@groundtrack/hooks 0.1.14 → 0.1.15

package/dist/session-import/cli.d.ts

@@ -13,6 +13,7 @@ type ImportArguments = Readonly<{
     yes: boolean;
     json: boolean;
     apiKey?: string;
+    receiptScope?: string;
     apiBaseUrl: string;
     help: boolean;
 }>;

package/dist/session-import/cli.js

@@ -24,7 +24,8 @@ Import options:
   --since DATE           Import sessions at or after an ISO timestamp or local YYYY-MM-DD
   --include-subagents    Include subagent, forked-agent, and guardian sessions
   --visibility VALUE     private (default) or organization
-  --api-key KEY          API key; prefer the GROUNDTRACK_API_KEY environment variable
+  --api-key KEY          API key; prefer GROUNDTRACK_IMPORT_KEY or GROUNDTRACK_API_KEY
+  --receipt-scope VALUE  Stable receipt scope from create_session_import_key for rotating keys
   --url URL              Groundtrack app or API URL (default: https://app.groundtrack.dev)
   --dry-run              Discover and prune without authentication or network calls
   --yes, -y              Upload without another confirmation
@@ -68,6 +69,7 @@ export function parseImportArguments(argv) {
     let yes = false;
     let json = false;
     let apiKey;
+    let receiptScope;
     let apiBaseUrl = normalizeApiBaseUrl("https://app.groundtrack.dev");
     let help = false;
     for (let index = 0; index < args.length; index += 1) {
@@ -98,6 +100,8 @@ export function parseImportArguments(argv) {
             since = parseDate(valueAfter(index++, arg));
         else if (arg === "--api-key")
             apiKey = valueAfter(index++, arg);
+        else if (arg === "--receipt-scope")
+            receiptScope = valueAfter(index++, arg);
         else if (arg === "--url")
             apiBaseUrl = normalizeApiBaseUrl(valueAfter(index++, arg));
         else if (arg === "--dry-run")
@@ -128,6 +132,7 @@ export function parseImportArguments(argv) {
         yes,
         json,
         apiKey,
+        receiptScope,
         apiBaseUrl,
         help,
     };
@@ -216,7 +221,12 @@ async function runAgentImport(args, agent, context, interactive) {
         workingDirectory: context.repoDir,
     });
     try {
-        const apiKey = args.apiKey ?? context.env.GROUNDTRACK_API_KEY;
+        const apiKey = args.apiKey ?? context.env.GROUNDTRACK_IMPORT_KEY ?? context.env.GROUNDTRACK_API_KEY;
+        const providedReceiptScope = args.receiptScope ?? context.env.GROUNDTRACK_IMPORT_RECEIPT_SCOPE;
+        if (providedReceiptScope && !/^[a-f0-9]{64}$/.test(providedReceiptScope))
+            throw new Error("The import receipt scope must be a 64-character lowercase hex value.");
+        // A leftover scope from another import must not skip uploads with a legacy key.
+        const stableReceiptScope = apiKey?.startsWith("gti_") ? providedReceiptScope : undefined;
         const receipts = apiKey ? readReceipts(context) : { version: 1, receipts: {} };
         const prepared = [];
         const preparationErrors = [...discovery.failed];
@@ -232,6 +242,7 @@ async function runAgentImport(args, agent, context, interactive) {
                     ? receiptKey({
                         apiBaseUrl: args.apiBaseUrl,
                         apiKey,
+                        receiptScope: stableReceiptScope,
                         source: format.source,
                         sourceContentHash: pruned.sourceContentHash,
                         visibility: args.visibility,
@@ -290,7 +301,7 @@ async function runAgentImport(args, agent, context, interactive) {
                 failed: preparationErrors.length,
             });
         if (!apiKey)
-            throw new Error("Set GROUNDTRACK_API_KEY or pass --api-key before uploading.");
+            throw new Error("Set GROUNDTRACK_IMPORT_KEY or GROUNDTRACK_API_KEY before uploading.");
         if (!args.yes && !interactive)
             throw new Error("Import needs confirmation. Use --yes, or run it in an interactive terminal.");
         if (!args.yes) {

package/dist/session-import/receipts.d.ts

@@ -13,6 +13,7 @@ export declare function readReceipts(context: SetupEnvironment): ReceiptFile;
 export declare function receiptKey(input: {
     apiBaseUrl: string;
     apiKey: string;
+    receiptScope?: string;
     source: AgentSessionSource;
     sourceContentHash: string;
     visibility: ImportVisibility;

package/dist/session-import/receipts.js

@@ -30,7 +30,9 @@ export function receiptKey(input) {
     return createHash("sha256")
         .update([
         input.apiBaseUrl,
-        createHash("sha256").update(input.apiKey).digest("hex"),
+        input.receiptScope
+            ? `scoped:${input.receiptScope}`
+            : createHash("sha256").update(input.apiKey).digest("hex"),
         input.source,
         CANONICALIZATION_VERSION,
         input.visibility,

package/dist/session-import/redaction.js

@@ -16,12 +16,13 @@ function isSensitiveKey(value) {
     return sensitiveKeyPattern.test(value.replace(/([a-z0-9])([A-Z])/g, "$1_$2"));
 }
 export function redactCredentialText(value) {
+    // Server persistence and CLI normalization both use this redactor.
     return value
         .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]")
         .replace(/\b(authorization\s*:\s*(?:bearer|basic)\s+)[^\s,;]+/gi, "$1[REDACTED]")
         .replace(/\b((?:[a-z0-9_-]*(?:api[_-]?key|access[_-]?key(?:[_-]?id)?|token|password|passwd|secret|private[_-]?key|credentials?|database[_-]?url))\s*[=:]\s*)[^\s,;]+/gi, "$1[REDACTED]")
         .replace(/(?:^|\s)((?:--)?(?:api-key|token|password|secret)\s+)[^\s,;]+/gi, "$1$2[REDACTED]")
-        .replace(/\b(?:sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|glpat-[A-Za-z0-9_-]{12,}|npm_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{12,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{20,})\b/g, "[REDACTED]")
+        .replace(/\b(?:gti_[A-Za-z]{32,}|sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|glpat-[A-Za-z0-9_-]{12,}|npm_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{12,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{20,})\b/g, "[REDACTED]")
         .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED]")
         .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/:@]+:[^\s/@]+@/gi, "$1[REDACTED]@");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundtrack/hooks",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Lifecycle hook utilities for Groundtrack MCP clients.",
   "keywords": [
     "claude-code",