@indigoai-us/hq-cli 5.334.0 → 5.335.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.335.0] — 2026-10-03
+- Keep expected invalid-refresh-token events countable at warning level and tag each rejection with its allowlisted Cognito OAuth error class.
+- Keep the intentional HQ Anywhere flag-off refusal for `hq mcp login` out of Sentry while preserving its message and exit code.
+
 ## [5.334.0] — 2026-10-03
 - Keep keep-alive audit verdicts for expired stops independent of the lane's current state, and report restarts recorded after the grace window separately.
 

package/dist/lib/daemon/mcp-oauth.js

@@ -5,6 +5,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import open from "open";
 import { resolveCognitoTokenSource } from "../../utils/cognito-session.js";
+import { markExpectedUserError } from "../../utils/expected-cli-error.js";
 import { anywhereRuntimeEnabled } from "../../commands/anywhere-runtime-flag.js";
 import { resolveHqMcpOAuthOrigin } from "./mcp-endpoint.js";
 const MCP_SCOPE = "openid email profile hq-mcp/use";
@@ -128,7 +129,7 @@ function newPkce() {
 async function runLogin(options) {
     const env = options.env ?? process.env;
     if (!(options.isEnabled ?? (() => anywhereRuntimeEnabled(env)))()) {
-        throw new McpOAuthError("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use `hq mcp login`.");
+        throw markExpectedUserError(new McpOAuthError("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use `hq mcp login`."));
     }
     if ((options.isMachine ?? (() => resolveCognitoTokenSource(env) === "machine"))()) {
         throw new McpOAuthError("`hq mcp login` is for person accounts; this box uses machine credentials.");

package/dist/utils/cognito-refresh-sentry.js

@@ -1,5 +1,15 @@
 import { CLI_VERSION } from "../cli-version.js";
 import { CognitoRefreshError } from "@indigoai-us/hq-cloud";
+const OAUTH_ERROR_CLASSES = new Set([
+    "invalid_grant",
+    "invalid_client",
+    "unauthorized_client",
+    "invalid_request",
+    "invalid_scope",
+    "NotAuthorizedException",
+    "other",
+    "unknown",
+]);
 /** Capture only fixed, aggregatable auth diagnostics; never attach tokens or identity. */
 export async function reportNoninteractivePersonRefreshRejection(error) {
     try {
@@ -11,6 +21,15 @@ export async function reportNoninteractivePersonRefreshRejection(error) {
         const rejectionKind = error instanceof CognitoRefreshError
             ? "cognito_refresh_rejection"
             : "classified_auth_error";
+        const rawOauthError = error instanceof CognitoRefreshError &&
+            "oauthError" in error &&
+            typeof error.oauthError === "string"
+            ? error.oauthError
+            : "unknown";
+        const oauthError = OAUTH_ERROR_CLASSES.has(rawOauthError)
+            ? rawOauthError
+            : "unknown";
+        const expectedReauthentication = oauthError === "invalid_grant" || oauthError === "NotAuthorizedException";
         Sentry.withScope((scope) => {
             scope.setUser(null);
             scope.clearBreadcrumbs();
@@ -29,10 +48,11 @@ export async function reportNoninteractivePersonRefreshRejection(error) {
                     ...(Number.isInteger(statusCode) ? { status_code: statusCode } : {}),
                 },
             });
-            scope.setLevel("error");
+            scope.setLevel(expectedReauthentication ? "warning" : "error");
             scope.setFingerprint(["hq-cli", "person-refresh-rejected"]);
             scope.setTag("component", "person-session-refresh");
             scope.setTag("auth.rejection_kind", rejectionKind);
+            scope.setTag("auth.oauth_error", oauthError);
             scope.setTag("auth.fresh_cache_generation_found", "false");
             scope.setTag("platform", process.platform);
             scope.setTag("cli_version", CLI_VERSION);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.334.0",
+  "version": "5.335.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {