@indigoai-us/hq-cli 5.345.84 → 5.345.86

package/dist/lib/lanes/legacy-pool.js

@@ -0,0 +1,209 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { readProcStarttime } from "./spawn.js";
+// The runner writes loop.json after node start-up and a CPU sample, measured at
+// 0.8 to 1.8 s past the whole second `ps lstart` reports. A process that reused
+// the pid started after the recorded runner was alive at started_at, so its
+// lstart cannot fall a full second before started_at; the upper bound only
+// caps how slow a start-up is believed.
+const LOOP_START_WINDOW_MS = 60_000;
+function loopStartMatches(processStartedAt, loopStartedAt) {
+    if (processStartedAt === null || !Number.isFinite(loopStartedAt))
+        return false;
+    const delta = loopStartedAt - processStartedAt;
+    return delta > -1_000 && delta < LOOP_START_WINDOW_MS;
+}
+function poolSlots(text) {
+    const slots = [];
+    let inBlock = false;
+    let current;
+    const save = () => {
+        if (current?.workerId && current.status && current.pid && current.runDir)
+            slots.push(current);
+        current = undefined;
+    };
+    for (const line of text.split(/\r?\n/)) {
+        if (!inBlock) {
+            if (line === "conduct_pool:")
+                inBlock = true;
+            continue;
+        }
+        if (/^[^ \t]/.test(line)) {
+            save();
+            break;
+        }
+        const worker = /^ {2}- worker_id:\s*"?([^"\s]+)"?\s*$/.exec(line);
+        if (worker) {
+            save();
+            current = { workerId: worker[1] };
+            continue;
+        }
+        if (!current)
+            continue;
+        const field = /^ {4}(status|pid|run_dir):\s*(.*?)\s*$/.exec(line);
+        if (!field)
+            continue;
+        const value = field[2].replace(/^"|"$/g, "");
+        if (field[1] === "status")
+            current.status = value;
+        if (field[1] === "pid" && /^\d+$/.test(value))
+            current.pid = Number(value);
+        if (field[1] === "run_dir")
+            current.runDir = value;
+    }
+    save();
+    return slots;
+}
+function processSnapshot(pid) {
+    const argsResult = spawnSync("ps", ["-ww", "-p", String(pid), "-o", "args="], { encoding: "utf8", windowsHide: true });
+    if (argsResult.status !== 0)
+        return null;
+    const startResult = spawnSync("ps", ["-p", String(pid), "-o", "lstart="], { encoding: "utf8", windowsHide: true });
+    const startedAt = startResult.status === 0 ? Date.parse(startResult.stdout.trim()) : NaN;
+    return { args: argsResult.stdout.trim(), startedAt: Number.isFinite(startedAt) ? startedAt : null };
+}
+function readProcessList() {
+    const result = spawnSync("ps", ["-ww", "-axo", "pid=,ppid=,args="], { encoding: "utf8", windowsHide: true });
+    if (result.status !== 0)
+        return [];
+    return result.stdout.split("\n").flatMap((line) => {
+        const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+        return match ? [{ pid: Number(match[1]), ppid: Number(match[2]), args: match[3] ?? "" }] : [];
+    });
+}
+function hasLiveSessionAncestor(pid, processes) {
+    const byPid = new Map(processes.map((proc) => [proc.pid, proc]));
+    let current = byPid.get(pid);
+    const seen = new Set();
+    for (let hops = 0; current && current.pid > 1 && hops < 64; hops++) {
+        if (seen.has(current.pid))
+            return true;
+        seen.add(current.pid);
+        const argv = current.args.trim().split(/\s+/);
+        const base = (arg) => arg?.split(/[\\/]/).at(-1)?.toLowerCase();
+        const names = new Set(["claude", "codex", "codex-code-mode-host", "grok", "grok-cli"]);
+        if (names.has(base(argv[0]) ?? "") || ((["bash", "sh", "zsh", "dash", "ksh", "node", "env"].includes(base(argv[0]) ?? "")) && names.has(base(argv[1]) ?? "")))
+            return true;
+        current = byPid.get(current.ppid);
+    }
+    return false;
+}
+function sessionCompany(meta) {
+    return /^company_slug:\s*["']?([A-Za-z0-9._-]+)["']?\s*$/m.exec(meta)?.[1];
+}
+function loopRecords(root) {
+    const sessions = path.join(root, "workspace", "sessions");
+    const runnerRoot = path.resolve(root, "workspace", "tmp", "workflow-runner");
+    let sessionIds;
+    try {
+        sessionIds = fs.readdirSync(sessions);
+    }
+    catch {
+        return [];
+    }
+    const records = [];
+    for (const sessionId of sessionIds) {
+        const metaPath = path.join(sessions, sessionId, "meta.yaml");
+        let slots;
+        let meta;
+        try {
+            meta = fs.readFileSync(metaPath, "utf8");
+            slots = poolSlots(meta);
+        }
+        catch {
+            continue;
+        }
+        const companySlug = sessionCompany(meta);
+        for (const slot of slots) {
+            if (!Number.isSafeInteger(slot.pid) || slot.pid <= 1 || !["running", "waiting"].includes(slot.status))
+                continue;
+            const runDir = path.resolve(slot.runDir);
+            if (!runDir.startsWith(`${runnerRoot}${path.sep}`))
+                continue;
+            let loop;
+            try {
+                loop = JSON.parse(fs.readFileSync(path.join(runDir, "loop.json"), "utf8"));
+            }
+            catch {
+                continue;
+            }
+            if (loop.pid !== slot.pid || path.resolve(loop.run_dir ?? "") !== runDir)
+                continue;
+            records.push({ sessionId, ...(companySlug ? { companySlug } : {}), slot, loop });
+        }
+    }
+    return records;
+}
+export function findLegacyPoolLanes(root, deps = {}) {
+    const processes = (deps.processes ?? (() => {
+        const result = spawnSync("ps", ["-ww", "-axo", "pid=,ppid=,args="], { encoding: "utf8", windowsHide: true });
+        if (result.status !== 0)
+            return [];
+        return result.stdout.split("\n").flatMap((line) => {
+            const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+            return match ? [{ pid: Number(match[1]), ppid: Number(match[2]), args: match[3] ?? "" }] : [];
+        });
+    }))();
+    const alive = deps.isAlive ?? ((pid) => { try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    } });
+    const readStart = deps.readStarttime ?? readProcStarttime;
+    const now = deps.now?.() ?? new Date();
+    return loopRecords(root).flatMap(({ sessionId, companySlug, slot, loop }) => {
+        if (!alive(slot.pid))
+            return [];
+        const proc = (deps.snapshotProcess ?? processSnapshot)(slot.pid);
+        if (!proc)
+            return [];
+        const argsMatch = /(?:^|[\\/])workflow-runner\.mjs(?:\s|$)/.test(proc.args) && /(?:^|\s)--loop(?:\s|$)/.test(proc.args);
+        const identityMatches = argsMatch && loopStartMatches(proc.startedAt, Date.parse(loop.started_at ?? ""));
+        const ownerState = deps.sessionState?.(root, sessionId, now) ?? null;
+        if (deps.sessionState ? ownerState !== "ended" && ownerState !== "lost" : hasLiveSessionAncestor(slot.pid, processes))
+            return [];
+        const laneId = `legacy-${sessionId}-${slot.workerId}`;
+        return [{
+                lane_id: laneId,
+                legacy: true,
+                orphaned: true,
+                reason: identityMatches ? "legacy_conduct_session_gone" : "legacy_pid_reused_or_identity_unproven",
+                age_minutes: Number.isFinite(Date.parse(loop.started_at ?? ""))
+                    ? Math.max(0, Math.floor((now.getTime() - Date.parse(loop.started_at)) / 60_000))
+                    : 0,
+                session_id: sessionId,
+                ...(companySlug ? { company_slug: companySlug } : {}),
+                pid: slot.pid,
+                process_starttime: readStart(slot.pid),
+                loop_started_at: loop.started_at ?? "",
+                run_dir: slot.runDir,
+                ...(!identityMatches ? { would_stop: false } : {}),
+            }];
+    }).sort((a, b) => a.lane_id.localeCompare(b.lane_id));
+}
+export function stopLegacyPoolLane(root, finding, deps = {}) {
+    const processes = (deps.processes ?? readProcessList)();
+    const proc = (deps.snapshotProcess ?? processSnapshot)(finding.pid);
+    const readStart = deps.readStarttime ?? readProcStarttime;
+    if (!proc || finding.process_starttime === null || readStart(finding.pid) !== finding.process_starttime || !loopStartMatches(proc.startedAt, Date.parse(finding.loop_started_at)) || !/(?:^|[\\/])workflow-runner\.mjs(?:\s|$)/.test(proc.args) || !/(?:^|\s)--loop(?:\s|$)/.test(proc.args))
+        return false;
+    const signal = deps.signal ?? ((pid, value) => process.kill(pid, value));
+    if (processes.length > 0 && hasLiveSessionAncestor(finding.pid, processes))
+        return false;
+    if (deps.sessionState) {
+        const ownerState = deps.sessionState(root, finding.session_id, deps.now?.() ?? new Date());
+        if (ownerState !== "ended" && ownerState !== "lost")
+            return false;
+    }
+    try {
+        signal(finding.pid, "SIGTERM");
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=legacy-pool.js.map

package/dist/lib/lanes/reaper.d.ts

@@ -1,4 +1,5 @@
 import type { LaneRecord } from "./types.js";
+import { type LegacyPoolFinding } from "./legacy-pool.js";
 export declare const DEFAULT_REAP_MIN_AGE_MINUTES = 120;
 export declare const REAP_SINGLE_FLIGHT_LOCK_STALE_MS: number;
 export declare const REAP_RECENT_SWEEP_MS: number;
@@ -20,6 +21,8 @@ export interface ReapFinding {
     stop_complete?: boolean;
     stop_error?: string;
     stale_state?: string[];
+    legacy?: true;
+    run_dir?: string;
 }
 export interface ReapDeps {
     now?: () => Date;
@@ -31,6 +34,15 @@ export interface ReapDeps {
     stopEnabled?: (lane: LaneRecord) => Promise<boolean> | boolean;
     stopLane?: (laneId: string, reason: string) => Promise<void>;
     sleep?: (ms: number) => void;
+    rootScopedStateEnabled?: () => Promise<boolean> | boolean;
+    waitingSeniorEnabled?: () => Promise<boolean> | boolean;
+    legacyEnabled?: () => Promise<boolean> | boolean;
+    legacyStopEnabled?: () => Promise<boolean> | boolean;
+    stopLegacy?: (finding: LegacyPoolFinding) => boolean;
+    snapshotProcess?: (pid: number) => {
+        args: string;
+        startedAt: number | null;
+    } | null;
 }
 export declare function parseReapMinAge(value: string | undefined): number;
 export declare function isProcessRunning(pid: number): boolean;
@@ -39,6 +51,7 @@ export interface ReapOptions {
     minAgeMinutes: number;
     stop: boolean;
     applyStaleState: boolean;
+    legacy?: boolean;
     reason: string;
     json: boolean;
 }

package/dist/lib/lanes/reaper.js

@@ -1,5 +1,6 @@
 /** Session-start orphan lane sweep. Every destructive action is opt-in and gated. */
 import * as fs from "node:fs";
+import { createHash } from "node:crypto";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -7,6 +8,7 @@ import { laneRunsOnHost } from "./admission.js";
 import { laneRunDir, isPidRecordAlive, readPidRecord, readProcStarttime } from "./spawn.js";
 import { readAllLanes, readLane } from "./store.js";
 import { LanesError } from "./errors.js";
+import { findLegacyPoolLanes, stopLegacyPoolLane } from "./legacy-pool.js";
 export const DEFAULT_REAP_MIN_AGE_MINUTES = 120;
 export const REAP_SINGLE_FLIGHT_LOCK_STALE_MS = 60 * 60 * 1000;
 export const REAP_RECENT_SWEEP_MS = 30 * 60 * 1000;
@@ -15,6 +17,14 @@ const staleMarkerSnapshots = new WeakMap();
 function safeHostComponent(hostname) {
     return hostname.replace(/[^A-Za-z0-9._-]/g, "_") || "unknown-host";
 }
+function resolvedRootKey(root) {
+    let resolved = path.resolve(root);
+    try {
+        resolved = fs.realpathSync(root);
+    }
+    catch { /* use the normalized input path */ }
+    return createHash("sha256").update(resolved).digest("hex").slice(0, 12);
+}
 function reaperStateDirectory() {
     const stateRoot = process.env.HQ_LANES_REAPER_STATE_HOME?.trim() ||
         process.env.XDG_STATE_HOME?.trim() || path.join(os.homedir(), ".local", "state");
@@ -231,8 +241,15 @@ export async function classifyLocalLanes(root, now, minAgeMinutes, deps = {}) {
             const sessionState = deps.sessionState?.(root, lane.senior.id, now) ?? null;
             if (sessionState !== "ended" && sessionState !== "lost")
                 finding.reason = sessionState === "live" ? "senior_session_alive" : "senior_session_not_proven_dead";
-            else if (lane.state !== "running")
-                finding.reason = "lane_not_running";
+            else if (lane.state !== "running") {
+                const waitingEnabled = deps.waitingSeniorEnabled ? await deps.waitingSeniorEnabled() : true;
+                if (waitingEnabled && ["queued", "awaiting_input", "blocked"].includes(lane.state)) {
+                    finding.orphaned = true;
+                    finding.reason = "senior_ended_while_waiting";
+                }
+                else
+                    finding.reason = "lane_not_running";
+            }
             else if (lane.keep_alive === true || lane.keep_alive_standing === true)
                 finding.reason = "keep_alive";
             else if (lane.senior_history.some((entry) => entry.reason === "reparented"))
@@ -276,7 +293,10 @@ export async function reapLocalLanes(root, options, deps = {}) {
     const stateDir = reaperStateDirectory();
     fs.mkdirSync(stateDir, { recursive: true });
     const host = safeHostComponent(deps.hostname?.() ?? os.hostname());
-    const lockDir = path.join(stateDir, `.lock-${host}`);
+    const rootScoped = deps.rootScopedStateEnabled ? await deps.rootScopedStateEnabled() : true;
+    const rootKey = resolvedRootKey(root);
+    const stateKey = rootScoped ? `${host}-${rootKey}` : host;
+    const lockDir = path.join(stateDir, `.lock-${stateKey}`);
     try {
         fs.mkdirSync(lockDir);
     }
@@ -301,7 +321,7 @@ export async function reapLocalLanes(root, options, deps = {}) {
             return { ok: true, action: "lanes.reap", generated_at: now.toISOString(), min_age_minutes: options.minAgeMinutes, mode: "report", stop_enabled: false, skipped: "already_running", lanes: [] };
         }
     }
-    const stamp = path.join(stateDir, `.last-sweep-${host}`);
+    const stamp = path.join(stateDir, `.last-sweep-${stateKey}`);
     if (!options.stop && !options.applyStaleState) {
         try {
             const stampText = fs.readFileSync(stamp, "utf8").trim();
@@ -319,6 +339,9 @@ export async function reapLocalLanes(root, options, deps = {}) {
     }
     try {
         const findings = await classifyLocalLanes(root, now, options.minAgeMinutes, deps);
+        const legacyEnabled = options.legacy && (deps.legacyEnabled ? await deps.legacyEnabled() : true);
+        const legacyFindings = legacyEnabled ? findLegacyPoolLanes(root, deps) : [];
+        findings.push(...legacyFindings);
         const isAlive = deps.isAlive ?? isProcessRunning;
         const readStart = deps.readStarttime ?? readProcStarttime;
         const clearStaleMarkerIfUnchanged = (finding, marker) => {
@@ -341,10 +364,25 @@ export async function reapLocalLanes(root, options, deps = {}) {
                         clearStaleMarkerIfUnchanged(finding, marker);
             }
             if (!finding.orphaned || !options.stop || finding.pid === undefined) {
-                if (finding.orphaned && options.stop)
+                if (finding.orphaned && options.stop && finding.pid !== undefined)
                     finding.would_stop = true;
                 continue;
             }
+            if (finding.legacy) {
+                const enabled = await (deps.legacyEnabled?.() ?? true) && await (deps.legacyStopEnabled?.() ?? false);
+                stopEnabled ||= enabled;
+                if (!enabled || finding.reason === "legacy_pid_reused_or_identity_unproven") {
+                    finding.would_stop = false;
+                    continue;
+                }
+                const legacy = finding;
+                const stopped = (deps.stopLegacy ?? ((item) => stopLegacyPoolLane(root, item, deps)))(legacy);
+                finding.stopped = stopped;
+                finding.would_stop = !stopped;
+                if (!stopped)
+                    finding.reason = "legacy_identity_changed_before_stop";
+                continue;
+            }
             const lane = readLane(root, finding.lane_id);
             const enabled = await (deps.stopEnabled?.(lane) ?? false);
             stopEnabled ||= enabled;

package/dist/lib/secret-scan/detect.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Secret detection over text fragments, following gitleaks' detection model:
+ * global path allowlist, per-rule path filter, keyword prefilter, regex match,
+ * secret-group selection, Shannon-entropy floor, allowlists (OR/AND; target
+ * secret, match, or line; stopwords), and the inline `gitleaks:allow` marker.
+ *
+ * Findings carry rule, file and line only. The secret value never leaves this
+ * module.
+ */
+import { type CompiledRuleSet } from "./rules.js";
+import type { SecretFinding } from "./types.js";
+/** Inline markers that suppress a finding on that line. */
+export declare const ALLOW_MARKERS: readonly ["gitleaks:allow", "hq-secret-scan:allow"];
+export interface Fragment {
+    file: string;
+    text: string;
+    /** 1-based line number of the first line of `text` in the file. */
+    startLine: number;
+}
+/** Shannon entropy in bits per character (gitleaks' definition). */
+export declare function shannonEntropy(data: string): number;
+/** True when the global allowlist excludes this path from scanning. */
+export declare function pathIgnored(file: string, rules?: CompiledRuleSet): boolean;
+/** Path-only rules (e.g. a committed .p12 keystore); for binary or whole-file adds. */
+export declare function scanPath(file: string, rules?: CompiledRuleSet): SecretFinding[];
+export declare function scanFragment(frag: Fragment, rules?: CompiledRuleSet): SecretFinding[];
+//# sourceMappingURL=detect.d.ts.map

package/dist/lib/secret-scan/detect.js

@@ -0,0 +1,129 @@
+/**
+ * Secret detection over text fragments, following gitleaks' detection model:
+ * global path allowlist, per-rule path filter, keyword prefilter, regex match,
+ * secret-group selection, Shannon-entropy floor, allowlists (OR/AND; target
+ * secret, match, or line; stopwords), and the inline `gitleaks:allow` marker.
+ *
+ * Findings carry rule, file and line only. The secret value never leaves this
+ * module.
+ */
+import { compiledRules } from "./rules.js";
+/** Inline markers that suppress a finding on that line. */
+export const ALLOW_MARKERS = ["gitleaks:allow", "hq-secret-scan:allow"];
+/** Shannon entropy in bits per character (gitleaks' definition). */
+export function shannonEntropy(data) {
+    if (!data)
+        return 0;
+    const counts = new Map();
+    for (const ch of data)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    const len = Buffer.byteLength(data, "utf8");
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const freq = count / len;
+        entropy -= freq * Math.log2(freq);
+    }
+    return entropy;
+}
+function allowed(al, c) {
+    const target = al.target === "match" ? c.match : al.target === "line" ? c.line : c.secret;
+    const checks = [];
+    if (al.paths.length)
+        checks.push(al.paths.some((p) => p.test(c.file)));
+    if (al.regexes.length)
+        checks.push(al.regexes.some((r) => r.test(target)));
+    if (al.stopwords.length) {
+        const lower = c.secret.toLowerCase();
+        checks.push(al.stopwords.some((s) => lower.includes(s)));
+    }
+    if (!checks.length)
+        return false;
+    return al.condition === "AND" ? checks.every(Boolean) : checks.some(Boolean);
+}
+function lineBounds(text, start, end) {
+    const from = text.lastIndexOf("\n", start - 1) + 1;
+    const nl = text.indexOf("\n", Math.max(end - 1, start));
+    const to = nl < 0 ? text.length : nl;
+    let offset = 0;
+    for (let i = 0; i < from; i++)
+        if (text.charCodeAt(i) === 10)
+            offset++;
+    return { line: text.slice(from, to), offset };
+}
+/** True when the global allowlist excludes this path from scanning. */
+export function pathIgnored(file, rules = compiledRules()) {
+    return rules.global.paths.some((p) => p.test(file));
+}
+/** Path-only rules (e.g. a committed .p12 keystore); for binary or whole-file adds. */
+export function scanPath(file, rules = compiledRules()) {
+    if (pathIgnored(file, rules))
+        return [];
+    return rules.rules
+        .filter((r) => !r.regex && r.path?.test(file))
+        .map((r) => ({ ruleId: r.id, description: r.description, file, line: 1 }));
+}
+export function scanFragment(frag, rules = compiledRules()) {
+    const { file, text, startLine } = frag;
+    if (!text || pathIgnored(file, rules))
+        return [];
+    const lower = text.toLowerCase();
+    const seen = new Set();
+    const findings = [];
+    for (const rule of rules.rules) {
+        if (!rule.regex)
+            continue;
+        if (rule.path && !rule.path.test(file))
+            continue;
+        if (rule.keywords.length && !rule.keywords.some((k) => lower.includes(k)))
+            continue;
+        const re = rule.regex;
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(text)) !== null) {
+            if (m[0].length === 0) {
+                re.lastIndex++;
+                continue;
+            }
+            let secret = m[0];
+            if (m.length > 1) {
+                if (rule.secretGroup && rule.secretGroup > 0)
+                    secret = m[rule.secretGroup] ?? "";
+                else
+                    secret = m.slice(1).find((g) => g !== undefined && g.length > 0) ?? m[0];
+            }
+            if (!secret)
+                continue;
+            if (rule.entropy !== undefined && rule.entropy !== 0 && shannonEntropy(secret) <= rule.entropy)
+                continue;
+            const { line, offset } = lineBounds(text, m.index, m.index + m[0].length);
+            if (ALLOW_MARKERS.some((mk) => line.includes(mk)))
+                continue;
+            const cand = { file, secret, match: m[0], line };
+            if (allowed(rules.global, cand))
+                continue;
+            if (rule.allowlists.some((al) => allowed(al, cand)))
+                continue;
+            const lineNo = startLine + offset;
+            const key = `${rule.id}:${lineNo}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            findings.push({ ruleId: rule.id, description: rule.description, file, line: lineNo });
+        }
+    }
+    return dedupeByLine(findings).sort((a, b) => a.line - b.line || a.ruleId.localeCompare(b.ruleId));
+}
+/**
+ * One line, one report: when a provider-specific rule fired on a line, drop the
+ * catch-all `generic-api-key` and HQ fallback (`hq-*`) findings for that line,
+ * as gitleaks does for its generic rule.
+ */
+function dedupeByLine(findings) {
+    const fallback = (id) => id === "generic-api-key" || id.startsWith("hq-");
+    const specific = new Set(findings.filter((f) => !fallback(f.ruleId)).map((f) => f.line));
+    const out = findings.filter((f) => !fallback(f.ruleId) || !specific.has(f.line));
+    // Between the two fallbacks, prefer the HQ rule (names the provider).
+    const hqLines = new Set(out.filter((f) => f.ruleId.startsWith("hq-")).map((f) => f.line));
+    return out.filter((f) => f.ruleId !== "generic-api-key" || !hqLines.has(f.line));
+}
+//# sourceMappingURL=detect.js.map

package/dist/lib/secret-scan/gitleaks-rules.generated.d.ts

@@ -0,0 +1,6 @@
+import type { GitleaksConfig } from "./types.js";
+export declare const GITLEAKS_UPSTREAM_VERSION = "v8.30.1";
+/** Upstream license; shipped with the derived rules as MIT requires. */
+export declare const GITLEAKS_LICENSE = "MIT License\n\nCopyright (c) 2019 Zachary Rice\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n";
+export declare const GITLEAKS_CONFIG: GitleaksConfig;
+//# sourceMappingURL=gitleaks-rules.generated.d.ts.map