@indigoai-us/hq-cli 5.5.2 → 5.5.3

package/dist/sentry-before-send.js

@@ -0,0 +1,219 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d9f4f042-d671-5ca3-8b43-d26395fc0189")}catch(e){}}();
+const SENSITIVE_FIELD_NAMES = new Set([
+    "password", "secret", "apikey", "api_key", "token",
+    // Cognito token-response fields captured as error context.
+    "idtoken", "accesstoken", "refreshtoken",
+]);
+// Stored lowercased; membership tested against `name.toLowerCase()`.
+// MUST cover BOTH Auth.js v5 (current in hq-console, pinned to
+// next-auth@5.0.0-beta.25 which resolves @auth/core@0.37.2) AND legacy
+// NextAuth v4 name spaces — covering both is cheap and survives accidental
+// downgrades or mixed-version repos. Grounded against @auth/core@0.37.2's
+// src/lib/utils/cookie.ts (re-ground via `grep -nE
+// '(sessionToken|callbackUrl|csrfToken|pkceCodeVerifier|state|nonce|webauthnChallenge): \{'
+// node_modules/.pnpm/@auth+core@0.37.2/node_modules/@auth/core/src/lib/utils/cookie.ts`
+// — seven matches, one per cookie family): two distinct prefixing patterns
+// coexist there, and the entries below mirror BOTH exactly:
+//   • session-token / callback-url / pkce.code_verifier / state / nonce /
+//     challenge each pair the bare form (HTTP dev, cookiePrefix="") with
+//     the __Secure- form (HTTPS prod, cookiePrefix="__Secure-").
+//   • csrf-token is special: the source explicitly uses __Host- (NOT
+//     __Secure-) under HTTPS for stricter cookie scoping (the csrfToken
+//     entry in @auth/core's cookie.ts is the only one whose name template
+//     uses `__Host-` instead of `${cookiePrefix}`; the comment above it
+//     reads "Default to __Host- for CSRF token for additional protection
+//     if using useSecureCookies"). The set therefore pairs the bare form
+//     with __Host-, and does NOT include __Secure-authjs.csrf-token
+//     because @auth/core never emits that name. The legacy v4 entry mirrors
+//     the same pattern (bare next-auth.csrf-token + __Host-next-auth.csrf-token,
+//     no __Secure- variant).
+// Missing any of the four OAuth-state families (pkce.code_verifier, state,
+// nonce, challenge) ships a cookie-leak in the same class as the v4-only
+// defect Round-4 called out. This set is the single authoritative spec;
+// all of Steps 3/8/9a/12/13 reproduce it identically.
+//
+// MAINTAINER NOTE: Do NOT extend this set by mechanically pairing every
+// cookie with bare + __Secure- + __Host-. The pairing follows the source:
+// session-style cookies use __Secure-; csrf-style cookies use __Host-.
+// New entries added in the future must be grounded against the actual
+// emitter (Auth.js source for v5/v4, vendor docs for Clerk, etc.) rather
+// than copied from the existing pattern.
+const SENSITIVE_COOKIE_NAMES = new Set([
+    // ==== Auth.js v5 (next-auth@5 / @auth/core) ====
+    // Session JWT — bare + __Secure-
+    "authjs.session-token",
+    "__secure-authjs.session-token",
+    // CSRF double-submit token — bare + __Host- ONLY (@auth/core's cookie.ts
+    // csrfToken entry uses __Host-, never __Secure-)
+    "authjs.csrf-token",
+    "__host-authjs.csrf-token",
+    // Post-auth redirect URL — bare + __Secure-
+    "authjs.callback-url",
+    "__secure-authjs.callback-url",
+    // OAuth PKCE verifier — leaking this enables interception of an in-flight
+    // OAuth code exchange.
+    "authjs.pkce.code_verifier",
+    "__secure-authjs.pkce.code_verifier",
+    // OAuth CSRF/replay protection
+    "authjs.state",
+    "__secure-authjs.state",
+    // OpenID Connect nonce — replay protection
+    "authjs.nonce",
+    "__secure-authjs.nonce",
+    // OAuth WebAuthn challenge
+    "authjs.challenge",
+    "__secure-authjs.challenge",
+    // ==== NextAuth v4 legacy names (kept so accidental downgrades /
+    //       mixed-version monorepos don't silently leak). Same prefix
+    //       discipline as v5: csrf-token uses __Host-, others use __Secure-. ====
+    "next-auth.session-token",
+    "__secure-next-auth.session-token",
+    "next-auth.csrf-token",
+    "__host-next-auth.csrf-token",
+    "next-auth.callback-url",
+    "__secure-next-auth.callback-url",
+    "next-auth.pkce.code_verifier",
+    "__secure-next-auth.pkce.code_verifier",
+    "next-auth.state",
+    "__secure-next-auth.state",
+    // ==== Clerk (documented for future; no-op today) ====
+    "__clerk_db_jwt", "__session",
+]);
+const REDACTED = "[Filtered]";
+const SENSITIVE_HEADER_NAMES = new Set([
+    "authorization", "proxy-authorization",
+    "cookie", "set-cookie",
+    "x-api-key", "x-auth-token", "x-access-token", "x-session-token",
+]);
+function scrubHeaders(h) {
+    if (!h)
+        return h;
+    const out = {};
+    for (const [k, v] of Object.entries(h)) {
+        out[k] = SENSITIVE_HEADER_NAMES.has(k.toLowerCase()) ? REDACTED : v;
+    }
+    return out;
+}
+function scrubCookies(c) {
+    if (!c)
+        return c;
+    if (typeof c === "string")
+        return REDACTED; // raw Cookie header — wholesale redact
+    const out = {};
+    for (const [k, v] of Object.entries(c)) {
+        out[k] = SENSITIVE_COOKIE_NAMES.has(k.toLowerCase()) ? REDACTED : v;
+    }
+    return out;
+}
+const SENSITIVE_STRING_PATTERNS = [
+    // kv pairs; `(?:id|access|refresh)[_-]?token` catches Cognito-style free-text
+    // `accessToken=...`, `refreshToken: ...`, `id_token=...` which bare `\btoken` misses.
+    /\b(password|secret|api[_-]?key|(?:id|access|refresh)[_-]?token|token)\s*[:=]\s*[^\s&"'<>]+/gi,
+    /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+];
+function scrubString(s) {
+    let out = s;
+    for (const re of SENSITIVE_STRING_PATTERNS) {
+        out = out.replace(re, (m) => {
+            const sep = m.search(/[:=\s]/);
+            return sep > 0 ? `${m.slice(0, sep + 1)}${REDACTED}` : REDACTED;
+        });
+    }
+    return out;
+}
+function scrubQueryString(qs) {
+    try {
+        const params = new URLSearchParams(qs.startsWith("?") ? qs.slice(1) : qs);
+        const out = [];
+        for (const [k, v] of params) {
+            out.push(`${k}=${SENSITIVE_FIELD_NAMES.has(k.toLowerCase()) ? REDACTED : v}`);
+        }
+        const joined = out.join("&");
+        return qs.startsWith("?") ? `?${joined}` : joined;
+    }
+    catch {
+        return scrubString(qs);
+    }
+}
+function scrubFields(value, memo = new Map()) {
+    if (value === null || typeof value !== "object")
+        return value;
+    const obj = value;
+    // On cycle revisit, return the SAME scrubbed copy built on first visit —
+    // NOT the original. Returning the original would leak fields reachable
+    // only through the cycle (e.g., a.self.token).
+    if (memo.has(obj))
+        return memo.get(obj);
+    if (Array.isArray(value)) {
+        const arr = [];
+        memo.set(obj, arr);
+        for (const v of value)
+            arr.push(scrubFields(v, memo));
+        return arr;
+    }
+    const out = {};
+    memo.set(obj, out);
+    for (const [k, v] of Object.entries(value)) {
+        if (SENSITIVE_FIELD_NAMES.has(k.toLowerCase())) {
+            out[k] = REDACTED;
+        }
+        else if (v !== null && typeof v === "object") {
+            out[k] = scrubFields(v, memo);
+        }
+        else if (typeof v === "string") {
+            // SCALAR-STRING DEFENSE-IN-DEPTH. A stringified log line stashed via
+            // setExtra / setContext / setUser can embed `password=...` or a Bearer
+            // token even when the outer key (`note`, `bio`, `log_line`, …) isn't
+            // in SENSITIVE_FIELD_NAMES. Route scalar strings through scrubString so
+            // these don't bypass the scrubber on their way into Sentry.
+            out[k] = scrubString(v);
+        }
+        else {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+export function beforeSend(event, _hint) {
+    if (event.request) {
+        const req = event.request;
+        event.request = {
+            ...event.request,
+            headers: scrubHeaders(req.headers),
+            cookies: scrubCookies(req.cookies),
+            data: scrubFields(req.data),
+            query_string: typeof req.query_string === "string"
+                ? scrubQueryString(req.query_string)
+                : req.query_string,
+        };
+    }
+    if (typeof event.message === "string")
+        event.message = scrubString(event.message);
+    if (event.exception?.values) {
+        event.exception = {
+            ...event.exception,
+            values: event.exception.values.map((v) => ({
+                ...v,
+                value: typeof v.value === "string" ? scrubString(v.value) : v.value,
+            })),
+        };
+    }
+    if (event.user)
+        event.user = scrubFields(event.user);
+    if (event.breadcrumbs) {
+        event.breadcrumbs = event.breadcrumbs.map((b) => ({
+            ...b,
+            message: typeof b.message === "string" ? scrubString(b.message) : b.message,
+            data: b.data ? scrubFields(b.data) : b.data,
+        }));
+    }
+    if (event.extra)
+        event.extra = scrubFields(event.extra);
+    if (event.contexts)
+        event.contexts = scrubFields(event.contexts);
+    return event;
+}
+//# sourceMappingURL=sentry-before-send.js.map
+//# debugId=d9f4f042-d671-5ca3-8b43-d26395fc0189

package/dist/sentry-dsn.generated.d.ts

@@ -0,0 +1,2 @@
+export declare const BUNDLED_DSN = "https://ed8c1f7624b67945b43d485bbf98d0f7@o4507292345892864.ingest.us.sentry.io/4511263744786432";
+//# sourceMappingURL=sentry-dsn.generated.d.ts.map

package/dist/sentry-dsn.generated.js

@@ -0,0 +1,5 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="55f2362e-5cf7-5dac-b6a3-ef0f9ccde645")}catch(e){}}();
+export const BUNDLED_DSN = "https://ed8c1f7624b67945b43d485bbf98d0f7@o4507292345892864.ingest.us.sentry.io/4511263744786432";
+//# sourceMappingURL=sentry-dsn.generated.js.map
+//# debugId=55f2362e-5cf7-5dac-b6a3-ef0f9ccde645

package/dist/sentry.d.ts

@@ -0,0 +1,4 @@
+import * as Sentry from "@sentry/node";
+export declare function initSentry(): void;
+export { Sentry };
+//# sourceMappingURL=sentry.d.ts.map

package/dist/sentry.js

@@ -0,0 +1,22 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9a31fb53-8cc1-5394-ac16-e96b82fa6caa")}catch(e){}}();
+import * as Sentry from "@sentry/node";
+import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
+import { beforeSend } from "./sentry-before-send.js";
+export function initSentry() {
+    const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
+    if (!dsn)
+        return;
+    Sentry.init({
+        dsn,
+        release: `hq-cli@${process.env.npm_package_version ?? "0.0.0"}`,
+        environment: process.env.HQ_CLI_ENV ?? "production",
+        initialScope: {
+            tags: { repo: "hq-cli" },
+        },
+        beforeSend,
+    });
+}
+export { Sentry };
+//# sourceMappingURL=sentry.js.map
+//# debugId=9a31fb53-8cc1-5394-ac16-e96b82fa6caa

package/dist/strategies/link.js

@@ -2,6 +2,8 @@
  * Link Sync Strategy (US-006)
  * Symlinks module paths into HQ tree
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="602c865a-033c-5b7c-8839-11a66b9a6bc5")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 export async function linkSync(module, moduleDir, hqRoot) {
@@ -48,4 +50,5 @@ export async function linkSync(module, moduleDir, hqRoot) {
         filesChanged,
     };
 }
-//# sourceMappingURL=link.js.map
+//# sourceMappingURL=link.js.map
+//# debugId=602c865a-033c-5b7c-8839-11a66b9a6bc5

package/dist/strategies/merge.js

@@ -2,6 +2,8 @@
  * Merge Sync Strategy (US-007)
  * Copies files from module into HQ, tracks state for conflict detection
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7a161796-4e72-58d8-89f3-a1010add7d0f")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as crypto from 'crypto';
@@ -107,4 +109,5 @@ export async function mergeSync(module, moduleDir, hqRoot) {
         filesChanged: filesChanged.count,
     };
 }
-//# sourceMappingURL=merge.js.map
+//# sourceMappingURL=merge.js.map
+//# debugId=7a161796-4e72-58d8-89f3-a1010add7d0f

package/dist/types.js

@@ -7,5 +7,8 @@
  *                            (new in hq-core v12.0.0; see
  *                            knowledge/public/hq-core/package-yaml-spec.md)
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="42a2c1bd-8924-5fcf-8f50-72086dab7a97")}catch(e){}}();
 export {};
-//# sourceMappingURL=types.js.map
+//# sourceMappingURL=types.js.map
+//# debugId=42a2c1bd-8924-5fcf-8f50-72086dab7a97

package/dist/utils/cognito-session.js

@@ -16,6 +16,8 @@
  *   HQ_COGNITO_CALLBACK_PORT   — Loopback OAuth callback port
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="95513873-e956-5318-8115-e2088c581155")}catch(e){}}();
 import * as os from "os";
 import * as path from "path";
 import chalk from "chalk";
@@ -96,4 +98,5 @@ export async function refreshCachedSession() {
         };
     }
 }
-//# sourceMappingURL=cognito-session.js.map
+//# sourceMappingURL=cognito-session.js.map
+//# debugId=95513873-e956-5318-8115-e2088c581155

package/dist/utils/git.js

@@ -1,3 +1,5 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6ee15d43-ad5e-5f40-b27b-8bd389e0dad7")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import simpleGit from 'simple-git';
@@ -67,4 +69,5 @@ export function ensureGitignore(hqRoot, entry) {
         fs.writeFileSync(gitignorePath, content);
     }
 }
-//# sourceMappingURL=git.js.map
+//# sourceMappingURL=git.js.map
+//# debugId=6ee15d43-ad5e-5f40-b27b-8bd389e0dad7

package/dist/utils/hq-root.js

@@ -1,6 +1,8 @@
 /**
  * HQ root detection — walks up from cwd looking for HQ markers (US-004)
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="aebb967b-5f70-5107-9d81-bb495be1c405")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 /**
@@ -19,4 +21,5 @@ export function findHqRoot() {
     }
     throw new Error('Could not find HQ root. Run this command from within your HQ directory.');
 }
-//# sourceMappingURL=hq-root.js.map
+//# sourceMappingURL=hq-root.js.map
+//# debugId=aebb967b-5f70-5107-9d81-bb495be1c405

package/dist/utils/integrity.js

@@ -1,6 +1,8 @@
 /**
  * Integrity verification — SHA256 hash and RSA signature checks (US-005)
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="19765c32-6c3d-5477-bf80-0f7d08197d29")}catch(e){}}();
 import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -37,4 +39,5 @@ export function verifyRsaSignature(sha256Hash, signature, publicKeyPath) {
     verifier.end();
     return verifier.verify(publicKey, Buffer.from(signature, 'base64'));
 }
-//# sourceMappingURL=integrity.js.map
+//# sourceMappingURL=integrity.js.map
+//# debugId=19765c32-6c3d-5477-bf80-0f7d08197d29

package/dist/utils/manifest.js

@@ -1,3 +1,5 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ea38913d-4086-56ca-872a-9a85ccf9c453")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
@@ -112,4 +114,5 @@ export function parseRepoName(repoUrl) {
 export function isValidRepoUrl(url) {
     return url.startsWith('https://') || url.startsWith('git@');
 }
-//# sourceMappingURL=manifest.js.map
+//# sourceMappingURL=manifest.js.map
+//# debugId=ea38913d-4086-56ca-872a-9a85ccf9c453

package/dist/utils/registry-client.js

@@ -4,6 +4,8 @@
  *
  * Auth tokens are NEVER written to stdout or logs.
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ffe2dc58-fb20-5566-a56c-1b1c26999bba")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
@@ -99,4 +101,5 @@ export class RegistryClient {
         return this.request('GET', `/packages/${encodeURIComponent(slug)}/download${qs ? `?${qs}` : ''}`, { auth: true });
     }
 }
-//# sourceMappingURL=registry-client.js.map
+//# sourceMappingURL=registry-client.js.map
+//# debugId=ffe2dc58-fb20-5566-a56c-1b1c26999bba

package/dist/utils/registry.js

@@ -1,6 +1,8 @@
 /**
  * Registry YAML helpers — read/write packages/registry.yaml (US-005)
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3fb6a06d-7cbe-5764-be4f-6c8189de649c")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
@@ -55,4 +57,5 @@ export function removeFromRegistry(hqRoot, slug) {
     const entries = readRegistry(hqRoot).filter((e) => e.slug !== slug);
     writeRegistry(hqRoot, entries);
 }
-//# sourceMappingURL=registry.js.map
+//# sourceMappingURL=registry.js.map
+//# debugId=3fb6a06d-7cbe-5764-be4f-6c8189de649c

package/dist/utils/secrets-cache.js

@@ -1,3 +1,5 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="263d7b10-622e-56c3-8c82-ebb294510b1b")}catch(e){}}();
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -15,7 +17,7 @@ function ensureCacheDir(companyUid) {
 function validateInputs(companyUid, name) {
     if (!companyUid || companyUid.includes("/") || companyUid.includes(".."))
         return false;
-    if (!/^[A-Z][A-Z0-9_]*$/.test(name))
+    if (!/^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/.test(name))
         return false;
     return true;
 }
@@ -101,6 +103,7 @@ export function writeCache(companyUid, name, value) {
         timestamp.writeBigInt64BE(BigInt(Date.now()));
         const out = Buffer.concat([timestamp, iv, authTag, encrypted]);
         const filePath = path.join(CACHE_DIR, companyUid, name);
+        fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
         const tmpPath = `${filePath}.tmp.${process.pid}`;
         fs.writeFileSync(tmpPath, out, { mode: 0o600 });
         fs.renameSync(tmpPath, filePath);
@@ -131,4 +134,5 @@ export function clearAllCache() {
     }
     return { removed };
 }
-//# sourceMappingURL=secrets-cache.js.map
+//# sourceMappingURL=secrets-cache.js.map
+//# debugId=263d7b10-622e-56c3-8c82-ebb294510b1b

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.5.2",
+  "version": "5.5.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -8,14 +8,15 @@
     "hq-auth-refresh": "dist/bin/hq-auth-refresh.js"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "node scripts/generate-dsn.mjs && tsc",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "clean": "rm -rf dist"
   },
   "dependencies": {
+    "@sentry/node": "^10.49.0",
     "@indigoai-us/hq-cloud": "^5.1.0",
-    "@indigoai-us/hq-onboarding": "^0.1.1",
+    "@indigoai-us/hq-onboarding": "^0.1.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",

package/scripts/generate-dsn.mjs

@@ -0,0 +1,26 @@
+import { writeFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+const isGitHubActions = process.env.GITHUB_ACTIONS === "true";
+const isPublishJob = process.env.GITHUB_JOB === "publish";
+const dsn = process.env.HQ_CLI_PUBLISH_SENTRY_DSN ?? "";
+
+if (isGitHubActions && isPublishJob && !dsn) {
+  process.stderr.write(
+    "[generate-dsn] FATAL: GITHUB_ACTIONS=true, GITHUB_JOB=publish, " +
+      "but HQ_CLI_PUBLISH_SENTRY_DSN is not set. " +
+      "Add the repo secret HQ_CLI_PUBLISH_SENTRY_DSN before publishing.\n",
+  );
+  process.exit(1);
+}
+
+const outPath = join(__dirname, "../src/sentry-dsn.generated.ts");
+const content = `export const BUNDLED_DSN = "${dsn}";\n`;
+
+writeFileSync(outPath, content, "utf8");
+process.stdout.write(
+  `[generate-dsn] Wrote BUNDLED_DSN="${dsn ? "[DSN set]" : ""}" to ${outPath}\n`,
+);

package/src/bin/hq-auth-refresh.ts

@@ -11,22 +11,29 @@
  * Writes the refreshed tokens to ~/.hq/cognito-tokens.json.
  */
 
+import { initSentry, Sentry } from "../sentry.js";
 import { refreshCachedSession } from "../utils/cognito-session.js";
 
-async function main(): Promise<void> {
-  const result = await refreshCachedSession();
-  if (result.refreshed) {
-    process.exit(0);
-  }
-  if (result.reason) {
-    process.stderr.write(`hq-auth-refresh: ${result.reason}\n`);
-  }
-  process.exit(1);
-}
+initSentry();
 
-main().catch((err) => {
-  process.stderr.write(
-    `hq-auth-refresh: ${err instanceof Error ? err.message : String(err)}\n`,
-  );
-  process.exit(1);
-});
+(async () => {
+  let exitCode = 1;
+  try {
+    const result = await refreshCachedSession();
+    if (result.refreshed) {
+      exitCode = 0;
+    } else {
+      if (result.reason) {
+        process.stderr.write(`hq-auth-refresh: ${result.reason}\n`);
+      }
+    }
+  } catch (err) {
+    Sentry.captureException(err);
+    process.stderr.write(
+      `hq-auth-refresh: ${err instanceof Error ? err.message : String(err)}\n`,
+    );
+  } finally {
+    await Sentry.flush(2000);
+    process.exit(exitCode);
+  }
+})();

package/src/commands/_patterns.ts

@@ -0,0 +1,2 @@
+export const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/;
+export const GROUP_ID_PATTERN = /^grp_[A-Za-z0-9_-]+$/;