@indigoai-us/hq-cli 5.334.0 → 5.335.1-beta.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.335.1-beta.0] — 2026-10-03
+- Client-health refresh failures now retain the bounded Cognito OAuth error class for accurate auth diagnostics.
+- CI: Run main-push Linux ARM checks on the reserved self-hosted runner pool.
+
+## [5.335.0] — 2026-10-03
+- Keep expected invalid-refresh-token events countable at warning level and tag each rejection with its allowlisted Cognito OAuth error class.
+- Keep the intentional HQ Anywhere flag-off refusal for `hq mcp login` out of Sentry while preserving its message and exit code.
+
 ## [5.334.0] — 2026-10-03
 - Keep keep-alive audit verdicts for expired stops independent of the lane's current state, and report restarts recorded after the grace window separately.
 

package/dist/lib/daemon/mcp-oauth.js

@@ -5,6 +5,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import open from "open";
 import { resolveCognitoTokenSource } from "../../utils/cognito-session.js";
+import { markExpectedUserError } from "../../utils/expected-cli-error.js";
 import { anywhereRuntimeEnabled } from "../../commands/anywhere-runtime-flag.js";
 import { resolveHqMcpOAuthOrigin } from "./mcp-endpoint.js";
 const MCP_SCOPE = "openid email profile hq-mcp/use";
@@ -128,7 +129,7 @@ function newPkce() {
 async function runLogin(options) {
     const env = options.env ?? process.env;
     if (!(options.isEnabled ?? (() => anywhereRuntimeEnabled(env)))()) {
-        throw new McpOAuthError("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use `hq mcp login`.");
+        throw markExpectedUserError(new McpOAuthError("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use `hq mcp login`."));
     }
     if ((options.isMachine ?? (() => resolveCognitoTokenSource(env) === "machine"))()) {
         throw new McpOAuthError("`hq mcp login` is for person accounts; this box uses machine credentials.");

package/dist/utils/cognito-refresh-sentry.js

@@ -1,5 +1,15 @@
 import { CLI_VERSION } from "../cli-version.js";
 import { CognitoRefreshError } from "@indigoai-us/hq-cloud";
+const OAUTH_ERROR_CLASSES = new Set([
+    "invalid_grant",
+    "invalid_client",
+    "unauthorized_client",
+    "invalid_request",
+    "invalid_scope",
+    "NotAuthorizedException",
+    "other",
+    "unknown",
+]);
 /** Capture only fixed, aggregatable auth diagnostics; never attach tokens or identity. */
 export async function reportNoninteractivePersonRefreshRejection(error) {
     try {
@@ -11,6 +21,15 @@ export async function reportNoninteractivePersonRefreshRejection(error) {
         const rejectionKind = error instanceof CognitoRefreshError
             ? "cognito_refresh_rejection"
             : "classified_auth_error";
+        const rawOauthError = error instanceof CognitoRefreshError &&
+            "oauthError" in error &&
+            typeof error.oauthError === "string"
+            ? error.oauthError
+            : "unknown";
+        const oauthError = OAUTH_ERROR_CLASSES.has(rawOauthError)
+            ? rawOauthError
+            : "unknown";
+        const expectedReauthentication = oauthError === "invalid_grant" || oauthError === "NotAuthorizedException";
         Sentry.withScope((scope) => {
             scope.setUser(null);
             scope.clearBreadcrumbs();
@@ -29,10 +48,11 @@ export async function reportNoninteractivePersonRefreshRejection(error) {
                     ...(Number.isInteger(statusCode) ? { status_code: statusCode } : {}),
                 },
             });
-            scope.setLevel("error");
+            scope.setLevel(expectedReauthentication ? "warning" : "error");
             scope.setFingerprint(["hq-cli", "person-refresh-rejected"]);
             scope.setTag("component", "person-session-refresh");
             scope.setTag("auth.rejection_kind", rejectionKind);
+            scope.setTag("auth.oauth_error", oauthError);
             scope.setTag("auth.fresh_cache_generation_found", "false");
             scope.setTag("platform", process.platform);
             scope.setTag("cli_version", CLI_VERSION);

package/dist/utils/cognito-session.js

@@ -531,6 +531,73 @@ function throwIfAborted(signal) {
     if (signal.aborted)
         throw signal.reason ?? new Error("Token acquisition was aborted");
 }
+const COGNITO_REFRESH_OAUTH_ERROR_CLASSES = new Set([
+    "invalid_grant",
+    "invalid_client",
+    "unauthorized_client",
+    "invalid_request",
+    "invalid_scope",
+    "NotAuthorizedException",
+]);
+const MAX_COGNITO_REFRESH_ERROR_BODY_BYTES = 4_096;
+function classifyCognitoRefreshOAuthError(text) {
+    try {
+        const payload = JSON.parse(text);
+        if (!payload || typeof payload !== "object" || !("error" in payload))
+            return "unknown";
+        const oauthError = payload.error;
+        if (typeof oauthError !== "string")
+            return "unknown";
+        return COGNITO_REFRESH_OAUTH_ERROR_CLASSES.has(oauthError)
+            ? oauthError
+            : "other";
+    }
+    catch {
+        return "unknown";
+    }
+}
+async function readCognitoRefreshOAuthError(response, signal) {
+    throwIfAborted(signal);
+    const reader = response.body?.getReader();
+    if (!reader)
+        return "unknown";
+    const decoder = new TextDecoder();
+    let text = "";
+    let bytesRead = 0;
+    let bodyComplete = false;
+    const cancelRead = () => {
+        void reader.cancel(signal.reason ?? new Error("Token acquisition was aborted")).catch(() => undefined);
+    };
+    signal.addEventListener("abort", cancelRead, { once: true });
+    try {
+        while (bytesRead < MAX_COGNITO_REFRESH_ERROR_BODY_BYTES) {
+            throwIfAborted(signal);
+            const chunk = await reader.read();
+            throwIfAborted(signal);
+            if (chunk.done) {
+                bodyComplete = true;
+                text += decoder.decode();
+                break;
+            }
+            const boundedChunk = chunk.value.subarray(0, MAX_COGNITO_REFRESH_ERROR_BODY_BYTES - bytesRead);
+            bytesRead += boundedChunk.byteLength;
+            text += decoder.decode(boundedChunk, { stream: true });
+        }
+        throwIfAborted(signal);
+        text += decoder.decode();
+        return classifyCognitoRefreshOAuthError(text);
+    }
+    catch {
+        throwIfAborted(signal);
+        return "unknown";
+    }
+    finally {
+        signal.removeEventListener("abort", cancelRead);
+        if (!bodyComplete)
+            cancelRead();
+        reader.releaseLock();
+    }
+}
 function waitForRefreshLock(signal, delayMs) {
     return new Promise((resolve, reject) => {
         const finish = (error) => {
@@ -681,7 +748,16 @@ export async function refreshActivePersonTokensForClientHealth(cached, signal) {
                 continue;
             const reauth = response.status === 401 ||
                 (response.status >= 400 && response.status < 500 && ![408, 429].includes(response.status));
-            throw new CognitoRefreshError(`Cognito refresh failed (${response.status})`, reauth, response.status, fingerprint);
+            const oauthError = reauth
+                ? await readCognitoRefreshOAuthError(response, signal)
+                : "unknown";
+            const error = new CognitoRefreshError(`Cognito refresh failed (${response.status})`, reauth, response.status, fingerprint);
+            Object.defineProperty(error, "oauthError", {
+                configurable: true,
+                enumerable: true,
+                value: oauthError,
+            });
+            throw error;
         }
         if (!response?.ok) {
             throw new CognitoRefreshError("Cognito refresh failed after retry", false, undefined, fingerprint);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.334.0",
+  "version": "5.335.1-beta.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {