@indigoai-us/hq-cli 5.108.0 → 5.108.1

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [5.108.1] — 2026-09-04
+
 ## [5.108.0] — 2026-09-03
 
 ### Fixed

package/dist/commands/cloud.d.ts

@@ -30,6 +30,12 @@ export declare class SyncExitError extends Error {
     readonly code: number;
     constructor(code: number);
 }
+/**
+ * Preserve the vault's typed write-scope refusal at the CLI boundary. This is
+ * deliberately duck-typed so hq-cli remains compatible while hq-cloud and the
+ * CLI are released independently.
+ */
+export declare function formatSyncFailure(err: unknown): string;
 /**
  * US-003: run one sync fanout under a client-health attempt/outcome report.
  * The report is best-effort, bounded, and swallowed — it can only append a

package/dist/commands/cloud.js

@@ -38,6 +38,29 @@ export class SyncExitError extends Error {
         this.name = "SyncExitError";
     }
 }
+/**
+ * Preserve the vault's typed write-scope refusal at the CLI boundary. This is
+ * deliberately duck-typed so hq-cli remains compatible while hq-cloud and the
+ * CLI are released independently.
+ */
+export function formatSyncFailure(err) {
+    if (typeof err === "object" && err !== null) {
+        const diagnostic = err;
+        if (diagnostic.code === "POLICY_WRITE_SCOPE_TRUNCATED") {
+            const dropped = Array.isArray(diagnostic.droppedWriteGrantPrefixes)
+                ? diagnostic.droppedWriteGrantPrefixes.filter((prefix) => typeof prefix === "string")
+                : [];
+            const retained = Array.isArray(diagnostic.retainedGrantPrefixes)
+                ? diagnostic.retainedGrantPrefixes.filter((prefix) => typeof prefix === "string")
+                : [];
+            return ("Vault credentials were refused because the requested write scope could not be represented exactly. " +
+                `Dropped write prefixes: ${dropped.length > 0 ? dropped.join(", ") : "unknown"}. ` +
+                `Retained prefixes: ${retained.length > 0 ? retained.join(", ") : "none"}. ` +
+                "No files were uploaded. Narrow or consolidate the grants, then retry.");
+        }
+    }
+    return err instanceof Error ? err.message : String(err);
+}
 /**
  * US-003: run one sync fanout under a client-health attempt/outcome report.
  * The report is best-effort, bounded, and swallowed — it can only append a
@@ -324,7 +347,7 @@ export async function pullAll(options, deps) {
             }
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
+            const message = formatSyncFailure(err);
             result.errors.push({ company: entry.slug, message });
             result.perCompany.push({ slug: entry.slug, error: message });
         }
@@ -416,7 +439,7 @@ export async function pushAll(options, deps) {
             result.perCompany.push({ slug: entry.slug, result: r });
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
+            const message = formatSyncFailure(err);
             result.errors.push({ company: entry.slug, message });
             result.perCompany.push({ slug: entry.slug, error: message });
         }
@@ -810,7 +833,7 @@ export function registerCloudCommands(program) {
         catch (err) {
             if (syncHealth)
                 await syncHealth.failed();
-            const message = err instanceof Error ? err.message : String(err);
+            const message = formatSyncFailure(err);
             if (jsonMode) {
                 // In JSON mode, the parent process is parsing stderr for ndjson —
                 // human-formatted error lines would corrupt the stream. Emit a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.108.0",
+  "version": "5.108.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {