@indigoai-us/hq-cli 5.59.0 → 5.61.0

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="12b04dfd-a264-56c7-bfbb-a448c35689b3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ac2acbfe-d6f8-52af-9e1a-38b43474a6d5")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -153,6 +153,74 @@ function describeSecretAclPrincipal(principal) {
         ? "@all (entire company)"
         : principal.granteeId;
 }
+// Mirrors hq-pro's server-authoritative KNOWN_DESTINATION_REGISTRY
+// (src/vault-service/handlers/destination-registry.ts) — a KNOWN host's
+// --auth-style is optional because the server resolves the recipe itself.
+// This client-side copy exists purely so an UNKNOWN host with no
+// --auth-style can be rejected immediately with a clear, actionable message
+// instead of a round trip; the server remains the authoritative validator
+// (this list drifting stale merely means one extra CLI round trip, not a
+// security gap — the server still 400s an unrecognized host with no recipe).
+const KNOWN_DESTINATION_HOSTS = new Set([
+    "api.anthropic.com",
+    "api.openai.com",
+    "api.stripe.com",
+]);
+// Parses `--auth-style` into the InjectionRecipe shape the server expects.
+// Returns `null` (with a printed error) for an unrecognized value.
+function parseAuthStyle(authStyle) {
+    if (authStyle === "bearer") {
+        return { header: "authorization", scheme: "bearer" };
+    }
+    if (authStyle === "x-api-key") {
+        return { header: "x-api-key", scheme: "raw" };
+    }
+    const headerMatch = authStyle.match(/^header:(.+)$/);
+    if (headerMatch) {
+        const headerName = headerMatch[1].trim();
+        if (!headerName) {
+            console.error(chalk.red(`Invalid --auth-style 'header:': must name a header, e.g. header:X-Custom-Key`));
+            return null;
+        }
+        return { header: headerName, scheme: "raw" };
+    }
+    console.error(chalk.red(`Invalid --auth-style '${authStyle}': must be one of bearer, x-api-key, or header:NAME`));
+    return null;
+}
+// Validates `--destination` is a bare HTTPS scheme+host URL (no path, query,
+// port). Mirrors hq-pro's `validateDestinations` server-side check
+// (src/vault-service/handlers/secrets.ts) so a malformed URL is caught
+// locally with an actionable message rather than a round trip — the server
+// re-validates and remains authoritative.
+function parseDestinationUrl(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        console.error(chalk.red(`Invalid --destination '${raw}': must be a valid URL`));
+        return { ok: false };
+    }
+    if (parsed.protocol !== "https:") {
+        console.error(chalk.red(`Invalid --destination '${raw}': must use https://`));
+        return { ok: false };
+    }
+    if (!parsed.hostname) {
+        console.error(chalk.red(`Invalid --destination '${raw}': missing hostname`));
+        return { ok: false };
+    }
+    if ((parsed.pathname !== "" && parsed.pathname !== "/") ||
+        parsed.search !== "" ||
+        parsed.hash !== "") {
+        console.error(chalk.red(`Invalid --destination '${raw}': must be a bare scheme+host URL with no path, query, or fragment (e.g. https://api.openai.com)`));
+        return { ok: false };
+    }
+    if (parsed.port !== "") {
+        console.error(chalk.red(`Invalid --destination '${raw}': must not specify a port`));
+        return { ok: false };
+    }
+    return { ok: true, url: `https://${parsed.hostname}`, hostname: parsed.hostname };
+}
 function normalizeSecretTier(tier) {
     return tier === "sensitive" || tier === "nuclear" ? tier : "standard";
 }
@@ -218,7 +286,11 @@ export function scrubSandboxOutput(text, secretNames = []) {
 }
 function renderSandboxJobResult(job, secretNames) {
     if (job.output) {
-        process.stdout.write(scrubSandboxOutput(job.output, secretNames));
+        const output = scrubSandboxOutput(job.output, secretNames);
+        process.stdout.write(output);
+        if (output.length > 0 && !output.endsWith("\n")) {
+            process.stdout.write("\n");
+        }
     }
 }
 function normalizePolicyRecord(secretPath, data) {
@@ -374,12 +446,56 @@ export function registerSecretsCommand(program) {
         .command("set <name>")
         .description("Create or update a secret")
         .option("--from-stdin", "Read secret value from piped stdin")
+        .option("--high-security", "Mark the secret high-security: it can never be revealed or injected locally, only used through the HQ secret proxy (requires --destination)")
+        .option("--destination <https-url>", "Approved scheme+host HTTPS URL the proxy may forward this secret to (e.g. https://api.openai.com); required with --high-security")
+        .option("--auth-style <style>", "How the proxy attaches the key upstream: bearer | x-api-key | header:NAME. Optional for known destinations (auto-resolved server-side); required for unknown ones")
         .action(async (name, opts) => {
         try {
             if (!SECRET_NAME_PATTERN.test(name)) {
                 console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
             }
+            // secrets-proxy-per-secret-destination US-006: --high-security marks
+            // the secret so it can only ever be used through the server-side
+            // proxy (never revealed/injected locally — that refusal is the
+            // pre-existing consumption-side behavior in `get`/`exec`/`env` above,
+            // unchanged by this story). It REQUIRES a --destination: the proxy
+            // (hq-pro US-002) fails closed with no destination configured, so
+            // catching the missing pin here is a clear, immediate CLI error
+            // rather than a deferred proxy-time failure.
+            let destinations;
+            let injection;
+            if (opts.highSecurity) {
+                if (!opts.destination) {
+                    console.error(chalk.red("Error: --high-security requires --destination <https-url> (e.g. --destination https://api.openai.com)."));
+                    process.exit(1);
+                }
+                const destResult = parseDestinationUrl(opts.destination);
+                if (!destResult.ok) {
+                    process.exit(1);
+                }
+                destinations = [destResult.url];
+                if (opts.authStyle) {
+                    const recipe = parseAuthStyle(opts.authStyle);
+                    if (!recipe) {
+                        process.exit(1);
+                    }
+                    injection = recipe;
+                }
+                else if (!KNOWN_DESTINATION_HOSTS.has(destResult.hostname)) {
+                    // Unknown host + no explicit recipe: the server would reject this
+                    // 400 anyway (US-004 registry lookup only, never guesses) — fail
+                    // fast locally with an actionable message instead of a round trip.
+                    console.error(chalk.red(`Error: unknown destination host '${destResult.hostname}' — provide --auth-style <bearer|x-api-key|header:NAME> (known hosts auto-resolve: ${[...KNOWN_DESTINATION_HOSTS].join(", ")}).`));
+                    process.exit(1);
+                }
+                // Known host + no --auth-style: leave `injection` undefined so the
+                // server (US-004) auto-resolves the recipe from its registry.
+            }
+            else if (opts.destination || opts.authStyle) {
+                console.error(chalk.red("Error: --destination/--auth-style require --high-security."));
+                process.exit(1);
+            }
             let value;
             if (opts.fromStdin) {
                 if (process.stdin.isTTY) {
@@ -415,15 +531,27 @@ export function registerSecretsCommand(program) {
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}`,
                 method: "POST",
-                body: { name, value },
+                body: {
+                    name,
+                    value,
+                    // Only present when --high-security was passed — an ordinary
+                    // `set` with no flags sends exactly `{ name, value }`, byte-for-
+                    // byte unchanged from before this story.
+                    ...(opts.highSecurity ? { highSecurity: true } : {}),
+                    ...(destinations ? { destinations } : {}),
+                    ...(injection ? { injection } : {}),
+                },
             });
             if (!res.ok) {
-                const body = await res.json().catch(() => ({}));
-                console.error(chalk.red(`Failed to set secret: ${body.error ?? res.statusText}`));
+                const body = (await res.json().catch(() => ({})));
+                console.error(chalk.red(`Failed to set secret: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
             removeCacheEntry(companyUid, name);
             console.log(chalk.green(formatSecretSaved(name, scopeLabel)));
+            if (opts.highSecurity) {
+                console.log(chalk.dim(`  High-security: destination pinned to ${destinations?.[0]}. This value can never be revealed or injected locally — only used through the HQ secret proxy.`));
+            }
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -1254,4 +1382,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=12b04dfd-a264-56c7-bfbb-a448c35689b3
+//# debugId=ac2acbfe-d6f8-52af-9e1a-38b43474a6d5

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
-/**
- * HQ CLI - Module management, package management, and cloud sync for HQ
- */
 import "./node-preflight.js";
+declare function isVersionRequest(argv: readonly string[]): boolean;
+export declare const __test__: {
+    isVersionRequest: typeof isVersionRequest;
+};
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,247 +1,21 @@
 #!/usr/bin/env node
-/**
- * HQ CLI - Module management, package management, and cloud sync for HQ
- */
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8839ee7d-9f6d-54fe-8f90-99ad858e349e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8fdfd788-4c00-50bc-9ed0-579ed9d5f903")}catch(e){}}();
 import "./node-preflight.js";
-import { Command } from "commander";
-import { initSentry, Sentry } from "./sentry.js";
-import { registerAddCommand } from "./commands/add.js";
-import { registerSyncCommand } from "./commands/sync.js";
-import { registerListCommand } from "./commands/list.js";
-import { registerUpdateCommand } from "./commands/update.js";
-import { registerCloudCommands } from "./commands/cloud.js";
-import { registerSyncModeCommand } from "./commands/sync-mode.js";
-import { registerSyncNarrowCommand } from "./commands/sync-narrow.js";
-import { registerCloudProvisionCommands } from "./commands/cloud-provision.js";
-import { registerCloudDemoteCommands } from "./commands/cloud-demote.js";
-import { registerLoginCommand } from "./commands/login.js";
-import { registerLogoutCommand } from "./commands/logout.js";
-import { registerWhoamiCommand } from "./commands/whoami.js";
-import { registerOnboardCommand } from "./commands/onboard.js";
-import { registerPackageInstallCommand } from "./commands/pkg-install.js";
-import { registerPackageRemoveCommand } from "./commands/pkg-remove.js";
-import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
-import { registerPackageListCommand } from "./commands/pkg-list.js";
-import { registerPacksCommand } from "./commands/packs.js";
-import { registerPublishCommand } from "./commands/publish.js";
-import { registerCreatorsCommand } from "./commands/creators.js";
-import { registerTeamSyncCommand } from "./commands/team-sync.js";
-import { registerAuthCommands } from "./commands/auth.js";
-import { registerApiKeysCommand } from "./commands/api-keys.js";
-import { registerSecretsCommand } from "./commands/secrets.js";
-import { registerRunCommand } from "./commands/run.js";
-import { registerGroupsCommand } from "./commands/groups.js";
-import { registerGroupGrantsCommand } from "./commands/group-grants.js";
-import { registerFilesCommand } from "./commands/files.js";
-import { registerFilesBrowseCommands } from "./commands/files-browse.js";
-import { registerMembersCommand } from "./commands/members.js";
-import { registerPeopleCommand } from "./commands/people.js";
-import { registerDmCommand } from "./commands/dm.js";
-import { registerChannelsCommand } from "./commands/channels.js";
-import { registerFeedbackCommand } from "./commands/feedback.js";
-import { registerMeetingsCommand } from "./commands/meetings.js";
-import { registerSourcesCommand } from "./commands/sources.js";
-import { registerSignalsCommand } from "./commands/signals.js";
-import { registerReindexCommand } from "./commands/reindex.js";
-import { registerRescueCommand } from "./commands/rescue.js";
-import { registerMcpCommand } from "./commands/mcp-status.js";
-import { registerCrmCommand } from "./commands/crm.js";
-import { registerCompanyCommand } from "./commands/company.js";
-import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
-import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
-import { isEpipe } from "./utils/epipe.js";
-import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
-import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
-import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
 import { CLI_VERSION } from "./cli-version.js";
-// Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes
-// the pipe early. This covers the ASYNC path — an 'error' event emitted on the
-// stream. The SYNCHRONOUS path (a `write EPIPE` thrown straight out of
-// console.log inside a command) is handled in the top-level catch below; both
-// share `isEpipe` (HQ-6B).
-const onPipeError = (err) => {
-    if (isEpipe(err)) {
-        process.exit(0);
-    }
-    throw err;
-};
-process.stdout.on("error", onPipeError);
-process.stderr.on("error", onPipeError);
-initSentry();
-maybeWarnNewVersion();
-const program = new Command();
-program
-    .name("hq")
-    .description("HQ management CLI — modules, packages, and cloud sync")
-    .version(CLI_VERSION);
-// Module management subcommand group
-const modulesCmd = program
-    .command("modules")
-    .description("Module management commands");
-registerAddCommand(modulesCmd);
-registerSyncCommand(modulesCmd);
-registerListCommand(modulesCmd);
-registerUpdateCommand(modulesCmd);
-// Package management subcommand group
-const packagesCmd = program
-    .command("packages")
-    .description("Package management commands");
-registerPackageInstallCommand(packagesCmd);
-registerPackageRemoveCommand(packagesCmd);
-registerPackageUpdateCommand(packagesCmd);
-registerPackageListCommand(packagesCmd);
-// Content-pack lifecycle (core/packages/hq-pack-*). Distinct from the registry
-// `packages` system above. Available as both `hq packages packs …` (grouped)
-// and `hq packs …` (top-level convenience).
-registerPacksCommand(packagesCmd);
-registerPacksCommand(program);
-// Top-level shortcuts for package commands
-// "hq install <slug>" = "hq packages install <slug>"
-// "hq remove <slug>"  = "hq packages remove <slug>"
-registerPackageInstallCommand(program);
-registerPackageRemoveCommand(program);
-// Marketplace publish (top-level — packer + authenticated upload, US-004)
-// "hq publish <skill-or-worker-path>" packages and submits a pack to the
-// marketplace via POST /v1/listings.
-registerPublishCommand(program);
-// `hq creators apply` — request verified-creator access (required to publish).
-registerCreatorsCommand(program);
-// Cloud sync subcommand group
-const syncCmd = program
-    .command("sync")
-    .description("Cloud sync commands — sync HQ to S3 for mobile access");
-registerCloudCommands(syncCmd);
-registerSyncModeCommand(syncCmd);
-registerSyncNarrowCommand(syncCmd);
-// Cloud provisioning subcommand group (entity + bucket + initial sync)
-// Distinct from `hq sync` which assumes provisioning has already happened.
-const cloudCmd = program
-    .command("cloud")
-    .description("Cloud commands — provision entities and manage cloud-backed companies");
-registerCloudProvisionCommands(cloudCmd);
-registerCloudDemoteCommands(cloudCmd);
-// Team commands (top-level)
-registerTeamSyncCommand(program);
-// Auth commands (top-level — Cognito OAuth)
-registerLoginCommand(program);
-registerLogoutCommand(program);
-registerWhoamiCommand(program);
-registerAuthCommands(program);
-// Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
-registerSecretsCommand(program);
-// API key management (subcommand group — hq api-keys create|list|revoke)
-registerApiKeysCommand(program);
-// Schema-driven dev runner — hq run [options] -- <cmd>
-registerRunCommand(program);
-// Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
-registerGroupsCommand(program);
-// Cross-company group grants (subcommand group —
-// hq group-grants grant|revoke|outbound|inbound)
-registerGroupGrantsCommand(program);
-// Files ACL management (subcommand group — hq files share|unshare|acl)
-// `registerFilesCommand` returns the `files` group so we can attach the
-// browse-vs-sync subcommands (`hq files browse`/`cat`) onto the same group.
-const filesCmd = registerFilesCommand(program);
-registerFilesBrowseCommands(filesCmd);
-// Membership management (subcommand group — hq members invite|list|revoke)
-registerMembersCommand(program);
-// People directory (subcommand group — hq people list|search|resolve), reading
-// the local companies/<co>/people store scoped to one company.
-registerPeopleCommand(program);
-registerDmCommand(program);
-registerChannelsCommand(program);
-// Onboarding (top-level — Cognito + vault-service provisioning)
-registerOnboardCommand(program);
-// Feedback (subcommand group — hq feedback bug|feature)
-registerFeedbackCommand(program);
-// Meetings (subcommand group — hq meetings list|get|search|transcript|notes)
-registerMeetingsCommand(program);
-// Sources read surface (subcommand group — hq sources list|get|channels|entities)
-registerSourcesCommand(program);
-// Signals read surface (subcommand group — hq signals list|get|types|entities)
-registerSignalsCommand(program);
-// Skill/personal-overlay mirroring + workers-registry regen. Invoked by the
-// hq-core reindex hook shim (Stop / PostToolUse) and by sync()/rescue() after
-// they change on-disk sources. Keeps a `master-sync` alias for one release.
-// Implementation lives in @indigoai-us/hq-cloud.
-registerReindexCommand(program);
-// Drift-preserving HQ-core re-sync (top-level — `hq rescue`). CLI sibling of
-// the HQ Sync app's "Update / Restore" pill; drives the same replace-rescue.sh
-// shipped from @indigoai-us/hq-cloud.
-registerRescueCommand(program);
-// MCP pack observability (subcommand group — `hq mcp status`). Read-only
-// provenance-based status across BOTH Claude + Codex runtimes (reads `_hqPack`
-// off the configs, NOT linkStatus), with secret-redacted output + `--json`.
-registerMcpCommand(program);
-// Native CRM entity upsert (subcommand group — `hq crm entity upsert`). Wraps
-// POST /crm/entities (the ontology write gate) so an authenticated company
-// member can create/update canonical CRM entities in the company vault.
-registerCrmCommand(program);
-// Company settings (subcommand group — `hq company settings set`). Owner-only
-// toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
-registerCompanyCommand(program);
-(async () => {
-    try {
-        Sentry.addBreadcrumb({
-            category: "command",
-            message: sanitizeArgv(process.argv.slice(2)).join(" "),
-            level: "info",
-        });
-        // Hard version gate: ask hq-pro whether this CLI is below the floor and
-        // auto-update if so (exits the process on update). Skipped for inspection
-        // flags (`--version`, `--help`) so users debugging a broken install can
-        // still introspect what they have. Silent on any failure — never blocks
-        // the CLI on a flaky network or hq-pro hiccup. See `utils/version-gate.ts`.
-        if (!shouldSkipGate(process.argv)) {
-            await enforceVersionGate();
-        }
-        await program.parseAsync();
-    }
-    catch (err) {
-        // A broken pipe (EPIPE) means the reader of `hq`'s output closed it early
-        // (`hq … | head`, `source <(hq …)`, a parent that exited). That is normal
-        // Unix behavior with no user-facing degradation — exit cleanly (0) and
-        // skip Sentry capture instead of shipping a fatal (HQ-6B). A synchronous
-        // `write EPIPE` thrown out of console.log lands here rather than on the
-        // stream 'error' listener above.
-        if (isEpipe(err)) {
-            process.exitCode = 0;
-        }
-        else if (isInterceptedProcessExit(err)) {
-            // A security/audit FUZZ harness replaced `process.exit` with a throw so it
-            // can keep exercising the binary. Commander calling `process.exit` for
-            // normal CLI control flow (e.g. an unknown command → exit 1) then surfaces
-            // here as that synthetic marker. It is a test-harness artifact, NOT an
-            // hq-cli defect — a real user's `process.exit` just exits, so nothing is
-            // thrown or captured. Skip Sentry capture (no signal, no user-facing
-            // degradation) and preserve the intended non-zero exit (HQ-CLI-3).
-            process.exitCode = 1;
-        }
-        else {
-            // A full disk / exhausted quota / read-only filesystem is the user's
-            // machine, not an HQ code defect. Surface a clear, actionable message and
-            // skip Sentry capture so one full disk doesn't flood the tracker with
-            // identical, unfixable crash reports (HQ-CLI-2). Genuine errors still go
-            // to Sentry and still exit 1.
-            const envMsg = environmentalFsErrorMessage(err);
-            if (envMsg) {
-                process.stderr.write(`hq: ${envMsg}\n`);
-            }
-            else {
-                Sentry.captureException(err);
-            }
-            process.exitCode = 1;
-        }
-    }
-    finally {
-        // Release health: finalize the per-run session before the flush.
-        Sentry.endSession();
-        await Promise.allSettled([refreshVersionCache(), Sentry.flush(2000)]);
-    }
-})();
+function isVersionRequest(argv) {
+    const args = argv.slice(2);
+    return args.length === 1 && (args[0] === "--version" || args[0] === "-V" || args[0] === "-v");
+}
+if (isVersionRequest(process.argv)) {
+    process.stdout.write(`${CLI_VERSION}\n`);
+}
+else {
+    const { runCli } = await import("./main.js");
+    await runCli();
+}
+export const __test__ = { isVersionRequest };
 //# sourceMappingURL=index.js.map
-//# debugId=8839ee7d-9f6d-54fe-8f90-99ad858e349e
+//# debugId=8fdfd788-4c00-50bc-9ed0-579ed9d5f903

package/dist/main.d.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+/**
+ * HQ CLI - Module management, package management, and cloud sync for HQ
+ */
+import "./node-preflight.js";
+export declare function runCli(): Promise<void>;
+//# sourceMappingURL=main.d.ts.map