@indigoai-us/hq-cli 5.345.90 → 5.345.91

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.345.91] — 2026-10-12
+- Add published E2E checks comparing native commands with bundled shell scripts for qmd background reindex, hq-session, checkpoint stop gate, and worker skill commands.
+
+- `hq integrations connect <app> --auth key` (and `--token-stdin`) now
+  sends the access key to the app's MCP endpoint. Catalog Slack used to
+  ignore the key and only `--mcp-url` connected. If the server says the
+  app needs a key and cannot sign HQ in automatically, the command
+  collects the key instead of stopping.
+
 ## [5.345.90] — 2026-10-12
 - The setup bot that ships with hq-cli (used before an HQ has synced its core workers) now reads the HQ desktop app's first-run handoff, the same as hq-core's copy. It treats the one note the app sends when its visual setup closes as its kickoff, never offers or repeats an import the app already did, and never runs a second scan. It also no longer asks what the person already said: told "I run an independent software engineering company", it sets up for a software services firm instead of asking "for clients, or your own product?".
 

package/dist/commands/integrations-connect.d.ts

@@ -15,6 +15,12 @@
  * install and treats hq-pro's `INTEGRATION_FACTORY_OAUTH_REQUIRED` as the
  * signal to switch into the browser flow. That way a catalog row that says
  * "key" but is really OAuth-protected still connects on the first try.
+ *
+ * A pasted key is different. Catalog/domain installs can drop `--auth key` /
+ * `--token-stdin` (hq-pro only forwards a bearer token on the direct MCP URL
+ * path, and an OAuth catalog row short-circuits to sign-in). When the caller
+ * supplied a key, or the server says the endpoint needs one and cannot
+ * register HQ, retry against the inspected MCP URL with the key.
  */
 import { Command } from "commander";
 import { type ResidentCommandLeaseOptions } from "../utils/resident-package-preload.js";

package/dist/commands/integrations-connect.js

@@ -15,6 +15,12 @@
  * install and treats hq-pro's `INTEGRATION_FACTORY_OAUTH_REQUIRED` as the
  * signal to switch into the browser flow. That way a catalog row that says
  * "key" but is really OAuth-protected still connects on the first try.
+ *
+ * A pasted key is different. Catalog/domain installs can drop `--auth key` /
+ * `--token-stdin` (hq-pro only forwards a bearer token on the direct MCP URL
+ * path, and an OAuth catalog row short-circuits to sign-in). When the caller
+ * supplied a key, or the server says the endpoint needs one and cannot
+ * register HQ, retry against the inspected MCP URL with the key.
  */
 import chalk from "chalk";
 import open from "open";
@@ -30,6 +36,8 @@ import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBluep
 import { OAUTH_LOOPBACK_TIMEOUT_CODE, startLoopbackListener, } from "./integrations-oauth.js";
 /** hq-pro's machine code for "this endpoint needs a browser sign-in". */
 const OAUTH_REQUIRED_CODE = "INTEGRATION_FACTORY_OAUTH_REQUIRED";
+/** hq-pro's machine code for "this MCP endpoint refused the auth we sent". */
+const DIRECT_MCP_AUTH_REJECTED_CODE = "DIRECT_MCP_AUTH_REJECTED";
 function warnBrowserOpenFailure(error) {
     console.warn("[hq-cli:integrations-connect] browser open failed", safeCaughtError(error));
 }
@@ -51,6 +59,17 @@ function isOAuthRequiredError(err) {
     return (err instanceof IntegrationsCliError &&
         (err.code === OAUTH_REQUIRED_CODE || err.oauthProtected === true));
 }
+/**
+ * The server probed the MCP endpoint, got an OAuth challenge, and determined
+ * it cannot self-register HQ (no DCR). The recovery is a pasted access key,
+ * not a browser sign-in. `oauthProtected: true` is the opposite signal and
+ * must keep taking the sign-in branch.
+ */
+function isAccessKeyRequiredError(err) {
+    return (err instanceof IntegrationsCliError &&
+        err.code === DIRECT_MCP_AUTH_REJECTED_CODE &&
+        err.oauthProtected !== true);
+}
 /**
  * hq-pro will not take our loopback callback, for either of the two reasons it
  * can refuse one:
@@ -894,6 +913,59 @@ async function completeCredentialIfNeeded(token, companyUid, target, opts, resul
         bearerToken,
     });
 }
+function mcpUrlFromBlueprint(blueprint) {
+    const surfaces = [
+        ...(blueprint.recommendedSurface ? [blueprint.recommendedSurface] : []),
+        ...blueprint.surfaces,
+    ];
+    for (const surface of surfaces) {
+        const url = surface.url?.trim();
+        if (url && /^https:\/\//i.test(url))
+            return url;
+    }
+    return undefined;
+}
+/**
+ * Catalog/domain/query installs are the path that drops a pasted key. The
+ * working connect is the same one `--mcp-url` already uses: a direct MCP
+ * endpoint plus `authMode: bearer`.
+ */
+async function targetForAccessKeyConnect(token, companyUid, target, opts) {
+    if (target.ref.mcpUrl)
+        return { ...target, authClass: "key" };
+    const blueprint = await pullBlueprint(token, companyUid, {
+        ...(target.ref.domain ? { domain: target.ref.domain } : {}),
+        ...(target.ref.query ? { query: target.ref.query } : {}),
+        ...(target.ref.catalogEntryId ? { catalogEntryId: target.ref.catalogEntryId } : {}),
+    });
+    const mcpUrl = mcpUrlFromBlueprint(blueprint);
+    if (!mcpUrl) {
+        throw new IntegrationsCliError(`${target.label} needs an access key. Re-run with --mcp-url <endpoint> --auth key --token-stdin.`, { expected: true });
+    }
+    return {
+        ref: {
+            mcpUrl,
+            ...(opts.provider ? { provider: opts.provider } : blueprint.provider ? { provider: blueprint.provider } : {}),
+            ...(opts.displayName
+                ? { displayName: opts.displayName }
+                : blueprint.displayName
+                    ? { displayName: blueprint.displayName }
+                    : {}),
+        },
+        authClass: "key",
+        label: target.label,
+    };
+}
+function bearerInstallInput(target, opts, bearerToken) {
+    return {
+        ...target.ref,
+        authMode: "bearer",
+        bearerToken,
+        ...(opts.authHeader
+            ? { authScheme: { placement: "header", header: opts.authHeader } }
+            : {}),
+    };
+}
 /** Print the outcome of a successful connect. */
 function reportInstall(result, opts, expectedRevivedConnectionId) {
     if (opts.json) {
@@ -923,17 +995,34 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
         : opts.auth ?? target.authClass;
     assertUserClientApplicable(opts, target, authMode);
     assertScopesApplicable(opts, target, authMode);
-    if (authMode === "oauth") {
-        const result = await connectViaOAuth(token, companyUid, target, opts);
-        if (result)
-            reportInstall(result, opts, expectedRevivedConnectionId);
-        return;
-    }
     // A key is only collected when something already says one is needed, or
     // the caller supplied one — otherwise a no-auth app would pointlessly
-    // prompt.
+    // prompt. Compute this BEFORE the OAuth branch: a catalog row marked
+    // oauth plus `--token-stdin` used to skip the key entirely.
     const wantsKey = authMode === "key" || Boolean(opts.token || opts.tokenStdin);
+    const finishWithAccessKey = async (existingKey) => {
+        const keyTarget = await targetForAccessKeyConnect(token, companyUid, target, opts);
+        const bearerToken = existingKey ?? (await resolveKey(opts, keyTarget.label));
+        const result = await installIntegration(token, companyUid, bearerInstallInput(keyTarget, opts, bearerToken));
+        reportInstall(await completeCredentialIfNeeded(token, companyUid, keyTarget, opts, result), opts, expectedRevivedConnectionId);
+    };
+    if (authMode === "oauth" && !wantsKey) {
+        try {
+            const result = await connectViaOAuth(token, companyUid, target, opts);
+            if (result)
+                reportInstall(result, opts, expectedRevivedConnectionId);
+        }
+        catch (err) {
+            if (isAccessKeyRequiredError(err)) {
+                await finishWithAccessKey();
+                return;
+            }
+            throw err;
+        }
+        return;
+    }
     const bearerToken = wantsKey ? await resolveKey(opts, target.label) : undefined;
+    const alreadyDirectKeyInstall = Boolean(target.ref.mcpUrl && bearerToken);
     try {
         const result = await installIntegration(token, companyUid, {
             ...target.ref,
@@ -952,13 +1041,28 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
         reportInstall(await completeCredentialIfNeeded(token, companyUid, target, opts, result), opts, expectedRevivedConnectionId);
     }
     catch (err) {
+        const retryAsKey = !alreadyDirectKeyInstall &&
+            (isAccessKeyRequiredError(err) || (isOAuthRequiredError(err) && wantsKey));
+        if (retryAsKey) {
+            await finishWithAccessKey(bearerToken);
+            return;
+        }
         // Server-authoritative detection: the endpoint turned out to be
         // OAuth-protected, so run the browser flow instead of making the
         // caller re-issue the command with --auth oauth.
         if (isOAuthRequiredError(err)) {
-            const result = await connectViaOAuth(token, companyUid, target, opts);
-            if (result)
-                reportInstall(result, opts, expectedRevivedConnectionId);
+            try {
+                const result = await connectViaOAuth(token, companyUid, target, opts);
+                if (result)
+                    reportInstall(result, opts, expectedRevivedConnectionId);
+            }
+            catch (oauthErr) {
+                if (isAccessKeyRequiredError(oauthErr)) {
+                    await finishWithAccessKey(bearerToken);
+                    return;
+                }
+                throw oauthErr;
+            }
             return;
         }
         throw err;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.90",
+  "version": "5.345.91",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {