@indigoai-us/hq-cli 5.345.156 → 5.345.160

package/dist/lib/mesh/api.js

@@ -515,6 +515,81 @@ export async function registerMeshProject(token, companyUid, projectId, channelI
         channelCreated: result?.channelCreated === true,
     };
 }
+// ---------------------------------------------------------------------------
+// Project lifecycle (active | completed | archived)
+// ---------------------------------------------------------------------------
+export const PROJECT_LIFECYCLE_STATUSES = ["active", "completed", "archived"];
+function lifecycleFromRow(row) {
+    const rec = asRecord(row);
+    const projectId = String(rec?.projectId || "").trim();
+    const status = String(rec?.status || "").trim();
+    const version = Number(rec?.version);
+    if (!projectId || !Number.isSafeInteger(version) || version < 0)
+        return null;
+    if (!PROJECT_LIFECYCLE_STATUSES.includes(status))
+        return null;
+    return {
+        projectId,
+        status: status,
+        version,
+        updatedAt: String(rec?.updatedAt || ""),
+        updatedBy: String(rec?.updatedBy || ""),
+    };
+}
+/**
+ * List every lifecycle row for a company (follows the 25-row server pages).
+ * A project with no row has never left `active` and is not listed.
+ */
+export async function listProjectLifecycles(token, companyUid) {
+    const rows = [];
+    let cursor;
+    // Bounded so a server that keeps returning the same cursor cannot loop forever.
+    for (let page = 0; page < 200; page += 1) {
+        const data = asRecord(await meshJson(token, "/v1/work-mesh/project-lifecycle", {
+            query: { companyUid, ...(cursor ? { cursor } : {}) },
+        }));
+        const projects = Array.isArray(data?.projects) ? data.projects : [];
+        for (const row of projects) {
+            const parsed = lifecycleFromRow(row);
+            if (parsed)
+                rows.push(parsed);
+        }
+        const next = typeof data?.nextCursor === "string" ? data.nextCursor.trim() : "";
+        if (!next || next === cursor)
+            break;
+        cursor = next;
+    }
+    return rows;
+}
+/** The lifecycle row for one project, or null when it has never been changed. */
+export async function getProjectLifecycle(token, companyUid, projectId) {
+    const rows = await listProjectLifecycles(token, companyUid);
+    return rows.find((row) => row.projectId === projectId) ?? null;
+}
+/**
+ * PATCH /v1/work-mesh/projects/{id}/lifecycle. `expectedVersion` is the
+ * current lifecycle row version (0 when the project has no row yet). The
+ * server answers 409 BOARD_NONEMPTY when archiving a Board that still has
+ * stories unless `confirmNonempty` is set, and a plain 409 on a version
+ * mismatch. Nothing is deleted: stories, folder, channel, members and
+ * history stay; the project only leaves the active list and the organize
+ * candidates.
+ */
+export async function setProjectLifecycle(token, companyUid, projectId, change) {
+    const data = await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/lifecycle`, {
+        method: "PATCH",
+        query: { companyUid },
+        body: {
+            status: change.status,
+            expectedVersion: change.expectedVersion,
+            ...(change.confirmNonempty ? { confirmNonempty: true } : {}),
+        },
+    });
+    const parsed = lifecycleFromRow(data);
+    if (!parsed)
+        throw new Error("Work mesh returned an invalid project lifecycle row");
+    return parsed;
+}
 export function pairDmUidsFromInbox(inbox) {
     const rec = asRecord(inbox);
     const ids = new Set();

package/dist/lib/plan-limit-nag.d.ts

@@ -79,22 +79,6 @@ export declare function recordPlanLimitStatus(body: unknown, opts?: {
  * never claims the workspace has stopped working.
  */
 export declare function buildOverLine(overEntries: Array<[string, PlanLimitEntry]>, upgradeUrl: string): string;
-/**
- * My Telemetry is an Individual-plan feature on a personal scope (owner
- * decision 9 / us-044-individual-plan-design.md §11). When hq-pro refuses it,
- * the CLI prints this notice INSTEAD of telemetry output.
- *
- * It lives beside the nag copy so plan wording stays in one file, but it is
- * NOT part of the nag model: no persistence, no throttle, no episode state. It
- * is rendered once, on the spot, by whoever received the refusal. The refusal
- * is a plan fact, so it neither counts toward the nag bands nor is silenced by
- * the nag cadence.
- *
- * Copy names the plan and its price only — no Outposts, no bot pricing (owner
- * decisions 10 and 11).
- */
-export declare const INDIVIDUAL_PLAN_NAME = "Individual";
-export declare const INDIVIDUAL_PRICE_LABEL = "$50/mo";
 /**
  * The notice a personal feature refusal prints. `upgradeUrl` is the server's
  * own checkout target; an older hq-pro sends none, and the line then names the

package/dist/lib/plan-limit-nag.js

@@ -367,16 +367,18 @@ export function buildOverLine(overEntries, upgradeUrl) {
     const facts = overEntries
         .map(([key, entry]) => `${PLAN_LIMIT_DIMENSION_LABELS[key] ?? key} ${entry.used} of ${entry.limit}`)
         .join(", ");
-    return (`⚠ HQ Starter: ${facts}. New files and new secrets are paused. ` +
-        `Upgrade: ${upgradeUrl}`);
+    // US-024: names no plan and offers no upgrade; the link is the Billing page.
+    return (`⚠ Over this account's limits: ${facts}. New files and new secrets are paused. ` +
+        `Billing: ${upgradeUrl}`);
 }
 // ---------------------------------------------------------------------------
-// Individual-plan feature notice (US-054)
+// Personal feature notice (US-054, copy per US-024)
 // ---------------------------------------------------------------------------
 /**
- * My Telemetry is an Individual-plan feature on a personal scope (owner
- * decision 9 / us-044-individual-plan-design.md §11). When hq-pro refuses it,
- * the CLI prints this notice INSTEAD of telemetry output.
+ * My Telemetry is a paid feature on a personal scope (owner decision 9 /
+ * us-044-individual-plan-design.md §11). When hq-pro refuses it, the CLI
+ * prints this notice INSTEAD of telemetry output. The flat personal plan is
+ * closed (US-024), so the notice names no plan or price.
  *
  * It lives beside the nag copy so plan wording stays in one file, but it is
  * NOT part of the nag model: no persistence, no throttle, no episode state. It
@@ -384,11 +386,8 @@ export function buildOverLine(overEntries, upgradeUrl) {
  * is a plan fact, so it neither counts toward the nag bands nor is silenced by
  * the nag cadence.
  *
- * Copy names the plan and its price only — no Outposts, no bot pricing (owner
- * decisions 10 and 11).
+ * No Outposts and no bot pricing in the copy (owner decisions 10 and 11).
  */
-export const INDIVIDUAL_PLAN_NAME = "Individual";
-export const INDIVIDUAL_PRICE_LABEL = "$50/mo";
 /** Human names for the features a personal scope can be refused. */
 const PERSONAL_FEATURE_LABELS = {
     telemetry: "My Telemetry",
@@ -403,11 +402,11 @@ export function renderPersonalPlanFeatureNotice(feature, upgradeUrl, opts = {})
     // A person on usage pricing has no Individual plan to buy (US-012).
     if (isUsageOnly(opts.pricingPlan))
         return usageOnlyPersonalFeatureNotice(label);
-    const headline = `${label} is included with the HQ ${INDIVIDUAL_PLAN_NAME} plan (${INDIVIDUAL_PRICE_LABEL}).`;
+    const headline = `${label} is not included on your personal account's current billing.`;
     const action = typeof upgradeUrl === "string" && upgradeUrl.trim().length > 0
-        ? `Upgrade: ${upgradeUrl.trim()}`
-        : "Upgrade in your HQ billing settings.";
-    return `${headline} Your personal account is on the free tier. ${action}`;
+        ? `Billing: ${upgradeUrl.trim()}`
+        : "See your HQ billing settings.";
+    return `${headline} ${action}`;
 }
 /** `"{resource}:{band}"` — the persisted key, matching the server's own. */
 function crossingKey(crossing) {
@@ -429,9 +428,9 @@ export function renderThresholdNotice(crossing, upgradeUrl) {
     const name = dimensionName(crossing.resource);
     const counts = `${crossing.used} of ${crossing.limit}`;
     const headline = crossing.band === "over"
-        ? `HQ Starter: you are past your ${name} limit (${counts}).`
-        : `HQ Starter: you have reached 80% of your ${name} (${counts}).`;
-    return `${headline} Upgrade: ${upgradeUrl}`;
+        ? `You are past your ${name} limit (${counts}).`
+        : `You have reached 80% of your ${name} limit (${counts}).`;
+    return `${headline} Billing: ${upgradeUrl}`;
 }
 /**
  * Print every crossing this machine has not already printed for this episode.
@@ -521,7 +520,7 @@ export function emitPlanLimitNag(opts = {}) {
         if (worst === null)
             return;
         warningShownThisSession = true;
-        const line = `⚠ HQ Starter: ${formatEntryLine(worst.key, worst.entry)}. Add headroom before you hit the cap: ${resolvedUpgradeUrl}`;
+        const line = `⚠ Nearing this account's limits: ${formatEntryLine(worst.key, worst.entry)}. Make room before you hit the cap. Billing: ${resolvedUpgradeUrl}`;
         write(chalk.yellow(line) + "\n");
         if (isCliLimitResourceKind(worst.key)) {
             queueCliLimitNoticeExposure(worst.key, "advisory");

package/dist/lib/secret-scan/detect.js

@@ -36,6 +36,8 @@ function allowed(al, c) {
         const lower = c.secret.toLowerCase();
         checks.push(al.stopwords.some((s) => lower.includes(s)));
     }
+    if (al.commits.length)
+        checks.push(c.commit !== undefined && al.commits.includes(c.commit.toLowerCase()));
     if (!checks.length)
         return false;
     return al.condition === "AND" ? checks.every(Boolean) : checks.some(Boolean);
@@ -50,6 +52,10 @@ function lineBounds(text, start, end) {
             offset++;
     return { line: text.slice(from, to), offset };
 }
+/** A repo allowlist applies to this rule (no targetRules means every rule). */
+function repoAllowed(rules, ruleId, c) {
+    return (rules.repo ?? []).some((al) => (!al.targetRules.length || al.targetRules.includes(ruleId)) && allowed(al, c));
+}
 /** True when the global allowlist excludes this path from scanning. */
 export function pathIgnored(file, rules = compiledRules()) {
     return rules.global.paths.some((p) => p.test(file));
@@ -60,6 +66,7 @@ export function scanPath(file, rules = compiledRules()) {
         return [];
     return rules.rules
         .filter((r) => !r.regex && r.path?.test(file))
+        .filter((r) => !repoAllowed(rules, r.id, { file, secret: "", match: "", line: "" }))
         .map((r) => ({ ruleId: r.id, description: r.description, file, line: 1 }));
 }
 export function scanFragment(frag, rules = compiledRules()) {
@@ -103,6 +110,8 @@ export function scanFragment(frag, rules = compiledRules()) {
                 continue;
             if (rule.allowlists.some((al) => allowed(al, cand)))
                 continue;
+            if (repoAllowed(rules, rule.id, cand))
+                continue;
             const lineNo = startLine + offset;
             const key = `${rule.id}:${lineNo}`;
             if (seen.has(key))

package/dist/lib/secret-scan/repo-config.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Repo-level allowlists: `[[allowlists]]` (and the legacy `[allowlist]`) from
+ * the scanned repo's own `.gitleaks.toml`, with gitleaks semantics for
+ * `paths`, `regexes`, `regexTarget`, `stopwords`, `commits`, `targetRules` and
+ * `condition`. They apply on top of the built-in rules and allowlists, to that
+ * repo only. Repo `[[rules]]`, `[extend]` and the rest of the file are ignored:
+ * a repo can allow known false positives, not change what is detected.
+ *
+ * The file is read from git, never the working tree:
+ *   - The staged (index) copy applies only when it is identical to the copy
+ *     already committed at HEAD (or at MERGE_HEAD during a merge). A commit
+ *     that changes the allowlist is scanned with the HEAD allowlist, so
+ *     widening the allowlist and adding the secret cannot happen in one commit.
+ *   - A changed staged copy is still validated, so a broken file fails now.
+ *   - A symlinked .gitleaks.toml is rejected.
+ *
+ * Narrow by construction: every allowlist needs `paths`, each anchored with a
+ * literal prefix (`^golden/...`); `regexes` and `stopwords` need
+ * `condition = "AND"`, so they never reach files outside those paths.
+ *
+ * Fails closed: anything not acceptable is a ScanConfigError, and the scan
+ * exits 2 rather than running with a guess.
+ */
+import { type CompiledAllowlist } from "./rules.js";
+export declare class ScanConfigError extends Error {
+}
+export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
+/**
+ * Length of the literal text right after a leading `^`: letters, digits,
+ * `/ _ - @ ~` and backslash-escaped punctuation. A quantifier on the last
+ * literal makes it optional, so it does not count.
+ */
+export declare function literalPathPrefix(src: string): number;
+/** Validated allowlists from the text of a .gitleaks.toml. */
+export declare function parseRepoAllowlists(text: string, file?: string): CompiledAllowlist[];
+/**
+ * Compiled allowlists for a staged scan of the repo at `repoRoot`, read from
+ * git as described at the top of this file. [] when the repo has none.
+ */
+export declare function loadRepoAllowlists(repoRoot: string): CompiledAllowlist[];
+//# sourceMappingURL=repo-config.d.ts.map

package/dist/lib/secret-scan/repo-config.js

@@ -0,0 +1,237 @@
+/**
+ * Repo-level allowlists: `[[allowlists]]` (and the legacy `[allowlist]`) from
+ * the scanned repo's own `.gitleaks.toml`, with gitleaks semantics for
+ * `paths`, `regexes`, `regexTarget`, `stopwords`, `commits`, `targetRules` and
+ * `condition`. They apply on top of the built-in rules and allowlists, to that
+ * repo only. Repo `[[rules]]`, `[extend]` and the rest of the file are ignored:
+ * a repo can allow known false positives, not change what is detected.
+ *
+ * The file is read from git, never the working tree:
+ *   - The staged (index) copy applies only when it is identical to the copy
+ *     already committed at HEAD (or at MERGE_HEAD during a merge). A commit
+ *     that changes the allowlist is scanned with the HEAD allowlist, so
+ *     widening the allowlist and adding the secret cannot happen in one commit.
+ *   - A changed staged copy is still validated, so a broken file fails now.
+ *   - A symlinked .gitleaks.toml is rejected.
+ *
+ * Narrow by construction: every allowlist needs `paths`, each anchored with a
+ * literal prefix (`^golden/...`); `regexes` and `stopwords` need
+ * `condition = "AND"`, so they never reach files outside those paths.
+ *
+ * Fails closed: anything not acceptable is a ScanConfigError, and the scan
+ * exits 2 rather than running with a guess.
+ */
+import { execFileSync } from "node:child_process";
+import { parse } from "smol-toml";
+import { compileGoRegex } from "./go-regex.js";
+import { compileAllowlist } from "./rules.js";
+export class ScanConfigError extends Error {
+}
+export const REPO_CONFIG_FILE = ".gitleaks.toml";
+const KEYS = new Set(["description", "condition", "regexTarget", "paths", "regexes", "stopwords", "commits", "targetRules"]);
+const MIN_PATH_PREFIX = 3;
+const MIN_STOPWORD = 3;
+/** User regexes run on JavaScript's backtracking engine, not RE2. */
+const MAX_REGEX_LENGTH = 256;
+/** A quantified group that itself contains a quantifier, e.g. (a+)+ or (?:x*y)*. */
+const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[*+}](?:[^()\\]|\\.)*\)[*+{]/;
+/** Paths no real allowlist path should match all of. */
+const PROBE_PATHS = ["a", ".env", "src/index.ts", "config/credentials.yml", "deep/nested/dir/file.json"];
+function fail(file, where, msg) {
+    throw new ScanConfigError(`${file}: ${where}: ${msg}`);
+}
+function stringList(file, where, key, v) {
+    if (v === undefined)
+        return undefined;
+    if (!Array.isArray(v) || v.some((x) => typeof x !== "string"))
+        fail(file, where, `${key} must be a list of strings`);
+    return v;
+}
+/**
+ * Length of the literal text right after a leading `^`: letters, digits,
+ * `/ _ - @ ~` and backslash-escaped punctuation. A quantifier on the last
+ * literal makes it optional, so it does not count.
+ */
+export function literalPathPrefix(src) {
+    if (!src.startsWith("^"))
+        return 0;
+    let n = 0;
+    let i = 1;
+    while (i < src.length) {
+        const ch = src[i];
+        if (/[A-Za-z0-9/_\-@~]/.test(ch)) {
+            n++;
+            i++;
+        }
+        else if (ch === "\\" && i + 1 < src.length && /[^A-Za-z0-9]/.test(src[i + 1])) {
+            n++;
+            i += 2;
+        }
+        else {
+            break;
+        }
+    }
+    if (n > 0 && /^[*?{]/.test(src.slice(i)))
+        n--;
+    return n;
+}
+/** True when `src` has a `|` outside any group, which would bypass the `^` prefix. */
+function topLevelAlternation(src) {
+    let depth = 0;
+    let inClass = false;
+    for (let i = 0; i < src.length; i++) {
+        const ch = src[i];
+        if (ch === "\\")
+            i++;
+        else if (inClass)
+            inClass = ch !== "]";
+        else if (ch === "[")
+            inClass = true;
+        else if (ch === "(")
+            depth++;
+        else if (ch === ")")
+            depth--;
+        else if (ch === "|" && depth === 0)
+            return true;
+    }
+    return false;
+}
+function compileChecked(file, where, key, src) {
+    if (src.length > MAX_REGEX_LENGTH)
+        fail(file, where, `${key} entry is longer than ${MAX_REGEX_LENGTH} characters`);
+    if (NESTED_QUANTIFIER.test(src))
+        fail(file, where, `${key} entry ${JSON.stringify(src)} has a nested quantifier; simplify it`);
+    try {
+        return compileGoRegex(src);
+    }
+    catch (err) {
+        fail(file, where, `${key} entry ${JSON.stringify(src)} is not a supported regex (${err instanceof Error ? err.message : String(err)})`);
+    }
+}
+function validate(file, where, raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        fail(file, where, "must be a table");
+    const t = raw;
+    for (const k of Object.keys(t))
+        if (!KEYS.has(k))
+            fail(file, where, `unknown key "${k}"`);
+    if (t.description !== undefined && typeof t.description !== "string")
+        fail(file, where, "description must be a string");
+    let condition;
+    if (t.condition !== undefined) {
+        const c = typeof t.condition === "string" ? t.condition.trim().toUpperCase() : "";
+        if (c !== "OR" && c !== "AND")
+            fail(file, where, 'condition must be "AND" or "OR"');
+        condition = c;
+    }
+    if (t.regexTarget !== undefined && t.regexTarget !== "secret" && t.regexTarget !== "match" && t.regexTarget !== "line") {
+        fail(file, where, 'regexTarget must be "secret", "match" or "line"');
+    }
+    const al = {
+        condition,
+        regexTarget: t.regexTarget,
+        paths: stringList(file, where, "paths", t.paths),
+        regexes: stringList(file, where, "regexes", t.regexes),
+        stopwords: stringList(file, where, "stopwords", t.stopwords),
+        commits: stringList(file, where, "commits", t.commits),
+        targetRules: stringList(file, where, "targetRules", t.targetRules),
+    };
+    // A repo may narrow what is reported, never switch the scanner off: every
+    // allowlist is scoped to files named by an anchored literal prefix.
+    if (!al.paths?.length) {
+        fail(file, where, "needs paths, each starting with ^ and a literal directory or file name (e.g. '^fixtures/')");
+    }
+    for (const src of al.paths) {
+        const re = compileChecked(file, where, "paths", src);
+        if (literalPathPrefix(src) < MIN_PATH_PREFIX || topLevelAlternation(src)) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} must start with ^ and at least ${MIN_PATH_PREFIX} literal characters (e.g. '^fixtures/')`);
+        }
+        if (re.test("") || PROBE_PATHS.every((p) => re.test(p))) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} matches everything; allowlist specific files`);
+        }
+    }
+    if ((al.regexes?.length || al.stopwords?.length) && al.condition !== "AND") {
+        fail(file, where, 'regexes and stopwords need condition = "AND", so they only apply inside paths');
+    }
+    for (const src of al.regexes ?? []) {
+        if (compileChecked(file, where, "regexes", src).test(""))
+            fail(file, where, `regexes entry ${JSON.stringify(src)} matches everything`);
+    }
+    for (const s of al.stopwords ?? []) {
+        if (s.trim().length < MIN_STOPWORD)
+            fail(file, where, `stopword ${JSON.stringify(s)} is shorter than ${MIN_STOPWORD} characters`);
+    }
+    return al;
+}
+/** Validated allowlists from the text of a .gitleaks.toml. */
+export function parseRepoAllowlists(text, file = REPO_CONFIG_FILE) {
+    let doc;
+    try {
+        doc = parse(text);
+    }
+    catch (err) {
+        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+    }
+    const out = [];
+    if (doc.allowlist !== undefined)
+        out.push(validate(file, "[allowlist]", doc.allowlist));
+    if (doc.allowlists !== undefined) {
+        if (!Array.isArray(doc.allowlists))
+            fail(file, "allowlists", "must be an array of tables ([[allowlists]])");
+        doc.allowlists.forEach((a, i) => out.push(validate(file, `[[allowlists]] #${i + 1}`, a)));
+    }
+    return out.map(compileAllowlist);
+}
+function git(repoRoot, args) {
+    try {
+        return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    }
+    catch {
+        return null;
+    }
+}
+/** `<mode> <type> <blob>\t<path>` (ls-tree, blobField 2) or `<mode> <blob> <stage>\t<path>` (ls-files -s, blobField 1). */
+function entry(out, blobField) {
+    const line = out?.split("\n").find(Boolean);
+    if (!line)
+        return null;
+    const f = line.split("\t")[0].split(" ");
+    return { mode: f[0], blob: f[blobField] };
+}
+function readEntry(repoRoot, e, where) {
+    if (e.mode === "120000")
+        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) is a symlink; commit a regular file`);
+    const text = git(repoRoot, ["cat-file", "blob", e.blob]);
+    if (text === null)
+        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) could not be read from git`);
+    return text;
+}
+/**
+ * Compiled allowlists for a staged scan of the repo at `repoRoot`, read from
+ * git as described at the top of this file. [] when the repo has none.
+ */
+export function loadRepoAllowlists(repoRoot) {
+    const lsFiles = git(repoRoot, ["ls-files", "-s", "--", REPO_CONFIG_FILE]);
+    // Only a resolved (stage 0) index entry counts. A conflicted .gitleaks.toml
+    // has stages 1-3 and no stage 0; it is not trusted and the HEAD copy is used.
+    const stage0 = lsFiles?.split("\n").find((l) => l.split("\t")[0].split(" ")[2] === "0") ?? null;
+    const staged = entry(stage0, 1);
+    if (!staged)
+        return lsFiles?.trim() ? headAllowlists(repoRoot) : [];
+    const stagedLists = parseRepoAllowlists(readEntry(repoRoot, staged, "staged"));
+    const committed = ["HEAD", "MERGE_HEAD"]
+        .filter((rev) => git(repoRoot, ["rev-parse", "--verify", "-q", `${rev}^{commit}`]) !== null)
+        .map((rev) => ({ rev, e: entry(git(repoRoot, ["ls-tree", rev, "--", REPO_CONFIG_FILE]), 2) }))
+        .filter((c) => c.e !== null);
+    if (committed.some((c) => c.e.blob === staged.blob && c.e.mode === staged.mode))
+        return stagedLists;
+    // Changed in this commit: scan with the version already committed at HEAD.
+    return headAllowlists(repoRoot);
+}
+function headAllowlists(repoRoot) {
+    if (git(repoRoot, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]) === null)
+        return [];
+    const head = entry(git(repoRoot, ["ls-tree", "HEAD", "--", REPO_CONFIG_FILE]), 2);
+    return head ? parseRepoAllowlists(readEntry(repoRoot, head, "HEAD"), `${REPO_CONFIG_FILE} (HEAD)`) : [];
+}
+//# sourceMappingURL=repo-config.js.map

package/dist/lib/secret-scan/rules.d.ts

@@ -2,13 +2,16 @@
  * Compiled rule set: the vendored gitleaks default rules plus HQ's own token
  * patterns (src/lib/core-utils/secret-patterns.ts). Compiled once per process.
  */
-import type { GitleaksRule } from "./types.js";
+import type { GitleaksAllowlist, GitleaksRule } from "./types.js";
 export interface CompiledAllowlist {
     condition: "OR" | "AND";
     target: "secret" | "match" | "line";
     paths: RegExp[];
     regexes: RegExp[];
     stopwords: string[];
+    commits: string[];
+    /** Empty: applies to every rule. */
+    targetRules: string[];
 }
 export interface CompiledRule {
     id: string;
@@ -24,7 +27,10 @@ export interface CompiledRule {
 export interface CompiledRuleSet {
     global: CompiledAllowlist;
     rules: CompiledRule[];
+    /** Allowlists from the scanned repo's own .gitleaks.toml (see repo-config.ts). */
+    repo?: CompiledAllowlist[];
 }
+export declare function compileAllowlist(a: GitleaksAllowlist): CompiledAllowlist;
 /** HQ's own patterns, expressed as gitleaks-shaped rules. */
 export declare function hqRules(): GitleaksRule[];
 export declare function compiledRules(): CompiledRuleSet;

package/dist/lib/secret-scan/rules.js

@@ -5,13 +5,15 @@
 import { SECRET_PATTERNS } from "../core-utils/secret-patterns.js";
 import { GITLEAKS_CONFIG } from "./gitleaks-rules.generated.js";
 import { compileGoRegex } from "./go-regex.js";
-function compileAllowlist(a) {
+export function compileAllowlist(a) {
     return {
         condition: a.condition === "AND" ? "AND" : "OR",
         target: a.regexTarget ?? "secret",
         paths: (a.paths ?? []).map((p) => compileGoRegex(p)),
         regexes: (a.regexes ?? []).map((r) => compileGoRegex(r)),
         stopwords: (a.stopwords ?? []).map((s) => s.toLowerCase()),
+        commits: (a.commits ?? []).map((c) => c.toLowerCase()),
+        targetRules: a.targetRules ?? [],
     };
 }
 function compileRule(r) {

package/dist/lib/secret-scan/staged.d.ts

@@ -12,6 +12,11 @@ export interface ParsedDiff {
 /** Parse `git diff --unified=0` output into one fragment of added lines per hunk. */
 export declare function parseUnifiedDiff(diff: string): ParsedDiff;
 export declare function stagedDiff(cwd: string): string;
+export declare function repoRoot(cwd: string): string;
+/**
+ * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
+ * relative to the repo root, as gitleaks' allowlist paths are.
+ */
 export declare function scanStaged(cwd: string): SecretFinding[];
 export declare function scanFiles(paths: string[]): SecretFinding[];
 //# sourceMappingURL=staged.d.ts.map

package/dist/lib/secret-scan/staged.js

@@ -4,6 +4,8 @@
 import { execFileSync } from "node:child_process";
 import { readFileSync, statSync } from "node:fs";
 import { scanFragment, scanPath } from "./detect.js";
+import { loadRepoAllowlists } from "./repo-config.js";
+import { compiledRules } from "./rules.js";
 export class ScanInputError extends Error {
 }
 const DIFF_ARGS = [
@@ -89,9 +91,24 @@ export function stagedDiff(cwd) {
         throw new ScanInputError(`could not read the staged changes: ${detail || "git diff failed"}`);
     }
 }
+export function repoRoot(cwd) {
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    }
+    catch (err) {
+        const detail = err instanceof Error && "stderr" in err ? String(err.stderr).trim() : String(err);
+        throw new ScanInputError(`could not find the repo root: ${detail || "git rev-parse failed"}`);
+    }
+}
+/**
+ * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
+ * relative to the repo root, as gitleaks' allowlist paths are.
+ */
 export function scanStaged(cwd) {
-    const { fragments, binaryFiles } = parseUnifiedDiff(stagedDiff(cwd));
-    return [...fragments.flatMap((f) => scanFragment(f)), ...binaryFiles.flatMap((f) => scanPath(f))];
+    const diff = stagedDiff(cwd);
+    const rules = { ...compiledRules(), repo: loadRepoAllowlists(repoRoot(cwd)) };
+    const { fragments, binaryFiles } = parseUnifiedDiff(diff);
+    return [...fragments.flatMap((f) => scanFragment(f, rules)), ...binaryFiles.flatMap((f) => scanPath(f, rules))];
 }
 export function scanFiles(paths) {
     const out = [];

package/dist/lib/secret-scan/types.d.ts

@@ -9,6 +9,8 @@ export interface GitleaksAllowlist {
     regexes?: string[];
     stopwords?: string[];
     commits?: string[];
+    /** Repo allowlists only: limit the allowlist to these rule ids. */
+    targetRules?: string[];
 }
 export interface GitleaksRule {
     id: string;

package/dist/lib/sync/server-owned-local-only.d.ts

@@ -0,0 +1,29 @@
+/** Company-relative folders the server owns and a client push never uploads. */
+export declare const SERVER_OWNED_FOLDERS: readonly string[];
+/**
+ * True for a company-relative path a client push refuses as server-owned.
+ * Mirrors hq-cloud's `isLocallyIneligibleForPush` with the entity exception:
+ * `ontology/entities/` can be client-owned, so it is not reported here.
+ */
+export declare function isServerOwnedNeverPushed(rel: string): boolean;
+export type ServerOwnedLocalOnlyResult = {
+    files: string[];
+    total: number;
+};
+export type FindServerOwnedLocalOnlyOptions = {
+    hqRoot: string;
+    slug: string;
+    /** Company-relative keys already in the sync journal (live or tombstoned). */
+    journalKeys: ReadonlySet<string>;
+    /** Engine ignore filter over absolute paths; true = would sync. */
+    shouldSync?: (absPath: string, isDir?: boolean) => boolean;
+    /** Max paths returned; `total` still counts every match. */
+    limit?: number;
+};
+/**
+ * Walk the server-owned folders under `companies/<slug>/` and return files
+ * that are not in the journal. A journaled file arrived by pull and is in
+ * sync; anything else was written locally and will never upload.
+ */
+export declare function findServerOwnedLocalOnly(opts: FindServerOwnedLocalOnlyOptions): ServerOwnedLocalOnlyResult;
+//# sourceMappingURL=server-owned-local-only.d.ts.map