@indigoai-us/hq-cli 5.275.0 → 5.277.0

package/dist/lib/checkpoint-ontology/plan.js

@@ -13,6 +13,7 @@ import * as path from "node:path";
 import { writeCompanyBrief } from "./company-brief.js";
 import { resolveOntologyCompany, safeWriteFile, stateRoot } from "./company.js";
 import { startMultiWriterRun } from "./multi-writer.js";
+import { claimQueuedTouches, recordQueuedTouches } from "./queued-touches.js";
 import { checkSyncClient, readSyncClientVersions } from "./sync-client.js";
 import { buildEntityIndex, listKnowledgeFiles, listSignalFiles, readSignal } from "./tree.js";
 export const ONTOLOGY_FLAG = "checkpoint.ontology";
@@ -74,6 +75,17 @@ export const FIRST_NAME_PEOPLE_FLAG = "checkpoint.ontology.first-name-people";
  * to 0.803 and cost recall 0.023 on a replay of six runs.
  */
 export const SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG = "checkpoint.ontology.skip-ambiguous-concept-links";
+/**
+ * A knowledge link to the weaker of two entities that share a canonical name
+ * across types is redirected to the sibling other entity files link to
+ * (`project/build-your-own-agi` beside `concept/build-your-own-agi`, or
+ * `project/hq-core 2` beside `project/hq-core` when a concept also holds the
+ * name). The plan carries `dominant_sibling_link: true`, and apply reports
+ * the move in `dominant_sibling_redirects` without writing the entity files.
+ * CO-60: a replay of six runs raised knowledge precision from 0.725 to 0.754
+ * and recall from 0.784 to 0.816, and never changed a create.
+ */
+export const DOMINANT_SIBLING_LINK_FLAG = "checkpoint.ontology.dominant-sibling-link";
 /**
  * A knowledge concept candidate whose name is an alias of more than one
  * entity, and which apply would defer as `ambiguous_alias`, links instead to
@@ -98,6 +110,15 @@ export const CONCEPT_PROJECT_LINK_FLAG = "checkpoint.ontology.concept-project-li
  * and lost no gold link.
  */
 export const NAMED_EVIDENCE_FLAG = "checkpoint.ontology.named-evidence";
+/**
+ * CO-59: consume the files touched by company checkpoints that were queued
+ * behind a busy sibling (see queued-touches.ts). On, the plan adds the
+ * company's queued touches to this run's session-touched set, and a run whose
+ * own payload names no company plans the company the parent picked for it
+ * (`ontology_company`), without that run's session text. Off, queued touches
+ * wait on disk and a company-less run skips the ontology step as before.
+ */
+export const QUEUED_TOUCHES_FLAG = "checkpoint.ontology.queued-touches";
 export const PLAN_FILE = "ontology-plan.json";
 export const CANDIDATES_FILE = "ontology-candidates.json";
 export const REPORT_FILE = "ontology-report.json";
@@ -255,13 +276,32 @@ export function refreshLedger(company, existing, touched) {
     }
     return { ledger: { schema: LEDGER_SCHEMA, company: company.slug, boundary, entries }, firstRun };
 }
+/**
+ * The company this run's ontology step works on: the payload's own company,
+ * or else the `ontology_company` the checkpoint parent picked for queued
+ * touches (`borrowed`).
+ */
+export function payloadOntologyCompany(payload) {
+    if (typeof payload.company === "string" && payload.company)
+        return { slug: payload.company, borrowed: false };
+    if (typeof payload.ontology_company === "string" && payload.ontology_company) {
+        return { slug: payload.ontology_company, borrowed: true };
+    }
+    return { slug: null, borrowed: false };
+}
 /** Plan this run. Never throws for a skip; returns the reason instead. */
 export async function planOntologyRun(options) {
     const { hqRoot, runDir, payload } = options;
-    const resolution = resolveOntologyCompany(hqRoot, typeof payload.company === "string" ? payload.company : null);
+    const { slug, borrowed } = payloadOntologyCompany(payload);
+    const resolution = resolveOntologyCompany(hqRoot, slug);
     if (!resolution.ok)
         return { status: "skipped", reason: resolution.reason };
     const company = resolution.company;
+    // A borrowed company exists only for queued touches, so its run needs the
+    // queued-touches flag before anything else is read or written.
+    if (borrowed && !(await options.readFlag(QUEUED_TOUCHES_FLAG, company))) {
+        return { status: "skipped", reason: "flag off" };
+    }
     const ontologyOn = (await options.readFlag(ONTOLOGY_FLAG, company)) || (await options.readFlag(ONTOLOGY_SYNC_GATED_FLAG, company));
     const syncClient = ontologyOn ? checkSyncClient((options.syncClientVersions ?? readSyncClientVersions)()) : null;
     if (!ontologyOn || !syncClient?.ok) {
@@ -276,9 +316,17 @@ export async function planOntologyRun(options) {
     const noLinkAliases = await options.readFlag(NO_LINK_ALIASES_FLAG, company);
     const firstNamePeople = await options.readFlag(FIRST_NAME_PEOPLE_FLAG, company);
     const skipAmbiguousConceptLinks = await options.readFlag(SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG, company);
+    const dominantSiblingLink = await options.readFlag(DOMINANT_SIBLING_LINK_FLAG, company);
     const conceptProjectLink = await options.readFlag(CONCEPT_PROJECT_LINK_FLAG, company);
     const namedEvidence = await options.readFlag(NAMED_EVIDENCE_FLAG, company);
-    const touched = sessionTouched(hqRoot, company, payload.files);
+    const queuedTouchesOn = borrowed || (await options.readFlag(QUEUED_TOUCHES_FLAG, company));
+    // A borrowed company's run belongs to another session: its own files and
+    // session text are not this company's input.
+    const touched = sessionTouched(hqRoot, company, borrowed ? [] : payload.files);
+    if (queuedTouchesOn) {
+        for (const rel of sessionTouched(hqRoot, company, claimQueuedTouches(hqRoot, company, runDir)))
+            touched.add(rel);
+    }
     // A first run takes its boundary from the entity tree, so the ledger is
     // refreshed before merge-back moves any `last_updated` forward.
     const { ledger, firstRun } = refreshLedger(company, readLedger(hqRoot, company), touched);
@@ -293,9 +341,11 @@ export async function planOntologyRun(options) {
     const inputs = [];
     let tokens = 0;
     let remaining = 0;
+    const leftover = [];
     for (const [rel, entry] of pending) {
         if (inputs.length >= BUDGET.maxInputs || tokens >= BUDGET.maxTokens) {
             remaining += 1;
+            leftover.push(rel);
             continue;
         }
         const text = fs.readFileSync(path.join(company.dir, rel), "utf8");
@@ -329,10 +379,21 @@ export async function planOntologyRun(options) {
             });
             tokens += cost;
         }
-        if (index < chunks.length)
+        if (index < chunks.length) {
             remaining += 1;
+            leftover.push(rel);
+        }
     }
     writeLedger(hqRoot, company, ledger);
+    // The leftover files stay queued so a later company-less run can borrow this company again.
+    if (queuedTouchesOn && leftover.length > 0) {
+        try {
+            recordQueuedTouches(hqRoot, company.slug, leftover.map((rel) => path.relative(hqRoot, path.join(company.dir, rel))), options.now ?? new Date());
+        }
+        catch {
+            // Re-queueing leftovers must not fail the plan.
+        }
+    }
     if (inputs.length === 0) {
         const reason = pending.length > 0 ? "over budget" : "nothing changed";
         return {
@@ -345,7 +406,7 @@ export async function planOntologyRun(options) {
     // Session content is scoped to the session's user (design section 6, D2).
     // v1 records the existing entities it names as links in the report and
     // writes nothing from it, so it rides along only when files changed.
-    const sessionText = sessionContent(payload);
+    const sessionText = borrowed ? null : sessionContent(payload);
     if (sessionText) {
         const cost = estTokens(Buffer.byteLength(sessionText, "utf8"));
         inputs.unshift({
@@ -379,6 +440,7 @@ export async function planOntologyRun(options) {
         ...(noLinkAliases ? { link_aliases: false } : {}),
         ...(firstNamePeople ? { first_name_people: true } : {}),
         ...(skipAmbiguousConceptLinks ? { skip_ambiguous_concept_links: true } : {}),
+        ...(dominantSiblingLink ? { dominant_sibling_link: true } : {}),
         ...(conceptProjectLink ? { concept_project_link: true } : {}),
         ...(namedEvidence ? { named_evidence: true } : {}),
         inputs,

package/dist/lib/checkpoint-ontology/queued-touches.d.ts

@@ -0,0 +1,32 @@
+import { type OntologyCompany } from "./company.js";
+export declare const QUEUED_TOUCHES_FILE = "queued-touches.jsonl";
+export declare const QUEUED_TOUCHES_CLAIM_FILE = "queued-touches-claimed.jsonl";
+export declare const QUEUED_TOUCHES_BORROWED_FILE = "queued-touches-borrowed-at";
+export declare const MAX_QUEUED_TOUCHES = 200;
+export declare function queuedTouchesPath(hqRoot: string, slug: string): string;
+/**
+ * Record the files a queued checkpoint touched inside its company. Files
+ * outside `companies/<slug>/` are dropped. Returns the number of files
+ * recorded; 0 when the company is not a manifest company or nothing is inside
+ * it. The queue keeps its newest {@link MAX_QUEUED_TOUCHES} lines.
+ */
+export declare function recordQueuedTouches(hqRoot: string, slug: string | null, files: string[], now: Date): number;
+/**
+ * Record that a company-less run borrowed `slug`, so the next such run prefers
+ * a company that has waited longer.
+ */
+export declare function markBorrowed(hqRoot: string, slug: string, now: Date): void;
+/**
+ * The manifest company whose queued touches have waited longest, or null.
+ * The order key is the later of the first queued record and the last borrow,
+ * so a company a company-less run just borrowed goes to the back. A run whose
+ * own payload names no company uses it for its ontology step.
+ */
+export declare function oldestQueuedCompany(hqRoot: string): string | null;
+/**
+ * Take the company's queued touches by renaming the file into the run
+ * directory, then return the HQ-relative paths it lists. Renaming is atomic,
+ * so a touch recorded during the claim lands in a fresh file for a later run.
+ */
+export declare function claimQueuedTouches(hqRoot: string, company: OntologyCompany, runDir: string): string[];
+//# sourceMappingURL=queued-touches.d.ts.map

package/dist/lib/checkpoint-ontology/queued-touches.js

@@ -0,0 +1,193 @@
+/**
+ * Company files touched by checkpoints that were queued behind a busy sibling.
+ *
+ * `hq core checkpoint` queues its payload when a sibling is already running,
+ * and the next run claims the queue. That run renders the ontology step only
+ * for its own payload's company, and the ontology plan records any changed
+ * file the run's own payload did not touch as seen. Without this file, the
+ * files a queued company checkpoint touched never reach the ontology (CO-59).
+ *
+ * The checkpoint parent performs no network I/O, so it cannot read the
+ * `checkpoint.ontology.queued-touches` flag. It always records the touches in
+ * the company's local, unsynced state directory; the ontology plan consumes
+ * them only while the flag is on. The file is capped so it stays small while
+ * the flag is off.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { assertSafeTarget, resolveOntologyCompany, safeWriteFile, WriteBoundsError, } from "./company.js";
+export const QUEUED_TOUCHES_FILE = "queued-touches.jsonl";
+export const QUEUED_TOUCHES_CLAIM_FILE = "queued-touches-claimed.jsonl";
+export const QUEUED_TOUCHES_BORROWED_FILE = "queued-touches-borrowed-at";
+export const MAX_QUEUED_TOUCHES = 200;
+function ontologyStateBase(hqRoot) {
+    return path.join(hqRoot, "workspace", "checkpoints", "ontology");
+}
+function companyStateDir(hqRoot, slug) {
+    return path.join(ontologyStateBase(hqRoot), slug);
+}
+export function queuedTouchesPath(hqRoot, slug) {
+    return path.join(companyStateDir(hqRoot, slug), QUEUED_TOUCHES_FILE);
+}
+/**
+ * Record the files a queued checkpoint touched inside its company. Files
+ * outside `companies/<slug>/` are dropped. Returns the number of files
+ * recorded; 0 when the company is not a manifest company or nothing is inside
+ * it. The queue keeps its newest {@link MAX_QUEUED_TOUCHES} lines.
+ */
+export function recordQueuedTouches(hqRoot, slug, files, now) {
+    if (!slug)
+        return 0;
+    const resolution = resolveOntologyCompany(hqRoot, slug);
+    if (!resolution.ok)
+        return 0;
+    const inside = files.filter((file) => {
+        if (typeof file !== "string" || !file.trim())
+            return false;
+        const rel = path.relative(resolution.company.dir, path.resolve(hqRoot, file.trim()));
+        return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+    });
+    if (inside.length === 0)
+        return 0;
+    const target = queuedTouchesPath(hqRoot, slug);
+    try {
+        assertSafeTarget(hqRoot, [companyStateDir(hqRoot, slug)], target);
+    }
+    catch (error) {
+        if (error instanceof WriteBoundsError)
+            return 0;
+        throw error;
+    }
+    const fd = fs.openSync(target, fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | fs.constants.O_NOFOLLOW);
+    try {
+        fs.writeSync(fd, `${JSON.stringify({ queued_at: now.toISOString(), files: inside })}\n`);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    const lines = fs.readFileSync(target, "utf8").split("\n").filter((line) => line.trim());
+    if (lines.length > MAX_QUEUED_TOUCHES) {
+        // Best-effort trim, as for the sibling's pending queue: it can race a
+        // concurrent append, but only once the file is already over its cap.
+        safeWriteFile(hqRoot, [companyStateDir(hqRoot, slug)], target, `${lines.slice(-MAX_QUEUED_TOUCHES).join("\n")}\n`);
+    }
+    return inside.length;
+}
+/**
+ * Record that a company-less run borrowed `slug`, so the next such run prefers
+ * a company that has waited longer.
+ */
+export function markBorrowed(hqRoot, slug, now) {
+    const target = path.join(companyStateDir(hqRoot, slug), QUEUED_TOUCHES_BORROWED_FILE);
+    safeWriteFile(hqRoot, [companyStateDir(hqRoot, slug)], target, `${now.toISOString()}\n`);
+}
+/** `queued_at` of the oldest record, or the file mtime when no line has one. */
+function firstQueuedMs(file, mtimeMs) {
+    for (const line of fs.readFileSync(file, "utf8").split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (typeof parsed.queued_at !== "string")
+                continue;
+            const ms = Date.parse(parsed.queued_at);
+            if (!Number.isNaN(ms))
+                return ms;
+        }
+        catch {
+            // A partial line is not a record; a later valid line still counts.
+        }
+    }
+    return mtimeMs;
+}
+/** When this company was last borrowed, or -Infinity when it never was. */
+function borrowedMs(hqRoot, slug) {
+    const file = path.join(companyStateDir(hqRoot, slug), QUEUED_TOUCHES_BORROWED_FILE);
+    let stat;
+    try {
+        stat = fs.lstatSync(file);
+    }
+    catch {
+        return Number.NEGATIVE_INFINITY;
+    }
+    if (!stat.isFile())
+        return Number.NEGATIVE_INFINITY;
+    const ms = Date.parse(fs.readFileSync(file, "utf8").trim());
+    return Number.isNaN(ms) ? Number.NEGATIVE_INFINITY : ms;
+}
+/**
+ * The manifest company whose queued touches have waited longest, or null.
+ * The order key is the later of the first queued record and the last borrow,
+ * so a company a company-less run just borrowed goes to the back. A run whose
+ * own payload names no company uses it for its ontology step.
+ */
+export function oldestQueuedCompany(hqRoot) {
+    let entries;
+    try {
+        entries = fs.readdirSync(ontologyStateBase(hqRoot));
+    }
+    catch {
+        return null;
+    }
+    let oldest = null;
+    for (const slug of entries.sort()) {
+        let stat;
+        try {
+            stat = fs.lstatSync(queuedTouchesPath(hqRoot, slug));
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile() || stat.size === 0)
+            continue;
+        if (!resolveOntologyCompany(hqRoot, slug).ok)
+            continue;
+        const key = Math.max(firstQueuedMs(queuedTouchesPath(hqRoot, slug), stat.mtimeMs), borrowedMs(hqRoot, slug));
+        if (!oldest || key < oldest.key)
+            oldest = { slug, key };
+    }
+    return oldest?.slug ?? null;
+}
+/**
+ * Take the company's queued touches by renaming the file into the run
+ * directory, then return the HQ-relative paths it lists. Renaming is atomic,
+ * so a touch recorded during the claim lands in a fresh file for a later run.
+ */
+export function claimQueuedTouches(hqRoot, company, runDir) {
+    const queuedPath = queuedTouchesPath(hqRoot, company.slug);
+    try {
+        assertSafeTarget(hqRoot, [companyStateDir(hqRoot, company.slug)], queuedPath);
+    }
+    catch (error) {
+        if (error instanceof WriteBoundsError)
+            return [];
+        throw error;
+    }
+    const claimPath = path.join(runDir, QUEUED_TOUCHES_CLAIM_FILE);
+    try {
+        fs.renameSync(queuedPath, claimPath);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const files = [];
+    for (const line of fs.readFileSync(claimPath, "utf8").split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (Array.isArray(parsed.files)) {
+                for (const file of parsed.files)
+                    if (typeof file === "string")
+                        files.push(file);
+            }
+        }
+        catch {
+            // A partial line must not drop the valid lines around it.
+        }
+    }
+    return files;
+}
+//# sourceMappingURL=queued-touches.js.map

package/dist/lib/checkpoint-ontology/tree.d.ts

@@ -36,6 +36,8 @@ export declare function indexAlias(index: EntityIndex, type: string, rel: string
  * type conflict, but they are never written.
  */
 export declare function buildEntityIndex(companyDir: string): EntityIndex;
+/** Entity path → number of other entity files whose body links to it. */
+export declare function countInboundLinks(companyDir: string, index: EntityIndex): Map<string, number>;
 export interface SignalRecord {
     /** Company-relative path, `signals/<type>/<file>.md`. */
     rel: string;

package/dist/lib/checkpoint-ontology/tree.js

@@ -90,6 +90,40 @@ export function buildEntityIndex(companyDir) {
     }
     return index;
 }
+// Spaces are allowed in the target, as merge-copies writes `../person/jane-doe 2.md`.
+const INBOUND_LINK = /\]\(([^)\n]+?\.md)(?:#[^)\n]*)?\)/g;
+/** Entity path → number of other entity files whose body links to it. */
+export function countInboundLinks(companyDir, index) {
+    const counts = new Map();
+    for (const rel of index.byRel.keys())
+        counts.set(rel, 0);
+    for (const rel of index.byRel.keys()) {
+        const parsed = parseEntityFile(fs.readFileSync(path.join(companyDir, rel), "utf8"));
+        if (!parsed)
+            continue;
+        const seen = new Set();
+        for (const match of parsed.body.matchAll(INBOUND_LINK)) {
+            const target = match[1];
+            if (target.startsWith("http:") || target.startsWith("https:") || target.startsWith("mailto:"))
+                continue;
+            let decoded = target;
+            try {
+                decoded = decodeURI(target);
+            }
+            catch (error) {
+                if (!(error instanceof URIError))
+                    throw error;
+            }
+            const resolved = path.posix.normalize(path.posix.join(path.posix.dirname(rel), decoded));
+            if (resolved === rel || !index.byRel.has(resolved))
+                continue;
+            seen.add(resolved);
+        }
+        for (const targetRel of seen)
+            counts.set(targetRel, (counts.get(targetRel) ?? 0) + 1);
+    }
+    return counts;
+}
 /** Parse the frontmatter of one company-audience signal file. */
 export function readSignal(companyDir, rel) {
     let content;

package/dist/lib/core-utils/jq-json-serializer.d.ts

@@ -0,0 +1,5 @@
+/** JSON output formats used by the scaffold scripts that previously called jq. */
+export type JqJsonOutput = "compact" | "raw" | "pretty";
+/** Serialize one jq result, including jq's output newline. */
+export declare function serializeJqJson(value: unknown, output?: JqJsonOutput): string;
+//# sourceMappingURL=jq-json-serializer.d.ts.map

package/dist/lib/core-utils/jq-json-serializer.js

@@ -0,0 +1,10 @@
+/** Serialize one jq result, including jq's output newline. */
+export function serializeJqJson(value, output = "pretty") {
+    if (output === "raw" && typeof value === "string")
+        return `${value}\n`;
+    const serialized = output === "compact"
+        ? JSON.stringify(value)
+        : JSON.stringify(value, null, 2);
+    return serialized === undefined ? "" : `${serialized.replace(/\u007f/g, "\\u007f")}\n`;
+}
+//# sourceMappingURL=jq-json-serializer.js.map

package/dist/lib/core-utils/secret-patterns.d.ts

@@ -0,0 +1,41 @@
+/** Shared secret detector patterns mirrored from the scaffold shell library. */
+export declare const SECRET_PATTERN_BOUNDARY = "(^|[^a-zA-Z0-9])";
+export declare const SECRET_PATTERNS: readonly [{
+    readonly pattern: "sk-[a-zA-Z0-9._-]{20,}";
+    readonly name: "OpenAI/Stripe key";
+}, {
+    readonly pattern: "ghp_[a-zA-Z0-9]{36,}";
+    readonly name: "GitHub PAT";
+}, {
+    readonly pattern: "AKIA[0-9A-Z]{16}";
+    readonly name: "AWS access key";
+}, {
+    readonly pattern: "xox[bpsa]-[a-zA-Z0-9-]+";
+    readonly name: "Slack token";
+}, {
+    readonly pattern: "Bearer [a-zA-Z0-9._-]{20,}";
+    readonly name: "Bearer token";
+}, {
+    readonly pattern: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----";
+    readonly name: "Private key";
+}, {
+    readonly pattern: "glpat-[a-zA-Z0-9_-]{20,}";
+    readonly name: "GitLab PAT";
+}, {
+    readonly pattern: "gho_[a-zA-Z0-9]{36,}";
+    readonly name: "GitHub OAuth token";
+}, {
+    readonly pattern: "github_pat_[a-zA-Z0-9_]{22,}";
+    readonly name: "Fine-grained GitHub PAT";
+}, {
+    readonly pattern: "eyJ[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{10,}";
+    readonly name: "JWT";
+}];
+/** Return the pattern names that match, in the shell library's declared order. */
+export declare function matchingSecretPatterns(value: string): string[];
+/** Print only pattern names and paths; never include matched file content. */
+export declare function scanSecretFiles(files: readonly string[]): {
+    code: 0 | 1;
+    hits: string[];
+};
+//# sourceMappingURL=secret-patterns.d.ts.map

package/dist/lib/core-utils/secret-patterns.js

@@ -0,0 +1,33 @@
+/** Shared secret detector patterns mirrored from the scaffold shell library. */
+import * as fs from "node:fs";
+export const SECRET_PATTERN_BOUNDARY = "(^|[^a-zA-Z0-9])";
+export const SECRET_PATTERNS = [
+    { pattern: "sk-[a-zA-Z0-9._-]{20,}", name: "OpenAI/Stripe key" },
+    { pattern: "ghp_[a-zA-Z0-9]{36,}", name: "GitHub PAT" },
+    { pattern: "AKIA[0-9A-Z]{16}", name: "AWS access key" },
+    { pattern: "xox[bpsa]-[a-zA-Z0-9-]+", name: "Slack token" },
+    { pattern: "Bearer [a-zA-Z0-9._-]{20,}", name: "Bearer token" },
+    { pattern: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----", name: "Private key" },
+    { pattern: "glpat-[a-zA-Z0-9_-]{20,}", name: "GitLab PAT" },
+    { pattern: "gho_[a-zA-Z0-9]{36,}", name: "GitHub OAuth token" },
+    { pattern: "github_pat_[a-zA-Z0-9_]{22,}", name: "Fine-grained GitHub PAT" },
+    { pattern: "eyJ[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{10,}", name: "JWT" },
+];
+/** Return the pattern names that match, in the shell library's declared order. */
+export function matchingSecretPatterns(value) {
+    return SECRET_PATTERNS.flatMap(({ pattern, name }) => new RegExp(`${SECRET_PATTERN_BOUNDARY}${pattern}`).test(value) ? [name] : []);
+}
+/** Print only pattern names and paths; never include matched file content. */
+export function scanSecretFiles(files) {
+    const hits = [];
+    for (const file of files) {
+        if (!fs.existsSync(file) || !fs.statSync(file).isFile())
+            continue;
+        const contents = fs.readFileSync(file, "utf8");
+        for (const name of matchingSecretPatterns(contents)) {
+            hits.push(`secret-scan: pattern '${name}' matched in ${file}`);
+        }
+    }
+    return { code: hits.length > 0 ? 1 : 0, hits };
+}
+//# sourceMappingURL=secret-patterns.js.map

package/dist/lib/core-utils/timeout-guard-native.d.ts

@@ -0,0 +1,7 @@
+/** Native fast-route adapter for the shared timeout-guard command. */
+import type { FlagReader } from "../flag-registry.js";
+import { type PersistedFlagSnapshot } from "../flag-snapshot-file.js";
+import { type TimeoutGuardDeps } from "./timeout-guard.js";
+export declare function createNativeSnapshotFlagReader(persistedSnapshot: PersistedFlagSnapshot | null, companyIdentifiers: readonly string[], env: NodeJS.ProcessEnv): FlagReader;
+export declare function runTimeoutGuardFast(_argv: readonly string[], stdin: string, _cwd: string, _hqRoot: string | undefined, dependencies?: TimeoutGuardDeps): Promise<number>;
+//# sourceMappingURL=timeout-guard-native.d.ts.map

package/dist/lib/core-utils/timeout-guard-native.js

@@ -0,0 +1,40 @@
+/** Native fast-route adapter for the shared timeout-guard command. */
+import { readLocalOverride, resolveFlag, } from "@indigoai-us/hq-flags-client";
+import { resolveProcessFlagCompanyContext } from "../process-flag-company-context.js";
+import { readFlagSnapshotFile, } from "../flag-snapshot-file.js";
+import { timeoutGuardCommand } from "./timeout-guard.js";
+export function createNativeSnapshotFlagReader(persistedSnapshot, companyIdentifiers, env) {
+    const snapshot = persistedSnapshot
+        ? { version: 0, flags: persistedSnapshot.flags }
+        : null;
+    return {
+        isEnabled(flagKey, lookup = {}) {
+            if (snapshot) {
+                return resolveFlag({
+                    flagKey,
+                    env,
+                    snapshot,
+                    companyIdentifiers,
+                    lookup,
+                }).value;
+            }
+            return readLocalOverride(flagKey, env) ?? (lookup.fallback ?? false);
+        },
+    };
+}
+function snapshotFlagReader(companyUid, companySlug, env) {
+    const persistedSnapshot = companyUid ? readFlagSnapshotFile(companyUid, { env }) : null;
+    const companyIdentifiers = [companyUid, companySlug].filter((value) => Boolean(value));
+    return createNativeSnapshotFlagReader(persistedSnapshot, companyIdentifiers, env);
+}
+export async function runTimeoutGuardFast(_argv, stdin, _cwd, _hqRoot, dependencies = {}) {
+    const env = dependencies.env ?? process.env;
+    const company = resolveProcessFlagCompanyContext(env);
+    const flagReader = dependencies.flagReader ?? snapshotFlagReader(company.companyUid, company.companySlug, env);
+    return timeoutGuardCommand(stdin, {
+        ...dependencies,
+        env,
+        flagReader,
+    });
+}
+//# sourceMappingURL=timeout-guard-native.js.map

package/dist/lib/core-utils/timeout-guard.d.ts

@@ -20,7 +20,7 @@
  *
  * Exit codes: 0 = allow, 2 = block.
  */
-import { type FlagReader } from "../flag-registry.js";
+import type { FlagReader } from "../flag-registry.js";
 /**
  * Worst-case inner deadline (seconds) declared in a command: a `timeout` /
  * `gtimeout` prefix (matched by executable BASENAME, so `/usr/bin/timeout`
@@ -55,11 +55,11 @@ export interface TimeoutGuardDeps {
     flagReader?: FlagReader;
 }
 /** Whether the guard is active for this identity (rollout gate). */
-export declare function isGatedUser(email: string | undefined, flagReader?: FlagReader): boolean;
+export declare function isGatedUser(email: string | undefined, flagReader?: FlagReader): Promise<boolean>;
 /**
  * Command entry: read the PreToolUse JSON, apply the gate + short-circuits, and
  * return the exit code (0 allow / 2 block). Never throws — a parse failure or a
  * missing identity fails OPEN (allow), because a hook must not break tool calls.
  */
-export declare function timeoutGuardCommand(stdin: string, deps?: TimeoutGuardDeps): number;
+export declare function timeoutGuardCommand(stdin: string, deps?: TimeoutGuardDeps): Promise<number>;
 //# sourceMappingURL=timeout-guard.d.ts.map