@indigoai-us/hq-cli 5.345.165 → 5.345.168

package/dist/lib/index-render/index.d.ts

@@ -1,5 +1,10 @@
 import { RenderContext, RenderResult } from "./shared.js";
 export type IndexTarget = "all" | "companies" | "company-knowledge" | "orchestrator" | "projects" | "public-knowledge" | "reports" | "social-drafts" | "threads" | "workers";
+/**
+ * One-line summaries for targets without their own option grammar. The CLI,
+ * the renderer and the bundled shell fallbacks all print the same help text.
+ */
+export declare const GENERIC_INDEX_HELP_SUMMARIES: Readonly<Record<Exclude<IndexTarget, "companies" | "company-knowledge" | "projects">, string>>;
 export declare function renderIndexTarget(target: IndexTarget, context: RenderContext, args?: string[]): RenderResult;
 export { atomicWrite, comparePath, immediateEntries, type RenderContext, type RenderResult } from "./shared.js";
 export { CompanyIndexUserError } from "./companies.js";

package/dist/lib/index-render/index.js

@@ -43,15 +43,36 @@ function companyScope(target, context, args) {
     }
     return company;
 }
+/**
+ * One-line summaries for targets without their own option grammar. The CLI,
+ * the renderer and the bundled shell fallbacks all print the same help text.
+ */
+export const GENERIC_INDEX_HELP_SUMMARIES = {
+    all: "Regenerate every INDEX.md across the HQ tree",
+    orchestrator: "Regenerate the orchestrator workspace INDEX.md",
+    "public-knowledge": "Regenerate core/knowledge/public/INDEX.md",
+    reports: "Regenerate the reports INDEX.md",
+    "social-drafts": "Regenerate workspace/social-drafts/INDEX.md",
+    threads: "Regenerate the session-threads INDEX.md",
+    workers: "Regenerate the workers INDEX.md",
+};
+function isHelp(args) {
+    return args.some((arg) => arg === "--help" || arg === "-h");
+}
 export function renderIndexTarget(target, context, args = []) {
     if (target === "company-knowledge" || target === "projects") {
-        if (args.some((arg) => arg === "--help" || arg === "-h")) {
+        if (isHelp(args)) {
             (context.output ?? ((message) => process.stdout.write(message)))(`Usage: hq core rebuild-index ${target} [<company> | --company <company>] [--accept]\n\nWith a company, rebuild only that company's index. Without a company, retain the all-company rebuild. Help performs no writes.\n`);
             return { written: [] };
         }
         const company = companyScope(target, context, args);
         return target === "projects" ? renderProjects(context, company) : renderCompanyKnowledge(context, company);
     }
+    if (target !== "companies" && isHelp(args)) {
+        // Help must never write, matching the CLI and the bundled shell fallback.
+        (context.output ?? ((message) => process.stdout.write(message)))(`Usage: hq core rebuild-index ${target} [--accept]\n\n${GENERIC_INDEX_HELP_SUMMARIES[target]}. Help performs no writes.\n`);
+        return { written: [] };
+    }
     switch (target) {
         case "companies": return renderCompanies(context, args);
         case "orchestrator": return renderOrchestrator(context);

package/dist/lib/notify-recipient.d.ts

@@ -4,4 +4,19 @@ export declare const AGENT_UID_PATTERN: RegExp;
 export declare const EMAIL_PATTERN: RegExp;
 export declare function isRecipientUid(value: string): boolean;
 export declare function isAgentUid(value: string): boolean;
+/** Who a notify message is for. */
+export type DmAudience = "human" | "agent" | "both";
+/** What a send is addressed to, for the default audience. */
+export type DmRecipientKind = "person" | "agent" | "channel" | "group";
+/**
+ * Classify a single 1:1 recipient (email, prs_ or agt_ uid) for the default
+ * audience. Anything that is not an agent uid is a person.
+ */
+export declare function recipientKindOf(recipient: string): "person" | "agent";
+/**
+ * Default audience by recipient: a 1:1 message to a person is for that
+ * person (`human`); a message to an agent, a channel or a group is tagged
+ * `agent` and folded away from people by default.
+ */
+export declare function defaultAudienceFor(kind: DmRecipientKind): DmAudience;
 //# sourceMappingURL=notify-recipient.d.ts.map

package/dist/lib/notify-recipient.js

@@ -8,4 +8,19 @@ export function isRecipientUid(value) {
 export function isAgentUid(value) {
     return AGENT_UID_PATTERN.test(value.trim());
 }
+/**
+ * Classify a single 1:1 recipient (email, prs_ or agt_ uid) for the default
+ * audience. Anything that is not an agent uid is a person.
+ */
+export function recipientKindOf(recipient) {
+    return /^agt_/.test(recipient.trim()) ? "agent" : "person";
+}
+/**
+ * Default audience by recipient: a 1:1 message to a person is for that
+ * person (`human`); a message to an agent, a channel or a group is tagged
+ * `agent` and folded away from people by default.
+ */
+export function defaultAudienceFor(kind) {
+    return kind === "person" ? "human" : "agent";
+}
 //# sourceMappingURL=notify-recipient.js.map

package/dist/lib/secret-scan/repo-config.d.ts

@@ -26,13 +26,19 @@
  * there, because a pattern can always be widened, alone or combined with other
  * entries, to hide a real credential.
  *
- * Fails closed: anything not acceptable is a ScanConfigError, and the scan
- * exits 2 rather than running with a guess.
+ * An allowlist that is not acceptable is an InvalidAllowlistError. The scan
+ * then warns and runs with no repo allowlist at all (stricter, never looser),
+ * so a rejected file cannot block the commit that replaces it. Other config
+ * problems, such as an unknown --allowlist-rev, are a ScanConfigError and the
+ * scan exits 2.
  */
 import { type Probe } from "./probes.js";
 import { type CompiledAllowlist } from "./rules.js";
 export declare class ScanConfigError extends Error {
 }
+/** The repo's .gitleaks.toml cannot be used; the scan ignores it (see the top of the file). */
+export declare class InvalidAllowlistError extends ScanConfigError {
+}
 export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
 /**
  * The first probe credential the allowlist would hide, judged as the detector

package/dist/lib/secret-scan/repo-config.js

@@ -26,8 +26,11 @@
  * there, because a pattern can always be widened, alone or combined with other
  * entries, to hide a real credential.
  *
- * Fails closed: anything not acceptable is a ScanConfigError, and the scan
- * exits 2 rather than running with a guess.
+ * An allowlist that is not acceptable is an InvalidAllowlistError. The scan
+ * then warns and runs with no repo allowlist at all (stricter, never looser),
+ * so a rejected file cannot block the commit that replaces it. Other config
+ * problems, such as an unknown --allowlist-rev, are a ScanConfigError and the
+ * scan exits 2.
  */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -38,6 +41,9 @@ import { credentialProbes } from "./probes.js";
 import { compileAllowlist, compiledRules } from "./rules.js";
 export class ScanConfigError extends Error {
 }
+/** The repo's .gitleaks.toml cannot be used; the scan ignores it (see the top of the file). */
+export class InvalidAllowlistError extends ScanConfigError {
+}
 export const REPO_CONFIG_FILE = ".gitleaks.toml";
 const KEYS = new Set(["description", "condition", "regexTarget", "paths", "regexes", "stopwords", "commits", "targetRules"]);
 const MIN_PATH_PREFIX = 3;
@@ -68,7 +74,7 @@ export function suppressedProbe(al) {
     return probes.find((p, i) => probeBaseline[i] && scanFragment(probeFragment(p.line), rules).length === 0);
 }
 function fail(file, where, msg) {
-    throw new ScanConfigError(`${file}: ${where}: ${msg}`);
+    throw new InvalidAllowlistError(`${file}: ${where}: ${msg}`);
 }
 function stringList(file, where, key, v) {
     if (v === undefined)
@@ -292,7 +298,7 @@ function parseToml(text, file) {
         return parse(text);
     }
     catch (err) {
-        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+        throw new InvalidAllowlistError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
     }
 }
 function git(repoRoot, args) {
@@ -313,10 +319,10 @@ function entry(out, blobField) {
 }
 function readEntry(repoRoot, e, where) {
     if (e.mode === "120000")
-        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) is a symlink; commit a regular file`);
+        throw new InvalidAllowlistError(`${REPO_CONFIG_FILE} (${where}) is a symlink; commit a regular file`);
     const text = git(repoRoot, ["cat-file", "blob", e.blob]);
     if (text === null)
-        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) could not be read from git`);
+        throw new InvalidAllowlistError(`${REPO_CONFIG_FILE} (${where}) could not be read from git`);
     return text;
 }
 /**

package/dist/lib/secret-scan/staged.d.ts

@@ -13,6 +13,12 @@ export interface ParsedDiff {
 export declare function parseUnifiedDiff(diff: string): ParsedDiff;
 export declare function stagedDiff(cwd: string): string;
 export declare function repoRoot(cwd: string): string;
+/**
+ * The repo's allowlists, or none when its .gitleaks.toml is rejected. The
+ * warning is fixed text: a validation message can quote a path or other
+ * entry, and an entry can hold a credential.
+ */
+export declare const ALLOWLIST_IGNORED_WARNING = "HQ secret scan: warning: the repo .gitleaks.toml allowlist was rejected; ignoring it and scanning with no repo allowlist";
 /**
  * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
  * relative to the repo root, as gitleaks' allowlist paths are.

package/dist/lib/secret-scan/staged.js

@@ -5,7 +5,7 @@ import { execFileSync } from "node:child_process";
 import { readFileSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import { scanFragment, scanPath } from "./detect.js";
-import { loadCommittedAllowlists, loadRepoAllowlists } from "./repo-config.js";
+import { InvalidAllowlistError, loadCommittedAllowlists, loadRepoAllowlists } from "./repo-config.js";
 import { compiledRules } from "./rules.js";
 export class ScanInputError extends Error {
 }
@@ -101,13 +101,31 @@ export function repoRoot(cwd) {
         throw new ScanInputError(`could not find the repo root: ${detail || "git rev-parse failed"}`);
     }
 }
+/**
+ * The repo's allowlists, or none when its .gitleaks.toml is rejected. The
+ * warning is fixed text: a validation message can quote a path or other
+ * entry, and an entry can hold a credential.
+ */
+export const ALLOWLIST_IGNORED_WARNING = "HQ secret scan: warning: the repo .gitleaks.toml allowlist was rejected; ignoring it and scanning with no repo allowlist";
+function repoAllowlistsOrNone(load) {
+    try {
+        return load();
+    }
+    catch (err) {
+        if (!(err instanceof InvalidAllowlistError))
+            throw err;
+        process.stderr.write(`${ALLOWLIST_IGNORED_WARNING}\n`);
+        return [];
+    }
+}
 /**
  * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
  * relative to the repo root, as gitleaks' allowlist paths are.
  */
 export function scanStaged(cwd) {
     const diff = stagedDiff(cwd);
-    const rules = { ...compiledRules(), repo: loadRepoAllowlists(repoRoot(cwd)) };
+    const root = repoRoot(cwd);
+    const rules = { ...compiledRules(), repo: repoAllowlistsOrNone(() => loadRepoAllowlists(root)) };
     const { fragments, binaryFiles } = parseUnifiedDiff(diff);
     return [...fragments.flatMap((f) => scanFragment(f, rules)), ...binaryFiles.flatMap((f) => scanPath(f, rules))];
 }
@@ -145,7 +163,7 @@ function matchPath(p, repo, snapshotRoot) {
 }
 export function scanFiles(paths, opts = {}) {
     const root = opts.repo !== undefined ? repoRoot(opts.repo) : undefined;
-    const rules = root !== undefined ? { ...compiledRules(), repo: loadCommittedAllowlists(root, opts.allowlistRev) } : compiledRules();
+    const rules = root !== undefined ? { ...compiledRules(), repo: repoAllowlistsOrNone(() => loadCommittedAllowlists(root, opts.allowlistRev)) } : compiledRules();
     const repo = root !== undefined ? real(root) : undefined;
     const snapshotRoot = opts.snapshotRoot !== undefined ? real(opts.snapshotRoot) : undefined;
     const out = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.165",
+  "version": "5.345.168",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -52,7 +52,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "6.18.100",
+    "@indigoai-us/hq-cloud": "6.18.101",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.165",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.165",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.165",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.165",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.165",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.165"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.168",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.168",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.168",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.168",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.168",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.168"
   }
 }