@indigoai-us/hq-cli 5.345.155 → 5.345.159

package/dist/lib/secret-scan/repo-config.js

@@ -0,0 +1,237 @@
+/**
+ * Repo-level allowlists: `[[allowlists]]` (and the legacy `[allowlist]`) from
+ * the scanned repo's own `.gitleaks.toml`, with gitleaks semantics for
+ * `paths`, `regexes`, `regexTarget`, `stopwords`, `commits`, `targetRules` and
+ * `condition`. They apply on top of the built-in rules and allowlists, to that
+ * repo only. Repo `[[rules]]`, `[extend]` and the rest of the file are ignored:
+ * a repo can allow known false positives, not change what is detected.
+ *
+ * The file is read from git, never the working tree:
+ *   - The staged (index) copy applies only when it is identical to the copy
+ *     already committed at HEAD (or at MERGE_HEAD during a merge). A commit
+ *     that changes the allowlist is scanned with the HEAD allowlist, so
+ *     widening the allowlist and adding the secret cannot happen in one commit.
+ *   - A changed staged copy is still validated, so a broken file fails now.
+ *   - A symlinked .gitleaks.toml is rejected.
+ *
+ * Narrow by construction: every allowlist needs `paths`, each anchored with a
+ * literal prefix (`^golden/...`); `regexes` and `stopwords` need
+ * `condition = "AND"`, so they never reach files outside those paths.
+ *
+ * Fails closed: anything not acceptable is a ScanConfigError, and the scan
+ * exits 2 rather than running with a guess.
+ */
+import { execFileSync } from "node:child_process";
+import { parse } from "smol-toml";
+import { compileGoRegex } from "./go-regex.js";
+import { compileAllowlist } from "./rules.js";
+export class ScanConfigError extends Error {
+}
+export const REPO_CONFIG_FILE = ".gitleaks.toml";
+const KEYS = new Set(["description", "condition", "regexTarget", "paths", "regexes", "stopwords", "commits", "targetRules"]);
+const MIN_PATH_PREFIX = 3;
+const MIN_STOPWORD = 3;
+/** User regexes run on JavaScript's backtracking engine, not RE2. */
+const MAX_REGEX_LENGTH = 256;
+/** A quantified group that itself contains a quantifier, e.g. (a+)+ or (?:x*y)*. */
+const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[*+}](?:[^()\\]|\\.)*\)[*+{]/;
+/** Paths no real allowlist path should match all of. */
+const PROBE_PATHS = ["a", ".env", "src/index.ts", "config/credentials.yml", "deep/nested/dir/file.json"];
+function fail(file, where, msg) {
+    throw new ScanConfigError(`${file}: ${where}: ${msg}`);
+}
+function stringList(file, where, key, v) {
+    if (v === undefined)
+        return undefined;
+    if (!Array.isArray(v) || v.some((x) => typeof x !== "string"))
+        fail(file, where, `${key} must be a list of strings`);
+    return v;
+}
+/**
+ * Length of the literal text right after a leading `^`: letters, digits,
+ * `/ _ - @ ~` and backslash-escaped punctuation. A quantifier on the last
+ * literal makes it optional, so it does not count.
+ */
+export function literalPathPrefix(src) {
+    if (!src.startsWith("^"))
+        return 0;
+    let n = 0;
+    let i = 1;
+    while (i < src.length) {
+        const ch = src[i];
+        if (/[A-Za-z0-9/_\-@~]/.test(ch)) {
+            n++;
+            i++;
+        }
+        else if (ch === "\\" && i + 1 < src.length && /[^A-Za-z0-9]/.test(src[i + 1])) {
+            n++;
+            i += 2;
+        }
+        else {
+            break;
+        }
+    }
+    if (n > 0 && /^[*?{]/.test(src.slice(i)))
+        n--;
+    return n;
+}
+/** True when `src` has a `|` outside any group, which would bypass the `^` prefix. */
+function topLevelAlternation(src) {
+    let depth = 0;
+    let inClass = false;
+    for (let i = 0; i < src.length; i++) {
+        const ch = src[i];
+        if (ch === "\\")
+            i++;
+        else if (inClass)
+            inClass = ch !== "]";
+        else if (ch === "[")
+            inClass = true;
+        else if (ch === "(")
+            depth++;
+        else if (ch === ")")
+            depth--;
+        else if (ch === "|" && depth === 0)
+            return true;
+    }
+    return false;
+}
+function compileChecked(file, where, key, src) {
+    if (src.length > MAX_REGEX_LENGTH)
+        fail(file, where, `${key} entry is longer than ${MAX_REGEX_LENGTH} characters`);
+    if (NESTED_QUANTIFIER.test(src))
+        fail(file, where, `${key} entry ${JSON.stringify(src)} has a nested quantifier; simplify it`);
+    try {
+        return compileGoRegex(src);
+    }
+    catch (err) {
+        fail(file, where, `${key} entry ${JSON.stringify(src)} is not a supported regex (${err instanceof Error ? err.message : String(err)})`);
+    }
+}
+function validate(file, where, raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        fail(file, where, "must be a table");
+    const t = raw;
+    for (const k of Object.keys(t))
+        if (!KEYS.has(k))
+            fail(file, where, `unknown key "${k}"`);
+    if (t.description !== undefined && typeof t.description !== "string")
+        fail(file, where, "description must be a string");
+    let condition;
+    if (t.condition !== undefined) {
+        const c = typeof t.condition === "string" ? t.condition.trim().toUpperCase() : "";
+        if (c !== "OR" && c !== "AND")
+            fail(file, where, 'condition must be "AND" or "OR"');
+        condition = c;
+    }
+    if (t.regexTarget !== undefined && t.regexTarget !== "secret" && t.regexTarget !== "match" && t.regexTarget !== "line") {
+        fail(file, where, 'regexTarget must be "secret", "match" or "line"');
+    }
+    const al = {
+        condition,
+        regexTarget: t.regexTarget,
+        paths: stringList(file, where, "paths", t.paths),
+        regexes: stringList(file, where, "regexes", t.regexes),
+        stopwords: stringList(file, where, "stopwords", t.stopwords),
+        commits: stringList(file, where, "commits", t.commits),
+        targetRules: stringList(file, where, "targetRules", t.targetRules),
+    };
+    // A repo may narrow what is reported, never switch the scanner off: every
+    // allowlist is scoped to files named by an anchored literal prefix.
+    if (!al.paths?.length) {
+        fail(file, where, "needs paths, each starting with ^ and a literal directory or file name (e.g. '^fixtures/')");
+    }
+    for (const src of al.paths) {
+        const re = compileChecked(file, where, "paths", src);
+        if (literalPathPrefix(src) < MIN_PATH_PREFIX || topLevelAlternation(src)) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} must start with ^ and at least ${MIN_PATH_PREFIX} literal characters (e.g. '^fixtures/')`);
+        }
+        if (re.test("") || PROBE_PATHS.every((p) => re.test(p))) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} matches everything; allowlist specific files`);
+        }
+    }
+    if ((al.regexes?.length || al.stopwords?.length) && al.condition !== "AND") {
+        fail(file, where, 'regexes and stopwords need condition = "AND", so they only apply inside paths');
+    }
+    for (const src of al.regexes ?? []) {
+        if (compileChecked(file, where, "regexes", src).test(""))
+            fail(file, where, `regexes entry ${JSON.stringify(src)} matches everything`);
+    }
+    for (const s of al.stopwords ?? []) {
+        if (s.trim().length < MIN_STOPWORD)
+            fail(file, where, `stopword ${JSON.stringify(s)} is shorter than ${MIN_STOPWORD} characters`);
+    }
+    return al;
+}
+/** Validated allowlists from the text of a .gitleaks.toml. */
+export function parseRepoAllowlists(text, file = REPO_CONFIG_FILE) {
+    let doc;
+    try {
+        doc = parse(text);
+    }
+    catch (err) {
+        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+    }
+    const out = [];
+    if (doc.allowlist !== undefined)
+        out.push(validate(file, "[allowlist]", doc.allowlist));
+    if (doc.allowlists !== undefined) {
+        if (!Array.isArray(doc.allowlists))
+            fail(file, "allowlists", "must be an array of tables ([[allowlists]])");
+        doc.allowlists.forEach((a, i) => out.push(validate(file, `[[allowlists]] #${i + 1}`, a)));
+    }
+    return out.map(compileAllowlist);
+}
+function git(repoRoot, args) {
+    try {
+        return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    }
+    catch {
+        return null;
+    }
+}
+/** `<mode> <type> <blob>\t<path>` (ls-tree, blobField 2) or `<mode> <blob> <stage>\t<path>` (ls-files -s, blobField 1). */
+function entry(out, blobField) {
+    const line = out?.split("\n").find(Boolean);
+    if (!line)
+        return null;
+    const f = line.split("\t")[0].split(" ");
+    return { mode: f[0], blob: f[blobField] };
+}
+function readEntry(repoRoot, e, where) {
+    if (e.mode === "120000")
+        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) is a symlink; commit a regular file`);
+    const text = git(repoRoot, ["cat-file", "blob", e.blob]);
+    if (text === null)
+        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) could not be read from git`);
+    return text;
+}
+/**
+ * Compiled allowlists for a staged scan of the repo at `repoRoot`, read from
+ * git as described at the top of this file. [] when the repo has none.
+ */
+export function loadRepoAllowlists(repoRoot) {
+    const lsFiles = git(repoRoot, ["ls-files", "-s", "--", REPO_CONFIG_FILE]);
+    // Only a resolved (stage 0) index entry counts. A conflicted .gitleaks.toml
+    // has stages 1-3 and no stage 0; it is not trusted and the HEAD copy is used.
+    const stage0 = lsFiles?.split("\n").find((l) => l.split("\t")[0].split(" ")[2] === "0") ?? null;
+    const staged = entry(stage0, 1);
+    if (!staged)
+        return lsFiles?.trim() ? headAllowlists(repoRoot) : [];
+    const stagedLists = parseRepoAllowlists(readEntry(repoRoot, staged, "staged"));
+    const committed = ["HEAD", "MERGE_HEAD"]
+        .filter((rev) => git(repoRoot, ["rev-parse", "--verify", "-q", `${rev}^{commit}`]) !== null)
+        .map((rev) => ({ rev, e: entry(git(repoRoot, ["ls-tree", rev, "--", REPO_CONFIG_FILE]), 2) }))
+        .filter((c) => c.e !== null);
+    if (committed.some((c) => c.e.blob === staged.blob && c.e.mode === staged.mode))
+        return stagedLists;
+    // Changed in this commit: scan with the version already committed at HEAD.
+    return headAllowlists(repoRoot);
+}
+function headAllowlists(repoRoot) {
+    if (git(repoRoot, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]) === null)
+        return [];
+    const head = entry(git(repoRoot, ["ls-tree", "HEAD", "--", REPO_CONFIG_FILE]), 2);
+    return head ? parseRepoAllowlists(readEntry(repoRoot, head, "HEAD"), `${REPO_CONFIG_FILE} (HEAD)`) : [];
+}
+//# sourceMappingURL=repo-config.js.map

package/dist/lib/secret-scan/rules.d.ts

@@ -2,13 +2,16 @@
  * Compiled rule set: the vendored gitleaks default rules plus HQ's own token
  * patterns (src/lib/core-utils/secret-patterns.ts). Compiled once per process.
  */
-import type { GitleaksRule } from "./types.js";
+import type { GitleaksAllowlist, GitleaksRule } from "./types.js";
 export interface CompiledAllowlist {
     condition: "OR" | "AND";
     target: "secret" | "match" | "line";
     paths: RegExp[];
     regexes: RegExp[];
     stopwords: string[];
+    commits: string[];
+    /** Empty: applies to every rule. */
+    targetRules: string[];
 }
 export interface CompiledRule {
     id: string;
@@ -24,7 +27,10 @@ export interface CompiledRule {
 export interface CompiledRuleSet {
     global: CompiledAllowlist;
     rules: CompiledRule[];
+    /** Allowlists from the scanned repo's own .gitleaks.toml (see repo-config.ts). */
+    repo?: CompiledAllowlist[];
 }
+export declare function compileAllowlist(a: GitleaksAllowlist): CompiledAllowlist;
 /** HQ's own patterns, expressed as gitleaks-shaped rules. */
 export declare function hqRules(): GitleaksRule[];
 export declare function compiledRules(): CompiledRuleSet;

package/dist/lib/secret-scan/rules.js

@@ -5,13 +5,15 @@
 import { SECRET_PATTERNS } from "../core-utils/secret-patterns.js";
 import { GITLEAKS_CONFIG } from "./gitleaks-rules.generated.js";
 import { compileGoRegex } from "./go-regex.js";
-function compileAllowlist(a) {
+export function compileAllowlist(a) {
     return {
         condition: a.condition === "AND" ? "AND" : "OR",
         target: a.regexTarget ?? "secret",
         paths: (a.paths ?? []).map((p) => compileGoRegex(p)),
         regexes: (a.regexes ?? []).map((r) => compileGoRegex(r)),
         stopwords: (a.stopwords ?? []).map((s) => s.toLowerCase()),
+        commits: (a.commits ?? []).map((c) => c.toLowerCase()),
+        targetRules: a.targetRules ?? [],
     };
 }
 function compileRule(r) {

package/dist/lib/secret-scan/staged.d.ts

@@ -12,6 +12,11 @@ export interface ParsedDiff {
 /** Parse `git diff --unified=0` output into one fragment of added lines per hunk. */
 export declare function parseUnifiedDiff(diff: string): ParsedDiff;
 export declare function stagedDiff(cwd: string): string;
+export declare function repoRoot(cwd: string): string;
+/**
+ * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
+ * relative to the repo root, as gitleaks' allowlist paths are.
+ */
 export declare function scanStaged(cwd: string): SecretFinding[];
 export declare function scanFiles(paths: string[]): SecretFinding[];
 //# sourceMappingURL=staged.d.ts.map

package/dist/lib/secret-scan/staged.js

@@ -4,6 +4,8 @@
 import { execFileSync } from "node:child_process";
 import { readFileSync, statSync } from "node:fs";
 import { scanFragment, scanPath } from "./detect.js";
+import { loadRepoAllowlists } from "./repo-config.js";
+import { compiledRules } from "./rules.js";
 export class ScanInputError extends Error {
 }
 const DIFF_ARGS = [
@@ -89,9 +91,24 @@ export function stagedDiff(cwd) {
         throw new ScanInputError(`could not read the staged changes: ${detail || "git diff failed"}`);
     }
 }
+export function repoRoot(cwd) {
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    }
+    catch (err) {
+        const detail = err instanceof Error && "stderr" in err ? String(err.stderr).trim() : String(err);
+        throw new ScanInputError(`could not find the repo root: ${detail || "git rev-parse failed"}`);
+    }
+}
+/**
+ * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
+ * relative to the repo root, as gitleaks' allowlist paths are.
+ */
 export function scanStaged(cwd) {
-    const { fragments, binaryFiles } = parseUnifiedDiff(stagedDiff(cwd));
-    return [...fragments.flatMap((f) => scanFragment(f)), ...binaryFiles.flatMap((f) => scanPath(f))];
+    const diff = stagedDiff(cwd);
+    const rules = { ...compiledRules(), repo: loadRepoAllowlists(repoRoot(cwd)) };
+    const { fragments, binaryFiles } = parseUnifiedDiff(diff);
+    return [...fragments.flatMap((f) => scanFragment(f, rules)), ...binaryFiles.flatMap((f) => scanPath(f, rules))];
 }
 export function scanFiles(paths) {
     const out = [];

package/dist/lib/secret-scan/types.d.ts

@@ -9,6 +9,8 @@ export interface GitleaksAllowlist {
     regexes?: string[];
     stopwords?: string[];
     commits?: string[];
+    /** Repo allowlists only: limit the allowlist to these rule ids. */
+    targetRules?: string[];
 }
 export interface GitleaksRule {
     id: string;

package/dist/lib/sync/server-owned-local-only.d.ts

@@ -0,0 +1,29 @@
+/** Company-relative folders the server owns and a client push never uploads. */
+export declare const SERVER_OWNED_FOLDERS: readonly string[];
+/**
+ * True for a company-relative path a client push refuses as server-owned.
+ * Mirrors hq-cloud's `isLocallyIneligibleForPush` with the entity exception:
+ * `ontology/entities/` can be client-owned, so it is not reported here.
+ */
+export declare function isServerOwnedNeverPushed(rel: string): boolean;
+export type ServerOwnedLocalOnlyResult = {
+    files: string[];
+    total: number;
+};
+export type FindServerOwnedLocalOnlyOptions = {
+    hqRoot: string;
+    slug: string;
+    /** Company-relative keys already in the sync journal (live or tombstoned). */
+    journalKeys: ReadonlySet<string>;
+    /** Engine ignore filter over absolute paths; true = would sync. */
+    shouldSync?: (absPath: string, isDir?: boolean) => boolean;
+    /** Max paths returned; `total` still counts every match. */
+    limit?: number;
+};
+/**
+ * Walk the server-owned folders under `companies/<slug>/` and return files
+ * that are not in the journal. A journaled file arrived by pull and is in
+ * sync; anything else was written locally and will never upload.
+ */
+export declare function findServerOwnedLocalOnly(opts: FindServerOwnedLocalOnlyOptions): ServerOwnedLocalOnlyResult;
+//# sourceMappingURL=server-owned-local-only.d.ts.map

package/dist/lib/sync/server-owned-local-only.js

@@ -0,0 +1,75 @@
+/**
+ * Local-only files under server-owned vault folders (feedback_0414d71c).
+ *
+ * The sync engine treats `sources/`, `signals/` and the non-entity part of
+ * `ontology/` as cloud-authoritative: the server pipeline writes them and a
+ * client push refuses them (`refuse-server-owned` in hq-cloud's share plan,
+ * see hq-cloud `src/lib/cloud-authoritative.ts`). The recurring runner skips
+ * them quietly, so a file written locally into one of these folders never
+ * reaches the vault and nothing reports it as pending. `hq sync status` lists
+ * them so the gap is visible.
+ *
+ * Read-only and network-free: the walk covers only the server-owned folders
+ * and the "already synced" set is the company's sync journal the caller
+ * already has.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+/** Company-relative folders the server owns and a client push never uploads. */
+export const SERVER_OWNED_FOLDERS = ["sources", "signals", "ontology"];
+/**
+ * True for a company-relative path a client push refuses as server-owned.
+ * Mirrors hq-cloud's `isLocallyIneligibleForPush` with the entity exception:
+ * `ontology/entities/` can be client-owned, so it is not reported here.
+ */
+export function isServerOwnedNeverPushed(rel) {
+    const vaultRel = rel.split("\\").join("/").replace(/^\.?\//, "");
+    if (vaultRel.startsWith("ontology/entities/"))
+        return false;
+    return SERVER_OWNED_FOLDERS.some((folder) => vaultRel.startsWith(`${folder}/`));
+}
+/**
+ * Walk the server-owned folders under `companies/<slug>/` and return files
+ * that are not in the journal. A journaled file arrived by pull and is in
+ * sync; anything else was written locally and will never upload.
+ */
+export function findServerOwnedLocalOnly(opts) {
+    const root = path.join(opts.hqRoot, "companies", opts.slug);
+    const limit = opts.limit ?? 20;
+    const found = [];
+    const stack = SERVER_OWNED_FOLDERS.map((folder) => path.join(root, folder));
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const abs = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (entry.name === ".git" || entry.name === "node_modules")
+                    continue;
+                if (opts.shouldSync && !opts.shouldSync(abs, true))
+                    continue;
+                stack.push(abs);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (opts.shouldSync && !opts.shouldSync(abs, false))
+                continue;
+            const rel = path.relative(root, abs).split(path.sep).join("/");
+            if (!isServerOwnedNeverPushed(rel))
+                continue;
+            if (opts.journalKeys.has(rel))
+                continue;
+            found.push(rel);
+        }
+    }
+    found.sort((a, b) => a.localeCompare(b));
+    return { files: found.slice(0, limit), total: found.length };
+}
+//# sourceMappingURL=server-owned-local-only.js.map

package/dist/sentry-before-send.js

@@ -192,6 +192,7 @@ export function beforeSend(event, _hint) {
             "core-version-unavailable",
             "core-update-available",
             "no-local-tree",
+            "company-not-resolved",
             "legacy-personal-journal",
             "never-synced",
             "invalid-last-sync",

package/dist/utils/access-denied-hint.js

@@ -31,6 +31,12 @@ function errMessage(err) {
 export function isAccessDeniedError(err) {
     const rec = errRecord(err);
     if (rec) {
+        // A presigned storage download that failed AFTER the API authorized the
+        // key (createCompanyPresignClient). The ACL already passed, so pointing
+        // the caller at `hq access` would loop. Checked before the message regex
+        // because the message names the HTTP status.
+        if (rec.code === "FILES_STORAGE_DOWNLOAD_FAILED")
+            return false;
         if (rec.status === 403)
             return true;
         const meta = rec.$metadata;

package/dist/utils/client-health.d.ts

@@ -64,6 +64,17 @@ export declare const CLIENT_HEALTH_OBSERVATION_FILE = "cli-client-health.observa
  * always re-observe — they have opened the store anyway, so it costs nothing.
  */
 export declare const JOURNAL_OBSERVATION_TTL_MS: number;
+/**
+ * V8 old-space cap, in MB, for the child process that enumerates journals on
+ * behalf of a plain invocation. `listJournals()` materializes every area of
+ * the local sync state store; on a large store that took a short-lived
+ * command such as `hq secrets exec` to 2.5-4 GB RSS (feedback_d70e9d63). The
+ * child either finishes inside this cap or dies, and the command never holds
+ * that memory itself.
+ */
+export declare const JOURNAL_OBSERVER_HEAP_MB = 512;
+/** Wall-clock bound for the isolated journal observer. */
+export declare const JOURNAL_OBSERVER_TIMEOUT_MS = 20000;
 export interface CliClientHealthState {
     /** Stable random installation identity — regenerated only if invalid. */
     installationId: string;
@@ -120,6 +131,24 @@ interface JournalLike {
  * contract ISO-UTC. Null when nothing has ever synced.
  */
 export declare function latestJournalSyncTime(journals: readonly JournalLike[]): string | null;
+/**
+ * The isolated observer could not produce a value (heap cap, timeout, crash or
+ * unreadable output). The caller stamps the observation so the next attempt
+ * waits a full TTL instead of re-running a read already known to fail here.
+ */
+export declare class JournalObservationUnavailableError extends Error {
+    constructor(message: string);
+}
+/**
+ * Run `listJournals()` in a heap-capped child process and return only the
+ * `lastSync` values. Used for plain invocations so the full store
+ * materialization never lands in the invoking command's own memory.
+ */
+export declare function observeJournalsIsolated(opts?: {
+    engineUrl?: string;
+    heapMb?: number;
+    timeoutMs?: number;
+}): JournalLike[];
 /**
  * True when this event kind must pay for a fresh `listJournals()` read.
  *
@@ -167,6 +196,11 @@ export interface ClientHealthDeps {
     expiring?: typeof isExpiring;
     versions?: () => VersionInfo;
     journals?: () => readonly JournalLike[];
+    /**
+     * Journal source for plain invocations when `journals` is not set. Defaults
+     * to {@link observeJournalsIsolated}; sync events read in-process.
+     */
+    isolatedJournals?: () => readonly JournalLike[];
     post?: HeartbeatPoster;
     timeoutMs?: number;
     /** US-016: overridable for tests; defaults to {@link collectLocalFilesOverview}. */

package/dist/utils/client-health.js

@@ -33,6 +33,9 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
 import { getStateDir, listJournals } from "@indigoai-us/hq-cloud";
 import { isExpiring, isMachineIdentity, loadCachedTokens, } from "./cognito-session.js";
 import { vaultApiFetch } from "./vault-api.js";
@@ -73,6 +76,17 @@ export const CLIENT_HEALTH_OBSERVATION_FILE = "cli-client-health.observation.jso
  * always re-observe — they have opened the store anyway, so it costs nothing.
  */
 export const JOURNAL_OBSERVATION_TTL_MS = 15 * 60_000;
+/**
+ * V8 old-space cap, in MB, for the child process that enumerates journals on
+ * behalf of a plain invocation. `listJournals()` materializes every area of
+ * the local sync state store; on a large store that took a short-lived
+ * command such as `hq secrets exec` to 2.5-4 GB RSS (feedback_d70e9d63). The
+ * child either finishes inside this cap or dies, and the command never holds
+ * that memory itself.
+ */
+export const JOURNAL_OBSERVER_HEAP_MB = 512;
+/** Wall-clock bound for the isolated journal observer. */
+export const JOURNAL_OBSERVER_TIMEOUT_MS = 20_000;
 /** An observation lock older than this is treated as abandoned. */
 const JOURNAL_OBSERVATION_LOCK_STALE_MS = 5 * 60_000;
 /**
@@ -234,6 +248,66 @@ export function latestJournalSyncTime(journals) {
     }
     return latest === null ? null : new Date(latest).toISOString();
 }
+/**
+ * The isolated observer could not produce a value (heap cap, timeout, crash or
+ * unreadable output). The caller stamps the observation so the next attempt
+ * waits a full TTL instead of re-running a read already known to fail here.
+ */
+export class JournalObservationUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "JournalObservationUnavailableError";
+    }
+}
+const JOURNAL_OBSERVER_SOURCE = [
+    "const engine = await import(process.argv[1]);",
+    "const out = [];",
+    "for (const entry of engine.listJournals()) {",
+    "  const value = entry && entry.journal ? entry.journal.lastSync : undefined;",
+    "  if (typeof value === 'string') out.push(value);",
+    "}",
+    "process.stdout.write(JSON.stringify(out));",
+].join("\n");
+function defaultJournalEngineUrl() {
+    return pathToFileURL(createRequire(import.meta.url).resolve("@indigoai-us/hq-cloud")).href;
+}
+/**
+ * Run `listJournals()` in a heap-capped child process and return only the
+ * `lastSync` values. Used for plain invocations so the full store
+ * materialization never lands in the invoking command's own memory.
+ */
+export function observeJournalsIsolated(opts = {}) {
+    const engineUrl = opts.engineUrl ?? defaultJournalEngineUrl();
+    const result = spawnSync(process.execPath, [
+        `--max-old-space-size=${opts.heapMb ?? JOURNAL_OBSERVER_HEAP_MB}`,
+        "--input-type=module",
+        "-e",
+        JOURNAL_OBSERVER_SOURCE,
+        engineUrl,
+    ], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: opts.timeoutMs ?? JOURNAL_OBSERVER_TIMEOUT_MS,
+        maxBuffer: 1024 * 1024,
+        windowsHide: true,
+    });
+    if (result.error || result.status !== 0 || result.signal) {
+        throw new JournalObservationUnavailableError(`journal observer failed (status ${String(result.status)}, signal ${String(result.signal)})`);
+    }
+    let values;
+    try {
+        values = JSON.parse(result.stdout);
+    }
+    catch {
+        throw new JournalObservationUnavailableError("journal observer output was not JSON");
+    }
+    if (!Array.isArray(values)) {
+        throw new JournalObservationUnavailableError("journal observer output was not a list");
+    }
+    return values
+        .filter((value) => typeof value === "string")
+        .map((lastSync) => ({ journal: { lastSync } }));
+}
 /**
  * True when this event kind must pay for a fresh `listJournals()` read.
  *
@@ -527,7 +601,14 @@ async function contributeClientHealthUnbounded(kind, deps, failureReason) {
             }
             else {
                 try {
-                    const observed = latestJournalSyncTime((deps.journals ?? listJournals)());
+                    // A plain invocation (any command, `hq secrets exec` included) reads
+                    // the store in a heap-capped child. Sync commands have the store open
+                    // already and read in-process.
+                    const source = deps.journals ??
+                        (kind === "invocation"
+                            ? (deps.isolatedJournals ?? observeJournalsIsolated)
+                            : listJournals);
+                    const observed = latestJournalSyncTime(source());
                     if (observed !== null) {
                         journalLastSyncAt = observed;
                         observation.lastSyncAt = observed;
@@ -543,8 +624,20 @@ async function contributeClientHealthUnbounded(kind, deps, failureReason) {
                     observation.observedAt = now.toISOString();
                     persistJournalObservation(stateDir, observation);
                 }
-                catch {
-                    // Journal enumeration is best effort.
+                catch (error) {
+                    // Journal enumeration is best effort. When the isolated observer hit
+                    // its heap or time cap, keep the previous value but stamp the attempt
+                    // so the next invocation waits a full TTL instead of retrying a read
+                    // already known to fail on this machine.
+                    if (error instanceof JournalObservationUnavailableError) {
+                        observation.observedAt = now.toISOString();
+                        try {
+                            persistJournalObservation(stateDir, observation);
+                        }
+                        catch {
+                            // Best effort.
+                        }
+                    }
                 }
                 finally {
                     release();