@indigoai-us/hq-cli 5.345.164 → 5.345.166

package/dist/commands/integrations.js

@@ -61,7 +61,7 @@ import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
 import { registerSlackCommands } from "./integrations-slack.js";
-import { fetchPendingApprovals } from "./integrations-api.js";
+import { fetchPendingApprovals, terminalSafeText } from "./integrations-api.js";
 const CALL_ARGS_EXAMPLE = `--args '{"assignee":"me"}' or --args-file args.json`;
 function readStream(stream) {
     return new Promise((resolve, reject) => {
@@ -533,7 +533,7 @@ export function registerIntegrationsCommand(program) {
                 return;
             }
             console.log(chalk.yellow("Queued for approval — this call can change the app, so a company owner decides first."));
-            console.log(`Approve with:\n  hq integrations approve ${queued.queueId} --provider ${bareProvider(connection.provider)}`);
+            console.log(`Approve with:\n  hq integrations approve ${queued.queueId} --provider ${bareProvider(connection.provider)}${opts.company ? ` --company ${opts.company}` : ""}`);
             if (queued.expiresAt) {
                 console.log(chalk.dim(`Expires ${queued.expiresAt}`));
             }
@@ -606,7 +606,9 @@ export function registerIntegrationsCommand(program) {
                     const unknown = terminal.status === "write_unknown" || terminal.outcome === "unknown";
                     console.log(chalk.red(unknown
                         ? `The provider outcome is unknown for ${queueId}. Check the provider before taking any action; ${historyCommand} shows the latest queue state.`
-                        : `The approved call failed (${terminal.status ?? terminal.outcome}). See ${historyCommand} for its status.`));
+                        : terminal.failureMessage
+                            ? `The approved call did not run: ${terminalSafeText(terminal.failureMessage)}`
+                            : `The approved call failed (${terminal.rejectionReason ?? terminal.status ?? terminal.outcome}). See ${historyCommand} for its status.`));
                 }
                 else if (terminal.status === "resumed" || terminal.status === "completed" || terminal.outcome === "ran") {
                     console.log(chalk.green("Approved — the call completed."));
@@ -614,7 +616,7 @@ export function registerIntegrationsCommand(program) {
                         printJson(unwrapGatewayResult(stored.result));
                     }
                     else if (ran) {
-                        console.log(chalk.yellow(`The call's result could not be read back. Run \`hq integrations approve ${queueId}\` again to fetch it; the call will not run twice.`));
+                        console.log(chalk.yellow(`The call's result could not be read back. Run \`hq integrations approve ${queueId} --provider ${bareProvider(connection.provider)}${opts.company ? ` --company ${opts.company}` : ""}\` again to fetch it; the call will not run twice.`));
                     }
                 }
                 else {
@@ -649,7 +651,9 @@ export function registerIntegrationsCommand(program) {
             if (failed) {
                 const reason = body.rejectionReason ??
                     (toolError ? "provider_tool_error" : body.outcome ?? body.status ?? "failed");
-                console.log(chalk.red(`The approved call failed at the provider (${reason}).`));
+                console.log(chalk.red(body.failureMessage
+                    ? `The approved call did not run: ${terminalSafeText(body.failureMessage)}`
+                    : `The approved call failed at the provider (${reason}).`));
             }
             else if (body.status === "resumed" || body.status === "completed" || body.outcome === "ran") {
                 console.log(chalk.green(`Approved — the call ran (status: ${body.status ?? body.outcome}).`));

package/dist/commands/scan.d.ts

@@ -4,6 +4,9 @@
  *   hq scan secrets               scan the staged changes of the current repo
  *   hq scan secrets <file...>     scan whole files instead
  *   hq scan secrets --json        findings as JSON
+ *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
+ *                                 scan files with that repo's committed
+ *                                 .gitleaks.toml allowlists (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -18,6 +21,9 @@ import { Command } from "commander";
 interface ScanSecretsOptions {
     json?: boolean;
     staged?: boolean;
+    repo?: string;
+    snapshotRoot?: string;
+    allowlistRev?: string;
 }
 export declare function runScanSecrets(paths: string[], opts: ScanSecretsOptions, cwd?: string): number;
 export declare function registerScanCommand(program: Command): void;

package/dist/commands/scan.js

@@ -4,6 +4,9 @@
  *   hq scan secrets               scan the staged changes of the current repo
  *   hq scan secrets <file...>     scan whole files instead
  *   hq scan secrets --json        findings as JSON
+ *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
+ *                                 scan files with that repo's committed
+ *                                 .gitleaks.toml allowlists (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -31,7 +34,11 @@ function report(findings, scope) {
 export function runScanSecrets(paths, opts, cwd = process.cwd()) {
     let findings;
     try {
-        findings = paths.length && !opts.staged ? scanFiles(paths) : scanStaged(cwd);
+        if (opts.snapshotRoot !== undefined && opts.repo === undefined)
+            throw new ScanInputError("--snapshot-root needs --repo");
+        if (opts.allowlistRev !== undefined && opts.repo === undefined)
+            throw new ScanInputError("--allowlist-rev needs --repo");
+        findings = paths.length && !opts.staged ? scanFiles(paths, { repo: opts.repo, snapshotRoot: opts.snapshotRoot, allowlistRev: opts.allowlistRev }) : scanStaged(cwd);
     }
     catch (err) {
         const msg = err instanceof ScanInputError || err instanceof ScanConfigError ? err.message : `scan failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -56,6 +63,9 @@ export function registerScanCommand(program) {
         .argument("[files...]", "Scan these files instead of the staged changes")
         .option("--staged", "Scan the staged changes (default when no files are given)")
         .option("--json", "Print findings as JSON")
+        .option("--repo <dir>", "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths")
+        .option("--snapshot-root <dir>", "With --repo: files under <dir>/<commit>/<path> are matched as <path>")
+        .option("--allowlist-rev <rev>", "With --repo: read .gitleaks.toml from this commit instead of HEAD")
         .action((files, opts) => {
         process.exitCode = runScanSecrets(files ?? [], opts);
     });