@indigoai-us/hq-cli 5.345.164 → 5.345.165

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.345.165] — 2026-10-23
+- `hq billing sponsor grant <email|prs_id> --company <slug>` lets a company owner or admin put a member's personal plan on the company bill without a request first; `--all-members` does it for every active member and reports each person as covered, already covered, or skipped. `hq billing sponsor ungrant <email|prs_id>` takes it off again. hq-pro checks the owner/admin role and active membership.
+- `hq scan secrets <files...>` takes `--repo <dir>`, which applies that repo's committed `.gitleaks.toml` allowlists to a file scan, matching each file by its path relative to the repo, as a staged scan does. `--snapshot-root <dir>` (with `--repo`) matches files laid out as `<dir>/<commit>/<repo path>`, the history copies `commit-secret-scan.sh pr-check` writes, as `<repo path>`. Findings still name the files as given. Before this, a file scan ignored the repo's allowlists, so pr-check failed on false positives the commit gate already allowed. Without `--repo` a file scan is unchanged.
+- `--allowlist-rev <rev>` (with `--repo`) reads `.gitleaks.toml` from that commit instead of HEAD; pr-check passes its base branch, so a branch cannot exempt its own earlier commits by adding an allowlist later. An unknown rev exits 2.
+- A file that resolves (after `..` and symlinks) outside the repo and the snapshot root gets no repo allowlist, nor does a snapshot file without a commit folder.
+- A file scan with `--repo` honors only exact-value exemptions. Each allowlist needs `condition = "AND"` and specific `paths`, and lists in `stopwords` the exact secret values it allows, such as known manifest digests (at least 16 characters, no spaces). A detected secret is allowed only when it equals one of them, so other secrets in the same file are still reported. An allowlist with `regexes`, `regexTarget`, `targetRules` or `commits`, or with paths alone, is refused and the scan exits 2, because patterns, alone or combined across entries, can hide a real credential. Staged scans keep the full allowlist format; there each allowlist with content checks is judged by running the real detector on a fixed set of realistic credentials and refused if it hides any of them.
+- An allowlist validation error never prints an exemption value. It names the entry and position (for example `stopwords[0]`) with the value's length and a short SHA-256 prefix, so a credential typed into an allowlist by mistake does not reach terminal or CI logs.
+
 ## [5.345.164] — 2026-10-23
 - `hq billing status` and `hq billing usage --card` now show trial usage against the $500 trial cap, the $10 included usage, the spend limit and a prompt to add a card when usage passes the included amount. The plan line says "unavailable right now" instead of guessing Starter, invoice-billed companies read as a flat plan billed by invoice, and a failed read of a scheduled switch is reported.
 - `hq deploy domains` refuses a name that is really an IPv4 address. Inputs such as `1.2`, `0x7f.1` and `1.2.3.4` were rewritten to an address and accepted; a numeric last label is now refused before any request.

package/dist/command-catalog.generated.d.ts

@@ -6277,6 +6277,18 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--json";
             readonly description: "Print findings as JSON";
             readonly hidden: false;
+        }, {
+            readonly flags: "--repo <dir>";
+            readonly description: "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--snapshot-root <dir>";
+            readonly description: "With --repo: files under <dir>/<commit>/<path> are matched as <path>";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--allowlist-rev <rev>";
+            readonly description: "With --repo: read .gitleaks.toml from this commit instead of HEAD";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }];
@@ -8820,6 +8832,60 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "grant";
+            readonly description: "Admin: put a member's personal plan on the company bill, no request needed";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options] [person]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [{
+                readonly name: "person";
+                readonly required: false;
+                readonly variadic: false;
+                readonly description: "Member email or prs_ id";
+            }];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Company slug (resolves to companyUid)";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--all-members";
+                readonly description: "Sponsor every active member of the company";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--json";
+                readonly description: "Emit raw JSON";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "ungrant";
+            readonly description: "Admin: take a member's personal plan off the company bill";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options] <person>";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [{
+                readonly name: "person";
+                readonly required: true;
+                readonly variadic: false;
+                readonly description: "Member email or prs_ id";
+            }];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Company slug (resolves to companyUid)";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--json";
+                readonly description: "Emit raw JSON";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
         }];
     }, {
         readonly name: "usage";

package/dist/command-catalog.generated.js

@@ -7634,6 +7634,21 @@ export const COMMAND_CATALOG = [
                         "flags": "--json",
                         "description": "Print findings as JSON",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--repo <dir>",
+                        "description": "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--snapshot-root <dir>",
+                        "description": "With --repo: files under <dir>/<commit>/<path> are matched as <path>",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--allowlist-rev <rev>",
+                        "description": "With --repo: read .gitleaks.toml from this commit instead of HEAD",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []
@@ -10757,6 +10772,73 @@ export const COMMAND_CATALOG = [
                             }
                         ],
                         "subcommands": []
+                    },
+                    {
+                        "name": "grant",
+                        "description": "Admin: put a member's personal plan on the company bill, no request needed",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options] [person]",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "person",
+                                "required": false,
+                                "variadic": false,
+                                "description": "Member email or prs_ id"
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company slug (resolves to companyUid)",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--all-members",
+                                "description": "Sponsor every active member of the company",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit raw JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "ungrant",
+                        "description": "Admin: take a member's personal plan off the company bill",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options] <person>",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "person",
+                                "required": true,
+                                "variadic": false,
+                                "description": "Member email or prs_ id"
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company slug (resolves to companyUid)",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit raw JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
                     }
                 ]
             },

package/dist/commands/billing-sponsor.d.ts

@@ -13,6 +13,13 @@
  *   hq billing sponsor decline <id>        — admin: say no
  *   hq billing sponsor revoke  <id>        — admin: end an active sponsorship
  *   hq billing sponsor withdraw <id>       — me: take back my own request
+ *   hq billing sponsor grant <person> --company <slug>
+ *                                          — admin: sponsor a member's plan
+ *                                            directly, no request needed
+ *   hq billing sponsor grant --all-members --company <slug>
+ *                                          — admin: sponsor every active member
+ *   hq billing sponsor ungrant <person> --company <slug>
+ *                                          — admin: end a direct sponsorship
  *
  * Every subcommand talks to the SAME hq-pro routes the console uses
  * (`/v1/billing/sponsorship/...`). hq-pro is the authoritative gate on all of
@@ -82,6 +89,19 @@ export interface SponsorshipSelfState {
 }
 /** Plain label for a request status. Never shows the raw enum. */
 export declare function statusLabel(status: string): string;
+/** Per-person outcome of an owner/admin grant, as hq-pro returns it. */
+export interface PlanGrantResult {
+    personUid: string;
+    resourceId: string;
+    outcome: "sponsored" | "already_sponsored" | "sponsored_by_another_company" | "usage_pricing" | "not_a_member";
+}
+/** Plain line for one grant outcome. */
+export declare function grantOutcomeLabel(outcome: PlanGrantResult["outcome"]): string;
+/**
+ * Turn `<person>` into a person uid: a `prs_` uid passes through, an email is
+ * looked up in the company's active members. hq-pro re-checks membership.
+ */
+export declare function resolveMemberPersonUid(token: string, companyUid: string, person: string): Promise<string>;
 export declare function registerBillingSponsorCommands(billing: Command): void;
 export {};
 //# sourceMappingURL=billing-sponsor.d.ts.map

package/dist/commands/billing-sponsor.js

@@ -13,6 +13,13 @@
  *   hq billing sponsor decline <id>        — admin: say no
  *   hq billing sponsor revoke  <id>        — admin: end an active sponsorship
  *   hq billing sponsor withdraw <id>       — me: take back my own request
+ *   hq billing sponsor grant <person> --company <slug>
+ *                                          — admin: sponsor a member's plan
+ *                                            directly, no request needed
+ *   hq billing sponsor grant --all-members --company <slug>
+ *                                          — admin: sponsor every active member
+ *   hq billing sponsor ungrant <person> --company <slug>
+ *                                          — admin: end a direct sponsorship
  *
  * Every subcommand talks to the SAME hq-pro routes the console uses
  * (`/v1/billing/sponsorship/...`). hq-pro is the authoritative gate on all of
@@ -35,6 +42,7 @@ import { diagnosticsEnabled } from "../lib/diagnostics.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { isCompanySelectionError } from "../utils/company-selection-error.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { listActiveMembers } from "./members.js";
 import { fetchCompanyPricingPlan, fetchPersonPricingPlan, isUsageOnly, usageOnlySponsorLines, } from "../lib/billing/usage-only.js";
 /** The request kind this command files. Matches hq-pro's contract. */
 export const PLAN_RESOURCE = "plan";
@@ -90,6 +98,9 @@ export function messageForError(status, body) {
     if (status === 403) {
         return "You're not allowed to do that. Only an owner or admin of the company can answer a sponsorship request.";
     }
+    if (status === 404 && code === "NOT_A_MEMBER") {
+        return "That person isn't an active member of this company.";
+    }
     if (status === 404)
         return "No sponsorship request with that id.";
     if (status === 409 && code === "DUPLICATE_PENDING_REQUEST") {
@@ -168,6 +179,41 @@ async function transition(requestId, op) {
     });
     return { ...data.request, code: data.code, addCardUrl: data.addCardUrl };
 }
+/** Plain line for one grant outcome. */
+export function grantOutcomeLabel(outcome) {
+    switch (outcome) {
+        case "sponsored":
+            return "Now on the company bill";
+        case "already_sponsored":
+            return "Already on the company bill";
+        case "sponsored_by_another_company":
+            return "Skipped: another company already covers them";
+        case "usage_pricing":
+            return "Skipped: on usage pricing, no personal plan to cover";
+        case "not_a_member":
+            return "Skipped: not an active member";
+        default:
+            return outcome;
+    }
+}
+/**
+ * Turn `<person>` into a person uid: a `prs_` uid passes through, an email is
+ * looked up in the company's active members. hq-pro re-checks membership.
+ */
+export async function resolveMemberPersonUid(token, companyUid, person) {
+    const trimmed = person.trim();
+    if (/^prs_[A-Za-z0-9]+$/.test(trimmed))
+        return trimmed;
+    const email = trimmed.toLowerCase();
+    if (!/^[^\s]+@[^\s]+$/.test(email)) {
+        throw new SponsorError("Pass the person's email or their prs_ id.");
+    }
+    const members = await listActiveMembers(token, companyUid);
+    const match = members.find((m) => m.personEmail?.trim().toLowerCase() === email);
+    if (match?.personUid)
+        return match.personUid;
+    throw new SponsorError(`No active member has the email ${email}. Run \`hq members list\`.`);
+}
 /** Whether the sponsoring company is on usage pricing. Unknown counts as no. */
 async function companyIsUsageOnly(companyUid) {
     if (!companyUid)
@@ -402,5 +448,75 @@ export function registerBillingSponsorCommands(billing) {
             fail(err);
         }
     });
+    sponsor
+        .command("grant")
+        .argument("[person]", "Member email or prs_ id")
+        .description("Admin: put a member's personal plan on the company bill, no request needed")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--all-members", "Sponsor every active member of the company")
+        .option("--json", "Emit raw JSON")
+        .action(async function (person, opts) {
+        try {
+            if (Boolean(person) === Boolean(opts.allMembers)) {
+                throw new SponsorError("Name one person, or pass --all-members.");
+            }
+            const token = await ensureCognitoToken();
+            const named = opts.company ?? billing.opts().company;
+            const companyUid = await getCompanyUid(token, named);
+            const body = { companyUid };
+            if (person)
+                body.personUid = await resolveMemberPersonUid(token, companyUid, person);
+            else
+                body.allMembers = true;
+            const data = await callApi(token, "/v1/billing/sponsorship/plans", { method: "POST", body });
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+                return;
+            }
+            if (data.results.length === 0) {
+                console.log("No active members to sponsor.");
+                return;
+            }
+            for (const r of data.results) {
+                console.log(`  ${chalk.bold(r.personUid)}  ${grantOutcomeLabel(r.outcome)}`);
+            }
+            const added = data.results.filter((r) => r.outcome === "sponsored").length;
+            console.log(added === 1
+                ? "1 personal plan moved onto the company bill."
+                : `${added} personal plans moved onto the company bill.`);
+            const single = person ? data.results[0] : undefined;
+            if (single && single.outcome !== "sponsored" && single.outcome !== "already_sponsored") {
+                process.exitCode = 1;
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    sponsor
+        .command("ungrant")
+        .argument("<person>", "Member email or prs_ id")
+        .description("Admin: take a member's personal plan off the company bill")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (person, opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const named = opts.company ?? billing.opts().company;
+            const companyUid = await getCompanyUid(token, named);
+            const personUid = await resolveMemberPersonUid(token, companyUid, person);
+            const data = await callApi(token, "/v1/billing/sponsorship/plans", { method: "DELETE", body: { companyUid, personUid } });
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+                return;
+            }
+            console.log(data.revoked
+                ? "Ended. Their personal plan goes back to them from the next bill."
+                : "This company wasn't covering their plan. Nothing changed.");
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
 }
 //# sourceMappingURL=billing-sponsor.js.map

package/dist/commands/scan.d.ts

@@ -4,6 +4,9 @@
  *   hq scan secrets               scan the staged changes of the current repo
  *   hq scan secrets <file...>     scan whole files instead
  *   hq scan secrets --json        findings as JSON
+ *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
+ *                                 scan files with that repo's committed
+ *                                 .gitleaks.toml allowlists (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -18,6 +21,9 @@ import { Command } from "commander";
 interface ScanSecretsOptions {
     json?: boolean;
     staged?: boolean;
+    repo?: string;
+    snapshotRoot?: string;
+    allowlistRev?: string;
 }
 export declare function runScanSecrets(paths: string[], opts: ScanSecretsOptions, cwd?: string): number;
 export declare function registerScanCommand(program: Command): void;

package/dist/commands/scan.js

@@ -4,6 +4,9 @@
  *   hq scan secrets               scan the staged changes of the current repo
  *   hq scan secrets <file...>     scan whole files instead
  *   hq scan secrets --json        findings as JSON
+ *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
+ *                                 scan files with that repo's committed
+ *                                 .gitleaks.toml allowlists (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -31,7 +34,11 @@ function report(findings, scope) {
 export function runScanSecrets(paths, opts, cwd = process.cwd()) {
     let findings;
     try {
-        findings = paths.length && !opts.staged ? scanFiles(paths) : scanStaged(cwd);
+        if (opts.snapshotRoot !== undefined && opts.repo === undefined)
+            throw new ScanInputError("--snapshot-root needs --repo");
+        if (opts.allowlistRev !== undefined && opts.repo === undefined)
+            throw new ScanInputError("--allowlist-rev needs --repo");
+        findings = paths.length && !opts.staged ? scanFiles(paths, { repo: opts.repo, snapshotRoot: opts.snapshotRoot, allowlistRev: opts.allowlistRev }) : scanStaged(cwd);
     }
     catch (err) {
         const msg = err instanceof ScanInputError || err instanceof ScanConfigError ? err.message : `scan failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -56,6 +63,9 @@ export function registerScanCommand(program) {
         .argument("[files...]", "Scan these files instead of the staged changes")
         .option("--staged", "Scan the staged changes (default when no files are given)")
         .option("--json", "Print findings as JSON")
+        .option("--repo <dir>", "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths")
+        .option("--snapshot-root <dir>", "With --repo: files under <dir>/<commit>/<path> are matched as <path>")
+        .option("--allowlist-rev <rev>", "With --repo: read .gitleaks.toml from this commit instead of HEAD")
         .action((files, opts) => {
         process.exitCode = runScanSecrets(files ?? [], opts);
     });

package/dist/lib/secret-scan/detect.js

@@ -38,6 +38,8 @@ function allowed(al, c) {
     }
     if (al.commits.length)
         checks.push(c.commit !== undefined && al.commits.includes(c.commit.toLowerCase()));
+    if (al.exact?.length)
+        checks.push(al.exact.includes(c.secret));
     if (!checks.length)
         return false;
     return al.condition === "AND" ? checks.every(Boolean) : checks.some(Boolean);

package/dist/lib/secret-scan/probes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * A fixed corpus of realistic credential lines, used to judge a repo
+ * allowlist by what it does: each line is placed in a file at the allowlist's
+ * paths and run through the real detector. Values are generated from a fixed
+ * seed at runtime, so no secret-shaped literal sits in this file and the
+ * corpus is the same on every run.
+ */
+export interface Probe {
+    kind: string;
+    line: string;
+}
+export declare function credentialProbes(): Probe[];
+//# sourceMappingURL=probes.d.ts.map

package/dist/lib/secret-scan/probes.js

@@ -0,0 +1,69 @@
+/**
+ * A fixed corpus of realistic credential lines, used to judge a repo
+ * allowlist by what it does: each line is placed in a file at the allowlist's
+ * paths and run through the real detector. Values are generated from a fixed
+ * seed at runtime, so no secret-shaped literal sits in this file and the
+ * corpus is the same on every run.
+ */
+const UPPER = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+const LOWER = "abcdefghijklmnopqrstuvwxyz";
+const DIGITS = "0123456789";
+const ALNUM = UPPER + LOWER + DIGITS;
+const HEX = "0123456789abcdef";
+const B64URL = ALNUM + "-_";
+/** Deterministic xorshift32 generator. */
+function generator(seed) {
+    let s = seed >>> 0 || 1;
+    return (alphabet, n) => {
+        let out = "";
+        for (let i = 0; i < n; i++) {
+            s ^= s << 13;
+            s >>>= 0;
+            s ^= s >>> 17;
+            s ^= s << 5;
+            s >>>= 0;
+            out += alphabet[s % alphabet.length];
+        }
+        return out;
+    };
+}
+const b64url = (s) => Buffer.from(s).toString("base64url");
+const j = (...parts) => parts.join("");
+let cached;
+export function credentialProbes() {
+    if (cached)
+        return cached;
+    const r = generator(0x9e3779b9);
+    const probes = [];
+    const add = (kind, line) => probes.push({ kind, line });
+    // GitHub tokens: classic PAT, OAuth, app and fine-grained PAT.
+    add("GitHub PAT", `token = "${j("gh", "p_", r(ALNUM, 36))}"`);
+    add("GitHub PAT", `export GH_TOKEN=${j("gh", "o_", r(ALNUM, 36))}`);
+    add("GitHub PAT", `  "github": "${j("gh", "s_", r(ALNUM, 36))}",`);
+    add("GitHub PAT", j("gith", "ub_pat_", r(ALNUM, 22), "_", r(ALNUM, 59)));
+    // AWS access key ids.
+    add("AWS key", `aws_access_key_id = ${j("AK", "IA", r(UPPER + "234567", 16))}`);
+    add("AWS key", `AWS_ACCESS_KEY_ID="${j("AS", "IA", r(UPPER + "234567", 16))}"`);
+    add("AWS key", j("AK", "IA", r(UPPER + "234567", 16)));
+    // Slack bot and user tokens.
+    add("Slack token", `SLACK_BOT_TOKEN=${j("xo", "xb-", r(DIGITS, 12), "-", r(DIGITS, 13), "-", r(ALNUM, 24))}`);
+    add("Slack token", `slack: "${j("xo", "xb-", r(DIGITS, 11), "-", r(DIGITS, 12), "-", r(ALNUM, 24))}"`);
+    add("Slack token", `token = "${j("xo", "xp-", r(DIGITS, 12), "-", r(DIGITS, 12), "-", r(DIGITS, 13), "-", r(HEX, 32))}"`);
+    // 64-character hex secrets under credential-looking keys.
+    add("hex-64", `api_secret = "${r(HEX, 64)}"`);
+    add("hex-64", `  "auth_token": "${r(HEX, 64)}",`);
+    add("hex-64", `SECRET_KEY=${r(HEX, 64)}`);
+    // JWTs of different lengths.
+    for (const n of [24, 48, 96]) {
+        const header = b64url('{"alg":"HS256","typ":"JWT"}');
+        const payload = b64url(JSON.stringify({ sub: r(DIGITS, 10), name: r(LOWER, n / 4), iat: 1700000000 }));
+        add("JWT", `const jwt = "${header}.${payload}.${r(B64URL, 43)}";`);
+    }
+    // Generic key = value credentials of different lengths.
+    add("generic api_key", `api_key = "${r(ALNUM, 20)}"`);
+    add("generic api_key", `client_secret: '${r(ALNUM, 32)}'`);
+    add("generic api_key", `ACCESS_TOKEN=${r(ALNUM, 48)}`);
+    cached = probes;
+    return probes;
+}
+//# sourceMappingURL=probes.js.map

package/dist/lib/secret-scan/repo-config.d.ts

@@ -18,13 +18,28 @@
  * literal prefix (`^golden/...`); `regexes` and `stopwords` need
  * `condition = "AND"`, so they never reach files outside those paths.
  *
+ * File scans (`hq scan secrets <files> --repo`, used by pr-check) honor only
+ * exact-value exemptions: each allowlist names its paths and lists, in
+ * `stopwords`, the exact secret values it allows (e.g. known digests). A
+ * detected secret is allowed only when it equals one of them. Regexes,
+ * targetRules, commits, regexTarget and path-only allowlists are rejected
+ * there, because a pattern can always be widened, alone or combined with other
+ * entries, to hide a real credential.
+ *
  * Fails closed: anything not acceptable is a ScanConfigError, and the scan
  * exits 2 rather than running with a guess.
  */
+import { type Probe } from "./probes.js";
 import { type CompiledAllowlist } from "./rules.js";
 export declare class ScanConfigError extends Error {
 }
 export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
+/**
+ * The first probe credential the allowlist would hide, judged as the detector
+ * judges it (every regex ORed, every check combined by its condition, its
+ * targetRules applied), for a file at one of its paths. undefined: none.
+ */
+export declare function suppressedProbe(al: CompiledAllowlist): Probe | undefined;
 /**
  * Length of the literal text right after a leading `^`: letters, digits,
  * `/ _ - @ ~` and backslash-escaped punctuation. A quantifier on the last
@@ -33,9 +48,18 @@ export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
 export declare function literalPathPrefix(src: string): number;
 /** Validated allowlists from the text of a .gitleaks.toml. */
 export declare function parseRepoAllowlists(text: string, file?: string): CompiledAllowlist[];
+/** Validated exact-value allowlists for a file scan, from the text of a .gitleaks.toml. */
+export declare function parseExactAllowlists(text: string, file?: string): CompiledAllowlist[];
 /**
  * Compiled allowlists for a staged scan of the repo at `repoRoot`, read from
  * git as described at the top of this file. [] when the repo has none.
  */
 export declare function loadRepoAllowlists(repoRoot: string): CompiledAllowlist[];
+/**
+ * Exact-value allowlists from the copy committed at `rev` (default HEAD), for a
+ * file scan (`hq scan secrets --repo [--allowlist-rev]`). The index and working
+ * tree are ignored. pr-check passes the base branch, so a branch cannot exempt
+ * its own commits by adding an allowlist. An unknown rev is an error.
+ */
+export declare function loadCommittedAllowlists(repoRoot: string, rev?: string): CompiledAllowlist[];
 //# sourceMappingURL=repo-config.d.ts.map

package/dist/lib/secret-scan/repo-config.js

@@ -18,13 +18,24 @@
  * literal prefix (`^golden/...`); `regexes` and `stopwords` need
  * `condition = "AND"`, so they never reach files outside those paths.
  *
+ * File scans (`hq scan secrets <files> --repo`, used by pr-check) honor only
+ * exact-value exemptions: each allowlist names its paths and lists, in
+ * `stopwords`, the exact secret values it allows (e.g. known digests). A
+ * detected secret is allowed only when it equals one of them. Regexes,
+ * targetRules, commits, regexTarget and path-only allowlists are rejected
+ * there, because a pattern can always be widened, alone or combined with other
+ * entries, to hide a real credential.
+ *
  * Fails closed: anything not acceptable is a ScanConfigError, and the scan
  * exits 2 rather than running with a guess.
  */
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { parse } from "smol-toml";
 import { compileGoRegex } from "./go-regex.js";
-import { compileAllowlist } from "./rules.js";
+import { scanFragment } from "./detect.js";
+import { credentialProbes } from "./probes.js";
+import { compileAllowlist, compiledRules } from "./rules.js";
 export class ScanConfigError extends Error {
 }
 export const REPO_CONFIG_FILE = ".gitleaks.toml";
@@ -37,6 +48,25 @@ const MAX_REGEX_LENGTH = 256;
 const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[*+}](?:[^()\\]|\\.)*\)[*+{]/;
 /** Paths no real allowlist path should match all of. */
 const PROBE_PATHS = ["a", ".env", "src/index.ts", "config/credentials.yml", "deep/nested/dir/file.json"];
+/** File the probes are placed in; the allowlist's own paths are treated as matching it. */
+const PROBE_FILE = "probe/settings.txt";
+let probeBaseline;
+function probeFragment(line) {
+    return { file: PROBE_FILE, text: `${line}\n`, startLine: 1 };
+}
+/**
+ * The first probe credential the allowlist would hide, judged as the detector
+ * judges it (every regex ORed, every check combined by its condition, its
+ * targetRules applied), for a file at one of its paths. undefined: none.
+ */
+export function suppressedProbe(al) {
+    const base = compiledRules();
+    const probes = credentialProbes();
+    probeBaseline ??= probes.map((p) => scanFragment(probeFragment(p.line), base).length > 0);
+    const atPath = { ...al, paths: al.paths.length ? [/(?:)/] : [] };
+    const rules = { ...base, repo: [atPath] };
+    return probes.find((p, i) => probeBaseline[i] && scanFragment(probeFragment(p.line), rules).length === 0);
+}
 function fail(file, where, msg) {
     throw new ScanConfigError(`${file}: ${where}: ${msg}`);
 }
@@ -96,16 +126,38 @@ function topLevelAlternation(src) {
     }
     return false;
 }
-function compileChecked(file, where, key, src) {
+/**
+ * How an error names an exemption value: its length and a short hash, never
+ * the value itself, which may be a real credential (e.g. one with a typo).
+ */
+function redact(value) {
+    return `<${value.length} chars, sha256:${createHash("sha256").update(value).digest("hex").slice(0, 12)}>`;
+}
+/** Names a regexes entry by index and redacted value; paths are shown as written. */
+function entryName(key, src, i) {
+    return key === "paths" ? `paths entry ${JSON.stringify(src)}` : `${key}[${i}] ${redact(src)}`;
+}
+function compileChecked(file, where, key, src, i = 0) {
     if (src.length > MAX_REGEX_LENGTH)
         fail(file, where, `${key} entry is longer than ${MAX_REGEX_LENGTH} characters`);
     if (NESTED_QUANTIFIER.test(src))
-        fail(file, where, `${key} entry ${JSON.stringify(src)} has a nested quantifier; simplify it`);
+        fail(file, where, `${entryName(key, src, i)} has a nested quantifier; simplify it`);
     try {
         return compileGoRegex(src);
     }
     catch (err) {
-        fail(file, where, `${key} entry ${JSON.stringify(src)} is not a supported regex (${err instanceof Error ? err.message : String(err)})`);
+        fail(file, where, `${entryName(key, src, i)} is not a supported regex${key === "paths" ? ` (${err instanceof Error ? err.message : String(err)})` : ""}`);
+    }
+}
+function checkPaths(file, where, paths) {
+    for (const src of paths) {
+        const re = compileChecked(file, where, "paths", src);
+        if (literalPathPrefix(src) < MIN_PATH_PREFIX || topLevelAlternation(src)) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} must start with ^ and at least ${MIN_PATH_PREFIX} literal characters (e.g. '^fixtures/')`);
+        }
+        if (re.test("") || PROBE_PATHS.every((p) => re.test(p))) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} matches everything; allowlist specific files`);
+        }
     }
 }
 function validate(file, where, raw) {
@@ -141,37 +193,29 @@ function validate(file, where, raw) {
     if (!al.paths?.length) {
         fail(file, where, "needs paths, each starting with ^ and a literal directory or file name (e.g. '^fixtures/')");
     }
-    for (const src of al.paths) {
-        const re = compileChecked(file, where, "paths", src);
-        if (literalPathPrefix(src) < MIN_PATH_PREFIX || topLevelAlternation(src)) {
-            fail(file, where, `paths entry ${JSON.stringify(src)} must start with ^ and at least ${MIN_PATH_PREFIX} literal characters (e.g. '^fixtures/')`);
-        }
-        if (re.test("") || PROBE_PATHS.every((p) => re.test(p))) {
-            fail(file, where, `paths entry ${JSON.stringify(src)} matches everything; allowlist specific files`);
-        }
-    }
+    checkPaths(file, where, al.paths);
     if ((al.regexes?.length || al.stopwords?.length) && al.condition !== "AND") {
         fail(file, where, 'regexes and stopwords need condition = "AND", so they only apply inside paths');
     }
-    for (const src of al.regexes ?? []) {
-        if (compileChecked(file, where, "regexes", src).test(""))
-            fail(file, where, `regexes entry ${JSON.stringify(src)} matches everything`);
-    }
-    for (const s of al.stopwords ?? []) {
+    al.regexes?.forEach((src, i) => compileChecked(file, where, "regexes", src, i));
+    al.stopwords?.forEach((s, i) => {
         if (s.trim().length < MIN_STOPWORD)
-            fail(file, where, `stopword ${JSON.stringify(s)} is shorter than ${MIN_STOPWORD} characters`);
+            fail(file, where, `stopwords[${i}] ${redact(s)} is shorter than ${MIN_STOPWORD} characters`);
+    });
+    // A path-only allowlist exempts the files it names. One with content checks
+    // must still report a real credential in those files, so run the detector on
+    // the probe corpus with this allowlist, exactly as a scan would apply it.
+    if (al.regexes?.length || al.stopwords?.length) {
+        const hidden = suppressedProbe(compileAllowlist(al));
+        if (hidden) {
+            fail(file, where, `matches everything: it would hide a real ${hidden.kind} credential in its paths; narrow its regexes or stopwords to the known false positive`);
+        }
     }
     return al;
 }
 /** Validated allowlists from the text of a .gitleaks.toml. */
 export function parseRepoAllowlists(text, file = REPO_CONFIG_FILE) {
-    let doc;
-    try {
-        doc = parse(text);
-    }
-    catch (err) {
-        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
-    }
+    const doc = parseToml(text, file);
     const out = [];
     if (doc.allowlist !== undefined)
         out.push(validate(file, "[allowlist]", doc.allowlist));
@@ -182,6 +226,75 @@ export function parseRepoAllowlists(text, file = REPO_CONFIG_FILE) {
     }
     return out.map(compileAllowlist);
 }
+/** Shortest exact value a file-scan allowlist may list; real secrets and digests are longer. */
+const MIN_EXACT_VALUE = 16;
+const EXACT_KEYS = new Set(["description", "condition", "paths", "stopwords"]);
+/**
+ * A file-scan allowlist: paths plus the exact secret values to allow, listed
+ * in `stopwords`. Anything pattern-based is rejected (see the top of the file).
+ */
+function validateExact(file, where, raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        fail(file, where, "must be a table");
+    const t = raw;
+    for (const k of Object.keys(t)) {
+        if (!KEYS.has(k))
+            fail(file, where, `unknown key "${k}"`);
+        if (!EXACT_KEYS.has(k)) {
+            fail(file, where, `file scans honor only exact-value exemptions: remove "${k}" and list the exact secret values in stopwords`);
+        }
+    }
+    if (t.description !== undefined && typeof t.description !== "string")
+        fail(file, where, "description must be a string");
+    if (typeof t.condition !== "string" || t.condition.trim().toUpperCase() !== "AND") {
+        fail(file, where, 'file scans need condition = "AND", so the exact values only apply inside paths');
+    }
+    const paths = stringList(file, where, "paths", t.paths);
+    if (!paths?.length) {
+        fail(file, where, "needs paths, each starting with ^ and a literal directory or file name (e.g. '^fixtures/')");
+    }
+    checkPaths(file, where, paths);
+    const values = stringList(file, where, "stopwords", t.stopwords);
+    if (!values?.length) {
+        fail(file, where, "file scans honor only exact-value exemptions: list the exact secret values to allow in stopwords");
+    }
+    values.forEach((v, i) => {
+        if (v.length < MIN_EXACT_VALUE || /\s/.test(v)) {
+            fail(file, where, `stopwords[${i}] ${redact(v)} must be an exact secret value of at least ${MIN_EXACT_VALUE} characters with no spaces`);
+        }
+    });
+    return {
+        condition: "AND",
+        target: "secret",
+        paths: paths.map((p) => compileGoRegex(p)),
+        regexes: [],
+        stopwords: [],
+        commits: [],
+        targetRules: [],
+        exact: [...values],
+    };
+}
+/** Validated exact-value allowlists for a file scan, from the text of a .gitleaks.toml. */
+export function parseExactAllowlists(text, file = REPO_CONFIG_FILE) {
+    const doc = parseToml(text, file);
+    const out = [];
+    if (doc.allowlist !== undefined)
+        out.push(validateExact(file, "[allowlist]", doc.allowlist));
+    if (doc.allowlists !== undefined) {
+        if (!Array.isArray(doc.allowlists))
+            fail(file, "allowlists", "must be an array of tables ([[allowlists]])");
+        doc.allowlists.forEach((a, i) => out.push(validateExact(file, `[[allowlists]] #${i + 1}`, a)));
+    }
+    return out;
+}
+function parseToml(text, file) {
+    try {
+        return parse(text);
+    }
+    catch (err) {
+        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+    }
+}
 function git(repoRoot, args) {
     try {
         return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -228,10 +341,27 @@ export function loadRepoAllowlists(repoRoot) {
     // Changed in this commit: scan with the version already committed at HEAD.
     return headAllowlists(repoRoot);
 }
-function headAllowlists(repoRoot) {
+/**
+ * Exact-value allowlists from the copy committed at `rev` (default HEAD), for a
+ * file scan (`hq scan secrets --repo [--allowlist-rev]`). The index and working
+ * tree are ignored. pr-check passes the base branch, so a branch cannot exempt
+ * its own commits by adding an allowlist. An unknown rev is an error.
+ */
+export function loadCommittedAllowlists(repoRoot, rev = "HEAD") {
+    if (rev === "HEAD")
+        return headAllowlists(repoRoot, parseExactAllowlists);
+    if (rev.startsWith("-") || git(repoRoot, ["rev-parse", "--verify", "-q", `${rev}^{commit}`]) === null) {
+        throw new ScanConfigError(`allowlist rev ${JSON.stringify(rev)} is not a commit in ${repoRoot}`);
+    }
+    return revAllowlists(repoRoot, rev, parseExactAllowlists);
+}
+function headAllowlists(repoRoot, parser = parseRepoAllowlists) {
     if (git(repoRoot, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]) === null)
         return [];
-    const head = entry(git(repoRoot, ["ls-tree", "HEAD", "--", REPO_CONFIG_FILE]), 2);
-    return head ? parseRepoAllowlists(readEntry(repoRoot, head, "HEAD"), `${REPO_CONFIG_FILE} (HEAD)`) : [];
+    return revAllowlists(repoRoot, "HEAD", parser);
+}
+function revAllowlists(repoRoot, rev, parser) {
+    const e = entry(git(repoRoot, ["ls-tree", rev, "--", REPO_CONFIG_FILE]), 2);
+    return e ? parser(readEntry(repoRoot, e, rev), `${REPO_CONFIG_FILE} (${rev})`) : [];
 }
 //# sourceMappingURL=repo-config.js.map

package/dist/lib/secret-scan/rules.d.ts

@@ -12,6 +12,8 @@ export interface CompiledAllowlist {
     commits: string[];
     /** Empty: applies to every rule. */
     targetRules: string[];
+    /** Exact secret values: allows only a detected secret equal to one of them (file scans with a repo). */
+    exact?: string[];
 }
 export interface CompiledRule {
     id: string;

package/dist/lib/secret-scan/staged.d.ts

@@ -18,5 +18,19 @@ export declare function repoRoot(cwd: string): string;
  * relative to the repo root, as gitleaks' allowlist paths are.
  */
 export declare function scanStaged(cwd: string): SecretFinding[];
-export declare function scanFiles(paths: string[]): SecretFinding[];
+export interface ScanFilesOptions {
+    /**
+     * Apply this repo's committed .gitleaks.toml allowlists. Files under the repo
+     * are matched by their repo-relative path, as in a staged scan.
+     */
+    repo?: string;
+    /**
+     * Files laid out as <snapshotRoot>/<commit>/<repo path> (historical copies,
+     * as `commit-secret-scan.sh pr-check` writes them) are matched as <repo path>.
+     */
+    snapshotRoot?: string;
+    /** Read the allowlists from .gitleaks.toml at this commit instead of HEAD (pr-check passes its base). */
+    allowlistRev?: string;
+}
+export declare function scanFiles(paths: string[], opts?: ScanFilesOptions): SecretFinding[];
 //# sourceMappingURL=staged.d.ts.map

package/dist/lib/secret-scan/staged.js

@@ -2,9 +2,10 @@
  * Scan inputs: the staged diff of a git repo (pre-commit), or whole files.
  */
 import { execFileSync } from "node:child_process";
-import { readFileSync, statSync } from "node:fs";
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
 import { scanFragment, scanPath } from "./detect.js";
-import { loadRepoAllowlists } from "./repo-config.js";
+import { loadCommittedAllowlists, loadRepoAllowlists } from "./repo-config.js";
 import { compiledRules } from "./rules.js";
 export class ScanInputError extends Error {
 }
@@ -110,7 +111,43 @@ export function scanStaged(cwd) {
     const { fragments, binaryFiles } = parseUnifiedDiff(diff);
     return [...fragments.flatMap((f) => scanFragment(f, rules)), ...binaryFiles.flatMap((f) => scanPath(f, rules))];
 }
-export function scanFiles(paths) {
+/** `p` relative to `root`, or null when `p` is not inside `root`. */
+function inside(root, p) {
+    const rel = relative(root, p);
+    if (!rel || rel.startsWith("..") || isAbsolute(rel))
+        return null;
+    return rel.split(sep).join("/");
+}
+function real(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+/**
+ * The path allowlists see for `p`: repo-relative, or `<path>` for a snapshot at
+ * `<snapshotRoot>/<commit>/<path>`. null when `p` (after symlinks and `..`) is
+ * outside both roots: such a file gets no repo allowlist at all.
+ */
+function matchPath(p, repo, snapshotRoot) {
+    const abs = real(p);
+    if (snapshotRoot) {
+        const rel = inside(snapshotRoot, abs);
+        if (rel !== null) {
+            const slash = rel.indexOf("/");
+            if (slash > 0)
+                return rel.slice(slash + 1);
+        }
+    }
+    return inside(repo, abs);
+}
+export function scanFiles(paths, opts = {}) {
+    const root = opts.repo !== undefined ? repoRoot(opts.repo) : undefined;
+    const rules = root !== undefined ? { ...compiledRules(), repo: loadCommittedAllowlists(root, opts.allowlistRev) } : compiledRules();
+    const repo = root !== undefined ? real(root) : undefined;
+    const snapshotRoot = opts.snapshotRoot !== undefined ? real(opts.snapshotRoot) : undefined;
     const out = [];
     for (const p of paths) {
         let text;
@@ -122,7 +159,12 @@ export function scanFiles(paths) {
         catch (err) {
             throw new ScanInputError(`could not read ${p}: ${err instanceof Error ? err.message : String(err)}`);
         }
-        out.push(...scanPath(p), ...scanFragment({ file: p, text, startLine: 1 }));
+        const mapped = repo !== undefined ? matchPath(p, repo, snapshotRoot) : p;
+        const file = mapped ?? p;
+        const use = mapped === null ? compiledRules() : rules;
+        // Findings still name the file as given, so a history copy keeps its commit folder.
+        const found = [...scanPath(file, use), ...scanFragment({ file, text, startLine: 1 }, use)];
+        out.push(...found.map((f) => ({ ...f, file: p })));
     }
     return out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.164",
+  "version": "5.345.165",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.164",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.164",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.164",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.164",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.164",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.164"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.165",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.165",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.165",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.165",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.165",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.165"
   }
 }