@indigoai-us/hq-cli 5.56.0 → 5.57.0

package/src/commands/meetings.ts

@@ -150,8 +150,13 @@ function printMeetingTable(meetings: MeetingListItem[]): void {
     return;
   }
 
+  // Titles can come back null/undefined from the API even though the type says
+  // string; fall back to a placeholder so width calc + rendering never crash on
+  // `undefined.length`.
+  const displayTitle = (m: MeetingListItem): string => m.title ?? "(untitled)";
+
   const ID_W = 8;
-  const TITLE_W = Math.min(40, Math.max(10, ...meetings.map((m) => m.title.length)));
+  const TITLE_W = Math.min(40, Math.max(10, ...meetings.map((m) => displayTitle(m).length)));
   const DATE_W = 16;
   const DUR_W = 8;
   const STATUS_W = 12;
@@ -174,7 +179,8 @@ function printMeetingTable(meetings: MeetingListItem[]): void {
 
   for (const m of meetings) {
     const id = m.meetingId.slice(0, 8);
-    const title = m.title.length > TITLE_W ? m.title.slice(0, TITLE_W - 1) + "…" : m.title;
+    const fullTitle = displayTitle(m);
+    const title = fullTitle.length > TITLE_W ? fullTitle.slice(0, TITLE_W - 1) + "…" : fullTitle;
     const date = new Date(m.startTime).toLocaleDateString("en-US", {
       month: "short",
       day: "numeric",

package/src/commands/secrets.test.ts

@@ -56,10 +56,16 @@ vi.mock("node:child_process", () => ({
 }));
 
 import { Command } from "commander";
-import { registerSecretsCommand, loadRevealedSecrets } from "./secrets.js";
+import {
+  registerSecretsCommand,
+  loadRevealedSecrets,
+  type SecretUsageChannel,
+} from "./secrets.js";
 import { spawn } from "node:child_process";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { getEntityUid, vaultApiFetch } from "../utils/vault-api.js";
 import { readCache, writeCache } from "../utils/secrets-cache.js";
+import { SandboxRunnerClient } from "../utils/sandbox-runner-client.js";
 
 let logSpy: MockInstance<typeof console.log>;
 let errSpy: MockInstance<typeof console.error>;
@@ -95,6 +101,193 @@ function jsonRes(body: unknown, status = 200): Response {
   });
 }
 
+describe("secrets sandbox", () => {
+  let stdoutSpy: MockInstance<typeof process.stdout.write>;
+  let stderrSpy: MockInstance<typeof process.stderr.write>;
+  let startJobSpy: MockInstance<SandboxRunnerClient["startJob"]>;
+  let pollJobSpy: MockInstance<SandboxRunnerClient["pollJob"]>;
+  let getJobSpy: MockInstance<SandboxRunnerClient["getJob"]>;
+
+  beforeEach(() => {
+    stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+    stderrSpy = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    startJobSpy = vi
+      .spyOn(SandboxRunnerClient.prototype, "startJob")
+      .mockResolvedValue({ jobId: "job_123", status: "queued" });
+    pollJobSpy = vi
+      .spyOn(SandboxRunnerClient.prototype, "pollJob")
+      .mockResolvedValue({
+        jobId: "job_123",
+        status: "succeeded",
+        stdout: "done\n",
+      });
+    getJobSpy = vi.spyOn(SandboxRunnerClient.prototype, "getJob");
+  });
+
+  it("registers the sandbox channel value", () => {
+    const channel: SecretUsageChannel = "sandbox";
+    expect(channel).toBe("sandbox");
+  });
+
+  it("parses --company, --only, and the -- <skill> separator", async () => {
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "sandbox",
+      "--company",
+      "acme",
+      "--only",
+      "API_KEY,OTHER_KEY",
+      "--",
+      "pull-triple-whale",
+      "--days",
+      "7",
+    ]);
+
+    expect(startJobSpy).toHaveBeenCalledWith("test-token", {
+      skillId: "pull-triple-whale",
+      companyUid: "prs_alice",
+      args: { argv: ["--days", "7"] },
+      companySlug: "acme",
+      only: ["API_KEY", "OTHER_KEY"],
+      usage: { channel: "sandbox" },
+    });
+    expect(stdoutSpy).toHaveBeenCalledWith("done\n");
+  });
+
+  it("resolves identity before posting the runner job", async () => {
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "--company",
+      "parent-co",
+      "sandbox",
+      "--",
+      "my-skill",
+    ]);
+
+    expect(ensureCognitoToken).toHaveBeenCalled();
+    expect(getEntityUid).toHaveBeenCalledWith("test-token", {
+      personal: false,
+      companySlug: "parent-co",
+    });
+    expect(startJobSpy).toHaveBeenCalledWith(
+      "test-token",
+      expect.objectContaining({
+        skillId: "my-skill",
+        companyUid: "prs_alice",
+        companySlug: "parent-co",
+        usage: { channel: "sandbox" },
+      }),
+    );
+  });
+
+  it("can attach script attestation metadata to sandbox usage", async () => {
+    const scriptPath = join(tempDir, "sandbox-script.sh");
+    const scriptBody = "#!/usr/bin/env bash\necho sandbox\n";
+    writeFileSync(scriptPath, scriptBody);
+    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "sandbox",
+      "--script",
+      scriptPath,
+      "--",
+      "my-skill",
+    ]);
+
+    expect(startJobSpy).toHaveBeenCalledWith(
+      "test-token",
+      expect.objectContaining({
+        usage: {
+          channel: "sandbox",
+          script: {
+            scriptId: scriptPath,
+            path: scriptPath,
+            sha256: expectedSha,
+            attestationLevel: "self-asserted-hash",
+          },
+        },
+      }),
+    );
+  });
+
+  it("never batch-loads or prints a plaintext secret value locally", async () => {
+    pollJobSpy.mockResolvedValueOnce({
+      jobId: "job_123",
+      status: "succeeded",
+      stdout: "token sk-test-secret-value\nAPI_KEY=sk-another-secret\n",
+      stderr: "debug sk-stderr-secret\n",
+      logsTail: "tail sk-log-secret\n",
+    });
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "sandbox",
+      "--only",
+      "API_KEY",
+      "--",
+      "my-skill",
+    ]);
+
+    expect(vaultApiFetch).not.toHaveBeenCalledWith(
+      expect.objectContaining({ path: expect.stringContaining("/load") }),
+    );
+    expect(vaultApiFetch).not.toHaveBeenCalledWith(
+      expect.objectContaining({ path: expect.stringContaining("/name/") }),
+    );
+    const rendered = [
+      ...stdoutSpy.mock.calls.flat().map(String),
+      ...stderrSpy.mock.calls.flat().map(String),
+      ...logSpy.mock.calls.flat().map(String),
+      ...errSpy.mock.calls.flat().map(String),
+    ].join("\n");
+    expect(rendered).not.toContain("sk-test-secret-value");
+    expect(rendered).not.toContain("sk-another-secret");
+    expect(rendered).not.toContain("sk-stderr-secret");
+    expect(rendered).not.toContain("sk-log-secret");
+    expect(rendered).toContain("[REDACTED]");
+  });
+
+  it("renders scrubbed stdout, stderr, and log tails", async () => {
+    pollJobSpy.mockResolvedValueOnce({
+      jobId: "job_123",
+      status: "succeeded",
+      stdout: "ok\nAPI_KEY=sk-stdout-secret\n",
+      stderr: "warn sk-stderr-secret\n",
+      logsTail: "tail sk-log-secret\n",
+    });
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "sandbox",
+      "--only",
+      "API_KEY",
+      "--",
+      "my-skill",
+    ]);
+
+    expect(stdoutSpy).toHaveBeenCalledWith("ok\nAPI_KEY=[REDACTED]\n");
+    expect(stderrSpy).toHaveBeenCalledWith("warn [REDACTED]\n");
+    expect(stderrSpy).toHaveBeenCalledWith("tail [REDACTED]\n");
+    expect(getJobSpy).not.toHaveBeenCalled();
+  });
+});
+
 // HQ-4H: `hq secrets exists` — HEAD existence probe with shell-chaining exit
 // codes (0=present, 1=absent, 2=error). process.exit is spied so the command's
 // terminal exit doesn't kill the runner; we assert the code it requested.

package/src/commands/secrets.ts

@@ -24,6 +24,10 @@ import {
   getCompanyUid,
   getEntityUid,
 } from "../utils/vault-api.js";
+import {
+  SandboxRunnerClient,
+  type SandboxRunnerJob,
+} from "../utils/sandbox-runner-client.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 
@@ -172,6 +176,7 @@ export type SecretUsageChannel =
   | "run"
   | "exec"
   | "env"
+  | "sandbox"
   | "reveal"
   | "submit-link";
 
@@ -318,6 +323,62 @@ async function buildSecretUsage(
   };
 }
 
+function parseSecretNameList(input: string): string[] {
+  const keys = input.split(",").map((k) => k.trim()).filter(Boolean);
+  if (keys.length === 0) {
+    console.error(chalk.red("Error: --only requires at least one secret name."));
+    process.exit(1);
+  }
+  for (const key of keys) {
+    if (!SECRET_NAME_PATTERN.test(key)) {
+      console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$`));
+      process.exit(1);
+    }
+  }
+  return keys;
+}
+
+function mergeScopeOpts(
+  parent: SecretsScopeOpts,
+  child: SecretsScopeOpts,
+): SecretsScopeOpts {
+  return {
+    company: child.company ?? parent.company,
+    personal: child.personal ?? parent.personal,
+  };
+}
+
+export function scrubSandboxOutput(text: string, secretNames: string[] = []): string {
+  let scrubbed = text;
+  for (const name of secretNames) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    scrubbed = scrubbed.replace(
+      new RegExp(`\\b(${escaped})\\s*=\\s*([^\\s'"\\n]+|'[^'\\n]*'|"[^"\\n]*")`, "g"),
+      "$1=[REDACTED]",
+    );
+    scrubbed = scrubbed.replace(
+      new RegExp(`\\b(${escaped})\\s*:\\s*([^\\s'"\\n]+|'[^'\\n]*'|"[^"\\n]*")`, "g"),
+      "$1: [REDACTED]",
+    );
+  }
+  return scrubbed
+    .replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]")
+    .replace(/\bgh[pousr]_[A-Za-z0-9_]{16,}\b/g, "[REDACTED]")
+    .replace(/\b[A-Za-z0-9+/]{40,}={0,2}\b/g, "[REDACTED]");
+}
+
+function renderSandboxJobResult(job: SandboxRunnerJob, secretNames: string[]): void {
+  if (job.stdout) {
+    process.stdout.write(scrubSandboxOutput(job.stdout, secretNames));
+  }
+  if (job.stderr) {
+    process.stderr.write(scrubSandboxOutput(job.stderr, secretNames));
+  }
+  if (job.logsTail) {
+    process.stderr.write(scrubSandboxOutput(job.logsTail, secretNames));
+  }
+}
+
 function normalizePolicyRecord(
   secretPath: string,
   data: SecretPolicyResponse,
@@ -1186,6 +1247,65 @@ export function registerSecretsCommand(program: Command): void {
       }
     });
 
+  secrets
+    .command("sandbox")
+    .description("Run a skill in the hosted sandbox with secrets injected server-side")
+    .option("--company <slug>", "Company slug (resolves to companyUid)")
+    .option(
+      "--personal",
+      "Operate on the caller's personal vault (no sharing)",
+    )
+    .option("--only <keys>", "Comma-separated list of secret names the skill may use")
+    .option("--script <path>", "Attach local script identity for script-locked secrets")
+    .allowUnknownOption(true)
+    .action(async (opts: { company?: string; personal?: boolean; only?: string; script?: string }, cmd: Command) => {
+      try {
+        const dashIndex = process.argv.indexOf("--");
+        const rawArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : cmd.args;
+        if (rawArgs.length === 0) {
+          console.error(chalk.red("Error: no skill specified. Usage: hq secrets sandbox [--company X] [--only KEY1,KEY2] -- <skill> [args...]"));
+          process.exit(1);
+        }
+
+        const [skillId, ...skillArgs] = rawArgs;
+        const keys = opts.only ? parseSecretNameList(opts.only) : [];
+        const token = await ensureCognitoToken();
+        const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
+        const companyUid = await getEntityUid(token, scope);
+        const usage = await buildSecretUsage("sandbox", opts.script);
+        const client = new SandboxRunnerClient();
+        const started = await client.startJob(token, {
+          skillId,
+          companyUid,
+          args: skillArgs.length > 0 ? { argv: skillArgs } : undefined,
+          companySlug: scope.companySlug,
+          only: keys.length > 0 ? keys : undefined,
+          usage,
+        });
+        const job =
+          started.status === "succeeded" || started.status === "failed"
+            ? await client.getJob(token, started.jobId)
+            : await client.pollJob(token, started.jobId);
+
+        renderSandboxJobResult(job, keys);
+        if (job.status === "failed") {
+          if (job.error) {
+            console.error(chalk.red("Sandbox job failed:"), scrubSandboxOutput(job.error, keys));
+          }
+          process.exit(job.exitCode && job.exitCode > 0 ? job.exitCode : 1);
+        }
+        if (job.exitCode && job.exitCode !== 0) {
+          process.exit(job.exitCode);
+        }
+      } catch (err) {
+        console.error(
+          chalk.red("Error:"),
+          err instanceof Error ? scrubSandboxOutput(err.message) : scrubSandboxOutput(String(err)),
+        );
+        process.exit(1);
+      }
+    });
+
   secrets
     .command("exec")
     .description("Run a command with secrets injected as env vars")
@@ -1208,18 +1328,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const keys = _opts.only.split(",").map((k) => k.trim()).filter(Boolean);
-        if (keys.length === 0) {
-          console.error(chalk.red("Error: --only requires at least one secret name."));
-          process.exit(1);
-        }
-
-        for (const key of keys) {
-          if (!SECRET_NAME_PATTERN.test(key)) {
-            console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$`));
-            process.exit(1);
-          }
-        }
+        const keys = parseSecretNameList(_opts.only);
 
         const token = await ensureCognitoToken();
         const companyUid = await getEntityUid(
@@ -1287,18 +1396,7 @@ export function registerSecretsCommand(program: Command): void {
           );
         }
 
-        const keys = opts.only.split(",").map((k) => k.trim()).filter(Boolean);
-        if (keys.length === 0) {
-          console.error(chalk.red("Error: --only requires at least one secret name."));
-          process.exit(1);
-        }
-
-        for (const key of keys) {
-          if (!SECRET_NAME_PATTERN.test(key)) {
-            console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$`));
-            process.exit(1);
-          }
-        }
+        const keys = parseSecretNameList(opts.only);
 
         const token = await ensureCognitoToken();
         const companyUid = await getEntityUid(

package/src/utils/sandbox-runner-client.test.ts

@@ -0,0 +1,125 @@
+import { describe, expect, it, vi } from "vitest";
+import { SandboxRunnerClient } from "./sandbox-runner-client.js";
+
+function jsonRes(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+describe("SandboxRunnerClient", () => {
+  it("posts jobs to the configured runner URL with the caller JWT", async () => {
+    const fetchImpl = vi.fn<typeof fetch>(async () =>
+      jsonRes({ jobId: "job_1", status: "queued" }),
+    );
+    const client = new SandboxRunnerClient({
+      baseUrl: "https://runner.example/",
+      fetchImpl,
+    });
+
+    const result = await client.startJob("jwt-token", {
+      skillId: "my-skill",
+      companyUid: "cmp_123",
+      args: { argv: ["--x"] },
+      only: ["API_KEY"],
+      usage: { channel: "sandbox" },
+    });
+
+    expect(result).toEqual({ jobId: "job_1", status: "queued" });
+    expect(fetchImpl).toHaveBeenCalledWith("https://runner.example/jobs", {
+      method: "POST",
+      headers: {
+        Authorization: "Bearer jwt-token",
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        skillId: "my-skill",
+        companyUid: "cmp_123",
+        args: { argv: ["--x"] },
+        only: ["API_KEY"],
+        usage: { channel: "sandbox" },
+      }),
+    });
+  });
+
+  it("polls queued and running states until succeeded", async () => {
+    const fetchImpl = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(jsonRes({ jobId: "job_1", status: "queued" }))
+      .mockResolvedValueOnce(jsonRes({ jobId: "job_1", status: "running" }))
+      .mockResolvedValueOnce(
+        jsonRes({ jobId: "job_1", status: "succeeded", stdout: "ok\n" }),
+      );
+    const client = new SandboxRunnerClient({
+      baseUrl: "https://runner.example",
+      fetchImpl,
+    });
+
+    const result = await client.pollJob("jwt-token", "job_1", {
+      intervalMs: 0,
+    });
+
+    expect(result).toEqual({
+      jobId: "job_1",
+      status: "succeeded",
+      stdout: "ok\n",
+      stderr: undefined,
+      logsTail: undefined,
+      exitCode: undefined,
+      error: undefined,
+    });
+    expect(fetchImpl).toHaveBeenCalledTimes(3);
+    expect(fetchImpl).toHaveBeenNthCalledWith(
+      1,
+      "https://runner.example/jobs/job_1",
+      { headers: { Authorization: "Bearer jwt-token" } },
+    );
+  });
+
+  it("returns failed terminal jobs with error details", async () => {
+    const fetchImpl = vi.fn<typeof fetch>(async () =>
+      jsonRes({
+        jobId: "job_1",
+        status: "failed",
+        stderr: "boom\n",
+        exitCode: 2,
+        error: "command failed",
+      }),
+    );
+    const client = new SandboxRunnerClient({
+      baseUrl: "https://runner.example",
+      fetchImpl,
+    });
+
+    await expect(
+      client.pollJob("jwt-token", "job_1", { intervalMs: 0 }),
+    ).resolves.toMatchObject({
+      jobId: "job_1",
+      status: "failed",
+      stderr: "boom\n",
+      exitCode: 2,
+      error: "command failed",
+    });
+  });
+
+  it("uses the requested job id when the live status response omits it", async () => {
+    const fetchImpl = vi.fn<typeof fetch>(async () =>
+      jsonRes({ status: "succeeded", logsTail: "ok\n" }),
+    );
+    const client = new SandboxRunnerClient({
+      baseUrl: "https://runner.example",
+      fetchImpl,
+    });
+
+    await expect(client.getJob("jwt-token", "job_live")).resolves.toEqual({
+      jobId: "job_live",
+      status: "succeeded",
+      stdout: undefined,
+      stderr: undefined,
+      logsTail: "ok\n",
+      exitCode: undefined,
+      error: undefined,
+    });
+  });
+});