@indigoai-us/hq-cli 5.77.7 → 5.77.8

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.77.8]
+
+### Fixed
+
+- `hq secrets script approve` now accepts `--remote-path <path>`, so an
+  operator can hash a local copy while approving the byte-identical script at
+  its fleet or other target runtime path. Existing same-path approvals are
+  unchanged. (#263)
+
 ## [5.77.7]
 
 ### Fixed

package/dist/commands/group-grants.d.ts

@@ -69,7 +69,7 @@ export declare function grantGroup(options: GrantGroupOptions): Promise<GroupGra
 /** POST /group-grants/revoke — remove a group's grant on a target company. */
 export declare function revokeGroupGrant(options: RevokeGroupGrantOptions): Promise<void>;
 /** GET /group-grants/outbound — grants a source company's group(s) hold. */
-export declare function listOutboundGrants(token: string, sourceCompanyUid: string, groupId?: string): Promise<GroupGrant[]>;
+export declare function listOutboundGrants(token: string, sourceCompanyUid: string, groupId: string): Promise<GroupGrant[]>;
 /** GET /group-grants/inbound — grants other companies' groups hold on us. */
 export declare function listInboundGrants(token: string, companyUid: string): Promise<GroupGrant[]>;
 export declare function registerGroupGrantsCommand(program: Command): void;

package/dist/commands/group-grants.js

@@ -123,13 +123,13 @@ export async function revokeGroupGrant(options) {
 }
 /** GET /group-grants/outbound — grants a source company's group(s) hold. */
 export async function listOutboundGrants(token, sourceCompanyUid, groupId) {
-    const query = { sourceCompanyUid };
-    if (groupId)
-        query.groupId = groupId;
+    if (!GROUP_ID_PATTERN.test(groupId)) {
+        throw new Error(`Invalid group id '${groupId}': must match grp_<alphanumeric, underscore, hyphen>`);
+    }
     const res = await vaultApiFetch({
         token,
         path: "/group-grants/outbound",
-        query,
+        query: { sourceCompanyUid, groupId },
     });
     if (!res.ok) {
         const err = (await res.json().catch(() => ({})));
@@ -242,8 +242,8 @@ export function registerGroupGrantsCommand(program) {
     });
     grants
         .command("outbound")
-        .description("List grants the source company's groups hold on other companies")
-        .option("--group <groupId>", "Filter to a single group id")
+        .description("List grants a source-company group holds on other companies")
+        .requiredOption("--group <groupId>", "Group id to inspect")
         .action(async (opts) => {
         try {
             const token = await ensureCognitoToken();

package/dist/commands/secrets.js

@@ -961,6 +961,7 @@ export function registerSecretsCommand(program) {
         .description("Approve a script for a secret path")
         .requiredOption("--id <scriptId>", "Stable script identifier")
         .requiredOption("--script <path>", "Path to the local script file")
+        .option("--remote-path <path>", "Script path reported by the target runtime (defaults to the local path)")
         .option("--attestation <level>", "Attestation level", "self-asserted-hash")
         .action(async (secretPath, opts) => {
         try {
@@ -979,7 +980,7 @@ export function registerSecretsCommand(program) {
                 body: {
                     path: secretPath,
                     scriptId: usage.script?.scriptId,
-                    scriptPath: usage.script?.path,
+                    scriptPath: opts.remotePath ?? usage.script?.path,
                     sha256: usage.script?.sha256,
                     attestationLevel: usage.script?.attestationLevel,
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.77.7",
+  "version": "5.77.8",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/group-grants.test.ts

@@ -15,14 +15,25 @@
  *      yields an actionable cross-tenant permission message.
  */
 
+import { Command } from "commander";
 import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from "vitest";
 
+const { ensureCognitoTokenSpy } = vi.hoisted(() => ({
+  ensureCognitoTokenSpy: vi.fn(),
+}));
+
+vi.mock("../utils/cognito-session.js", async (importOriginal) => ({
+  ...(await importOriginal()),
+  ensureCognitoToken: ensureCognitoTokenSpy,
+}));
+
 import {
   GrantHttpError,
   formatGrantHttpError,
   grantGroup,
   listInboundGrants,
   listOutboundGrants,
+  registerGroupGrantsCommand,
   revokeGroupGrant,
 } from "./group-grants.js";
 
@@ -41,8 +52,16 @@ beforeEach(() => {
 
 afterEach(() => {
   vi.restoreAllMocks();
+  ensureCognitoTokenSpy.mockReset();
 });
 
+async function runCli(argv: string[]): Promise<void> {
+  const program = new Command();
+  program.exitOverride();
+  registerGroupGrantsCommand(program);
+  await program.parseAsync(["node", "hq", ...argv]);
+}
+
 // ---------------------------------------------------------------------------
 // grantGroup — story e2e #1 (authorized) + validation
 // ---------------------------------------------------------------------------
@@ -242,7 +261,7 @@ describe("revokeGroupGrant", () => {
 // ---------------------------------------------------------------------------
 
 describe("listOutboundGrants", () => {
-  it("GETs /group-grants/outbound with sourceCompanyUid and optional groupId", async () => {
+  it("GETs /group-grants/outbound with both required query parameters", async () => {
     fetchSpy.mockResolvedValueOnce(
       jsonResponse(200, {
         grants: [
@@ -267,7 +286,27 @@ describe("listOutboundGrants", () => {
 
   it("returns [] when the server returns no grants", async () => {
     fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    expect(await listOutboundGrants("test-token", "cmp_a")).toEqual([]);
+    expect(await listOutboundGrants("test-token", "cmp_a", "grp_eng")).toEqual([]);
+  });
+
+  it.each(["", "eng"]) (
+    "rejects invalid group id %j before calling the API",
+    async (groupId) => {
+      await expect(
+        listOutboundGrants("test-token", "cmp_a", groupId),
+      ).rejects.toThrow(/Invalid group id/);
+      expect(fetchSpy).not.toHaveBeenCalled();
+    },
+  );
+});
+
+describe("group-grants outbound command", () => {
+  it("rejects a missing --group before authentication or fetch", async () => {
+    await expect(runCli(["group-grants", "outbound"])).rejects.toMatchObject({
+      code: "commander.missingMandatoryOptionValue",
+    });
+    expect(ensureCognitoTokenSpy).not.toHaveBeenCalled();
+    expect(fetchSpy).not.toHaveBeenCalled();
   });
 });
 

package/src/commands/group-grants.ts

@@ -189,15 +189,18 @@ export async function revokeGroupGrant(
 export async function listOutboundGrants(
   token: string,
   sourceCompanyUid: string,
-  groupId?: string,
+  groupId: string,
 ): Promise<GroupGrant[]> {
-  const query: Record<string, string> = { sourceCompanyUid };
-  if (groupId) query.groupId = groupId;
+  if (!GROUP_ID_PATTERN.test(groupId)) {
+    throw new Error(
+      `Invalid group id '${groupId}': must match grp_<alphanumeric, underscore, hyphen>`,
+    );
+  }
 
   const res = await vaultApiFetch({
     token,
     path: "/group-grants/outbound",
-    query,
+    query: { sourceCompanyUid, groupId },
   });
 
   if (!res.ok) {
@@ -385,13 +388,13 @@ export function registerGroupGrantsCommand(program: Command): void {
   grants
     .command("outbound")
     .description(
-      "List grants the source company's groups hold on other companies",
+      "List grants a source-company group holds on other companies",
     )
-    .option(
+    .requiredOption(
       "--group <groupId>",
-      "Filter to a single group id",
+      "Group id to inspect",
     )
-    .action(async (opts: { group?: string }) => {
+    .action(async (opts: { group: string }) => {
       try {
         const token = await ensureCognitoToken();
         const sourceSlug = grants.opts().company as string | undefined;

package/src/commands/secrets.test.ts

@@ -1723,6 +1723,46 @@ describe("secrets reveal and policy controls", () => {
     expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
   });
 
+  it("script approve hashes the local file while approving a remote runtime path", async () => {
+    const scriptPath = join(tempDir, "approved.sh");
+    const remotePath =
+      "/home/ec2-user/hq-agent/companies/acme/scripts/approved.sh";
+    const scriptBody = "#!/usr/bin/env bash\necho approved remotely\n";
+    writeFileSync(scriptPath, scriptBody);
+    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "script",
+      "approve",
+      "LOCKED",
+      "--id",
+      "deploy-script",
+      "--script",
+      scriptPath,
+      "--remote-path",
+      remotePath,
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/policy/scripts",
+      method: "POST",
+      body: {
+        path: "LOCKED",
+        scriptId: "deploy-script",
+        scriptPath: remotePath,
+        sha256: expectedSha,
+        attestationLevel: "self-asserted-hash",
+      },
+    });
+    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
+  });
+
   it("script revoke hits the revoke endpoint", async () => {
     vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
 

package/src/commands/secrets.ts

@@ -1360,6 +1360,10 @@ export function registerSecretsCommand(program: Command): void {
     .description("Approve a script for a secret path")
     .requiredOption("--id <scriptId>", "Stable script identifier")
     .requiredOption("--script <path>", "Path to the local script file")
+    .option(
+      "--remote-path <path>",
+      "Script path reported by the target runtime (defaults to the local path)",
+    )
     .option(
       "--attestation <level>",
       "Attestation level",
@@ -1367,7 +1371,12 @@ export function registerSecretsCommand(program: Command): void {
     )
     .action(async (
       secretPath: string,
-      opts: { id: string; script: string; attestation: string },
+      opts: {
+        id: string;
+        script: string;
+        remotePath?: string;
+        attestation: string;
+      },
     ) => {
       try {
         rejectIfPersonal(secrets.opts(), "script approve");
@@ -1395,7 +1404,7 @@ export function registerSecretsCommand(program: Command): void {
           body: {
             path: secretPath,
             scriptId: usage.script?.scriptId,
-            scriptPath: usage.script?.path,
+            scriptPath: opts.remotePath ?? usage.script?.path,
             sha256: usage.script?.sha256,
             attestationLevel: usage.script?.attestationLevel,
           },