@indigoai-us/hq-cli 5.345.164 → 5.345.166

package/dist/lib/index-render/index.d.ts

@@ -1,5 +1,10 @@
 import { RenderContext, RenderResult } from "./shared.js";
 export type IndexTarget = "all" | "companies" | "company-knowledge" | "orchestrator" | "projects" | "public-knowledge" | "reports" | "social-drafts" | "threads" | "workers";
+/**
+ * One-line summaries for targets without their own option grammar. The CLI,
+ * the renderer and the bundled shell fallbacks all print the same help text.
+ */
+export declare const GENERIC_INDEX_HELP_SUMMARIES: Readonly<Record<Exclude<IndexTarget, "companies" | "company-knowledge" | "projects">, string>>;
 export declare function renderIndexTarget(target: IndexTarget, context: RenderContext, args?: string[]): RenderResult;
 export { atomicWrite, comparePath, immediateEntries, type RenderContext, type RenderResult } from "./shared.js";
 export { CompanyIndexUserError } from "./companies.js";

package/dist/lib/index-render/index.js

@@ -43,15 +43,36 @@ function companyScope(target, context, args) {
     }
     return company;
 }
+/**
+ * One-line summaries for targets without their own option grammar. The CLI,
+ * the renderer and the bundled shell fallbacks all print the same help text.
+ */
+export const GENERIC_INDEX_HELP_SUMMARIES = {
+    all: "Regenerate every INDEX.md across the HQ tree",
+    orchestrator: "Regenerate the orchestrator workspace INDEX.md",
+    "public-knowledge": "Regenerate core/knowledge/public/INDEX.md",
+    reports: "Regenerate the reports INDEX.md",
+    "social-drafts": "Regenerate workspace/social-drafts/INDEX.md",
+    threads: "Regenerate the session-threads INDEX.md",
+    workers: "Regenerate the workers INDEX.md",
+};
+function isHelp(args) {
+    return args.some((arg) => arg === "--help" || arg === "-h");
+}
 export function renderIndexTarget(target, context, args = []) {
     if (target === "company-knowledge" || target === "projects") {
-        if (args.some((arg) => arg === "--help" || arg === "-h")) {
+        if (isHelp(args)) {
             (context.output ?? ((message) => process.stdout.write(message)))(`Usage: hq core rebuild-index ${target} [<company> | --company <company>] [--accept]\n\nWith a company, rebuild only that company's index. Without a company, retain the all-company rebuild. Help performs no writes.\n`);
             return { written: [] };
         }
         const company = companyScope(target, context, args);
         return target === "projects" ? renderProjects(context, company) : renderCompanyKnowledge(context, company);
     }
+    if (target !== "companies" && isHelp(args)) {
+        // Help must never write, matching the CLI and the bundled shell fallback.
+        (context.output ?? ((message) => process.stdout.write(message)))(`Usage: hq core rebuild-index ${target} [--accept]\n\n${GENERIC_INDEX_HELP_SUMMARIES[target]}. Help performs no writes.\n`);
+        return { written: [] };
+    }
     switch (target) {
         case "companies": return renderCompanies(context, args);
         case "orchestrator": return renderOrchestrator(context);

package/dist/lib/secret-scan/detect.js

@@ -38,6 +38,8 @@ function allowed(al, c) {
     }
     if (al.commits.length)
         checks.push(c.commit !== undefined && al.commits.includes(c.commit.toLowerCase()));
+    if (al.exact?.length)
+        checks.push(al.exact.includes(c.secret));
     if (!checks.length)
         return false;
     return al.condition === "AND" ? checks.every(Boolean) : checks.some(Boolean);

package/dist/lib/secret-scan/probes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * A fixed corpus of realistic credential lines, used to judge a repo
+ * allowlist by what it does: each line is placed in a file at the allowlist's
+ * paths and run through the real detector. Values are generated from a fixed
+ * seed at runtime, so no secret-shaped literal sits in this file and the
+ * corpus is the same on every run.
+ */
+export interface Probe {
+    kind: string;
+    line: string;
+}
+export declare function credentialProbes(): Probe[];
+//# sourceMappingURL=probes.d.ts.map

package/dist/lib/secret-scan/probes.js

@@ -0,0 +1,69 @@
+/**
+ * A fixed corpus of realistic credential lines, used to judge a repo
+ * allowlist by what it does: each line is placed in a file at the allowlist's
+ * paths and run through the real detector. Values are generated from a fixed
+ * seed at runtime, so no secret-shaped literal sits in this file and the
+ * corpus is the same on every run.
+ */
+const UPPER = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+const LOWER = "abcdefghijklmnopqrstuvwxyz";
+const DIGITS = "0123456789";
+const ALNUM = UPPER + LOWER + DIGITS;
+const HEX = "0123456789abcdef";
+const B64URL = ALNUM + "-_";
+/** Deterministic xorshift32 generator. */
+function generator(seed) {
+    let s = seed >>> 0 || 1;
+    return (alphabet, n) => {
+        let out = "";
+        for (let i = 0; i < n; i++) {
+            s ^= s << 13;
+            s >>>= 0;
+            s ^= s >>> 17;
+            s ^= s << 5;
+            s >>>= 0;
+            out += alphabet[s % alphabet.length];
+        }
+        return out;
+    };
+}
+const b64url = (s) => Buffer.from(s).toString("base64url");
+const j = (...parts) => parts.join("");
+let cached;
+export function credentialProbes() {
+    if (cached)
+        return cached;
+    const r = generator(0x9e3779b9);
+    const probes = [];
+    const add = (kind, line) => probes.push({ kind, line });
+    // GitHub tokens: classic PAT, OAuth, app and fine-grained PAT.
+    add("GitHub PAT", `token = "${j("gh", "p_", r(ALNUM, 36))}"`);
+    add("GitHub PAT", `export GH_TOKEN=${j("gh", "o_", r(ALNUM, 36))}`);
+    add("GitHub PAT", `  "github": "${j("gh", "s_", r(ALNUM, 36))}",`);
+    add("GitHub PAT", j("gith", "ub_pat_", r(ALNUM, 22), "_", r(ALNUM, 59)));
+    // AWS access key ids.
+    add("AWS key", `aws_access_key_id = ${j("AK", "IA", r(UPPER + "234567", 16))}`);
+    add("AWS key", `AWS_ACCESS_KEY_ID="${j("AS", "IA", r(UPPER + "234567", 16))}"`);
+    add("AWS key", j("AK", "IA", r(UPPER + "234567", 16)));
+    // Slack bot and user tokens.
+    add("Slack token", `SLACK_BOT_TOKEN=${j("xo", "xb-", r(DIGITS, 12), "-", r(DIGITS, 13), "-", r(ALNUM, 24))}`);
+    add("Slack token", `slack: "${j("xo", "xb-", r(DIGITS, 11), "-", r(DIGITS, 12), "-", r(ALNUM, 24))}"`);
+    add("Slack token", `token = "${j("xo", "xp-", r(DIGITS, 12), "-", r(DIGITS, 12), "-", r(DIGITS, 13), "-", r(HEX, 32))}"`);
+    // 64-character hex secrets under credential-looking keys.
+    add("hex-64", `api_secret = "${r(HEX, 64)}"`);
+    add("hex-64", `  "auth_token": "${r(HEX, 64)}",`);
+    add("hex-64", `SECRET_KEY=${r(HEX, 64)}`);
+    // JWTs of different lengths.
+    for (const n of [24, 48, 96]) {
+        const header = b64url('{"alg":"HS256","typ":"JWT"}');
+        const payload = b64url(JSON.stringify({ sub: r(DIGITS, 10), name: r(LOWER, n / 4), iat: 1700000000 }));
+        add("JWT", `const jwt = "${header}.${payload}.${r(B64URL, 43)}";`);
+    }
+    // Generic key = value credentials of different lengths.
+    add("generic api_key", `api_key = "${r(ALNUM, 20)}"`);
+    add("generic api_key", `client_secret: '${r(ALNUM, 32)}'`);
+    add("generic api_key", `ACCESS_TOKEN=${r(ALNUM, 48)}`);
+    cached = probes;
+    return probes;
+}
+//# sourceMappingURL=probes.js.map

package/dist/lib/secret-scan/repo-config.d.ts

@@ -18,13 +18,28 @@
  * literal prefix (`^golden/...`); `regexes` and `stopwords` need
  * `condition = "AND"`, so they never reach files outside those paths.
  *
+ * File scans (`hq scan secrets <files> --repo`, used by pr-check) honor only
+ * exact-value exemptions: each allowlist names its paths and lists, in
+ * `stopwords`, the exact secret values it allows (e.g. known digests). A
+ * detected secret is allowed only when it equals one of them. Regexes,
+ * targetRules, commits, regexTarget and path-only allowlists are rejected
+ * there, because a pattern can always be widened, alone or combined with other
+ * entries, to hide a real credential.
+ *
  * Fails closed: anything not acceptable is a ScanConfigError, and the scan
  * exits 2 rather than running with a guess.
  */
+import { type Probe } from "./probes.js";
 import { type CompiledAllowlist } from "./rules.js";
 export declare class ScanConfigError extends Error {
 }
 export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
+/**
+ * The first probe credential the allowlist would hide, judged as the detector
+ * judges it (every regex ORed, every check combined by its condition, its
+ * targetRules applied), for a file at one of its paths. undefined: none.
+ */
+export declare function suppressedProbe(al: CompiledAllowlist): Probe | undefined;
 /**
  * Length of the literal text right after a leading `^`: letters, digits,
  * `/ _ - @ ~` and backslash-escaped punctuation. A quantifier on the last
@@ -33,9 +48,18 @@ export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
 export declare function literalPathPrefix(src: string): number;
 /** Validated allowlists from the text of a .gitleaks.toml. */
 export declare function parseRepoAllowlists(text: string, file?: string): CompiledAllowlist[];
+/** Validated exact-value allowlists for a file scan, from the text of a .gitleaks.toml. */
+export declare function parseExactAllowlists(text: string, file?: string): CompiledAllowlist[];
 /**
  * Compiled allowlists for a staged scan of the repo at `repoRoot`, read from
  * git as described at the top of this file. [] when the repo has none.
  */
 export declare function loadRepoAllowlists(repoRoot: string): CompiledAllowlist[];
+/**
+ * Exact-value allowlists from the copy committed at `rev` (default HEAD), for a
+ * file scan (`hq scan secrets --repo [--allowlist-rev]`). The index and working
+ * tree are ignored. pr-check passes the base branch, so a branch cannot exempt
+ * its own commits by adding an allowlist. An unknown rev is an error.
+ */
+export declare function loadCommittedAllowlists(repoRoot: string, rev?: string): CompiledAllowlist[];
 //# sourceMappingURL=repo-config.d.ts.map

package/dist/lib/secret-scan/repo-config.js

@@ -18,13 +18,24 @@
  * literal prefix (`^golden/...`); `regexes` and `stopwords` need
  * `condition = "AND"`, so they never reach files outside those paths.
  *
+ * File scans (`hq scan secrets <files> --repo`, used by pr-check) honor only
+ * exact-value exemptions: each allowlist names its paths and lists, in
+ * `stopwords`, the exact secret values it allows (e.g. known digests). A
+ * detected secret is allowed only when it equals one of them. Regexes,
+ * targetRules, commits, regexTarget and path-only allowlists are rejected
+ * there, because a pattern can always be widened, alone or combined with other
+ * entries, to hide a real credential.
+ *
  * Fails closed: anything not acceptable is a ScanConfigError, and the scan
  * exits 2 rather than running with a guess.
  */
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { parse } from "smol-toml";
 import { compileGoRegex } from "./go-regex.js";
-import { compileAllowlist } from "./rules.js";
+import { scanFragment } from "./detect.js";
+import { credentialProbes } from "./probes.js";
+import { compileAllowlist, compiledRules } from "./rules.js";
 export class ScanConfigError extends Error {
 }
 export const REPO_CONFIG_FILE = ".gitleaks.toml";
@@ -37,6 +48,25 @@ const MAX_REGEX_LENGTH = 256;
 const NESTED_QUANTIFIER = /\((?:[^()\\]|\\.)*[*+}](?:[^()\\]|\\.)*\)[*+{]/;
 /** Paths no real allowlist path should match all of. */
 const PROBE_PATHS = ["a", ".env", "src/index.ts", "config/credentials.yml", "deep/nested/dir/file.json"];
+/** File the probes are placed in; the allowlist's own paths are treated as matching it. */
+const PROBE_FILE = "probe/settings.txt";
+let probeBaseline;
+function probeFragment(line) {
+    return { file: PROBE_FILE, text: `${line}\n`, startLine: 1 };
+}
+/**
+ * The first probe credential the allowlist would hide, judged as the detector
+ * judges it (every regex ORed, every check combined by its condition, its
+ * targetRules applied), for a file at one of its paths. undefined: none.
+ */
+export function suppressedProbe(al) {
+    const base = compiledRules();
+    const probes = credentialProbes();
+    probeBaseline ??= probes.map((p) => scanFragment(probeFragment(p.line), base).length > 0);
+    const atPath = { ...al, paths: al.paths.length ? [/(?:)/] : [] };
+    const rules = { ...base, repo: [atPath] };
+    return probes.find((p, i) => probeBaseline[i] && scanFragment(probeFragment(p.line), rules).length === 0);
+}
 function fail(file, where, msg) {
     throw new ScanConfigError(`${file}: ${where}: ${msg}`);
 }
@@ -96,16 +126,38 @@ function topLevelAlternation(src) {
     }
     return false;
 }
-function compileChecked(file, where, key, src) {
+/**
+ * How an error names an exemption value: its length and a short hash, never
+ * the value itself, which may be a real credential (e.g. one with a typo).
+ */
+function redact(value) {
+    return `<${value.length} chars, sha256:${createHash("sha256").update(value).digest("hex").slice(0, 12)}>`;
+}
+/** Names a regexes entry by index and redacted value; paths are shown as written. */
+function entryName(key, src, i) {
+    return key === "paths" ? `paths entry ${JSON.stringify(src)}` : `${key}[${i}] ${redact(src)}`;
+}
+function compileChecked(file, where, key, src, i = 0) {
     if (src.length > MAX_REGEX_LENGTH)
         fail(file, where, `${key} entry is longer than ${MAX_REGEX_LENGTH} characters`);
     if (NESTED_QUANTIFIER.test(src))
-        fail(file, where, `${key} entry ${JSON.stringify(src)} has a nested quantifier; simplify it`);
+        fail(file, where, `${entryName(key, src, i)} has a nested quantifier; simplify it`);
     try {
         return compileGoRegex(src);
     }
     catch (err) {
-        fail(file, where, `${key} entry ${JSON.stringify(src)} is not a supported regex (${err instanceof Error ? err.message : String(err)})`);
+        fail(file, where, `${entryName(key, src, i)} is not a supported regex${key === "paths" ? ` (${err instanceof Error ? err.message : String(err)})` : ""}`);
+    }
+}
+function checkPaths(file, where, paths) {
+    for (const src of paths) {
+        const re = compileChecked(file, where, "paths", src);
+        if (literalPathPrefix(src) < MIN_PATH_PREFIX || topLevelAlternation(src)) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} must start with ^ and at least ${MIN_PATH_PREFIX} literal characters (e.g. '^fixtures/')`);
+        }
+        if (re.test("") || PROBE_PATHS.every((p) => re.test(p))) {
+            fail(file, where, `paths entry ${JSON.stringify(src)} matches everything; allowlist specific files`);
+        }
     }
 }
 function validate(file, where, raw) {
@@ -141,37 +193,29 @@ function validate(file, where, raw) {
     if (!al.paths?.length) {
         fail(file, where, "needs paths, each starting with ^ and a literal directory or file name (e.g. '^fixtures/')");
     }
-    for (const src of al.paths) {
-        const re = compileChecked(file, where, "paths", src);
-        if (literalPathPrefix(src) < MIN_PATH_PREFIX || topLevelAlternation(src)) {
-            fail(file, where, `paths entry ${JSON.stringify(src)} must start with ^ and at least ${MIN_PATH_PREFIX} literal characters (e.g. '^fixtures/')`);
-        }
-        if (re.test("") || PROBE_PATHS.every((p) => re.test(p))) {
-            fail(file, where, `paths entry ${JSON.stringify(src)} matches everything; allowlist specific files`);
-        }
-    }
+    checkPaths(file, where, al.paths);
     if ((al.regexes?.length || al.stopwords?.length) && al.condition !== "AND") {
         fail(file, where, 'regexes and stopwords need condition = "AND", so they only apply inside paths');
     }
-    for (const src of al.regexes ?? []) {
-        if (compileChecked(file, where, "regexes", src).test(""))
-            fail(file, where, `regexes entry ${JSON.stringify(src)} matches everything`);
-    }
-    for (const s of al.stopwords ?? []) {
+    al.regexes?.forEach((src, i) => compileChecked(file, where, "regexes", src, i));
+    al.stopwords?.forEach((s, i) => {
         if (s.trim().length < MIN_STOPWORD)
-            fail(file, where, `stopword ${JSON.stringify(s)} is shorter than ${MIN_STOPWORD} characters`);
+            fail(file, where, `stopwords[${i}] ${redact(s)} is shorter than ${MIN_STOPWORD} characters`);
+    });
+    // A path-only allowlist exempts the files it names. One with content checks
+    // must still report a real credential in those files, so run the detector on
+    // the probe corpus with this allowlist, exactly as a scan would apply it.
+    if (al.regexes?.length || al.stopwords?.length) {
+        const hidden = suppressedProbe(compileAllowlist(al));
+        if (hidden) {
+            fail(file, where, `matches everything: it would hide a real ${hidden.kind} credential in its paths; narrow its regexes or stopwords to the known false positive`);
+        }
     }
     return al;
 }
 /** Validated allowlists from the text of a .gitleaks.toml. */
 export function parseRepoAllowlists(text, file = REPO_CONFIG_FILE) {
-    let doc;
-    try {
-        doc = parse(text);
-    }
-    catch (err) {
-        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
-    }
+    const doc = parseToml(text, file);
     const out = [];
     if (doc.allowlist !== undefined)
         out.push(validate(file, "[allowlist]", doc.allowlist));
@@ -182,6 +226,75 @@ export function parseRepoAllowlists(text, file = REPO_CONFIG_FILE) {
     }
     return out.map(compileAllowlist);
 }
+/** Shortest exact value a file-scan allowlist may list; real secrets and digests are longer. */
+const MIN_EXACT_VALUE = 16;
+const EXACT_KEYS = new Set(["description", "condition", "paths", "stopwords"]);
+/**
+ * A file-scan allowlist: paths plus the exact secret values to allow, listed
+ * in `stopwords`. Anything pattern-based is rejected (see the top of the file).
+ */
+function validateExact(file, where, raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        fail(file, where, "must be a table");
+    const t = raw;
+    for (const k of Object.keys(t)) {
+        if (!KEYS.has(k))
+            fail(file, where, `unknown key "${k}"`);
+        if (!EXACT_KEYS.has(k)) {
+            fail(file, where, `file scans honor only exact-value exemptions: remove "${k}" and list the exact secret values in stopwords`);
+        }
+    }
+    if (t.description !== undefined && typeof t.description !== "string")
+        fail(file, where, "description must be a string");
+    if (typeof t.condition !== "string" || t.condition.trim().toUpperCase() !== "AND") {
+        fail(file, where, 'file scans need condition = "AND", so the exact values only apply inside paths');
+    }
+    const paths = stringList(file, where, "paths", t.paths);
+    if (!paths?.length) {
+        fail(file, where, "needs paths, each starting with ^ and a literal directory or file name (e.g. '^fixtures/')");
+    }
+    checkPaths(file, where, paths);
+    const values = stringList(file, where, "stopwords", t.stopwords);
+    if (!values?.length) {
+        fail(file, where, "file scans honor only exact-value exemptions: list the exact secret values to allow in stopwords");
+    }
+    values.forEach((v, i) => {
+        if (v.length < MIN_EXACT_VALUE || /\s/.test(v)) {
+            fail(file, where, `stopwords[${i}] ${redact(v)} must be an exact secret value of at least ${MIN_EXACT_VALUE} characters with no spaces`);
+        }
+    });
+    return {
+        condition: "AND",
+        target: "secret",
+        paths: paths.map((p) => compileGoRegex(p)),
+        regexes: [],
+        stopwords: [],
+        commits: [],
+        targetRules: [],
+        exact: [...values],
+    };
+}
+/** Validated exact-value allowlists for a file scan, from the text of a .gitleaks.toml. */
+export function parseExactAllowlists(text, file = REPO_CONFIG_FILE) {
+    const doc = parseToml(text, file);
+    const out = [];
+    if (doc.allowlist !== undefined)
+        out.push(validateExact(file, "[allowlist]", doc.allowlist));
+    if (doc.allowlists !== undefined) {
+        if (!Array.isArray(doc.allowlists))
+            fail(file, "allowlists", "must be an array of tables ([[allowlists]])");
+        doc.allowlists.forEach((a, i) => out.push(validateExact(file, `[[allowlists]] #${i + 1}`, a)));
+    }
+    return out;
+}
+function parseToml(text, file) {
+    try {
+        return parse(text);
+    }
+    catch (err) {
+        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+    }
+}
 function git(repoRoot, args) {
     try {
         return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -228,10 +341,27 @@ export function loadRepoAllowlists(repoRoot) {
     // Changed in this commit: scan with the version already committed at HEAD.
     return headAllowlists(repoRoot);
 }
-function headAllowlists(repoRoot) {
+/**
+ * Exact-value allowlists from the copy committed at `rev` (default HEAD), for a
+ * file scan (`hq scan secrets --repo [--allowlist-rev]`). The index and working
+ * tree are ignored. pr-check passes the base branch, so a branch cannot exempt
+ * its own commits by adding an allowlist. An unknown rev is an error.
+ */
+export function loadCommittedAllowlists(repoRoot, rev = "HEAD") {
+    if (rev === "HEAD")
+        return headAllowlists(repoRoot, parseExactAllowlists);
+    if (rev.startsWith("-") || git(repoRoot, ["rev-parse", "--verify", "-q", `${rev}^{commit}`]) === null) {
+        throw new ScanConfigError(`allowlist rev ${JSON.stringify(rev)} is not a commit in ${repoRoot}`);
+    }
+    return revAllowlists(repoRoot, rev, parseExactAllowlists);
+}
+function headAllowlists(repoRoot, parser = parseRepoAllowlists) {
     if (git(repoRoot, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]) === null)
         return [];
-    const head = entry(git(repoRoot, ["ls-tree", "HEAD", "--", REPO_CONFIG_FILE]), 2);
-    return head ? parseRepoAllowlists(readEntry(repoRoot, head, "HEAD"), `${REPO_CONFIG_FILE} (HEAD)`) : [];
+    return revAllowlists(repoRoot, "HEAD", parser);
+}
+function revAllowlists(repoRoot, rev, parser) {
+    const e = entry(git(repoRoot, ["ls-tree", rev, "--", REPO_CONFIG_FILE]), 2);
+    return e ? parser(readEntry(repoRoot, e, rev), `${REPO_CONFIG_FILE} (${rev})`) : [];
 }
 //# sourceMappingURL=repo-config.js.map

package/dist/lib/secret-scan/rules.d.ts

@@ -12,6 +12,8 @@ export interface CompiledAllowlist {
     commits: string[];
     /** Empty: applies to every rule. */
     targetRules: string[];
+    /** Exact secret values: allows only a detected secret equal to one of them (file scans with a repo). */
+    exact?: string[];
 }
 export interface CompiledRule {
     id: string;

package/dist/lib/secret-scan/staged.d.ts

@@ -18,5 +18,19 @@ export declare function repoRoot(cwd: string): string;
  * relative to the repo root, as gitleaks' allowlist paths are.
  */
 export declare function scanStaged(cwd: string): SecretFinding[];
-export declare function scanFiles(paths: string[]): SecretFinding[];
+export interface ScanFilesOptions {
+    /**
+     * Apply this repo's committed .gitleaks.toml allowlists. Files under the repo
+     * are matched by their repo-relative path, as in a staged scan.
+     */
+    repo?: string;
+    /**
+     * Files laid out as <snapshotRoot>/<commit>/<repo path> (historical copies,
+     * as `commit-secret-scan.sh pr-check` writes them) are matched as <repo path>.
+     */
+    snapshotRoot?: string;
+    /** Read the allowlists from .gitleaks.toml at this commit instead of HEAD (pr-check passes its base). */
+    allowlistRev?: string;
+}
+export declare function scanFiles(paths: string[], opts?: ScanFilesOptions): SecretFinding[];
 //# sourceMappingURL=staged.d.ts.map

package/dist/lib/secret-scan/staged.js

@@ -2,9 +2,10 @@
  * Scan inputs: the staged diff of a git repo (pre-commit), or whole files.
  */
 import { execFileSync } from "node:child_process";
-import { readFileSync, statSync } from "node:fs";
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
 import { scanFragment, scanPath } from "./detect.js";
-import { loadRepoAllowlists } from "./repo-config.js";
+import { loadCommittedAllowlists, loadRepoAllowlists } from "./repo-config.js";
 import { compiledRules } from "./rules.js";
 export class ScanInputError extends Error {
 }
@@ -110,7 +111,43 @@ export function scanStaged(cwd) {
     const { fragments, binaryFiles } = parseUnifiedDiff(diff);
     return [...fragments.flatMap((f) => scanFragment(f, rules)), ...binaryFiles.flatMap((f) => scanPath(f, rules))];
 }
-export function scanFiles(paths) {
+/** `p` relative to `root`, or null when `p` is not inside `root`. */
+function inside(root, p) {
+    const rel = relative(root, p);
+    if (!rel || rel.startsWith("..") || isAbsolute(rel))
+        return null;
+    return rel.split(sep).join("/");
+}
+function real(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+/**
+ * The path allowlists see for `p`: repo-relative, or `<path>` for a snapshot at
+ * `<snapshotRoot>/<commit>/<path>`. null when `p` (after symlinks and `..`) is
+ * outside both roots: such a file gets no repo allowlist at all.
+ */
+function matchPath(p, repo, snapshotRoot) {
+    const abs = real(p);
+    if (snapshotRoot) {
+        const rel = inside(snapshotRoot, abs);
+        if (rel !== null) {
+            const slash = rel.indexOf("/");
+            if (slash > 0)
+                return rel.slice(slash + 1);
+        }
+    }
+    return inside(repo, abs);
+}
+export function scanFiles(paths, opts = {}) {
+    const root = opts.repo !== undefined ? repoRoot(opts.repo) : undefined;
+    const rules = root !== undefined ? { ...compiledRules(), repo: loadCommittedAllowlists(root, opts.allowlistRev) } : compiledRules();
+    const repo = root !== undefined ? real(root) : undefined;
+    const snapshotRoot = opts.snapshotRoot !== undefined ? real(opts.snapshotRoot) : undefined;
     const out = [];
     for (const p of paths) {
         let text;
@@ -122,7 +159,12 @@ export function scanFiles(paths) {
         catch (err) {
             throw new ScanInputError(`could not read ${p}: ${err instanceof Error ? err.message : String(err)}`);
         }
-        out.push(...scanPath(p), ...scanFragment({ file: p, text, startLine: 1 }));
+        const mapped = repo !== undefined ? matchPath(p, repo, snapshotRoot) : p;
+        const file = mapped ?? p;
+        const use = mapped === null ? compiledRules() : rules;
+        // Findings still name the file as given, so a history copy keeps its commit folder.
+        const found = [...scanPath(file, use), ...scanFragment({ file, text, startLine: 1 }, use)];
+        out.push(...found.map((f) => ({ ...f, file: p })));
     }
     return out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.164",
+  "version": "5.345.166",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -52,7 +52,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "6.18.100",
+    "@indigoai-us/hq-cloud": "6.18.101",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.164",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.164",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.164",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.164",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.164",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.164"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.166",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.166",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.166",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.166",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.166",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.166"
   }
 }