@indigoai-us/hq-cli 5.333.0 → 5.335.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.335.0] — 2026-10-03
+- Keep expected invalid-refresh-token events countable at warning level and tag each rejection with its allowlisted Cognito OAuth error class.
+- Keep the intentional HQ Anywhere flag-off refusal for `hq mcp login` out of Sentry while preserving its message and exit code.
+
+## [5.334.0] — 2026-10-03
+- Keep keep-alive audit verdicts for expired stops independent of the lane's current state, and report restarts recorded after the grace window separately.
+
 ## [5.333.0] — 2026-10-03
 - Limit session-start telemetry to 30 events per machine per rolling minute.
 - Start the globally registered HQ hook with BASH_ENV cleared, so an inherited shell profile no longer runs before every hook event.

package/dist/command-catalog.generated.d.ts

@@ -11105,7 +11105,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "keep-alive-audit";
-        readonly description: "Audit lead lane keep-alive timing";
+        readonly description: "Audit lead lane keep-alive timing. A later envelope proves another turn ran and may reclassify an expired stop as restarted_untimed when no launch record remains; late_restarts_after_window counts known launches after the grace window.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;

package/dist/command-catalog.generated.js

@@ -13486,7 +13486,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "keep-alive-audit",
-                "description": "Audit lead lane keep-alive timing",
+                "description": "Audit lead lane keep-alive timing. A later envelope proves another turn ran and may reclassify an expired stop as restarted_untimed when no launch record remains; late_restarts_after_window counts known launches after the grace window.",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,

package/dist/commands/lanes-keep-alive-audit.js

@@ -2,7 +2,7 @@ import { buildKeepAliveAudit, formatKeepAliveAuditText } from "../lib/lanes/keep
 export function registerLaneKeepAliveAuditCommand(parent, deps) {
     parent
         .command("keep-alive-audit")
-        .description("Audit lead lane keep-alive timing")
+        .description("Audit lead lane keep-alive timing. A later envelope proves another turn ran and may reclassify an expired stop as restarted_untimed when no launch record remains; late_restarts_after_window counts known launches after the grace window.")
         .option("--since <iso>", "Include stopped turns at or after this ISO date-time")
         .option("--lane <id>", "Audit one exact lane id")
         .option("--json", "Print the report as JSON")

package/dist/lib/daemon/mcp-oauth.js

@@ -5,6 +5,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import open from "open";
 import { resolveCognitoTokenSource } from "../../utils/cognito-session.js";
+import { markExpectedUserError } from "../../utils/expected-cli-error.js";
 import { anywhereRuntimeEnabled } from "../../commands/anywhere-runtime-flag.js";
 import { resolveHqMcpOAuthOrigin } from "./mcp-endpoint.js";
 const MCP_SCOPE = "openid email profile hq-mcp/use";
@@ -128,7 +129,7 @@ function newPkce() {
 async function runLogin(options) {
     const env = options.env ?? process.env;
     if (!(options.isEnabled ?? (() => anywhereRuntimeEnabled(env)))()) {
-        throw new McpOAuthError("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use `hq mcp login`.");
+        throw markExpectedUserError(new McpOAuthError("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use `hq mcp login`."));
     }
     if ((options.isMachine ?? (() => resolveCognitoTokenSource(env) === "machine"))()) {
         throw new McpOAuthError("`hq mcp login` is for person accounts; this box uses machine credentials.");

package/dist/lib/lanes/keep-alive-audit.d.ts

@@ -19,6 +19,7 @@ interface KeepAliveAuditSummary {
     by_verdict: Record<KeepAliveAuditVerdict, number>;
     not_restarted: number;
     restarted_untimed: number;
+    late_restarts_after_window: number;
     late_over_10m: number;
     early_wake_by_others: number;
     self_wake: number;

package/dist/lib/lanes/keep-alive-audit.js

@@ -4,7 +4,6 @@ import { LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS } from "./keep-alive.js";
 import { LanesError } from "./errors.js";
 import { laneRunDir } from "./spawn.js";
 import { listQuestionIds, readAllLanes, tryReadQuestion } from "./store.js";
-import { HISTORY_CAP } from "./types.js";
 function readDoneClassifications(hqRoot, laneId) {
     const root = fs.realpathSync(hqRoot);
     const watcherLog = path.join(laneRunDir(root, laneId), "logs", "watcher.out");
@@ -309,17 +308,21 @@ function firstRestartAfter(lane, stop, nextEnvelopeMs) {
         // cannot establish its launch time.
         return { at: null, trigger: "keep_alive", caller: null };
     }
-    const resumeHistory = lane.resume_history ?? [];
-    const keepAliveHistory = lane.keep_alive_history ?? [];
-    if (resumeHistory.length >= HISTORY_CAP && keepAliveHistory.length >= HISTORY_CAP) {
-        // Both append-only histories can roll this resume out. The later envelope
-        // proves a turn ran, while its trigger and launch time are no longer known.
-        return { at: null, trigger: "unknown", caller: null };
-    }
-    return null;
+    const interruptedKeepAliveResume = (lane.keep_alive_history ?? []).some((entry) => {
+        const at = parseTime(entry.at);
+        return entry.resumed_from !== "done" && at !== undefined && at > stop.mtimeMs && at < nextEnvelopeMs;
+    });
+    if (interruptedKeepAliveResume)
+        return null;
+    // A later envelope proves the stop was followed by another turn even when
+    // neither capped history has a matching entry. Report the restart as
+    // untimed instead of using the lane's mutable current state as a proxy.
+    return nextEnvelopeMs === undefined ? null : { at: null, trigger: "unknown", caller: null };
 }
 function classifyVerdict(input) {
     const { dueAt, restart, lane, nowMs } = input;
+    if (restart?.trigger === "unknown" && laneWasKeepAliveOffAtStop(lane, input.stoppedAt))
+        return "keep_alive_off";
     if (restart) {
         if (restart.at === null)
             return "restarted_untimed";
@@ -356,7 +359,7 @@ function classifyVerdict(input) {
     }
     if (laneWasKeepAliveOffAtStop(lane, input.stoppedAt))
         return "keep_alive_off";
-    if (lane.state === "done" && nowMs > dueAt + KEEP_ALIVE_NOT_RESTARTED_GRACE_MS)
+    if (nowMs > dueAt + KEEP_ALIVE_NOT_RESTARTED_GRACE_MS)
         return "not_restarted";
     return "waiting";
 }
@@ -413,8 +416,12 @@ export function buildKeepAliveAudit(input) {
     rows.sort((a, b) => a.stopped_at.localeCompare(b.stopped_at) || a.lane.localeCompare(b.lane));
     const byVerdict = Object.fromEntries(VERDICTS.map((verdict) => [verdict, 0]));
     let lateOverTenMinutes = 0;
+    let lateRestartsAfterWindow = 0;
     for (const row of rows) {
         byVerdict[row.verdict] += 1;
+        if (row.restart !== null && row.restart.at !== null && Date.parse(row.restart.at) > Date.parse(row.due_at) + KEEP_ALIVE_NOT_RESTARTED_GRACE_MS) {
+            lateRestartsAfterWindow += 1;
+        }
         if (row.verdict === "late" && row.restart !== null && row.restart.at !== null && Date.parse(row.restart.at) - Date.parse(row.due_at) > LATE_KPI_THRESHOLD_MS) {
             lateOverTenMinutes += 1;
         }
@@ -427,6 +434,7 @@ export function buildKeepAliveAudit(input) {
             by_verdict: byVerdict,
             not_restarted: byVerdict.not_restarted,
             restarted_untimed: byVerdict.restarted_untimed,
+            late_restarts_after_window: lateRestartsAfterWindow,
             late_over_10m: lateOverTenMinutes,
             early_wake_by_others: byVerdict.early_wake,
             self_wake: byVerdict.self_wake,
@@ -455,7 +463,7 @@ export function formatKeepAliveAuditText(result) {
         ...values.map(tableLine),
         "",
         `Since ${result.since}; ${counts}`,
-        `not_restarted=${result.summary.not_restarted}, late_over_10m=${result.summary.late_over_10m}, early_wake_by_others=${result.summary.early_wake_by_others}, self_wake=${result.summary.self_wake}`,
+        `not_restarted=${result.summary.not_restarted}, late_restarts_after_window=${result.summary.late_restarts_after_window}, late_over_10m=${result.summary.late_over_10m}, early_wake_by_others=${result.summary.early_wake_by_others}, self_wake=${result.summary.self_wake}`,
         `Stopped and not restarted on their own: ${result.summary.stopped_and_not_restarted_on_their_own}`,
         ...result.errors.map((error) => `Error ${error.lane} (${error.error}) at ${error.path}: ${error.message}`),
     ].join("\n");

package/dist/utils/cognito-refresh-sentry.js

@@ -1,5 +1,15 @@
 import { CLI_VERSION } from "../cli-version.js";
 import { CognitoRefreshError } from "@indigoai-us/hq-cloud";
+const OAUTH_ERROR_CLASSES = new Set([
+    "invalid_grant",
+    "invalid_client",
+    "unauthorized_client",
+    "invalid_request",
+    "invalid_scope",
+    "NotAuthorizedException",
+    "other",
+    "unknown",
+]);
 /** Capture only fixed, aggregatable auth diagnostics; never attach tokens or identity. */
 export async function reportNoninteractivePersonRefreshRejection(error) {
     try {
@@ -11,6 +21,15 @@ export async function reportNoninteractivePersonRefreshRejection(error) {
         const rejectionKind = error instanceof CognitoRefreshError
             ? "cognito_refresh_rejection"
             : "classified_auth_error";
+        const rawOauthError = error instanceof CognitoRefreshError &&
+            "oauthError" in error &&
+            typeof error.oauthError === "string"
+            ? error.oauthError
+            : "unknown";
+        const oauthError = OAUTH_ERROR_CLASSES.has(rawOauthError)
+            ? rawOauthError
+            : "unknown";
+        const expectedReauthentication = oauthError === "invalid_grant" || oauthError === "NotAuthorizedException";
         Sentry.withScope((scope) => {
             scope.setUser(null);
             scope.clearBreadcrumbs();
@@ -29,10 +48,11 @@ export async function reportNoninteractivePersonRefreshRejection(error) {
                     ...(Number.isInteger(statusCode) ? { status_code: statusCode } : {}),
                 },
             });
-            scope.setLevel("error");
+            scope.setLevel(expectedReauthentication ? "warning" : "error");
             scope.setFingerprint(["hq-cli", "person-refresh-rejected"]);
             scope.setTag("component", "person-session-refresh");
             scope.setTag("auth.rejection_kind", rejectionKind);
+            scope.setTag("auth.oauth_error", oauthError);
             scope.setTag("auth.fresh_cache_generation_found", "false");
             scope.setTag("platform", process.platform);
             scope.setTag("cli_version", CLI_VERSION);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.333.0",
+  "version": "5.335.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {