@indigoai-us/hq-cli 5.345.165 → 5.345.166

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.345.166] — 2026-10-24
+- `hq integrations approve` now says why an approved call did not run. When an app refuses it, the CLI prints the app's own reason, such as Slack's refusal to send into a Slack Connect channel. Before this it printed only "failed (rejected)". With an older server it prints the rejection code instead. `hq integrations pending --history` adds a `Why:` line for decided calls that did not run. The approve command printed after a queued call keeps `--company` when you passed it. Before printing, the reason is cleaned of terminal escape codes, credentials and credential-bearing links, and it is capped at 500 characters. Feedback 15e7593c-50e5-4e6a-ae3a-342d618363c0.
+- The bundled sync engine now uses hq-cloud 6.18.101, the current npm `latest`.
+  A 403 from the flags endpoint (for example a stale company in the local
+  manifest) is now held as `false` for an hour instead of being re-read and
+  logged on every telemetry pass (hq-cloud #1046).
+- `hq doctor` no longer counts runner telemetry errors as sync receiver permission refusals. A failed outcome-flag read ("hq-flags: resolve returned 403") for a company you are not a member of used to inflate `sync.runtime.receiver-permission`; only the receiver's own events are counted now.
+- The bundled shell fallbacks for `rebuild-index` all, orchestrator, public-knowledge, reports, social-drafts, threads, and workers now print the same usage as the native command for `--help`/`-h` and exit without writing. Before, they ignored the flag and rebuilt the index, which failed the published core command parity check.
+
 ## [5.345.165] — 2026-10-23
 - `hq billing sponsor grant <email|prs_id> --company <slug>` lets a company owner or admin put a member's personal plan on the company bill without a request first; `--all-members` does it for every active member and reports each person as covered, already covered, or skipped. `hq billing sponsor ungrant <email|prs_id>` takes it off again. hq-pro checks the owner/admin role and active membership.
 - `hq scan secrets <files...>` takes `--repo <dir>`, which applies that repo's committed `.gitleaks.toml` allowlists to a file scan, matching each file by its path relative to the repo, as a staged scan does. `--snapshot-root <dir>` (with `--repo`) matches files laid out as `<dir>/<commit>/<repo path>`, the history copies `commit-secret-scan.sh pr-check` writes, as `<repo path>`. Findings still name the files as given. Before this, a file scan ignored the repo's allowlists, so pr-check failed on false positives the commit gate already allowed. Without `--repo` a file scan is unchanged.

package/assets/scaffold/core/scripts/rebuild-all-indexes.sh

@@ -11,6 +11,17 @@
 
 set -uo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index all --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index all [--accept]' \
+      '' \
+      'Regenerate every INDEX.md across the HQ tree. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-orchestrator-index.sh

@@ -12,6 +12,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index orchestrator --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index orchestrator [--accept]' \
+      '' \
+      'Regenerate the orchestrator workspace INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-public-knowledge-index.sh

@@ -7,6 +7,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index public-knowledge --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index public-knowledge [--accept]' \
+      '' \
+      'Regenerate core/knowledge/public/INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-reports-index.sh

@@ -8,6 +8,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index reports --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index reports [--accept]' \
+      '' \
+      'Regenerate the reports INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-social-drafts-index.sh

@@ -8,6 +8,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index social-drafts --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index social-drafts [--accept]' \
+      '' \
+      'Regenerate workspace/social-drafts/INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 # shellcheck source=core/scripts/lib/portable.sh
 . "$HQ_ROOT/core/scripts/lib/portable.sh"

package/assets/scaffold/core/scripts/rebuild-threads-index.sh

@@ -11,6 +11,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index threads --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index threads [--accept]' \
+      '' \
+      'Regenerate the session-threads INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/assets/scaffold/core/scripts/rebuild-workers-index.sh

@@ -7,6 +7,17 @@
 
 set -euo pipefail
 
+# Help must never write: print the same usage as `hq core rebuild-index workers --help`.
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index workers [--accept]' \
+      '' \
+      'Regenerate the workers INDEX.md. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 

package/dist/commands/integrations-api.d.ts

@@ -292,6 +292,10 @@ export interface PendingApproval {
     status?: string;
     /** Owner-facing outcome projected by hq-pro for decided rows. */
     outcome?: string;
+    /** Closed rejection code for a rejected row (e.g. provider_tool_error); older servers omit it. */
+    rejectionReason?: string | null;
+    /** Plain reason a decided row did not run, such as the app's own refusal text; older servers omit it. */
+    failureMessage?: string | null;
 }
 /**
  * Read open approvals from hq-pro's confirm-queue state (not the audit feed).
@@ -307,4 +311,15 @@ export declare function mutateConnectionAccess(token: string, companyUid: string
     granteeId?: string;
     permission?: Permission;
 }): Promise<ConnectionAccess>;
+/** Same cap the server applies to a failure reason; the CLI enforces it for older or malformed responses. */
+export declare const TERMINAL_REASON_MAX_CHARS = 500;
+/**
+ * Server-supplied text that reaches the terminal (a failure reason quoting an
+ * app's error). ANSI escapes, control and invisible formatting characters are
+ * removed, then the same credential-redaction chain the gateway diagnostics use
+ * (`redactErrorText`: credential URLs, bearer values, token assignments, known
+ * token shapes) is applied, and the result is capped. The server redacts too;
+ * this keeps an older or misbehaving server from printing a secret.
+ */
+export declare function terminalSafeText(text: string): string;
 //# sourceMappingURL=integrations-api.d.ts.map

package/dist/commands/integrations-api.js

@@ -8,6 +8,7 @@
  * is optional and read defensively.
  */
 import { vaultApiFetch } from "../utils/vault-api.js";
+import { redactErrorText } from "../utils/redact-error-text.js";
 import { IntegrationsCliError, raiseForResponse, } from "./integrations-core.js";
 export async function listCatalog(token, companyUid, opts = {}) {
     const query = {
@@ -188,4 +189,30 @@ export async function mutateConnectionAccess(token, companyUid, action, input) {
     }
     return (await res.json());
 }
+// eslint-disable-next-line no-control-regex
+const TERMINAL_ESCAPES = /\u001b\[[0-?]*[ -/]*[@-~]|\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)?|\u001b[@-_]/g;
+// eslint-disable-next-line no-control-regex
+const TERMINAL_CONTROL_CHARS = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
+/** Bidirectional overrides, isolates, marks and zero-width characters, which can reorder or hide text. */
+const TERMINAL_INVISIBLE_FORMAT_CHARS = /[\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g;
+/** Same cap the server applies to a failure reason; the CLI enforces it for older or malformed responses. */
+export const TERMINAL_REASON_MAX_CHARS = 500;
+/**
+ * Server-supplied text that reaches the terminal (a failure reason quoting an
+ * app's error). ANSI escapes, control and invisible formatting characters are
+ * removed, then the same credential-redaction chain the gateway diagnostics use
+ * (`redactErrorText`: credential URLs, bearer values, token assignments, known
+ * token shapes) is applied, and the result is capped. The server redacts too;
+ * this keeps an older or misbehaving server from printing a secret.
+ */
+export function terminalSafeText(text) {
+    const visible = text
+        .replace(TERMINAL_ESCAPES, "")
+        .replace(TERMINAL_CONTROL_CHARS, "")
+        .replace(TERMINAL_INVISIBLE_FORMAT_CHARS, "");
+    const redacted = redactErrorText(visible);
+    return redacted.length > TERMINAL_REASON_MAX_CHARS
+        ? `${redacted.slice(0, TERMINAL_REASON_MAX_CHARS - 1)}…`
+        : redacted;
+}
 //# sourceMappingURL=integrations-api.js.map

package/dist/commands/integrations-manage.js

@@ -18,7 +18,7 @@ import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
 import { IntegrationsCliError, bareProvider, printHealthNotice, fetchConnections, fetchAdminSurface, fetchAuditPage, AUDIT_PAGE_MAX, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
-import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
+import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, terminalSafeText, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
 const WRITE_POLICIES = ["auto-allow", "confirm", "deny"];
 const PERMISSIONS = ["read", "write", "admin"];
 /** Plain-English gloss for each write policy, used in every policy readout. */
@@ -617,9 +617,11 @@ export function registerManageCommands(integrations) {
             console.log(`${chalk.bold(label)}  ${chalk.dim(`${who} · ${row.createdAt}`)}`);
             if (opts.history) {
                 console.log(chalk.dim(`  ${row.queueId} · ${row.status ?? row.outcome ?? "status unavailable"}`));
+                if (row.failureMessage)
+                    console.log(chalk.dim(`  Why: ${terminalSafeText(row.failureMessage)}`));
             }
             else {
-                console.log(chalk.dim(`  hq integrations approve ${row.queueId}${row.provider ? ` --provider ${bareProvider(row.provider)}` : ""}`));
+                console.log(chalk.dim(`  hq integrations approve ${row.queueId}${row.provider ? ` --provider ${bareProvider(row.provider)}` : ""}${opts.company ? ` --company ${opts.company}` : ""}`));
             }
         }
     });

package/dist/commands/integrations.js

@@ -61,7 +61,7 @@ import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
 import { registerSlackCommands } from "./integrations-slack.js";
-import { fetchPendingApprovals } from "./integrations-api.js";
+import { fetchPendingApprovals, terminalSafeText } from "./integrations-api.js";
 const CALL_ARGS_EXAMPLE = `--args '{"assignee":"me"}' or --args-file args.json`;
 function readStream(stream) {
     return new Promise((resolve, reject) => {
@@ -533,7 +533,7 @@ export function registerIntegrationsCommand(program) {
                 return;
             }
             console.log(chalk.yellow("Queued for approval — this call can change the app, so a company owner decides first."));
-            console.log(`Approve with:\n  hq integrations approve ${queued.queueId} --provider ${bareProvider(connection.provider)}`);
+            console.log(`Approve with:\n  hq integrations approve ${queued.queueId} --provider ${bareProvider(connection.provider)}${opts.company ? ` --company ${opts.company}` : ""}`);
             if (queued.expiresAt) {
                 console.log(chalk.dim(`Expires ${queued.expiresAt}`));
             }
@@ -606,7 +606,9 @@ export function registerIntegrationsCommand(program) {
                     const unknown = terminal.status === "write_unknown" || terminal.outcome === "unknown";
                     console.log(chalk.red(unknown
                         ? `The provider outcome is unknown for ${queueId}. Check the provider before taking any action; ${historyCommand} shows the latest queue state.`
-                        : `The approved call failed (${terminal.status ?? terminal.outcome}). See ${historyCommand} for its status.`));
+                        : terminal.failureMessage
+                            ? `The approved call did not run: ${terminalSafeText(terminal.failureMessage)}`
+                            : `The approved call failed (${terminal.rejectionReason ?? terminal.status ?? terminal.outcome}). See ${historyCommand} for its status.`));
                 }
                 else if (terminal.status === "resumed" || terminal.status === "completed" || terminal.outcome === "ran") {
                     console.log(chalk.green("Approved — the call completed."));
@@ -614,7 +616,7 @@ export function registerIntegrationsCommand(program) {
                         printJson(unwrapGatewayResult(stored.result));
                     }
                     else if (ran) {
-                        console.log(chalk.yellow(`The call's result could not be read back. Run \`hq integrations approve ${queueId}\` again to fetch it; the call will not run twice.`));
+                        console.log(chalk.yellow(`The call's result could not be read back. Run \`hq integrations approve ${queueId} --provider ${bareProvider(connection.provider)}${opts.company ? ` --company ${opts.company}` : ""}\` again to fetch it; the call will not run twice.`));
                     }
                 }
                 else {
@@ -649,7 +651,9 @@ export function registerIntegrationsCommand(program) {
             if (failed) {
                 const reason = body.rejectionReason ??
                     (toolError ? "provider_tool_error" : body.outcome ?? body.status ?? "failed");
-                console.log(chalk.red(`The approved call failed at the provider (${reason}).`));
+                console.log(chalk.red(body.failureMessage
+                    ? `The approved call did not run: ${terminalSafeText(body.failureMessage)}`
+                    : `The approved call failed at the provider (${reason}).`));
             }
             else if (body.status === "resumed" || body.status === "completed" || body.outcome === "ran") {
                 console.log(chalk.green(`Approved — the call ran (status: ${body.status ?? body.outcome}).`));