@indigoai-us/hq-cli 5.130.0 → 5.132.0

package/dist/utils/vault-api.js

@@ -6,6 +6,8 @@ import { CompanySelectionError } from './company-selection-error.js';
 import { recordPlanLimitStatus } from '../lib/plan-limit-nag.js';
 import { networkTransportErrorCode } from './network-transport-error.js';
 import { planGateErrorFromResponse } from './plan-gate-error.js';
+import { markExpectedUserError } from './expected-cli-error.js';
+import { redactErrorText } from './redact-error-text.js';
 /**
  * Identity / company resolution lookups must never hang forever. These small
  * GETs run BEFORE a command does its real work (e.g. `hq secrets env` resolves
@@ -193,6 +195,7 @@ export async function vaultApiFetch(opts) {
                 // skew on EVERY authenticated request, not only health heartbeats.
                 // Fixed build constant, never caller-supplied; attribution only.
                 'x-hq-client-version': CLI_VERSION,
+                ...opts.headers,
             },
             body: opts.body ? JSON.stringify(opts.body) : undefined,
             signal: opts.signal,
@@ -342,6 +345,9 @@ function formatSlugLookupReason(res, body) {
         return fromStatus;
     return `HTTP ${res.status}`;
 }
+function redactedSlugLookupMessage(message) {
+    return redactErrorText(message) || 'Company lookup failed.';
+}
 function isTransientSlugLookupStatus(status) {
     return status === 408 || status === 425 || status === 429 || status >= 500;
 }
@@ -475,14 +481,15 @@ async function resolveCompanyUid(token, ref) {
         // failure — treating it as not-found sent owners to check a slug that
         // was fine (Shepherd #2306).
         if (res.status === 404 && mine.kind === "miss") {
-            throw Object.assign(new Error(`Company slug '${ref}' was not found. Check the slug or run \`hq companies list\`.`), { expected: true });
+            throw Object.assign(new Error(redactedSlugLookupMessage(`Company slug '${ref}' was not found. Check the slug or run \`hq companies list\`.`)), { expected: true });
         }
         const reason = formatSlugLookupReason(res, body);
         const retryable = mine.kind === "transient" || isTransientSlugLookupStatus(res.status);
         const hint = retryable
             ? " This is a temporary lookup failure, not a missing company. Retry the command."
             : "";
-        throw new Error(`Failed to resolve company slug '${ref}': ${reason}.${hint}`);
+        const error = new Error(redactedSlugLookupMessage(`Failed to resolve company slug '${ref}': ${reason}.${hint}`));
+        throw retryable ? error : markExpectedUserError(error);
     }
     const data = (await res.json());
     return data.entity.uid;
@@ -494,7 +501,8 @@ async function resolveCompanyFromMemberships(token) {
         signal: AbortSignal.timeout(identityLookupTimeoutMs()),
     });
     if (!res.ok) {
-        throw new Error("Failed to fetch memberships — run `hq login` and try again");
+        const error = new Error("Failed to fetch memberships — run `hq login` and try again");
+        throw res.status === 401 ? markExpectedUserError(error) : error;
     }
     const data = (await res.json());
     const active = data.memberships.filter((m) => m.status === 'active');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.130.0",
+  "version": "5.132.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -17,7 +17,8 @@
     "assets/lanes-hooks",
     "templates",
     "CHANGELOG.md",
-    "README.md"
+    "README.md",
+    "contracts"
   ],
   "scripts": {
     "build": "node scripts/generate-dsn.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs",