@indigoai-us/hq-cli 5.75.0 → 5.77.0

package/src/commands/pack-install.ts

@@ -56,7 +56,8 @@ import { findHqRoot } from '../utils/manifest.js';
 import { readHqVersion, routeContribution, listInstalledPacks } from '../utils/pack-contributions.js';
 import { CONTRIBUTION_TABLE, payloadFor } from '../utils/contribution-table.js';
 import { safeExtractTarball } from './safe-extract.js';
-import { vaultApiFetchPublic } from '../utils/vault-api.js';
+import { getCompanyUid, vaultApiFetchPublic } from '../utils/vault-api.js';
+import { ensureCognitoToken } from '../utils/cognito-session.js';
 import {
   redactSecrets,
   SECRET_REDACTION,
@@ -65,7 +66,8 @@ import {
   type McpManifest,
   type SecretResolver,
 } from './mcp-registration.js';
-import { readCache, listSecretCacheScopes } from '../utils/secrets-cache.js';
+import { listSecretCacheScopes } from '../utils/secrets-cache.js';
+import { loadRevealedSecrets } from './secrets.js';
 import type { PackManifest, PackContributeKey } from '../types.js';
 
 const PACK_UPDATE_CACHE_TTL_MS = 12 * 60 * 60 * 1000;
@@ -1751,33 +1753,59 @@ function evalConditional(expr: string): boolean {
 // ---------------------------------------------------------------------------
 
 /**
- * Build the install-time {@link SecretResolver} bound to the HQ vault's local
- * secrets-cache (`~/.hq/secrets-cache/<scope>/<NAME>`, AES-256-GCM, 0600, TTL'd).
+ * Build an install-time {@link SecretResolver} from a fresh server authorization
+ * decision. The encrypted cache may identify one unambiguous scope, but its
+ * plaintext is never trusted or read to register an MCP server.
  *
- * Active-company resolution at install time is INDIRECT by design: `hq install`
- * has no `--company` flag and runs OFFLINE (no token), so we cannot resolve a
- * single active company UID the way `hq run` / `hq secrets` do (via
- * `getEntityUid` over the network). Instead we probe EVERY cached scope
- * (`cmp_*`/`prs_*` — whichever has minted secrets locally) for the requested
- * name and return the first hit. This naturally resolves to whichever company
- * context just provisioned the secret (e.g. the one `/connect-shopify` minted
- * `VYG_API_KEY` under), without guessing, and works whether the vault scoped the
- * key under a company or person entity.
+ * With `--company`, the caller-selected company is resolved normally. Without
+ * it, exactly one cache scope may identify the intended company/person context;
+ * multiple scopes are ambiguous and fail closed. The requested names are then
+ * loaded through the same server-authorized endpoint as exec/env/run. Offline,
+ * expired-session, forbidden, not-found, script-lock, and malformed-response
+ * outcomes all produce an empty resolver, so MCP registration is deferred.
  *
- * On MISS across all scopes (no cache, expired TTL, or key never minted) it
- * returns `null` — which is exactly what {@link registerMcpServers}'s
- * unresolvable-secret path keys off to defer that server gracefully. With no
- * cached scopes at all (`listSecretCacheScopes()` → `[]`) it simply returns
- * `null` for every name, the desired graceful-deferral behavior.
+ * The returned synchronous resolver contains only values from that fresh
+ * authorization response. No cached value is a fallback.
  */
-export function makeInstallSecretResolver(): SecretResolver {
-  return (name: string): string | null => {
-    for (const scope of listSecretCacheScopes()) {
-      const value = readCache(scope, name);
-      if (value !== null) return value;
+export async function makeInstallSecretResolver(
+  secretNames: string[],
+  company?: string,
+): Promise<SecretResolver> {
+  const names = [...new Set(secretNames)];
+  if (names.length === 0) return () => null;
+
+  try {
+    const token = await ensureCognitoToken({ interactive: false });
+    let scopeUid: string;
+    if (company) {
+      scopeUid = await getCompanyUid(token, company);
+    } else {
+      const scopes = listSecretCacheScopes();
+      if (scopes.length !== 1) return () => null;
+      [scopeUid] = scopes;
     }
-    return null;
-  };
+    const authorized = await loadRevealedSecrets(token, scopeUid, names);
+    return (name: string): string | null => authorized.get(name) ?? null;
+  } catch {
+    return () => null;
+  }
+}
+
+const INSTALL_SECRET_REF_RE =
+  /\$\{secret:([A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*)\}/g;
+
+function collectManifestSecretNames(manifest: McpManifest): string[] {
+  const names = new Set<string>();
+  for (const value of [
+    ...Object.values(manifest.headers ?? {}),
+    ...Object.values(manifest.env ?? {}),
+  ]) {
+    INSTALL_SECRET_REF_RE.lastIndex = 0;
+    for (let match = INSTALL_SECRET_REF_RE.exec(value); match; match = INSTALL_SECRET_REF_RE.exec(value)) {
+      names.add(match[1]);
+    }
+  }
+  return [...names];
 }
 
 /**
@@ -1829,17 +1857,21 @@ function extractDeferredSecretName(message: string): string {
  *   - ANY OTHER error               → RE-THROW (abort install). Only the
  *     unresolvable-secret case is swallowed.
  */
-function wireMcpServers(
+async function wireMcpServers(
   pkg: PackManifest,
   destDir: string,
-): { registered: string[]; skipped: string[] } {
-  const resolveSecret = makeInstallSecretResolver();
+  company?: string,
+): Promise<{ registered: string[]; skipped: string[] }> {
   const loadManifest = (name: string): McpManifest => loadMcpManifestFrom(destDir, name);
   const registered: string[] = [];
   const skipped: string[] = [];
 
   for (const name of pkg.contributes.mcp ?? []) {
     try {
+      const resolveSecret = await makeInstallSecretResolver(
+        collectManifestSecretNames(loadManifest(name)),
+        company,
+      );
       // Per-server call: registerMcpServers throws on the FIRST unresolvable
       // secret, so calling it one name at a time lets us catch + continue.
       registerMcpServers(pkg.name, [name], { loadManifest, resolveSecret });
@@ -2016,6 +2048,8 @@ export function runScanPackages(hqRoot: string, opts: { quiet?: boolean } = {}):
 
 export interface InstallPackOptions {
   allowHooks?: boolean;
+  /** Company context for online authorization of install-time MCP secret refs. */
+  company?: string;
   /**
    * US-010 install-time MCP trust prompt bypass (CI/ambient-trust). Mirrors
    * `allowHooks`: when set, `confirmMcp` skips the prompt and prints a yellow
@@ -2172,7 +2206,11 @@ export async function installPack(
     // Per-server secret-deferral keeps a fresh install (key not yet minted) at
     // exit 0, deferring only the unresolvable server (see wireMcpServers).
     if (Array.isArray(pkg.contributes.mcp) && pkg.contributes.mcp.length > 0) {
-      const { registered, skipped } = wireMcpServers(pkg, destDir);
+      const { registered, skipped } = await wireMcpServers(
+        pkg,
+        destDir,
+        opts.company,
+      );
       // One-line summary (server NAMES only — never resolved secret VALUES).
       say(
         chalk.dim(

package/src/commands/pkg-install.ts

@@ -41,7 +41,7 @@ export function registerPackageInstallCommand(parent: Command): void {
       'Install a package. Sources: bare slug (registry, Cognito-gated), ' +
         '@scope/name[@ver] (npm pack), git URL[#ref], or local path.'
     )
-    .option('--company <co>', 'Scope the package to a specific company (registry flow only)')
+    .option('--company <co>', 'Scope package secret authorization to a specific company')
     .option('--allow-hooks', 'Skip the hooks confirmation prompt (content-pack flow)')
     .option('--allow-mcp', 'Skip the MCP server confirmation prompt (content-pack flow)')
     .option('--branch', 'Follow a ref instead of SHA-pinning (git content-pack flow)')
@@ -53,6 +53,7 @@ export function registerPackageInstallCommand(parent: Command): void {
         try {
           if (sourceMatchesPackPattern(source)) {
             await installPack(source, {
+              company: opts.company,
               allowHooks: opts.allowHooks,
               allowMcp: opts.allowMcp,
               followBranch: opts.branch,
@@ -63,6 +64,7 @@ export function registerPackageInstallCommand(parent: Command): void {
             // would fail at registry setup. Resolve it through the marketplace
             // listings transport — the live install path — instead.
             await installPack(`${MARKETPLACE_PREFIX}${source}`, {
+              company: opts.company,
               allowHooks: opts.allowHooks,
               allowMcp: opts.allowMcp,
               followBranch: opts.branch,

package/src/commands/run.test.ts

@@ -0,0 +1,45 @@
+import { createHash } from "node:crypto";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { buildRunUsage } from "./run.js";
+
+describe("hq run script usage", () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "hq-run-usage-test-"));
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("preserves a custom relative script id while resolving and hashing the file", async () => {
+    const scriptPath = join(tempDir, "deploy.sh");
+    const scriptBody = "#!/usr/bin/env bash\necho deploy\n";
+    writeFileSync(scriptPath, scriptBody);
+
+    const usage = await buildRunUsage(
+      scriptPath,
+      "scripts/deploy.sh",
+    );
+
+    expect(usage).toEqual({
+      channel: "run",
+      script: {
+        scriptId: "scripts/deploy.sh",
+        path: resolve(scriptPath),
+        sha256: createHash("sha256").update(scriptBody).digest("hex"),
+        attestationLevel: "self-asserted-hash",
+      },
+    });
+  });
+
+  it("rejects a script id when no script path can be attested", async () => {
+    await expect(buildRunUsage(undefined, "deploy-script")).rejects.toThrow(
+      "--script-id requires --script",
+    );
+  });
+});

package/src/commands/run.ts

@@ -10,7 +10,15 @@ import { discoverSchemas } from '../run/discover-schemas.js';
 import { installHqPlugin, prewarmHqSecrets, type PluginState, type InstallHqPluginOpts } from '../run/hq-plugin.js';
 import type { SecretLoadResponse, SecretUsage } from './secrets.js';
 
-async function buildRunUsage(scriptPath?: string): Promise<SecretUsage | undefined> {
+const SECRET_LOAD_TIMEOUT_MS = 30_000;
+
+export async function buildRunUsage(
+  scriptPath?: string,
+  scriptId?: string,
+): Promise<SecretUsage | undefined> {
+  if (scriptId && !scriptPath) {
+    throw new Error('--script-id requires --script');
+  }
   if (!scriptPath) {
     return undefined;
   }
@@ -18,7 +26,7 @@ async function buildRunUsage(scriptPath?: string): Promise<SecretUsage | undefin
   return {
     channel: 'run',
     script: {
-      scriptId: resolvedPath,
+      scriptId: scriptId ?? resolvedPath,
       path: resolvedPath,
       sha256: await computeSha256(resolvedPath),
       attestationLevel: 'self-asserted-hash',
@@ -33,9 +41,16 @@ export function registerRunCommand(program: Command): void {
     .option('--company <slug>', 'Company slug (overrides @hqCompany in schema)')
     .option('--schema <path>', 'Explicit schema path (skips walk-up discovery)')
     .option('--script <path>', 'Attach local script identity for script-locked secrets')
+    .option('--script-id <id>', 'Stable script identifier approved by policy')
     .option('--check', 'Resolve schema and validate vars without executing the command')
     .allowUnknownOption(true)
-    .action(async (opts: { company?: string; schema?: string; script?: string; check?: boolean }) => {
+    .action(async (opts: {
+      company?: string;
+      schema?: string;
+      script?: string;
+      scriptId?: string;
+      check?: boolean;
+    }) => {
       try {
         const dashIndex = process.argv.indexOf('--');
         const childArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : [];
@@ -78,7 +93,7 @@ export function registerRunCommand(program: Command): void {
 
         const token = await ensureCognitoToken();
         const uid = await getCompanyUid(token, slug);
-        const usage = await buildRunUsage(opts.script);
+        const usage = await buildRunUsage(opts.script, opts.scriptId);
 
         const fetchBatch: InstallHqPluginOpts['fetchBatch'] = async (companyUid, names, requestUsage) => {
           const res = await vaultApiFetch({
@@ -86,6 +101,7 @@ export function registerRunCommand(program: Command): void {
             path: `/secrets/${encodeURIComponent(companyUid)}/load`,
             method: 'POST',
             body: requestUsage ? { names, usage: requestUsage } : { names },
+            signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
           });
           if (!res.ok) {
             const body = await res.json().catch(() => ({})) as Record<string, unknown>;