@indigoai-us/hq-cli 5.77.10 → 5.77.12

package/src/commands/members.ts

@@ -471,6 +471,52 @@ export async function listActiveMembers(
   return data?.members ?? [];
 }
 
+/**
+ * Resolve a role-change target to an active membership key.
+ *
+ * Pending invites are email-keyed, but claimed active memberships are keyed by
+ * personUid. Consequently, role changes must look up email targets in the
+ * active member list instead of synthesizing an `email:...#company` key.
+ */
+export async function resolveRoleChangeTarget(
+  token: string,
+  companyUid: string,
+  target: string,
+): Promise<string> {
+  if (target.includes("#")) return target;
+
+  const detected = detectTarget(target);
+  if (detected?.type === "person" || detected?.type === "agent") {
+    return `${detected.value}#${companyUid}`;
+  }
+  if (detected?.type === "email") {
+    // Active fleet-agent guest memberships are keyed agt_…#cmp_…, not by
+    // personEmail enrichment. Map machine emails the same way revoke does
+    // before falling through to the human roster lookup.
+    if (detected.isAgent) {
+      const local = detected.value.split("@")[0] ?? "";
+      const m = local.match(/^agt-(.+)$/i);
+      if (m) return `agt_${m[1].toUpperCase()}#${companyUid}`;
+    }
+
+    const members = await listActiveMembers(token, companyUid);
+    const member = members.find(
+      (candidate) =>
+        candidate.personEmail?.trim().toLowerCase() === detected.value,
+    );
+    if (member) return member.membershipKey;
+
+    throw new Error(
+      `No active member has email '${detected.value}' in this company. ` +
+        "Run `hq members list` to find the member, or use their prs_ personUid.",
+    );
+  }
+
+  throw new Error(
+    `Invalid target '${target}': use an email, prs_ personUid, agt_ agentUid, or full membership key`,
+  );
+}
+
 /**
  * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
  * the server requires. Accepts three input forms:
@@ -631,9 +677,10 @@ export function registerMembersCommand(program: Command): void {
         const token = await ensureCognitoToken();
         const companySlug = members.opts().company as string | undefined;
         const companyUid = await getCompanyUid(token, companySlug);
-        const membershipKey = resolveRevokeTargetToMembershipKey(
-          target,
+        const membershipKey = await resolveRoleChangeTarget(
+          token,
           companyUid,
+          target,
         );
 
         await changeMemberRole(token, companyUid, membershipKey, role as Role);
@@ -708,10 +755,13 @@ export function registerMembersCommand(program: Command): void {
           resend?: boolean;
         },
       ) => {
+        let token: string | undefined;
+        let companyUid: string | undefined;
+        let companySlug: string | undefined;
         try {
-          const token = await ensureCognitoToken();
-          const companySlug = members.opts().company as string | undefined;
-          const companyUid = await getCompanyUid(token, companySlug);
+          token = await ensureCognitoToken();
+          companySlug = members.opts().company as string | undefined;
+          companyUid = await getCompanyUid(token, companySlug);
           const callerUid = await getCallerPersonUid(token);
 
           // --resend short-circuits to the server's re-fire path. No new row.
@@ -887,15 +937,79 @@ export function registerMembersCommand(program: Command): void {
             );
           }
         } catch (err) {
-          // The target is ALREADY an active member (409 MEMBERSHIP_ALREADY_EXISTS).
-          // Terminal, not a failure: the person is already in the company, so
-          // there's nothing to invite or retry. Print a plain note and exit 0 —
-          // re-attempting just re-fires the server's (correctly captured) 409,
-          // and a bulk-invite script shouldn't abort on an already-member. HQ-11.
+          // A 409 may refer to either an active membership or an existing
+          // pending invite. Probe both views so email targets get actionable
+          // guidance while preserving the terminal exit-0 behavior for bulk
+          // invite scripts.
           if (
             err instanceof InviteHttpError &&
             err.code === "MEMBERSHIP_ALREADY_EXISTS"
           ) {
+            const detected = detectTarget(target);
+            const normalizedEmail =
+              detected?.type === "email" ? detected.value : undefined;
+
+            if (normalizedEmail && token && companyUid) {
+              // Preserve --company in copy-paste hints so multi-company
+              // callers don't hit "Multiple active companies" on --resend.
+              const companyFlag = companySlug
+                ? ` --company ${companySlug}`
+                : "";
+              const resendHint =
+                `hq members invite ${normalizedEmail}${companyFlag} --resend`;
+
+              try {
+                const pending = await listPendingInvites(token, companyUid);
+                if (
+                  pending.some(
+                    (invite) =>
+                      invite.inviteeEmail?.trim().toLowerCase() ===
+                      normalizedEmail,
+                  )
+                ) {
+                  console.log(
+                    chalk.yellow(
+                      `${normalizedEmail} already has a pending invite. ` +
+                        `Use \`${resendHint}\` to re-send it.`,
+                    ),
+                  );
+                  return;
+                }
+              } catch {
+                // Pending-list visibility can vary by server version or role.
+                // Fall through to the active-member probe and generic copy.
+              }
+
+              try {
+                const activeMembers = await listActiveMembers(token, companyUid);
+                if (
+                  activeMembers.some(
+                    (member) =>
+                      member.personEmail?.trim().toLowerCase() ===
+                      normalizedEmail,
+                  )
+                ) {
+                  console.log(
+                    chalk.yellow(
+                      `${normalizedEmail} is already a member of this company — nothing to do.`,
+                    ),
+                  );
+                  return;
+                }
+              } catch {
+                // Preserve the original conflict as the source of truth and
+                // use copy that remains accurate when the probes are hidden.
+              }
+
+              console.log(
+                chalk.yellow(
+                  `${normalizedEmail} already has a membership or pending invite for this company. ` +
+                    `If the invite is pending, use \`${resendHint}\`.`,
+                ),
+              );
+              return;
+            }
+
             console.log(
               chalk.yellow(
                 `${target.toLowerCase()} is already a member of this company — nothing to do.`,

package/src/commands/secrets.test.ts

@@ -1902,3 +1902,136 @@ describe("secrets reveal and policy controls", () => {
     );
   });
 });
+
+describe("HQ_API_KEY consume path", () => {
+  let exitSpy: MockInstance<typeof process.exit>;
+
+  beforeEach(() => {
+    exitSpy = vi
+      .spyOn(process, "exit")
+      .mockImplementation(((code?: number) => {
+        throw new Error(`__EXIT__:${code ?? 0}`);
+      }) as never);
+  });
+
+  afterEach(() => {
+    delete process.env.HQ_API_KEY;
+  });
+
+  it("rejects secrets list when HQ_API_KEY is set (no Cognito fallback)", async () => {
+    process.env.HQ_API_KEY = "hqk_probe";
+    const program = buildProgram();
+    await expect(
+      program.parseAsync(["node", "hq", "secrets", "list"]),
+    ).rejects.toThrow(/__EXIT__:1/);
+    expect(ensureCognitoToken).not.toHaveBeenCalled();
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+    const errText = errSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(errText).toMatch(/not supported for API keys/);
+  });
+
+  it("rejects invalid HQ_API_KEY prefix without Cognito fallback", async () => {
+    process.env.HQ_API_KEY = "hqd_not_a_vault_key";
+    const program = buildProgram();
+    await expect(
+      program.parseAsync(["node", "hq", "secrets", "get", "FOO"]),
+    ).rejects.toThrow(/__EXIT__:1/);
+    expect(ensureCognitoToken).not.toHaveBeenCalled();
+    const errText = errSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(errText).toMatch(/must start with 'hqk_'/);
+  });
+
+  it("gets a secret via /v1/keys/secrets/fetch when HQ_API_KEY is set", async () => {
+    process.env.HQ_API_KEY = "hqk_valid_key";
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secret: {
+          name: "FOO",
+          value: "secret-value",
+          version: 1,
+          tier: "standard",
+        },
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "get",
+      "FOO",
+      "--reveal",
+    ]);
+
+    expect(ensureCognitoToken).not.toHaveBeenCalled();
+    expect(vaultApiFetch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        token: "hqk_valid_key",
+        path: "/v1/keys/secrets/fetch",
+        method: "POST",
+        body: { name: "FOO" },
+      }),
+    );
+    const printed = logSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(printed).toContain("FOO");
+    expect(printed).toContain("secret-value");
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+
+  it("fails --reveal when API-key fetch omits secret.value", async () => {
+    process.env.HQ_API_KEY = "hqk_valid_key";
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secret: {
+          name: "FOO",
+          version: 1,
+          tier: "standard",
+        },
+      }),
+    );
+
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "get",
+        "FOO",
+        "--reveal",
+      ]),
+    ).rejects.toThrow(/__EXIT__:1/);
+    const errText = errSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(errText).toMatch(/omitted secret\.value/);
+    const printed = logSpy.mock.calls
+      .map((call) => call.map(String).join(" "))
+      .join("\n");
+    expect(printed).not.toContain("[REDACTED]");
+  });
+
+  it("loadRevealedSecrets uses fetch endpoint for hqk_ tokens", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secret: { name: "A", value: "va" },
+      }),
+    );
+    const out = await loadRevealedSecrets("hqk_tok", "cmp_x", ["A"]);
+    expect(out.get("A")).toBe("va");
+    expect(vaultApiFetch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        path: "/v1/keys/secrets/fetch",
+        method: "POST",
+        body: { name: "A" },
+      }),
+    );
+  });
+});

package/src/commands/secrets.ts

@@ -23,6 +23,11 @@ import {
   getCompanyUid,
   getEntityUid,
 } from "../utils/vault-api.js";
+import {
+  HQ_API_KEY_PREFIX,
+  assertCognitoOnlyCommand,
+  resolveVaultCredential,
+} from "../utils/resolve-vault-credential.js";
 import {
   SandboxRunnerClient,
   type SandboxRunnerJob,
@@ -30,6 +35,14 @@ import {
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 
+/** Cognito session for secrets commands that do not support HQ_API_KEY. */
+async function requireCognitoTokenForSecrets(
+  commandLabel: string,
+): Promise<string> {
+  assertCognitoOnlyCommand(commandLabel);
+  return ensureCognitoToken();
+}
+
 interface SecretsScopeOpts {
   company?: string;
   personal?: boolean;
@@ -654,12 +667,76 @@ function renderPolicyScripts(scripts: SecretPolicyScript[]): void {
 // Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
 // with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
 // path used — never swallows a failure.
+async function loadRevealedSecretsViaApiKey(
+  token: string,
+  keys: string[],
+): Promise<Map<string, string>> {
+  const resolved = new Map<string, string>();
+  const requested = [...new Set(keys)];
+  const cacheScope = "__api_key__";
+
+  for (const name of requested) {
+    const res = await vaultApiFetch({
+      token,
+      path: "/v1/keys/secrets/fetch",
+      method: "POST",
+      body: { name },
+      signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+    });
+    const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+
+    if (!res.ok) {
+      if (res.status === 404) {
+        throw new Error(`Failed to fetch secret '${name}': Secret not found`);
+      }
+      if (res.status === 403) {
+        const message =
+          typeof body.error === "string"
+            ? body.error
+            : typeof body.message === "string"
+              ? body.message
+              : "No read permission";
+        if (body.highSecurity === true) {
+          throw new Error(highSecuritySandboxOnlyMessage(name));
+        }
+        throw new Error(`Failed to fetch secret '${name}': ${message}`);
+      }
+      if (res.status === 401) {
+        throw new Error(
+          `Failed to fetch secret '${name}': Invalid or missing API key`,
+        );
+      }
+      throw new Error(
+        `Failed to fetch secret '${name}': ${extractApiMessage(body, res.statusText)}`,
+      );
+    }
+
+    const secret =
+      typeof body.secret === "object" && body.secret !== null
+        ? (body.secret as { value?: unknown; name?: unknown })
+        : null;
+    if (typeof secret?.value !== "string") {
+      throw new Error(
+        `Failed to fetch secret '${name}': malformed fetch response`,
+      );
+    }
+    removeCacheEntry(cacheScope, name);
+    resolved.set(name, secret.value);
+  }
+
+  return resolved;
+}
+
 export async function loadRevealedSecrets(
   token: string,
   companyUid: string,
   keys: string[],
   usage?: SecretUsage,
 ): Promise<Map<string, string>> {
+  if (token.startsWith(HQ_API_KEY_PREFIX)) {
+    return loadRevealedSecretsViaApiKey(token, keys);
+  }
+
   const resolved = new Map<string, string>();
   const requested = [...new Set(keys)];
   try {
@@ -918,7 +995,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets set");
         const scope = scopeOpts(secrets.opts());
         const companyUid = await getEntityUid(token, scope);
         const scopeLabel = describeSecretsScope({
@@ -975,7 +1052,69 @@ export function registerSecretsCommand(program: Command): void {
     .option("--reveal", "Include the decrypted secret value")
     .action(async (name: string, opts: { reveal?: boolean }) => {
       try {
-        const token = await ensureCognitoToken();
+        const cred = await resolveVaultCredential();
+
+        if (cred.kind === "api-key") {
+          const res = await vaultApiFetch({
+            token: cred.token,
+            path: "/v1/keys/secrets/fetch",
+            method: "POST",
+            body: { name },
+          });
+          const body = (await res.json().catch(() => ({}))) as Record<
+            string,
+            unknown
+          >;
+          if (!res.ok) {
+            if (res.status === 403 && body.highSecurity === true) {
+              console.error(chalk.red(highSecuritySandboxOnlyMessage(name)));
+              process.exit(1);
+            }
+            console.error(
+              chalk.red(
+                `Failed to get secret: ${extractApiMessage(body, res.statusText)}`,
+              ),
+            );
+            process.exit(1);
+          }
+          const secret =
+            typeof body.secret === "object" && body.secret !== null
+              ? (body.secret as SecretGetResponse["secret"] & {
+                  value?: string;
+                })
+              : null;
+          if (!secret || typeof secret.name !== "string") {
+            console.error(chalk.red("Failed to get secret: malformed response"));
+            process.exit(1);
+          }
+          console.log(chalk.bold(`Secret: ${secret.name}`));
+          if (secret.lastModifiedDate) {
+            console.log(`  Last Modified: ${secret.lastModifiedDate}`);
+          }
+          if (secret.version != null) {
+            console.log(`  Version:       ${secret.version}`);
+          }
+          console.log(`  Tier:          ${normalizeSecretTier(secret.tier)}`);
+          console.log(
+            `  Script Lock:   ${normalizeScriptLockMode(secret.scriptLock?.mode)}`,
+          );
+          if (opts.reveal) {
+            if (typeof secret.value !== "string") {
+              console.error(
+                chalk.red(
+                  "Failed to get secret: reveal requested but response omitted secret.value",
+                ),
+              );
+              process.exit(1);
+            }
+            console.log(`  Value:         ${secret.value}`);
+          } else {
+            console.log(`  Value:         ${chalk.dim("[REDACTED]")}`);
+          }
+          return;
+        }
+
+        const token = cred.token;
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1061,7 +1200,7 @@ export function registerSecretsCommand(program: Command): void {
     .option("--quiet", "Suppress the present/absent line (use the exit code only)")
     .action(async (name: string, opts: { quiet?: boolean }) => {
       try {
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets exists");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1124,7 +1263,7 @@ export function registerSecretsCommand(program: Command): void {
           normalizedPrefix = normalized;
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets list");
         const scope = scopeOpts(secrets.opts());
         const companyUid = await getEntityUid(token, scope);
         const scopeLabel = describeSecretsScope({
@@ -1226,7 +1365,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1309,7 +1448,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1392,7 +1531,7 @@ export function registerSecretsCommand(program: Command): void {
           opts.id,
           opts.attestation,
         );
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1442,7 +1581,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1485,7 +1624,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1546,7 +1685,7 @@ export function registerSecretsCommand(program: Command): void {
           }
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1606,7 +1745,7 @@ export function registerSecretsCommand(program: Command): void {
         }
 
         const keys = parseSecretNameList(opts.only);
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
         const companyUid = await getEntityUid(token, scope);
         const client = new SandboxRunnerClient();
@@ -1673,17 +1812,19 @@ export function registerSecretsCommand(program: Command): void {
 
         const keys = parseSecretNameList(_opts.only);
 
-        const token = await ensureCognitoToken();
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
+        const cred = await resolveVaultCredential();
+        const companyUid =
+          cred.kind === "api-key"
+            ? "__api_key__"
+            : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
 
         const revealed = await loadRevealedSecrets(
-          token,
+          cred.token,
           companyUid,
           keys,
-          await buildSecretUsage("exec", _opts.script, _opts.scriptId),
+          cred.kind === "cognito"
+            ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
+            : undefined,
         );
 
         const secretEnv: Record<string, string> = {};
@@ -1744,17 +1885,19 @@ export function registerSecretsCommand(program: Command): void {
 
         const keys = parseSecretNameList(opts.only);
 
-        const token = await ensureCognitoToken();
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
+        const cred = await resolveVaultCredential();
+        const companyUid =
+          cred.kind === "api-key"
+            ? "__api_key__"
+            : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
 
         const revealed = await loadRevealedSecrets(
-          token,
+          cred.token,
           companyUid,
           keys,
-          await buildSecretUsage("env", opts.script, opts.scriptId),
+          cred.kind === "cognito"
+            ? await buildSecretUsage("env", opts.script, opts.scriptId)
+            : undefined,
         );
 
         for (const key of keys) {
@@ -1799,7 +1942,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1865,7 +2008,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1929,7 +2072,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),
@@ -1985,7 +2128,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const token = await ensureCognitoToken();
+        const token = await requireCognitoTokenForSecrets("secrets");
         const companyUid = await getEntityUid(
           token,
           scopeOpts(secrets.opts()),