@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/lanes/story-switch.d.ts

@@ -1,21 +0,0 @@
-import type { AttributionHistoryEntry, LaneEnvelope, LaneRecord, StorySwitchUnacknowledgedNote } from "./types.js";
-export declare function storySwitchNotice(previousProjectId: string, previousStoryId: string, projectId: string, storyId: string): string | undefined;
-export declare function artifactIdentityKeys(artifacts: readonly unknown[] | undefined): string[];
-export interface StorySwitchRollbackSnapshot {
-    message_id: string;
-    project_id: string;
-    story_id: string;
-    no_story_reason?: string;
-    added_story?: NonNullable<LaneRecord["stories"]>[number];
-    story_switch_unacknowledged: StorySwitchUnacknowledgedNote | undefined;
-}
-/** Restore only the attribution write owned by this failed command attempt. */
-export declare function rollbackStorySwitchAttribution(current: LaneRecord, snapshot: StorySwitchRollbackSnapshot): LaneRecord;
-/** Apply and consume one attribution-switch marker when the next envelope arrives. */
-export declare function applyStorySwitchEnvelope(lane: LaneRecord, envelope: LaneEnvelope, at: string, envelopeRef: string): {
-    suppressCompletion: boolean;
-    clearPending: boolean;
-    storySwitchUnacknowledged?: StorySwitchUnacknowledgedNote;
-    attributionHistory?: AttributionHistoryEntry[];
-};
-//# sourceMappingURL=story-switch.d.ts.map

package/dist/lib/lanes/story-switch.js

@@ -1,75 +0,0 @@
-export function storySwitchNotice(previousProjectId, previousStoryId, projectId, storyId) {
-    if (previousProjectId === projectId && previousStoryId === storyId)
-        return undefined;
-    const from = `${previousProjectId}/${previousStoryId || "(no story)"}`;
-    const to = `${projectId}/${storyId || "(no story)"}`;
-    return `Story changed: ${from} -> ${to}. The previous story is closed; report only on the new story in this turn's envelope.`;
-}
-export function artifactIdentityKeys(artifacts) {
-    if (!Array.isArray(artifacts))
-        return [];
-    return artifacts.flatMap((artifact) => {
-        if (typeof artifact === "string" && artifact.trim())
-            return [`value:${artifact.trim()}`];
-        if (artifact === null || typeof artifact !== "object" || Array.isArray(artifact))
-            return [];
-        const record = artifact;
-        const url = typeof record.url === "string" ? record.url.trim() : "";
-        const path = typeof record.path === "string" ? record.path.trim() : "";
-        const values = [url && `url:${url}`, path && `path:${path}`].filter((value) => Boolean(value));
-        return values;
-    }).sort();
-}
-/** Restore only the attribution write owned by this failed command attempt. */
-export function rollbackStorySwitchAttribution(current, snapshot) {
-    if (current.story_switch_pending?.message_id !== snapshot.message_id)
-        return current;
-    const addedStory = snapshot.added_story;
-    const stories = (current.stories ?? []).filter((story) => !(addedStory && story.project_id === addedStory.project_id && story.story_id === addedStory.story_id &&
-        story.added_at === addedStory.added_at));
-    return {
-        ...current,
-        project_id: snapshot.project_id,
-        story_id: snapshot.story_id,
-        no_story_reason: snapshot.no_story_reason,
-        stories,
-        attribution_history: current.attribution_history.filter((entry) => entry.message_id !== snapshot.message_id),
-        story_switch_pending: undefined,
-        story_switch_unacknowledged: snapshot.story_switch_unacknowledged,
-    };
-}
-function sameKeys(left, right) {
-    return left.length > 0 && left.length === right.length && left.every((key, index) => key === right[index]);
-}
-/** Apply and consume one attribution-switch marker when the next envelope arrives. */
-export function applyStorySwitchEnvelope(lane, envelope, at, envelopeRef) {
-    const pending = lane.story_switch_pending;
-    if (!pending)
-        return { suppressCompletion: false, clearPending: false };
-    if (envelope.story_complete !== true)
-        return { suppressCompletion: false, clearPending: false };
-    const currentKeys = artifactIdentityKeys(envelope.artifacts);
-    const suppressCompletion = sameKeys(pending.previous_artifact_keys, currentKeys);
-    if (!suppressCompletion)
-        return { suppressCompletion: false, clearPending: true };
-    const note = {
-        event: "story_switch_unacknowledged",
-        previous_project_id: pending.previous_project_id,
-        previous_story_id: pending.previous_story_id,
-        project_id: pending.project_id,
-        story_id: pending.story_id,
-        message_id: pending.message_id,
-        envelope_ref: envelopeRef,
-        at,
-        artifact_keys: currentKeys,
-    };
-    return {
-        suppressCompletion: true,
-        clearPending: true,
-        storySwitchUnacknowledged: note,
-        attributionHistory: lane.attribution_history.map((entry) => entry.message_id === pending.message_id
-            ? { ...entry, story_switch_unacknowledged: note }
-            : entry),
-    };
-}
-//# sourceMappingURL=story-switch.js.map

package/dist/lib/lanes/text-scan.d.ts

@@ -1,11 +0,0 @@
-/** Secret-like values already redacted from lane report summaries. */
-export declare const SECRET_RE: RegExp;
-/** Paths that should not be copied into a report or tracker record. */
-export declare const SECRETS_PATH_RE: RegExp;
-/** Return only the category of a match; never expose matched text to callers. */
-export declare function findSecretText(text: string): {
-    kind: string;
-} | null;
-/** Refuse free text containing credentials without copying the matched value into the error. */
-export declare function assertNoSecretText(field: string, text: string): void;
-//# sourceMappingURL=text-scan.d.ts.map

package/dist/lib/lanes/text-scan.js

@@ -1,103 +0,0 @@
-import { LanesError } from "./errors.js";
-/** Secret-like values already redacted from lane report summaries. */
-export const SECRET_RE = /(?:Bearer\s+[A-Za-z0-9._\-+=/]+)|(?:sk-[A-Za-z0-9]{8,})|(?:ghp_[A-Za-z0-9]{8,})|(?:github_pat_[A-Za-z0-9_]{8,})|(?:xox[baprs]-[A-Za-z0-9-]{8,})|(?:AKIA[0-9A-Z]{8,})|(?:op:\/\/[^\s"]+)/gi;
-/** Paths that should not be copied into a report or tracker record. */
-export const SECRETS_PATH_RE = /(?:^|[\s"'`])((?:~|\/|\.\/|\.\.\/)?(?:[\w.-]+\/)*(?:\.env(?:\.[A-Za-z0-9._-]+)?|secrets(?:\/[\w.-]+)*|id_rsa|credentials(?:\.json)?|\.netrc|\.npmrc))/gi;
-const TOKEN_SHAPED_SECRET_PATTERNS = [
-    // Keep the report-summary short-token thresholds, but require a true left boundary.
-    {
-        kind: "stripe_api_key",
-        pattern: /(?:^|[^a-zA-Z0-9_-])(?:sk|rk)_(?:live|test)_[a-zA-Z0-9]{16,}/i,
-    },
-    { kind: "api_key", pattern: /(?:^|[^a-zA-Z0-9_-])sk-[a-zA-Z0-9._-]{8,}/i },
-    { kind: "github_pat", pattern: /(?:^|[^a-zA-Z0-9_-])ghp_[a-zA-Z0-9]{8,}/i },
-    {
-        kind: "fine_grained_github_pat",
-        pattern: /(?:^|[^a-zA-Z0-9_-])github_pat_[a-zA-Z0-9_]{8,}/i,
-    },
-    { kind: "slack_token", pattern: /(?:^|[^a-zA-Z0-9_-])xox[baprs]-[a-zA-Z0-9-]{8,}/i },
-    { kind: "aws_access_key", pattern: /(?:^|[^a-zA-Z0-9_-])AKIA[0-9A-Z]{8,}/i },
-    { kind: "onepassword_reference", pattern: /(?:^|[^a-zA-Z0-9_-])op:\/\/[^\s"]+/i },
-    // The hook's Bearer rule requires a token-shaped value of at least 20 characters.
-    { kind: "bearer_token", pattern: /(?:^|[^a-zA-Z0-9_-])Bearer\s+[a-zA-Z0-9._-]{20,}/i },
-    {
-        kind: "private_key",
-        pattern: /(?:^|[^a-zA-Z0-9_-])-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,
-    },
-    { kind: "gitlab_pat", pattern: /(?:^|[^a-zA-Z0-9_-])glpat-[a-zA-Z0-9_-]{20,}/ },
-    { kind: "github_oauth_token", pattern: /(?:^|[^a-zA-Z0-9_-])gho_[a-zA-Z0-9]{36,}/ },
-    {
-        kind: "fine_grained_github_pat",
-        pattern: /(?:^|[^a-zA-Z0-9_-])github_pat_[a-zA-Z0-9_]{22,}/,
-    },
-];
-const SENSITIVE_URL_PARAMETER_NAMES = new Set([
-    "code",
-    "token",
-    "otp",
-    "magic",
-    "auth",
-    "session",
-    "signature",
-]);
-const URL_RE = /\b[A-Za-z][A-Za-z0-9+.-]*:\/\/[^\s<>"'`]+/g;
-const ONE_TIME_CODE_RE = /\b(?:(?:one[- ]time|verification|login|sign[- ]in|security|auth)\s+code|otp)\b\s*(?:(?:is|:|=)\s*)?(?:\d{4,8}|\d{3,4}[- ]\d{3,4})\b|\bcode(?:\s*:\s*|\s+is\s+)(?:\d{6}|\d{3,4}[- ]\d{3,4})\b/i;
-function hasSensitiveUrlParameter(urlText) {
-    let url;
-    try {
-        url = new URL(urlText);
-    }
-    catch {
-        return false;
-    }
-    const queryParts = [url.search.slice(1)];
-    const fragment = url.hash.slice(1);
-    if (fragment) {
-        const queryStart = fragment.indexOf("?");
-        queryParts.push(queryStart >= 0 ? fragment.slice(queryStart + 1) : fragment);
-    }
-    for (const part of queryParts) {
-        for (const [name, value] of new URLSearchParams(part)) {
-            const normalizedName = name
-                .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
-                .toLowerCase();
-            const hasSensitiveName = SENSITIVE_URL_PARAMETER_NAMES.has(normalizedName) ||
-                /(?:^|[_-])(?:code|token|otp|magic|auth|session|signature)(?:$|[_-])/.test(normalizedName);
-            if (hasSensitiveName &&
-                value.trim().length > 0) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-/** Return only the category of a match; never expose matched text to callers. */
-export function findSecretText(text) {
-    const secretPathPattern = new RegExp(SECRETS_PATH_RE.source, "gi");
-    const pathScanText = text.replace(/(^|[\s"'`])~\//g, "$1./");
-    for (const pathMatch of pathScanText.matchAll(secretPathPattern)) {
-        const candidate = pathMatch[1] ?? "";
-        if (candidate.startsWith("~") || candidate.includes("/")) {
-            return { kind: "secrets_path" };
-        }
-    }
-    for (const candidate of TOKEN_SHAPED_SECRET_PATTERNS) {
-        if (candidate.pattern.test(text))
-            return { kind: candidate.kind };
-    }
-    for (const match of text.matchAll(URL_RE)) {
-        if (hasSensitiveUrlParameter(match[0]))
-            return { kind: "sign_in_link" };
-    }
-    if (ONE_TIME_CODE_RE.test(text))
-        return { kind: "one_time_code" };
-    return null;
-}
-/** Refuse free text containing credentials without copying the matched value into the error. */
-export function assertNoSecretText(field, text) {
-    const match = findSecretText(text);
-    if (!match)
-        return;
-    throw new LanesError("secret_text_refused", `Sensitive text refused for ${field} (${match.kind})`, { field, kind: match.kind });
-}
-//# sourceMappingURL=text-scan.js.map

package/dist/lib/lanes/throttle.d.ts

@@ -1,116 +0,0 @@
-/**
- * CPU busy-fraction and memory admission gate (spec §5).
- *
- * Algorithm is the workflow-runner sampler (two os.cpus() readings
- * CPU_SAMPLE_MS apart, 1 - idleDelta/totalDelta, clamped 0..1). The sampler
- * is reimplemented here because hq-cli cannot import core/scripts and the
- * shared @indigoai-us/hq-cloud export listed in spec §13 does not exist yet.
- *
- * Overrides HQ_LANES_CPU_BUSY_OVERRIDE and HQ_LANES_CPU_CHECK are deliberately
- * distinct from the runner's HQ_WORKFLOW_* pair — this module never reads those.
- */
-import * as fs from "node:fs";
-import * as os from "node:os";
-import type { ThrottleConfig } from "./types.js";
-export declare const CPU_SAMPLE_MS = 5000;
-export declare const CPU_CUMULATIVE_MAX_AGE_MS: number;
-export declare const STARVATION_MAX_DEFERRALS = 10;
-export declare const STARVATION_MAX_MS: number;
-export declare const PROC_MEMINFO = "/proc/meminfo";
-export declare const LANES_CPU_BUSY_OVERRIDE = "HQ_LANES_CPU_BUSY_OVERRIDE";
-export declare const LANES_CPU_CHECK = "HQ_LANES_CPU_CHECK";
-export interface CpuTimes {
-    idle: number;
-    total: number;
-}
-export interface ThrottleDeps {
-    env: NodeJS.ProcessEnv;
-    now: () => number;
-    cpus: () => os.CpuInfo[];
-    sleep: (ms: number) => Promise<void>;
-    readFileSync: (file: string, encoding: "utf8") => string;
-    /**
-     * Fallback only where MemAvailable is absent from /proc/meminfo (or the
-     * file itself is missing). Do not use this as the Linux primary reading.
-     */
-    freemem: () => number;
-    existsSync: (file: string) => boolean;
-    mkdirSync: typeof fs.mkdirSync;
-    writeFileSync: typeof fs.writeFileSync;
-    renameSync: typeof fs.renameSync;
-    unlinkSync: typeof fs.unlinkSync;
-}
-export type CpuBusySource = "interval" | "window" | "override";
-export interface CpuCumulativeSnapshot {
-    idle: number;
-    total: number;
-    sampled_at: string;
-}
-export interface CpuBusyObservation {
-    busy: number | null;
-    source: CpuBusySource | undefined;
-    snapshot: CpuCumulativeSnapshot | undefined;
-}
-export declare function defaultThrottleDeps(env?: NodeJS.ProcessEnv): ThrottleDeps;
-export declare function cpuTimesSnapshot(cpus: os.CpuInfo[]): CpuTimes;
-export declare function busyFractionFromDeltas(before: CpuTimes, after: CpuTimes): number | null;
-export declare function sampleCpuBusyFraction(deps?: ThrottleDeps, sampleMs?: number): Promise<number | null>;
-export declare function isCpuCheckEnabled(env?: NodeJS.ProcessEnv): boolean;
-export declare function resolveCpuBusyFraction(deps?: ThrottleDeps): Promise<number | null>;
-/**
- * Measure CPU busy against the previous reconcile snapshot when it is fresh.
- * A short stable window is used only to establish a baseline or recover from
- * stale/backwards counters (for example, after a reboot).
- */
-export declare function sampleCpuBusyObservation(deps: ThrottleDeps, previous: CpuCumulativeSnapshot | undefined, options?: {
-    measureBusy?: boolean;
-}): Promise<CpuBusyObservation>;
-export declare function recordCpuBusyObservation(state: ThrottleState, observation: CpuBusyObservation, options?: {
-    advanceSnapshot?: boolean;
-}): ThrottleState;
-/** Parse MemAvailable kB from /proc/meminfo. */
-export declare function parseMemAvailableKb(contents: string): number | null;
-/**
- * Available memory in MiB. Prefers kernel MemAvailable; falls back to
- * os.freemem() only where MemAvailable is absent.
- */
-export declare function readAvailableMemMb(deps?: ThrottleDeps): number | null;
-export interface ThrottleState {
-    consecutiveDeferrals: number;
-    lastAdmissionAt: string | null;
-    cpuPaused: boolean;
-    cpu_snapshot?: CpuCumulativeSnapshot;
-    last_busy?: number | null;
-    busy_source?: CpuBusySource;
-    sampled_at?: string;
-}
-export type ThrottleAdmitReason = "ok" | "starvation_bound" | "unreadable" | "cpu_check_disabled";
-export type ThrottleDeferReason = "cpu" | "memory";
-export type ThrottleDecision = {
-    admit: true;
-    reason: ThrottleAdmitReason;
-} | {
-    admit: false;
-    reason: ThrottleDeferReason;
-    busy?: number;
-    availableMemMb?: number;
-};
-export declare function emptyThrottleState(): ThrottleState;
-export declare function starvationBoundReached(state: ThrottleState, nowMs: number): boolean;
-export declare function evaluateThrottle(input: {
-    busy: number | null;
-    availableMemMb: number | null;
-    cpuCheckEnabled: boolean;
-    state: ThrottleState | "unreadable";
-    throttle: ThrottleConfig;
-    nowMs: number;
-}): ThrottleDecision;
-export declare function applyThrottleDecision(state: ThrottleState, decision: ThrottleDecision, nowMs: number): ThrottleState;
-export declare function throttleStatePath(hqRoot: string): string;
-export declare function readThrottleState(filePath: string, deps?: ThrottleDeps): ThrottleState | "unreadable" | "missing";
-export declare function writeThrottleState(filePath: string, state: ThrottleState, deps?: ThrottleDeps): void;
-export declare function decideAdmission(hqRoot: string, throttle?: ThrottleConfig, deps?: ThrottleDeps, cpuBusyFraction?: number | null, cpuObservation?: CpuBusyObservation): Promise<{
-    decision: ThrottleDecision;
-    state: ThrottleState;
-}>;
-//# sourceMappingURL=throttle.d.ts.map