@indigoai-us/hq-cli 5.103.33 → 5.103.34

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [5.103.34] — 2026-08-30
+
 ## [5.103.33] — 2026-08-30
 
 ## [5.103.32] — 2026-08-29

package/dist/commands/skill.js

@@ -136,11 +136,17 @@ export function resolveSkillUid(target, cwd) {
     return uid;
 }
 export function canonicalCompanySkillPath(hqRoot, companySlug, skillSlug) {
+    // HQ-CLI-17 (Sentry 7699881899): both validators reject CALLER-supplied input
+    // — the `--company` slug and the `create <slug>` argument. A malformed value is
+    // the caller's request, not an hq-cli defect, so throw `localSkillError`
+    // (expected: true) and let the top-level boundary print the remedy and skip
+    // Sentry, exactly as the sibling caller-input throws in this module already do.
+    // The message text is unchanged; only its CLASS changes.
     if (!COMPANY_SLUG_PATTERN.test(companySlug)) {
-        throw new Error("Company slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        throw localSkillError("Company slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
     }
     if (!SKILL_SLUG_PATTERN.test(skillSlug)) {
-        throw new Error("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
     }
     return path.join(hqRoot, "companies", companySlug, "skills", skillSlug, "SKILL.md");
 }
@@ -277,7 +283,10 @@ export function registerSkillCommand(program, deps = {}) {
         .option("--surface-only", "Refresh local skill discovery without registration or sync")
         .action(async (slug, opts) => {
         if (!SKILL_SLUG_PATTERN.test(slug)) {
-            throw new Error("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+            // HQ-CLI-17: the `create <slug>` argument is caller input; a malformed
+            // slug is a correctly-enforced refusal, not a crash. Mark it expected
+            // (via localSkillError) so it is printed and skipped for Sentry.
+            throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
         }
         const parentOpts = skill.opts();
         const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
@@ -285,7 +294,13 @@ export function registerSkillCommand(program, deps = {}) {
         const filePath = canonicalCompanySkillPath(resolvedRoot, companySlug, slug);
         const legacyPrefix = readCompanyPrefix(resolvedRoot, companySlug);
         if (fs.existsSync(filePath) && !fs.statSync(filePath).isFile()) {
-            throw new Error(`Expected a SKILL.md file at '${filePath}'.`);
+            // HQ-CLI-17: the target path is derived from caller input and its
+            // on-disk shape is the caller's own filesystem, not an hq-cli defect.
+            // The bare Error also embedded this absolute (home-relative) path, so it
+            // minted a NEW Sentry fingerprint per machine. Mark it expected so it is
+            // printed (with the path the caller needs) and never captured. Redaction
+            // in localSkillError scrubs credentials but leaves plain paths intact.
+            throw localSkillError(`Expected a SKILL.md file at '${filePath}'.`);
         }
         if (opts.surfaceOnly === true) {
             // Discovery wrappers are execution surfaces. Never create one for an
@@ -396,8 +411,10 @@ export function registerSkillCommand(program, deps = {}) {
         .requiredOption("-m, --message <text>", "The improvement to discuss")
         .action(async (target, opts) => {
         const message = opts.message.trim();
+        // HQ-CLI-17: a blank `-m/--message` is caller input, not an hq-cli defect.
+        // Mark it expected so it is printed and skipped for Sentry.
         if (!message)
-            throw new Error("An improvement message is required.");
+            throw localSkillError("An improvement message is required.");
         const parentOpts = skill.opts();
         const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
         const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.103.33",
+  "version": "5.103.34",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {