@indigoai-us/hq-cli 5.60.0 → 5.62.0

package/src/commands/secrets.ts

@@ -279,6 +279,121 @@ function describeSecretAclPrincipal(principal: SecretAclPrincipal): string {
     : principal.granteeId;
 }
 
+// secrets-proxy-per-secret-destination US-006: an InjectionRecipe as sent on
+// the create/update POST body. Mirrors hq-pro's `InjectionRecipe`
+// (src/vault-service/handlers/secrets.ts) — kept as a local shape (not
+// imported) since the CLI does not depend on the hq-pro package.
+export interface SecretInjectionRecipe {
+  header: string;
+  scheme: "raw" | "bearer";
+  extraHeaders?: Record<string, string>;
+}
+
+// Mirrors hq-pro's server-authoritative KNOWN_DESTINATION_REGISTRY
+// (src/vault-service/handlers/destination-registry.ts) — a KNOWN host's
+// --auth-style is optional because the server resolves the recipe itself.
+// This client-side copy exists purely so an UNKNOWN host with no
+// --auth-style can be rejected immediately with a clear, actionable message
+// instead of a round trip; the server remains the authoritative validator
+// (this list drifting stale merely means one extra CLI round trip, not a
+// security gap — the server still 400s an unrecognized host with no recipe).
+const KNOWN_DESTINATION_HOSTS = new Set([
+  "api.anthropic.com",
+  "api.openai.com",
+  "api.stripe.com",
+]);
+
+// Parses `--auth-style` into the InjectionRecipe shape the server expects.
+// Returns `null` (with a printed error) for an unrecognized value.
+function parseAuthStyle(authStyle: string): SecretInjectionRecipe | null {
+  if (authStyle === "bearer") {
+    return { header: "authorization", scheme: "bearer" };
+  }
+  if (authStyle === "x-api-key") {
+    return { header: "x-api-key", scheme: "raw" };
+  }
+  const headerMatch = authStyle.match(/^header:(.+)$/);
+  if (headerMatch) {
+    const headerName = headerMatch[1].trim();
+    if (!headerName) {
+      console.error(
+        chalk.red(
+          `Invalid --auth-style 'header:': must name a header, e.g. header:X-Custom-Key`,
+        ),
+      );
+      return null;
+    }
+    return { header: headerName, scheme: "raw" };
+  }
+  console.error(
+    chalk.red(
+      `Invalid --auth-style '${authStyle}': must be one of bearer, x-api-key, or header:NAME`,
+    ),
+  );
+  return null;
+}
+
+// Validates `--destination` is a bare HTTPS scheme+host URL (no path, query,
+// port). Mirrors hq-pro's `validateDestinations` server-side check
+// (src/vault-service/handlers/secrets.ts) so a malformed URL is caught
+// locally with an actionable message rather than a round trip — the server
+// re-validates and remains authoritative.
+export function parseDestinationUrl(
+  raw: string,
+): { ok: true; url: string; hostname: string } | { ok: false } {
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    console.error(
+      chalk.red(`Invalid --destination '${raw}': must be a valid URL`),
+    );
+    return { ok: false };
+  }
+  if (parsed.protocol !== "https:") {
+    console.error(
+      chalk.red(`Invalid --destination '${raw}': must use https://`),
+    );
+    return { ok: false };
+  }
+  if (!parsed.hostname) {
+    console.error(
+      chalk.red(`Invalid --destination '${raw}': missing hostname`),
+    );
+    return { ok: false };
+  }
+  // Reject an embedded `user:pass@host` credential segment explicitly rather
+  // than letting `new URL()` silently drop it (mirrors hq-pro's authoritative
+  // `validateDestinations`; the server re-validates and remains authoritative).
+  if (parsed.username !== "" || parsed.password !== "") {
+    console.error(
+      chalk.red(
+        `Invalid --destination '${raw}': must not contain embedded userinfo (user:pass@) credentials`,
+      ),
+    );
+    return { ok: false };
+  }
+  if (
+    (parsed.pathname !== "" && parsed.pathname !== "/") ||
+    parsed.search !== "" ||
+    parsed.hash !== ""
+  ) {
+    console.error(
+      chalk.red(
+        `Invalid --destination '${raw}': must be a bare scheme+host URL with no path, query, or fragment (e.g. https://api.openai.com)`,
+      ),
+    );
+    return { ok: false };
+  }
+  if (parsed.port !== "") {
+    console.error(
+      chalk.red(`Invalid --destination '${raw}': must not specify a port`),
+    );
+    return { ok: false };
+  }
+  return { ok: true, url: `https://${parsed.hostname}`, hostname: parsed.hostname };
+}
+
 function normalizeSecretTier(tier?: string): SecretTier {
   return tier === "sensitive" || tier === "nuclear" ? tier : "standard";
 }
@@ -323,8 +438,17 @@ async function buildSecretUsage(
   };
 }
 
-function parseSecretNameList(input: string): string[] {
-  const keys = input.split(",").map((k) => k.trim()).filter(Boolean);
+// Commander collector for `--only`: accumulates across REPEATED flags instead
+// of the last one silently winning, and each value may still be
+// comma-separated. So `--only A,B`, `--only A --only B`, and
+// `--only A,B --only C` all resolve to the full list.
+export function collectSecretNames(value: string, previous?: string[]): string[] {
+  const parsed = value.split(",").map((k) => k.trim()).filter(Boolean);
+  return (previous ?? []).concat(parsed);
+}
+
+function parseSecretNameList(input: string[] | undefined): string[] {
+  const keys = input ?? [];
   if (keys.length === 0) {
     console.error(chalk.red("Error: --only requires at least one secret name."));
     process.exit(1);
@@ -572,13 +696,87 @@ export function registerSecretsCommand(program: Command): void {
     .command("set <name>")
     .description("Create or update a secret")
     .option("--from-stdin", "Read secret value from piped stdin")
-    .action(async (name: string, opts: { fromStdin?: boolean }) => {
+    .option(
+      "--high-security",
+      "Mark the secret high-security: it can never be revealed or injected locally, only used through the HQ secret proxy (requires --destination)",
+    )
+    .option(
+      "--destination <https-url>",
+      "Approved scheme+host HTTPS URL the proxy may forward this secret to (e.g. https://api.openai.com); required with --high-security",
+    )
+    .option(
+      "--auth-style <style>",
+      "How the proxy attaches the key upstream: bearer | x-api-key | header:NAME. Optional for known destinations (auto-resolved server-side); required for unknown ones",
+    )
+    .action(async (
+      name: string,
+      opts: {
+        fromStdin?: boolean;
+        highSecurity?: boolean;
+        destination?: string;
+        authStyle?: string;
+      },
+    ) => {
       try {
         if (!SECRET_NAME_PATTERN.test(name)) {
           console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
           process.exit(1);
         }
 
+        // secrets-proxy-per-secret-destination US-006: --high-security marks
+        // the secret so it can only ever be used through the server-side
+        // proxy (never revealed/injected locally — that refusal is the
+        // pre-existing consumption-side behavior in `get`/`exec`/`env` above,
+        // unchanged by this story). It REQUIRES a --destination: the proxy
+        // (hq-pro US-002) fails closed with no destination configured, so
+        // catching the missing pin here is a clear, immediate CLI error
+        // rather than a deferred proxy-time failure.
+        let destinations: string[] | undefined;
+        let injection: SecretInjectionRecipe | undefined;
+        if (opts.highSecurity) {
+          if (!opts.destination) {
+            console.error(
+              chalk.red(
+                "Error: --high-security requires --destination <https-url> (e.g. --destination https://api.openai.com).",
+              ),
+            );
+            process.exit(1);
+          }
+
+          const destResult = parseDestinationUrl(opts.destination);
+          if (!destResult.ok) {
+            process.exit(1);
+          }
+          destinations = [destResult.url];
+
+          if (opts.authStyle) {
+            const recipe = parseAuthStyle(opts.authStyle);
+            if (!recipe) {
+              process.exit(1);
+            }
+            injection = recipe;
+          } else if (!KNOWN_DESTINATION_HOSTS.has(destResult.hostname)) {
+            // Unknown host + no explicit recipe: the server would reject this
+            // 400 anyway (US-004 registry lookup only, never guesses) — fail
+            // fast locally with an actionable message instead of a round trip.
+            console.error(
+              chalk.red(
+                `Error: unknown destination host '${destResult.hostname}' — provide --auth-style <bearer|x-api-key|header:NAME> (known hosts auto-resolve: ${[...KNOWN_DESTINATION_HOSTS].join(", ")}).`,
+              ),
+            );
+            process.exit(1);
+          }
+          // Known host + no --auth-style: leave `injection` undefined so the
+          // server (US-004) auto-resolves the recipe from its registry.
+        } else if (opts.destination || opts.authStyle) {
+          console.error(
+            chalk.red(
+              "Error: --destination/--auth-style require --high-security.",
+            ),
+          );
+          process.exit(1);
+        }
+
         let value: string;
         if (opts.fromStdin) {
           if (process.stdin.isTTY) {
@@ -617,19 +815,35 @@ export function registerSecretsCommand(program: Command): void {
           token,
           path: `/secrets/${encodeURIComponent(companyUid)}`,
           method: "POST",
-          body: { name, value },
+          body: {
+            name,
+            value,
+            // Only present when --high-security was passed — an ordinary
+            // `set` with no flags sends exactly `{ name, value }`, byte-for-
+            // byte unchanged from before this story.
+            ...(opts.highSecurity ? { highSecurity: true } : {}),
+            ...(destinations ? { destinations } : {}),
+            ...(injection ? { injection } : {}),
+          },
         });
 
         if (!res.ok) {
-          const body = await res.json().catch(() => ({}));
+          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
           console.error(
-            chalk.red(`Failed to set secret: ${(body as Record<string, string>).error ?? res.statusText}`),
+            chalk.red(`Failed to set secret: ${extractApiMessage(body, res.statusText)}`),
           );
           process.exit(1);
         }
 
         removeCacheEntry(companyUid, name);
         console.log(chalk.green(formatSecretSaved(name, scopeLabel)));
+        if (opts.highSecurity) {
+          console.log(
+            chalk.dim(
+              `  High-security: destination pinned to ${destinations?.[0]}. This value can never be revealed or injected locally — only used through the HQ secret proxy.`,
+            ),
+          );
+        }
       } catch (err) {
         console.error(
           chalk.red("Error:"),
@@ -1253,11 +1467,11 @@ export function registerSecretsCommand(program: Command): void {
       "--personal",
       "Operate on the caller's personal vault (no sharing)",
     )
-    .option("--only <keys>", "Comma-separated list of secret names to inject (required)")
+    .option("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
     .allowUnknownOption(true)
-    .action(async (opts: { company?: string; personal?: boolean; only?: string }, cmd: Command) => {
+    .action(async (opts: { company?: string; personal?: boolean; only?: string[] }, cmd: Command) => {
       try {
-        if (!opts.only || opts.only.trim().length === 0) {
+        if (!opts.only || opts.only.length === 0) {
           console.error(chalk.red("Error: --only is required and must name at least one secret."));
           process.exit(1);
         }
@@ -1307,10 +1521,10 @@ export function registerSecretsCommand(program: Command): void {
   secrets
     .command("exec")
     .description("Run a command with secrets injected as env vars")
-    .requiredOption("--only <keys>", "Comma-separated list of secret names to inject (required)")
+    .requiredOption("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
     .option("--script <path>", "Attach local script identity for script-locked secrets")
     .allowUnknownOption(true)
-    .action(async (_opts: { only: string; script?: string }, cmd: Command) => {
+    .action(async (_opts: { only: string[]; script?: string }, cmd: Command) => {
       try {
         const rawArgs = cmd.args;
         const dashIndex = process.argv.indexOf("--");
@@ -1381,9 +1595,9 @@ export function registerSecretsCommand(program: Command): void {
   secrets
     .command("env")
     .description("Print 'export KEY=VALUE' lines suitable for: source <(hq secrets env --only K1,K2)")
-    .requiredOption("--only <keys>", "Comma-separated list of secret names to print (required)")
+    .requiredOption("--only <keys>", "Secret names to print (comma-separated; may be repeated) (required)", collectSecretNames)
     .option("--script <path>", "Attach local script identity for script-locked secrets")
-    .action(async (opts: { only: string; script?: string }) => {
+    .action(async (opts: { only: string[]; script?: string }) => {
       try {
         const redact = process.stdout.isTTY;
         if (redact) {