@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/core-utils/hook-timeout-debug-context-flag.js

@@ -1,81 +0,0 @@
-import { loadCachedTokens } from "@indigoai-us/hq-cloud";
-import { createFlagClient, } from "@indigoai-us/hq-flags-client";
-import { resolveProcessFlagCompanyContext } from "../flag-registry.js";
-import { resolveFlagRegistryEndpoint } from "../flag-registry-endpoint.js";
-export const HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG = "hook-timeout-debug-context";
-export const HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG_FALLBACK = false;
-export const HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG_TIMEOUT_MS = 150;
-function safeErrorClass(error) {
-    const name = error instanceof Error ? error.name : "UnknownError";
-    return /^[A-Za-z][A-Za-z0-9]{0,63}$/.test(name) ? name : "UnknownError";
-}
-function reportFlagFailure(error) {
-    process.stderr.write(`HQ hook timeout debug flag lookup failed (${safeErrorClass(error)}); using default off.\n`);
-}
-function combineSignals(first, second) {
-    return first ? AbortSignal.any([first, second]) : second;
-}
-/**
- * Read the optional diagnostic gate with a short, cancellable hq-flags request.
- * Missing identity/configuration and every client failure use the default-off
- * result so a flag outage cannot delay or suppress the underlying timeout.
- */
-export async function hookTimeoutDebugContextEnabled(dependencies = {}, callerSignal) {
-    const env = dependencies.env ?? process.env;
-    const endpoint = resolveFlagRegistryEndpoint(undefined, env);
-    const { companyUid, companySlug } = resolveProcessFlagCompanyContext(env);
-    if (!companyUid) {
-        return HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG_FALLBACK;
-    }
-    const deadline = AbortSignal.timeout(HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG_TIMEOUT_MS);
-    const signal = callerSignal ? AbortSignal.any([callerSignal, deadline]) : deadline;
-    const doFetch = dependencies.fetch ?? globalThis.fetch;
-    let client;
-    let failed = false;
-    let failureReported = false;
-    let enabled = HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG_FALLBACK;
-    const reportFailureOnce = (error) => {
-        failed = true;
-        if (failureReported)
-            return;
-        failureReported = true;
-        (dependencies.reportFailure ?? reportFlagFailure)(error);
-    };
-    try {
-        client = (dependencies.createClient ?? createFlagClient)({
-            endpoint,
-            companyUid,
-            ...(companySlug && /^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(companySlug)
-                ? { companyIdentifiers: [companySlug] }
-                : {}),
-            env: {},
-            getToken: dependencies.getToken ?? (() => loadCachedTokens()?.idToken ?? ""),
-            fetch: (input, init) => doFetch(input, {
-                ...init,
-                signal: combineSignals(init?.signal ?? undefined, signal),
-            }),
-            refreshIntervalMs: 0,
-            requestTimeoutMs: HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG_TIMEOUT_MS,
-            onError: reportFailureOnce,
-        });
-        await client.ready();
-        if (!failed && !signal.aborted) {
-            enabled = client.isEnabled(HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG, {
-                fallback: HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG_FALLBACK,
-            });
-        }
-    }
-    catch (error) {
-        reportFailureOnce(error);
-    }
-    finally {
-        try {
-            client?.close();
-        }
-        catch (error) {
-            reportFailureOnce(error);
-        }
-    }
-    return failed || signal.aborted ? HOOK_TIMEOUT_DEBUG_CONTEXT_FLAG_FALLBACK : enabled;
-}
-//# sourceMappingURL=hook-timeout-debug-context-flag.js.map

package/dist/lib/core-utils/jq-json-serializer.d.ts

@@ -1,5 +0,0 @@
-/** JSON output formats used by the scaffold scripts that previously called jq. */
-export type JqJsonOutput = "compact" | "raw" | "pretty";
-/** Serialize one jq result, including jq's output newline. */
-export declare function serializeJqJson(value: unknown, output?: JqJsonOutput): string;
-//# sourceMappingURL=jq-json-serializer.d.ts.map

package/dist/lib/core-utils/jq-json-serializer.js

@@ -1,10 +0,0 @@
-/** Serialize one jq result, including jq's output newline. */
-export function serializeJqJson(value, output = "pretty") {
-    if (output === "raw" && typeof value === "string")
-        return `${value}\n`;
-    const serialized = output === "compact"
-        ? JSON.stringify(value)
-        : JSON.stringify(value, null, 2);
-    return serialized === undefined ? "" : `${serialized.replace(/\u007f/g, "\\u007f")}\n`;
-}
-//# sourceMappingURL=jq-json-serializer.js.map

package/dist/lib/core-utils/secret-patterns.d.ts

@@ -1,43 +0,0 @@
-/** Shared secret detector patterns mirrored from the scaffold shell library. */
-export declare const SECRET_PATTERN_BOUNDARY = "(^|[^a-zA-Z0-9])";
-export declare const SECRET_PATTERNS: readonly [{
-    readonly pattern: "sk-[a-zA-Z0-9._-]{20,}";
-    readonly name: "OpenAI/Stripe key";
-}, {
-    readonly pattern: "ghp_[a-zA-Z0-9]{36,}";
-    readonly name: "GitHub PAT";
-}, {
-    readonly pattern: "AKIA[0-9A-Z]{16}";
-    readonly name: "AWS access key";
-}, {
-    readonly pattern: "xox[bpsa]-[a-zA-Z0-9-]+";
-    readonly name: "Slack token";
-}, {
-    readonly pattern: "Bearer [a-zA-Z0-9._-]{20,}";
-    readonly name: "Bearer token";
-}, {
-    readonly pattern: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----";
-    readonly name: "Private key";
-}, {
-    readonly pattern: "glpat-[a-zA-Z0-9_-]{20,}";
-    readonly name: "GitLab PAT";
-}, {
-    readonly pattern: "gho_[a-zA-Z0-9]{36,}";
-    readonly name: "GitHub OAuth token";
-}, {
-    readonly pattern: "github_pat_[a-zA-Z0-9_]{22,}";
-    readonly name: "Fine-grained GitHub PAT";
-}, {
-    readonly pattern: "eyJ[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{10,}";
-    readonly name: "JWT";
-}];
-/** Return the pattern names that match, in the shell library's declared order. */
-export declare function matchingSecretPatterns(value: string, options?: {
-    requireBoundary?: boolean;
-}): string[];
-/** Print only pattern names and paths; never include matched file content. */
-export declare function scanSecretFiles(files: readonly string[]): {
-    code: 0 | 1;
-    hits: string[];
-};
-//# sourceMappingURL=secret-patterns.d.ts.map

package/dist/lib/core-utils/secret-patterns.js

@@ -1,34 +0,0 @@
-/** Shared secret detector patterns mirrored from the scaffold shell library. */
-import * as fs from "node:fs";
-export const SECRET_PATTERN_BOUNDARY = "(^|[^a-zA-Z0-9])";
-export const SECRET_PATTERNS = [
-    { pattern: "sk-[a-zA-Z0-9._-]{20,}", name: "OpenAI/Stripe key" },
-    { pattern: "ghp_[a-zA-Z0-9]{36,}", name: "GitHub PAT" },
-    { pattern: "AKIA[0-9A-Z]{16}", name: "AWS access key" },
-    { pattern: "xox[bpsa]-[a-zA-Z0-9-]+", name: "Slack token" },
-    { pattern: "Bearer [a-zA-Z0-9._-]{20,}", name: "Bearer token" },
-    { pattern: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----", name: "Private key" },
-    { pattern: "glpat-[a-zA-Z0-9_-]{20,}", name: "GitLab PAT" },
-    { pattern: "gho_[a-zA-Z0-9]{36,}", name: "GitHub OAuth token" },
-    { pattern: "github_pat_[a-zA-Z0-9_]{22,}", name: "Fine-grained GitHub PAT" },
-    { pattern: "eyJ[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{10,}", name: "JWT" },
-];
-/** Return the pattern names that match, in the shell library's declared order. */
-export function matchingSecretPatterns(value, options = {}) {
-    const boundary = options.requireBoundary === false ? "" : SECRET_PATTERN_BOUNDARY;
-    return SECRET_PATTERNS.flatMap(({ pattern, name }) => new RegExp(`${boundary}${pattern}`).test(value) ? [name] : []);
-}
-/** Print only pattern names and paths; never include matched file content. */
-export function scanSecretFiles(files) {
-    const hits = [];
-    for (const file of files) {
-        if (!fs.existsSync(file) || !fs.statSync(file).isFile())
-            continue;
-        const contents = fs.readFileSync(file, "utf8");
-        for (const name of matchingSecretPatterns(contents)) {
-            hits.push(`secret-scan: pattern '${name}' matched in ${file}`);
-        }
-    }
-    return { code: hits.length > 0 ? 1 : 0, hits };
-}
-//# sourceMappingURL=secret-patterns.js.map

package/dist/lib/core-utils/sentry-report.d.ts

@@ -1,114 +0,0 @@
-/**
- * `hq core sentry report` — constrained diagnostic transport for HQ hooks.
- *
- * The stdin event schema is deliberately closed. Hook payloads can contain
- * commands, prompts, source content, transcript locations, and credentials, so
- * this module accepts only a small set of scalar diagnostics plus bounded hook
- * history and never reads a hook payload or the process environment. The
- * owner-approved `hook_path`
- * diagnostic is the narrow exception: it names the slow hook script and may
- * include its company directory, but never carries the hook payload itself.
- *
- * Invalid top-level input and structurally rich metadata are rejected. The
- * bounded hook sequence is the deliberate exception: it keeps only the most
- * recent entries so diagnostics cannot expand the transport payload. Unknown
- * scalar metadata is dropped instead: the allowlist, not a caller version
- * match, determines what may leave the machine.
- */
-import * as Sentry from "@sentry/node";
-import type { CaptureContext, SeverityLevel } from "@sentry/node";
-export declare const DEFAULT_SENTRY_REPORT_TIMEOUT_MS = 750;
-export declare const MAX_SENTRY_REPORT_PAYLOAD_BYTES = 2048;
-export declare const MAX_SENTRY_REPORT_METADATA_VALUE_BYTES = 256;
-/**
- * The only hook diagnostics that can be attached as metadata. The list omits
- * command text, prompts, payloads, company names, and repositories. `hook_path`
- * is owner-approved telemetry for the exact hook script and may include a
- * company directory; it is never a substitute for hook input or a transcript.
- */
-export declare const ALLOWED_SENTRY_REPORT_METADATA_KEYS: readonly ["hook_name", "hook_path", "hook_event", "hook_script", "tool_name", "session_id", "declared_timeout_ms", "elapsed_ms", "remaining_ms", "watchdog_timeout_ms", "hook_timeout_ms", "hq_version", "platform", "load_average", "spawn_ms", "slow_child", "slow_child_ms", "exit_code", "final_elapsed_ms", "bash_env_set", "cwd_kind", "shell", "nproc", "hook_sequence", "hook_timeout_debug_context"];
-export declare const MAX_SENTRY_REPORT_METADATA_KEYS: number;
-export type HookSequenceEntry = {
-    script: string;
-    event: string;
-    ms: number;
-};
-type HookTimeoutDebugPhaseTiming = {
-    phase: string;
-    elapsed_ms: number;
-};
-type HookTimeoutDebugContext = {
-    hook_name: string;
-    hook_event: string;
-    budget_ms: number;
-    elapsed_ms: number;
-    remaining_ms: number;
-    phase_timings: HookTimeoutDebugPhaseTiming[];
-    wait_point: string;
-    waiting_child_basename: string;
-    waiting_child_elapsed_ms: number;
-    load_average?: number | "unavailable";
-    spawn_ms?: number | "unavailable";
-    process_count?: number | "unavailable";
-};
-type SentryReportMetadataValue = string | number | boolean | HookSequenceEntry[] | HookTimeoutDebugContext;
-export type SentryReportMetadata = Record<string, SentryReportMetadataValue>;
-type SentryReportEvent = {
-    type: string;
-    message: string;
-    fingerprint: string;
-    level: SeverityLevel;
-    metadata: SentryReportMetadata;
-};
-export type SentryReportOptions = {
-    dryRun?: boolean;
-    /** Total time reserved for the report flush after validation. */
-    timeoutMs?: number;
-    /** Explicit live HQ root supplied by `hq core --hq-root`. */
-    hqRoot?: string;
-    /** Test seam for the bounded timeout-report stamp store. */
-    rateLimitDirectory?: string;
-    /** Test seam for deterministic rate-limit windows. */
-    rateLimitNow?: () => number;
-    /** Optional caller cancellation forwarded to the bounded flag lookup. */
-    signal?: AbortSignal;
-};
-export type SentryReportDependencies = {
-    sentry: {
-        captureMessage: (message: string, context?: CaptureContext | SeverityLevel) => string;
-        addBreadcrumb: (breadcrumb: Parameters<typeof Sentry.addBreadcrumb>[0]) => void;
-        metrics: Pick<typeof Sentry.metrics, "count">;
-        flush: (timeout?: number) => PromiseLike<boolean>;
-    };
-    stdout: Pick<NodeJS.WriteStream, "write">;
-    stderr: Pick<NodeJS.WriteStream, "write">;
-    /** Test seam; production resolves the live HQ workspace tmp directory. */
-    rateLimitDirectory?: string;
-    /** Test seam; production uses Date.now. */
-    rateLimitNow?: () => number;
-    /** Test seam for the company-scoped, bounded debug-context gate. */
-    timeoutDebugContextEnabled?: (signal?: AbortSignal) => Promise<boolean>;
-};
-export type SentryReportResult = {
-    code: 0 | 1;
-    event?: SentryReportEvent;
-    droppedMetadataKeys?: number;
-};
-/**
- * Read no more than the accepted event size. Returning early keeps a malformed
- * pipe from making a watchdog retain an unbounded hook payload in memory.
- */
-export declare function readSentryReportStdin(stdin: AsyncIterable<Buffer | string>): Promise<string | null>;
-/** Unknown metadata is ignored before this cap is evaluated. */
-export declare function exceedsSentryReportMetadataKeyCap(keys: Iterable<string>): boolean;
-/**
- * Capture one validated Sentry message and wait only for the supplied bounded
- * flush budget. A zero result means the event entered the local transport and
- * its queue drained in time, not that ingest accepted it. Normal reports are
- * silent on stdout; dry-runs print the same scrubbed event projection used by
- * the live path. All failures use a generic stderr line so malformed input and
- * transport errors cannot echo event data back to a hook.
- */
-export declare function reportSentryEvent(stdin: string, options?: SentryReportOptions, dependencies?: SentryReportDependencies): Promise<SentryReportResult>;
-export {};
-//# sourceMappingURL=sentry-report.d.ts.map