@indigoai-us/hq-cli 5.109.2 → 5.109.3

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [5.109.3] — 2026-09-09
+
+### Fixed
+
+- A provider that refuses the sign-in request is no longer reported as you
+  declining it. `hq integrations connect` treated every `?error=` on the
+  callback as "Sign-in was declined", so a scope the provider will not grant,
+  a misconfigured client, or a provider outage all read as a choice you made —
+  and, because declines are treated as expected, none of them reached error
+  reporting. Only `access_denied` is a decline now; anything else reports as a
+  provider refusal and is visible. The error code is matched against the
+  RFC 6749 set and reported as `other` when it is outside it, so nothing the
+  provider sends is echoed back.
+
 ## [5.109.2] — 2026-09-09
 
 ### Fixed

package/dist/commands/integrations-oauth.d.ts

@@ -19,12 +19,32 @@
  * as `OAUTH_REDIRECT_URI_NOT_ALLOWED` at connect time.
  */
 export declare const LOOPBACK_CALLBACK_PATH = "/hq/integrations/oauth/callback";
+/**
+ * Turn an `?error=` redirect into what to tell the user, and whether it is
+ * their doing.
+ *
+ * Every `?error=` used to be reported as "Sign-in was declined", marked
+ * expected, and therefore skipped for Sentry capture. Only `access_denied` is
+ * the person declining. `invalid_scope` is HQ or the catalog asking for
+ * something the provider does not grant; `unauthorized_client` and
+ * `invalid_request` are a misconfigured client; `server_error` is the provider
+ * failing. Reporting those as a decision the user made both misdirects the
+ * user — there is nothing for them to do differently — and hid the real,
+ * fixable causes from error reporting, because "expected" suppresses capture.
+ * So: `access_denied` stays expected and quiet; everything else is a provider
+ * rejection that reaches Sentry.
+ */
+export declare function authorizeErrorOutcome(raw: string): {
+    message: string;
+    expected: boolean;
+};
 export interface LoopbackListener {
     /** The redirect URI to hand hq-pro — includes the OS-assigned port. */
     redirectUri: string;
     /**
      * Resolves once the authorization server redirects back. Rejects on timeout,
-     * on an `?error=` response (the person clicked Deny), or on a state mismatch.
+     * on an `?error=` response, or on a state mismatch. Only `access_denied`
+     * means the person clicked Deny — see {@link authorizeErrorOutcome}.
      */
     waitForCode(expectedState: string): Promise<string>;
     close(): void;

package/dist/commands/integrations-oauth.js

@@ -23,6 +23,48 @@ import { IntegrationsCliError } from "./integrations-core.js";
 export const LOOPBACK_CALLBACK_PATH = "/hq/integrations/oauth/callback";
 /** How long to wait for the browser round trip before giving the port back. */
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * The authorization-endpoint error codes RFC 6749 §4.1.2.1 defines. Anything
+ * outside this set is reported as `other`: the value arrives in a redirect
+ * query string a third party controls, so it is matched against a closed list
+ * and never echoed. `error_description` is deliberately never read at all.
+ */
+const OAUTH_AUTHORIZE_ERROR_CODES = new Set([
+    "invalid_request",
+    "unauthorized_client",
+    "access_denied",
+    "unsupported_response_type",
+    "invalid_scope",
+    "server_error",
+    "temporarily_unavailable",
+]);
+/**
+ * Turn an `?error=` redirect into what to tell the user, and whether it is
+ * their doing.
+ *
+ * Every `?error=` used to be reported as "Sign-in was declined", marked
+ * expected, and therefore skipped for Sentry capture. Only `access_denied` is
+ * the person declining. `invalid_scope` is HQ or the catalog asking for
+ * something the provider does not grant; `unauthorized_client` and
+ * `invalid_request` are a misconfigured client; `server_error` is the provider
+ * failing. Reporting those as a decision the user made both misdirects the
+ * user — there is nothing for them to do differently — and hid the real,
+ * fixable causes from error reporting, because "expected" suppresses capture.
+ * So: `access_denied` stays expected and quiet; everything else is a provider
+ * rejection that reaches Sentry.
+ */
+export function authorizeErrorOutcome(raw) {
+    const code = raw.trim().toLowerCase();
+    if (code === "access_denied") {
+        return { message: "Sign-in was declined.", expected: true };
+    }
+    const known = OAUTH_AUTHORIZE_ERROR_CODES.has(code) ? code : "other";
+    return {
+        message: `The provider refused the sign-in request (${known}). ` +
+            "Nothing was connected.",
+        expected: false,
+    };
+}
 /**
  * Escapes text destined for the callback page.
  *
@@ -180,7 +222,10 @@ export async function startLoopbackListener(opts = {}) {
                     timer = null;
                     const { code, state, error } = result;
                     if (error) {
-                        reject(new IntegrationsCliError(`Sign-in was declined (${error}).`, { expected: true }));
+                        const outcome = authorizeErrorOutcome(error);
+                        reject(new IntegrationsCliError(outcome.message, {
+                            expected: outcome.expected,
+                        }));
                         return;
                     }
                     if (!code || !state) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.109.2",
+  "version": "5.109.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {