@indigoai-us/hq-cli 5.75.0 → 5.76.0

package/src/commands/secrets.test.ts

@@ -42,10 +42,9 @@ vi.mock("../utils/secrets-cache.js", async (importOriginal) => {
   const original = (await importOriginal()) as Record<string, unknown>;
   return {
     ...original,
-    // Default: cold cache (every key is a miss → forces a batch-load request).
-    // Tests that exercise the warm path override readCache per-case.
     readCache: vi.fn(() => null),
     writeCache: vi.fn(() => undefined),
+    removeCacheEntry: vi.fn(() => undefined),
   };
 });
 
@@ -64,7 +63,11 @@ import {
 import { spawn } from "node:child_process";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { getEntityUid, vaultApiFetch } from "../utils/vault-api.js";
-import { readCache, writeCache } from "../utils/secrets-cache.js";
+import {
+  readCache,
+  removeCacheEntry,
+  writeCache,
+} from "../utils/secrets-cache.js";
 import { SandboxRunnerClient } from "../utils/sandbox-runner-client.js";
 
 let logSpy: MockInstance<typeof console.log>;
@@ -377,12 +380,69 @@ describe("secrets sandbox", () => {
     expect(stdoutSpy).not.toHaveBeenCalled();
   });
 
-  it("exits non-zero when the sandbox command fails", async () => {
+  it("renders the server error without inventing an exit code when sandbox execution fails", async () => {
+    pollJobSpy.mockResolvedValueOnce({
+      jobId: "job_123",
+      status: "failed",
+      error: "Cloudflare worker timed out with API_KEY=secret-value",
+      success: false,
+    });
+
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "sandbox",
+        "--only",
+        "API_KEY",
+        "--",
+        "my-skill",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    const renderedError = errSpy.mock.calls.flat().join(" ");
+    expect(renderedError).toContain("Cloudflare worker timed out with API_KEY=[REDACTED]");
+    // The redacted form appearing is not enough — the raw value must be gone.
+    expect(renderedError).not.toContain("secret-value");
+    expect(renderedError).not.toMatch(/exit code 1/i);
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  });
+
+  it("still explains a failure that carries neither an exit code nor a reason", async () => {
+    pollJobSpy.mockResolvedValueOnce({
+      jobId: "job_123",
+      status: "failed",
+      success: false,
+    });
+
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "sandbox",
+        "--only",
+        "API_KEY",
+        "--",
+        "my-skill",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    const renderedError = errSpy.mock.calls.flat().join(" ");
+    expect(renderedError).toMatch(/sandbox execution failed/i);
+    expect(renderedError).not.toMatch(/exit code 1/i);
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  });
+
+  it("preserves the real exit code when the sandbox command exits non-zero", async () => {
     pollJobSpy.mockResolvedValueOnce({
       jobId: "job_123",
       status: "failed",
       output: "boom\n",
-      exitCode: 7,
+      exitCode: 2,
       success: false,
     });
 
@@ -401,8 +461,8 @@ describe("secrets sandbox", () => {
     ).rejects.toThrow("__exit__");
 
     expect(stdoutSpy).toHaveBeenCalledWith("boom\n");
-    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/exit code 7/i);
-    expect(exitSpy).toHaveBeenCalledWith(7);
+    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/exit code 2/i);
+    expect(exitSpy).toHaveBeenCalledWith(2);
     expect(getJobSpy).not.toHaveBeenCalled();
   });
 });
@@ -1038,6 +1098,7 @@ describe("secrets exec/env batch-load (HQ-4H)", () => {
       path: "/secrets/prs_alice/load",
       method: "POST",
       body: { names: ["MY_KEY", "OTHER"] },
+      signal: expect.any(AbortSignal),
     });
     // The crux: the capturing GET route is never touched.
     expect(vaultApiFetch).not.toHaveBeenCalledWith(CAPTURING_GET);
@@ -1045,11 +1106,17 @@ describe("secrets exec/env batch-load (HQ-4H)", () => {
     expect(writeCache).toHaveBeenCalledWith("prs_alice", "OTHER", "v2", 300000);
   });
 
-  it("controlled secrets with cacheTtlMs=0 skip the disk cache", async () => {
+  it("controlled policy metadata overrides a malformed positive cache TTL", async () => {
     vi.mocked(vaultApiFetch).mockResolvedValueOnce(
       jsonRes({
         secrets: [
-          { name: "LOCKED", value: "v1", cacheTtlMs: 0 },
+          {
+            name: "LOCKED",
+            value: "v1",
+            tier: "sensitive",
+            scriptLock: { mode: "enforced" },
+            cacheTtlMs: 300000,
+          },
         ],
         errors: [],
       }),
@@ -1061,6 +1128,62 @@ describe("secrets exec/env batch-load (HQ-4H)", () => {
 
     expect(out.get("LOCKED")).toBe("v1");
     expect(writeCache).not.toHaveBeenCalled();
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
+  });
+
+  it("treats a malformed cache TTL as zero instead of defaulting to a warm cache", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [{ name: "LOCKED", value: "v1", cacheTtlMs: "300000" }],
+        errors: [],
+      }),
+    );
+
+    const out = await loadRevealedSecrets("test-token", "prs_alice", [
+      "LOCKED",
+    ]);
+
+    expect(out.get("LOCKED")).toBe("v1");
+    expect(writeCache).not.toHaveBeenCalled();
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
+  });
+
+  it("evicts a stale cache entry when the server returns metadata without plaintext", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [{ name: "LOCKED", cacheTtlMs: 0 }],
+        errors: [],
+      }),
+    );
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", ["LOCKED"]),
+    ).rejects.toThrow("Secret 'LOCKED' has no value");
+
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
+  });
+
+  it("evicts every unresolved cache entry before reporting the first batch failure", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [{ name: "VALUELESS", cacheTtlMs: 0 }],
+        errors: [
+          { name: "DENIED", code: "forbidden", message: "No read permission" },
+        ],
+      }),
+    );
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", [
+        "VALUELESS",
+        "DENIED",
+        "OMITTED",
+      ]),
+    ).rejects.toThrow("Secret 'VALUELESS' has no value");
+
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "VALUELESS");
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "DENIED");
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "OMITTED");
   });
 
   it("a missing key fails cleanly WITHOUT hitting the GET-404 capture path", async () => {
@@ -1100,15 +1223,155 @@ describe("secrets exec/env batch-load (HQ-4H)", () => {
     expect(vaultApiFetch).not.toHaveBeenCalledWith(CAPTURING_GET);
   });
 
-  it("warm-cache keys cost no request at all", async () => {
-    vi.mocked(readCache).mockReturnValue("cached-value");
+  it("revalidates a previously cached secret and evicts it after remote ACL revocation", async () => {
+    vi.mocked(vaultApiFetch)
+      .mockResolvedValueOnce(
+        jsonRes({
+          secrets: [
+            { name: "CACHED", value: "cached-value", cacheTtlMs: 300000 },
+          ],
+          errors: [],
+        }),
+      )
+      .mockResolvedValueOnce(
+        jsonRes({
+          secrets: [],
+          errors: [
+            {
+              name: "CACHED",
+              code: "forbidden",
+              message: "No read permission",
+            },
+          ],
+        }),
+      );
 
-    const out = await loadRevealedSecrets("test-token", "prs_alice", [
+    const first = await loadRevealedSecrets("test-token", "prs_alice", [
       "CACHED",
     ]);
+    expect(first.get("CACHED")).toBe("cached-value");
+    expect(writeCache).toHaveBeenCalledWith(
+      "prs_alice",
+      "CACHED",
+      "cached-value",
+      300000,
+    );
 
-    expect(out.get("CACHED")).toBe("cached-value");
-    expect(vaultApiFetch).not.toHaveBeenCalled();
+    // Model the encrypted disk entry left by the first call. A pre-fix warm
+    // lookup would return this value without contacting the server.
+    vi.mocked(readCache).mockReturnValue("cached-value");
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", ["CACHED"]),
+    ).rejects.toThrow("Failed to fetch secret 'CACHED': No read permission");
+
+    expect(vaultApiFetch).toHaveBeenCalledTimes(2);
+    expect(readCache).not.toHaveBeenCalled();
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "CACHED");
+  });
+
+  it("evicts every requested entry when a stale session is rejected", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ error: "Unauthorized", code: "session_expired" }, 401),
+    );
+
+    await expect(
+      loadRevealedSecrets("stale-token", "prs_alice", ["FIRST", "SECOND"]),
+    ).rejects.toThrow("Unauthorized");
+
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "FIRST");
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "SECOND");
+  });
+
+  it("fails closed and evicts every entry on an offline network failure", async () => {
+    vi.mocked(vaultApiFetch).mockRejectedValueOnce(
+      new TypeError("fetch failed: ENETUNREACH"),
+    );
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", ["FIRST", "SECOND"]),
+    ).rejects.toThrow("ENETUNREACH");
+
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "FIRST");
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "SECOND");
+  });
+
+  it("fails closed and evicts every entry when authorization times out", async () => {
+    vi.mocked(vaultApiFetch).mockRejectedValueOnce(
+      new DOMException("The operation was aborted due to timeout", "TimeoutError"),
+    );
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", ["FIRST", "SECOND"]),
+    ).rejects.toThrow("timeout");
+
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "FIRST");
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "SECOND");
+  });
+
+  it("evicts earlier successful chunks when a later authorization chunk fails", async () => {
+    const keys = Array.from({ length: 101 }, (_, i) => `KEY_${i}`);
+    vi.mocked(vaultApiFetch)
+      .mockResolvedValueOnce(
+        jsonRes({
+          secrets: keys.slice(0, 100).map((name) => ({
+            name,
+            value: `value-for-${name}`,
+            cacheTtlMs: 300000,
+          })),
+          errors: [],
+        }),
+      )
+      .mockResolvedValueOnce(
+        jsonRes({ error: "No read permission", code: "forbidden" }, 403),
+      );
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", keys),
+    ).rejects.toThrow("No read permission");
+
+    expect(writeCache).toHaveBeenCalledWith(
+      "prs_alice",
+      "KEY_0",
+      "value-for-KEY_0",
+      300000,
+    );
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "KEY_0");
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "KEY_100");
+  });
+
+  it("rejects mixed success/error rows and evicts without exposing the value", async () => {
+    const secretValue = "sentinel-secret-value";
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [{ name: "MIXED", value: secretValue, cacheTtlMs: 300000 }],
+        errors: [{ name: "MIXED", code: "forbidden", message: "Denied" }],
+      }),
+    );
+
+    let failure: Error | undefined;
+    try {
+      await loadRevealedSecrets("test-token", "prs_alice", ["MIXED"]);
+    } catch (err) {
+      failure = err as Error;
+    }
+
+    expect(failure?.message).toBe("Invalid secret load response from vault");
+    expect(failure?.message).not.toContain(secretValue);
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "MIXED");
+  });
+
+  it("rejects malformed response envelopes and evicts every requested entry", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ secrets: { name: "FIRST", value: "hidden" }, errors: [] }),
+    );
+
+    await expect(
+      loadRevealedSecrets("test-token", "prs_alice", ["FIRST", "SECOND"]),
+    ).rejects.toThrow("Invalid secret load response from vault");
+
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "FIRST");
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "SECOND");
   });
 
   it("a non-2xx batch response throws the batch-load error", async () => {
@@ -1145,6 +1408,8 @@ describe("secrets script usage", () => {
       "MY_KEY",
       "--script",
       scriptPath,
+      "--script-id",
+      "scripts/exec-script.sh",
       "--",
       "env",
     ]);
@@ -1158,13 +1423,14 @@ describe("secrets script usage", () => {
         usage: {
           channel: "exec",
           script: {
-            scriptId: scriptPath,
+            scriptId: "scripts/exec-script.sh",
             path: scriptPath,
             sha256: expectedSha,
             attestationLevel: "self-asserted-hash",
           },
         },
       },
+      signal: expect.any(AbortSignal),
     });
     expect(spawn).toHaveBeenCalledWith(
       "env",
@@ -1220,6 +1486,7 @@ describe("secrets script usage", () => {
           },
         },
       },
+      signal: expect.any(AbortSignal),
     });
     expect(stdoutWriteSpy).toHaveBeenCalledWith("export MY_KEY='v1'\n");
   });
@@ -1368,6 +1635,7 @@ describe("secrets reveal and policy controls", () => {
     });
     expect(logSpy).toHaveBeenCalledWith("  Tier:          nuclear");
     expect(logSpy).toHaveBeenCalledWith("  Script Lock:   enforced");
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
   });
 
   it("script approve hashes the local file and hits the approval endpoint", async () => {
@@ -1403,6 +1671,7 @@ describe("secrets reveal and policy controls", () => {
         attestationLevel: "self-asserted-hash",
       },
     });
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
   });
 
   it("script revoke hits the revoke endpoint", async () => {
@@ -1429,23 +1698,38 @@ describe("secrets reveal and policy controls", () => {
         scriptId: "deploy-script",
       },
     });
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
   });
 
-  it("script list renders the current policy and approved scripts", async () => {
+  it("script list maps the server's scriptLock.approvedScripts response shape", async () => {
     vi.mocked(vaultApiFetch).mockResolvedValueOnce(
       jsonRes({
         policy: {
           path: "LOCKED",
           tier: "nuclear",
-          scriptLock: { mode: "enforced" },
-          scripts: [
-            {
-              scriptId: "deploy-script",
-              scriptPath: "/tmp/deploy.sh",
-              sha256: "abc123",
-              attestationLevel: "self-asserted-hash",
-            },
-          ],
+          scriptLock: {
+            mode: "enforced",
+            requiredAttestation: "self-asserted-hash",
+            approvedScripts: [
+              {
+                scriptId: "deploy-script",
+                path: "/tmp/deploy.sh",
+                sha256: "abc123",
+                attestationLevel: "self-asserted-hash",
+                approvedAt: "2026-01-01T00:00:00.000Z",
+                approvedBy: "prs_owner",
+              },
+              {
+                scriptId: "revoked-script",
+                path: "/tmp/old.sh",
+                sha256: "def456",
+                attestationLevel: "self-asserted-hash",
+                approvedAt: "2025-12-01T00:00:00.000Z",
+                approvedBy: "prs_owner",
+                revokedAt: "2026-01-02T00:00:00.000Z",
+              },
+            ],
+          },
         },
       }),
     );
@@ -1470,5 +1754,62 @@ describe("secrets reveal and policy controls", () => {
     expect(logSpy).toHaveBeenCalledWith(
       expect.stringContaining("deploy-script"),
     );
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("/tmp/deploy.sh"),
+    );
+    expect(logSpy).not.toHaveBeenCalledWith(
+      expect.stringContaining("revoked-script"),
+    );
+  });
+
+  it("script list ignores malformed modern rows without falling back to stale legacy rows", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        policy: {
+          path: "LOCKED",
+          tier: "sensitive",
+          scriptLock: {
+            mode: "enforced",
+            approvedScripts: [
+              null,
+              { scriptId: "missing-path", attestationLevel: "self-asserted-hash" },
+              {
+                scriptId: "active-modern",
+                path: "/tmp/active.sh",
+                attestationLevel: "self-asserted-hash",
+              },
+            ],
+          },
+          scripts: [
+            {
+              scriptId: "stale-legacy",
+              scriptPath: "/tmp/stale.sh",
+              sha256: "stale",
+              attestationLevel: "self-asserted-hash",
+            },
+          ],
+        },
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "script",
+      "list",
+      "LOCKED",
+    ]);
+
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("active-modern"),
+    );
+    expect(logSpy).not.toHaveBeenCalledWith(
+      expect.stringContaining("missing-path"),
+    );
+    expect(logSpy).not.toHaveBeenCalledWith(
+      expect.stringContaining("stale-legacy"),
+    );
   });
 });