@indigoai-us/hq-cli 5.326.0 → 5.328.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.328.0] — 2026-10-02
+- Keep successful JSON responses readable if vault API plan-limit inspection cannot reconstruct its buffered response.
+- Fixed bundled scaffold checks that could misclassify matching records when `grep -q` closed a pipe under `pipefail`.
+- Keep `hq mcp serve` initialization lightweight by avoiding the full flag registry and network-family compatibility setup.
+
+## [5.327.0] — 2026-10-02
+- Reduce hook-time startup imports for repo-run-registry and isolate hook-helper handlers from sibling modules.
+- Keep package-root Sentry diagnostics off the fast-route import path unless root diagnostics are needed.
+- `hq mcp login` adds browser-based OAuth sign-in for hosted MCP.
+
 ## [5.326.0] — 2026-10-02
 - Company-scoped daemon tools now reject an explicit company that conflicts with the active session or repository binding.
 - Added a flag-gated `hq mcp serve` command and global install hook for the Anywhere runtime.

package/assets/scaffold/core/scripts/hq-dm-bind.sh

@@ -329,7 +329,7 @@ mention_line() {
 cmd_bind() {
   local ch="${1:-}"; [ -n "$ch" ] || die "bind needs a channel name (see: hq channels)"
   ch="${ch#\#}"
-  hq channels 2>/dev/null | grep -q -- "hq dm $ch " || die "no channel named '$ch' (see: hq channels)"
+  hq channels 2>/dev/null | grep -- "hq dm $ch " >/dev/null || die "no channel named '$ch' (see: hq channels)"
   bash "$SESSION_SH" set dm_channel "$ch" >/dev/null
   local sk; sk="$(latest_sk "$ch")"
   printf '%s\n' "$sk" > "$(cursor_file)"

package/assets/scaffold/core/scripts/hq-job-run.sh

@@ -323,24 +323,24 @@ classify_failure() {
   local lower
   lower="$(printf '%s' "$tail_txt" | tr '[:upper:]' '[:lower:]')"
 
-  if printf '%s' "$lower" | grep -Eq \
-    'not logged in|please log in|authentication (failed|required)|unauthorized|401|invalid.*(token|credential)|credentials? (missing|expired|invalid)|device.?code|login required'; then
+  if printf '%s' "$lower" | grep -E \
+    'not logged in|please log in|authentication (failed|required)|unauthorized|401|invalid.*(token|credential)|credentials? (missing|expired|invalid)|device.?code|login required' >/dev/null; then
     printf 'auth'
     return
   fi
-  if printf '%s' "$lower" | grep -Eq \
-    'secret.*(not found|missing|denied|not visible|not shared)|hq secrets.*(fail|error|denied)|missing vault|access denied.*secret'; then
+  if printf '%s' "$lower" | grep -E \
+    'secret.*(not found|missing|denied|not visible|not shared)|hq secrets.*(fail|error|denied)|missing vault|access denied.*secret' >/dev/null; then
     printf 'secrets'
     return
   fi
   # Avoid matching job metadata like timeout_seconds=N in the log header.
-  if printf '%s' "$lower" | grep -Eq \
-    '(^|[^_])timed out|command timed out|deadline exceeded|killed by timeout|exit[=:][[:space:]]*124\b'; then
+  if printf '%s' "$lower" | grep -E \
+    '(^|[^_])timed out|command timed out|deadline exceeded|killed by timeout|exit[=:][[:space:]]*124\b' >/dev/null; then
     printf 'timeout'
     return
   fi
-  if printf '%s' "$lower" | grep -Eq \
-    'connection (refused|reset|timed out)|network is unreachable|temporary failure|econnreset|enotfound|no space left|i/o error|transport error|dns (fail|error)|http[/ ]*(502|503|504)|statusingesterror|api unreachable'; then
+  if printf '%s' "$lower" | grep -E \
+    'connection (refused|reset|timed out)|network is unreachable|temporary failure|econnreset|enotfound|no space left|i/o error|transport error|dns (fail|error)|http[/ ]*(502|503|504)|statusingesterror|api unreachable' >/dev/null; then
     printf 'infra'
     return
   fi

package/assets/scaffold/core/scripts/ontology-audience-grant.sh

@@ -67,7 +67,7 @@ for aud in "$C"/signals/@*/_audience.yaml; do
     # attendees), so they are already company identities; emails must be members.
     case "$who" in
       prs_*|agt_*) ;;
-      *) if ! printf '%s\n' "$members" | grep -qxF "$who"; then echo "skip $who (not a member of $co)" >&2; skipped=$((skipped+1)); continue; fi ;;
+      *) if ! grep -qxF "$who" <<<"$members"; then echo "skip $who (not a member of $co)" >&2; skipped=$((skipped+1)); continue; fi ;;
     esac
     for p in $prefixes; do grant "$p" "$who"; done
   done

package/assets/scaffold/core/scripts/ontology-candidate.sh

@@ -79,7 +79,7 @@ id="$(printf '%s\n%s\n%s\n%s' "$kind" "$type" "$key" "$norm_body" | sha)"
 
 dir="$root/companies/$co/$store/_candidates/$(date -u +%Y-%m-%d)"
 # Idempotent across days: the same candidate already written (pending or done) is a no-op.
-if find "$root/companies/$co/$store/_candidates" -name "$id.md" 2>/dev/null | grep -q .; then
+if [ -n "$(find "$root/companies/$co/$store/_candidates" -name "$id.md" -print -quit 2>/dev/null)" ]; then
   echo "exists $id"; exit 0
 fi
 mkdir -p "$dir"

package/assets/scaffold/core/scripts/resolve-company.sh

@@ -65,7 +65,7 @@ SLUGS="$(
 [ -n "$SLUGS" ] || emit "" "none"
 
 is_known_slug() {
-  printf '%s\n' "$SLUGS" | grep -Fxq "$1"
+  printf '%s\n' "$SLUGS" | grep -Fx -- "$1" >/dev/null
 }
 
 prompt_slug() {

package/dist/command-catalog.generated.d.ts

@@ -3728,6 +3728,15 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly arguments: readonly [];
         readonly options: readonly [];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "login";
+        readonly description: "Sign in to the hosted HQ MCP connector with browser OAuth";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "status";
         readonly description: "Show installed MCP packs/servers and their health in BOTH Claude and Codex (PARTIAL/DRIFT flagged; secrets redacted)";

package/dist/command-catalog.generated.js

@@ -4811,6 +4811,16 @@ export const COMMAND_CATALOG = [
                 "options": [],
                 "subcommands": []
             },
+            {
+                "name": "login",
+                "description": "Sign in to the hosted HQ MCP connector with browser OAuth",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "status",
                 "description": "Show installed MCP packs/servers and their health in BOTH Claude and Codex (PARTIAL/DRIFT flagged; secrets redacted)",

package/dist/commands/auth.js

@@ -264,7 +264,9 @@ export function registerAuthCommands(program) {
     authCmd
         .command("logout")
         .description("Clear the cached HQ Cognito session")
-        .action(() => {
+        .action(async () => {
+        const { clearMcpOAuthCaches } = await import("../lib/daemon/mcp-oauth.js");
+        clearMcpOAuthCaches();
         const existing = loadCachedTokens();
         if (!existing) {
             console.log(chalk.yellow("No cached HQ session"));

package/dist/commands/core-detect-stale-review-base-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runDetectStaleReviewBaseFast(args: readonly string[], _stdin: string, _cwd: string, hqRoot: string | undefined): Promise<number>;
+//# sourceMappingURL=core-detect-stale-review-base-fast.d.ts.map

package/dist/commands/core-detect-stale-review-base-fast.js

@@ -0,0 +1,23 @@
+/** Fast-route adapter isolated from the other hook-helper command modules. */
+import { resolveBundledAsset } from "../utils/hq-roots-core.js";
+import { runDetectStaleReviewBase, DETECT_STALE_REVIEW_BASE_ASSET } from "./core-detect-stale-review-base-native.js";
+function writeResult(result) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+export async function runDetectStaleReviewBaseFast(args, _stdin, _cwd, hqRoot) {
+    let root = hqRoot;
+    if (!root) {
+        const { resolveLiveRoot } = await import("../utils/hq-roots-core.js");
+        root = resolveLiveRoot();
+    }
+    return writeResult(runDetectStaleReviewBase(args, {
+        cwd: root,
+        env: { ...process.env, HQ_ROOT: root },
+        scriptPath: resolveBundledAsset(DETECT_STALE_REVIEW_BASE_ASSET),
+    }));
+}
+//# sourceMappingURL=core-detect-stale-review-base-fast.js.map

package/dist/commands/core-register-project-native.js

@@ -4,7 +4,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
-import { resolveBundledAsset } from "../utils/hq-roots.js";
+import { resolveBundledAsset } from "../utils/hq-roots-core.js";
 export const REGISTER_PROJECT_ASSET = "core/scripts/register-project.sh";
 const USAGE = "usage: register-project.sh <company> <project> | --audit <company> | --backfill <company> --only-active [--yes] | --retry-pending <company>";
 const MIN_HQ_CLI = "5.139.0";

package/dist/commands/core-repo-run-registry-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runRepoRunRegistryFast(args: readonly string[], _stdin: string, _cwd: string, hqRoot: string | undefined, _commandName: string, _hqRootArg?: string, worktreeScopeFixEnabled?: boolean): Promise<number>;
+//# sourceMappingURL=core-repo-run-registry-fast.d.ts.map

package/dist/commands/core-repo-run-registry-fast.js

@@ -0,0 +1,35 @@
+/** Fast-route adapter isolated from the other hook-helper command modules. */
+import { runBundledScript } from "../utils/run-bundled-script.js";
+import { runRepoRunRegistry, REPO_RUN_REGISTRY_ASSET } from "./core-repo-run-registry-native.js";
+function writeResult(result) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+async function liveRoot(hqRoot) {
+    if (hqRoot)
+        return hqRoot;
+    const { resolveLiveRoot } = await import("../utils/hq-roots-core.js");
+    return resolveLiveRoot();
+}
+export async function runRepoRunRegistryFast(args, _stdin, _cwd, hqRoot, _commandName, _hqRootArg, worktreeScopeFixEnabled = false) {
+    const root = await liveRoot(hqRoot);
+    return writeResult(runRepoRunRegistry(args, {
+        root,
+        cwd: root,
+        env: process.env,
+        worktreeScopeFixEnabled,
+        runShellFallback: (fallbackArgs) => {
+            const { code } = runBundledScript({
+                asset: REPO_RUN_REGISTRY_ASSET,
+                args: [...fallbackArgs],
+                cwd: root,
+                hqRoot: root,
+            });
+            return { code, stdout: "", stderr: "" };
+        },
+    }));
+}
+//# sourceMappingURL=core-repo-run-registry-fast.js.map

package/dist/commands/core-rrr-worktree-scope-fix-fast-flag.d.ts

@@ -0,0 +1,7 @@
+/** Light company-scoped reader for the repo-run-registry worktree-scope flag. */
+/**
+ * Resolve the same default-off, company-scoped flag without loading the full
+ * flag registry and work-context graph on the ordinary UID-scoped path.
+ */
+export declare function coreRrrWorktreeScopeFixFastFlagEnabled(env?: NodeJS.ProcessEnv): Promise<boolean>;
+//# sourceMappingURL=core-rrr-worktree-scope-fix-fast-flag.d.ts.map

package/dist/commands/core-rrr-worktree-scope-fix-fast-flag.js

@@ -0,0 +1,25 @@
+/** Light company-scoped reader for the repo-run-registry worktree-scope flag. */
+import { readLocalOverride } from "@indigoai-us/hq-flags-client";
+import { readFlagSnapshotFile } from "../lib/flag-snapshot-file.js";
+import { resolveFastProcessFlagCompanyContext } from "../lib/process-flag-company-context-fast.js";
+/**
+ * Resolve the same default-off, company-scoped flag without loading the full
+ * flag registry and work-context graph on the ordinary UID-scoped path.
+ */
+export async function coreRrrWorktreeScopeFixFastFlagEnabled(env = process.env) {
+    const flagKey = "core-rrr-worktree-scope-fix";
+    const override = readLocalOverride(flagKey, env);
+    if (override !== null)
+        return override;
+    try {
+        const context = await resolveFastProcessFlagCompanyContext(env);
+        if (!context.companyUid)
+            return false;
+        return readFlagSnapshotFile(context.companyUid, { env })?.flags[flagKey] === true;
+    }
+    catch {
+        // Keep the fast gate's established fail-closed default for unavailable scope or cache data.
+        return false;
+    }
+}
+//# sourceMappingURL=core-rrr-worktree-scope-fix-fast-flag.js.map

package/dist/commands/core-session-journal-native.js

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { resolveSessionHelperRuntime } from "./core-session-helper-runtime.js";
-import { resolveBundledAsset } from "../utils/hq-roots.js";
+import { resolveBundledAsset } from "../utils/hq-roots-core.js";
 const USAGE = `session-journal.sh: usage:
   session-journal.sh write "<title>" [--files f1,f2,...] [--body-file PATH] [--session KEY]
   session-journal.sh list [--date YYYY-MM-DD]

package/dist/commands/core-share-suggestion-state-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runShareSuggestionStateFast(args: readonly string[], stdin: string, _cwd: string, hqRoot: string | undefined): Promise<number>;
+//# sourceMappingURL=core-share-suggestion-state-fast.d.ts.map

package/dist/commands/core-share-suggestion-state-fast.js

@@ -0,0 +1,25 @@
+/** Fast-route adapter isolated from the other hook-helper command modules. */
+import { runShareSuggestionState } from "./core-share-suggestion-state-native.js";
+function writeResult(result) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+async function liveRoot(hqRoot) {
+    if (hqRoot)
+        return hqRoot;
+    const { resolveLiveRoot } = await import("../utils/hq-roots-core.js");
+    return resolveLiveRoot();
+}
+export async function runShareSuggestionStateFast(args, stdin, _cwd, hqRoot) {
+    const root = await liveRoot(hqRoot);
+    return writeResult(runShareSuggestionState(args, stdin, {
+        root,
+        cwd: root,
+        env: process.env,
+        stdinIsTty: process.stdin.isTTY,
+    }));
+}
+//# sourceMappingURL=core-share-suggestion-state-fast.js.map

package/dist/commands/logout.js

@@ -9,6 +9,8 @@ export function registerLogoutCommand(program) {
         .description('Log out and clear cached credentials')
         .action(async () => {
         try {
+            const { clearMcpOAuthCaches } = await import('../lib/daemon/mcp-oauth.js');
+            clearMcpOAuthCaches();
             const existing = loadCachedTokens();
             if (!existing) {
                 console.log(chalk.yellow('No cached HQ session'));

package/dist/commands/mcp-serve.js

@@ -15,7 +15,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
-import { HQ_ANYWHERE_RUNTIME_FLAG } from "./anywhere-runtime-flag.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "../lib/anywhere-runtime-flag-key.js";
 import { anywhereRuntimeEnabledFromSnapshot } from "../lib/anywhere-runtime-fast-flag.js";
 import { createLineSplitter, HqdClientError, hqdRequest, hqdSocketPath } from "../lib/daemon/protocol.js";
 export const MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];

package/dist/commands/mcp-status.js

@@ -396,6 +396,13 @@ export function registerMcpCommand(program) {
         const { runMcpServe } = await import('./mcp-serve.js');
         await runMcpServe();
     });
+    mcp
+        .command('login')
+        .description('Sign in to the hosted HQ MCP connector with browser OAuth')
+        .action(async () => {
+        const { loginHostedMcp } = await import('../lib/daemon/mcp-oauth.js');
+        await loginHostedMcp();
+    });
     mcp
         .command('status')
         .alias('list')

package/dist/fast-core.js

@@ -39,11 +39,8 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     const useShell = entry.kind === "native" && Boolean(entry.familyFlagKey) && !familyEnabled;
     let worktreeScopeFixEnabled;
     if (entry.name === "repo-run-registry") {
-        const [{ CORE_RRR_WORKTREE_SCOPE_FIX_FLAG }, { fastFlagEnabled }] = await Promise.all([
-            import("./commands/core-rrr-worktree-scope-fix-flag.js"),
-            import("./native-fast-route.js"),
-        ]);
-        worktreeScopeFixEnabled = await fastFlagEnabled(CORE_RRR_WORKTREE_SCOPE_FIX_FLAG, process.env, { numericEnvironmentOverride: false });
+        const { coreRrrWorktreeScopeFixFastFlagEnabled } = await import("./commands/core-rrr-worktree-scope-fix-fast-flag.js");
+        worktreeScopeFixEnabled = await coreRrrWorktreeScopeFixFastFlagEnabled(process.env);
     }
     const shouldInjectRoot = useShell
         ? entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
@@ -57,7 +54,7 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     // its expected-user-error formatting remains authoritative.
     let hqRoot;
     if (shouldInjectRoot) {
-        const { resolveLiveRoot } = await import("./utils/hq-roots.js");
+        const { resolveLiveRoot } = await import("./utils/hq-roots-core.js");
         try {
             hqRoot = resolveLiveRoot(parsed.hqRootArg ? { hqRoot: parsed.hqRootArg } : {});
         }

package/dist/fast-scaffold.js

@@ -175,7 +175,11 @@ export const FAST_SCAFFOLD_SCRIPTS = [
     ...["share-suggestion-state", "repo-run-registry", "detect-stale-review-base"].map((name) => ({
         name,
         kind: "native",
-        modulePath: "./commands/core-hook-state-helpers-native.js",
+        modulePath: name === "share-suggestion-state"
+            ? "./commands/core-share-suggestion-state-fast.js"
+            : name === "repo-run-registry"
+                ? "./commands/core-repo-run-registry-fast.js"
+                : "./commands/core-detect-stale-review-base-fast.js",
         exportName: name === "share-suggestion-state"
             ? "runShareSuggestionStateFast"
             : name === "repo-run-registry"

package/dist/lib/daemon/mcp-endpoint.d.ts

@@ -0,0 +1,8 @@
+export declare class McpEndpointError extends Error {
+    readonly code = "hq_mcp_config_error";
+}
+/** Derive the hosted MCP sibling from the same hq-pro URL used by hq-cli. */
+export declare function resolveHqMcpEndpoint(env?: NodeJS.ProcessEnv): URL;
+/** OAuth endpoints share the origin with the Streamable HTTP MCP endpoint. */
+export declare function resolveHqMcpOAuthOrigin(env?: NodeJS.ProcessEnv): URL;
+//# sourceMappingURL=mcp-endpoint.d.ts.map

package/dist/lib/daemon/mcp-endpoint.js

@@ -0,0 +1,30 @@
+import { DEFAULT_VAULT_API_URL } from "../../utils/cognito-session.js";
+export class McpEndpointError extends Error {
+    code = "hq_mcp_config_error";
+}
+/** Derive the hosted MCP sibling from the same hq-pro URL used by hq-cli. */
+export function resolveHqMcpEndpoint(env = process.env) {
+    const apiUrl = env.HQ_VAULT_API_URL?.trim() || DEFAULT_VAULT_API_URL;
+    let api;
+    try {
+        api = new URL(apiUrl);
+    }
+    catch {
+        throw new McpEndpointError("HQ's configured API URL is invalid; check HQ_VAULT_API_URL.");
+    }
+    if (api.protocol !== "https:" || !api.hostname.startsWith("hqapi.")) {
+        throw new McpEndpointError("Hosted hq-mcp requires an HTTPS hqapi host in HQ_VAULT_API_URL.");
+    }
+    api.hostname = `hq-mcp.${api.hostname.slice("hqapi.".length)}`;
+    api.pathname = "/mcp";
+    api.search = "";
+    api.hash = "";
+    return api;
+}
+/** OAuth endpoints share the origin with the Streamable HTTP MCP endpoint. */
+export function resolveHqMcpOAuthOrigin(env = process.env) {
+    const endpoint = resolveHqMcpEndpoint(env);
+    endpoint.pathname = "/";
+    return endpoint;
+}
+//# sourceMappingURL=mcp-endpoint.js.map

package/dist/lib/daemon/mcp-oauth.d.ts

@@ -0,0 +1,24 @@
+export declare class McpOAuthError extends Error {
+    readonly code = "hq_mcp_auth_required";
+    constructor(message: string);
+}
+export interface McpOAuthOptions {
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    oauthOrigin?: URL;
+    fetchImpl?: typeof fetch;
+    openBrowser?: (url: string) => Promise<unknown>;
+    writeOutput?: (message: string) => void;
+    isEnabled?: () => boolean;
+    isMachine?: () => boolean;
+    now?: () => number;
+    callbackTimeoutMs?: number;
+}
+export declare function mcpOAuthCacheFile(options?: McpOAuthOptions): string;
+/** Perform hosted DCR + PKCE login and cache only the hq-mcp audience tokens. */
+export declare function loginHostedMcp(options?: McpOAuthOptions): Promise<void>;
+/** Load or refresh a person's hosted MCP token without printing token material. */
+export declare function getMcpAudienceToken(options?: McpOAuthOptions): Promise<string>;
+/** Remove all per-origin hosted MCP OAuth caches during either HQ logout flow. */
+export declare function clearMcpOAuthCaches(options?: Pick<McpOAuthOptions, "env" | "home">): void;
+//# sourceMappingURL=mcp-oauth.d.ts.map