@indigoai-us/hq-cli 5.345.166 → 5.345.169

package/dist/lib/doctor/fix/refresh-sync-outcome.d.ts

@@ -1,5 +1,5 @@
 /** Privacy-safe outcomes for a targeted refresh-sync attempt. */
-export declare const REFRESH_SYNC_OUTCOMES: readonly ["pull-succeeded", "pull-timeout", "pull-failed:4xx", "pull-failed:5xx", "pull-failed:network", "pull-failed:other"];
+export declare const REFRESH_SYNC_OUTCOMES: readonly ["pull-succeeded", "pull-timeout", "pull-handed-off", "pull-preempted", "pull-timeout-capped", "pull-failed:lock-busy", "pull-failed:4xx", "pull-failed:5xx", "pull-failed:network", "pull-failed:other"];
 export type RefreshSyncOutcome = (typeof REFRESH_SYNC_OUTCOMES)[number];
 /** Outcomes that say nothing about the journal itself: offline, timed out, or the service failed. */
 export declare const TRANSIENT_REFRESH_SYNC_OUTCOMES: ReadonlySet<RefreshSyncOutcome>;

package/dist/lib/doctor/fix/refresh-sync-outcome.js

@@ -2,6 +2,10 @@
 export const REFRESH_SYNC_OUTCOMES = [
     "pull-succeeded",
     "pull-timeout",
+    "pull-handed-off",
+    "pull-preempted",
+    "pull-timeout-capped",
+    "pull-failed:lock-busy",
     "pull-failed:4xx",
     "pull-failed:5xx",
     "pull-failed:network",
@@ -10,6 +14,10 @@ export const REFRESH_SYNC_OUTCOMES = [
 /** Outcomes that say nothing about the journal itself: offline, timed out, or the service failed. */
 export const TRANSIENT_REFRESH_SYNC_OUTCOMES = new Set([
     "pull-timeout",
+    "pull-handed-off",
+    "pull-preempted",
+    "pull-timeout-capped",
+    "pull-failed:lock-busy",
     "pull-failed:network",
     "pull-failed:5xx",
 ]);
@@ -26,6 +34,11 @@ export function classifyRefreshSyncOutcome(observation) {
     if (!errorCode && observation.status === 0) {
         return "pull-succeeded";
     }
+    // Another HQ operation (usually the sync runner's pass) held the per-root
+    // lock past --lock-timeout. Nothing is wrong with the journal itself.
+    if (/another HQ operation is already\s+running/.test(details)) {
+        return "pull-failed:lock-busy";
+    }
     const httpStatus = /(?:HTTP(?:\/\d(?:\.\d)?)?\s+|status(?:\s+code)?\s*[=: ]\s*)([45]\d\d)\b/i.exec(details)?.[1] ?? "";
     if (httpStatus.startsWith("4"))
         return "pull-failed:4xx";

package/dist/lib/doctor/types.d.ts

@@ -19,7 +19,7 @@ export declare const DOCTOR_STATUSES: readonly ["PASS", "FAIL", "WARN", "UNTESTE
  */
 export type DoctorStatus = (typeof DOCTOR_STATUSES)[number];
 /** Stable, privacy-safe diagnostics emitted by the sync health family. */
-export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "company-not-resolved", "legacy-personal-journal", "never-synced", "invalid-last-sync", "stale-threshold", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "pull-access-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
+export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "company-not-resolved", "legacy-personal-journal", "never-synced", "invalid-last-sync", "stale-threshold", "refresh-in-progress", "refresh-lock-held", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "pull-access-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
 export type SyncReasonCode = (typeof SYNC_REASON_CODES)[number];
 /** Runtime type guard: true only for a member of the fixed vocabulary. */
 export declare function isDoctorStatus(value: unknown): value is DoctorStatus;

package/dist/lib/doctor/types.js

@@ -31,6 +31,8 @@ export const SYNC_REASON_CODES = [
     "never-synced",
     "invalid-last-sync",
     "stale-threshold",
+    "refresh-in-progress",
+    "refresh-lock-held",
     "manifest-unavailable",
     "manifest-state-unavailable",
     "no-manifest-scopes",

package/dist/lib/notify-recipient.d.ts

@@ -4,4 +4,19 @@ export declare const AGENT_UID_PATTERN: RegExp;
 export declare const EMAIL_PATTERN: RegExp;
 export declare function isRecipientUid(value: string): boolean;
 export declare function isAgentUid(value: string): boolean;
+/** Who a notify message is for. */
+export type DmAudience = "human" | "agent" | "both";
+/** What a send is addressed to, for the default audience. */
+export type DmRecipientKind = "person" | "agent" | "channel" | "group";
+/**
+ * Classify a single 1:1 recipient (email, prs_ or agt_ uid) for the default
+ * audience. Anything that is not an agent uid is a person.
+ */
+export declare function recipientKindOf(recipient: string): "person" | "agent";
+/**
+ * Default audience by recipient: a 1:1 message to a person is for that
+ * person (`human`); a message to an agent, a channel or a group is tagged
+ * `agent` and folded away from people by default.
+ */
+export declare function defaultAudienceFor(kind: DmRecipientKind): DmAudience;
 //# sourceMappingURL=notify-recipient.d.ts.map

package/dist/lib/notify-recipient.js

@@ -8,4 +8,19 @@ export function isRecipientUid(value) {
 export function isAgentUid(value) {
     return AGENT_UID_PATTERN.test(value.trim());
 }
+/**
+ * Classify a single 1:1 recipient (email, prs_ or agt_ uid) for the default
+ * audience. Anything that is not an agent uid is a person.
+ */
+export function recipientKindOf(recipient) {
+    return /^agt_/.test(recipient.trim()) ? "agent" : "person";
+}
+/**
+ * Default audience by recipient: a 1:1 message to a person is for that
+ * person (`human`); a message to an agent, a channel or a group is tagged
+ * `agent` and folded away from people by default.
+ */
+export function defaultAudienceFor(kind) {
+    return kind === "person" ? "human" : "agent";
+}
 //# sourceMappingURL=notify-recipient.js.map

package/dist/lib/secret-scan/repo-config.d.ts

@@ -26,13 +26,19 @@
  * there, because a pattern can always be widened, alone or combined with other
  * entries, to hide a real credential.
  *
- * Fails closed: anything not acceptable is a ScanConfigError, and the scan
- * exits 2 rather than running with a guess.
+ * An allowlist that is not acceptable is an InvalidAllowlistError. The scan
+ * then warns and runs with no repo allowlist at all (stricter, never looser),
+ * so a rejected file cannot block the commit that replaces it. Other config
+ * problems, such as an unknown --allowlist-rev, are a ScanConfigError and the
+ * scan exits 2.
  */
 import { type Probe } from "./probes.js";
 import { type CompiledAllowlist } from "./rules.js";
 export declare class ScanConfigError extends Error {
 }
+/** The repo's .gitleaks.toml cannot be used; the scan ignores it (see the top of the file). */
+export declare class InvalidAllowlistError extends ScanConfigError {
+}
 export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
 /**
  * The first probe credential the allowlist would hide, judged as the detector

package/dist/lib/secret-scan/repo-config.js

@@ -26,8 +26,11 @@
  * there, because a pattern can always be widened, alone or combined with other
  * entries, to hide a real credential.
  *
- * Fails closed: anything not acceptable is a ScanConfigError, and the scan
- * exits 2 rather than running with a guess.
+ * An allowlist that is not acceptable is an InvalidAllowlistError. The scan
+ * then warns and runs with no repo allowlist at all (stricter, never looser),
+ * so a rejected file cannot block the commit that replaces it. Other config
+ * problems, such as an unknown --allowlist-rev, are a ScanConfigError and the
+ * scan exits 2.
  */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -38,6 +41,9 @@ import { credentialProbes } from "./probes.js";
 import { compileAllowlist, compiledRules } from "./rules.js";
 export class ScanConfigError extends Error {
 }
+/** The repo's .gitleaks.toml cannot be used; the scan ignores it (see the top of the file). */
+export class InvalidAllowlistError extends ScanConfigError {
+}
 export const REPO_CONFIG_FILE = ".gitleaks.toml";
 const KEYS = new Set(["description", "condition", "regexTarget", "paths", "regexes", "stopwords", "commits", "targetRules"]);
 const MIN_PATH_PREFIX = 3;
@@ -68,7 +74,7 @@ export function suppressedProbe(al) {
     return probes.find((p, i) => probeBaseline[i] && scanFragment(probeFragment(p.line), rules).length === 0);
 }
 function fail(file, where, msg) {
-    throw new ScanConfigError(`${file}: ${where}: ${msg}`);
+    throw new InvalidAllowlistError(`${file}: ${where}: ${msg}`);
 }
 function stringList(file, where, key, v) {
     if (v === undefined)
@@ -292,7 +298,7 @@ function parseToml(text, file) {
         return parse(text);
     }
     catch (err) {
-        throw new ScanConfigError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+        throw new InvalidAllowlistError(`${file}: could not be parsed: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
     }
 }
 function git(repoRoot, args) {
@@ -313,10 +319,10 @@ function entry(out, blobField) {
 }
 function readEntry(repoRoot, e, where) {
     if (e.mode === "120000")
-        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) is a symlink; commit a regular file`);
+        throw new InvalidAllowlistError(`${REPO_CONFIG_FILE} (${where}) is a symlink; commit a regular file`);
     const text = git(repoRoot, ["cat-file", "blob", e.blob]);
     if (text === null)
-        throw new ScanConfigError(`${REPO_CONFIG_FILE} (${where}) could not be read from git`);
+        throw new InvalidAllowlistError(`${REPO_CONFIG_FILE} (${where}) could not be read from git`);
     return text;
 }
 /**

package/dist/lib/secret-scan/staged.d.ts

@@ -13,6 +13,12 @@ export interface ParsedDiff {
 export declare function parseUnifiedDiff(diff: string): ParsedDiff;
 export declare function stagedDiff(cwd: string): string;
 export declare function repoRoot(cwd: string): string;
+/**
+ * The repo's allowlists, or none when its .gitleaks.toml is rejected. The
+ * warning is fixed text: a validation message can quote a path or other
+ * entry, and an entry can hold a credential.
+ */
+export declare const ALLOWLIST_IGNORED_WARNING = "HQ secret scan: warning: the repo .gitleaks.toml allowlist was rejected; ignoring it and scanning with no repo allowlist";
 /**
  * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
  * relative to the repo root, as gitleaks' allowlist paths are.

package/dist/lib/secret-scan/staged.js

@@ -5,7 +5,7 @@ import { execFileSync } from "node:child_process";
 import { readFileSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import { scanFragment, scanPath } from "./detect.js";
-import { loadCommittedAllowlists, loadRepoAllowlists } from "./repo-config.js";
+import { InvalidAllowlistError, loadCommittedAllowlists, loadRepoAllowlists } from "./repo-config.js";
 import { compiledRules } from "./rules.js";
 export class ScanInputError extends Error {
 }
@@ -101,13 +101,31 @@ export function repoRoot(cwd) {
         throw new ScanInputError(`could not find the repo root: ${detail || "git rev-parse failed"}`);
     }
 }
+/**
+ * The repo's allowlists, or none when its .gitleaks.toml is rejected. The
+ * warning is fixed text: a validation message can quote a path or other
+ * entry, and an entry can hold a credential.
+ */
+export const ALLOWLIST_IGNORED_WARNING = "HQ secret scan: warning: the repo .gitleaks.toml allowlist was rejected; ignoring it and scanning with no repo allowlist";
+function repoAllowlistsOrNone(load) {
+    try {
+        return load();
+    }
+    catch (err) {
+        if (!(err instanceof InvalidAllowlistError))
+            throw err;
+        process.stderr.write(`${ALLOWLIST_IGNORED_WARNING}\n`);
+        return [];
+    }
+}
 /**
  * Built-in rules plus the repo's own .gitleaks.toml allowlists. Diff paths are
  * relative to the repo root, as gitleaks' allowlist paths are.
  */
 export function scanStaged(cwd) {
     const diff = stagedDiff(cwd);
-    const rules = { ...compiledRules(), repo: loadRepoAllowlists(repoRoot(cwd)) };
+    const root = repoRoot(cwd);
+    const rules = { ...compiledRules(), repo: repoAllowlistsOrNone(() => loadRepoAllowlists(root)) };
     const { fragments, binaryFiles } = parseUnifiedDiff(diff);
     return [...fragments.flatMap((f) => scanFragment(f, rules)), ...binaryFiles.flatMap((f) => scanPath(f, rules))];
 }
@@ -145,7 +163,7 @@ function matchPath(p, repo, snapshotRoot) {
 }
 export function scanFiles(paths, opts = {}) {
     const root = opts.repo !== undefined ? repoRoot(opts.repo) : undefined;
-    const rules = root !== undefined ? { ...compiledRules(), repo: loadCommittedAllowlists(root, opts.allowlistRev) } : compiledRules();
+    const rules = root !== undefined ? { ...compiledRules(), repo: repoAllowlistsOrNone(() => loadCommittedAllowlists(root, opts.allowlistRev)) } : compiledRules();
     const repo = root !== undefined ? real(root) : undefined;
     const snapshotRoot = opts.snapshotRoot !== undefined ? real(opts.snapshotRoot) : undefined;
     const out = [];

package/dist/sentry-before-send.js

@@ -2,6 +2,13 @@ const SENSITIVE_FIELD_NAMES = new Set([
     "password", "secret", "apikey", "api_key", "token",
     // Cognito token-response fields captured as error context.
     "idtoken", "accesstoken", "refreshtoken",
+    // Signed-URL query params, so scrubQueryString and key walks redact them.
+    "x-amz-signature", "x-amz-credential", "x-amz-security-token",
+    "x-goog-signature", "x-goog-credential", "signature", "sig",
+    // CloudFront signed-URL params, and the access-key ids paired with
+    // signatures; same names the string pattern below already covers.
+    "policy", "key-pair-id", "awsaccesskeyid", "googleaccessid",
+    "sessiontoken", "session_token",
 ]);
 // Stored lowercased; membership tested against `name.toLowerCase()`.
 // MUST cover BOTH Auth.js v5 (current in hq-console, pinned to
@@ -110,6 +117,10 @@ const SENSITIVE_STRING_PATTERNS = [
     /\b(password|secret|api[_-]?key|(?:id|access|refresh)[_-]?token|token)\s*[:=]\s*[^\s&"'<>]+/gi,
     /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi,
     /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+    // Signed-URL params (SigV4/SigV2, GCS, CloudFront, Azure SAS): plain, at the
+    // start of a bare query string, or URL-encoded. S3 presigned URLs carry the
+    // STS session token in X-Amz-Security-Token (feedback family ec9435cd).
+    /(?:^|(?<=[?&;\s"'(]|%3F|%26))(?:X-Amz-Signature|X-Amz-Credential|X-Amz-Security-Token|X-Amz-SignedHeaders|AWSAccessKeyId|Signature|X-Goog-Signature|X-Goog-Credential|GoogleAccessId|Policy|Key-Pair-Id|sig)(?:=|%3D)[^&\s"'#<>]+/gi,
 ];
 function scrubString(s) {
     let out = s;
@@ -197,6 +208,8 @@ export function beforeSend(event, _hint) {
             "never-synced",
             "invalid-last-sync",
             "stale-threshold",
+            "refresh-in-progress",
+            "refresh-lock-held",
             "manifest-unavailable",
             "manifest-state-unavailable",
             "no-manifest-scopes",

package/dist/utils/breadcrumb-buffer.js

@@ -1,15 +1,26 @@
+import { scrubDiagnosticsValue } from "./scrub-diagnostics.js";
 const BUFFER_SIZE = 20;
 const _buffer = [];
-// Sentry beforeBreadcrumb hook: records every breadcrumb in a ring buffer
-// and returns it unchanged so Sentry still processes it normally.
+// Sentry beforeBreadcrumb hook: records a scrubbed copy of every breadcrumb in
+// a ring buffer and returns the original so Sentry still processes it (its
+// own beforeSend scrubber runs on the way out). The buffer feeds feedback
+// diagnostics, which beforeSend never sees, so it must never hold raw
+// presigned URLs or tokens.
 export function beforeBreadcrumb(breadcrumb) {
-    _buffer.push(breadcrumb);
+    let copy;
+    try {
+        copy = scrubDiagnosticsValue(breadcrumb);
+    }
+    catch {
+        copy = { category: breadcrumb.category, message: "[breadcrumb dropped: scrub failed]" };
+    }
+    _buffer.push(copy);
     if (_buffer.length > BUFFER_SIZE) {
         _buffer.shift();
     }
     return breadcrumb;
 }
 export function getRecentBreadcrumbs() {
-    return [..._buffer];
+    return scrubDiagnosticsValue([..._buffer]);
 }
 //# sourceMappingURL=breadcrumb-buffer.js.map

package/dist/utils/feedback-diagnostics.js

@@ -4,6 +4,7 @@ import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
 import { CLI_VERSION } from "../cli-version.js";
 import { collectVersions } from "./feedback-versions.js";
 import { sanitizeArgv } from "./sanitize-argv.js";
+import { scrubDiagnosticsValue } from "./scrub-diagnostics.js";
 export { sanitizeArgv } from "./sanitize-argv.js";
 function sanitizeRemoteUrl(url) {
     return url.replace(/https?:\/\/[^@]+@/, "https://***@");
@@ -49,7 +50,9 @@ function collectGitContext() {
     return { branch, head, dirty, remoteUrl };
 }
 export function collectDiagnostics() {
-    return {
+    // Every field passes through the scrubber, not only the breadcrumbs: argv,
+    // cwd and the git remote can also carry a presigned URL or a token.
+    return scrubDiagnosticsValue({
         cliVersion: CLI_VERSION,
         versions: collectVersions(),
         nodeVersion: process.version,
@@ -62,6 +65,6 @@ export function collectDiagnostics() {
         cwd: process.cwd(),
         git: collectGitContext(),
         recentSentryBreadcrumbs: getRecentBreadcrumbs(),
-    };
+    });
 }
 //# sourceMappingURL=feedback-diagnostics.js.map

package/dist/utils/feedback-logs.d.ts

@@ -181,6 +181,13 @@ export interface LogCandidate {
     sizeBytes: number;
     modifiedMs: number;
 }
+/**
+ * Query parameters that sign or authorize a URL: AWS SigV4 (S3 presigned
+ * URLs carry the STS session token in X-Amz-Security-Token), legacy SigV2,
+ * GCS V4, CloudFront signed URLs and Azure SAS. Exported for the feedback
+ * diagnostics scrubber.
+ */
+export declare const SIGNED_URL_PARAM_PATTERN: RegExp;
 /**
  * Replace every secret-shaped span in `text`. Returns the redacted text and a
  * count of replacements, so triage can tell "no secrets present" from

package/dist/utils/feedback-logs.js

@@ -189,6 +189,13 @@ const FEEDBACK_ROOT_LOG_FILENAMES = [
     "boot-sync.log",
     "boot-capture.log",
 ];
+/**
+ * Query parameters that sign or authorize a URL: AWS SigV4 (S3 presigned
+ * URLs carry the STS session token in X-Amz-Security-Token), legacy SigV2,
+ * GCS V4, CloudFront signed URLs and Azure SAS. Exported for the feedback
+ * diagnostics scrubber.
+ */
+export const SIGNED_URL_PARAM_PATTERN = /((?:^|[?&;\s"'(]|%3F|%26)(?:X-Amz-Signature|X-Amz-Credential|X-Amz-Security-Token|X-Amz-SignedHeaders|AWSAccessKeyId|Signature|X-Goog-Signature|X-Goog-Credential|GoogleAccessId|Policy|Key-Pair-Id|sig|token|access_token|id_token|refresh_token|session_token)(?:=|%3D))[^&\s"'#<>]+/gi;
 /**
  * Redaction patterns, applied in order. Structured secrets (whole PEM blocks)
  * come first so a later, narrower pattern cannot chop one into fragments that
@@ -220,20 +227,47 @@ const REDACTION_PATTERNS = [
         pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/g,
         replace: () => "[redacted slack token]",
     },
+    // HQ API keys.
+    {
+        pattern: /\bhqk_[A-Za-z0-9_-]{8,}/g,
+        replace: () => "[redacted hq key]",
+    },
     // SigV4 presigned-URL material. Keeps the URL readable, drops what signs it.
     {
-        pattern: /([?&](?:X-Amz-Signature|X-Amz-Credential|X-Amz-Security-Token)=)[^&\s"']+/gi,
+        // Matches the param at a `?`/`&`/`;` boundary, at the start of a bare
+        // query string (Sentry's `http.query` breadcrumb field), or URL-encoded
+        // (`%3F`/`%26` boundary, `%3D` separator) inside another URL.
+        pattern: SIGNED_URL_PARAM_PATTERN,
         replace: (_m, prefix) => `${prefix}[redacted]`,
     },
     // `Authorization: Bearer <token>` in any casing.
+    // Signed-URL params written as header lines or quoted JSON keys
+    // (`X-Amz-Signature: v`, `"X-Amz-Credential":"v"`).
+    {
+        pattern: /("?\b(?:X-Amz-Signature|X-Amz-Credential|X-Amz-Security-Token|X-Goog-Signature|X-Goog-Credential)"?\s*:\s*"?)([^\s",;&}]+)/gi,
+        replace: (_m, prefix) => `${prefix}[redacted]`,
+    },
+    // `Authorization:` / `Proxy-Authorization:` with ANY scheme (Basic, Bearer,
+    // custom): the whole value to the end of the line or closing quote goes,
+    // however short.
+    {
+        pattern: /(\b(?:Proxy-)?Authorization"?\s*[:=]\s*"?)([^"\r\n]+)/gi,
+        replace: (_m, prefix) => `${prefix}[redacted]`,
+    },
+    // Bare scheme credentials outside a header. Basic requires a digit or a
+    // base64 symbol so prose like "Basic functionality" stays readable.
+    {
+        pattern: /\b([Bb]earer\s+)[A-Za-z0-9._~+/=-]{8,}/g,
+        replace: (_m, prefix) => `${prefix}[redacted]`,
+    },
     {
-        pattern: /\b([Bb]earer\s+)[A-Za-z0-9._~+/=-]{12,}/g,
+        pattern: /\b([Bb]asic\s+)(?=[A-Za-z0-9+/=]*[0-9+/=])[A-Za-z0-9+/=]{4,}/g,
         replace: (_m, prefix) => `${prefix}[redacted]`,
     },
     // Generic `key: value` / `key=value` for names that denote a secret. Runs
     // last so the specific patterns above produce the more informative label.
     {
-        pattern: /("?\b(?:token|secret|password|passwd|api[_-]?key|access[_-]?key|secret[_-]?key|auth[_-]?token|authorization|credential|session[_-]?token)"?\s*[:=]\s*"?)([^\s",;&}]{6,})/gi,
+        pattern: /("?\b(?:(?:access|id|refresh)[_-]?token|token|secret|password|passwd|api[_-]?key|access[_-]?key|secret[_-]?key|auth[_-]?token|authorization|credential|session[_-]?token)"?\s*[:=]\s*"?)([^\s",;&}]{6,})/gi,
         replace: (_m, prefix) => `${prefix}[redacted]`,
     },
 ];

package/dist/utils/scrub-diagnostics.d.ts

@@ -0,0 +1,4 @@
+export declare function isSensitiveDiagnosticsKey(key: string): boolean;
+export declare function scrubDiagnosticsString(value: string): string;
+export declare function scrubDiagnosticsValue<T>(value: T, seen?: WeakMap<object, unknown>): T;
+//# sourceMappingURL=scrub-diagnostics.d.ts.map

package/dist/utils/scrub-diagnostics.js

@@ -0,0 +1,95 @@
+import { redactLogText } from "./feedback-logs.js";
+/**
+ * Redaction for the feedback diagnostics blob.
+ *
+ * Feedback diagnostics are uploaded to hq-pro and stored on the feedback row.
+ * Sentry's `beforeSend` scrubber never sees them: the breadcrumb ring buffer
+ * records breadcrumbs in `beforeBreadcrumb`, before any scrubbing, and
+ * `collectDiagnostics` copied that buffer verbatim. Breadcrumbs from the
+ * Node http integration carry full request URLs, so S3 presigned URLs (with
+ * the STS session token in X-Amz-Security-Token) landed in stored rows.
+ *
+ * `scrubDiagnosticsValue` deep-copies any JSON-like value, replaces values
+ * under credential-named keys, and runs every string through the same
+ * redaction patterns as the inline log tails.
+ */
+const REDACTED = "[redacted]";
+// Compared after lowercasing and dropping every non-alphanumeric character,
+// so `X-Amz-Security-Token`, `x_amz_security_token` and `xAmzSecurityToken`
+// all normalize to the same entry.
+const SENSITIVE_KEYS = new Set([
+    "authorization",
+    "proxyauthorization",
+    "cookie",
+    "setcookie",
+    "token",
+    "accesstoken",
+    "idtoken",
+    "refreshtoken",
+    "sessiontoken",
+    "authtoken",
+    "bearertoken",
+    "securitytoken",
+    "xamzsecuritytoken",
+    "xamzsignature",
+    "xamzcredential",
+    "xapikey",
+    "xauthtoken",
+    "xaccesstoken",
+    "xsessiontoken",
+    "apikey",
+    "secret",
+    "clientsecret",
+    "secretaccesskey",
+    "password",
+    "passwd",
+    "signature",
+    "credential",
+    "credentials",
+    // Signed-URL params that arrive as structured keys (GCS, CloudFront, Azure SAS).
+    "xgoogsignature",
+    "xgoogcredential",
+    "googleaccessid",
+    "awsaccesskeyid",
+    "sig",
+    "policy",
+    "keypairid",
+]);
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+export function isSensitiveDiagnosticsKey(key) {
+    return SENSITIVE_KEYS.has(normalizeKey(key));
+}
+export function scrubDiagnosticsString(value) {
+    return redactLogText(value).text;
+}
+export function scrubDiagnosticsValue(value, seen = new WeakMap()) {
+    if (typeof value === "string")
+        return scrubDiagnosticsString(value);
+    if (value === null || typeof value !== "object")
+        return value;
+    const obj = value;
+    if (seen.has(obj))
+        return seen.get(obj);
+    if (Array.isArray(value)) {
+        const arr = [];
+        seen.set(obj, arr);
+        for (const item of value)
+            arr.push(scrubDiagnosticsValue(item, seen));
+        return arr;
+    }
+    const out = {};
+    seen.set(obj, out);
+    for (const [key, inner] of Object.entries(value)) {
+        const safeKey = scrubDiagnosticsString(key);
+        if (isSensitiveDiagnosticsKey(key) && inner !== null && inner !== undefined && inner !== "") {
+            out[safeKey] = REDACTED;
+        }
+        else {
+            out[safeKey] = scrubDiagnosticsValue(inner, seen);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=scrub-diagnostics.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.166",
+  "version": "5.345.169",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.166",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.166",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.166",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.166",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.166",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.166"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.169",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.169",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.169",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.169",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.169",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.169"
   }
 }