security: harden agent surface — vault_exec allow-list, SSRF, error hygiene

Stress-test remediation across MCP, CLI, and backend:

- primora_vault_exec rewritten as an allow-list (was deny-list):
  colon-form single-token commands bypassed it, leaking every vault
  secret; verbatim env-name injection allowed NODE_OPTIONS=--require
  host RCE. Now fixed read-mostly command set, arg/path deny regex,
  strict env-name grammar, loader-hook name blocklist. All prior
  bypasses verified denied; allowed commands still inject.
- SSRF: webhook/job URL validation now blocks cloud metadata IPs
  (169.254.169.254, fd00:ec2::254) inside the link-local allowance
  and non-canonical IP encodings (decimal/hex bare hosts) smuggled
  as "docker service names".
- Path params encodeURIComponent in all client consumers — encodeURI
  left ?#& intact, smuggling query segments through {name} params.
- primora_upload_object strict-validates contentBase64 — Buffer.from
  silently dropped invalid chars.
- MCP no-creds startup degrades instead of crashing mid-handshake.
- GET /api/v1/context — API-key self-discovery; fixes the CLI dead
  end (login --api-key validates the key + seeds org/project,
  use/context/whoami work under key auth).
- CLI: unknown commands / bare group exit 1 with hints; mri numeric
  coercion reversed via raw-argv restore (007 stays "007");
  login --json; orgs:rm / projects:rm / buckets:rm behind --yes;
  fetch-failed errors name the cause.
- Error hygiene: pgx.ErrNoRows -> 404, pgconn codes -> clean
  400/409 without SQLSTATE leaks, validator failures formatted,
  services.InputError maps input faults to 400 (webhook URL/event
  errors were 500s), presign on local driver -> 400.
- Webhook events accept wildcard patterns (*, ns.*, custom.*)
  matched via SQL LIKE — client-published events can be webhooked.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

packages/api-client/src/generated/index.ts

@@ -8,6 +8,7 @@ export { OpenAPI } from './core/OpenAPI';
 export type { OpenAPIConfig } from './core/OpenAPI';
 
 export type { AcceptInvitationRequest } from './models/AcceptInvitationRequest';
+export { ActorContext } from './models/ActorContext';
 export { AlertRule } from './models/AlertRule';
 export type { AlertRuleConfig } from './models/AlertRuleConfig';
 export type { AlertRuleListResponse } from './models/AlertRuleListResponse';
@@ -29,6 +30,7 @@ export type { CollectionListResponse } from './models/CollectionListResponse';
 export type { ComponentHealth } from './models/ComponentHealth';
 export type { ComponentID } from './models/ComponentID';
 export type { ConnectionID } from './models/ConnectionID';
+export type { ContextRef } from './models/ContextRef';
 export type { CopyBucketObjectRequest } from './models/CopyBucketObjectRequest';
 export type { CreateApiKeyRequest } from './models/CreateApiKeyRequest';
 export { CreateBucketRequest } from './models/CreateBucketRequest';
@@ -161,6 +163,7 @@ export type { WebhookID } from './models/WebhookID';
 export type { WebhookListResponse } from './models/WebhookListResponse';
 
 export { $AcceptInvitationRequest } from './schemas/$AcceptInvitationRequest';
+export { $ActorContext } from './schemas/$ActorContext';
 export { $AlertRule } from './schemas/$AlertRule';
 export { $AlertRuleConfig } from './schemas/$AlertRuleConfig';
 export { $AlertRuleListResponse } from './schemas/$AlertRuleListResponse';
@@ -182,6 +185,7 @@ export { $CollectionListResponse } from './schemas/$CollectionListResponse';
 export { $ComponentHealth } from './schemas/$ComponentHealth';
 export { $ComponentID } from './schemas/$ComponentID';
 export { $ConnectionID } from './schemas/$ConnectionID';
+export { $ContextRef } from './schemas/$ContextRef';
 export { $CopyBucketObjectRequest } from './schemas/$CopyBucketObjectRequest';
 export { $CreateApiKeyRequest } from './schemas/$CreateApiKeyRequest';
 export { $CreateBucketRequest } from './schemas/$CreateBucketRequest';

packages/api-client/src/generated/models/ActorContext.ts

@@ -0,0 +1,19 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { ContextRef } from './ContextRef';
+export type ActorContext = {
+    actor: ActorContext.actor;
+    scopes?: Array<string>;
+    key_prefix?: string;
+    organization?: ContextRef;
+    project?: ContextRef;
+};
+export namespace ActorContext {
+    export enum actor {
+        USER = 'user',
+        API_KEY = 'api_key',
+    }
+}
+

packages/api-client/src/generated/models/ContextRef.ts

@@ -0,0 +1,10 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type ContextRef = {
+    id: string;
+    slug: string;
+    name: string;
+};
+

packages/api-client/src/generated/schemas/$ActorContext.ts

@@ -0,0 +1,27 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $ActorContext = {
+    properties: {
+        actor: {
+            type: 'Enum',
+            isRequired: true,
+        },
+        scopes: {
+            type: 'array',
+            contains: {
+                type: 'string',
+            },
+        },
+        key_prefix: {
+            type: 'string',
+        },
+        organization: {
+            type: 'ContextRef',
+        },
+        project: {
+            type: 'ContextRef',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$ContextRef.ts

@@ -0,0 +1,21 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $ContextRef = {
+    properties: {
+        id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        slug: {
+            type: 'string',
+            isRequired: true,
+        },
+        name: {
+            type: 'string',
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/services/PlatformService.ts

@@ -2,6 +2,7 @@
 /* istanbul ignore file */
 /* tslint:disable */
 /* eslint-disable */
+import type { ActorContext } from '../models/ActorContext';
 import type { BootstrapRequest } from '../models/BootstrapRequest';
 import type { BootstrapResponse } from '../models/BootstrapResponse';
 import type { MeResponse } from '../models/MeResponse';
@@ -22,6 +23,20 @@ export class PlatformService {
             },
         });
     }
+    /**
+     * Caller scope — self-discovery for API keys, which cannot call /me
+     * @returns ActorContext Actor type, scopes, and resolved org/project for API keys
+     * @throws ApiError
+     */
+    public static getActorContext(): CancelablePromise<ActorContext> {
+        return __request(OpenAPI, {
+            method: 'GET',
+            url: '/context',
+            errors: {
+                401: `Error response`,
+            },
+        });
+    }
     /**
      * @returns BootstrapResponse Platform bootstrapped
      * @throws ApiError