@indigoai-us/hq-cli 5.182.0 → 5.184.0

package/dist/lib/mesh/live/report-summary.js

@@ -0,0 +1,222 @@
+/**
+ * US-051 — one-sentence quiet-report fields for session_end.
+ *
+ * Built locally at the quiet trigger / SessionEnd flush. Never includes file
+ * contents. Tokens, secret-looking strings, and secrets-file paths are redacted.
+ */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export const REPORT_SUMMARY_MAX_CHARS = 140;
+export const REPORT_SUMMARY_SCHEMA_MAX = 280;
+export const REPORT_TRANSCRIPT_TAIL_BYTES = 256 * 1024;
+const SECRET_RE = /(?:Bearer\s+[A-Za-z0-9._\-+=/]+)|(?:sk-[A-Za-z0-9]{8,})|(?:ghp_[A-Za-z0-9]{8,})|(?:github_pat_[A-Za-z0-9_]{8,})|(?:xox[baprs]-[A-Za-z0-9-]{8,})|(?:AKIA[0-9A-Z]{8,})|(?:op:\/\/[^\s"]+)/gi;
+const SECRETS_PATH_RE = /(?:^|[\s"'`])((?:~|\/|\.\/|\.\.\/)?(?:[\w.-]+\/)*(?:\.env(?:\.[A-Za-z0-9._-]+)?|secrets(?:\/[\w.-]+)*|id_rsa|credentials(?:\.json)?|\.netrc|\.npmrc))/gi;
+const PR_URL_RE = /https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/\d+/g;
+export function redactReportSummary(text) {
+    let out = text.replace(SECRET_RE, "[redacted]");
+    out = out.replace(SECRETS_PATH_RE, (full, match) => full.replace(match, "[redacted-path]"));
+    // eslint-disable-next-line no-control-regex -- strip C0 controls from report text
+    return out.replace(/[\u0000-\u001F\u007F]/g, " ").replace(/\s+/g, " ").trim();
+}
+export function firstSentence(text, max = REPORT_SUMMARY_MAX_CHARS) {
+    const cleaned = redactReportSummary(text);
+    if (!cleaned)
+        return "";
+    const cut = cleaned.split(/(?<=[.!?])\s+/)[0] ?? cleaned;
+    const sentence = cut.trim();
+    if (sentence.length <= max)
+        return sentence;
+    const slice = sentence.slice(0, max);
+    const lastSpace = slice.lastIndexOf(" ");
+    return (lastSpace > 40 ? slice.slice(0, lastSpace) : slice).trim();
+}
+function textFromUnknown(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value)) {
+        return value
+            .map((item) => {
+            if (typeof item === "string")
+                return item;
+            if (item && typeof item === "object") {
+                const rec = item;
+                if (rec.type === "text" && typeof rec.text === "string")
+                    return rec.text;
+            }
+            return "";
+        })
+            .filter(Boolean)
+            .join("\n");
+    }
+    if (value && typeof value === "object") {
+        const rec = value;
+        if (typeof rec.text === "string")
+            return rec.text;
+        if (rec.content !== undefined)
+            return textFromUnknown(rec.content);
+    }
+    return "";
+}
+export function extractLastAssistantText(jsonl) {
+    let last;
+    for (const rawLine of jsonl.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line.startsWith("{"))
+            continue;
+        let obj;
+        try {
+            obj = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const type = typeof obj.type === "string" ? obj.type : "";
+        const role = typeof obj.role === "string" ? obj.role : "";
+        const payload = obj.payload;
+        let text = "";
+        if (type === "assistant" || role === "assistant") {
+            text = textFromUnknown(obj.message ?? obj.content);
+        }
+        else if (payload &&
+            (payload.type === "agent_message" || payload.type === "assistant")) {
+            text = textFromUnknown(payload.message ?? payload.content ?? payload.text);
+        }
+        const trimmed = text.trim();
+        if (trimmed)
+            last = trimmed;
+    }
+    return last;
+}
+export function readTranscriptTail(transcriptPath, maxBytes = REPORT_TRANSCRIPT_TAIL_BYTES) {
+    try {
+        const st = fs.statSync(transcriptPath);
+        if (!st.isFile() || st.size <= 0)
+            return undefined;
+        const size = Math.min(st.size, maxBytes);
+        const fd = fs.openSync(transcriptPath, "r");
+        try {
+            const buf = Buffer.alloc(size);
+            fs.readSync(fd, buf, 0, size, Math.max(0, st.size - size));
+            let text = buf.toString("utf8");
+            if (st.size > maxBytes) {
+                const nl = text.indexOf("\n");
+                if (nl >= 0)
+                    text = text.slice(nl + 1);
+            }
+            return text;
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch {
+        return undefined;
+    }
+}
+function defaultGit(cwd, args) {
+    try {
+        const r = spawnSync("git", ["-C", cwd, ...args], {
+            timeout: 800,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (r.status !== 0)
+            return undefined;
+        const out = (r.stdout ?? "").trim();
+        return out || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function collectGitContext(cwd, git = defaultGit) {
+    const branch = git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    const top = git(cwd, ["rev-parse", "--show-toplevel"]);
+    const repo = top ? path.basename(top) : undefined;
+    const out = {};
+    if (repo && repo.length <= 128 && !repo.includes("\0"))
+        out.repo = repo;
+    if (branch && branch !== "HEAD" && branch.length <= 128)
+        out.gitBranch = branch;
+    return out;
+}
+export function extractPrUrls(text, max = 5) {
+    const seen = new Set();
+    const urls = [];
+    for (const match of text.match(PR_URL_RE) ?? []) {
+        if (seen.has(match))
+            continue;
+        seen.add(match);
+        urls.push(match.slice(0, 256));
+        if (urls.length >= max)
+            break;
+    }
+    return urls;
+}
+export function claudeTranscriptPathFor(sessionId, cwd, home = os.homedir()) {
+    const encoded = cwd.startsWith("/") ? cwd.replace(/\//g, "-") : `-${cwd.replace(/\//g, "-")}`;
+    return path.join(home, ".claude", "projects", encoded, `${sessionId}.jsonl`);
+}
+export function resolveTranscriptPath(input) {
+    const explicit = input.transcriptPath?.trim();
+    if (explicit)
+        return explicit;
+    const envPath = process.env.CLAUDE_TRANSCRIPT_PATH?.trim();
+    if (envPath)
+        return envPath;
+    const sid = input.sessionId?.trim();
+    const cwd = input.cwd?.trim();
+    if (sid && cwd)
+        return claudeTranscriptPathFor(sid, cwd, input.home);
+    return undefined;
+}
+export function buildSessionEndReportFields(input) {
+    const fields = {};
+    const git = input.git ?? defaultGit;
+    const cwd = input.cwd?.trim();
+    if (cwd)
+        Object.assign(fields, collectGitContext(cwd, git));
+    const transcriptPath = resolveTranscriptPath(input);
+    const read = input.readTranscript ?? ((p) => readTranscriptTail(p));
+    let assistant;
+    if (transcriptPath) {
+        const tail = read(transcriptPath);
+        if (tail)
+            assistant = extractLastAssistantText(tail);
+    }
+    if (assistant) {
+        const summary = firstSentence(assistant);
+        if (summary)
+            fields.summary = summary.slice(0, REPORT_SUMMARY_SCHEMA_MAX);
+        const prs = extractPrUrls(assistant);
+        if (prs.length > 0)
+            fields.prUrls = prs;
+    }
+    return fields;
+}
+/** Merge report fields onto a session_end event object (no-op for other kinds). */
+export function enrichSessionEndEvent(event, extra) {
+    if (event.kind !== "session_end")
+        return event;
+    const built = buildSessionEndReportFields({
+        sessionId: typeof event.sessionId === "string" ? event.sessionId : undefined,
+        cwd: typeof event.cwd === "string" ? event.cwd : undefined,
+        transcriptPath: extra?.transcriptPath,
+        home: extra?.home,
+        git: extra?.git,
+        readTranscript: extra?.readTranscript,
+    });
+    const out = { ...event };
+    if (!out.summary && built.summary)
+        out.summary = built.summary;
+    if (!out.repo && built.repo)
+        out.repo = built.repo;
+    if (!out.gitBranch && built.gitBranch)
+        out.gitBranch = built.gitBranch;
+    if (!out.prUrls && built.prUrls)
+        out.prUrls = built.prUrls;
+    return out;
+}
+//# sourceMappingURL=report-summary.js.map

package/dist/lib/mesh/live/session-event.schema.json

@@ -109,7 +109,30 @@
       "type": "string",
       "minLength": 1,
       "maxLength": 280,
-      "description": "Optional short summary allowed only on note, blocked, and task_status. Never prompt-derived content."
+      "description": "Optional short summary on note, blocked, task_status, and session_end (US-051 quiet report). Redacted; never raw prompts, tokens, or file contents."
+    },
+    "repo": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Optional git repository basename on session_end for the quiet work report (US-051)."
+    },
+    "gitBranch": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Optional git branch of the session cwd on session_end (US-051)."
+    },
+    "prUrls": {
+      "type": "array",
+      "maxItems": 5,
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 256,
+        "pattern": "^https://github\\.com/"
+      },
+      "description": "Optional pull-request URLs seen in the quiet window (US-051)."
     },
     "cwd": {
       "type": "string",

package/dist/lib/mesh/live/validate-session-event.d.ts

@@ -8,7 +8,7 @@
 import type { ValidateFunction } from "ajv";
 export declare const SESSION_EVENT_SCHEMA_PATH: string;
 /** Expected SHA-256 of the canonical schema bytes (hq-pro + hq-cli must match). */
-export declare const SESSION_EVENT_SCHEMA_SHA256 = "4284bcc3718b8c9008c26156c1f79ae5cfd70fdd248beb2b1c776988f109e415";
+export declare const SESSION_EVENT_SCHEMA_SHA256 = "e3a9b05daf0037688809e8825a286f9dc89d69aa9266696270d776b64bf99dda";
 export declare const PROHIBITED_CONTENT_CLASSES: readonly ["prompts", "model_output", "transcripts", "message_bodies", "tokens", "credentials"];
 export type ProhibitedContentClass = (typeof PROHIBITED_CONTENT_CLASSES)[number];
 /** Fixture field name → prohibited class. */

package/dist/lib/mesh/live/validate-session-event.js

@@ -13,7 +13,7 @@ import Ajv2020 from "ajv/dist/2020.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 export const SESSION_EVENT_SCHEMA_PATH = join(HERE, "session-event.schema.json");
 /** Expected SHA-256 of the canonical schema bytes (hq-pro + hq-cli must match). */
-export const SESSION_EVENT_SCHEMA_SHA256 = "4284bcc3718b8c9008c26156c1f79ae5cfd70fdd248beb2b1c776988f109e415";
+export const SESSION_EVENT_SCHEMA_SHA256 = "e3a9b05daf0037688809e8825a286f9dc89d69aa9266696270d776b64bf99dda";
 export const PROHIBITED_CONTENT_CLASSES = [
     "prompts",
     "model_output",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.182.0",
+  "version": "5.184.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {