@indigoai-us/hq-cli 5.345.163 → 5.345.165

package/dist/lib/mesh/live/daemon/work-subscribe.js

@@ -4,46 +4,67 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { randomUUID } from "node:crypto";
 import { createPersonalRealtimeFetcher, } from "./credentials.js";
 import { presignIotWssUrl } from "./presign.js";
 import { applyProjectViewPush, parseProjectViewPush } from "./live-cache.js";
 import { backoffDelayMs, RECONNECT_MIN_DELAY_MS } from "./presence.js";
-import { AGENT_INBOX_PUSH_STATE_BASENAME } from "../paths.js";
-export { AGENT_INBOX_PUSH_STATE_BASENAME } from "../paths.js";
+import { AGENT_INBOX_PUSH_STATE_BASENAME, SYNC_WAKE_STATE_BASENAME } from "../paths.js";
+export { AGENT_INBOX_PUSH_STATE_BASENAME, SYNC_WAKE_STATE_BASENAME } from "../paths.js";
 const INBOX_PUSH_HEARTBEAT_MS = 5_000;
-function readInboxWakeSequence(meshRoot, onInfo) {
-    const target = path.join(meshRoot, AGENT_INBOX_PUSH_STATE_BASENAME);
+function readWakeSequence(meshRoot, basename, label, onInfo) {
+    const target = path.join(meshRoot, basename);
     try {
         const info = fs.lstatSync(target);
         if (!info.isFile() || info.isSymbolicLink()) {
-            onInfo?.("agent inbox push state read ignored (not a regular file)");
-            return 0;
+            onInfo?.(`${label} state read ignored (not a regular file)`);
+            return { sequence: 0, writable: false };
         }
         const parsed = JSON.parse(fs.readFileSync(target, "utf8"));
         if (Number.isSafeInteger(parsed.wakeSequence) && Number(parsed.wakeSequence) >= 0) {
-            return Number(parsed.wakeSequence);
+            return { sequence: Number(parsed.wakeSequence), writable: true };
         }
-        onInfo?.("agent inbox push state read ignored (invalid wake sequence)");
-        return 0;
+        onInfo?.(`${label} state read ignored (invalid wake sequence)`);
+        return { sequence: 0, writable: false };
     }
     catch (error) {
         if (error.code !== "ENOENT") {
             const name = error instanceof Error ? error.name : "UnknownError";
-            onInfo?.(`agent inbox push state read failed (${name})`);
+            onInfo?.(`${label} state read failed (${name})`);
         }
-        return 0;
+        return { sequence: 0, writable: error.code === "ENOENT" };
     }
 }
-function writeInboxPushState(meshRoot, state) {
+function writeWakeState(meshRoot, basename, state, durable) {
     fs.mkdirSync(meshRoot, { recursive: true, mode: 0o700 });
-    const target = path.join(meshRoot, AGENT_INBOX_PUSH_STATE_BASENAME);
-    const temporary = `${target}.${process.pid}.tmp`;
+    const rootInfo = fs.lstatSync(meshRoot);
+    if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) {
+        throw new Error("wake state root is not a regular directory");
+    }
+    const target = path.join(meshRoot, basename);
+    const temporary = path.join(meshRoot, `.${basename}.${process.pid}.${randomUUID()}.tmp`);
+    let file;
     try {
-        fs.writeFileSync(temporary, `${JSON.stringify(state)}\n`, { mode: 0o600 });
-        fs.chmodSync(temporary, 0o600);
+        file = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
+        fs.writeFileSync(file, `${JSON.stringify(state)}\n`);
+        if (durable)
+            fs.fsyncSync(file);
+        fs.closeSync(file);
+        file = undefined;
         fs.renameSync(temporary, target);
+        if (durable && process.platform !== "win32") {
+            const directory = fs.openSync(meshRoot, fs.constants.O_RDONLY);
+            try {
+                fs.fsyncSync(directory);
+            }
+            finally {
+                fs.closeSync(directory);
+            }
+        }
     }
     catch (error) {
+        if (file !== undefined)
+            fs.closeSync(file);
         try {
             fs.unlinkSync(temporary);
         }
@@ -79,37 +100,46 @@ export async function startWorkCacheSubscriber(opts) {
     let heartbeatTimer = null;
     let generation = 0;
     let inboxSubscribed = false;
-    let inboxAgentUid;
-    // Carry the sequence forward from the last state marker so a daemon restart
-    // cannot reuse a value the watcher has already consumed.
-    let wakeSequence = readInboxWakeSequence(opts.meshRoot, opts.onInfo);
+    let syncSubscribed = false;
+    let actorUid;
+    let inboxWakeSequence = readWakeSequence(opts.meshRoot, AGENT_INBOX_PUSH_STATE_BASENAME, "agent inbox push", opts.onInfo).sequence;
+    const syncWakeState = readWakeSequence(opts.meshRoot, SYNC_WAKE_STATE_BASENAME, "sync wake", opts.onInfo);
+    let syncWakeSequence = syncWakeState.sequence;
+    const syncStateWritable = syncWakeState.writable;
     const clearInboxHeartbeat = () => {
         if (heartbeatTimer !== null)
             timers.clearTimeout(heartbeatTimer);
         heartbeatTimer = null;
     };
-    const persistInboxState = (connected) => {
+    const persistState = (basename, label, connected, wakeSequence, identity, durable = true) => {
         try {
-            writeInboxPushState(opts.meshRoot, {
+            writeWakeState(opts.meshRoot, basename, {
                 connected,
                 heartbeatAtMs: now().getTime(),
                 wakeSequence,
-                ...(connected && inboxAgentUid ? { agentUid: inboxAgentUid } : {}),
-            });
+                ...(connected && actorUid && identity ? { [identity]: actorUid } : {}),
+            }, durable);
         }
         catch (error) {
             const name = error instanceof Error ? error.name : "UnknownError";
-            opts.onInfo?.(`agent inbox push state write failed (${name})`);
+            opts.onInfo?.(`${label} state write failed (${name})`);
         }
     };
+    const persistInboxState = (connected, durable = true) => persistState(AGENT_INBOX_PUSH_STATE_BASENAME, "agent inbox push", connected, inboxWakeSequence, "agentUid", durable);
+    const persistSyncState = (connected, durable = true) => syncStateWritable
+        ? persistState(SYNC_WAKE_STATE_BASENAME, "sync wake", connected, syncWakeSequence, undefined, durable)
+        : undefined;
     const scheduleInboxHeartbeat = () => {
-        if (stopped || !inboxSubscribed)
+        if (stopped || (!inboxSubscribed && !syncSubscribed))
             return;
         clearInboxHeartbeat();
         heartbeatTimer = timers.setTimeout(() => {
             heartbeatTimer = null;
-            if (!stopped && inboxSubscribed) {
-                persistInboxState(true);
+            if (!stopped && (inboxSubscribed || syncSubscribed)) {
+                if (inboxSubscribed)
+                    persistInboxState(true, false);
+                if (syncSubscribed)
+                    persistSyncState(true, false);
                 scheduleInboxHeartbeat();
             }
         }, INBOX_PUSH_HEARTBEAT_MS);
@@ -118,9 +148,11 @@ export async function startWorkCacheSubscriber(opts) {
         if (stopped)
             return;
         inboxSubscribed = false;
-        inboxAgentUid = undefined;
+        syncSubscribed = false;
+        actorUid = undefined;
         clearInboxHeartbeat();
         persistInboxState(false);
+        persistSyncState(false);
         const gen = ++generation;
         let bundle;
         try {
@@ -137,14 +169,15 @@ export async function startWorkCacheSubscriber(opts) {
             bundle.topics.inbox === `hq/${bundle.actorUid}/inbox`
             ? bundle.topics.inbox
             : undefined;
-        inboxAgentUid = inboxTopic ? bundle.actorUid : undefined;
-        if (!topic && !inboxTopic) {
+        const syncTopic = syncStateWritable ? `hq/${bundle.actorUid}/sync` : undefined;
+        actorUid = inboxTopic || syncTopic ? bundle.actorUid : undefined;
+        if (!topic && !inboxTopic && !syncTopic) {
             opts.onInfo?.("work cache subscribe skipped: credentials have no supported topic");
             return;
         }
         const url = presignIotWssUrl(bundle.credentials, bundle.iotEndpoint, bundle.region, now());
         const next = opts.mqttConnect(url, {
-            clientId: `${bundle.clientId}-work`,
+            clientId: bundle.clientId,
             clean: true,
             reconnectPeriod: 0,
             protocolVersion: 4,
@@ -154,7 +187,8 @@ export async function startWorkCacheSubscriber(opts) {
             if (stopped || gen !== generation)
                 return;
             reconnectLogged = false;
-            let pendingSubscriptions = Number(Boolean(topic)) + Number(Boolean(inboxTopic));
+            let pendingSubscriptions = Number(Boolean(topic)) + Number(Boolean(inboxTopic)) +
+                Number(Boolean(syncTopic));
             let subscriptionFailed = false;
             const finishSubscription = (err) => {
                 if (err) {
@@ -171,6 +205,13 @@ export async function startWorkCacheSubscriber(opts) {
                 if (pendingSubscriptions === 0)
                     attempt = 0;
             };
+            const finishOptionalSubscription = () => {
+                if (subscriptionFailed)
+                    return;
+                pendingSubscriptions -= 1;
+                if (pendingSubscriptions === 0)
+                    attempt = 0;
+            };
             if (topic) {
                 next.subscribe(topic, { qos: 1 }, (err) => finishSubscription(err));
             }
@@ -180,7 +221,6 @@ export async function startWorkCacheSubscriber(opts) {
                         return;
                     if (err) {
                         inboxSubscribed = false;
-                        inboxAgentUid = undefined;
                         clearInboxHeartbeat();
                         persistInboxState(false);
                         opts.onInfo?.("agent inbox push subscribe failed");
@@ -193,17 +233,37 @@ export async function startWorkCacheSubscriber(opts) {
                     finishSubscription();
                 });
             }
+            if (syncTopic) {
+                next.subscribe(syncTopic, { qos: 1 }, (err) => {
+                    if (stopped || gen !== generation)
+                        return;
+                    if (err) {
+                        syncSubscribed = false;
+                        persistSyncState(false);
+                        opts.onInfo?.("sync wake subscribe failed");
+                        finishOptionalSubscription();
+                        return;
+                    }
+                    syncSubscribed = true;
+                    persistSyncState(true);
+                    scheduleInboxHeartbeat();
+                    finishSubscription();
+                });
+            }
         });
         next.on("message", (_topic, payload) => {
             if (stopped || gen !== generation)
                 return;
             if (inboxTopic && _topic === inboxTopic && inboxSubscribed) {
-                // A topic message is a doorbell only. Never parse, persist, or log its
-                // content; the authenticated inbox GET remains the source of truth.
-                wakeSequence += 1;
+                inboxWakeSequence += 1;
                 persistInboxState(true);
                 return;
             }
+            if (syncTopic && _topic === syncTopic && syncSubscribed) {
+                syncWakeSequence += 1;
+                persistSyncState(true);
+                return;
+            }
             if (_topic !== topic)
                 return;
             const push = parseProjectViewPush(payload);
@@ -214,13 +274,33 @@ export async function startWorkCacheSubscriber(opts) {
                 opts.onInfo?.(`project-view cache cursor=${result.cursor} ${push.companyUid}/${push.projectId}`);
             }
         });
+        next.on("error", (_error) => {
+            if (stopped || gen !== generation)
+                return;
+            inboxSubscribed = false;
+            syncSubscribed = false;
+            actorUid = undefined;
+            clearInboxHeartbeat();
+            persistInboxState(false);
+            persistSyncState(false);
+            opts.onInfo?.("work cache mqtt error");
+            schedule();
+            try {
+                next.end(true);
+            }
+            catch {
+                return;
+            }
+        });
         next.on("close", () => {
             if (stopped || gen !== generation)
                 return;
             inboxSubscribed = false;
-            inboxAgentUid = undefined;
+            syncSubscribed = false;
+            actorUid = undefined;
             clearInboxHeartbeat();
             persistInboxState(false);
+            persistSyncState(false);
             schedule();
         });
     };
@@ -250,7 +330,10 @@ export async function startWorkCacheSubscriber(opts) {
                 timers.clearTimeout(timer);
             clearInboxHeartbeat();
             inboxSubscribed = false;
+            syncSubscribed = false;
+            actorUid = undefined;
             persistInboxState(false);
+            persistSyncState(false);
             const current = client;
             client = null;
             if (!current)

package/dist/lib/mesh/live/paths.d.ts

@@ -4,6 +4,7 @@
  */
 /** Content-free sequence file written by the mesh MQTT inbox subscriber. */
 export declare const AGENT_INBOX_PUSH_STATE_BASENAME = "agent-inbox-push.json";
+export declare const SYNC_WAKE_STATE_BASENAME = "sync-wake.json";
 export declare function workMeshRoot(home?: string, env?: NodeJS.ProcessEnv): string;
 export declare function workMeshSpoolPath(root?: string): string;
 export declare function workMeshHeldPath(root?: string): string;

package/dist/lib/mesh/live/paths.js

@@ -7,6 +7,7 @@ import * as path from "node:path";
 const WORK_MESH_DIRNAME = "work-mesh";
 /** Content-free sequence file written by the mesh MQTT inbox subscriber. */
 export const AGENT_INBOX_PUSH_STATE_BASENAME = "agent-inbox-push.json";
+export const SYNC_WAKE_STATE_BASENAME = "sync-wake.json";
 export function workMeshRoot(home = os.homedir(), env = process.env) {
     const override = env.HQ_WORK_MESH_ROOT?.trim();
     if (override)

package/dist/lib/secret-scan/detect.js

@@ -38,6 +38,8 @@ function allowed(al, c) {
     }
     if (al.commits.length)
         checks.push(c.commit !== undefined && al.commits.includes(c.commit.toLowerCase()));
+    if (al.exact?.length)
+        checks.push(al.exact.includes(c.secret));
     if (!checks.length)
         return false;
     return al.condition === "AND" ? checks.every(Boolean) : checks.some(Boolean);

package/dist/lib/secret-scan/probes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * A fixed corpus of realistic credential lines, used to judge a repo
+ * allowlist by what it does: each line is placed in a file at the allowlist's
+ * paths and run through the real detector. Values are generated from a fixed
+ * seed at runtime, so no secret-shaped literal sits in this file and the
+ * corpus is the same on every run.
+ */
+export interface Probe {
+    kind: string;
+    line: string;
+}
+export declare function credentialProbes(): Probe[];
+//# sourceMappingURL=probes.d.ts.map

package/dist/lib/secret-scan/probes.js

@@ -0,0 +1,69 @@
+/**
+ * A fixed corpus of realistic credential lines, used to judge a repo
+ * allowlist by what it does: each line is placed in a file at the allowlist's
+ * paths and run through the real detector. Values are generated from a fixed
+ * seed at runtime, so no secret-shaped literal sits in this file and the
+ * corpus is the same on every run.
+ */
+const UPPER = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+const LOWER = "abcdefghijklmnopqrstuvwxyz";
+const DIGITS = "0123456789";
+const ALNUM = UPPER + LOWER + DIGITS;
+const HEX = "0123456789abcdef";
+const B64URL = ALNUM + "-_";
+/** Deterministic xorshift32 generator. */
+function generator(seed) {
+    let s = seed >>> 0 || 1;
+    return (alphabet, n) => {
+        let out = "";
+        for (let i = 0; i < n; i++) {
+            s ^= s << 13;
+            s >>>= 0;
+            s ^= s >>> 17;
+            s ^= s << 5;
+            s >>>= 0;
+            out += alphabet[s % alphabet.length];
+        }
+        return out;
+    };
+}
+const b64url = (s) => Buffer.from(s).toString("base64url");
+const j = (...parts) => parts.join("");
+let cached;
+export function credentialProbes() {
+    if (cached)
+        return cached;
+    const r = generator(0x9e3779b9);
+    const probes = [];
+    const add = (kind, line) => probes.push({ kind, line });
+    // GitHub tokens: classic PAT, OAuth, app and fine-grained PAT.
+    add("GitHub PAT", `token = "${j("gh", "p_", r(ALNUM, 36))}"`);
+    add("GitHub PAT", `export GH_TOKEN=${j("gh", "o_", r(ALNUM, 36))}`);
+    add("GitHub PAT", `  "github": "${j("gh", "s_", r(ALNUM, 36))}",`);
+    add("GitHub PAT", j("gith", "ub_pat_", r(ALNUM, 22), "_", r(ALNUM, 59)));
+    // AWS access key ids.
+    add("AWS key", `aws_access_key_id = ${j("AK", "IA", r(UPPER + "234567", 16))}`);
+    add("AWS key", `AWS_ACCESS_KEY_ID="${j("AS", "IA", r(UPPER + "234567", 16))}"`);
+    add("AWS key", j("AK", "IA", r(UPPER + "234567", 16)));
+    // Slack bot and user tokens.
+    add("Slack token", `SLACK_BOT_TOKEN=${j("xo", "xb-", r(DIGITS, 12), "-", r(DIGITS, 13), "-", r(ALNUM, 24))}`);
+    add("Slack token", `slack: "${j("xo", "xb-", r(DIGITS, 11), "-", r(DIGITS, 12), "-", r(ALNUM, 24))}"`);
+    add("Slack token", `token = "${j("xo", "xp-", r(DIGITS, 12), "-", r(DIGITS, 12), "-", r(DIGITS, 13), "-", r(HEX, 32))}"`);
+    // 64-character hex secrets under credential-looking keys.
+    add("hex-64", `api_secret = "${r(HEX, 64)}"`);
+    add("hex-64", `  "auth_token": "${r(HEX, 64)}",`);
+    add("hex-64", `SECRET_KEY=${r(HEX, 64)}`);
+    // JWTs of different lengths.
+    for (const n of [24, 48, 96]) {
+        const header = b64url('{"alg":"HS256","typ":"JWT"}');
+        const payload = b64url(JSON.stringify({ sub: r(DIGITS, 10), name: r(LOWER, n / 4), iat: 1700000000 }));
+        add("JWT", `const jwt = "${header}.${payload}.${r(B64URL, 43)}";`);
+    }
+    // Generic key = value credentials of different lengths.
+    add("generic api_key", `api_key = "${r(ALNUM, 20)}"`);
+    add("generic api_key", `client_secret: '${r(ALNUM, 32)}'`);
+    add("generic api_key", `ACCESS_TOKEN=${r(ALNUM, 48)}`);
+    cached = probes;
+    return probes;
+}
+//# sourceMappingURL=probes.js.map

package/dist/lib/secret-scan/repo-config.d.ts

@@ -18,13 +18,28 @@
  * literal prefix (`^golden/...`); `regexes` and `stopwords` need
  * `condition = "AND"`, so they never reach files outside those paths.
  *
+ * File scans (`hq scan secrets <files> --repo`, used by pr-check) honor only
+ * exact-value exemptions: each allowlist names its paths and lists, in
+ * `stopwords`, the exact secret values it allows (e.g. known digests). A
+ * detected secret is allowed only when it equals one of them. Regexes,
+ * targetRules, commits, regexTarget and path-only allowlists are rejected
+ * there, because a pattern can always be widened, alone or combined with other
+ * entries, to hide a real credential.
+ *
  * Fails closed: anything not acceptable is a ScanConfigError, and the scan
  * exits 2 rather than running with a guess.
  */
+import { type Probe } from "./probes.js";
 import { type CompiledAllowlist } from "./rules.js";
 export declare class ScanConfigError extends Error {
 }
 export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
+/**
+ * The first probe credential the allowlist would hide, judged as the detector
+ * judges it (every regex ORed, every check combined by its condition, its
+ * targetRules applied), for a file at one of its paths. undefined: none.
+ */
+export declare function suppressedProbe(al: CompiledAllowlist): Probe | undefined;
 /**
  * Length of the literal text right after a leading `^`: letters, digits,
  * `/ _ - @ ~` and backslash-escaped punctuation. A quantifier on the last
@@ -33,9 +48,18 @@ export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
 export declare function literalPathPrefix(src: string): number;
 /** Validated allowlists from the text of a .gitleaks.toml. */
 export declare function parseRepoAllowlists(text: string, file?: string): CompiledAllowlist[];
+/** Validated exact-value allowlists for a file scan, from the text of a .gitleaks.toml. */
+export declare function parseExactAllowlists(text: string, file?: string): CompiledAllowlist[];
 /**
  * Compiled allowlists for a staged scan of the repo at `repoRoot`, read from
  * git as described at the top of this file. [] when the repo has none.
  */
 export declare function loadRepoAllowlists(repoRoot: string): CompiledAllowlist[];
+/**
+ * Exact-value allowlists from the copy committed at `rev` (default HEAD), for a
+ * file scan (`hq scan secrets --repo [--allowlist-rev]`). The index and working
+ * tree are ignored. pr-check passes the base branch, so a branch cannot exempt
+ * its own commits by adding an allowlist. An unknown rev is an error.
+ */
+export declare function loadCommittedAllowlists(repoRoot: string, rev?: string): CompiledAllowlist[];
 //# sourceMappingURL=repo-config.d.ts.map