security: harden agent surface — vault_exec allow-list, SSRF, error hygiene

Stress-test remediation across MCP, CLI, and backend:

- primora_vault_exec rewritten as an allow-list (was deny-list):
  colon-form single-token commands bypassed it, leaking every vault
  secret; verbatim env-name injection allowed NODE_OPTIONS=--require
  host RCE. Now fixed read-mostly command set, arg/path deny regex,
  strict env-name grammar, loader-hook name blocklist. All prior
  bypasses verified denied; allowed commands still inject.
- SSRF: webhook/job URL validation now blocks cloud metadata IPs
  (169.254.169.254, fd00:ec2::254) inside the link-local allowance
  and non-canonical IP encodings (decimal/hex bare hosts) smuggled
  as "docker service names".
- Path params encodeURIComponent in all client consumers — encodeURI
  left ?#& intact, smuggling query segments through {name} params.
- primora_upload_object strict-validates contentBase64 — Buffer.from
  silently dropped invalid chars.
- MCP no-creds startup degrades instead of crashing mid-handshake.
- GET /api/v1/context — API-key self-discovery; fixes the CLI dead
  end (login --api-key validates the key + seeds org/project,
  use/context/whoami work under key auth).
- CLI: unknown commands / bare group exit 1 with hints; mri numeric
  coercion reversed via raw-argv restore (007 stays "007");
  login --json; orgs:rm / projects:rm / buckets:rm behind --yes;
  fetch-failed errors name the cause.
- Error hygiene: pgx.ErrNoRows -> 404, pgconn codes -> clean
  400/409 without SQLSTATE leaks, validator failures formatted,
  services.InputError maps input faults to 400 (webhook URL/event
  errors were 500s), presign on local driver -> 400.
- Webhook events accept wildcard patterns (*, ns.*, custom.*)
  matched via SQL LIKE — client-published events can be webhooked.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/cli/src/commands/context.ts

@@ -23,6 +23,22 @@ export async function cmdUse(options: UseOptions): Promise<void> {
   requireAuth(cfg);
   configureClient(cfg);
 
+  // API keys are bound to one org+project — resolve the scope directly.
+  if (cfg.auth?.type === "apiKey") {
+    const ctx = await PlatformService.getActorContext();
+    if (options.org && ctx.organization && options.org !== ctx.organization.id && options.org !== ctx.organization.slug) {
+      throw new Error(`API key is scoped to ${ctx.organization.slug} — cannot switch to "${options.org}".`);
+    }
+    if (options.project && ctx.project && options.project !== ctx.project.id && options.project !== ctx.project.slug) {
+      throw new Error(`API key is scoped to ${ctx.project.slug} — cannot switch to "${options.project}".`);
+    }
+    if (ctx.organization) cfg.organizationId = ctx.organization.id;
+    if (ctx.project) cfg.projectId = ctx.project.id;
+    saveConfig(cfg);
+    success(`Context → ${ctx.organization?.slug ?? "—"} / ${ctx.project?.slug ?? "—"}`);
+    return;
+  }
+
   const me = await PlatformService.getMe();
   const orgs = me.organizations;
   if (orgs.length === 0) {
@@ -77,6 +93,19 @@ export async function cmdContext(options: { json?: boolean }): Promise<void> {
   requireAuth(cfg);
   configureClient(cfg);
 
+  if (cfg.auth?.type === "apiKey") {
+    const ctx = await PlatformService.getActorContext();
+    if (isJson(options)) {
+      printJson({ baseUrl: cfg.baseUrl, auth: "apiKey", ...ctx });
+      return;
+    }
+    dim(`url      ${cfg.baseUrl}`);
+    dim(`auth     api_key (${ctx.key_prefix}…, scopes: ${ctx.scopes?.join(", ") || "none"})`);
+    process.stdout.write(`org      ${ctx.organization ? `${ctx.organization.name} (${ctx.organization.slug})` : "—"}\n`);
+    process.stdout.write(`project  ${ctx.project ? `${ctx.project.name} (${ctx.project.slug})` : "—"}\n`);
+    return;
+  }
+
   const me = await PlatformService.getMe();
   const org = me.organizations.find((o) => o.id === cfg.organizationId);
   const project = org?.projects.find((pr) => pr.id === cfg.projectId);