@indigoai-us/hq-cli 5.5.2 → 5.5.4

package/src/sentry-before-send.test.ts

@@ -0,0 +1,359 @@
+// src/sentry-before-send.test.ts — canonical fleet Vitest suite.
+// This file is byte-identical across every consumer repo (no per-repo
+// line-1 variation, unlike sentry-before-send.ts). The body-identity
+// gate each consumer runs is `diff hq-console/src/sentry-before-send.test.ts
+// <consumer>/src/sentry-before-send.test.ts` returns empty (no tail -n +2).
+import { describe, expect, it } from "vitest";
+import type { ErrorEvent, EventHint } from "@sentry/nextjs";
+import { beforeSend } from "./sentry-before-send";
+
+const REDACTED = "[Filtered]";
+
+function run(event: ErrorEvent): ErrorEvent {
+  const result = beforeSend(event, {} as EventHint);
+  if (!result) throw new Error("beforeSend dropped event unexpectedly");
+  return result;
+}
+
+describe("scrubHeaders — SENSITIVE_HEADER_NAMES case-insensitive redaction", () => {
+  const sensitiveHeaders = [
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key",
+    "x-auth-token",
+    "x-access-token",
+    "x-session-token",
+  ];
+
+  it.each(sensitiveHeaders)("redacts %s header (and case variants)", (name) => {
+    const upper = name.toUpperCase();
+    const out = run({
+      request: {
+        headers: { [upper]: "leaky-value", "x-trace-id": "keep-me" },
+      },
+    } as unknown as ErrorEvent);
+    expect((out.request!.headers as Record<string, unknown>)[upper]).toBe(REDACTED);
+    expect((out.request!.headers as Record<string, unknown>)["x-trace-id"]).toBe("keep-me");
+  });
+
+  it("redacts a raw Cookie header that lands on request.headers.cookie", () => {
+    const out = run({
+      request: {
+        headers: {
+          Cookie: "authjs.session-token=abc; other=keep",
+          "x-trace-id": "keep-me",
+        },
+      },
+    } as unknown as ErrorEvent);
+    expect((out.request!.headers as Record<string, unknown>).Cookie).toBe(REDACTED);
+    expect((out.request!.headers as Record<string, unknown>)["x-trace-id"]).toBe("keep-me");
+  });
+});
+
+describe("scrubCookies — SENSITIVE_COOKIE_NAMES (Auth.js v5 + v4 legacy + Clerk) + raw-string fallback", () => {
+  // v5 (Auth.js): session / callback-url use __Secure-; csrf-token uses
+  // __Host- (NOT __Secure-). OAuth-state families (pkce / state / nonce /
+  // challenge) each pair bare + __Secure-.
+  const v5Names = [
+    "authjs.session-token",
+    "__secure-authjs.session-token",
+    "authjs.csrf-token",
+    "__host-authjs.csrf-token",
+    "authjs.callback-url",
+    "__secure-authjs.callback-url",
+    "authjs.pkce.code_verifier",
+    "__secure-authjs.pkce.code_verifier",
+    "authjs.state",
+    "__secure-authjs.state",
+    "authjs.nonce",
+    "__secure-authjs.nonce",
+    "authjs.challenge",
+    "__secure-authjs.challenge",
+  ];
+
+  // v4 (NextAuth legacy): same prefix discipline — csrf uses __Host-, others
+  // use __Secure-. Kept in the set so accidental downgrades / mixed-version
+  // monorepos don't silently leak.
+  const v4Names = [
+    "next-auth.session-token",
+    "__secure-next-auth.session-token",
+    "next-auth.csrf-token",
+    "__host-next-auth.csrf-token",
+    "next-auth.callback-url",
+    "__secure-next-auth.callback-url",
+    "next-auth.pkce.code_verifier",
+    "__secure-next-auth.pkce.code_verifier",
+    "next-auth.state",
+    "__secure-next-auth.state",
+  ];
+
+  const clerkNames = ["__clerk_db_jwt", "__session"];
+
+  it.each([...v5Names, ...v4Names, ...clerkNames])(
+    "redacts cookie %s (case-insensitive)",
+    (name) => {
+      const out = run({
+        request: {
+          cookies: { [name.toUpperCase()]: "secret-session-value", keep_me: "ok" },
+        },
+      } as unknown as ErrorEvent);
+      const cookies = out.request!.cookies as Record<string, unknown>;
+      expect(cookies[name.toUpperCase()]).toBe(REDACTED);
+      expect(cookies.keep_me).toBe("ok");
+    },
+  );
+
+  it("does NOT include a __Secure-authjs.csrf-token assertion — Auth.js v5 never emits that name (uses __Host- instead)", () => {
+    // This test is a read-through spec comment: the set MUST NOT have an
+    // entry for __Secure-authjs.csrf-token. If a maintainer ever adds one
+    // mechanically-by-pattern, this test documents why it is wrong.
+    const out = run({
+      request: {
+        cookies: { "__Secure-authjs.csrf-token": "does-not-exist-in-prod" },
+      },
+    } as unknown as ErrorEvent);
+    // The value is NOT redacted because the set does not contain that name.
+    // This is deliberate — see SENSITIVE_COOKIE_NAMES comment in the module.
+    const cookies = out.request!.cookies as Record<string, unknown>;
+    expect(cookies["__Secure-authjs.csrf-token"]).toBe("does-not-exist-in-prod");
+  });
+
+  it("wholesale-redacts a raw-string Cookie header", () => {
+    const out = run({
+      request: { cookies: "anything=here; other=keep" },
+    } as unknown as ErrorEvent);
+    expect(out.request!.cookies).toBe(REDACTED);
+  });
+
+  it("leaves undefined cookies alone", () => {
+    const out = run({ request: { headers: {} } } as unknown as ErrorEvent);
+    expect(out.request!.cookies).toBeUndefined();
+  });
+});
+
+describe("scrubFields — recursive redaction with case-insensitivity, arrays, nested, cycles", () => {
+  it("redacts top-level sensitive field names case-insensitively", () => {
+    const out = run({
+      extra: {
+        token: "abc",
+        Password: "pw",
+        APIKEY: "k",
+        api_key: "k2",
+        IdToken: "id",
+        ACCESSTOKEN: "at",
+        RefreshToken: "rt",
+        keep: "yes",
+      },
+    } as unknown as ErrorEvent);
+    const extra = out.extra as Record<string, unknown>;
+    expect(extra.token).toBe(REDACTED);
+    expect(extra.Password).toBe(REDACTED);
+    expect(extra.APIKEY).toBe(REDACTED);
+    expect(extra.api_key).toBe(REDACTED);
+    expect(extra.IdToken).toBe(REDACTED);
+    expect(extra.ACCESSTOKEN).toBe(REDACTED);
+    expect(extra.RefreshToken).toBe(REDACTED);
+    expect(extra.keep).toBe("yes");
+  });
+
+  it("recurses into nested objects and arrays", () => {
+    const out = run({
+      extra: {
+        nested: { deeper: { token: "t", safe: 1 } },
+        items: [{ password: "pw" }, { other: "ok" }],
+      },
+    } as unknown as ErrorEvent);
+    const extra = out.extra as Record<string, any>;
+    expect(extra.nested.deeper.token).toBe(REDACTED);
+    expect(extra.nested.deeper.safe).toBe(1);
+    expect(extra.items[0].password).toBe(REDACTED);
+    expect(extra.items[1].other).toBe("ok");
+  });
+
+  it("handles circular references without stack overflow and scrubs fields reachable only through the cycle", () => {
+    const cyclic: Record<string, unknown> = { token: "leak" };
+    cyclic.self = cyclic;
+    const out = run({ extra: { outer: cyclic } } as unknown as ErrorEvent);
+    const outer = (out.extra as any).outer;
+    // Top-level field is scrubbed.
+    expect(outer.token).toBe(REDACTED);
+    // The Map<original, scrubbed> cycle fix means re-visits return the
+    // memoized scrubbed copy, not the un-scrubbed original — so
+    // `outer.self.token` is ALSO [Filtered], not the leaked value.
+    expect(outer.self.token).toBe(REDACTED);
+    expect(outer.self).toBe(outer);
+  });
+
+  it("scalar-string defense-in-depth: redacts embedded credentials in extra.note even when the key is NOT in SENSITIVE_FIELD_NAMES", () => {
+    const out = run({
+      extra: { note: "Something broke, password=hunter2 failed" },
+    } as unknown as ErrorEvent);
+    const extra = out.extra as Record<string, unknown>;
+    expect(extra.note).toContain(`password=${REDACTED}`);
+    expect(extra.note).not.toContain("hunter2");
+  });
+
+  it("scalar-string defense-in-depth: redacts a Bearer in user.bio (key NOT in SENSITIVE_FIELD_NAMES)", () => {
+    const out = run({
+      user: { id: "u1", email: "a@b.c", bio: "authorization: Bearer leak" },
+    } as unknown as ErrorEvent);
+    const user = out.user as Record<string, unknown>;
+    expect(user.id).toBe("u1");
+    expect(user.email).toBe("a@b.c");
+    expect(user.bio).toContain(`Bearer ${REDACTED}`);
+    expect(user.bio).not.toContain("leak");
+  });
+});
+
+describe("scrubString — regex passes for kv, scheme+credential, JWT triplets", () => {
+  it("redacts key=value and key: value pairs", () => {
+    const out = run({
+      message: "password=hunter2 and api-key: abc123 should be redacted",
+    } as unknown as ErrorEvent);
+    expect(out.message).toContain(`password=${REDACTED}`);
+    expect(out.message).toContain(`api-key:${REDACTED}`);
+    expect(out.message).not.toContain("hunter2");
+    expect(out.message).not.toContain("abc123");
+  });
+
+  it("redacts Bearer / Basic credentials", () => {
+    const out = run({
+      message: "Got header Bearer abcDEF._~+/=- and Basic Zm9vOmJhcg==",
+    } as unknown as ErrorEvent);
+    expect(out.message).toContain(`Bearer ${REDACTED}`);
+    expect(out.message).toContain(`Basic ${REDACTED}`);
+  });
+
+  it("redacts non-JWT-shaped accessToken/refreshToken/id_token values in free text", () => {
+    const out = run({
+      message:
+        "refreshToken=opaqueBase64NotAJwt-xyz and accessToken: anotherOpaqueValue and id_token=short",
+    } as unknown as ErrorEvent);
+    expect(out.message).toContain(`refreshToken=${REDACTED}`);
+    expect(out.message).toContain(`accessToken:${REDACTED}`);
+    expect(out.message).toContain(`id_token=${REDACTED}`);
+    expect(out.message).not.toContain("opaqueBase64NotAJwt-xyz");
+    expect(out.message).not.toContain("anotherOpaqueValue");
+    expect(out.message).not.toContain("=short");
+  });
+
+  it("redacts bare JWT triplets", () => {
+    const jwt = "eyJhbGciOi12345.eyJzdWIiOi67890.sig_abcdef1234";
+    const out = run({ message: `token was ${jwt} yeah` } as unknown as ErrorEvent);
+    expect(out.message).not.toContain(jwt);
+    expect(out.message).toContain(REDACTED);
+  });
+});
+
+describe("scrubQueryString — parse + fallback", () => {
+  it("parses well-formed query strings with a leading ? and redacts sensitive keys", () => {
+    const out = run({
+      request: {
+        query_string: "?foo=bar&token=leak&password=pw&keep=me",
+      },
+    } as unknown as ErrorEvent);
+    const qs = out.request!.query_string as string;
+    expect(qs.startsWith("?")).toBe(true);
+    expect(qs).toContain("foo=bar");
+    expect(qs).toContain(`token=${REDACTED}`);
+    expect(qs).toContain(`password=${REDACTED}`);
+    expect(qs).toContain("keep=me");
+  });
+
+  it("parses no-leading-? strings as well", () => {
+    const out = run({
+      request: { query_string: "token=leak&keep=1" },
+    } as unknown as ErrorEvent);
+    const qs = out.request!.query_string as string;
+    expect(qs.startsWith("?")).toBe(false);
+    expect(qs).toContain(`token=${REDACTED}`);
+    expect(qs).toContain("keep=1");
+  });
+
+  it("leaves non-string query_string alone", () => {
+    const out = run({
+      request: { query_string: undefined },
+    } as unknown as ErrorEvent);
+    expect(out.request!.query_string).toBeUndefined();
+  });
+});
+
+describe("event-level walk — exception.values, message, breadcrumbs, user, extra, contexts, request.data", () => {
+  it("scrubs exception.values[].value strings", () => {
+    const out = run({
+      exception: {
+        values: [
+          { type: "Error", value: "password=sekret failed" },
+          { type: "Error", value: "clean" },
+        ],
+      },
+    } as unknown as ErrorEvent);
+    expect(out.exception!.values![0].value).toContain(`password=${REDACTED}`);
+    expect(out.exception!.values![0].value).not.toContain("sekret");
+    expect(out.exception!.values![1].value).toBe("clean");
+  });
+
+  it("scrubs event.message", () => {
+    const out = run({ message: "Bearer leaked.jwt.token" } as unknown as ErrorEvent);
+    expect(out.message).toContain(`Bearer ${REDACTED}`);
+  });
+
+  it("scrubs breadcrumbs.message (string) and breadcrumbs.data (structured)", () => {
+    const out = run({
+      breadcrumbs: [
+        {
+          category: "fetch",
+          message: "GET /api?token=abc",
+          data: { url: "/api", password: "leak" },
+        },
+      ],
+    } as unknown as ErrorEvent);
+    const bc = out.breadcrumbs![0];
+    expect(bc.message).toContain(`token=${REDACTED}`);
+    expect((bc.data as Record<string, unknown>).password).toBe(REDACTED);
+    expect((bc.data as Record<string, unknown>).url).toBe("/api");
+  });
+
+  it("scrubs event.user fields", () => {
+    const out = run({
+      user: { id: "u1", email: "a@b.c", token: "bad", IdToken: "cognito" },
+    } as unknown as ErrorEvent);
+    const user = out.user as Record<string, unknown>;
+    expect(user.id).toBe("u1");
+    expect(user.email).toBe("a@b.c");
+    expect(user.token).toBe(REDACTED);
+    expect(user.IdToken).toBe(REDACTED);
+  });
+
+  it("scrubs event.extra", () => {
+    const out = run({ extra: { password: "x", safe: "y" } } as unknown as ErrorEvent);
+    expect((out.extra as Record<string, unknown>).password).toBe(REDACTED);
+    expect((out.extra as Record<string, unknown>).safe).toBe("y");
+  });
+
+  it("scrubs event.contexts", () => {
+    const out = run({
+      contexts: {
+        auth: { token: "x", scheme: "bearer" },
+        runtime: { name: "node", version: "22" },
+      },
+    } as unknown as ErrorEvent);
+    const auth = (out.contexts as any).auth;
+    const runtime = (out.contexts as any).runtime;
+    expect(auth.token).toBe(REDACTED);
+    expect(auth.scheme).toBe("bearer");
+    expect(runtime.name).toBe("node");
+  });
+
+  it("scrubs structured request body via request.data", () => {
+    const out = run({
+      request: { data: { username: "u", password: "pw", nested: { token: "t" } } },
+    } as unknown as ErrorEvent);
+    const data = out.request!.data as Record<string, any>;
+    expect(data.username).toBe("u");
+    expect(data.password).toBe(REDACTED);
+    expect(data.nested.token).toBe(REDACTED);
+  });
+});

package/src/sentry-before-send.ts

@@ -0,0 +1,221 @@
+// src/sentry-before-send.ts — canonical fleet scrubber
+// Line 1 is per-repo — see "Per-repo `import type` line" table in Step 3.
+// hq-console uses @sentry/nextjs. Consumer steps override to their own SDK.
+import type { ErrorEvent, EventHint } from "@sentry/node";
+
+const SENSITIVE_FIELD_NAMES = new Set([
+  "password", "secret", "apikey", "api_key", "token",
+  // Cognito token-response fields captured as error context.
+  "idtoken", "accesstoken", "refreshtoken",
+]);
+
+// Stored lowercased; membership tested against `name.toLowerCase()`.
+// MUST cover BOTH Auth.js v5 (current in hq-console, pinned to
+// next-auth@5.0.0-beta.25 which resolves @auth/core@0.37.2) AND legacy
+// NextAuth v4 name spaces — covering both is cheap and survives accidental
+// downgrades or mixed-version repos. Grounded against @auth/core@0.37.2's
+// src/lib/utils/cookie.ts (re-ground via `grep -nE
+// '(sessionToken|callbackUrl|csrfToken|pkceCodeVerifier|state|nonce|webauthnChallenge): \{'
+// node_modules/.pnpm/@auth+core@0.37.2/node_modules/@auth/core/src/lib/utils/cookie.ts`
+// — seven matches, one per cookie family): two distinct prefixing patterns
+// coexist there, and the entries below mirror BOTH exactly:
+//   • session-token / callback-url / pkce.code_verifier / state / nonce /
+//     challenge each pair the bare form (HTTP dev, cookiePrefix="") with
+//     the __Secure- form (HTTPS prod, cookiePrefix="__Secure-").
+//   • csrf-token is special: the source explicitly uses __Host- (NOT
+//     __Secure-) under HTTPS for stricter cookie scoping (the csrfToken
+//     entry in @auth/core's cookie.ts is the only one whose name template
+//     uses `__Host-` instead of `${cookiePrefix}`; the comment above it
+//     reads "Default to __Host- for CSRF token for additional protection
+//     if using useSecureCookies"). The set therefore pairs the bare form
+//     with __Host-, and does NOT include __Secure-authjs.csrf-token
+//     because @auth/core never emits that name. The legacy v4 entry mirrors
+//     the same pattern (bare next-auth.csrf-token + __Host-next-auth.csrf-token,
+//     no __Secure- variant).
+// Missing any of the four OAuth-state families (pkce.code_verifier, state,
+// nonce, challenge) ships a cookie-leak in the same class as the v4-only
+// defect Round-4 called out. This set is the single authoritative spec;
+// all of Steps 3/8/9a/12/13 reproduce it identically.
+//
+// MAINTAINER NOTE: Do NOT extend this set by mechanically pairing every
+// cookie with bare + __Secure- + __Host-. The pairing follows the source:
+// session-style cookies use __Secure-; csrf-style cookies use __Host-.
+// New entries added in the future must be grounded against the actual
+// emitter (Auth.js source for v5/v4, vendor docs for Clerk, etc.) rather
+// than copied from the existing pattern.
+const SENSITIVE_COOKIE_NAMES = new Set([
+  // ==== Auth.js v5 (next-auth@5 / @auth/core) ====
+  // Session JWT — bare + __Secure-
+  "authjs.session-token",
+  "__secure-authjs.session-token",
+  // CSRF double-submit token — bare + __Host- ONLY (@auth/core's cookie.ts
+  // csrfToken entry uses __Host-, never __Secure-)
+  "authjs.csrf-token",
+  "__host-authjs.csrf-token",
+  // Post-auth redirect URL — bare + __Secure-
+  "authjs.callback-url",
+  "__secure-authjs.callback-url",
+  // OAuth PKCE verifier — leaking this enables interception of an in-flight
+  // OAuth code exchange.
+  "authjs.pkce.code_verifier",
+  "__secure-authjs.pkce.code_verifier",
+  // OAuth CSRF/replay protection
+  "authjs.state",
+  "__secure-authjs.state",
+  // OpenID Connect nonce — replay protection
+  "authjs.nonce",
+  "__secure-authjs.nonce",
+  // OAuth WebAuthn challenge
+  "authjs.challenge",
+  "__secure-authjs.challenge",
+  // ==== NextAuth v4 legacy names (kept so accidental downgrades /
+  //       mixed-version monorepos don't silently leak). Same prefix
+  //       discipline as v5: csrf-token uses __Host-, others use __Secure-. ====
+  "next-auth.session-token",
+  "__secure-next-auth.session-token",
+  "next-auth.csrf-token",
+  "__host-next-auth.csrf-token",
+  "next-auth.callback-url",
+  "__secure-next-auth.callback-url",
+  "next-auth.pkce.code_verifier",
+  "__secure-next-auth.pkce.code_verifier",
+  "next-auth.state",
+  "__secure-next-auth.state",
+  // ==== Clerk (documented for future; no-op today) ====
+  "__clerk_db_jwt", "__session",
+]);
+
+const REDACTED = "[Filtered]";
+
+const SENSITIVE_HEADER_NAMES = new Set([
+  "authorization", "proxy-authorization",
+  "cookie", "set-cookie",
+  "x-api-key", "x-auth-token", "x-access-token", "x-session-token",
+]);
+
+function scrubHeaders(h?: Record<string, unknown>): Record<string, unknown> | undefined {
+  if (!h) return h;
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(h)) {
+    out[k] = SENSITIVE_HEADER_NAMES.has(k.toLowerCase()) ? REDACTED : v;
+  }
+  return out;
+}
+
+type CookieField = Record<string, unknown> | string | undefined;
+
+function scrubCookies(c: CookieField): CookieField {
+  if (!c) return c;
+  if (typeof c === "string") return REDACTED; // raw Cookie header — wholesale redact
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(c)) {
+    out[k] = SENSITIVE_COOKIE_NAMES.has(k.toLowerCase()) ? REDACTED : v;
+  }
+  return out;
+}
+
+const SENSITIVE_STRING_PATTERNS: RegExp[] = [
+  // kv pairs; `(?:id|access|refresh)[_-]?token` catches Cognito-style free-text
+  // `accessToken=...`, `refreshToken: ...`, `id_token=...` which bare `\btoken` misses.
+  /\b(password|secret|api[_-]?key|(?:id|access|refresh)[_-]?token|token)\s*[:=]\s*[^\s&"'<>]+/gi,
+  /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi,
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+];
+
+function scrubString(s: string): string {
+  let out = s;
+  for (const re of SENSITIVE_STRING_PATTERNS) {
+    out = out.replace(re, (m) => {
+      const sep = m.search(/[:=\s]/);
+      return sep > 0 ? `${m.slice(0, sep + 1)}${REDACTED}` : REDACTED;
+    });
+  }
+  return out;
+}
+
+function scrubQueryString(qs: string): string {
+  try {
+    const params = new URLSearchParams(qs.startsWith("?") ? qs.slice(1) : qs);
+    const out: string[] = [];
+    for (const [k, v] of params) {
+      out.push(`${k}=${SENSITIVE_FIELD_NAMES.has(k.toLowerCase()) ? REDACTED : v}`);
+    }
+    const joined = out.join("&");
+    return qs.startsWith("?") ? `?${joined}` : joined;
+  } catch {
+    return scrubString(qs);
+  }
+}
+
+function scrubFields<T>(value: T, memo: Map<object, unknown> = new Map()): T {
+  if (value === null || typeof value !== "object") return value;
+  const obj = value as unknown as object;
+  // On cycle revisit, return the SAME scrubbed copy built on first visit —
+  // NOT the original. Returning the original would leak fields reachable
+  // only through the cycle (e.g., a.self.token).
+  if (memo.has(obj)) return memo.get(obj) as T;
+
+  if (Array.isArray(value)) {
+    const arr: unknown[] = [];
+    memo.set(obj, arr);
+    for (const v of value) arr.push(scrubFields(v, memo));
+    return arr as unknown as T;
+  }
+
+  const out: Record<string, unknown> = {};
+  memo.set(obj, out);
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+    if (SENSITIVE_FIELD_NAMES.has(k.toLowerCase())) {
+      out[k] = REDACTED;
+    } else if (v !== null && typeof v === "object") {
+      out[k] = scrubFields(v, memo);
+    } else if (typeof v === "string") {
+      // SCALAR-STRING DEFENSE-IN-DEPTH. A stringified log line stashed via
+      // setExtra / setContext / setUser can embed `password=...` or a Bearer
+      // token even when the outer key (`note`, `bio`, `log_line`, …) isn't
+      // in SENSITIVE_FIELD_NAMES. Route scalar strings through scrubString so
+      // these don't bypass the scrubber on their way into Sentry.
+      out[k] = scrubString(v);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out as unknown as T;
+}
+
+export function beforeSend(event: ErrorEvent, _hint: EventHint): ErrorEvent | null {
+  if (event.request) {
+    const req = event.request as { headers?: unknown; cookies?: unknown; data?: unknown; query_string?: unknown };
+    event.request = {
+      ...event.request,
+      headers: scrubHeaders(req.headers as Record<string, unknown> | undefined) as typeof event.request.headers,
+      cookies: scrubCookies(req.cookies as CookieField) as typeof event.request.cookies,
+      data: scrubFields(req.data),
+      query_string:
+        typeof req.query_string === "string"
+          ? scrubQueryString(req.query_string)
+          : (req.query_string as typeof event.request.query_string),
+    };
+  }
+  if (typeof event.message === "string") event.message = scrubString(event.message);
+  if (event.exception?.values) {
+    event.exception = {
+      ...event.exception,
+      values: event.exception.values.map((v) => ({
+        ...v,
+        value: typeof v.value === "string" ? scrubString(v.value) : v.value,
+      })),
+    };
+  }
+  if (event.user) event.user = scrubFields(event.user as Record<string, unknown>) as typeof event.user;
+  if (event.breadcrumbs) {
+    event.breadcrumbs = event.breadcrumbs.map((b) => ({
+      ...b,
+      message: typeof b.message === "string" ? scrubString(b.message) : b.message,
+      data: b.data ? scrubFields(b.data) : b.data,
+    }));
+  }
+  if (event.extra) event.extra = scrubFields(event.extra);
+  if (event.contexts) event.contexts = scrubFields(event.contexts);
+  return event;
+}

package/src/sentry.test.ts

@@ -0,0 +1,24 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import * as Sentry from "@sentry/node";
+import { initSentry } from "./sentry.js";
+
+vi.mock("./sentry-dsn.generated.js", () => ({ BUNDLED_DSN: "" }));
+
+describe("initSentry — empty BUNDLED_DSN no-op", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("fakeTransport.send is never called after captureException + flush(2000) when no DSN configured", async () => {
+    vi.stubEnv("SENTRY_DSN", "");
+
+    const fakeTransport = { send: vi.fn().mockResolvedValue(undefined) };
+
+    initSentry();
+
+    Sentry.captureException(new Error("no-dsn-should-not-send"));
+    await Sentry.flush(2000);
+
+    expect(fakeTransport.send).not.toHaveBeenCalled();
+  });
+});

package/src/sentry.ts

@@ -0,0 +1,19 @@
+import * as Sentry from "@sentry/node";
+import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
+import { beforeSend } from "./sentry-before-send.js";
+
+export function initSentry(): void {
+  const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
+  if (!dsn) return;
+  Sentry.init({
+    dsn,
+    release: `hq-cli@${process.env.npm_package_version ?? "0.0.0"}`,
+    environment: process.env.HQ_CLI_ENV ?? "production",
+    initialScope: {
+      tags: { repo: "hq-cli" },
+    },
+    beforeSend,
+  });
+}
+
+export { Sentry };

package/src/utils/cognito-session.ts

@@ -6,7 +6,7 @@
  *   - `hq auth refresh` and the standalone `hq-auth-refresh` bin invoked by
  *     the deploy skill (.claude/skills/deploy/SKILL.md step 4)
  *
- * Defaults point at the shared hq-vault-dev Cognito pool. They mirror
+ * Defaults point at the shared vault-indigo-hq-dev Cognito pool. They mirror
  * tools/vlt-e2e/e2e-create-company-smoke.ts so the CLI and the in-tree demo script
  * stay drift-free. Override any of them via env:
  *
@@ -31,8 +31,8 @@ import {
 
 export const DEFAULT_COGNITO: CognitoAuthConfig = {
   region: process.env.AWS_REGION ?? "us-east-1",
-  userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "hq-vault-dev",
-  clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "4mmujmjq3srakdueg656b9m0mp",
+  userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-dev",
+  clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7r7an9keh0u6hlsvepl74tvqb0",
   port: process.env.HQ_COGNITO_CALLBACK_PORT
     ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
     : 8765,
@@ -40,7 +40,7 @@ export const DEFAULT_COGNITO: CognitoAuthConfig = {
 
 export const DEFAULT_VAULT_API_URL =
   process.env.HQ_VAULT_API_URL ??
-  "https://tqdwdqxv75.execute-api.us-east-1.amazonaws.com";
+  "https://ky8cgbl4yh.execute-api.us-east-1.amazonaws.com";
 
 export const DEFAULT_HQ_ROOT = path.join(os.homedir(), "hq");
 

package/src/utils/secrets-cache.ts

@@ -17,7 +17,7 @@ function ensureCacheDir(companyUid: string): void {
 
 function validateInputs(companyUid: string, name: string): boolean {
   if (!companyUid || companyUid.includes("/") || companyUid.includes("..")) return false;
-  if (!/^[A-Z][A-Z0-9_]*$/.test(name)) return false;
+  if (!/^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/.test(name)) return false;
   return true;
 }
 
@@ -99,6 +99,7 @@ export function writeCache(companyUid: string, name: string, value: string): voi
 
     const out = Buffer.concat([timestamp, iv, authTag, encrypted]);
     const filePath = path.join(CACHE_DIR, companyUid, name);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
     const tmpPath = `${filePath}.tmp.${process.pid}`;
     fs.writeFileSync(tmpPath, out, { mode: 0o600 });
     fs.renameSync(tmpPath, filePath);

package/dist/bin/hq-auth-refresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hq-auth-refresh.d.ts","sourceRoot":"","sources":["../../src/bin/hq-auth-refresh.ts"],"names":[],"mappings":";AAEA;;;;;;;;;GASG"}

package/dist/bin/hq-auth-refresh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hq-auth-refresh.js","sourceRoot":"","sources":["../../src/bin/hq-auth-refresh.ts"],"names":[],"mappings":";AAEA;;;;;;;;;GASG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC5C,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACzE,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/commands/add.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkEzD"}