@indigoai-us/hq-cli 5.335.0 → 5.335.1-beta.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.335.1-beta.0] — 2026-10-03
+- Client-health refresh failures now retain the bounded Cognito OAuth error class for accurate auth diagnostics.
+- CI: Run main-push Linux ARM checks on the reserved self-hosted runner pool.
+
 ## [5.335.0] — 2026-10-03
 - Keep expected invalid-refresh-token events countable at warning level and tag each rejection with its allowlisted Cognito OAuth error class.
 - Keep the intentional HQ Anywhere flag-off refusal for `hq mcp login` out of Sentry while preserving its message and exit code.

package/dist/utils/cognito-session.js

@@ -531,6 +531,73 @@ function throwIfAborted(signal) {
     if (signal.aborted)
         throw signal.reason ?? new Error("Token acquisition was aborted");
 }
+const COGNITO_REFRESH_OAUTH_ERROR_CLASSES = new Set([
+    "invalid_grant",
+    "invalid_client",
+    "unauthorized_client",
+    "invalid_request",
+    "invalid_scope",
+    "NotAuthorizedException",
+]);
+const MAX_COGNITO_REFRESH_ERROR_BODY_BYTES = 4_096;
+function classifyCognitoRefreshOAuthError(text) {
+    try {
+        const payload = JSON.parse(text);
+        if (!payload || typeof payload !== "object" || !("error" in payload))
+            return "unknown";
+        const oauthError = payload.error;
+        if (typeof oauthError !== "string")
+            return "unknown";
+        return COGNITO_REFRESH_OAUTH_ERROR_CLASSES.has(oauthError)
+            ? oauthError
+            : "other";
+    }
+    catch {
+        return "unknown";
+    }
+}
+async function readCognitoRefreshOAuthError(response, signal) {
+    throwIfAborted(signal);
+    const reader = response.body?.getReader();
+    if (!reader)
+        return "unknown";
+    const decoder = new TextDecoder();
+    let text = "";
+    let bytesRead = 0;
+    let bodyComplete = false;
+    const cancelRead = () => {
+        void reader.cancel(signal.reason ?? new Error("Token acquisition was aborted")).catch(() => undefined);
+    };
+    signal.addEventListener("abort", cancelRead, { once: true });
+    try {
+        while (bytesRead < MAX_COGNITO_REFRESH_ERROR_BODY_BYTES) {
+            throwIfAborted(signal);
+            const chunk = await reader.read();
+            throwIfAborted(signal);
+            if (chunk.done) {
+                bodyComplete = true;
+                text += decoder.decode();
+                break;
+            }
+            const boundedChunk = chunk.value.subarray(0, MAX_COGNITO_REFRESH_ERROR_BODY_BYTES - bytesRead);
+            bytesRead += boundedChunk.byteLength;
+            text += decoder.decode(boundedChunk, { stream: true });
+        }
+        throwIfAborted(signal);
+        text += decoder.decode();
+        return classifyCognitoRefreshOAuthError(text);
+    }
+    catch {
+        throwIfAborted(signal);
+        return "unknown";
+    }
+    finally {
+        signal.removeEventListener("abort", cancelRead);
+        if (!bodyComplete)
+            cancelRead();
+        reader.releaseLock();
+    }
+}
 function waitForRefreshLock(signal, delayMs) {
     return new Promise((resolve, reject) => {
         const finish = (error) => {
@@ -681,7 +748,16 @@ export async function refreshActivePersonTokensForClientHealth(cached, signal) {
                 continue;
             const reauth = response.status === 401 ||
                 (response.status >= 400 && response.status < 500 && ![408, 429].includes(response.status));
-            throw new CognitoRefreshError(`Cognito refresh failed (${response.status})`, reauth, response.status, fingerprint);
+            const oauthError = reauth
+                ? await readCognitoRefreshOAuthError(response, signal)
+                : "unknown";
+            const error = new CognitoRefreshError(`Cognito refresh failed (${response.status})`, reauth, response.status, fingerprint);
+            Object.defineProperty(error, "oauthError", {
+                configurable: true,
+                enumerable: true,
+                value: oauthError,
+            });
+            throw error;
         }
         if (!response?.ok) {
             throw new CognitoRefreshError("Cognito refresh failed after retry", false, undefined, fingerprint);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.335.0",
+  "version": "5.335.1-beta.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {