@indigoai-us/hq-cli 5.345.168 → 5.345.169

package/dist/lib/doctor/fix/refresh-sync-outcome.d.ts

@@ -1,5 +1,5 @@
 /** Privacy-safe outcomes for a targeted refresh-sync attempt. */
-export declare const REFRESH_SYNC_OUTCOMES: readonly ["pull-succeeded", "pull-timeout", "pull-failed:4xx", "pull-failed:5xx", "pull-failed:network", "pull-failed:other"];
+export declare const REFRESH_SYNC_OUTCOMES: readonly ["pull-succeeded", "pull-timeout", "pull-handed-off", "pull-preempted", "pull-timeout-capped", "pull-failed:lock-busy", "pull-failed:4xx", "pull-failed:5xx", "pull-failed:network", "pull-failed:other"];
 export type RefreshSyncOutcome = (typeof REFRESH_SYNC_OUTCOMES)[number];
 /** Outcomes that say nothing about the journal itself: offline, timed out, or the service failed. */
 export declare const TRANSIENT_REFRESH_SYNC_OUTCOMES: ReadonlySet<RefreshSyncOutcome>;

package/dist/lib/doctor/fix/refresh-sync-outcome.js

@@ -2,6 +2,10 @@
 export const REFRESH_SYNC_OUTCOMES = [
     "pull-succeeded",
     "pull-timeout",
+    "pull-handed-off",
+    "pull-preempted",
+    "pull-timeout-capped",
+    "pull-failed:lock-busy",
     "pull-failed:4xx",
     "pull-failed:5xx",
     "pull-failed:network",
@@ -10,6 +14,10 @@ export const REFRESH_SYNC_OUTCOMES = [
 /** Outcomes that say nothing about the journal itself: offline, timed out, or the service failed. */
 export const TRANSIENT_REFRESH_SYNC_OUTCOMES = new Set([
     "pull-timeout",
+    "pull-handed-off",
+    "pull-preempted",
+    "pull-timeout-capped",
+    "pull-failed:lock-busy",
     "pull-failed:network",
     "pull-failed:5xx",
 ]);
@@ -26,6 +34,11 @@ export function classifyRefreshSyncOutcome(observation) {
     if (!errorCode && observation.status === 0) {
         return "pull-succeeded";
     }
+    // Another HQ operation (usually the sync runner's pass) held the per-root
+    // lock past --lock-timeout. Nothing is wrong with the journal itself.
+    if (/another HQ operation is already\s+running/.test(details)) {
+        return "pull-failed:lock-busy";
+    }
     const httpStatus = /(?:HTTP(?:\/\d(?:\.\d)?)?\s+|status(?:\s+code)?\s*[=: ]\s*)([45]\d\d)\b/i.exec(details)?.[1] ?? "";
     if (httpStatus.startsWith("4"))
         return "pull-failed:4xx";

package/dist/lib/doctor/types.d.ts

@@ -19,7 +19,7 @@ export declare const DOCTOR_STATUSES: readonly ["PASS", "FAIL", "WARN", "UNTESTE
  */
 export type DoctorStatus = (typeof DOCTOR_STATUSES)[number];
 /** Stable, privacy-safe diagnostics emitted by the sync health family. */
-export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "company-not-resolved", "legacy-personal-journal", "never-synced", "invalid-last-sync", "stale-threshold", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "pull-access-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
+export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "company-not-resolved", "legacy-personal-journal", "never-synced", "invalid-last-sync", "stale-threshold", "refresh-in-progress", "refresh-lock-held", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "pull-access-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
 export type SyncReasonCode = (typeof SYNC_REASON_CODES)[number];
 /** Runtime type guard: true only for a member of the fixed vocabulary. */
 export declare function isDoctorStatus(value: unknown): value is DoctorStatus;

package/dist/lib/doctor/types.js

@@ -31,6 +31,8 @@ export const SYNC_REASON_CODES = [
     "never-synced",
     "invalid-last-sync",
     "stale-threshold",
+    "refresh-in-progress",
+    "refresh-lock-held",
     "manifest-unavailable",
     "manifest-state-unavailable",
     "no-manifest-scopes",

package/dist/sentry-before-send.js

@@ -2,6 +2,13 @@ const SENSITIVE_FIELD_NAMES = new Set([
     "password", "secret", "apikey", "api_key", "token",
     // Cognito token-response fields captured as error context.
     "idtoken", "accesstoken", "refreshtoken",
+    // Signed-URL query params, so scrubQueryString and key walks redact them.
+    "x-amz-signature", "x-amz-credential", "x-amz-security-token",
+    "x-goog-signature", "x-goog-credential", "signature", "sig",
+    // CloudFront signed-URL params, and the access-key ids paired with
+    // signatures; same names the string pattern below already covers.
+    "policy", "key-pair-id", "awsaccesskeyid", "googleaccessid",
+    "sessiontoken", "session_token",
 ]);
 // Stored lowercased; membership tested against `name.toLowerCase()`.
 // MUST cover BOTH Auth.js v5 (current in hq-console, pinned to
@@ -110,6 +117,10 @@ const SENSITIVE_STRING_PATTERNS = [
     /\b(password|secret|api[_-]?key|(?:id|access|refresh)[_-]?token|token)\s*[:=]\s*[^\s&"'<>]+/gi,
     /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi,
     /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+    // Signed-URL params (SigV4/SigV2, GCS, CloudFront, Azure SAS): plain, at the
+    // start of a bare query string, or URL-encoded. S3 presigned URLs carry the
+    // STS session token in X-Amz-Security-Token (feedback family ec9435cd).
+    /(?:^|(?<=[?&;\s"'(]|%3F|%26))(?:X-Amz-Signature|X-Amz-Credential|X-Amz-Security-Token|X-Amz-SignedHeaders|AWSAccessKeyId|Signature|X-Goog-Signature|X-Goog-Credential|GoogleAccessId|Policy|Key-Pair-Id|sig)(?:=|%3D)[^&\s"'#<>]+/gi,
 ];
 function scrubString(s) {
     let out = s;
@@ -197,6 +208,8 @@ export function beforeSend(event, _hint) {
             "never-synced",
             "invalid-last-sync",
             "stale-threshold",
+            "refresh-in-progress",
+            "refresh-lock-held",
             "manifest-unavailable",
             "manifest-state-unavailable",
             "no-manifest-scopes",

package/dist/utils/breadcrumb-buffer.js

@@ -1,15 +1,26 @@
+import { scrubDiagnosticsValue } from "./scrub-diagnostics.js";
 const BUFFER_SIZE = 20;
 const _buffer = [];
-// Sentry beforeBreadcrumb hook: records every breadcrumb in a ring buffer
-// and returns it unchanged so Sentry still processes it normally.
+// Sentry beforeBreadcrumb hook: records a scrubbed copy of every breadcrumb in
+// a ring buffer and returns the original so Sentry still processes it (its
+// own beforeSend scrubber runs on the way out). The buffer feeds feedback
+// diagnostics, which beforeSend never sees, so it must never hold raw
+// presigned URLs or tokens.
 export function beforeBreadcrumb(breadcrumb) {
-    _buffer.push(breadcrumb);
+    let copy;
+    try {
+        copy = scrubDiagnosticsValue(breadcrumb);
+    }
+    catch {
+        copy = { category: breadcrumb.category, message: "[breadcrumb dropped: scrub failed]" };
+    }
+    _buffer.push(copy);
     if (_buffer.length > BUFFER_SIZE) {
         _buffer.shift();
     }
     return breadcrumb;
 }
 export function getRecentBreadcrumbs() {
-    return [..._buffer];
+    return scrubDiagnosticsValue([..._buffer]);
 }
 //# sourceMappingURL=breadcrumb-buffer.js.map

package/dist/utils/feedback-diagnostics.js

@@ -4,6 +4,7 @@ import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
 import { CLI_VERSION } from "../cli-version.js";
 import { collectVersions } from "./feedback-versions.js";
 import { sanitizeArgv } from "./sanitize-argv.js";
+import { scrubDiagnosticsValue } from "./scrub-diagnostics.js";
 export { sanitizeArgv } from "./sanitize-argv.js";
 function sanitizeRemoteUrl(url) {
     return url.replace(/https?:\/\/[^@]+@/, "https://***@");
@@ -49,7 +50,9 @@ function collectGitContext() {
     return { branch, head, dirty, remoteUrl };
 }
 export function collectDiagnostics() {
-    return {
+    // Every field passes through the scrubber, not only the breadcrumbs: argv,
+    // cwd and the git remote can also carry a presigned URL or a token.
+    return scrubDiagnosticsValue({
         cliVersion: CLI_VERSION,
         versions: collectVersions(),
         nodeVersion: process.version,
@@ -62,6 +65,6 @@ export function collectDiagnostics() {
         cwd: process.cwd(),
         git: collectGitContext(),
         recentSentryBreadcrumbs: getRecentBreadcrumbs(),
-    };
+    });
 }
 //# sourceMappingURL=feedback-diagnostics.js.map

package/dist/utils/feedback-logs.d.ts

@@ -181,6 +181,13 @@ export interface LogCandidate {
     sizeBytes: number;
     modifiedMs: number;
 }
+/**
+ * Query parameters that sign or authorize a URL: AWS SigV4 (S3 presigned
+ * URLs carry the STS session token in X-Amz-Security-Token), legacy SigV2,
+ * GCS V4, CloudFront signed URLs and Azure SAS. Exported for the feedback
+ * diagnostics scrubber.
+ */
+export declare const SIGNED_URL_PARAM_PATTERN: RegExp;
 /**
  * Replace every secret-shaped span in `text`. Returns the redacted text and a
  * count of replacements, so triage can tell "no secrets present" from

package/dist/utils/feedback-logs.js

@@ -189,6 +189,13 @@ const FEEDBACK_ROOT_LOG_FILENAMES = [
     "boot-sync.log",
     "boot-capture.log",
 ];
+/**
+ * Query parameters that sign or authorize a URL: AWS SigV4 (S3 presigned
+ * URLs carry the STS session token in X-Amz-Security-Token), legacy SigV2,
+ * GCS V4, CloudFront signed URLs and Azure SAS. Exported for the feedback
+ * diagnostics scrubber.
+ */
+export const SIGNED_URL_PARAM_PATTERN = /((?:^|[?&;\s"'(]|%3F|%26)(?:X-Amz-Signature|X-Amz-Credential|X-Amz-Security-Token|X-Amz-SignedHeaders|AWSAccessKeyId|Signature|X-Goog-Signature|X-Goog-Credential|GoogleAccessId|Policy|Key-Pair-Id|sig|token|access_token|id_token|refresh_token|session_token)(?:=|%3D))[^&\s"'#<>]+/gi;
 /**
  * Redaction patterns, applied in order. Structured secrets (whole PEM blocks)
  * come first so a later, narrower pattern cannot chop one into fragments that
@@ -220,20 +227,47 @@ const REDACTION_PATTERNS = [
         pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/g,
         replace: () => "[redacted slack token]",
     },
+    // HQ API keys.
+    {
+        pattern: /\bhqk_[A-Za-z0-9_-]{8,}/g,
+        replace: () => "[redacted hq key]",
+    },
     // SigV4 presigned-URL material. Keeps the URL readable, drops what signs it.
     {
-        pattern: /([?&](?:X-Amz-Signature|X-Amz-Credential|X-Amz-Security-Token)=)[^&\s"']+/gi,
+        // Matches the param at a `?`/`&`/`;` boundary, at the start of a bare
+        // query string (Sentry's `http.query` breadcrumb field), or URL-encoded
+        // (`%3F`/`%26` boundary, `%3D` separator) inside another URL.
+        pattern: SIGNED_URL_PARAM_PATTERN,
         replace: (_m, prefix) => `${prefix}[redacted]`,
     },
     // `Authorization: Bearer <token>` in any casing.
+    // Signed-URL params written as header lines or quoted JSON keys
+    // (`X-Amz-Signature: v`, `"X-Amz-Credential":"v"`).
+    {
+        pattern: /("?\b(?:X-Amz-Signature|X-Amz-Credential|X-Amz-Security-Token|X-Goog-Signature|X-Goog-Credential)"?\s*:\s*"?)([^\s",;&}]+)/gi,
+        replace: (_m, prefix) => `${prefix}[redacted]`,
+    },
+    // `Authorization:` / `Proxy-Authorization:` with ANY scheme (Basic, Bearer,
+    // custom): the whole value to the end of the line or closing quote goes,
+    // however short.
+    {
+        pattern: /(\b(?:Proxy-)?Authorization"?\s*[:=]\s*"?)([^"\r\n]+)/gi,
+        replace: (_m, prefix) => `${prefix}[redacted]`,
+    },
+    // Bare scheme credentials outside a header. Basic requires a digit or a
+    // base64 symbol so prose like "Basic functionality" stays readable.
+    {
+        pattern: /\b([Bb]earer\s+)[A-Za-z0-9._~+/=-]{8,}/g,
+        replace: (_m, prefix) => `${prefix}[redacted]`,
+    },
     {
-        pattern: /\b([Bb]earer\s+)[A-Za-z0-9._~+/=-]{12,}/g,
+        pattern: /\b([Bb]asic\s+)(?=[A-Za-z0-9+/=]*[0-9+/=])[A-Za-z0-9+/=]{4,}/g,
         replace: (_m, prefix) => `${prefix}[redacted]`,
     },
     // Generic `key: value` / `key=value` for names that denote a secret. Runs
     // last so the specific patterns above produce the more informative label.
     {
-        pattern: /("?\b(?:token|secret|password|passwd|api[_-]?key|access[_-]?key|secret[_-]?key|auth[_-]?token|authorization|credential|session[_-]?token)"?\s*[:=]\s*"?)([^\s",;&}]{6,})/gi,
+        pattern: /("?\b(?:(?:access|id|refresh)[_-]?token|token|secret|password|passwd|api[_-]?key|access[_-]?key|secret[_-]?key|auth[_-]?token|authorization|credential|session[_-]?token)"?\s*[:=]\s*"?)([^\s",;&}]{6,})/gi,
         replace: (_m, prefix) => `${prefix}[redacted]`,
     },
 ];

package/dist/utils/scrub-diagnostics.d.ts

@@ -0,0 +1,4 @@
+export declare function isSensitiveDiagnosticsKey(key: string): boolean;
+export declare function scrubDiagnosticsString(value: string): string;
+export declare function scrubDiagnosticsValue<T>(value: T, seen?: WeakMap<object, unknown>): T;
+//# sourceMappingURL=scrub-diagnostics.d.ts.map

package/dist/utils/scrub-diagnostics.js

@@ -0,0 +1,95 @@
+import { redactLogText } from "./feedback-logs.js";
+/**
+ * Redaction for the feedback diagnostics blob.
+ *
+ * Feedback diagnostics are uploaded to hq-pro and stored on the feedback row.
+ * Sentry's `beforeSend` scrubber never sees them: the breadcrumb ring buffer
+ * records breadcrumbs in `beforeBreadcrumb`, before any scrubbing, and
+ * `collectDiagnostics` copied that buffer verbatim. Breadcrumbs from the
+ * Node http integration carry full request URLs, so S3 presigned URLs (with
+ * the STS session token in X-Amz-Security-Token) landed in stored rows.
+ *
+ * `scrubDiagnosticsValue` deep-copies any JSON-like value, replaces values
+ * under credential-named keys, and runs every string through the same
+ * redaction patterns as the inline log tails.
+ */
+const REDACTED = "[redacted]";
+// Compared after lowercasing and dropping every non-alphanumeric character,
+// so `X-Amz-Security-Token`, `x_amz_security_token` and `xAmzSecurityToken`
+// all normalize to the same entry.
+const SENSITIVE_KEYS = new Set([
+    "authorization",
+    "proxyauthorization",
+    "cookie",
+    "setcookie",
+    "token",
+    "accesstoken",
+    "idtoken",
+    "refreshtoken",
+    "sessiontoken",
+    "authtoken",
+    "bearertoken",
+    "securitytoken",
+    "xamzsecuritytoken",
+    "xamzsignature",
+    "xamzcredential",
+    "xapikey",
+    "xauthtoken",
+    "xaccesstoken",
+    "xsessiontoken",
+    "apikey",
+    "secret",
+    "clientsecret",
+    "secretaccesskey",
+    "password",
+    "passwd",
+    "signature",
+    "credential",
+    "credentials",
+    // Signed-URL params that arrive as structured keys (GCS, CloudFront, Azure SAS).
+    "xgoogsignature",
+    "xgoogcredential",
+    "googleaccessid",
+    "awsaccesskeyid",
+    "sig",
+    "policy",
+    "keypairid",
+]);
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+export function isSensitiveDiagnosticsKey(key) {
+    return SENSITIVE_KEYS.has(normalizeKey(key));
+}
+export function scrubDiagnosticsString(value) {
+    return redactLogText(value).text;
+}
+export function scrubDiagnosticsValue(value, seen = new WeakMap()) {
+    if (typeof value === "string")
+        return scrubDiagnosticsString(value);
+    if (value === null || typeof value !== "object")
+        return value;
+    const obj = value;
+    if (seen.has(obj))
+        return seen.get(obj);
+    if (Array.isArray(value)) {
+        const arr = [];
+        seen.set(obj, arr);
+        for (const item of value)
+            arr.push(scrubDiagnosticsValue(item, seen));
+        return arr;
+    }
+    const out = {};
+    seen.set(obj, out);
+    for (const [key, inner] of Object.entries(value)) {
+        const safeKey = scrubDiagnosticsString(key);
+        if (isSensitiveDiagnosticsKey(key) && inner !== null && inner !== undefined && inner !== "") {
+            out[safeKey] = REDACTED;
+        }
+        else {
+            out[safeKey] = scrubDiagnosticsValue(inner, seen);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=scrub-diagnostics.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.168",
+  "version": "5.345.169",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.168",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.168",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.168",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.168",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.168",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.168"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.169",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.169",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.169",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.169",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.169",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.169"
   }
 }