@indigoai-us/hq-cli 5.60.0 → 5.61.0

package/src/commands/secrets.test.ts

@@ -528,6 +528,324 @@ describe("US-003 — CLI refuses high-security secrets on local injection", () =
   });
 });
 
+// secrets-proxy-per-secret-destination US-006: hq-cli creation-side parity.
+// `hq secrets set NAME --high-security --destination <url> [--auth-style ...]`
+// POSTs `highSecurity`/`destinations`/`injection` to the vault API — the CLI
+// counterpart to the console create-form (US-005) and the server contract
+// (US-001/US-004). Value input is exercised via --from-stdin (unaffected by
+// this story) so these tests isolate the new flag-handling/validation.
+describe("US-006 — hq secrets set --high-security --destination parity", () => {
+  let exitSpy: MockInstance<typeof process.exit>;
+  let stdinIsTTYSpy: MockInstance<() => boolean> | undefined;
+
+  beforeEach(() => {
+    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
+      throw new Error("__exit__");
+    }) as never);
+  });
+
+  afterEach(() => {
+    stdinIsTTYSpy?.mockRestore();
+    stdinIsTTYSpy = undefined;
+  });
+
+  // Drives the value through the existing --from-stdin path (unchanged by
+  // this story) by feeding a piped-stdin double: mocks isTTY=false and
+  // replaces the data/end listeners `readFromPipedStdin` attaches.
+  function stubPipedStdin(value: string): void {
+    Object.defineProperty(process.stdin, "isTTY", {
+      configurable: true,
+      value: false,
+    });
+    vi.spyOn(process.stdin, "on").mockImplementation(((
+      event: string,
+      cb: (...args: unknown[]) => void,
+    ) => {
+      if (event === "data") cb(value);
+      if (event === "end") cb();
+      return process.stdin;
+    }) as never);
+  }
+
+  it("with no flags, the POST body is byte-for-byte unchanged (just name+value)", async () => {
+    stubPipedStdin("plain-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "MY_KEY",
+      "--from-stdin",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: { name: "MY_KEY", value: "plain-value" },
+    });
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+
+  it("--high-security with a KNOWN destination auto-resolves the recipe (no --auth-style needed)", async () => {
+    stubPipedStdin("sk-secret-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "OPENAI_KEY",
+      "--from-stdin",
+      "--high-security",
+      "--destination",
+      "https://api.openai.com",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: {
+        name: "OPENAI_KEY",
+        value: "sk-secret-value",
+        highSecurity: true,
+        destinations: ["https://api.openai.com"],
+      },
+    });
+    expect(errSpy).not.toHaveBeenCalled();
+    expect(logSpy.mock.calls.flat().join(" ")).toMatch(/high-security/i);
+  });
+
+  it("--auth-style bearer maps to {header: authorization, scheme: bearer}", async () => {
+    stubPipedStdin("bearer-token-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "SOME_BEARER_KEY",
+      "--from-stdin",
+      "--high-security",
+      "--destination",
+      "https://api.example.com",
+      "--auth-style",
+      "bearer",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: {
+        name: "SOME_BEARER_KEY",
+        value: "bearer-token-value",
+        highSecurity: true,
+        destinations: ["https://api.example.com"],
+        injection: { header: "authorization", scheme: "bearer" },
+      },
+    });
+  });
+
+  it("--auth-style x-api-key maps to {header: x-api-key, scheme: raw}", async () => {
+    stubPipedStdin("raw-key-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "SOME_RAW_KEY",
+      "--from-stdin",
+      "--high-security",
+      "--destination",
+      "https://api.example.com",
+      "--auth-style",
+      "x-api-key",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: {
+        name: "SOME_RAW_KEY",
+        value: "raw-key-value",
+        highSecurity: true,
+        destinations: ["https://api.example.com"],
+        injection: { header: "x-api-key", scheme: "raw" },
+      },
+    });
+  });
+
+  it("--auth-style header:NAME maps to a custom raw header", async () => {
+    stubPipedStdin("custom-header-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "CUSTOM_HEADER_KEY",
+      "--from-stdin",
+      "--high-security",
+      "--destination",
+      "https://api.example.com",
+      "--auth-style",
+      "header:X-Custom-Key",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: {
+        name: "CUSTOM_HEADER_KEY",
+        value: "custom-header-value",
+        highSecurity: true,
+        destinations: ["https://api.example.com"],
+        injection: { header: "X-Custom-Key", scheme: "raw" },
+      },
+    });
+  });
+
+  it("--high-security with an UNKNOWN host and no --auth-style errors clearly, client-side (no request sent)", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "UNKNOWN_HOST_KEY",
+        "--from-stdin",
+        "--high-security",
+        "--destination",
+        "https://api.unknown-vendor.example",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/unknown destination host/i);
+    expect(errText).toMatch(/--auth-style/);
+    // Client-side rejection — never reaches the network.
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("--high-security with no --destination errors clearly (non-zero exit, no request sent)", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "MISSING_DEST_KEY",
+        "--from-stdin",
+        "--high-security",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/--high-security/);
+    expect(errText).toMatch(/--destination/);
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("--destination without --high-security errors clearly (non-zero exit, no request sent)", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "STRAY_DEST_KEY",
+        "--from-stdin",
+        "--destination",
+        "https://api.openai.com",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("an invalid --destination URL (path segment) errors clearly, client-side", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "BAD_URL_KEY",
+        "--from-stdin",
+        "--high-security",
+        "--destination",
+        "https://api.openai.com/v1",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/no path, query, or fragment/i);
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("surfaces the server's rejection message when the backend 400s (e.g. unknown host drift)", async () => {
+    stubPipedStdin("value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes(
+        {
+          error:
+            "unknown destination host api.newer-vendor.com: provide an injection recipe (header + scheme)",
+        },
+        400,
+      ),
+    );
+
+    const program = buildProgram();
+    // A host absent from the CLI's own known-set copy but WOULD be flagged
+    // client-side too (this asserts the server-error surfacing path itself
+    // stays intact, using --auth-style to bypass the client-side check and
+    // reach the network).
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "DRIFT_KEY",
+        "--from-stdin",
+        "--high-security",
+        "--destination",
+        "https://api.newer-vendor.com",
+        "--auth-style",
+        "bearer",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/unknown destination host/i);
+  });
+});
+
 describe("secrets generate-link", () => {
   it("mints one-time submission links for personal secrets", async () => {
     const program = buildProgram();

package/src/commands/secrets.ts

@@ -279,6 +279,110 @@ function describeSecretAclPrincipal(principal: SecretAclPrincipal): string {
     : principal.granteeId;
 }
 
+// secrets-proxy-per-secret-destination US-006: an InjectionRecipe as sent on
+// the create/update POST body. Mirrors hq-pro's `InjectionRecipe`
+// (src/vault-service/handlers/secrets.ts) — kept as a local shape (not
+// imported) since the CLI does not depend on the hq-pro package.
+export interface SecretInjectionRecipe {
+  header: string;
+  scheme: "raw" | "bearer";
+  extraHeaders?: Record<string, string>;
+}
+
+// Mirrors hq-pro's server-authoritative KNOWN_DESTINATION_REGISTRY
+// (src/vault-service/handlers/destination-registry.ts) — a KNOWN host's
+// --auth-style is optional because the server resolves the recipe itself.
+// This client-side copy exists purely so an UNKNOWN host with no
+// --auth-style can be rejected immediately with a clear, actionable message
+// instead of a round trip; the server remains the authoritative validator
+// (this list drifting stale merely means one extra CLI round trip, not a
+// security gap — the server still 400s an unrecognized host with no recipe).
+const KNOWN_DESTINATION_HOSTS = new Set([
+  "api.anthropic.com",
+  "api.openai.com",
+  "api.stripe.com",
+]);
+
+// Parses `--auth-style` into the InjectionRecipe shape the server expects.
+// Returns `null` (with a printed error) for an unrecognized value.
+function parseAuthStyle(authStyle: string): SecretInjectionRecipe | null {
+  if (authStyle === "bearer") {
+    return { header: "authorization", scheme: "bearer" };
+  }
+  if (authStyle === "x-api-key") {
+    return { header: "x-api-key", scheme: "raw" };
+  }
+  const headerMatch = authStyle.match(/^header:(.+)$/);
+  if (headerMatch) {
+    const headerName = headerMatch[1].trim();
+    if (!headerName) {
+      console.error(
+        chalk.red(
+          `Invalid --auth-style 'header:': must name a header, e.g. header:X-Custom-Key`,
+        ),
+      );
+      return null;
+    }
+    return { header: headerName, scheme: "raw" };
+  }
+  console.error(
+    chalk.red(
+      `Invalid --auth-style '${authStyle}': must be one of bearer, x-api-key, or header:NAME`,
+    ),
+  );
+  return null;
+}
+
+// Validates `--destination` is a bare HTTPS scheme+host URL (no path, query,
+// port). Mirrors hq-pro's `validateDestinations` server-side check
+// (src/vault-service/handlers/secrets.ts) so a malformed URL is caught
+// locally with an actionable message rather than a round trip — the server
+// re-validates and remains authoritative.
+function parseDestinationUrl(
+  raw: string,
+): { ok: true; url: string; hostname: string } | { ok: false } {
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    console.error(
+      chalk.red(`Invalid --destination '${raw}': must be a valid URL`),
+    );
+    return { ok: false };
+  }
+  if (parsed.protocol !== "https:") {
+    console.error(
+      chalk.red(`Invalid --destination '${raw}': must use https://`),
+    );
+    return { ok: false };
+  }
+  if (!parsed.hostname) {
+    console.error(
+      chalk.red(`Invalid --destination '${raw}': missing hostname`),
+    );
+    return { ok: false };
+  }
+  if (
+    (parsed.pathname !== "" && parsed.pathname !== "/") ||
+    parsed.search !== "" ||
+    parsed.hash !== ""
+  ) {
+    console.error(
+      chalk.red(
+        `Invalid --destination '${raw}': must be a bare scheme+host URL with no path, query, or fragment (e.g. https://api.openai.com)`,
+      ),
+    );
+    return { ok: false };
+  }
+  if (parsed.port !== "") {
+    console.error(
+      chalk.red(`Invalid --destination '${raw}': must not specify a port`),
+    );
+    return { ok: false };
+  }
+  return { ok: true, url: `https://${parsed.hostname}`, hostname: parsed.hostname };
+}
+
 function normalizeSecretTier(tier?: string): SecretTier {
   return tier === "sensitive" || tier === "nuclear" ? tier : "standard";
 }
@@ -572,13 +676,87 @@ export function registerSecretsCommand(program: Command): void {
     .command("set <name>")
     .description("Create or update a secret")
     .option("--from-stdin", "Read secret value from piped stdin")
-    .action(async (name: string, opts: { fromStdin?: boolean }) => {
+    .option(
+      "--high-security",
+      "Mark the secret high-security: it can never be revealed or injected locally, only used through the HQ secret proxy (requires --destination)",
+    )
+    .option(
+      "--destination <https-url>",
+      "Approved scheme+host HTTPS URL the proxy may forward this secret to (e.g. https://api.openai.com); required with --high-security",
+    )
+    .option(
+      "--auth-style <style>",
+      "How the proxy attaches the key upstream: bearer | x-api-key | header:NAME. Optional for known destinations (auto-resolved server-side); required for unknown ones",
+    )
+    .action(async (
+      name: string,
+      opts: {
+        fromStdin?: boolean;
+        highSecurity?: boolean;
+        destination?: string;
+        authStyle?: string;
+      },
+    ) => {
       try {
         if (!SECRET_NAME_PATTERN.test(name)) {
           console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
           process.exit(1);
         }
 
+        // secrets-proxy-per-secret-destination US-006: --high-security marks
+        // the secret so it can only ever be used through the server-side
+        // proxy (never revealed/injected locally — that refusal is the
+        // pre-existing consumption-side behavior in `get`/`exec`/`env` above,
+        // unchanged by this story). It REQUIRES a --destination: the proxy
+        // (hq-pro US-002) fails closed with no destination configured, so
+        // catching the missing pin here is a clear, immediate CLI error
+        // rather than a deferred proxy-time failure.
+        let destinations: string[] | undefined;
+        let injection: SecretInjectionRecipe | undefined;
+        if (opts.highSecurity) {
+          if (!opts.destination) {
+            console.error(
+              chalk.red(
+                "Error: --high-security requires --destination <https-url> (e.g. --destination https://api.openai.com).",
+              ),
+            );
+            process.exit(1);
+          }
+
+          const destResult = parseDestinationUrl(opts.destination);
+          if (!destResult.ok) {
+            process.exit(1);
+          }
+          destinations = [destResult.url];
+
+          if (opts.authStyle) {
+            const recipe = parseAuthStyle(opts.authStyle);
+            if (!recipe) {
+              process.exit(1);
+            }
+            injection = recipe;
+          } else if (!KNOWN_DESTINATION_HOSTS.has(destResult.hostname)) {
+            // Unknown host + no explicit recipe: the server would reject this
+            // 400 anyway (US-004 registry lookup only, never guesses) — fail
+            // fast locally with an actionable message instead of a round trip.
+            console.error(
+              chalk.red(
+                `Error: unknown destination host '${destResult.hostname}' — provide --auth-style <bearer|x-api-key|header:NAME> (known hosts auto-resolve: ${[...KNOWN_DESTINATION_HOSTS].join(", ")}).`,
+              ),
+            );
+            process.exit(1);
+          }
+          // Known host + no --auth-style: leave `injection` undefined so the
+          // server (US-004) auto-resolves the recipe from its registry.
+        } else if (opts.destination || opts.authStyle) {
+          console.error(
+            chalk.red(
+              "Error: --destination/--auth-style require --high-security.",
+            ),
+          );
+          process.exit(1);
+        }
+
         let value: string;
         if (opts.fromStdin) {
           if (process.stdin.isTTY) {
@@ -617,19 +795,35 @@ export function registerSecretsCommand(program: Command): void {
           token,
           path: `/secrets/${encodeURIComponent(companyUid)}`,
           method: "POST",
-          body: { name, value },
+          body: {
+            name,
+            value,
+            // Only present when --high-security was passed — an ordinary
+            // `set` with no flags sends exactly `{ name, value }`, byte-for-
+            // byte unchanged from before this story.
+            ...(opts.highSecurity ? { highSecurity: true } : {}),
+            ...(destinations ? { destinations } : {}),
+            ...(injection ? { injection } : {}),
+          },
         });
 
         if (!res.ok) {
-          const body = await res.json().catch(() => ({}));
+          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
           console.error(
-            chalk.red(`Failed to set secret: ${(body as Record<string, string>).error ?? res.statusText}`),
+            chalk.red(`Failed to set secret: ${extractApiMessage(body, res.statusText)}`),
           );
           process.exit(1);
         }
 
         removeCacheEntry(companyUid, name);
         console.log(chalk.green(formatSecretSaved(name, scopeLabel)));
+        if (opts.highSecurity) {
+          console.log(
+            chalk.dim(
+              `  High-security: destination pinned to ${destinations?.[0]}. This value can never be revealed or injected locally — only used through the HQ secret proxy.`,
+            ),
+          );
+        }
       } catch (err) {
         console.error(
           chalk.red("Error:"),

package/src/index.test.ts

@@ -0,0 +1,32 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("./cli-version.js", () => ({
+  CLI_VERSION: "5.60.0",
+  CLI_NAME: "@indigoai-us/hq-cli",
+}));
+
+vi.mock("./node-preflight.js", () => ({}));
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.resetModules();
+});
+
+describe("bin bootstrap", () => {
+  it("answers --version without importing the command graph", async () => {
+    const originalArgv = process.argv;
+    const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+    const runCli = vi.fn();
+    vi.doMock("./main.js", () => ({ runCli }));
+    process.argv = ["node", "hq", "--version"];
+
+    try {
+      await import("./index.js");
+    } finally {
+      process.argv = originalArgv;
+    }
+
+    expect(write).toHaveBeenCalledWith("5.60.0\n");
+    expect(runCli).not.toHaveBeenCalled();
+  });
+});