@indigoai-us/hq-cli 5.103.23 → 5.103.24

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [5.103.24] — 2026-08-27
+
 ## [5.103.23] — 2026-08-26
 
 ### Changed

package/dist/main.js

@@ -72,6 +72,7 @@ import { isExpectedUserError } from "./utils/expected-cli-error.js";
 import { isEpipe } from "./utils/epipe.js";
 import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
 import { isAuthError } from "./utils/auth-error.js";
+import { browserLoginAbandonedMessage } from "./utils/browser-login-abandoned.js";
 import { isCompanySelectionError } from "./utils/company-selection-error.js";
 import { canOfferTeamUpgrade, formatPlanGateError, isPlanGateError, offerTeamUpgrade, } from "./utils/plan-gate-error.js";
 import { upgradeToTeam } from "./utils/team-upgrade.js";
@@ -394,6 +395,21 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
         deps.stderr.write(`hq: ${err.message}\n`);
         deps.setExitCode(1);
     }
+    else if (browserLoginAbandonedMessage(err)) {
+        // HQ-CLI-V: the caller triggered the implicit browser sign-in fallback
+        // (an expiring/absent HQ session) and then never completed it —
+        // @indigoai-us/hq-cloud's browserLogin rejected either at its 15-minute
+        // deadline or because the user declined at the IdP (access_denied). A
+        // human walking away from an OAuth prompt is expected auth state the user
+        // fixes with `hq login`, not an hq-cli defect. Print the fixed actionable
+        // remedy and skip Sentry so one abandoned login doesn't file a permanent
+        // high-priority "crash". Placed with the auth carve-out (both mean "your
+        // HQ session isn't usable; run hq login"); every genuine browser-login or
+        // token-exchange fault stays outside the closed allowlist and still
+        // captures below.
+        deps.stderr.write(`hq: ${browserLoginAbandonedMessage(err)}\n`);
+        deps.setExitCode(1);
+    }
     else if (isPlanGateError(err)) {
         // hq-pro's plan denials are expected product limits, never a CLI crash.
         // The shared vault client has already decoded and typed the small safe

package/dist/utils/browser-login-abandoned.d.ts

@@ -0,0 +1,12 @@
+/**
+ * If `err` is an abandoned implicit browser sign-in, return a short, fixed
+ * user-facing remedy; otherwise return `null`.
+ *
+ * A non-null result means the caller should print the message and SKIP Sentry
+ * capture — a user who walked away from an OAuth prompt is not an hq-cli defect.
+ * A null result means "handle as usual (capture to Sentry)". CognitoRefreshError
+ * is a refresh fault, never an abandonment, so it is excluded structurally even
+ * though it extends CognitoAuthError.
+ */
+export declare function browserLoginAbandonedMessage(err: unknown): string | null;
+//# sourceMappingURL=browser-login-abandoned.d.ts.map

package/dist/utils/browser-login-abandoned.js

@@ -0,0 +1,70 @@
+// src/utils/browser-login-abandoned.ts
+//
+// Classify an ABANDONED implicit browser sign-in — the caller triggered the
+// fallback OAuth flow (an expiring/absent HQ session on any of the ~100
+// ensureCognitoToken/ensureCognitoIdToken call sites) and then never completed
+// it. @indigoai-us/hq-cloud's browserLogin arms a 15-minute deadline and also
+// rejects when the identity provider reports the user declined; both mint a
+// bare CognitoAuthError. A human walking away from an OAuth prompt is expected
+// auth state the user fixes with `hq login`, NOT an hq-cli defect — so the
+// top-level handler prints an actionable line and exits non-zero but SKIPS
+// Sentry capture, mirroring the auth (HQ-CLI-8), company-selection (HQ-CLI-7),
+// expected-user-error (HQ-CLI-6), and environmental-FS (HQ-CLI-2) carve-outs.
+//
+// HQ-CLI-V (Sentry indigo-d0/hq-cli 7685055900): `hq integrations list
+// --company <slug> --json` tried to refresh an expiring session, the refresh
+// 400'd (invalid_grant), and it fell back to browserLogin(). Nobody finished
+// the sign-in, so exactly 15 minutes later browserLogin rejected with
+// `CognitoAuthError("Login timed out after 15 minutes")`. That error carries no
+// `code`, no `expected` flag, and is not an AuthError/CompanySelectionError/…,
+// so every predicate in handleTopLevelError returned false and the abandoned
+// login was captured as a high-priority, unfixable "crash".
+//
+// The allowlist is CLOSED at the two upstream-minted human-abandonment
+// signatures and defaults to null (capture). Every other CognitoAuthError — a
+// state-parameter mismatch (possible CSRF), a missing callback code, a
+// non-access_denied IdP error, a token-exchange failure — and every
+// CognitoRefreshError (a refresh fault, not an abandonment) still reaches
+// Sentry.
+import { CognitoAuthError, CognitoRefreshError } from "@indigoai-us/hq-cloud";
+/**
+ * Fixed, actionable remedy. Deliberately interpolates NO upstream error text,
+ * so this carve-out can never widen disclosure and needs no redaction pass.
+ */
+const BROWSER_LOGIN_ABANDONED_MESSAGE = "Browser sign-in was not completed. Run `hq login`, finish the sign-in in " +
+    "your browser, then re-run your command.";
+/**
+ * The 15-minute login-deadline signature (@indigoai-us/hq-cloud cognito-auth
+ * `waitForAuthCode`). The minute count is tolerated (`\d+`) so an upstream
+ * retune of the deadline turns the contract test red rather than silently
+ * restoring the Sentry noise.
+ */
+const LOGIN_TIMED_OUT = /^Login timed out after \d+ minutes?$/;
+/**
+ * The user declined at the identity provider. Matched EXACTLY — other
+ * `Cognito returned error: <x>` values (server_error, …) are not abandonment
+ * and stay reportable.
+ */
+const ACCESS_DENIED = "Cognito returned error: access_denied";
+/**
+ * If `err` is an abandoned implicit browser sign-in, return a short, fixed
+ * user-facing remedy; otherwise return `null`.
+ *
+ * A non-null result means the caller should print the message and SKIP Sentry
+ * capture — a user who walked away from an OAuth prompt is not an hq-cli defect.
+ * A null result means "handle as usual (capture to Sentry)". CognitoRefreshError
+ * is a refresh fault, never an abandonment, so it is excluded structurally even
+ * though it extends CognitoAuthError.
+ */
+export function browserLoginAbandonedMessage(err) {
+    if (!(err instanceof CognitoAuthError))
+        return null;
+    if (err instanceof CognitoRefreshError)
+        return null;
+    const { message } = err;
+    if (LOGIN_TIMED_OUT.test(message) || message === ACCESS_DENIED) {
+        return BROWSER_LOGIN_ABANDONED_MESSAGE;
+    }
+    return null;
+}
+//# sourceMappingURL=browser-login-abandoned.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.103.23",
+  "version": "5.103.24",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {