@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/commands/integrations-connect.js

@@ -18,8 +18,11 @@
  */
 import chalk from "chalk";
 import open from "open";
-import { DEFAULT_VAULT_API_URL, ensureCognitoIdToken, } from "../utils/cognito-session.js";
+import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { consoleOrigin } from "../utils/console-origin.js";
+export { consoleOrigin };
 import { getCompanyUid } from "../utils/vault-api.js";
+import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
 import { IntegrationsCliError, bareProvider, connectionDomain, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, } from "./integrations-core.js";
 import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBlueprint, startOAuth, } from "./integrations-api.js";
 import { OAUTH_LOOPBACK_TIMEOUT_CODE, startLoopbackListener, } from "./integrations-oauth.js";
@@ -182,6 +185,12 @@ export function assertAuthMode(value) {
         throw new IntegrationsCliError("--auth must be none, key, or oauth.", { expected: true });
     }
 }
+/** RFC 7230 token characters accepted for an HTTP field name. */
+export function assertAuthHeader(value) {
+    if (value !== undefined && !/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(value)) {
+        throw new IntegrationsCliError("--auth-header must be a non-empty HTTP header name using RFC 7230 token characters.", { expected: true });
+    }
+}
 /** Single-quote a value for a copy-pasteable shell command. */
 export function shellQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -292,7 +301,7 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
                 : found.discovery.authMode === "oauth"
                     ? "oauth"
                     : "none",
-            label: found.discovery.displayName,
+            label: redactUrlsInText(found.discovery.displayName),
         };
     }
     if (opts.mcpUrl) {
@@ -302,11 +311,11 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
                 ...(opts.provider ? { provider: opts.provider } : {}),
                 ...(opts.displayName ? { displayName: opts.displayName } : {}),
             },
-            label: opts.displayName ?? opts.provider ?? opts.mcpUrl,
+            label: redactUrlsInText(opts.displayName ?? opts.provider ?? opts.mcpUrl),
         };
     }
     if (opts.entryId) {
-        return { ref: { catalogEntryId: opts.entryId }, label: opts.entryId };
+        return { ref: { catalogEntryId: opts.entryId }, label: redactUrlsInText(opts.entryId) };
     }
     if (!app) {
         throw new IntegrationsCliError("Name an app to connect — a domain (`hq integrations connect linear.app`), or use --mcp-url / --docs-url / --entry-id.", { expected: true });
@@ -324,10 +333,10 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
             return {
                 ref: { domain: app },
                 ...(match?.authClass ? { authClass: match.authClass } : {}),
-                label: match?.name || app,
+                label: redactUrlsInText(match?.name || app),
             };
         }
-        return catalogEntryToTarget(match, { ref: { domain: app }, label: app });
+        return catalogEntryToTarget(match, { ref: { domain: app }, label: redactUrlsInText(app) });
     }
     // A bare name (`notion`, `atlassian`) is how the catalog reads to a person —
     // the rows are titled `notion.com`, `atlassian.com`. Resolve it to that row
@@ -337,9 +346,9 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
     // unmatched → fall back to the server-side query resolver.
     const named = await findCatalogEntryByName(token, companyUid, app);
     if (named) {
-        return catalogEntryToTarget(named, { ref: { query: app }, label: app });
+        return catalogEntryToTarget(named, { ref: { query: app }, label: redactUrlsInText(app) });
     }
-    return { ref: { query: app }, label: app };
+    return { ref: { query: app }, label: redactUrlsInText(app) };
 }
 /**
  * Turn a matched catalog entry into a connect target, preferring its opaque
@@ -353,13 +362,13 @@ function catalogEntryToTarget(match, fallback) {
         return {
             ref: { catalogEntryId: match.entryId },
             ...(match.authClass ? { authClass: match.authClass } : {}),
-            label: match.name || fallback.label,
+            label: redactUrlsInText(match.name || fallback.label),
         };
     }
     return {
         ref: { domain: match.domain },
         ...(match.authClass ? { authClass: match.authClass } : {}),
-        label: match.name || fallback.label,
+        label: redactUrlsInText(match.name || fallback.label),
     };
 }
 /** Best-effort catalog lookup by domain; never fails the connect. */
@@ -507,15 +516,15 @@ async function connectViaOAuth(token, companyUid, target, opts) {
         // that beats it, but ordering it this way means the happy path never
         // depends on that buffer.
         const pendingCode = listener.waitForCode(started.state);
-        console.error(chalk.dim(`Waiting for you to sign in to ${started.displayName || target.label}…`));
+        console.error(chalk.dim(`Waiting for you to sign in to ${redactUrlsInText(started.displayName || target.label)}…`));
         if (opts.browser === false) {
-            console.error(`Open this URL to sign in:\n  ${started.authorizationUrl}`);
+            console.error(`Open this URL to sign in:\n  ${redactSensitiveUrl(started.authorizationUrl)}`);
         }
         else {
             // A failed browser launch (headless box, no handler) is recoverable —
             // print the URL and keep waiting rather than aborting the sign-in.
             await open(started.authorizationUrl).catch(() => {
-                console.error(`Open this URL to sign in:\n  ${started.authorizationUrl}`);
+                console.error(`Open this URL to sign in:\n  ${redactSensitiveUrl(started.authorizationUrl)}`);
             });
         }
         let code;
@@ -535,37 +544,6 @@ async function connectViaOAuth(token, companyUid, target, opts) {
         listener.close();
     }
 }
-const PRODUCTION_CONSOLE_ORIGIN = "https://hq.computer";
-const PRODUCTION_VAULT_API_HOST = "hqapi.hq.computer";
-/**
- * The console that fronts the control plane this CLI is pointed at.
- *
- * A handoff must land on the console for the SAME backend, because that
- * console starts its own OAuth flow against its own backend. Sending a staging
- * session to the production console would connect the app in the wrong place —
- * so when the control plane is overridden and its console cannot be derived,
- * return undefined and say so rather than guess a host.
- *
- * `HQ_CONSOLE_URL` is the explicit override; otherwise the console is the
- * control-plane host with its `hqapi.` prefix removed.
- */
-export function consoleOrigin(vaultApiUrl = DEFAULT_VAULT_API_URL) {
-    const explicit = process.env.HQ_CONSOLE_URL?.trim();
-    if (explicit)
-        return explicit.replace(/\/+$/, "");
-    let api;
-    try {
-        api = new URL(vaultApiUrl);
-    }
-    catch {
-        return undefined;
-    }
-    if (api.host === PRODUCTION_VAULT_API_HOST)
-        return PRODUCTION_CONSOLE_ORIGIN;
-    if (!api.hostname.startsWith("hqapi."))
-        return undefined;
-    return `${api.protocol}//${api.host.slice("hqapi.".length)}`;
-}
 /**
  * The console's Integrations page for a company, the console root when the
  * caller never named one (a single-membership session resolves the company
@@ -596,9 +574,9 @@ companySlug, origin) {
  */
 function targetSelectionHint(opts) {
     if (opts.mcpUrl)
-        return `Server address to enter there: ${opts.mcpUrl}`;
+        return `Server address to enter there: ${redactSensitiveUrl(opts.mcpUrl)}`;
     if (opts.docsUrl)
-        return `Found from these docs: ${opts.docsUrl}`;
+        return `Found from these docs: ${redactSensitiveUrl(opts.docsUrl)}`;
     if (opts.entryId)
         return `Catalog entry: ${opts.entryId}`;
     return undefined;
@@ -656,10 +634,10 @@ function loopbackTimeoutHandoff(target, opts) {
 }
 function printConsoleDestination(target, opts, url) {
     if (url) {
-        console.error(`Open this page and connect ${target.label} from it:\n  ${url}`);
+        console.error(`Open this page and connect ${redactUrlsInText(target.label)} from it:\n  ${redactSensitiveUrl(url)}`);
     }
     else {
-        console.error(`Open your HQ console's Integrations page and connect ${target.label} there. ` +
+        console.error(`Open your HQ console's Integrations page and connect ${redactUrlsInText(target.label)} there. ` +
             "(This session points at a control plane whose console address is not " +
             "derivable — set HQ_CONSOLE_URL to name it.)");
     }
@@ -707,9 +685,9 @@ async function consoleHandoff(target, opts) {
  * credentials — but only the console can collect them, so say what is needed
  * and hand the page over rather than restating the refusal and stopping.
  */
-async function bringYourOwnClientHandoff(target, opts, reason, redirectUri) {
-    console.error(chalk.yellow(reason));
-    console.error(`${target.label} needs an OAuth app you register with the provider yourself.`);
+export async function bringYourOwnClientHandoff(target, opts, reason, redirectUri) {
+    console.error(chalk.yellow(redactUrlsInText(reason)));
+    console.error(`${redactUrlsInText(target.label)} needs an OAuth app you register with the provider yourself.`);
     // Prefer finishing here. The recovery needs two things the terminal can
     // supply — the callback URL to register, and a client id + secret — and
     // hq-pro sends the first one back on exactly these errors. Falling through
@@ -719,7 +697,7 @@ async function bringYourOwnClientHandoff(target, opts, reason, redirectUri) {
     if (redirectUri && command) {
         console.error("");
         console.error(`In the provider's developer portal, register this callback URL:`);
-        console.error(`  ${redirectUri}`);
+        console.error(`  ${redactSensitiveUrl(redirectUri)}`);
         console.error(`Then run:`);
         console.error(`  ${command}`);
         console.error(chalk.dim("The secret is read from stdin, so it stays out of your shell history. " +
@@ -747,7 +725,7 @@ function byoClientCommand(target, opts) {
     const { mcpUrl, provider } = target.ref;
     if (!mcpUrl)
         return null;
-    const parts = ["hq integrations connect", `--mcp-url ${shellQuote(mcpUrl)}`];
+    const parts = ["hq integrations connect", `--mcp-url ${shellQuote(redactSensitiveUrl(mcpUrl))}`];
     if (opts.company)
         parts.push(`--company ${shellQuote(opts.company)}`);
     if (provider)
@@ -849,14 +827,38 @@ async function userClientSignIn(token, companyUid, target, opts, client, request
         // authorize step on this path too.
         ...(requestedScopes ? { scopes: requestedScopes } : {}),
     });
-    console.error(`Open this URL to sign in to ${started.displayName || target.label}:`);
-    console.error(`  ${started.authorizationUrl}`);
+    console.error(`Open this URL to sign in to ${redactUrlsInText(started.displayName || target.label)}:`);
+    console.error(`  ${redactSensitiveUrl(started.authorizationUrl)}`);
+    const googleHint = googleClientTypeHint(client.clientId, started.authorizationUrl);
+    if (googleHint)
+        console.error(chalk.yellow(googleHint));
     if (opts.browser !== false)
         await open(started.authorizationUrl).catch(() => { });
     console.error(chalk.dim("The browser finishes on the HQ console. When it says connected, " +
         "run `hq integrations list` to confirm."));
     return null;
 }
+/**
+ * Google issues "Desktop app" and "Web application" OAuth clients with the
+ * same client-id shape, but only a Web application client accepts HQ's hosted
+ * https callback. A Desktop client fails at Google with `redirect_uri_mismatch`
+ * after the user has already opened the browser, so say it up front
+ * (Undrdog, 2026-09-24). The callback is read from the authorize URL hq-pro
+ * built, so the hint always names the URL Google will actually be sent.
+ */
+export function googleClientTypeHint(clientId, authorizationUrl) {
+    if (!clientId.toLowerCase().endsWith(".apps.googleusercontent.com"))
+        return null;
+    let redirectUri = null;
+    try {
+        redirectUri = new URL(authorizationUrl).searchParams.get("redirect_uri");
+    }
+    catch {
+        // An unparseable URL still gets the client-type half of the hint.
+    }
+    return ("This Google OAuth client must be of type \"Web application\" (a \"Desktop app\" client will not work)" +
+        (redirectUri ? `, with this authorized redirect URI:\n  ${redactSensitiveUrl(redirectUri)}` : "."));
+}
 /**
  * Second chance at a credential when the target's auth mode wasn't known up
  * front.
@@ -893,7 +895,7 @@ function reportInstall(result, opts, expectedRevivedConnectionId) {
     const { installation, connection } = result;
     const toolCount = result.mcp?.tools?.length;
     const revived = connection.id === expectedRevivedConnectionId;
-    console.log(chalk.green(`${revived ? "Revived" : "Connected"} ${chalk.bold(installation.displayName)}`) +
+    console.log(chalk.green(`${revived ? "Revived" : "Connected"} ${chalk.bold(redactUrlsInText(installation.displayName))}`) +
         (typeof toolCount === "number" ? chalk.dim(` — ${toolCount} tools available`) : ""));
     console.log(chalk.dim(`  connection: ${connection.id}`));
     if (installation.status === "needs_credentials") {
@@ -908,7 +910,9 @@ function reportInstall(result, opts, expectedRevivedConnectionId) {
  */
 async function connectApp(token, companyUid, app, opts, expectedRevivedConnectionId) {
     const target = await resolveTarget(token, companyUid, app, opts, expectedRevivedConnectionId !== undefined);
-    const authMode = opts.auth ?? target.authClass;
+    const authMode = opts.authHeader
+        ? "key"
+        : opts.auth ?? target.authClass;
     assertUserClientApplicable(opts, target, authMode);
     assertScopesApplicable(opts, target, authMode);
     if (authMode === "oauth") {
@@ -926,7 +930,13 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
         const result = await installIntegration(token, companyUid, {
             ...target.ref,
             ...(bearerToken
-                ? { authMode: "bearer", bearerToken }
+                ? {
+                    authMode: "bearer",
+                    bearerToken,
+                    ...(opts.authHeader
+                        ? { authScheme: { placement: "header", header: opts.authHeader } }
+                        : {}),
+                }
                 : authMode === "none"
                     ? { authMode: "none" }
                     : {}),
@@ -1049,7 +1059,7 @@ async function refuseIfAlreadyConnected(token, companyUid, app, opts) {
         });
         return true;
     }
-    const label = existing.installation?.displayName ?? slug;
+    const label = redactUrlsInText(existing.installation?.displayName ?? slug);
     console.log(chalk.green(`${label} is already connected.`));
     console.log(chalk.dim(`  Sign in again:  hq integrations reconnect --provider ${slug}\n` +
         `  Add a second:   hq integrations connect ${shellQuote(app)} --force`));
@@ -1080,7 +1090,7 @@ export function registerConnectCommands(integrations) {
         }
         if (entries.length === 0) {
             console.log(query
-                ? `Nothing matched '${query}'. Try a domain, e.g. hq integrations catalog linear.app`
+                ? `Nothing matched '${redactUrlsInText(query)}'. Try a domain, e.g. hq integrations catalog linear.app`
                 : "The catalog is empty right now.");
             return;
         }
@@ -1105,9 +1115,9 @@ export function registerConnectCommands(integrations) {
             ]
                 .filter(Boolean)
                 .join(" · ");
-            console.log(`${chalk.bold(entry.name)}  ${chalk.dim(entry.domain)}  ${chalk.dim(tags)}`);
+            console.log(`${chalk.bold(redactUrlsInText(entry.name))}  ${chalk.dim(redactUrlsInText(entry.domain))}  ${chalk.dim(tags)}`);
             if (entry.description)
-                console.log(chalk.dim(`  ${entry.description}`));
+                console.log(chalk.dim(`  ${redactUrlsInText(entry.description)}`));
         }
         console.log(chalk.dim(`\n${entries.length} apps. Connect one with: hq integrations connect <domain>`));
     });
@@ -1127,18 +1137,18 @@ export function registerConnectCommands(integrations) {
             printJson(blueprint);
             return;
         }
-        console.log(`${chalk.bold(blueprint.displayName)}  ${chalk.dim(blueprint.domain)}`);
+        console.log(`${chalk.bold(redactUrlsInText(blueprint.displayName))}  ${chalk.dim(redactUrlsInText(blueprint.domain))}`);
         if (blueprint.summary)
-            console.log(chalk.dim(blueprint.summary));
+            console.log(chalk.dim(redactUrlsInText(blueprint.summary)));
         for (const surface of blueprint.surfaces) {
             const auth = surface.authStatus === "none" ? "no auth" : `auth: ${surface.authStatus}`;
-            console.log(`  ${chalk.bold(surface.kind)}  ${surface.name}  ${chalk.dim(`${auth} · ${surface.readiness.strategy}`)}`);
+            console.log(`  ${chalk.bold(redactUrlsInText(surface.kind))}  ${redactUrlsInText(surface.name)}  ${chalk.dim(`${auth} · ${redactUrlsInText(surface.readiness.strategy)}`)}`);
         }
         for (const credential of blueprint.credentials) {
-            console.log(chalk.dim(`  needs: ${credential.label}${credential.generateUrl ? ` (${credential.generateUrl})` : ""}`));
+            console.log(chalk.dim(`  needs: ${redactUrlsInText(credential.label)}${credential.generateUrl ? ` (${redactSensitiveUrl(credential.generateUrl)})` : ""}`));
         }
         for (const warning of blueprint.warnings) {
-            console.log(chalk.yellow(`  ! ${warning.message}`));
+            console.log(chalk.yellow(`  ! ${redactUrlsInText(warning.message)}`));
         }
     });
     integrations
@@ -1159,11 +1169,11 @@ export function registerConnectCommands(integrations) {
             return;
         }
         const { discovery } = found;
-        console.log(`${chalk.bold(discovery.displayName)}  ${chalk.dim(discovery.mcpUrl)}`);
+        console.log(`${chalk.bold(redactUrlsInText(discovery.displayName))}  ${chalk.dim(redactSensitiveUrl(discovery.mcpUrl))}`);
         console.log(chalk.dim(`  sign-in: ${discovery.authMode} · ${discovery.verification} · confidence ${discovery.confidence}`));
         // Quoted: a docs URL routinely carries `&`, which would background the
         // command when pasted, and `;` would run whatever follows it.
-        console.log(chalk.dim(`\nConnect it with: hq integrations connect --docs-url ${shellQuote(docsUrl)}`));
+        console.log(chalk.dim(`\nConnect it with: hq integrations connect --docs-url ${shellQuote(redactSensitiveUrl(docsUrl))}`));
     });
     integrations
         .command("connect [app]")
@@ -1177,6 +1187,7 @@ export function registerConnectCommands(integrations) {
         .option("--display-name <name>", "Display name for a custom --mcp-url")
         .option("--token <key>", "API key (prefer --token-stdin: --token lands in shell history)")
         .option("--token-stdin", "Read the API key from stdin")
+        .option("--auth-header <name>", "Send the API key in this HTTP header (implies --auth key)")
         .option("--auth <mode>", "Force the auth mode: none, key, or oauth (default: detect)")
         .option("--client-id <id>", "Client id of an OAuth app you registered with the provider yourself")
         .option("--client-secret-stdin", "Read that app's client secret from stdin")
@@ -1187,6 +1198,10 @@ export function registerConnectCommands(integrations) {
         .option("--json", "Machine-readable output")
         .action(async (app, opts) => {
         assertAuthMode(opts.auth);
+        assertAuthHeader(opts.authHeader);
+        if (opts.authHeader && opts.auth !== undefined && opts.auth !== "key") {
+            throw new IntegrationsCliError("--auth-header can only be used with --auth key.", { expected: true });
+        }
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         if (await refuseIfAlreadyConnected(token, companyUid, app, opts))
@@ -1225,8 +1240,8 @@ export function registerConnectCommands(integrations) {
                 if (opts.json)
                     printJson(details);
                 else {
-                    console.log(chalk.yellow(details.reason));
-                    console.log(chalk.yellow(`Re-add it with: ${details.fixPath}`));
+                    console.log(chalk.yellow(redactUrlsInText(details.reason)));
+                    console.log(chalk.yellow(`Re-add it with: ${redactUrlsInText(details.fixPath)}`));
                 }
                 return;
             }

package/dist/commands/integrations-core.d.ts

@@ -152,12 +152,10 @@ export declare class IntegrationsCliError extends Error {
     readonly rpcCode?: number;
     /**
      * HQ's own OAuth callback URL, carried on the errors that say a provider
-     * refused to register HQ automatically. It is what the admin must register
-     * with the provider before their own OAuth app can be used, and it is NOT a
-     * secret — every authorization server already receives it in the authorize
-     * URL. Taken from the response rather than assembled locally so the CLI
-     * prints the callback this backend will actually redirect to, instead of a
-     * guess at its route that would send the admin to register the wrong URL.
+     * refused to register HQ automatically. The provider must register the exact
+     * callback this backend will redirect to, so the CLI preserves the server
+     * value for the OAuth recovery flow. It may contain sensitive query data;
+     * keep it non-enumerable and redact it at display boundaries.
      */
     readonly redirectUri?: string;
     constructor(message: string, opts?: {
@@ -274,6 +272,8 @@ interface QueuedOutcome {
 }
 export declare function queuedOutcome(payload: unknown): QueuedOutcome | null;
 export declare function printJson(value: unknown): void;
+/** Print the successful payload from `hq integrations call` without altering URLs. */
+export declare function printIntegrationCallResultJson(value: unknown): void;
 /**
  * Print why a connection is unusable and how to repair it, directly beneath its
  * status line.

package/dist/commands/integrations-core.js

@@ -12,7 +12,9 @@ import { randomUUID } from "node:crypto";
 import chalk from "chalk";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { AuthError } from "../utils/auth-error.js";
+import { planGateErrorFromPayload } from "../utils/plan-gate-error.js";
 import { redactErrorText } from "../utils/redact-error-text.js";
+import { redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
 import { connectionHealthNotice } from "../lib/integrations/health.js";
 import { bareProvider } from "../lib/integrations/provider-slug.js";
 export { bareProvider } from "../lib/integrations/provider-slug.js";
@@ -53,16 +55,14 @@ export class IntegrationsCliError extends Error {
     rpcCode;
     /**
      * HQ's own OAuth callback URL, carried on the errors that say a provider
-     * refused to register HQ automatically. It is what the admin must register
-     * with the provider before their own OAuth app can be used, and it is NOT a
-     * secret — every authorization server already receives it in the authorize
-     * URL. Taken from the response rather than assembled locally so the CLI
-     * prints the callback this backend will actually redirect to, instead of a
-     * guess at its route that would send the admin to register the wrong URL.
+     * refused to register HQ automatically. The provider must register the exact
+     * callback this backend will redirect to, so the CLI preserves the server
+     * value for the OAuth recovery flow. It may contain sensitive query data;
+     * keep it non-enumerable and redact it at display boundaries.
      */
     redirectUri;
     constructor(message, opts = {}) {
-        super(message);
+        super(redactUrlsInText(message));
         this.name = "IntegrationsCliError";
         this.expected = opts.expected ?? false;
         if (opts.code)
@@ -73,8 +73,12 @@ export class IntegrationsCliError extends Error {
             this.oauthProtected = opts.oauthProtected;
         if (opts.rpcCode !== undefined)
             this.rpcCode = opts.rpcCode;
-        if (opts.redirectUri !== undefined)
-            this.redirectUri = opts.redirectUri;
+        if (opts.redirectUri !== undefined) {
+            Object.defineProperty(this, "redirectUri", {
+                value: opts.redirectUri,
+                enumerable: false,
+            });
+        }
     }
 }
 /**
@@ -192,6 +196,12 @@ export async function raiseForResponse(res, fallback) {
     raiseIfUnauthorized(res);
     raiseIfUpstreamUnavailable(res);
     const body = (await res.json().catch(() => ({})));
+    // A plan-limit 402 is normally decoded by vaultApiFetch before it gets here.
+    // Decode it again so no integration route can print the wire token
+    // `plan_limit_reached` as its whole message; main.ts renders the typed gate.
+    const planGate = planGateErrorFromPayload(res.status, body);
+    if (planGate)
+        throw planGate;
     // hq-pro mints this error text, so it is untrusted input to a message we
     // print verbatim — scrub credentials out before it can reach a terminal or a
     // Sentry crash report (same reasoning as the gateway path below).
@@ -473,6 +483,10 @@ export function queuedOutcome(payload) {
     return null;
 }
 export function printJson(value) {
+    console.log(JSON.stringify(redactSensitiveUrls(value), null, 2));
+}
+/** Print the successful payload from `hq integrations call` without altering URLs. */
+export function printIntegrationCallResultJson(value) {
     console.log(JSON.stringify(value, null, 2));
 }
 /**
@@ -492,8 +506,8 @@ export function printHealthNotice(connection) {
     const notice = connectionHealthNotice(connection);
     if (!notice)
         return;
-    console.log(chalk.yellow(`  ${notice.headline}`));
+    console.log(chalk.yellow(`  ${redactUrlsInText(notice.headline)}`));
     if (notice.remediation)
-        console.log(chalk.yellow(`  ${notice.remediation}`));
+        console.log(chalk.yellow(`  ${redactUrlsInText(notice.remediation)}`));
 }
 //# sourceMappingURL=integrations-core.js.map

package/dist/commands/integrations-import.d.ts

@@ -3,7 +3,7 @@ import { type McpManifest } from "./mcp-registration.js";
 export type DesktopConnector = McpManifest & {
     [key: string]: unknown;
 };
-export type ImportStatus = "imported" | "needs-signin" | "shared-for-local" | "skipped";
+export type ImportStatus = "imported" | "needs-signin" | "shared-for-local" | "personal-for-local" | "skipped";
 export interface ImportOutcome {
     name: string;
     status: ImportStatus;

package/dist/commands/integrations-import.js

@@ -10,10 +10,12 @@ import * as path from "node:path";
 import chalk from "chalk";
 import { ensureCognitoIdToken, ensureCognitoToken, resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
 import { bareProvider, IntegrationsCliError, printJson } from "./integrations-core.js";
 import { installIntegration, startOAuth } from "./integrations-api.js";
 import { loadRevealedSecrets } from "./secrets.js";
 import { registerServer } from "./mcp-registration.js";
+import { personalConnectorSettingsEnabled } from "./personal-connector-settings-flag.js";
 const OAUTH_REQUIRED_CODE = "INTEGRATION_FACTORY_OAUTH_REQUIRED";
 /** Claude Desktop's documented connector-config location for the current OS. */
 export function claudeDesktopConfigPath(platform = process.platform, home = os.homedir(), env = process.env) {
@@ -148,7 +150,13 @@ function oauthRequired(error) {
 function reconnectCommand(name, provider) {
     return `hq integrations reconnect ${name} --provider ${bareProvider(provider)}`;
 }
-function connectorPath(hqRoot, company, name) {
+function connectorPath(hqRoot, name, company, personal) {
+    if (personal) {
+        return path.join(hqRoot, "personal", "settings", "connectors", `${name}.json`);
+    }
+    if (!company) {
+        throw new IntegrationsCliError("A company is required for a shared connector manifest.", { expected: true });
+    }
     return path.join(hqRoot, "companies", company, "settings", "connectors", `${name}.json`);
 }
 /**
@@ -171,8 +179,8 @@ async function companyFolderSlug(token, companyUid) {
     }
     return folderSlug;
 }
-function writeLocalConnector(hqRoot, company, name, entry) {
-    const target = connectorPath(hqRoot, company, name);
+function writeLocalConnector(hqRoot, name, company, personal, entry) {
+    const target = connectorPath(hqRoot, name, company, personal);
     fs.mkdirSync(path.dirname(target), { recursive: true });
     fs.writeFileSync(target, `${JSON.stringify(stripConnectorSecrets(entry), null, 2)}\n`, { mode: 0o600 });
     return target;
@@ -222,28 +230,31 @@ async function importRemote(token, companyUid, name, entry, dryRun) {
 function renderOutcomes(outcomes) {
     console.log("Connector                 Outcome             Details");
     for (const outcome of outcomes) {
-        console.log(`${outcome.name.padEnd(25)} ${outcome.status.padEnd(19)} ${outcome.reason ?? outcome.path ?? ""}`);
+        console.log(`${redactUrlsInText(outcome.name).padEnd(25)} ${outcome.status.padEnd(19)} ${redactUrlsInText(outcome.reason ?? outcome.path ?? "")}`);
     }
-    for (const outcome of outcomes.filter((item) => item.status === "shared-for-local")) {
-        console.log(chalk.dim(`  Shared manifest: ${outcome.path}`));
-        console.log(chalk.dim(`  Teammate install: ${outcome.installCommand}`));
+    for (const outcome of outcomes.filter((item) => item.status === "shared-for-local" || item.status === "personal-for-local")) {
+        const label = outcome.status === "personal-for-local" ? "Personal manifest" : "Shared manifest";
+        const installLabel = outcome.status === "personal-for-local" ? "Personal install" : "Teammate install";
+        console.log(chalk.dim(`  ${label}: ${redactUrlsInText(outcome.path ?? "")}`));
+        console.log(chalk.dim(`  ${installLabel}: ${redactUrlsInText(outcome.installCommand ?? "")}`));
     }
-    if (outcomes.some((item) => item.status === "shared-for-local")) {
+    if (outcomes.some((item) => item.status === "shared-for-local" || item.status === "personal-for-local")) {
         console.log(chalk.yellow("  Local connector credentials were replaced with ${secret:ENV_NAME}. Set them with `hq secrets` before installing."));
     }
     if (outcomes.some((item) => item.redactedArgumentCredentials)) {
         console.log(chalk.yellow("  Local connector argument credentials were replaced with ${secret:FLAG_NAME}. Set them with `hq secrets` before installing."));
     }
     for (const outcome of outcomes.filter((item) => item.status === "needs-signin")) {
-        console.log(chalk.yellow(`  ${outcome.name} needs sign-in: ${outcome.reason}`));
-        if (outcome.authorizationUrl)
-            console.log(chalk.yellow(`  Open this URL to sign in:\n  ${outcome.authorizationUrl}`));
+        console.log(chalk.yellow(`  ${redactUrlsInText(outcome.name)} needs sign-in: ${redactUrlsInText(outcome.reason ?? "")}`));
+        if (outcome.authorizationUrl) {
+            console.log(chalk.yellow(`  Open this URL to sign in:\n  ${redactSensitiveUrl(outcome.authorizationUrl)}`));
+        }
     }
 }
 export function registerImportCommands(integrations) {
     integrations
         .command("import")
-        .description("Import Claude Desktop connectors into company Integrations")
+        .description("Import Claude Desktop connectors into HQ Integrations")
         .option("--company <slug>", "Company slug (defaults to your single active company)")
         .option("--dry-run", "Detect and classify connectors without writing or connecting")
         .option("--only <name[,name...]>", "Import only these Claude Desktop connector names")
@@ -270,6 +281,7 @@ export function registerImportCommands(integrations) {
         const outcomes = [];
         let company;
         let hqRoot;
+        const personalSettings = personalConnectorSettingsEnabled();
         const localCompany = async () => company ??= await companyFolderSlug(token, companyUid);
         const localHqRoot = () => hqRoot ??= resolveDefaultHqRoot({ onMissing: "throw" });
         const normalizedNames = new Map();
@@ -295,13 +307,17 @@ export function registerImportCommands(integrations) {
                 continue;
             }
             if (isLocal(entry)) {
-                const resolvedCompany = await localCompany();
-                const target = connectorPath(localHqRoot(), resolvedCompany, safeName);
+                const resolvedCompany = personalSettings ? undefined : await localCompany();
+                const target = connectorPath(localHqRoot(), safeName, resolvedCompany, personalSettings);
                 outcomes.push({
                     name,
-                    status: "shared-for-local",
-                    ...(opts.dryRun ? { reason: "would write secret-stripped local manifest" } : { path: writeLocalConnector(localHqRoot(), resolvedCompany, safeName, entry) }),
-                    installCommand: `hq integrations install-local ${safeName} --company ${resolvedCompany}`,
+                    status: personalSettings ? "personal-for-local" : "shared-for-local",
+                    ...(opts.dryRun
+                        ? { reason: personalSettings ? "would write secret-stripped personal manifest" : "would write secret-stripped local manifest" }
+                        : { path: writeLocalConnector(localHqRoot(), safeName, resolvedCompany, personalSettings, entry) }),
+                    installCommand: personalSettings
+                        ? `hq integrations install-local ${safeName}`
+                        : `hq integrations install-local ${safeName} --company ${resolvedCompany}`,
                     ...(hasRedactedArgumentCredentials(entry) ? { redactedArgumentCredentials: true } : {}),
                 });
                 // Keep dry-run output useful without leaking a filesystem write target.
@@ -322,7 +338,7 @@ export function registerImportCommands(integrations) {
     });
     integrations
         .command("install-local <name>")
-        .description("Register a company-shared local connector in this machine's Claude/Codex MCP config")
+        .description("Install local connector settings in this machine's Claude/Codex MCP config")
         .option("--company <slug>", "Company slug (defaults to your single active company)")
         .option("--json", "Machine-readable registration result")
         .action(async (name, opts) => {
@@ -332,11 +348,12 @@ export function registerImportCommands(integrations) {
         }
         const token = await ensureCognitoToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const company = await companyFolderSlug(token, companyUid);
+        const personalSettings = personalConnectorSettingsEnabled();
+        const company = personalSettings ? undefined : await companyFolderSlug(token, companyUid);
         const hqRoot = resolveDefaultHqRoot({ onMissing: "throw" });
-        const manifestPath = connectorPath(hqRoot, company, safeName);
+        const manifestPath = connectorPath(hqRoot, safeName, company, personalSettings);
         if (!fs.existsSync(manifestPath)) {
-            throw new IntegrationsCliError(`Shared connector not found: ${manifestPath}`, { expected: true });
+            throw new IntegrationsCliError(`Connector settings not found: ${manifestPath}`, { expected: true });
         }
         let manifest;
         try {
@@ -344,15 +361,17 @@ export function registerImportCommands(integrations) {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            throw new IntegrationsCliError(`Could not parse shared connector ${manifestPath}: ${message}`, { expected: true });
+            throw new IntegrationsCliError(`Could not parse connector settings ${manifestPath}: ${message}`, { expected: true });
         }
         const secretNames = [...Object.values({ ...(manifest.env ?? {}), ...(manifest.headers ?? {}) }), ...(manifest.args ?? [])]
             .flatMap((value) => [...value.matchAll(/\$\{secret:([A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]*)*)\}/g)].map((match) => match[1]));
-        const secrets = await loadRevealedSecrets(token, companyUid, secretNames);
+        const secrets = await loadRevealedSecrets(token, companyUid, secretNames, undefined, {
+            allowOfflineFallback: false,
+        });
         const result = registerServer({
             name: safeName,
             manifest,
-            pack: `company-${company}-connectors`,
+            pack: personalSettings ? "personal-connectors" : `company-${company}-connectors`,
             resolveSecret: (secret) => secrets.get(secret) ?? null,
         });
         if (opts.json)