@indigoai-us/hq-cli 5.109.1 → 5.109.3

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [5.109.3] — 2026-09-09
+
+### Fixed
+
+- A provider that refuses the sign-in request is no longer reported as you
+  declining it. `hq integrations connect` treated every `?error=` on the
+  callback as "Sign-in was declined", so a scope the provider will not grant,
+  a misconfigured client, or a provider outage all read as a choice you made —
+  and, because declines are treated as expected, none of them reached error
+  reporting. Only `access_denied` is a decline now; anything else reports as a
+  provider refusal and is visible. The error code is matched against the
+  RFC 6749 set and reported as `other` when it is outside it, so nothing the
+  provider sends is echoed back.
+
+## [5.109.2] — 2026-09-09
+
+### Fixed
+
+- `hq integrations connect <app>` now says so when the app is already
+  connected, instead of opening a browser and waiting for a sign-in that
+  changes nothing. It prints the reconnect command for re-authorizing the
+  existing connection, and `--force` still adds a second one. Across a
+  few-hundred-app sweep the old behavior read as a silent failure.
+
+  The check only short-circuits a connection that is genuinely finished. A row
+  whose installation is still at `needs_credentials`, `pending`, `error`, or
+  `revoked` falls through to the ordinary connect, because that connect is the
+  only thing that repairs those states. An installation status the CLI does not
+  recognize is treated the same way, so an unknown state costs a redundant
+  sign-in rather than a stranded integration.
+
 ## [5.109.1] — 2026-09-08
 
 ### Added

package/dist/commands/integrations-connect.d.ts

@@ -17,6 +17,7 @@
  * "key" but is really OAuth-protected still connects on the first try.
  */
 import { Command } from "commander";
+import type { AdminConnection } from "./integrations-core.js";
 /**
  * Validate `--auth` against the supported enum, rejecting an unknown value
  * before anything is installed. A finite provider/runtime option must never be
@@ -46,5 +47,6 @@ export declare function consoleOrigin(vaultApiUrl?: string): string | undefined;
  * by slug), or undefined when the console for this control plane is unknown.
  */
 export declare function consoleIntegrationsUrl(companySlug: string | undefined, origin: string | undefined): string | undefined;
+export declare function findAlreadyConnected(connections: readonly AdminConnection[], app: string): AdminConnection | undefined;
 export declare function registerConnectCommands(integrations: Command): void;
 //# sourceMappingURL=integrations-connect.d.ts.map

package/dist/commands/integrations-connect.js

@@ -20,7 +20,7 @@ import chalk from "chalk";
 import open from "open";
 import { DEFAULT_VAULT_API_URL, ensureCognitoIdToken, } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
-import { IntegrationsCliError, bareProvider, connectionDomain, printJson, revokedConnectionDetails, resolveConnection, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, connectionDomain, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, } from "./integrations-core.js";
 import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBlueprint, startOAuth, } from "./integrations-api.js";
 import { startLoopbackListener } from "./integrations-oauth.js";
 /** hq-pro's machine code for "this endpoint needs a browser sign-in". */
@@ -886,6 +886,115 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
         throw err;
     }
 }
+/**
+ * The connection `app` already names, if it is connected RIGHT NOW.
+ *
+ * `connect` used to start a fresh sign-in for an app that was already
+ * connected: it opened a browser, printed an authorize URL and waited, saying
+ * nothing about the connection already sitting there. Sweeping a few hundred
+ * apps, that reads as a silent failure — you approve a vendor a second time and
+ * get no acknowledgement that the first one exists.
+ *
+ * Only `status === "connected"` counts. A `needs-reauth`, `error` or `revoked`
+ * row is NOT a reason to refuse: those are exactly the rows a person runs this
+ * command to repair, and blocking them would strand the app.
+ *
+ * Matching is deliberately anchored on the app's own name. A connected
+ * `installation.domain` matches when it IS the app, or is a subdomain of it
+ * (`notion.com` is served by `mcp.notion.com`) — never the reverse, so an
+ * unrelated host can never be read as this app. The provider slug and display
+ * name are matched too, because `connect notion` and `connect notion.com` are
+ * the same request.
+ */
+/**
+ * Whether a row is finished enough that starting another sign-in would be
+ * redundant work rather than the repair the caller needs.
+ *
+ * `connection.status === "connected"` is NOT sufficient on its own. A row can
+ * be connected at the connection level while its installation still sits at
+ * `needs_credentials`, `pending`, `error`, or `revoked` — states whose ONLY
+ * remedy is the very connect the caller just asked for. Short-circuiting those
+ * would strand them: the command would report "already connected" about a thing
+ * that cannot be used, and the person would have no way to fix it.
+ *
+ * So this is an allowlist, not a denylist of known-bad states. An absent
+ * installation is treated as settled (a non-factory connection has no
+ * installation to be mid-flight), but any PRESENT status other than `installed`
+ * is treated as unfinished. A status this CLI has not heard of therefore falls
+ * through to the ordinary connect — the safe direction, since a redundant
+ * sign-in costs a browser round-trip while a wrong skip costs a broken
+ * integration with no visible path out.
+ */
+function isSettledInstallation(connection) {
+    const status = connection.installation?.status?.trim().toLowerCase();
+    return status === undefined || status === "" || status === "installed";
+}
+export function findAlreadyConnected(connections, app) {
+    const want = app.trim().toLowerCase();
+    if (want === "")
+        return undefined;
+    const wantSlug = displayNameSlug(want);
+    return connections.find((connection) => {
+        if (connection.status !== "connected")
+            return false;
+        if (!isSettledInstallation(connection))
+            return false;
+        const domain = (connectionDomain(connection) ?? "").toLowerCase();
+        if (domain === want || domain.endsWith(`.${want}`))
+            return true;
+        if (bareProvider(connection.provider).toLowerCase() === want)
+            return true;
+        const displayName = (connection.installation?.displayName ?? "").trim();
+        if (displayName === "")
+            return false;
+        if (displayName.toLowerCase() === want)
+            return true;
+        // `connect aws-marketplace` is the copy-pasteable form of the display name
+        // "AWS Marketplace", and it is what the catalog resolver already accepts.
+        // Compare on the same slug both ways or this check misses every app whose
+        // name has a space in it.
+        return wantSlug !== "" && displayNameSlug(displayName) === wantSlug;
+    });
+}
+/**
+ * Report an app as already connected instead of opening a second sign-in.
+ * Returns true when the connect should stop here.
+ */
+async function refuseIfAlreadyConnected(token, companyUid, app, opts) {
+    // Only a plain `connect <app>`. An explicit --mcp-url / --docs-url /
+    // --entry-id names an endpoint rather than an installed app, and --force is
+    // the deliberate "yes, add another one" escape hatch.
+    if (!app || opts.force || opts.mcpUrl || opts.docsUrl || opts.entryId)
+        return false;
+    let connections;
+    try {
+        connections = (await fetchAdminSurface(token, companyUid)).connections ?? [];
+    }
+    catch {
+        // Never let this convenience check block a connect. If the list cannot be
+        // read, fall through and let the real flow report whatever is wrong.
+        return false;
+    }
+    const existing = findAlreadyConnected(connections, app);
+    if (!existing)
+        return false;
+    const slug = bareProvider(existing.provider);
+    if (opts.json) {
+        printJson({
+            ok: true,
+            alreadyConnected: true,
+            provider: slug,
+            connection: existing.id,
+            ...(connectionDomain(existing) ? { domain: connectionDomain(existing) } : {}),
+        });
+        return true;
+    }
+    const label = existing.installation?.displayName ?? slug;
+    console.log(chalk.green(`${label} is already connected.`));
+    console.log(chalk.dim(`  Sign in again:  hq integrations reconnect --provider ${slug}\n` +
+        `  Add a second:   hq integrations connect ${shellQuote(app)} --force`));
+    return true;
+}
 export function registerConnectCommands(integrations) {
     integrations
         .command("catalog [query]")
@@ -1014,11 +1123,14 @@ export function registerConnectCommands(integrations) {
         .option("--scopes <list>", "Permissions to request, space- or comma-separated (default: what the app needs)")
         .option("--no-browser", "Print the sign-in URL instead of opening a browser")
         .option("--timeout <seconds>", "How long to wait for a browser sign-in (default 300)")
+        .option("--force", "Connect again even if this app is already connected")
         .option("--json", "Machine-readable output")
         .action(async (app, opts) => {
         assertAuthMode(opts.auth);
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
+        if (await refuseIfAlreadyConnected(token, companyUid, app, opts))
+            return;
         await connectApp(token, companyUid, app, opts);
     });
     integrations

package/dist/commands/integrations-oauth.d.ts

@@ -19,12 +19,32 @@
  * as `OAUTH_REDIRECT_URI_NOT_ALLOWED` at connect time.
  */
 export declare const LOOPBACK_CALLBACK_PATH = "/hq/integrations/oauth/callback";
+/**
+ * Turn an `?error=` redirect into what to tell the user, and whether it is
+ * their doing.
+ *
+ * Every `?error=` used to be reported as "Sign-in was declined", marked
+ * expected, and therefore skipped for Sentry capture. Only `access_denied` is
+ * the person declining. `invalid_scope` is HQ or the catalog asking for
+ * something the provider does not grant; `unauthorized_client` and
+ * `invalid_request` are a misconfigured client; `server_error` is the provider
+ * failing. Reporting those as a decision the user made both misdirects the
+ * user — there is nothing for them to do differently — and hid the real,
+ * fixable causes from error reporting, because "expected" suppresses capture.
+ * So: `access_denied` stays expected and quiet; everything else is a provider
+ * rejection that reaches Sentry.
+ */
+export declare function authorizeErrorOutcome(raw: string): {
+    message: string;
+    expected: boolean;
+};
 export interface LoopbackListener {
     /** The redirect URI to hand hq-pro — includes the OS-assigned port. */
     redirectUri: string;
     /**
      * Resolves once the authorization server redirects back. Rejects on timeout,
-     * on an `?error=` response (the person clicked Deny), or on a state mismatch.
+     * on an `?error=` response, or on a state mismatch. Only `access_denied`
+     * means the person clicked Deny — see {@link authorizeErrorOutcome}.
      */
     waitForCode(expectedState: string): Promise<string>;
     close(): void;

package/dist/commands/integrations-oauth.js

@@ -23,6 +23,48 @@ import { IntegrationsCliError } from "./integrations-core.js";
 export const LOOPBACK_CALLBACK_PATH = "/hq/integrations/oauth/callback";
 /** How long to wait for the browser round trip before giving the port back. */
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * The authorization-endpoint error codes RFC 6749 §4.1.2.1 defines. Anything
+ * outside this set is reported as `other`: the value arrives in a redirect
+ * query string a third party controls, so it is matched against a closed list
+ * and never echoed. `error_description` is deliberately never read at all.
+ */
+const OAUTH_AUTHORIZE_ERROR_CODES = new Set([
+    "invalid_request",
+    "unauthorized_client",
+    "access_denied",
+    "unsupported_response_type",
+    "invalid_scope",
+    "server_error",
+    "temporarily_unavailable",
+]);
+/**
+ * Turn an `?error=` redirect into what to tell the user, and whether it is
+ * their doing.
+ *
+ * Every `?error=` used to be reported as "Sign-in was declined", marked
+ * expected, and therefore skipped for Sentry capture. Only `access_denied` is
+ * the person declining. `invalid_scope` is HQ or the catalog asking for
+ * something the provider does not grant; `unauthorized_client` and
+ * `invalid_request` are a misconfigured client; `server_error` is the provider
+ * failing. Reporting those as a decision the user made both misdirects the
+ * user — there is nothing for them to do differently — and hid the real,
+ * fixable causes from error reporting, because "expected" suppresses capture.
+ * So: `access_denied` stays expected and quiet; everything else is a provider
+ * rejection that reaches Sentry.
+ */
+export function authorizeErrorOutcome(raw) {
+    const code = raw.trim().toLowerCase();
+    if (code === "access_denied") {
+        return { message: "Sign-in was declined.", expected: true };
+    }
+    const known = OAUTH_AUTHORIZE_ERROR_CODES.has(code) ? code : "other";
+    return {
+        message: `The provider refused the sign-in request (${known}). ` +
+            "Nothing was connected.",
+        expected: false,
+    };
+}
 /**
  * Escapes text destined for the callback page.
  *
@@ -180,7 +222,10 @@ export async function startLoopbackListener(opts = {}) {
                     timer = null;
                     const { code, state, error } = result;
                     if (error) {
-                        reject(new IntegrationsCliError(`Sign-in was declined (${error}).`, { expected: true }));
+                        const outcome = authorizeErrorOutcome(error);
+                        reject(new IntegrationsCliError(outcome.message, {
+                            expected: outcome.expected,
+                        }));
                         return;
                     }
                     if (!code || !state) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.109.1",
+  "version": "5.109.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {