmp_acme", "admin"],
+        { from: "user" },
+      ),
+    ).rejects.toThrow("__EXIT__:1");
+
+    expect(errSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Only owners can change member roles."),
+    );
+  });
+});
+
 // ---------------------------------------------------------------------------
 // resolveRevokeTargetToMembershipKey
 // ---------------------------------------------------------------------------

package/src/commands/members.ts

@@ -6,8 +6,10 @@ import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 export const VALID_ROLES = new Set(["owner", "admin", "member", "guest"]);
+const VALID_MEMBER_SET_ROLES = new Set(["admin", "member"]);
 
 export type Role = "owner" | "admin" | "member" | "guest";
+type MemberSetRole = "admin" | "member";
 
 export interface PendingInvite {
   membershipKey: string;
@@ -455,12 +457,71 @@ export async function revokeInvite(
   }
 }
 
+async function setMemberRole(
+  token: string,
+  companyUid: string,
+  membershipKey: string,
+  newRole: MemberSetRole,
+): Promise<void> {
+  if (!VALID_MEMBER_SET_ROLES.has(newRole)) {
+    throw new Error(
+      `Invalid role '${newRole}': must be one of admin, member`,
+    );
+  }
+
+  const res = await vaultApiFetch({
+    token,
+    path: "/membership/role",
+    method: "POST",
+    body: { companyUid, membershipKey, newRole },
+  });
+  if (!res.ok) {
+    const err = (await res.json().catch(() => ({}))) as Record<string, string>;
+    throw new InviteHttpError(
+      res.status,
+      err.message ?? err.error ?? res.statusText,
+      err.code,
+    );
+  }
+}
+
 export function registerMembersCommand(program: Command): void {
   const members = program
     .command("members")
     .description("Manage company memberships and invites")
     .option("--company <slug>", "Company slug (resolves to companyUid)");
 
+  members
+    .command("set-role <membershipKey> <role>")
+    .description("Change a member or agent role to admin or member")
+    .action(async (membershipKey: string, role: string) => {
+      try {
+        const token = await ensureCognitoToken();
+        const companySlug = members.opts().company as string | undefined;
+        const companyUid = await getCompanyUid(token, companySlug);
+
+        await setMemberRole(
+          token,
+          companyUid,
+          membershipKey,
+          role as MemberSetRole,
+        );
+        console.log(
+          chalk.green(`Updated role for '${membershipKey}' to ${role}`),
+        );
+      } catch (err) {
+        if (err instanceof InviteHttpError) {
+          console.error(chalk.red(err.message));
+          process.exit(1);
+        }
+        console.error(
+          chalk.red("Error:"),
+          err instanceof Error ? err.message : String(err),
+        );
+        process.exit(1);
+      }
+    });
+
   members
     .command("invite <target>")
     .description(

package/src/commands/run.env-local.test.ts

@@ -9,6 +9,7 @@ import { installHqPlugin, prewarmHqSecrets, type PluginState } from '../run/hq-p
 vi.mock('../utils/secrets-cache.js', () => {
   const store = new Map<string, string>();
   return {
+    DEFAULT_SECRETS_CACHE_TTL_MS: 300000,
     readCache: (uid: string, name: string): string | null =>
       store.get(`${uid}\0${name}`) ?? null,
     writeCache: (uid: string, name: string, value: string): void => {
@@ -46,7 +47,10 @@ test('.env.local overrides hq()-resolved value', async () => {
     // fetchBatch returns "vault-value" — if .env.local is correctly wired,
     // graph resolution should still surface "local-value" because the local
     // file wins precedence.
-    fetchBatch: async () => ({ secrets: [{ name: 'KEY', value: 'vault-value' }], errors: [] }),
+    fetchBatch: async () => ({
+      secrets: [{ name: 'KEY', value: 'vault-value', cacheTtlMs: 0 }],
+      errors: [],
+    }),
   };
 
   let state!: PluginState;

package/src/commands/run.ts

@@ -4,9 +4,27 @@ import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { internal } from 'varlock';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { computeSha256 } from '../utils/integrity.js';
 import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
 import { discoverSchemas } from '../run/discover-schemas.js';
 import { installHqPlugin, prewarmHqSecrets, type PluginState, type InstallHqPluginOpts } from '../run/hq-plugin.js';
+import type { SecretLoadResponse, SecretUsage } from './secrets.js';
+
+async function buildRunUsage(scriptPath?: string): Promise<SecretUsage | undefined> {
+  if (!scriptPath) {
+    return undefined;
+  }
+  const resolvedPath = path.resolve(scriptPath);
+  return {
+    channel: 'run',
+    script: {
+      scriptId: resolvedPath,
+      path: resolvedPath,
+      sha256: await computeSha256(resolvedPath),
+      attestationLevel: 'self-asserted-hash',
+    },
+  };
+}
 
 export function registerRunCommand(program: Command): void {
   program
@@ -14,9 +32,10 @@ export function registerRunCommand(program: Command): void {
     .description('Load secrets from .env.schema and run a command with them injected')
     .option('--company <slug>', 'Company slug (overrides @hqCompany in schema)')
     .option('--schema <path>', 'Explicit schema path (skips walk-up discovery)')
+    .option('--script <path>', 'Attach local script identity for script-locked secrets')
     .option('--check', 'Resolve schema and validate vars without executing the command')
     .allowUnknownOption(true)
-    .action(async (opts: { company?: string; schema?: string; check?: boolean }) => {
+    .action(async (opts: { company?: string; schema?: string; script?: string; check?: boolean }) => {
       try {
         const dashIndex = process.argv.indexOf('--');
         const childArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : [];
@@ -59,27 +78,39 @@ export function registerRunCommand(program: Command): void {
 
         const token = await ensureCognitoToken();
         const uid = await getCompanyUid(token, slug);
+        const usage = await buildRunUsage(opts.script);
 
-        const fetchBatch: InstallHqPluginOpts['fetchBatch'] = async (companyUid, names) => {
+        const fetchBatch: InstallHqPluginOpts['fetchBatch'] = async (companyUid, names, requestUsage) => {
           const res = await vaultApiFetch({
             token,
             path: `/secrets/${encodeURIComponent(companyUid)}/load`,
             method: 'POST',
-            body: { names },
+            body: requestUsage ? { names, usage: requestUsage } : { names },
           });
           if (!res.ok) {
-            const body = await res.json().catch(() => ({})) as Record<string, string>;
-            throw new Error(`Failed to batch-load secrets: ${body.error ?? res.statusText}`);
+            const body = await res.json().catch(() => ({})) as Record<string, unknown>;
+            const message =
+              typeof body.message === 'string'
+                ? body.message
+                : typeof body.error === 'string'
+                  ? body.error
+                  : res.statusText;
+            if (
+              res.status >= 400 &&
+              res.status < 500 &&
+              typeof body.code === 'string'
+            ) {
+              throw new Error(message);
+            }
+            throw new Error(`Failed to batch-load secrets: ${message}`);
           }
-          return res.json() as Promise<{
-            secrets: Array<{ name: string; value: string }>;
-            errors: Array<{ name: string; code: string; message?: string }>;
-          }>;
+          return res.json() as Promise<SecretLoadResponse>;
         };
 
         const pluginOpts: InstallHqPluginOpts = {
           companyOverride: opts.company,
           resolveCompanyUid: async () => uid,
+          usage,
           fetchBatch,
         };