@indigoai-us/hq-cli 5.345.84 → 5.345.86

package/dist/lib/secret-scan/go-regex.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Translate a Go RE2 regular expression (as written in the gitleaks config)
+ * into an equivalent JavaScript RegExp source that compiles on Node 20+.
+ *
+ * Node 20/22 do not support scoped modifiers like `(?i:...)` or a mid-pattern
+ * `(?i)`, so case-insensitivity is expanded inline: inside a case-insensitive
+ * scope every ASCII letter `a` becomes `[aA]`, and character classes gain the
+ * other-case counterpart of each letter and letter range. Patterns are then
+ * compiled with no flags, which keeps `(?-i:...)` exact.
+ *
+ * Other RE2 differences handled:
+ *   (?s:...) / (?s)  `.` in scope becomes `[\s\S]`
+ *   (?P<name>        becomes `(?<name>`
+ *   \z  \A           become `$`  `^` (no `m` flag, so both anchor the input)
+ *   [[:alnum:]] etc. POSIX classes inside a bracket expression
+ *
+ * Throws on syntax this translator does not understand rather than guessing.
+ */
+export declare function translateGoRegex(src: string): string;
+/** Compile a Go RE2 pattern to a JavaScript RegExp (extra flags e.g. "g"). */
+export declare function compileGoRegex(src: string, flags?: string): RegExp;
+//# sourceMappingURL=go-regex.d.ts.map

package/dist/lib/secret-scan/go-regex.js

@@ -0,0 +1,250 @@
+/**
+ * Translate a Go RE2 regular expression (as written in the gitleaks config)
+ * into an equivalent JavaScript RegExp source that compiles on Node 20+.
+ *
+ * Node 20/22 do not support scoped modifiers like `(?i:...)` or a mid-pattern
+ * `(?i)`, so case-insensitivity is expanded inline: inside a case-insensitive
+ * scope every ASCII letter `a` becomes `[aA]`, and character classes gain the
+ * other-case counterpart of each letter and letter range. Patterns are then
+ * compiled with no flags, which keeps `(?-i:...)` exact.
+ *
+ * Other RE2 differences handled:
+ *   (?s:...) / (?s)  `.` in scope becomes `[\s\S]`
+ *   (?P<name>        becomes `(?<name>`
+ *   \z  \A           become `$`  `^` (no `m` flag, so both anchor the input)
+ *   [[:alnum:]] etc. POSIX classes inside a bracket expression
+ *
+ * Throws on syntax this translator does not understand rather than guessing.
+ */
+const POSIX = {
+    alnum: "a-zA-Z0-9",
+    alpha: "a-zA-Z",
+    digit: "0-9",
+    lower: "a-z",
+    upper: "A-Z",
+    space: "\\s",
+    word: "\\w",
+    xdigit: "0-9A-Fa-f",
+    punct: "!-\\/:-@\\[-`{-~",
+};
+const isLower = (c) => c >= "a" && c <= "z";
+const isUpper = (c) => c >= "A" && c <= "Z";
+const isLetter = (c) => isLower(c) || isUpper(c);
+const swap = (c) => (isLower(c) ? c.toUpperCase() : c.toLowerCase());
+function parseFlags(spec, base) {
+    const out = { ...base };
+    let on = true;
+    for (const ch of spec) {
+        if (ch === "-")
+            on = false;
+        else if (ch === "i")
+            out.i = on;
+        else if (ch === "s")
+            out.s = on;
+        else if (ch === "m" || ch === "U") {
+            throw new Error(`unsupported RE2 flag '${ch}'`);
+        }
+        else
+            throw new Error(`unknown RE2 flag '${ch}'`);
+    }
+    return out;
+}
+/** Translate one bracket expression starting at src[start] === "[". */
+function translateClass(src, start, flags) {
+    let i = start + 1;
+    let out = "[";
+    if (src[i] === "^") {
+        out += "^";
+        i++;
+    }
+    // A leading "]" is a literal in RE2.
+    if (src[i] === "]") {
+        out += "\\]";
+        i++;
+    }
+    const extra = [];
+    while (i < src.length && src[i] !== "]") {
+        if (src.startsWith("[:", i)) {
+            const close = src.indexOf(":]", i + 2);
+            if (close < 0)
+                throw new Error("unterminated POSIX class");
+            const name = src.slice(i + 2, close);
+            const neg = name.startsWith("^");
+            const body = POSIX[neg ? name.slice(1) : name];
+            if (!body || neg)
+                throw new Error(`unsupported POSIX class [:${name}:]`);
+            out += body;
+            i = close + 2;
+            continue;
+        }
+        if (src[i] === "\\") {
+            const esc = src.slice(i, i + 2);
+            if (esc === "\\x" && src[i + 2] === "{")
+                throw new Error("unsupported \\x{...} escape");
+            if (esc === "\\p" || esc === "\\P" || esc === "\\Q")
+                throw new Error(`unsupported escape ${esc}`);
+            // \xHH keeps its two hex digits.
+            if (esc === "\\x") {
+                out += src.slice(i, i + 4);
+                i += 4;
+            }
+            else {
+                out += esc;
+                i += 2;
+            }
+            continue;
+        }
+        const c = src[i];
+        if (c === "[") {
+            out += "\\[";
+            i++;
+            continue;
+        }
+        // Range lo-hi (hi is not "]").
+        if (src[i + 1] === "-" && i + 2 < src.length && src[i + 2] !== "]") {
+            let hi = src[i + 2];
+            let consumed = 3;
+            if (hi === "\\") {
+                hi = src.slice(i + 2, i + 4);
+                consumed = 4;
+            }
+            out += `${c}-${hi}`;
+            if (flags.i && hi.length === 1 && isLetter(c) && isLetter(hi) && isLower(c) === isLower(hi)) {
+                extra.push(`${swap(c)}-${swap(hi)}`);
+            }
+            i += consumed;
+            continue;
+        }
+        // A literal "-" is escaped so the case-folded extras appended below can
+        // never turn it into a range operator.
+        out += c === "-" ? "\\-" : c;
+        if (flags.i && isLetter(c))
+            extra.push(swap(c));
+        i++;
+    }
+    if (src[i] !== "]")
+        throw new Error("unterminated character class");
+    out += extra.join("") + "]";
+    return { out, end: i + 1 };
+}
+export function translateGoRegex(src) {
+    const stack = [{ i: false, s: false }];
+    let out = "";
+    let i = 0;
+    const top = () => stack[stack.length - 1];
+    while (i < src.length) {
+        const c = src[i];
+        const flags = top();
+        if (c === "\\") {
+            const n = src[i + 1];
+            if (n === undefined)
+                throw new Error("trailing backslash");
+            if (n === "z")
+                out += "$";
+            else if (n === "A")
+                out += "^";
+            else if (n === "Q" || n === "p" || n === "P" || n === "C")
+                throw new Error(`unsupported escape \\${n}`);
+            else if (n === "x") {
+                if (src[i + 2] === "{")
+                    throw new Error("unsupported \\x{...} escape");
+                out += src.slice(i, i + 4);
+                i += 4;
+                continue;
+            }
+            else
+                out += `\\${n}`;
+            i += 2;
+            continue;
+        }
+        if (c === "[") {
+            const cls = translateClass(src, i, flags);
+            out += cls.out;
+            i = cls.end;
+            continue;
+        }
+        if (c === "(") {
+            if (src[i + 1] === "?") {
+                // (?P<name>...)
+                if (src[i + 2] === "P" && src[i + 3] === "<") {
+                    out += "(?<";
+                    stack.push({ ...flags });
+                    i += 4;
+                    continue;
+                }
+                if (src[i + 2] === "<" && src[i + 3] !== "=" && src[i + 3] !== "!") {
+                    out += "(?<";
+                    stack.push({ ...flags });
+                    i += 3;
+                    continue;
+                }
+                // Flag group: (?flags) or (?flags:...)
+                const m = /^\(\?([a-zA-Z-]*)([:)])/.exec(src.slice(i));
+                if (m) {
+                    const next = parseFlags(m[1], flags);
+                    if (m[2] === ")") {
+                        // Applies to the rest of the enclosing group.
+                        stack[stack.length - 1] = next;
+                    }
+                    else {
+                        out += "(?:";
+                        stack.push(next);
+                    }
+                    i += m[0].length;
+                    continue;
+                }
+                throw new Error(`unsupported group syntax near '${src.slice(i, i + 6)}'`);
+            }
+            out += "(";
+            stack.push({ ...flags });
+            i++;
+            continue;
+        }
+        if (c === ")") {
+            if (stack.length === 1)
+                throw new Error("unbalanced ')'");
+            stack.pop();
+            out += ")";
+            i++;
+            continue;
+        }
+        if (c === ".") {
+            out += flags.s ? "[\\s\\S]" : ".";
+            i++;
+            continue;
+        }
+        if (c === "{") {
+            // Quantifier {n}, {n,}, {n,m} copies through; any other "{" is literal.
+            const q = /^\{\d+(,\d*)?\}/.exec(src.slice(i));
+            if (q) {
+                out += q[0];
+                i += q[0].length;
+            }
+            else {
+                out += "\\{";
+                i++;
+            }
+            continue;
+        }
+        if (c === "}") {
+            out += "\\}";
+            i++;
+            continue;
+        }
+        if (flags.i && isLetter(c)) {
+            out += `[${c}${swap(c)}]`;
+            i++;
+            continue;
+        }
+        out += c;
+        i++;
+    }
+    if (stack.length !== 1)
+        throw new Error("unbalanced '('");
+    return out;
+}
+/** Compile a Go RE2 pattern to a JavaScript RegExp (extra flags e.g. "g"). */
+export function compileGoRegex(src, flags = "") {
+    return new RegExp(translateGoRegex(src), flags);
+}
+//# sourceMappingURL=go-regex.js.map

package/dist/lib/secret-scan/rules.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Compiled rule set: the vendored gitleaks default rules plus HQ's own token
+ * patterns (src/lib/core-utils/secret-patterns.ts). Compiled once per process.
+ */
+import type { GitleaksRule } from "./types.js";
+export interface CompiledAllowlist {
+    condition: "OR" | "AND";
+    target: "secret" | "match" | "line";
+    paths: RegExp[];
+    regexes: RegExp[];
+    stopwords: string[];
+}
+export interface CompiledRule {
+    id: string;
+    description: string;
+    /** Global-flagged, for iterating matches. */
+    regex?: RegExp;
+    path?: RegExp;
+    entropy?: number;
+    secretGroup?: number;
+    keywords: string[];
+    allowlists: CompiledAllowlist[];
+}
+export interface CompiledRuleSet {
+    global: CompiledAllowlist;
+    rules: CompiledRule[];
+}
+/** HQ's own patterns, expressed as gitleaks-shaped rules. */
+export declare function hqRules(): GitleaksRule[];
+export declare function compiledRules(): CompiledRuleSet;
+//# sourceMappingURL=rules.d.ts.map

package/dist/lib/secret-scan/rules.js

@@ -0,0 +1,84 @@
+/**
+ * Compiled rule set: the vendored gitleaks default rules plus HQ's own token
+ * patterns (src/lib/core-utils/secret-patterns.ts). Compiled once per process.
+ */
+import { SECRET_PATTERNS } from "../core-utils/secret-patterns.js";
+import { GITLEAKS_CONFIG } from "./gitleaks-rules.generated.js";
+import { compileGoRegex } from "./go-regex.js";
+function compileAllowlist(a) {
+    return {
+        condition: a.condition === "AND" ? "AND" : "OR",
+        target: a.regexTarget ?? "secret",
+        paths: (a.paths ?? []).map((p) => compileGoRegex(p)),
+        regexes: (a.regexes ?? []).map((r) => compileGoRegex(r)),
+        stopwords: (a.stopwords ?? []).map((s) => s.toLowerCase()),
+    };
+}
+function compileRule(r) {
+    return {
+        id: r.id,
+        description: r.description,
+        regex: r.regex === undefined ? undefined : compileGoRegex(r.regex, "g"),
+        path: r.path === undefined ? undefined : compileGoRegex(r.path),
+        entropy: r.entropy,
+        secretGroup: r.secretGroup,
+        keywords: (r.keywords ?? []).map((k) => k.toLowerCase()),
+        allowlists: (r.allowlists ?? []).map(compileAllowlist),
+    };
+}
+/** Literal prefix of an HQ pattern, used as its keyword prefilter. */
+function literalPrefix(pattern) {
+    const m = /^[A-Za-z0-9_-]+/.exec(pattern.replace(/^-+/, ""));
+    return (m ? m[0] : "").replace(/\[.*$/, "").toLowerCase();
+}
+/** HQ's own patterns, expressed as gitleaks-shaped rules. */
+export function hqRules() {
+    return SECRET_PATTERNS.map(({ pattern, name }) => {
+        const id = `hq-${name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "")}`;
+        const prefix = literalPrefix(pattern);
+        const rule = {
+            id,
+            description: `HQ pattern: ${name}`,
+            regex: `(?:^|[^a-zA-Z0-9])(${pattern})`,
+            secretGroup: 1,
+            keywords: prefix.length >= 3 ? [prefix] : undefined,
+        };
+        if (name === "Bearer token") {
+            // An auth header built from a variable is not a credential: a real token
+            // carries a digit, looks random, and is not an environment lookup.
+            rule.entropy = 4;
+            rule.allowlists = [
+                { regexes: ["^[^0-9]*$", "(?i)process\\.env|import\\.meta|os\\.environ|ENV\\["] },
+            ];
+        }
+        if (name === "Slack token") {
+            // Real Slack tokens are long (team id, user id, then a random part).
+            // Short test fixtures are not. gitleaks' Slack rules cover the exact
+            // formats; this fallback only catches long, digit-bearing tokens.
+            rule.regex = `(?:^|[^a-zA-Z0-9])(${pattern.replace("+", "{30,}")})`;
+            rule.entropy = 3.5;
+            rule.allowlists = [{ regexes: ["^[^0-9]*$"] }];
+        }
+        return rule;
+    });
+}
+/**
+ * The scanner's own rule sources contain example token shapes; gitleaks skips
+ * its gitleaks.toml the same way.
+ */
+const SELF_PATHS = [
+    "(?:^|/)vendor/gitleaks/",
+    "(?:^|/)src/lib/secret-scan/gitleaks-rules\\.generated\\.ts$",
+];
+let cached;
+export function compiledRules() {
+    if (!cached) {
+        const global = GITLEAKS_CONFIG.global;
+        cached = {
+            global: compileAllowlist({ ...global, paths: [...(global.paths ?? []), ...SELF_PATHS] }),
+            rules: [...GITLEAKS_CONFIG.rules, ...hqRules()].map(compileRule),
+        };
+    }
+    return cached;
+}
+//# sourceMappingURL=rules.js.map

package/dist/lib/secret-scan/staged.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Scan inputs: the staged diff of a git repo (pre-commit), or whole files.
+ */
+import { type Fragment } from "./detect.js";
+import type { SecretFinding } from "./types.js";
+export declare class ScanInputError extends Error {
+}
+export interface ParsedDiff {
+    fragments: Fragment[];
+    binaryFiles: string[];
+}
+/** Parse `git diff --unified=0` output into one fragment of added lines per hunk. */
+export declare function parseUnifiedDiff(diff: string): ParsedDiff;
+export declare function stagedDiff(cwd: string): string;
+export declare function scanStaged(cwd: string): SecretFinding[];
+export declare function scanFiles(paths: string[]): SecretFinding[];
+//# sourceMappingURL=staged.d.ts.map

package/dist/lib/secret-scan/staged.js

@@ -0,0 +1,112 @@
+/**
+ * Scan inputs: the staged diff of a git repo (pre-commit), or whole files.
+ */
+import { execFileSync } from "node:child_process";
+import { readFileSync, statSync } from "node:fs";
+import { scanFragment, scanPath } from "./detect.js";
+export class ScanInputError extends Error {
+}
+const DIFF_ARGS = [
+    "-c",
+    "core.quotePath=false",
+    "diff",
+    "--cached",
+    "--no-color",
+    "--no-ext-diff",
+    "--no-textconv",
+    "--unified=0",
+    "--diff-filter=ACMR",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+];
+/** Parse `git diff --unified=0` output into one fragment of added lines per hunk. */
+export function parseUnifiedDiff(diff) {
+    const fragments = [];
+    const binaryFiles = [];
+    let file = null;
+    let inHunk = false;
+    let nextLine = 0;
+    let cur = null;
+    const flush = () => {
+        if (file && cur && cur.lines.length) {
+            fragments.push({ file, text: cur.lines.join("\n"), startLine: cur.startLine });
+        }
+        cur = null;
+    };
+    for (const raw of diff.split("\n")) {
+        if (raw.startsWith("diff --git ")) {
+            flush();
+            file = null;
+            inHunk = false;
+            continue;
+        }
+        if (!inHunk && raw.startsWith("+++ ")) {
+            const p = raw.slice(4);
+            file = p === "/dev/null" ? null : p.replace(/^b\//, "");
+            continue;
+        }
+        if (!inHunk && raw.startsWith("Binary files ")) {
+            const m = / and b\/(.*) differ$/.exec(raw);
+            if (m)
+                binaryFiles.push(m[1]);
+            continue;
+        }
+        const h = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
+        if (h) {
+            flush();
+            inHunk = true;
+            nextLine = Number(h[1]);
+            continue;
+        }
+        if (!inHunk)
+            continue;
+        if (raw.startsWith("+")) {
+            if (!cur)
+                cur = { lines: [], startLine: nextLine };
+            cur.lines.push(raw.slice(1));
+            nextLine++;
+        }
+        else if (raw.startsWith(" ")) {
+            flush();
+            nextLine++;
+        }
+        // "-" removed lines and "" are skipped.
+    }
+    flush();
+    return { fragments, binaryFiles };
+}
+export function stagedDiff(cwd) {
+    try {
+        return execFileSync("git", DIFF_ARGS, {
+            cwd,
+            encoding: "utf8",
+            maxBuffer: 1024 * 1024 * 1024,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+    }
+    catch (err) {
+        const detail = err instanceof Error && "stderr" in err ? String(err.stderr).trim() : String(err);
+        throw new ScanInputError(`could not read the staged changes: ${detail || "git diff failed"}`);
+    }
+}
+export function scanStaged(cwd) {
+    const { fragments, binaryFiles } = parseUnifiedDiff(stagedDiff(cwd));
+    return [...fragments.flatMap((f) => scanFragment(f)), ...binaryFiles.flatMap((f) => scanPath(f))];
+}
+export function scanFiles(paths) {
+    const out = [];
+    for (const p of paths) {
+        let text;
+        try {
+            if (!statSync(p).isFile())
+                continue;
+            text = readFileSync(p, "utf8");
+        }
+        catch (err) {
+            throw new ScanInputError(`could not read ${p}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        out.push(...scanPath(p), ...scanFragment({ file: p, text, startLine: 1 }));
+    }
+    return out;
+}
+//# sourceMappingURL=staged.js.map

package/dist/lib/secret-scan/types.d.ts

@@ -0,0 +1,34 @@
+/** Shapes of the vendored gitleaks config (see vendor/gitleaks/). */
+export interface GitleaksAllowlist {
+    description?: string;
+    /** "OR" (default): any check allows. "AND": every defined check must allow. */
+    condition?: "OR" | "AND";
+    /** What `regexes` test: the secret (default), the full match, or the line. */
+    regexTarget?: "secret" | "match" | "line";
+    paths?: string[];
+    regexes?: string[];
+    stopwords?: string[];
+    commits?: string[];
+}
+export interface GitleaksRule {
+    id: string;
+    description: string;
+    regex?: string;
+    path?: string;
+    entropy?: number;
+    secretGroup?: number;
+    keywords?: string[];
+    allowlists?: GitleaksAllowlist[];
+}
+export interface GitleaksConfig {
+    global: GitleaksAllowlist;
+    rules: GitleaksRule[];
+}
+/** One finding. Never carries the secret value. */
+export interface SecretFinding {
+    ruleId: string;
+    description: string;
+    file: string;
+    line: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/lib/secret-scan/types.js

@@ -0,0 +1,3 @@
+/** Shapes of the vendored gitleaks config (see vendor/gitleaks/). */
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.84",
+  "version": "5.345.86",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {