@indigoai-us/hq-cli 5.345.156 → 5.345.159

package/dist/lib/mesh/api.js

@@ -515,6 +515,81 @@ export async function registerMeshProject(token, companyUid, projectId, channelI
         channelCreated: result?.channelCreated === true,
     };
 }
+// ---------------------------------------------------------------------------
+// Project lifecycle (active | completed | archived)
+// ---------------------------------------------------------------------------
+export const PROJECT_LIFECYCLE_STATUSES = ["active", "completed", "archived"];
+function lifecycleFromRow(row) {
+    const rec = asRecord(row);
+    const projectId = String(rec?.projectId || "").trim();
+    const status = String(rec?.status || "").trim();
+    const version = Number(rec?.version);
+    if (!projectId || !Number.isSafeInteger(version) || version < 0)
+        return null;
+    if (!PROJECT_LIFECYCLE_STATUSES.includes(status))
+        return null;
+    return {
+        projectId,
+        status: status,
+        version,
+        updatedAt: String(rec?.updatedAt || ""),
+        updatedBy: String(rec?.updatedBy || ""),
+    };
+}
+/**
+ * List every lifecycle row for a company (follows the 25-row server pages).
+ * A project with no row has never left `active` and is not listed.
+ */
+export async function listProjectLifecycles(token, companyUid) {
+    const rows = [];
+    let cursor;
+    // Bounded so a server that keeps returning the same cursor cannot loop forever.
+    for (let page = 0; page < 200; page += 1) {
+        const data = asRecord(await meshJson(token, "/v1/work-mesh/project-lifecycle", {
+            query: { companyUid, ...(cursor ? { cursor } : {}) },
+        }));
+        const projects = Array.isArray(data?.projects) ? data.projects : [];
+        for (const row of projects) {
+            const parsed = lifecycleFromRow(row);
+            if (parsed)
+                rows.push(parsed);
+        }
+        const next = typeof data?.nextCursor === "string" ? data.nextCursor.trim() : "";
+        if (!next || next === cursor)
+            break;
+        cursor = next;
+    }
+    return rows;
+}
+/** The lifecycle row for one project, or null when it has never been changed. */
+export async function getProjectLifecycle(token, companyUid, projectId) {
+    const rows = await listProjectLifecycles(token, companyUid);
+    return rows.find((row) => row.projectId === projectId) ?? null;
+}
+/**
+ * PATCH /v1/work-mesh/projects/{id}/lifecycle. `expectedVersion` is the
+ * current lifecycle row version (0 when the project has no row yet). The
+ * server answers 409 BOARD_NONEMPTY when archiving a Board that still has
+ * stories unless `confirmNonempty` is set, and a plain 409 on a version
+ * mismatch. Nothing is deleted: stories, folder, channel, members and
+ * history stay; the project only leaves the active list and the organize
+ * candidates.
+ */
+export async function setProjectLifecycle(token, companyUid, projectId, change) {
+    const data = await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/lifecycle`, {
+        method: "PATCH",
+        query: { companyUid },
+        body: {
+            status: change.status,
+            expectedVersion: change.expectedVersion,
+            ...(change.confirmNonempty ? { confirmNonempty: true } : {}),
+        },
+    });
+    const parsed = lifecycleFromRow(data);
+    if (!parsed)
+        throw new Error("Work mesh returned an invalid project lifecycle row");
+    return parsed;
+}
 export function pairDmUidsFromInbox(inbox) {
     const rec = asRecord(inbox);
     const ids = new Set();

package/dist/lib/secret-scan/detect.js

@@ -36,6 +36,8 @@ function allowed(al, c) {
         const lower = c.secret.toLowerCase();
         checks.push(al.stopwords.some((s) => lower.includes(s)));
     }
+    if (al.commits.length)
+        checks.push(c.commit !== undefined && al.commits.includes(c.commit.toLowerCase()));
     if (!checks.length)
         return false;
     return al.condition === "AND" ? checks.every(Boolean) : checks.some(Boolean);
@@ -50,6 +52,10 @@ function lineBounds(text, start, end) {
             offset++;
     return { line: text.slice(from, to), offset };
 }
+/** A repo allowlist applies to this rule (no targetRules means every rule). */
+function repoAllowed(rules, ruleId, c) {
+    return (rules.repo ?? []).some((al) => (!al.targetRules.length || al.targetRules.includes(ruleId)) && allowed(al, c));
+}
 /** True when the global allowlist excludes this path from scanning. */
 export function pathIgnored(file, rules = compiledRules()) {
     return rules.global.paths.some((p) => p.test(file));
@@ -60,6 +66,7 @@ export function scanPath(file, rules = compiledRules()) {
         return [];
     return rules.rules
         .filter((r) => !r.regex && r.path?.test(file))
+        .filter((r) => !repoAllowed(rules, r.id, { file, secret: "", match: "", line: "" }))
         .map((r) => ({ ruleId: r.id, description: r.description, file, line: 1 }));
 }
 export function scanFragment(frag, rules = compiledRules()) {
@@ -103,6 +110,8 @@ export function scanFragment(frag, rules = compiledRules()) {
                 continue;
             if (rule.allowlists.some((al) => allowed(al, cand)))
                 continue;
+            if (repoAllowed(rules, rule.id, cand))
+                continue;
             const lineNo = startLine + offset;
             const key = `${rule.id}:${lineNo}`;
             if (seen.has(key))

package/dist/lib/secret-scan/repo-config.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Repo-level allowlists: `[[allowlists]]` (and the legacy `[allowlist]`) from
+ * the scanned repo's own `.gitleaks.toml`, with gitleaks semantics for
+ * `paths`, `regexes`, `regexTarget`, `stopwords`, `commits`, `targetRules` and
+ * `condition`. They apply on top of the built-in rules and allowlists, to that
+ * repo only. Repo `[[rules]]`, `[extend]` and the rest of the file are ignored:
+ * a repo can allow known false positives, not change what is detected.
+ *
+ * The file is read from git, never the working tree:
+ *   - The staged (index) copy applies only when it is identical to the copy
+ *     already committed at HEAD (or at MERGE_HEAD during a merge). A commit
+ *     that changes the allowlist is scanned with the HEAD allowlist, so
+ *     widening the allowlist and adding the secret cannot happen in one commit.
+ *   - A changed staged copy is still validated, so a broken file fails now.
+ *   - A symlinked .gitleaks.toml is rejected.
+ *
+ * Narrow by construction: every allowlist needs `paths`, each anchored with a
+ * literal prefix (`^golden/...`); `regexes` and `stopwords` need
+ * `condition = "AND"`, so they never reach files outside those paths.
+ *
+ * Fails closed: anything not acceptable is a ScanConfigError, and the scan
+ * exits 2 rather than running with a guess.
+ */
+import { type CompiledAllowlist } from "./rules.js";
+export declare class ScanConfigError extends Error {
+}
+export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
+/**
+ * Length of the literal text right after a leading `^`: letters, digits,
+ * `/ _ - @ ~` and backslash-escaped punctuation. A quantifier on the last
+ * literal makes it optional, so it does not count.
+ */
+export declare function literalPathPrefix(src: string): number;
+/** Validated allowlists from the text of a .gitleaks.toml. */
+export declare function parseRepoAllowlists(text: string, file?: string): CompiledAllowlist[];
+/**
+ * Compiled allowlists for a staged scan of the repo at `repoRoot`, read from
+ * git as described at the top of this file. [] when the repo has none.
+ */
+export declare function loadRepoAllowlists(repoRoot: string): CompiledAllowlist[];
+//# sourceMappingURL=repo-config.d.ts.map

package/dist/lib/secret-scan/repo-config.js

@@ -0,0 +1,237 @@
+/**
+ * Repo-level allowlists: `[[allowlists]]` (and the legacy `[allowlist]`) from
+ * the scanned repo's own `.gitleaks.toml`, with gitleaks semantics for
+ * `paths`, `regexes`, `regexTarget`, `stopwords`, `commits`, `targetRules` and
+ * `condition`. They apply on top of the built-in rules and allowlists, to that
+ * repo only. Repo `[[rules]]`, `[extend]` and the rest of the file are ignored:
+ * a repo can allow known false positives, not change what is detected.
+ *
+ * The file is read from git, never the working tree:
+ *   - The staged (index) copy applies only when it is identical to the copy
+ *     already committed at HEAD (or at MERGE_HEAD during a merge). A commit
+ *     that changes the allowlist is scanned with the HEAD allowlist, so
+ *     widening the allowlist and adding the secret cannot happen in one commit.
+ *   - A changed staged copy is still validated, so a broken file fails now.
+ *   - A symlinked .gitleaks.toml is rejected.
+ *
+ * Narrow by construction: every allowlist needs `paths`, each anchored with a
+ * literal prefix (`^golden/...`); `regexes` and `stopwords` need
+ * `condition = "AND"`, so they never reach files outside those paths.
+ *
+ * Fails closed: anything not acceptable is a ScanConfigError, and the scan
+ * exits 2 rather than running with a guess.
+ */
+import { execFileSync } from "node:child_process";
+import { parse } from "smol-toml";
+import { compileGoRegex } from "./go-regex.js";
+import { compileAllowlist } from "./rules.js";
+export class ScanConfigError extends Error {
+}
+export const REPO_CONFIG_FILE = ".gitleaks.toml";
+const KEYS = new Set(["description", "condition", "regexTarget", "paths", "regexes", "stopwords", "commits", "targetRules"]);
+const MIN_PATH_PREFIX = 3;
+const MIN_STOPWORD = 3;
+/** User regexes run on JavaScript's backtracking engine, not RE2. */
+const MAX_REGEX_LENGTH = 256;
+/** A quantified group that itself contains a quantifier, e.g. (a+)+ or (?:x*y)*. */
+const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[*+}](?:[^()\\]|\\.)*\)[*+{]/;
+/** Paths no real allowlist path should match all of. */
+const PROBE_PATHS = ["a", ".env", "src/index.ts", "config/credentials.yml", "deep/nested/dir/file.json"];
+function fail(file, where, msg) {
+    throw new ScanConfigError(`${file}: ${where}: ${msg}`);
+}
+function stringList(file, where, key, v) {
+    if (v === undefined)
+        return undefined;
+    if (!Array.isArray(v) || v.some((x) => typeof x !== "string"))
+        fail(file, where, `${key} must be a list of strings`);
+    return v;
+}
+/**
+ * Length of the literal text right after a leading `^`: letters, digits,
+ * `/ _ - @ ~` and backslash-escaped punctuation. A quantifier on the last
+ * literal makes it optional, so it does not count.
+ */
+export function literalPathPrefix(src) {
+    if (!src.startsWith("^"))
+        return 0;
+    let n = 0;
+    let i = 1;
+    while (i < src.length) {
+        const ch = src[i];
+        if (/[A-Za-z0-9/_\-@~]/.test(ch)) {
+            n++;
+            i++;
+        }
+        else if (ch === "\\" && i + 1 < src.length && /[^A-Za-z0-9]/.test(src[i + 1])) {
+            n++;
+            i += 2;
+        }
+        else {
+            break;
+        }
+    }
+    if (n > 0 && /^[*?{]/.test(src.slice(i)))
+        n--;
+    return n;
+}
+/** True when `src` has a `|` outside any group, which would bypass the `^` prefix. */
+function topLevelAlternation(src) {
+    let depth = 0;
+    let inClass = false;
+    for (let i = 0; i < src.length; i++) {
+        const ch = src[i];
+        if (ch === "\\")
+            i++;
+        else if (inClass)
+            inClass = ch !== "]";
+        else if (ch === "[")
+            inClass = true;
+        else if (ch === "(")
+            depth++;
+        else if (ch === ")")
+            depth--;
+        else if (ch === "|" && depth === 0)
+            return true;
+    }
+    return false;
+}
+function compileChecked(file, where, key, src) {
+    if (src.length > MAX_REGEX_LENGTH)
+        fail(file, where, `${key} entry is longer than ${MAX_REGEX_LENGTH} characters`);
+    if (NESTED_QUANTIFIER.test(src))
+        fail(file, where, `${key} entry ${JSON.stringify(src)} has a nested quantifier; simplify it`);
+    try {
+        return compileGoRegex(src);
+    }
+    catch (err) {
+        fail(file, where, `${key} entry ${JSON.stringify(src)} is not a supported regex (${err instanceof Error ? err.message : String(err)})`);
+    }
+}
+function validate(file, where, raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        fail(file, where, "must be a table");
+    const t = raw;
+    for (const k of Object.keys(t))
+        if (!KEYS.has(k))
+            fail(file, where, `unknown key "${k}"`);
+    if (t.description !== undefined && typeof t.description !== "string")
+        fail(file, where, "description must be a string");
+    let condition;
+    if (t.condition !== undefined) {
+        const c = typeof t.condition === "string" ? t.condition.trim().toUpperCase() : "";
+        if (c !== "OR" && c !== "AND")
+            fail(file, where, 'condition must be "AND" or "OR"');
+        condition = c;
+    }
+    if (t.regexTarget !== undefined && t.regexTarget !== "secret" && t.regexTarget !== "match" && t.regexTarget !== "line") {
+        fail(file, where, 'regexTarget must be "secret", "match" or "line"');
+    }
+    const al = {
+        condition,
+        regexTarget: t.regexTarget,
+        paths: stringList(file, where, "paths", t.paths),
+        regexes: stringList(file, where, "regexes", t.regexes),
+        stopwords: stringList(file, where, "stopwords", t.stopwords),
+        commits: stringList(file, where, "commits", t.commits),
+        targetRules: stringList(file, where, "targetRules", t.targetRules),
+    };
+    // A repo may narrow what is reported, never switch the scanner off: every
+    // allowlist is scoped to files named by an anchored literal prefix.
+    if (!al.paths?.length) {
+        fail(file, where, "needs paths, each starting with ^ and a literal directory or file name (e.g. '^fixtures/')");
+    }
+    for (const src of al.paths) {
+        const re = compileChecked(file, where, "paths", src);
+        if (literalPathPrefix(src) < MIN_PATH_PREFIX || topLevelAlternation(src)) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} must start with ^ and at least ${MIN_PATH_PREFIX} literal characters (e.g. '^fixtures/')`);
+        }
+        if (re.test("") || PROBE_PATHS.every((p) => re.test(p))) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} matches everything; allowlist specific files`);
+        }
+    }
+    if ((al.regexes?.length || al.stopwords?.length) && al.condition !== "AND") {
+        fail(file, where, 'regexes and stopwords need condition = "AND", so they only apply inside paths');
+    }
+    for (const src of al.regexes ?? []) {
+        if (compileChecked(file, where, "regexes", src).test(""))
+            fail(file, where, `regexes entry ${JSON.stringify(src)} matches everything`);
+    }
+    for (const s of al.stopwords ?? []) {
+        if (s.trim().length < MIN_STOPWORD)
+            fail(file, where, `stopword ${JSON.stringify(s)} is shorter than ${MIN_STOPWORD} characters`);
+    }
+    return al;
+}
+/** Validated allowlists from the text of a .gitleaks.toml. */
+export function parseRepoAllowlists(text, file = REPO_CONFIG_FILE) {
+    let doc;
+    try {
+        doc = parse(text);
+    }
+    catch (err) {
+        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+    }
+    const out = [];
+    if (doc.allowlist !== undefined)
+        out.push(validate(file, "[allowlist]", doc.allowlist));
+    if (doc.allowlists !== undefined) {
+        if (!Array.isArray(doc.allowlists))
+            fail(file, "allowlists", "must be an array of tables ([[allowlists]])");
+        doc.allowlists.forEach((a, i) => out.push(validate(file, `[[allowlists]] #${i + 1}`, a)));
+    }
+    return out.map(compileAllowlist);
+}
+function git(repoRoot, args) {
+    try {
+        return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    }
+    catch {
+        return null;
+    }
+}
+/** `<mode> <type> <blob>\t<path>` (ls-tree, blobField 2) or `<mode> <blob> <stage>\t<path>` (ls-files -s, blobField 1). */
+function entry(out, blobField) {
+    const line = out?.split("\n").find(Boolean);
+    if (!line)
+        return null;
+    const f = line.split("\t")[0].split(" ");
+    return { mode: f[0], blob: f[blobField] };
+}
+function readEntry(repoRoot, e, where) {
+    if (e.mode === "120000")
+        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) is a symlink; commit a regular file`);
+    const text = git(repoRoot, ["cat-file", "blob", e.blob]);
+    if (text === null)
+        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) could not be read from git`);
+    return text;
+}
+/**
+ * Compiled allowlists for a staged scan of the repo at `repoRoot`, read from
+ * git as described at the top of this file. [] when the repo has none.
+ */
+export function loadRepoAllowlists(repoRoot) {
+    const lsFiles = git(repoRoot, ["ls-files", "-s", "--", REPO_CONFIG_FILE]);
+    // Only a resolved (stage 0) index entry counts. A conflicted .gitleaks.toml
+    // has stages 1-3 and no stage 0; it is not trusted and the HEAD copy is used.
+    const stage0 = lsFiles?.split("\n").find((l) => l.split("\t")[0].split(" ")[2] === "0") ?? null;
+    const staged = entry(stage0, 1);
+    if (!staged)
+        return lsFiles?.trim() ? headAllowlists(repoRoot) : [];
+    const stagedLists = parseRepoAllowlists(readEntry(repoRoot, staged, "staged"));
+    const committed = ["HEAD", "MERGE_HEAD"]
+        .filter((rev) => git(repoRoot, ["rev-parse", "--verify", "-q", `${rev}^{commit}`]) !== null)
+        .map((rev) => ({ rev, e: entry(git(repoRoot, ["ls-tree", rev, "--", REPO_CONFIG_FILE]), 2) }))
+        .filter((c) => c.e !== null);
+    if (committed.some((c) => c.e.blob === staged.blob && c.e.mode === staged.mode))
+        return stagedLists;
+    // Changed in this commit: scan with the version already committed at HEAD.
+    return headAllowlists(repoRoot);
+}
+function headAllowlists(repoRoot) {
+    if (git(repoRoot, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]) === null)
+        return [];
+    const head = entry(git(repoRoot, ["ls-tree", "HEAD", "--", REPO_CONFIG_FILE]), 2);
+    return head ? parseRepoAllowlists(readEntry(repoRoot, head, "HEAD"), `${REPO_CONFIG_FILE} (HEAD)`) : [];
+}
+//# sourceMappingURL=repo-config.js.map

package/dist/lib/secret-scan/rules.d.ts

@@ -2,13 +2,16 @@
  * Compiled rule set: the vendored gitleaks default rules plus HQ's own token
  * patterns (src/lib/core-utils/secret-patterns.ts). Compiled once per process.
  */
-import type { GitleaksRule } from "./types.js";
+import type { GitleaksAllowlist, GitleaksRule } from "./types.js";
 export interface CompiledAllowlist {
     condition: "OR" | "AND";
     target: "secret" | "match" | "line";
     paths: RegExp[];
     regexes: RegExp[];
     stopwords: string[];
+    commits: string[];
+    /** Empty: applies to every rule. */
+    targetRules: string[];
 }
 export interface CompiledRule {
     id: string;
@@ -24,7 +27,10 @@ export interface CompiledRule {
 export interface CompiledRuleSet {
     global: CompiledAllowlist;
     rules: CompiledRule[];
+    /** Allowlists from the scanned repo's own .gitleaks.toml (see repo-config.ts). */
+    repo?: CompiledAllowlist[];
 }
+export declare function compileAllowlist(a: GitleaksAllowlist): CompiledAllowlist;
 /** HQ's own patterns, expressed as gitleaks-shaped rules. */
 export declare function hqRules(): GitleaksRule[];
 export declare function compiledRules(): CompiledRuleSet;

package/dist/lib/secret-scan/rules.js

@@ -5,13 +5,15 @@
 import { SECRET_PATTERNS } from "../core-utils/secret-patterns.js";
 import { GITLEAKS_CONFIG } from "./gitleaks-rules.generated.js";
 import { compileGoRegex } from "./go-regex.js";
-function compileAllowlist(a) {
+export function compileAllowlist(a) {
     return {
         condition: a.condition === "AND" ? "AND" : "OR",
         target: a.regexTarget ?? "secret",
         paths: (a.paths ?? []).map((p) => compileGoRegex(p)),
         regexes: (a.regexes ?? []).map((r) => compileGoRegex(r)),
         stopwords: (a.stopwords ?? []).map((s) => s.toLowerCase()),
+        commits: (a.commits ?? []).map((c) => c.toLowerCase()),
+        targetRules: a.targetRules ?? [],
     };
 }
 function compileRule(r) {

package/dist/lib/secret-scan/staged.d.ts

@@ -12,6 +12,11 @@ export interface ParsedDiff {
 /** Parse `git diff --unified=0` output into one fragment of added lines per hunk. */
 export declare function parseUnifiedDiff(diff: string): ParsedDiff;
 export declare function stagedDiff(cwd: string): string;
+export declare function repoRoot(cwd: string): string;
+/**
+ * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
+ * relative to the repo root, as gitleaks' allowlist paths are.
+ */
 export declare function scanStaged(cwd: string): SecretFinding[];
 export declare function scanFiles(paths: string[]): SecretFinding[];
 //# sourceMappingURL=staged.d.ts.map

package/dist/lib/secret-scan/staged.js

@@ -4,6 +4,8 @@
 import { execFileSync } from "node:child_process";
 import { readFileSync, statSync } from "node:fs";
 import { scanFragment, scanPath } from "./detect.js";
+import { loadRepoAllowlists } from "./repo-config.js";
+import { compiledRules } from "./rules.js";
 export class ScanInputError extends Error {
 }
 const DIFF_ARGS = [
@@ -89,9 +91,24 @@ export function stagedDiff(cwd) {
         throw new ScanInputError(`could not read the staged changes: ${detail || "git diff failed"}`);
     }
 }
+export function repoRoot(cwd) {
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    }
+    catch (err) {
+        const detail = err instanceof Error && "stderr" in err ? String(err.stderr).trim() : String(err);
+        throw new ScanInputError(`could not find the repo root: ${detail || "git rev-parse failed"}`);
+    }
+}
+/**
+ * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
+ * relative to the repo root, as gitleaks' allowlist paths are.
+ */
 export function scanStaged(cwd) {
-    const { fragments, binaryFiles } = parseUnifiedDiff(stagedDiff(cwd));
-    return [...fragments.flatMap((f) => scanFragment(f)), ...binaryFiles.flatMap((f) => scanPath(f))];
+    const diff = stagedDiff(cwd);
+    const rules = { ...compiledRules(), repo: loadRepoAllowlists(repoRoot(cwd)) };
+    const { fragments, binaryFiles } = parseUnifiedDiff(diff);
+    return [...fragments.flatMap((f) => scanFragment(f, rules)), ...binaryFiles.flatMap((f) => scanPath(f, rules))];
 }
 export function scanFiles(paths) {
     const out = [];

package/dist/lib/secret-scan/types.d.ts

@@ -9,6 +9,8 @@ export interface GitleaksAllowlist {
     regexes?: string[];
     stopwords?: string[];
     commits?: string[];
+    /** Repo allowlists only: limit the allowlist to these rule ids. */
+    targetRules?: string[];
 }
 export interface GitleaksRule {
     id: string;

package/dist/lib/sync/server-owned-local-only.d.ts

@@ -0,0 +1,29 @@
+/** Company-relative folders the server owns and a client push never uploads. */
+export declare const SERVER_OWNED_FOLDERS: readonly string[];
+/**
+ * True for a company-relative path a client push refuses as server-owned.
+ * Mirrors hq-cloud's `isLocallyIneligibleForPush` with the entity exception:
+ * `ontology/entities/` can be client-owned, so it is not reported here.
+ */
+export declare function isServerOwnedNeverPushed(rel: string): boolean;
+export type ServerOwnedLocalOnlyResult = {
+    files: string[];
+    total: number;
+};
+export type FindServerOwnedLocalOnlyOptions = {
+    hqRoot: string;
+    slug: string;
+    /** Company-relative keys already in the sync journal (live or tombstoned). */
+    journalKeys: ReadonlySet<string>;
+    /** Engine ignore filter over absolute paths; true = would sync. */
+    shouldSync?: (absPath: string, isDir?: boolean) => boolean;
+    /** Max paths returned; `total` still counts every match. */
+    limit?: number;
+};
+/**
+ * Walk the server-owned folders under `companies/<slug>/` and return files
+ * that are not in the journal. A journaled file arrived by pull and is in
+ * sync; anything else was written locally and will never upload.
+ */
+export declare function findServerOwnedLocalOnly(opts: FindServerOwnedLocalOnlyOptions): ServerOwnedLocalOnlyResult;
+//# sourceMappingURL=server-owned-local-only.d.ts.map

package/dist/lib/sync/server-owned-local-only.js

@@ -0,0 +1,75 @@
+/**
+ * Local-only files under server-owned vault folders (feedback_0414d71c).
+ *
+ * The sync engine treats `sources/`, `signals/` and the non-entity part of
+ * `ontology/` as cloud-authoritative: the server pipeline writes them and a
+ * client push refuses them (`refuse-server-owned` in hq-cloud's share plan,
+ * see hq-cloud `src/lib/cloud-authoritative.ts`). The recurring runner skips
+ * them quietly, so a file written locally into one of these folders never
+ * reaches the vault and nothing reports it as pending. `hq sync status` lists
+ * them so the gap is visible.
+ *
+ * Read-only and network-free: the walk covers only the server-owned folders
+ * and the "already synced" set is the company's sync journal the caller
+ * already has.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+/** Company-relative folders the server owns and a client push never uploads. */
+export const SERVER_OWNED_FOLDERS = ["sources", "signals", "ontology"];
+/**
+ * True for a company-relative path a client push refuses as server-owned.
+ * Mirrors hq-cloud's `isLocallyIneligibleForPush` with the entity exception:
+ * `ontology/entities/` can be client-owned, so it is not reported here.
+ */
+export function isServerOwnedNeverPushed(rel) {
+    const vaultRel = rel.split("\\").join("/").replace(/^\.?\//, "");
+    if (vaultRel.startsWith("ontology/entities/"))
+        return false;
+    return SERVER_OWNED_FOLDERS.some((folder) => vaultRel.startsWith(`${folder}/`));
+}
+/**
+ * Walk the server-owned folders under `companies/<slug>/` and return files
+ * that are not in the journal. A journaled file arrived by pull and is in
+ * sync; anything else was written locally and will never upload.
+ */
+export function findServerOwnedLocalOnly(opts) {
+    const root = path.join(opts.hqRoot, "companies", opts.slug);
+    const limit = opts.limit ?? 20;
+    const found = [];
+    const stack = SERVER_OWNED_FOLDERS.map((folder) => path.join(root, folder));
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const abs = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (entry.name === ".git" || entry.name === "node_modules")
+                    continue;
+                if (opts.shouldSync && !opts.shouldSync(abs, true))
+                    continue;
+                stack.push(abs);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (opts.shouldSync && !opts.shouldSync(abs, false))
+                continue;
+            const rel = path.relative(root, abs).split(path.sep).join("/");
+            if (!isServerOwnedNeverPushed(rel))
+                continue;
+            if (opts.journalKeys.has(rel))
+                continue;
+            found.push(rel);
+        }
+    }
+    found.sort((a, b) => a.localeCompare(b));
+    return { files: found.slice(0, limit), total: found.length };
+}
+//# sourceMappingURL=server-owned-local-only.js.map

package/dist/utils/package-use-lease.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { utimes } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -152,6 +152,29 @@ export function packageUseLeaseDirectory(prefix, stateDirectory = packageUseStat
 function packageUseUpdateRequestPath(prefix, stateDirectory) {
     return path.join(packageUseLeaseDirectory(prefix, stateDirectory), UPDATE_REQUEST);
 }
+// os.uptime() has whole-second resolution, so allow a small margin before
+// calling a request older than the current boot.
+const BOOT_TIME_MARGIN_MS = 5_000;
+/**
+ * An update request is stale when it was written before the current boot (its
+ * pid may have been reused by an unrelated process since), or when its pid is
+ * gone (ESRCH) or belongs to another user (EPERM). The updater always runs as
+ * the same user as the CLI, so a pid we may not signal is not our updater.
+ */
+function updateRequestIsStale(requestPath, pid) {
+    const bootTimeMs = Date.now() - os.uptime() * 1000;
+    if (statSync(requestPath).mtimeMs < bootTimeMs - BOOT_TIME_MARGIN_MS)
+        return true;
+    try {
+        process.kill(pid, 0);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ESRCH" || code === "EPERM")
+            return true;
+    }
+    return false;
+}
 function waitForUpdateRequest(requestPath, timeoutMs, notify = null) {
     const started = Date.now();
     let notified = false;
@@ -163,14 +186,9 @@ function waitForUpdateRequest(requestPath, timeoutMs, notify = null) {
             if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) {
                 throw new Error("invalid update request");
             }
-            try {
-                process.kill(pid, 0);
-            }
-            catch (error) {
-                if (error.code === "ESRCH") {
-                    rmSync(requestPath, { force: true });
-                    return;
-                }
+            if (updateRequestIsStale(requestPath, pid)) {
+                rmSync(requestPath, { force: true });
+                return;
             }
         }
         catch (error) {