@indigoai-us/hq-cli 5.345.163 → 5.345.165

package/dist/lib/secret-scan/repo-config.js

@@ -18,13 +18,24 @@
  * literal prefix (`^golden/...`); `regexes` and `stopwords` need
  * `condition = "AND"`, so they never reach files outside those paths.
  *
+ * File scans (`hq scan secrets <files> --repo`, used by pr-check) honor only
+ * exact-value exemptions: each allowlist names its paths and lists, in
+ * `stopwords`, the exact secret values it allows (e.g. known digests). A
+ * detected secret is allowed only when it equals one of them. Regexes,
+ * targetRules, commits, regexTarget and path-only allowlists are rejected
+ * there, because a pattern can always be widened, alone or combined with other
+ * entries, to hide a real credential.
+ *
  * Fails closed: anything not acceptable is a ScanConfigError, and the scan
  * exits 2 rather than running with a guess.
  */
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { parse } from "smol-toml";
 import { compileGoRegex } from "./go-regex.js";
-import { compileAllowlist } from "./rules.js";
+import { scanFragment } from "./detect.js";
+import { credentialProbes } from "./probes.js";
+import { compileAllowlist, compiledRules } from "./rules.js";
 export class ScanConfigError extends Error {
 }
 export const REPO_CONFIG_FILE = ".gitleaks.toml";
@@ -37,6 +48,25 @@ const MAX_REGEX_LENGTH = 256;
 const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[*+}](?:[^()\\]|\\.)*\)[*+{]/;
 /** Paths no real allowlist path should match all of. */
 const PROBE_PATHS = ["a", ".env", "src/index.ts", "config/credentials.yml", "deep/nested/dir/file.json"];
+/** File the probes are placed in; the allowlist's own paths are treated as matching it. */
+const PROBE_FILE = "probe/settings.txt";
+let probeBaseline;
+function probeFragment(line) {
+    return { file: PROBE_FILE, text: `${line}\n`, startLine: 1 };
+}
+/**
+ * The first probe credential the allowlist would hide, judged as the detector
+ * judges it (every regex ORed, every check combined by its condition, its
+ * targetRules applied), for a file at one of its paths. undefined: none.
+ */
+export function suppressedProbe(al) {
+    const base = compiledRules();
+    const probes = credentialProbes();
+    probeBaseline ??= probes.map((p) => scanFragment(probeFragment(p.line), base).length > 0);
+    const atPath = { ...al, paths: al.paths.length ? [/(?:)/] : [] };
+    const rules = { ...base, repo: [atPath] };
+    return probes.find((p, i) => probeBaseline[i] && scanFragment(probeFragment(p.line), rules).length === 0);
+}
 function fail(file, where, msg) {
     throw new ScanConfigError(`${file}: ${where}: ${msg}`);
 }
@@ -96,16 +126,38 @@ function topLevelAlternation(src) {
     }
     return false;
 }
-function compileChecked(file, where, key, src) {
+/**
+ * How an error names an exemption value: its length and a short hash, never
+ * the value itself, which may be a real credential (e.g. one with a typo).
+ */
+function redact(value) {
+    return `<${value.length} chars, sha256:${createHash("sha256").update(value).digest("hex").slice(0, 12)}>`;
+}
+/** Names a regexes entry by index and redacted value; paths are shown as written. */
+function entryName(key, src, i) {
+    return key === "paths" ? `paths entry ${JSON.stringify(src)}` : `${key}[${i}] ${redact(src)}`;
+}
+function compileChecked(file, where, key, src, i = 0) {
     if (src.length > MAX_REGEX_LENGTH)
         fail(file, where, `${key} entry is longer than ${MAX_REGEX_LENGTH} characters`);
     if (NESTED_QUANTIFIER.test(src))
-        fail(file, where, `${key} entry ${JSON.stringify(src)} has a nested quantifier; simplify it`);
+        fail(file, where, `${entryName(key, src, i)} has a nested quantifier; simplify it`);
     try {
         return compileGoRegex(src);
     }
     catch (err) {
-        fail(file, where, `${key} entry ${JSON.stringify(src)} is not a supported regex (${err instanceof Error ? err.message : String(err)})`);
+        fail(file, where, `${entryName(key, src, i)} is not a supported regex${key === "paths" ? ` (${err instanceof Error ? err.message : String(err)})` : ""}`);
+    }
+}
+function checkPaths(file, where, paths) {
+    for (const src of paths) {
+        const re = compileChecked(file, where, "paths", src);
+        if (literalPathPrefix(src) < MIN_PATH_PREFIX || topLevelAlternation(src)) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} must start with ^ and at least ${MIN_PATH_PREFIX} literal characters (e.g. '^fixtures/')`);
+        }
+        if (re.test("") || PROBE_PATHS.every((p) => re.test(p))) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} matches everything; allowlist specific files`);
+        }
     }
 }
 function validate(file, where, raw) {
@@ -141,37 +193,29 @@ function validate(file, where, raw) {
     if (!al.paths?.length) {
         fail(file, where, "needs paths, each starting with ^ and a literal directory or file name (e.g. '^fixtures/')");
     }
-    for (const src of al.paths) {
-        const re = compileChecked(file, where, "paths", src);
-        if (literalPathPrefix(src) < MIN_PATH_PREFIX || topLevelAlternation(src)) {
-            fail(file, where, `paths entry ${JSON.stringify(src)} must start with ^ and at least ${MIN_PATH_PREFIX} literal characters (e.g. '^fixtures/')`);
-        }
-        if (re.test("") || PROBE_PATHS.every((p) => re.test(p))) {
-            fail(file, where, `paths entry ${JSON.stringify(src)} matches everything; allowlist specific files`);
-        }
-    }
+    checkPaths(file, where, al.paths);
     if ((al.regexes?.length || al.stopwords?.length) && al.condition !== "AND") {
         fail(file, where, 'regexes and stopwords need condition = "AND", so they only apply inside paths');
     }
-    for (const src of al.regexes ?? []) {
-        if (compileChecked(file, where, "regexes", src).test(""))
-            fail(file, where, `regexes entry ${JSON.stringify(src)} matches everything`);
-    }
-    for (const s of al.stopwords ?? []) {
+    al.regexes?.forEach((src, i) => compileChecked(file, where, "regexes", src, i));
+    al.stopwords?.forEach((s, i) => {
         if (s.trim().length < MIN_STOPWORD)
-            fail(file, where, `stopword ${JSON.stringify(s)} is shorter than ${MIN_STOPWORD} characters`);
+            fail(file, where, `stopwords[${i}] ${redact(s)} is shorter than ${MIN_STOPWORD} characters`);
+    });
+    // A path-only allowlist exempts the files it names. One with content checks
+    // must still report a real credential in those files, so run the detector on
+    // the probe corpus with this allowlist, exactly as a scan would apply it.
+    if (al.regexes?.length || al.stopwords?.length) {
+        const hidden = suppressedProbe(compileAllowlist(al));
+        if (hidden) {
+            fail(file, where, `matches everything: it would hide a real ${hidden.kind} credential in its paths; narrow its regexes or stopwords to the known false positive`);
+        }
     }
     return al;
 }
 /** Validated allowlists from the text of a .gitleaks.toml. */
 export function parseRepoAllowlists(text, file = REPO_CONFIG_FILE) {
-    let doc;
-    try {
-        doc = parse(text);
-    }
-    catch (err) {
-        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
-    }
+    const doc = parseToml(text, file);
     const out = [];
     if (doc.allowlist !== undefined)
         out.push(validate(file, "[allowlist]", doc.allowlist));
@@ -182,6 +226,75 @@ export function parseRepoAllowlists(text, file = REPO_CONFIG_FILE) {
     }
     return out.map(compileAllowlist);
 }
+/** Shortest exact value a file-scan allowlist may list; real secrets and digests are longer. */
+const MIN_EXACT_VALUE = 16;
+const EXACT_KEYS = new Set(["description", "condition", "paths", "stopwords"]);
+/**
+ * A file-scan allowlist: paths plus the exact secret values to allow, listed
+ * in `stopwords`. Anything pattern-based is rejected (see the top of the file).
+ */
+function validateExact(file, where, raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        fail(file, where, "must be a table");
+    const t = raw;
+    for (const k of Object.keys(t)) {
+        if (!KEYS.has(k))
+            fail(file, where, `unknown key "${k}"`);
+        if (!EXACT_KEYS.has(k)) {
+            fail(file, where, `file scans honor only exact-value exemptions: remove "${k}" and list the exact secret values in stopwords`);
+        }
+    }
+    if (t.description !== undefined && typeof t.description !== "string")
+        fail(file, where, "description must be a string");
+    if (typeof t.condition !== "string" || t.condition.trim().toUpperCase() !== "AND") {
+        fail(file, where, 'file scans need condition = "AND", so the exact values only apply inside paths');
+    }
+    const paths = stringList(file, where, "paths", t.paths);
+    if (!paths?.length) {
+        fail(file, where, "needs paths, each starting with ^ and a literal directory or file name (e.g. '^fixtures/')");
+    }
+    checkPaths(file, where, paths);
+    const values = stringList(file, where, "stopwords", t.stopwords);
+    if (!values?.length) {
+        fail(file, where, "file scans honor only exact-value exemptions: list the exact secret values to allow in stopwords");
+    }
+    values.forEach((v, i) => {
+        if (v.length < MIN_EXACT_VALUE || /\s/.test(v)) {
+            fail(file, where, `stopwords[${i}] ${redact(v)} must be an exact secret value of at least ${MIN_EXACT_VALUE} characters with no spaces`);
+        }
+    });
+    return {
+        condition: "AND",
+        target: "secret",
+        paths: paths.map((p) => compileGoRegex(p)),
+        regexes: [],
+        stopwords: [],
+        commits: [],
+        targetRules: [],
+        exact: [...values],
+    };
+}
+/** Validated exact-value allowlists for a file scan, from the text of a .gitleaks.toml. */
+export function parseExactAllowlists(text, file = REPO_CONFIG_FILE) {
+    const doc = parseToml(text, file);
+    const out = [];
+    if (doc.allowlist !== undefined)
+        out.push(validateExact(file, "[allowlist]", doc.allowlist));
+    if (doc.allowlists !== undefined) {
+        if (!Array.isArray(doc.allowlists))
+            fail(file, "allowlists", "must be an array of tables ([[allowlists]])");
+        doc.allowlists.forEach((a, i) => out.push(validateExact(file, `[[allowlists]] #${i + 1}`, a)));
+    }
+    return out;
+}
+function parseToml(text, file) {
+    try {
+        return parse(text);
+    }
+    catch (err) {
+        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+    }
+}
 function git(repoRoot, args) {
     try {
         return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -228,10 +341,27 @@ export function loadRepoAllowlists(repoRoot) {
     // Changed in this commit: scan with the version already committed at HEAD.
     return headAllowlists(repoRoot);
 }
-function headAllowlists(repoRoot) {
+/**
+ * Exact-value allowlists from the copy committed at `rev` (default HEAD), for a
+ * file scan (`hq scan secrets --repo [--allowlist-rev]`). The index and working
+ * tree are ignored. pr-check passes the base branch, so a branch cannot exempt
+ * its own commits by adding an allowlist. An unknown rev is an error.
+ */
+export function loadCommittedAllowlists(repoRoot, rev = "HEAD") {
+    if (rev === "HEAD")
+        return headAllowlists(repoRoot, parseExactAllowlists);
+    if (rev.startsWith("-") || git(repoRoot, ["rev-parse", "--verify", "-q", `${rev}^{commit}`]) === null) {
+        throw new ScanConfigError(`allowlist rev ${JSON.stringify(rev)} is not a commit in ${repoRoot}`);
+    }
+    return revAllowlists(repoRoot, rev, parseExactAllowlists);
+}
+function headAllowlists(repoRoot, parser = parseRepoAllowlists) {
     if (git(repoRoot, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]) === null)
         return [];
-    const head = entry(git(repoRoot, ["ls-tree", "HEAD", "--", REPO_CONFIG_FILE]), 2);
-    return head ? parseRepoAllowlists(readEntry(repoRoot, head, "HEAD"), `${REPO_CONFIG_FILE} (HEAD)`) : [];
+    return revAllowlists(repoRoot, "HEAD", parser);
+}
+function revAllowlists(repoRoot, rev, parser) {
+    const e = entry(git(repoRoot, ["ls-tree", rev, "--", REPO_CONFIG_FILE]), 2);
+    return e ? parser(readEntry(repoRoot, e, rev), `${REPO_CONFIG_FILE} (${rev})`) : [];
 }
 //# sourceMappingURL=repo-config.js.map

package/dist/lib/secret-scan/rules.d.ts

@@ -12,6 +12,8 @@ export interface CompiledAllowlist {
     commits: string[];
     /** Empty: applies to every rule. */
     targetRules: string[];
+    /** Exact secret values: allows only a detected secret equal to one of them (file scans with a repo). */
+    exact?: string[];
 }
 export interface CompiledRule {
     id: string;

package/dist/lib/secret-scan/staged.d.ts

@@ -18,5 +18,19 @@ export declare function repoRoot(cwd: string): string;
  * relative to the repo root, as gitleaks' allowlist paths are.
  */
 export declare function scanStaged(cwd: string): SecretFinding[];
-export declare function scanFiles(paths: string[]): SecretFinding[];
+export interface ScanFilesOptions {
+    /**
+     * Apply this repo's committed .gitleaks.toml allowlists. Files under the repo
+     * are matched by their repo-relative path, as in a staged scan.
+     */
+    repo?: string;
+    /**
+     * Files laid out as <snapshotRoot>/<commit>/<repo path> (historical copies,
+     * as `commit-secret-scan.sh pr-check` writes them) are matched as <repo path>.
+     */
+    snapshotRoot?: string;
+    /** Read the allowlists from .gitleaks.toml at this commit instead of HEAD (pr-check passes its base). */
+    allowlistRev?: string;
+}
+export declare function scanFiles(paths: string[], opts?: ScanFilesOptions): SecretFinding[];
 //# sourceMappingURL=staged.d.ts.map

package/dist/lib/secret-scan/staged.js

@@ -2,9 +2,10 @@
  * Scan inputs: the staged diff of a git repo (pre-commit), or whole files.
  */
 import { execFileSync } from "node:child_process";
-import { readFileSync, statSync } from "node:fs";
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
 import { scanFragment, scanPath } from "./detect.js";
-import { loadRepoAllowlists } from "./repo-config.js";
+import { loadCommittedAllowlists, loadRepoAllowlists } from "./repo-config.js";
 import { compiledRules } from "./rules.js";
 export class ScanInputError extends Error {
 }
@@ -110,7 +111,43 @@ export function scanStaged(cwd) {
     const { fragments, binaryFiles } = parseUnifiedDiff(diff);
     return [...fragments.flatMap((f) => scanFragment(f, rules)), ...binaryFiles.flatMap((f) => scanPath(f, rules))];
 }
-export function scanFiles(paths) {
+/** `p` relative to `root`, or null when `p` is not inside `root`. */
+function inside(root, p) {
+    const rel = relative(root, p);
+    if (!rel || rel.startsWith("..") || isAbsolute(rel))
+        return null;
+    return rel.split(sep).join("/");
+}
+function real(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+/**
+ * The path allowlists see for `p`: repo-relative, or `<path>` for a snapshot at
+ * `<snapshotRoot>/<commit>/<path>`. null when `p` (after symlinks and `..`) is
+ * outside both roots: such a file gets no repo allowlist at all.
+ */
+function matchPath(p, repo, snapshotRoot) {
+    const abs = real(p);
+    if (snapshotRoot) {
+        const rel = inside(snapshotRoot, abs);
+        if (rel !== null) {
+            const slash = rel.indexOf("/");
+            if (slash > 0)
+                return rel.slice(slash + 1);
+        }
+    }
+    return inside(repo, abs);
+}
+export function scanFiles(paths, opts = {}) {
+    const root = opts.repo !== undefined ? repoRoot(opts.repo) : undefined;
+    const rules = root !== undefined ? { ...compiledRules(), repo: loadCommittedAllowlists(root, opts.allowlistRev) } : compiledRules();
+    const repo = root !== undefined ? real(root) : undefined;
+    const snapshotRoot = opts.snapshotRoot !== undefined ? real(opts.snapshotRoot) : undefined;
     const out = [];
     for (const p of paths) {
         let text;
@@ -122,7 +159,12 @@ export function scanFiles(paths) {
         catch (err) {
             throw new ScanInputError(`could not read ${p}: ${err instanceof Error ? err.message : String(err)}`);
         }
-        out.push(...scanPath(p), ...scanFragment({ file: p, text, startLine: 1 }));
+        const mapped = repo !== undefined ? matchPath(p, repo, snapshotRoot) : p;
+        const file = mapped ?? p;
+        const use = mapped === null ? compiledRules() : rules;
+        // Findings still name the file as given, so a history copy keeps its commit folder.
+        const found = [...scanPath(file, use), ...scanFragment({ file, text, startLine: 1 }, use)];
+        out.push(...found.map((f) => ({ ...f, file: p })));
     }
     return out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.163",
+  "version": "5.345.165",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.163",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.163",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.163",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.163",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.163",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.163"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.165",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.165",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.165",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.165",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.165",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.165"
   }
 }