security: harden agent surface — vault_exec allow-list, SSRF, error hygiene

Stress-test remediation across MCP, CLI, and backend:

- primora_vault_exec rewritten as an allow-list (was deny-list):
  colon-form single-token commands bypassed it, leaking every vault
  secret; verbatim env-name injection allowed NODE_OPTIONS=--require
  host RCE. Now fixed read-mostly command set, arg/path deny regex,
  strict env-name grammar, loader-hook name blocklist. All prior
  bypasses verified denied; allowed commands still inject.
- SSRF: webhook/job URL validation now blocks cloud metadata IPs
  (169.254.169.254, fd00:ec2::254) inside the link-local allowance
  and non-canonical IP encodings (decimal/hex bare hosts) smuggled
  as "docker service names".
- Path params encodeURIComponent in all client consumers — encodeURI
  left ?#& intact, smuggling query segments through {name} params.
- primora_upload_object strict-validates contentBase64 — Buffer.from
  silently dropped invalid chars.
- MCP no-creds startup degrades instead of crashing mid-handshake.
- GET /api/v1/context — API-key self-discovery; fixes the CLI dead
  end (login --api-key validates the key + seeds org/project,
  use/context/whoami work under key auth).
- CLI: unknown commands / bare group exit 1 with hints; mri numeric
  coercion reversed via raw-argv restore (007 stays "007");
  login --json; orgs:rm / projects:rm / buckets:rm behind --yes;
  fetch-failed errors name the cause.
- Error hygiene: pgx.ErrNoRows -> 404, pgconn codes -> clean
  400/409 without SQLSTATE leaks, validator failures formatted,
  services.InputError maps input faults to 400 (webhook URL/event
  errors were 500s), presign on local driver -> 400.
- Webhook events accept wildcard patterns (*, ns.*, custom.*)
  matched via SQL LIKE — client-published events can be webhooked.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/cli/src/out.ts

@@ -17,9 +17,27 @@ export function dim(message: string): void {
   process.stdout.write(pc.dim(message) + "\n");
 }
 
+/** Destructive-action gate — requires --yes in scripts, prompts on a TTY. */
+export async function confirmOrAbort(message: string, yes?: boolean): Promise<void> {
+  if (yes) return;
+  if (!process.stdin.isTTY) {
+    throw new Error(`${message} — pass --yes to confirm in non-interactive mode`);
+  }
+  const answer = await p.confirm({ message });
+  if (p.isCancel(answer) || !answer) {
+    p.cancel("Aborted.");
+    process.exit(1);
+  }
+}
+
 export function fail(error: unknown): never {
-  const err = error as { message?: string; hint?: string; status?: number; body?: unknown };
+  const err = error as { message?: string; hint?: string; status?: number; body?: unknown; cause?: { code?: string } };
   let message = err?.message ?? "unknown error";
+  // undici TypeError "fetch failed" — the useful part is the cause code.
+  if (message === "fetch failed" || message.startsWith("fetch failed")) {
+    const code = err?.cause?.code;
+    message = `could not reach the instance${code ? ` (${code})` : ""} — check \`primora context\` and that it is running`;
+  }
   // generated client throws ApiError with a parsed body
   const body = err?.body as { error?: { message?: string } } | undefined;
   if (body?.error?.message) message = body.error.message;