@indigoai-us/hq-cli 5.57.0 → 5.58.1

package/src/commands/people.ts

@@ -6,25 +6,21 @@
  *   hq people search <keyword> [--company <slug>] [--json]
  *   hq people resolve <name>   [--company <slug>] [--json]
  *
- * Source of truth is `companies/<company>/people/<person>/meta.yaml`. Every
- * subcommand operates on exactly ONE company (the active company, or the one
- * named by `--company`); nothing reads across company boundaries.
+ * Local records from `companies/<company>/people/<person>/meta.yaml` are the
+ * curated primary source. On misses, commands may fall back to the membership
+ * roster for exactly ONE company (the active company, or the one named by
+ * `--company`); nothing reads across company boundaries.
  */
 
 import * as fs from "fs";
 import { Command, Option } from "commander";
 import chalk from "chalk";
-import { VaultClient } from "@indigoai-us/hq-cloud";
 import * as yaml from "js-yaml";
 import { findHqRoot } from "../utils/manifest.js";
 import { manifestPath, type ManifestDoc } from "./cloud-provision.js";
-import {
-  DEFAULT_COGNITO,
-  buildVaultConfig,
-  ensureCognitoToken,
-} from "../utils/cognito-session.js";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
-import { createCompanyPresignClient, runGet } from "./files-browse.js";
+import { listActiveMembers, type ActiveMember } from "./members.js";
 import {
   assertSafeCompanySlug,
   listCompanyPeople,
@@ -39,13 +35,13 @@ interface PeopleScopeOpts {
   hqRoot?: string;
 }
 
-export type RefreshPeopleRoster = (
+export type FetchPeopleRoster = (
   hqRoot: string,
   companySlug: string,
-) => Promise<void>;
+) => Promise<PersonRecord[]>;
 
 interface PeopleCommandDeps {
-  refreshRoster?: RefreshPeopleRoster;
+  fetchRoster?: FetchPeopleRoster;
 }
 
 interface PeopleLookupOpts {
@@ -53,23 +49,71 @@ interface PeopleLookupOpts {
   json?: boolean;
 }
 
-export async function refreshPeopleRosterFromCloud(
+function slugify(value: string): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "");
+}
+
+export function activeMemberToPersonRecord(
+  m: ActiveMember,
+): PersonRecord | null {
+  const name =
+    m.personName?.trim() ||
+    m.personEmail?.trim() ||
+    m.personSlug?.trim() ||
+    "";
+  if (!name) return null;
+
+  const email = m.personEmail?.trim() || undefined;
+  const slug = m.personSlug?.trim() || slugify(name) || m.personUid;
+
+  return {
+    slug,
+    name,
+    email,
+    role: m.role || undefined,
+    type: "internal",
+    source: `hq-pro membership: /membership/company/${m.companyUid}`,
+  };
+}
+
+export async function fetchMembershipRoster(
   hqRoot: string,
   companySlug: string,
-): Promise<void> {
-  const accessToken = await ensureCognitoToken();
-  const client = new VaultClient(buildVaultConfig(accessToken));
-  await getCompanyUid(accessToken, companySlug);
-
-  await runGet({
-    path: `companies/${companySlug}/people/`,
-    hqRoot,
-    companySlug,
-    vaultClient: client,
-    companyClient: ({ companyUid }) =>
-      createCompanyPresignClient({ token: accessToken, companyUid }),
-    region: DEFAULT_COGNITO.region,
-  });
+): Promise<PersonRecord[]> {
+  void hqRoot;
+  const token = await ensureCognitoToken();
+  const companyUid = await getCompanyUid(token, companySlug);
+  const members = await listActiveMembers(token, companyUid);
+  return members
+    .map(activeMemberToPersonRecord)
+    .filter((r): r is PersonRecord => r !== null);
+}
+
+function personIdentityKey(person: PersonRecord): string {
+  return (
+    person.email?.toLowerCase() ||
+    person.slug?.toLowerCase() ||
+    person.name.toLowerCase()
+  );
+}
+
+export function mergePeople(
+  primary: PersonRecord[],
+  extra: PersonRecord[],
+): PersonRecord[] {
+  const seen = new Set(primary.map(personIdentityKey));
+  const merged = [...primary];
+  for (const person of extra) {
+    const key = personIdentityKey(person);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    merged.push(person);
+  }
+  return merged;
 }
 
 /** Companies that still exist (anything not explicitly `status: archived`). */
@@ -159,26 +203,25 @@ function fail(message: string): never {
   process.exit(1);
 }
 
-function logRefreshFailure(companySlug: string, err: unknown): void {
+function logRosterFetchFailure(companySlug: string, err: unknown): void {
   const message = err instanceof Error ? err.message : String(err);
   console.error(
     chalk.dim(
-      `  Could not refresh people roster for '${companySlug}': ${message}`,
+      `  Could not fetch people roster for '${companySlug}': ${message}`,
     ),
   );
 }
 
-async function tryRefreshRoster(
-  refreshRoster: RefreshPeopleRoster,
+async function tryFetchRoster(
+  fetchRoster: FetchPeopleRoster,
   hqRoot: string,
   slug: string,
-): Promise<boolean> {
+): Promise<PersonRecord[] | null> {
   try {
-    await refreshRoster(hqRoot, slug);
-    return true;
+    return await fetchRoster(hqRoot, slug);
   } catch (err) {
-    logRefreshFailure(slug, err);
-    return false;
+    logRosterFetchFailure(slug, err);
+    return null;
   }
 }
 
@@ -188,25 +231,20 @@ export async function resolvePersonWithRosterFallback(
     slug: string;
     name: string;
     opts?: PeopleLookupOpts;
-    refreshRoster?: RefreshPeopleRoster;
+    fetchRoster?: FetchPeopleRoster;
   },
 ): Promise<ReturnType<typeof resolveNameToEmail>> {
-  const local = resolveNameToEmail(
-    listCompanyPeople(input.hqRoot, input.slug),
-    input.name,
-  );
+  const localPeople = listCompanyPeople(input.hqRoot, input.slug);
+  const local = resolveNameToEmail(localPeople, input.name);
   if (local.status !== "not_found" || input.opts?.localOnly) return local;
 
-  const refreshed = await tryRefreshRoster(
-    input.refreshRoster ?? refreshPeopleRosterFromCloud,
+  const roster = await tryFetchRoster(
+    input.fetchRoster ?? fetchMembershipRoster,
     input.hqRoot,
     input.slug,
   );
-  if (!refreshed) return local;
-  return resolveNameToEmail(
-    listCompanyPeople(input.hqRoot, input.slug),
-    input.name,
-  );
+  if (!roster) return local;
+  return resolveNameToEmail(mergePeople(localPeople, roster), input.name);
 }
 
 export async function searchPeopleWithRosterFallback(input: {
@@ -214,21 +252,19 @@ export async function searchPeopleWithRosterFallback(input: {
   slug: string;
   keyword: string;
   opts?: PeopleLookupOpts;
-  refreshRoster?: RefreshPeopleRoster;
+  fetchRoster?: FetchPeopleRoster;
 }): Promise<PersonRecord[]> {
-  const local = searchPeople(
-    listCompanyPeople(input.hqRoot, input.slug),
-    input.keyword,
-  );
+  const localPeople = listCompanyPeople(input.hqRoot, input.slug);
+  const local = searchPeople(localPeople, input.keyword);
   if (local.length > 0 || input.opts?.localOnly) return local;
 
-  const refreshed = await tryRefreshRoster(
-    input.refreshRoster ?? refreshPeopleRosterFromCloud,
+  const roster = await tryFetchRoster(
+    input.fetchRoster ?? fetchMembershipRoster,
     input.hqRoot,
     input.slug,
   );
-  if (!refreshed) return local;
-  return searchPeople(listCompanyPeople(input.hqRoot, input.slug), input.keyword);
+  if (!roster) return local;
+  return searchPeople(mergePeople(localPeople, roster), input.keyword);
 }
 
 export function registerPeopleCommand(
@@ -257,12 +293,26 @@ export function registerPeopleCommand(
     .command("list")
     .description("List all people recorded for the company")
     .option("--json", "Output JSON instead of a table")
-    .action((opts: { json?: boolean }) => {
+    .option(
+      "--local-only",
+      "Skip network fallback; list only the local people roster",
+    )
+    .action(async (opts: PeopleLookupOpts) => {
       try {
         const scope = people.opts() as PeopleScopeOpts;
         const hqRoot = resolveHqRoot(scope);
         const slug = resolveCompanySlug(hqRoot, scope.company);
-        const records = listCompanyPeople(hqRoot, slug);
+        let records = listCompanyPeople(hqRoot, slug);
+
+        if (!opts.localOnly) {
+          const roster = await tryFetchRoster(
+            deps.fetchRoster ?? fetchMembershipRoster,
+            hqRoot,
+            slug,
+          );
+          if (roster) records = mergePeople(records, roster);
+        }
+        records = records.sort((a, b) => a.name.localeCompare(b.name));
 
         if (opts.json) {
           console.log(JSON.stringify(records, null, 2));
@@ -288,7 +338,7 @@ export function registerPeopleCommand(
     .option("--json", "Output JSON instead of a table")
     .option(
       "--local-only",
-      "Skip cloud fallback; search only the local people roster",
+      "Skip network fallback; search only the local people roster",
     )
     .action(async (keyword: string, opts: PeopleLookupOpts) => {
       try {
@@ -300,7 +350,7 @@ export function registerPeopleCommand(
           slug,
           keyword,
           opts,
-          refreshRoster: deps.refreshRoster,
+          fetchRoster: deps.fetchRoster,
         });
 
         if (opts.json) {
@@ -323,7 +373,7 @@ export function registerPeopleCommand(
     .option("--json", "Output JSON instead of plain text")
     .option(
       "--local-only",
-      "Skip cloud fallback; resolve only from the local people roster",
+      "Skip network fallback; resolve only from the local people roster",
     )
     .action(async (name: string, opts: PeopleLookupOpts) => {
       try {
@@ -335,7 +385,7 @@ export function registerPeopleCommand(
           slug,
           name,
           opts,
-          refreshRoster: deps.refreshRoster,
+          fetchRoster: deps.fetchRoster,
         });
 
         if (opts.json) {

package/src/commands/secrets.test.ts

@@ -104,6 +104,7 @@ function jsonRes(body: unknown, status = 200): Response {
 describe("secrets sandbox", () => {
   let stdoutSpy: MockInstance<typeof process.stdout.write>;
   let stderrSpy: MockInstance<typeof process.stderr.write>;
+  let exitSpy: MockInstance<typeof process.exit>;
   let startJobSpy: MockInstance<SandboxRunnerClient["startJob"]>;
   let pollJobSpy: MockInstance<SandboxRunnerClient["pollJob"]>;
   let getJobSpy: MockInstance<SandboxRunnerClient["getJob"]>;
@@ -119,9 +120,14 @@ describe("secrets sandbox", () => {
       .mockResolvedValue({
         jobId: "job_123",
         status: "succeeded",
-        stdout: "done\n",
+        output: "done\n",
+        exitCode: 0,
+        success: true,
       });
     getJobSpy = vi.spyOn(SandboxRunnerClient.prototype, "getJob");
+    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
+      throw new Error("__exit__");
+    }) as never);
   });
 
   it("registers the sandbox channel value", () => {
@@ -129,7 +135,7 @@ describe("secrets sandbox", () => {
     expect(channel).toBe("sandbox");
   });
 
-  it("parses --company, --only, and the -- <skill> separator", async () => {
+  it("parses --company, --only, and joins args after -- into a command", async () => {
     const program = buildProgram();
     await program.parseAsync([
       "node",
@@ -141,22 +147,59 @@ describe("secrets sandbox", () => {
       "--only",
       "API_KEY,OTHER_KEY",
       "--",
-      "pull-triple-whale",
+      "node",
+      "-e",
+      "console.log('hi')",
       "--days",
       "7",
     ]);
 
     expect(startJobSpy).toHaveBeenCalledWith("test-token", {
-      skillId: "pull-triple-whale",
       companyUid: "prs_alice",
-      args: { argv: ["--days", "7"] },
-      companySlug: "acme",
-      only: ["API_KEY", "OTHER_KEY"],
-      usage: { channel: "sandbox" },
+      secretNames: ["API_KEY", "OTHER_KEY"],
+      command: "node -e console.log('hi') --days 7",
     });
     expect(stdoutSpy).toHaveBeenCalledWith("done\n");
   });
 
+  it("requires --only", async () => {
+    const program = buildProgram();
+
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "sandbox",
+        "--",
+        "env",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/--only is required/i);
+    expect(startJobSpy).not.toHaveBeenCalled();
+  });
+
+  it("requires a command after --", async () => {
+    const program = buildProgram();
+
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "sandbox",
+        "--only",
+        "API_KEY",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/no command specified/i);
+    expect(startJobSpy).not.toHaveBeenCalled();
+  });
+
   it("resolves identity before posting the runner job", async () => {
     const program = buildProgram();
     await program.parseAsync([
@@ -166,8 +209,10 @@ describe("secrets sandbox", () => {
       "--company",
       "parent-co",
       "sandbox",
+      "--only",
+      "API_KEY",
       "--",
-      "my-skill",
+      "env",
     ]);
 
     expect(ensureCognitoToken).toHaveBeenCalled();
@@ -175,58 +220,20 @@ describe("secrets sandbox", () => {
       personal: false,
       companySlug: "parent-co",
     });
-    expect(startJobSpy).toHaveBeenCalledWith(
-      "test-token",
-      expect.objectContaining({
-        skillId: "my-skill",
-        companyUid: "prs_alice",
-        companySlug: "parent-co",
-        usage: { channel: "sandbox" },
-      }),
-    );
-  });
-
-  it("can attach script attestation metadata to sandbox usage", async () => {
-    const scriptPath = join(tempDir, "sandbox-script.sh");
-    const scriptBody = "#!/usr/bin/env bash\necho sandbox\n";
-    writeFileSync(scriptPath, scriptBody);
-    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--script",
-      scriptPath,
-      "--",
-      "my-skill",
-    ]);
-
-    expect(startJobSpy).toHaveBeenCalledWith(
-      "test-token",
-      expect.objectContaining({
-        usage: {
-          channel: "sandbox",
-          script: {
-            scriptId: scriptPath,
-            path: scriptPath,
-            sha256: expectedSha,
-            attestationLevel: "self-asserted-hash",
-          },
-        },
-      }),
-    );
+    expect(startJobSpy).toHaveBeenCalledWith("test-token", {
+      companyUid: "prs_alice",
+      secretNames: ["API_KEY"],
+      command: "env",
+    });
   });
 
-  it("never batch-loads or prints a plaintext secret value locally", async () => {
+  it("prints server-scrubbed output and never batch-loads secrets locally", async () => {
     pollJobSpy.mockResolvedValueOnce({
       jobId: "job_123",
       status: "succeeded",
-      stdout: "token sk-test-secret-value\nAPI_KEY=sk-another-secret\n",
-      stderr: "debug sk-stderr-secret\n",
-      logsTail: "tail sk-log-secret\n",
+      output: "token [REDACTED]\nAPI_KEY=[REDACTED]\n",
+      exitCode: 0,
+      success: true,
     });
 
     const program = buildProgram();
@@ -253,37 +260,36 @@ describe("secrets sandbox", () => {
       ...logSpy.mock.calls.flat().map(String),
       ...errSpy.mock.calls.flat().map(String),
     ].join("\n");
-    expect(rendered).not.toContain("sk-test-secret-value");
-    expect(rendered).not.toContain("sk-another-secret");
-    expect(rendered).not.toContain("sk-stderr-secret");
-    expect(rendered).not.toContain("sk-log-secret");
     expect(rendered).toContain("[REDACTED]");
+    expect(stdoutSpy).toHaveBeenCalledWith("token [REDACTED]\nAPI_KEY=[REDACTED]\n");
   });
 
-  it("renders scrubbed stdout, stderr, and log tails", async () => {
+  it("exits non-zero when the sandbox command fails", async () => {
     pollJobSpy.mockResolvedValueOnce({
       jobId: "job_123",
-      status: "succeeded",
-      stdout: "ok\nAPI_KEY=sk-stdout-secret\n",
-      stderr: "warn sk-stderr-secret\n",
-      logsTail: "tail sk-log-secret\n",
+      status: "failed",
+      output: "boom\n",
+      exitCode: 7,
+      success: false,
     });
 
     const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--only",
-      "API_KEY",
-      "--",
-      "my-skill",
-    ]);
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "sandbox",
+        "--only",
+        "API_KEY",
+        "--",
+        "my-skill",
+      ]),
+    ).rejects.toThrow("__exit__");
 
-    expect(stdoutSpy).toHaveBeenCalledWith("ok\nAPI_KEY=[REDACTED]\n");
-    expect(stderrSpy).toHaveBeenCalledWith("warn [REDACTED]\n");
-    expect(stderrSpy).toHaveBeenCalledWith("tail [REDACTED]\n");
+    expect(stdoutSpy).toHaveBeenCalledWith("boom\n");
+    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/exit code 7/i);
+    expect(exitSpy).toHaveBeenCalledWith(7);
     expect(getJobSpy).not.toHaveBeenCalled();
   });
 });

package/src/commands/secrets.ts

@@ -368,14 +368,8 @@ export function scrubSandboxOutput(text: string, secretNames: string[] = []): st
 }
 
 function renderSandboxJobResult(job: SandboxRunnerJob, secretNames: string[]): void {
-  if (job.stdout) {
-    process.stdout.write(scrubSandboxOutput(job.stdout, secretNames));
-  }
-  if (job.stderr) {
-    process.stderr.write(scrubSandboxOutput(job.stderr, secretNames));
-  }
-  if (job.logsTail) {
-    process.stderr.write(scrubSandboxOutput(job.logsTail, secretNames));
+  if (job.output) {
+    process.stdout.write(scrubSandboxOutput(job.output, secretNames));
   }
 }
 
@@ -1249,38 +1243,41 @@ export function registerSecretsCommand(program: Command): void {
 
   secrets
     .command("sandbox")
-    .description("Run a skill in the hosted sandbox with secrets injected server-side")
+    .description("Run a command in the hosted sandbox with named secrets injected as env vars; open egress, secrets never touch this machine")
     .option("--company <slug>", "Company slug (resolves to companyUid)")
     .option(
       "--personal",
       "Operate on the caller's personal vault (no sharing)",
     )
-    .option("--only <keys>", "Comma-separated list of secret names the skill may use")
-    .option("--script <path>", "Attach local script identity for script-locked secrets")
+    .option("--only <keys>", "Comma-separated list of secret names to inject (required)")
     .allowUnknownOption(true)
-    .action(async (opts: { company?: string; personal?: boolean; only?: string; script?: string }, cmd: Command) => {
+    .action(async (opts: { company?: string; personal?: boolean; only?: string }, cmd: Command) => {
       try {
-        const dashIndex = process.argv.indexOf("--");
-        const rawArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : cmd.args;
-        if (rawArgs.length === 0) {
-          console.error(chalk.red("Error: no skill specified. Usage: hq secrets sandbox [--company X] [--only KEY1,KEY2] -- <skill> [args...]"));
+        if (!opts.only || opts.only.trim().length === 0) {
+          console.error(chalk.red("Error: --only is required and must name at least one secret."));
+          process.exit(1);
+        }
+
+        const rawArgs = cmd.args;
+        const command = rawArgs.join(" ").trim();
+        if (command.length === 0) {
+          console.error(chalk.red("Error: no command specified. Usage: hq secrets sandbox --company <slug> --only KEY1,KEY2 -- <command>"));
+          process.exit(1);
+        }
+        if (command.length > 8192) {
+          console.error(chalk.red("Error: sandbox command exceeds the 8192 character limit."));
           process.exit(1);
         }
 
-        const [skillId, ...skillArgs] = rawArgs;
-        const keys = opts.only ? parseSecretNameList(opts.only) : [];
+        const keys = parseSecretNameList(opts.only);
         const token = await ensureCognitoToken();
         const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
         const companyUid = await getEntityUid(token, scope);
-        const usage = await buildSecretUsage("sandbox", opts.script);
         const client = new SandboxRunnerClient();
         const started = await client.startJob(token, {
-          skillId,
           companyUid,
-          args: skillArgs.length > 0 ? { argv: skillArgs } : undefined,
-          companySlug: scope.companySlug,
-          only: keys.length > 0 ? keys : undefined,
-          usage,
+          secretNames: keys,
+          command,
         });
         const job =
           started.status === "succeeded" || started.status === "failed"
@@ -1288,14 +1285,11 @@ export function registerSecretsCommand(program: Command): void {
             : await client.pollJob(token, started.jobId);
 
         renderSandboxJobResult(job, keys);
-        if (job.status === "failed") {
-          if (job.error) {
-            console.error(chalk.red("Sandbox job failed:"), scrubSandboxOutput(job.error, keys));
-          }
-          process.exit(job.exitCode && job.exitCode > 0 ? job.exitCode : 1);
-        }
-        if (job.exitCode && job.exitCode !== 0) {
-          process.exit(job.exitCode);
+        const exitCode = typeof job.exitCode === "number" ? job.exitCode : undefined;
+        if (job.success === false || (exitCode !== undefined && exitCode !== 0) || job.status === "failed") {
+          const code = exitCode && exitCode !== 0 ? exitCode : 1;
+          console.error(chalk.red(`Sandbox command failed with exit code ${code}.`));
+          process.exit(code);
         }
       } catch (err) {
         console.error(