@indigoai-us/hq-cli 5.345.164 → 5.345.166

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## [Unreleased]
 
+## [5.345.166] — 2026-10-24
+- `hq integrations approve` now says why an approved call did not run. When an app refuses it, the CLI prints the app's own reason, such as Slack's refusal to send into a Slack Connect channel. Before this it printed only "failed (rejected)". With an older server it prints the rejection code instead. `hq integrations pending --history` adds a `Why:` line for decided calls that did not run. The approve command printed after a queued call keeps `--company` when you passed it. Before printing, the reason is cleaned of terminal escape codes, credentials and credential-bearing links, and it is capped at 500 characters. Feedback 15e7593c-50e5-4e6a-ae3a-342d618363c0.
+- The bundled sync engine now uses hq-cloud 6.18.101, the current npm `latest`.
+  A 403 from the flags endpoint (for example a stale company in the local
+  manifest) is now held as `false` for an hour instead of being re-read and
+  logged on every telemetry pass (hq-cloud #1046).
+- `hq doctor` no longer counts runner telemetry errors as sync receiver permission refusals. A failed outcome-flag read ("hq-flags: resolve returned 403") for a company you are not a member of used to inflate `sync.runtime.receiver-permission`; only the receiver's own events are counted now.
+- The bundled shell fallbacks for `rebuild-index` all, orchestrator, public-knowledge, reports, social-drafts, threads, and workers now print the same usage as the native command for `--help`/`-h` and exit without writing. Before, they ignored the flag and rebuilt the index, which failed the published core command parity check.
+
+## [5.345.165] — 2026-10-23
+- `hq billing sponsor grant <email|prs_id> --company <slug>` lets a company owner or admin put a member's personal plan on the company bill without a request first; `--all-members` does it for every active member and reports each person as covered, already covered, or skipped. `hq billing sponsor ungrant <email|prs_id>` takes it off again. hq-pro checks the owner/admin role and active membership.
+- `hq scan secrets <files...>` takes `--repo <dir>`, which applies that repo's committed `.gitleaks.toml` allowlists to a file scan, matching each file by its path relative to the repo, as a staged scan does. `--snapshot-root <dir>` (with `--repo`) matches files laid out as `<dir>/<commit>/<repo path>`, the history copies `commit-secret-scan.sh pr-check` writes, as `<repo path>`. Findings still name the files as given. Before this, a file scan ignored the repo's allowlists, so pr-check failed on false positives the commit gate already allowed. Without `--repo` a file scan is unchanged.
+- `--allowlist-rev <rev>` (with `--repo`) reads `.gitleaks.toml` from that commit instead of HEAD; pr-check passes its base branch, so a branch cannot exempt its own earlier commits by adding an allowlist later. An unknown rev exits 2.
+- A file that resolves (after `..` and symlinks) outside the repo and the snapshot root gets no repo allowlist, nor does a snapshot file without a commit folder.
+- A file scan with `--repo` honors only exact-value exemptions. Each allowlist needs `condition = "AND"` and specific `paths`, and lists in `stopwords` the exact secret values it allows, such as known manifest digests (at least 16 characters, no spaces). A detected secret is allowed only when it equals one of them, so other secrets in the same file are still reported. An allowlist with `regexes`, `regexTarget`, `targetRules` or `commits`, or with paths alone, is refused and the scan exits 2, because patterns, alone or combined across entries, can hide a real credential. Staged scans keep the full allowlist format; there each allowlist with content checks is judged by running the real detector on a fixed set of realistic credentials and refused if it hides any of them.
+- An allowlist validation error never prints an exemption value. It names the entry and position (for example `stopwords[0]`) with the value's length and a short SHA-256 prefix, so a credential typed into an allowlist by mistake does not reach terminal or CI logs.
+
 ## [5.345.164] — 2026-10-23
 - `hq billing status` and `hq billing usage --card` now show trial usage against the $500 trial cap, the $10 included usage, the spend limit and a prompt to add a card when usage passes the included amount. The plan line says "unavailable right now" instead of guessing Starter, invoice-billed companies read as a flat plan billed by invoice, and a failed read of a scheduled switch is reported.
 - `hq deploy domains` refuses a name that is really an IPv4 address. Inputs such as `1.2`, `0x7f.1` and `1.2.3.4` were rewritten to an address and accepted; a numeric last label is now refused before any request.

package/assets/scaffold/core/scripts/rebuild-all-indexes.sh

@@ -11,6 +11,17 @@
 
 set -uo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index all --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index all [--accept]' \
+      '' \
+      'Regenerate every INDEX.md across the HQ tree. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-orchestrator-index.sh

@@ -12,6 +12,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index orchestrator --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index orchestrator [--accept]' \
+      '' \
+      'Regenerate the orchestrator workspace INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-public-knowledge-index.sh

@@ -7,6 +7,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index public-knowledge --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index public-knowledge [--accept]' \
+      '' \
+      'Regenerate core/knowledge/public/INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-reports-index.sh

@@ -8,6 +8,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index reports --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index reports [--accept]' \
+      '' \
+      'Regenerate the reports INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-social-drafts-index.sh

@@ -8,6 +8,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index social-drafts --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index social-drafts [--accept]' \
+      '' \
+      'Regenerate workspace/social-drafts/INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 # shellcheck source=core/scripts/lib/portable.sh
 . "$HQ_ROOT/core/scripts/lib/portable.sh"

package/assets/scaffold/core/scripts/rebuild-threads-index.sh

@@ -11,6 +11,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index threads --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index threads [--accept]' \
+      '' \
+      'Regenerate the session-threads INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-workers-index.sh

@@ -7,6 +7,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index workers --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index workers [--accept]' \
+      '' \
+      'Regenerate the workers INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/dist/command-catalog.generated.d.ts

@@ -6277,6 +6277,18 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--json";
             readonly description: "Print findings as JSON";
             readonly hidden: false;
+        }, {
+            readonly flags: "--repo <dir>";
+            readonly description: "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--snapshot-root <dir>";
+            readonly description: "With --repo: files under <dir>/<commit>/<path> are matched as <path>";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--allowlist-rev <rev>";
+            readonly description: "With --repo: read .gitleaks.toml from this commit instead of HEAD";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }];
@@ -8820,6 +8832,60 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "grant";
+            readonly description: "Admin: put a member's personal plan on the company bill, no request needed";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options] [person]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [{
+                readonly name: "person";
+                readonly required: false;
+                readonly variadic: false;
+                readonly description: "Member email or prs_ id";
+            }];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Company slug (resolves to companyUid)";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--all-members";
+                readonly description: "Sponsor every active member of the company";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--json";
+                readonly description: "Emit raw JSON";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "ungrant";
+            readonly description: "Admin: take a member's personal plan off the company bill";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options] <person>";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [{
+                readonly name: "person";
+                readonly required: true;
+                readonly variadic: false;
+                readonly description: "Member email or prs_ id";
+            }];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Company slug (resolves to companyUid)";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--json";
+                readonly description: "Emit raw JSON";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
         }];
     }, {
         readonly name: "usage";

package/dist/command-catalog.generated.js

@@ -7634,6 +7634,21 @@ export const COMMAND_CATALOG = [
                         "flags": "--json",
                         "description": "Print findings as JSON",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--repo <dir>",
+                        "description": "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--snapshot-root <dir>",
+                        "description": "With --repo: files under <dir>/<commit>/<path> are matched as <path>",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--allowlist-rev <rev>",
+                        "description": "With --repo: read .gitleaks.toml from this commit instead of HEAD",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []
@@ -10757,6 +10772,73 @@ export const COMMAND_CATALOG = [
                             }
                         ],
                         "subcommands": []
+                    },
+                    {
+                        "name": "grant",
+                        "description": "Admin: put a member's personal plan on the company bill, no request needed",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options] [person]",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "person",
+                                "required": false,
+                                "variadic": false,
+                                "description": "Member email or prs_ id"
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company slug (resolves to companyUid)",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--all-members",
+                                "description": "Sponsor every active member of the company",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit raw JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "ungrant",
+                        "description": "Admin: take a member's personal plan off the company bill",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options] <person>",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "person",
+                                "required": true,
+                                "variadic": false,
+                                "description": "Member email or prs_ id"
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company slug (resolves to companyUid)",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit raw JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
                     }
                 ]
             },

package/dist/commands/billing-sponsor.d.ts

@@ -13,6 +13,13 @@
  *   hq billing sponsor decline <id>        — admin: say no
  *   hq billing sponsor revoke  <id>        — admin: end an active sponsorship
  *   hq billing sponsor withdraw <id>       — me: take back my own request
+ *   hq billing sponsor grant <person> --company <slug>
+ *                                          — admin: sponsor a member's plan
+ *                                            directly, no request needed
+ *   hq billing sponsor grant --all-members --company <slug>
+ *                                          — admin: sponsor every active member
+ *   hq billing sponsor ungrant <person> --company <slug>
+ *                                          — admin: end a direct sponsorship
  *
  * Every subcommand talks to the SAME hq-pro routes the console uses
  * (`/v1/billing/sponsorship/...`). hq-pro is the authoritative gate on all of
@@ -82,6 +89,19 @@ export interface SponsorshipSelfState {
 }
 /** Plain label for a request status. Never shows the raw enum. */
 export declare function statusLabel(status: string): string;
+/** Per-person outcome of an owner/admin grant, as hq-pro returns it. */
+export interface PlanGrantResult {
+    personUid: string;
+    resourceId: string;
+    outcome: "sponsored" | "already_sponsored" | "sponsored_by_another_company" | "usage_pricing" | "not_a_member";
+}
+/** Plain line for one grant outcome. */
+export declare function grantOutcomeLabel(outcome: PlanGrantResult["outcome"]): string;
+/**
+ * Turn `<person>` into a person uid: a `prs_` uid passes through, an email is
+ * looked up in the company's active members. hq-pro re-checks membership.
+ */
+export declare function resolveMemberPersonUid(token: string, companyUid: string, person: string): Promise<string>;
 export declare function registerBillingSponsorCommands(billing: Command): void;
 export {};
 //# sourceMappingURL=billing-sponsor.d.ts.map

package/dist/commands/billing-sponsor.js

@@ -13,6 +13,13 @@
  *   hq billing sponsor decline <id>        — admin: say no
  *   hq billing sponsor revoke  <id>        — admin: end an active sponsorship
  *   hq billing sponsor withdraw <id>       — me: take back my own request
+ *   hq billing sponsor grant <person> --company <slug>
+ *                                          — admin: sponsor a member's plan
+ *                                            directly, no request needed
+ *   hq billing sponsor grant --all-members --company <slug>
+ *                                          — admin: sponsor every active member
+ *   hq billing sponsor ungrant <person> --company <slug>
+ *                                          — admin: end a direct sponsorship
  *
  * Every subcommand talks to the SAME hq-pro routes the console uses
  * (`/v1/billing/sponsorship/...`). hq-pro is the authoritative gate on all of
@@ -35,6 +42,7 @@ import { diagnosticsEnabled } from "../lib/diagnostics.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { isCompanySelectionError } from "../utils/company-selection-error.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { listActiveMembers } from "./members.js";
 import { fetchCompanyPricingPlan, fetchPersonPricingPlan, isUsageOnly, usageOnlySponsorLines, } from "../lib/billing/usage-only.js";
 /** The request kind this command files. Matches hq-pro's contract. */
 export const PLAN_RESOURCE = "plan";
@@ -90,6 +98,9 @@ export function messageForError(status, body) {
     if (status === 403) {
         return "You're not allowed to do that. Only an owner or admin of the company can answer a sponsorship request.";
     }
+    if (status === 404 && code === "NOT_A_MEMBER") {
+        return "That person isn't an active member of this company.";
+    }
     if (status === 404)
         return "No sponsorship request with that id.";
     if (status === 409 && code === "DUPLICATE_PENDING_REQUEST") {
@@ -168,6 +179,41 @@ async function transition(requestId, op) {
     });
     return { ...data.request, code: data.code, addCardUrl: data.addCardUrl };
 }
+/** Plain line for one grant outcome. */
+export function grantOutcomeLabel(outcome) {
+    switch (outcome) {
+        case "sponsored":
+            return "Now on the company bill";
+        case "already_sponsored":
+            return "Already on the company bill";
+        case "sponsored_by_another_company":
+            return "Skipped: another company already covers them";
+        case "usage_pricing":
+            return "Skipped: on usage pricing, no personal plan to cover";
+        case "not_a_member":
+            return "Skipped: not an active member";
+        default:
+            return outcome;
+    }
+}
+/**
+ * Turn `<person>` into a person uid: a `prs_` uid passes through, an email is
+ * looked up in the company's active members. hq-pro re-checks membership.
+ */
+export async function resolveMemberPersonUid(token, companyUid, person) {
+    const trimmed = person.trim();
+    if (/^prs_[A-Za-z0-9]+$/.test(trimmed))
+        return trimmed;
+    const email = trimmed.toLowerCase();
+    if (!/^[^\s]+@[^\s]+$/.test(email)) {
+        throw new SponsorError("Pass the person's email or their prs_ id.");
+    }
+    const members = await listActiveMembers(token, companyUid);
+    const match = members.find((m) => m.personEmail?.trim().toLowerCase() === email);
+    if (match?.personUid)
+        return match.personUid;
+    throw new SponsorError(`No active member has the email ${email}. Run \`hq members list\`.`);
+}
 /** Whether the sponsoring company is on usage pricing. Unknown counts as no. */
 async function companyIsUsageOnly(companyUid) {
     if (!companyUid)
@@ -402,5 +448,75 @@ export function registerBillingSponsorCommands(billing) {
             fail(err);
         }
     });
+    sponsor
+        .command("grant")
+        .argument("[person]", "Member email or prs_ id")
+        .description("Admin: put a member's personal plan on the company bill, no request needed")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--all-members", "Sponsor every active member of the company")
+        .option("--json", "Emit raw JSON")
+        .action(async function (person, opts) {
+        try {
+            if (Boolean(person) === Boolean(opts.allMembers)) {
+                throw new SponsorError("Name one person, or pass --all-members.");
+            }
+            const token = await ensureCognitoToken();
+            const named = opts.company ?? billing.opts().company;
+            const companyUid = await getCompanyUid(token, named);
+            const body = { companyUid };
+            if (person)
+                body.personUid = await resolveMemberPersonUid(token, companyUid, person);
+            else
+                body.allMembers = true;
+            const data = await callApi(token, "/v1/billing/sponsorship/plans", { method: "POST", body });
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+                return;
+            }
+            if (data.results.length === 0) {
+                console.log("No active members to sponsor.");
+                return;
+            }
+            for (const r of data.results) {
+                console.log(`  ${chalk.bold(r.personUid)}  ${grantOutcomeLabel(r.outcome)}`);
+            }
+            const added = data.results.filter((r) => r.outcome === "sponsored").length;
+            console.log(added === 1
+                ? "1 personal plan moved onto the company bill."
+                : `${added} personal plans moved onto the company bill.`);
+            const single = person ? data.results[0] : undefined;
+            if (single && single.outcome !== "sponsored" && single.outcome !== "already_sponsored") {
+                process.exitCode = 1;
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    sponsor
+        .command("ungrant")
+        .argument("<person>", "Member email or prs_ id")
+        .description("Admin: take a member's personal plan off the company bill")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (person, opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const named = opts.company ?? billing.opts().company;
+            const companyUid = await getCompanyUid(token, named);
+            const personUid = await resolveMemberPersonUid(token, companyUid, person);
+            const data = await callApi(token, "/v1/billing/sponsorship/plans", { method: "DELETE", body: { companyUid, personUid } });
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+                return;
+            }
+            console.log(data.revoked
+                ? "Ended. Their personal plan goes back to them from the next bill."
+                : "This company wasn't covering their plan. Nothing changed.");
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
 }
 //# sourceMappingURL=billing-sponsor.js.map

package/dist/commands/integrations-api.d.ts

@@ -292,6 +292,10 @@ export interface PendingApproval {
     status?: string;
     /** Owner-facing outcome projected by hq-pro for decided rows. */
     outcome?: string;
+    /** Closed rejection code for a rejected row (e.g. provider_tool_error); older servers omit it. */
+    rejectionReason?: string | null;
+    /** Plain reason a decided row did not run, such as the app's own refusal text; older servers omit it. */
+    failureMessage?: string | null;
 }
 /**
  * Read open approvals from hq-pro's confirm-queue state (not the audit feed).
@@ -307,4 +311,15 @@ export declare function mutateConnectionAccess(token: string, companyUid: string
     granteeId?: string;
     permission?: Permission;
 }): Promise<ConnectionAccess>;
+/** Same cap the server applies to a failure reason; the CLI enforces it for older or malformed responses. */
+export declare const TERMINAL_REASON_MAX_CHARS = 500;
+/**
+ * Server-supplied text that reaches the terminal (a failure reason quoting an
+ * app's error). ANSI escapes, control and invisible formatting characters are
+ * removed, then the same credential-redaction chain the gateway diagnostics use
+ * (`redactErrorText`: credential URLs, bearer values, token assignments, known
+ * token shapes) is applied, and the result is capped. The server redacts too;
+ * this keeps an older or misbehaving server from printing a secret.
+ */
+export declare function terminalSafeText(text: string): string;
 //# sourceMappingURL=integrations-api.d.ts.map

package/dist/commands/integrations-api.js

@@ -8,6 +8,7 @@
  * is optional and read defensively.
  */
 import { vaultApiFetch } from "../utils/vault-api.js";
+import { redactErrorText } from "../utils/redact-error-text.js";
 import { IntegrationsCliError, raiseForResponse, } from "./integrations-core.js";
 export async function listCatalog(token, companyUid, opts = {}) {
     const query = {
@@ -188,4 +189,30 @@ export async function mutateConnectionAccess(token, companyUid, action, input) {
     }
     return (await res.json());
 }
+// eslint-disable-next-line no-control-regex
+const TERMINAL_ESCAPES = /\u001b\[[0-?]*[ -/]*[@-~]|\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)?|\u001b[@-_]/g;
+// eslint-disable-next-line no-control-regex
+const TERMINAL_CONTROL_CHARS = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
+/** Bidirectional overrides, isolates, marks and zero-width characters, which can reorder or hide text. */
+const TERMINAL_INVISIBLE_FORMAT_CHARS = /[\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g;
+/** Same cap the server applies to a failure reason; the CLI enforces it for older or malformed responses. */
+export const TERMINAL_REASON_MAX_CHARS = 500;
+/**
+ * Server-supplied text that reaches the terminal (a failure reason quoting an
+ * app's error). ANSI escapes, control and invisible formatting characters are
+ * removed, then the same credential-redaction chain the gateway diagnostics use
+ * (`redactErrorText`: credential URLs, bearer values, token assignments, known
+ * token shapes) is applied, and the result is capped. The server redacts too;
+ * this keeps an older or misbehaving server from printing a secret.
+ */
+export function terminalSafeText(text) {
+    const visible = text
+        .replace(TERMINAL_ESCAPES, "")
+        .replace(TERMINAL_CONTROL_CHARS, "")
+        .replace(TERMINAL_INVISIBLE_FORMAT_CHARS, "");
+    const redacted = redactErrorText(visible);
+    return redacted.length > TERMINAL_REASON_MAX_CHARS
+        ? `${redacted.slice(0, TERMINAL_REASON_MAX_CHARS - 1)}…`
+        : redacted;
+}
 //# sourceMappingURL=integrations-api.js.map

package/dist/commands/integrations-manage.js

@@ -18,7 +18,7 @@ import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
 import { IntegrationsCliError, bareProvider, printHealthNotice, fetchConnections, fetchAdminSurface, fetchAuditPage, AUDIT_PAGE_MAX, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
-import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
+import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, terminalSafeText, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
 const WRITE_POLICIES = ["auto-allow", "confirm", "deny"];
 const PERMISSIONS = ["read", "write", "admin"];
 /** Plain-English gloss for each write policy, used in every policy readout. */
@@ -617,9 +617,11 @@ export function registerManageCommands(integrations) {
             console.log(`${chalk.bold(label)}  ${chalk.dim(`${who} · ${row.createdAt}`)}`);
             if (opts.history) {
                 console.log(chalk.dim(`  ${row.queueId} · ${row.status ?? row.outcome ?? "status unavailable"}`));
+                if (row.failureMessage)
+                    console.log(chalk.dim(`  Why: ${terminalSafeText(row.failureMessage)}`));
             }
             else {
-                console.log(chalk.dim(`  hq integrations approve ${row.queueId}${row.provider ? ` --provider ${bareProvider(row.provider)}` : ""}`));
+                console.log(chalk.dim(`  hq integrations approve ${row.queueId}${row.provider ? ` --provider ${bareProvider(row.provider)}` : ""}${opts.company ? ` --company ${opts.company}` : ""}`));
             }
         }
     });