@indigoai-us/hq-cli 5.73.0 → 5.74.0

package/dist/commands/integrations.d.ts

@@ -45,7 +45,16 @@ interface GatewayMessage {
     };
 }
 export declare class IntegrationsCliError extends Error {
-    constructor(message: string);
+    /**
+     * True when the error is the caller's request/state/permission (a client 4xx
+     * or a local input/usage error) rather than an hq-cli defect. Expected errors
+     * are printed to the user but skipped for Sentry capture (HQ-CLI-6). Defaults
+     * to false so an unclassified error still reaches Sentry.
+     */
+    readonly expected: boolean;
+    constructor(message: string, opts?: {
+        expected?: boolean;
+    });
 }
 /** "factory:linear" → "linear"; mirrors hq-pro's factoryToolPrefix. */
 export declare function toolPrefixForProvider(provider: string): string;

package/dist/commands/integrations.js

@@ -29,12 +29,42 @@ import { randomUUID } from "node:crypto";
 import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { AuthError } from "../utils/auth-error.js";
 export class IntegrationsCliError extends Error {
-    constructor(message) {
+    /**
+     * True when the error is the caller's request/state/permission (a client 4xx
+     * or a local input/usage error) rather than an hq-cli defect. Expected errors
+     * are printed to the user but skipped for Sentry capture (HQ-CLI-6). Defaults
+     * to false so an unclassified error still reaches Sentry.
+     */
+    expected;
+    constructor(message, opts = {}) {
         super(message);
         this.name = "IntegrationsCliError";
+        this.expected = opts.expected ?? false;
     }
 }
+/**
+ * A client 4xx is the caller's request/state/permission (bad params, stale
+ * queueId, a non-owner approving) — expected and user-facing, not a bug. A 5xx
+ * (or a 2xx protocol violation) is a genuine server/unknown fault worth a Sentry
+ * crash report.
+ */
+function isClientError(status) {
+    return status >= 400 && status < 500;
+}
+// A 401 from ANY integration-gateway vault call means the caller's HQ session
+// is expired or missing — an expected auth state fixed by `hq login`, not an
+// hq-cli defect. Raise the same typed AuthError the vault company-resolution
+// paths use (HQ-CLI-8) so the top-level handler prints one actionable message
+// and skips Sentry, instead of surfacing the opaque, unactionable
+// "Integration gateway request failed (HTTP 401)" that shipped as a fatal from
+// `callGateway` (HQ-CLI-9). Non-401 statuses keep their existing behavior:
+// other 4xx stay expected client errors, 5xx still report.
+function raiseIfUnauthorized(res) {
+    if (res.status === 401)
+        throw new AuthError();
+}
 /** "factory:linear" → "linear"; mirrors hq-pro's factoryToolPrefix. */
 export function toolPrefixForProvider(provider) {
     return provider
@@ -50,8 +80,9 @@ export async function fetchConnections(token, companyUid) {
         query: { companyUid },
     });
     if (!res.ok) {
+        raiseIfUnauthorized(res);
         const body = (await res.json().catch(() => ({})));
-        throw new IntegrationsCliError(body.error ?? `Failed to list integrations (HTTP ${res.status})`);
+        throw new IntegrationsCliError(body.error ?? `Failed to list integrations (HTTP ${res.status})`, { expected: isClientError(res.status) });
     }
     const data = (await res.json());
     return data.connections ?? [];
@@ -66,7 +97,7 @@ export function selectConnection(connections, opts) {
     if (opts.connection) {
         const match = connections.find((c) => c.id === opts.connection);
         if (!match) {
-            throw new IntegrationsCliError(`No connection '${opts.connection}'. Run \`hq integrations list\` to see connected apps.`);
+            throw new IntegrationsCliError(`No connection '${opts.connection}'. Run \`hq integrations list\` to see connected apps.`, { expected: true });
         }
         return match;
     }
@@ -81,17 +112,17 @@ export function selectConnection(connections, opts) {
                 .map((c) => c.provider.replace(/^factory:/, ""))
                 .join(", ");
             throw new IntegrationsCliError(`No connected app matches '${opts.provider}'.` +
-                (available ? ` Connected: ${available}.` : " Nothing is connected yet — connect apps on the console Integrations page."));
+                (available ? ` Connected: ${available}.` : " Nothing is connected yet — connect apps on the console Integrations page."), { expected: true });
         }
         return match;
     }
     if (active.length === 1)
         return active[0];
     if (active.length === 0) {
-        throw new IntegrationsCliError("No connected apps yet. Connect one on the console Integrations page, then retry.");
+        throw new IntegrationsCliError("No connected apps yet. Connect one on the console Integrations page, then retry.", { expected: true });
     }
     throw new IntegrationsCliError(`Multiple apps are connected — pick one with --provider:\n` +
-        active.map((c) => `  --provider ${c.provider.replace(/^factory:/, "")}`).join("\n"));
+        active.map((c) => `  --provider ${c.provider.replace(/^factory:/, "")}`).join("\n"), { expected: true });
 }
 export async function callGateway(token, params) {
     const res = await vaultApiFetch({
@@ -107,7 +138,8 @@ export async function callGateway(token, params) {
     });
     const message = (await res.json().catch(() => null));
     if (!res.ok || !message) {
-        throw new IntegrationsCliError(`Integration gateway request failed (HTTP ${res.status}).`);
+        raiseIfUnauthorized(res);
+        throw new IntegrationsCliError(`Integration gateway request failed (HTTP ${res.status}).`, { expected: isClientError(res.status) });
     }
     if (message.error) {
         throw new IntegrationsCliError(message.error.message ?? "Integration gateway returned an error.");
@@ -232,7 +264,7 @@ export function registerIntegrationsCommand(program) {
             parsedArgs = raw;
         }
         catch {
-            throw new IntegrationsCliError(`--args must be a JSON object, e.g. --args '{"assignee":"me"}'`);
+            throw new IntegrationsCliError(`--args must be a JSON object, e.g. --args '{"assignee":"me"}'`, { expected: true });
         }
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
@@ -288,7 +320,8 @@ export function registerIntegrationsCommand(program) {
             });
             const body = (await res.json().catch(() => ({})));
             if (!res.ok) {
-                throw new IntegrationsCliError(body.error ?? `${decision} failed (HTTP ${res.status})`);
+                raiseIfUnauthorized(res);
+                throw new IntegrationsCliError(body.error ?? `${decision} failed (HTTP ${res.status})`, { expected: isClientError(res.status) });
             }
             if (opts.json) {
                 printJson(body);

package/dist/commands/outposts.d.ts

@@ -143,13 +143,14 @@ export declare function joinCommandParts(commandParts: string[]): string;
  * caller's command. `exec` runs over two transports with two different default
  * working directories — SSM runs as root with no `$HOME` (cwd `/usr/bin`) and
  * SSH lands in the login user's home — so without this, `hq outposts exec -- pwd`
- * printed an unhelpful, transport-dependent directory. We resolve the HQ folder
- * in-shell: `$HOME/hq` for the login/SSH user, falling back to ec2-user's home
- * for the SSM/root path. The trailing `|| true` keeps the command running from
- * the default directory when no HQ checkout is present, so exec never fails
- * merely because the box has no HQ folder.
+ * printed an unhelpful, transport-dependent directory. Initialize a real root
+ * home for the SSM case before resolving the HQ folder: tools run by the caller
+ * (notably `gh`) otherwise treat the HQ checkout as their home and can create
+ * root-owned machine state inside it. The trailing `|| true` keeps the command
+ * running from the default directory when no HQ checkout is present, so exec
+ * never fails merely because the box has no HQ folder.
  */
-export declare const REMOTE_HQ_DIR_PREFIX = "cd \"$HOME/hq\" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true";
+export declare const REMOTE_HQ_DIR_PREFIX = "export HOME=\"${HOME:-/root}\"; cd \"$HOME/hq\" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true";
 /** Wrap `command` so it runs from the box's HQ folder (see REMOTE_HQ_DIR_PREFIX). */
 export declare function withRemoteHqDir(command: string): string;
 /** SSH connection details vended by `POST /outpost/ssh-access`. */

package/dist/commands/outposts.js

@@ -215,13 +215,14 @@ async function waitForExecResult(token, commandId, outpostId) {
  * caller's command. `exec` runs over two transports with two different default
  * working directories — SSM runs as root with no `$HOME` (cwd `/usr/bin`) and
  * SSH lands in the login user's home — so without this, `hq outposts exec -- pwd`
- * printed an unhelpful, transport-dependent directory. We resolve the HQ folder
- * in-shell: `$HOME/hq` for the login/SSH user, falling back to ec2-user's home
- * for the SSM/root path. The trailing `|| true` keeps the command running from
- * the default directory when no HQ checkout is present, so exec never fails
- * merely because the box has no HQ folder.
+ * printed an unhelpful, transport-dependent directory. Initialize a real root
+ * home for the SSM case before resolving the HQ folder: tools run by the caller
+ * (notably `gh`) otherwise treat the HQ checkout as their home and can create
+ * root-owned machine state inside it. The trailing `|| true` keeps the command
+ * running from the default directory when no HQ checkout is present, so exec
+ * never fails merely because the box has no HQ folder.
  */
-export const REMOTE_HQ_DIR_PREFIX = 'cd "$HOME/hq" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true';
+export const REMOTE_HQ_DIR_PREFIX = 'export HOME="${HOME:-/root}"; cd "$HOME/hq" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true';
 /** Wrap `command` so it runs from the box's HQ folder (see REMOTE_HQ_DIR_PREFIX). */
 export function withRemoteHqDir(command) {
     return `${REMOTE_HQ_DIR_PREFIX}; ${command}`;

package/dist/main.js

@@ -58,8 +58,11 @@ import { registerBillingCommand } from "./commands/billing.js";
 import { registerDbCommand } from "./commands/db.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
+import { isExpectedUserError } from "./utils/expected-cli-error.js";
 import { isEpipe } from "./utils/epipe.js";
 import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
+import { isAuthError } from "./utils/auth-error.js";
+import { isCompanySelectionError } from "./utils/company-selection-error.js";
 import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
 import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
 import { CLI_VERSION } from "./cli-version.js";
@@ -253,6 +256,37 @@ export async function runCli() {
             // degradation) and preserve the intended non-zero exit (HQ-CLI-3).
             process.exitCode = 1;
         }
+        else if (isCompanySelectionError(err)) {
+            // The user has multiple (or zero) active company memberships and ran a
+            // command that needs exactly one without `--company`, or a `--company`
+            // slug collided across companies. That's an expected, user-actionable
+            // disambiguation prompt — the message already tells them exactly how to
+            // proceed (re-run with `--company <slug-or-uid>`) — not an hq-cli defect.
+            // The CLI can't pick a company for them. Print the actionable message and
+            // exit non-zero, but skip Sentry capture so a normal "pick a company"
+            // prompt doesn't flood the tracker with unfixable "crashes" (HQ-CLI-7).
+            process.stderr.write(`hq: ${err.message}\n`);
+            process.exitCode = 1;
+        }
+        else if (isAuthError(err)) {
+            // HQ-CLI-8: the vault API returned 401 Unauthorized — the caller's HQ
+            // session is expired or missing. That's an expected auth state the user
+            // fixes with `hq login`, not an hq-cli defect. Print the actionable
+            // message and skip Sentry so an expired login doesn't flood the tracker
+            // with identical, unfixable "crashes".
+            process.stderr.write(`hq: ${err.message}\n`);
+            process.exitCode = 1;
+        }
+        else if (isExpectedUserError(err)) {
+            // HQ-CLI-6: a user-facing, client-caused error (a non-owner running
+            // `hq integrations approve`, a stale queueId, a bad --args, an unknown
+            // connection) is the caller's request/state/permission, not an hq-cli
+            // defect. Print the actionable message and skip Sentry so a correctly-
+            // denied 4xx doesn't flood the tracker with identical, unfixable crash
+            // reports. Genuine server (5xx) / unknown failures still capture below.
+            process.stderr.write(`hq: ${err.message}\n`);
+            process.exitCode = 1;
+        }
         else {
             // A full disk / exhausted quota / read-only filesystem is the user's
             // machine, not an HQ code defect. Surface a clear, actionable message and

package/dist/utils/auth-error.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Thrown when the vault API reports the caller's HQ session is expired or
+ * missing. The `message` is user-facing and actionable; the top-level handler
+ * prints it verbatim and skips Sentry capture.
+ */
+export declare class AuthError extends Error {
+    constructor(message?: string);
+}
+/**
+ * True when `err` is an expected auth-state failure the user must resolve with
+ * `hq login`. Callers should print `err.message` and SKIP Sentry capture while
+ * preserving a non-zero exit. Genuine faults are plain `Error`s and return
+ * `false`, so real bugs still report.
+ */
+export declare function isAuthError(err: unknown): boolean;
+//# sourceMappingURL=auth-error.d.ts.map

package/dist/utils/auth-error.js

@@ -0,0 +1,39 @@
+// src/utils/auth-error.ts
+//
+// Classify expired or missing HQ session conditions surfaced by the vault API
+// (HQ-CLI-8). These are expected, user-actionable auth states — NOT hq-cli
+// defects — so the top-level catch prints the message and exits non-zero but
+// SKIPS Sentry capture, mirroring the company-selection (HQ-CLI-7),
+// expected-user-error (HQ-CLI-6), and environmental-FS (HQ-CLI-2) carve-outs.
+//
+// HQ-CLI-8: a user ran `hq integrations list --company liverecover --json`
+// with an expired HQ session. Company-slug resolution tried the caller-scoped
+// `/entity/check-slug/me` lookup and the global `/entity/by-slug/company/...`
+// fallback; both returned 401 Unauthorized. The plain Error that bubbled up
+// looked like a company-resolution defect and was shipped to Sentry as a fatal.
+// A 401 from vault resolution means the caller needs to run `hq login`; the
+// code cannot repair an expired token, so this is normal auth state, not a
+// crash to triage.
+/**
+ * Thrown when the vault API reports the caller's HQ session is expired or
+ * missing. The `message` is user-facing and actionable; the top-level handler
+ * prints it verbatim and skips Sentry capture.
+ */
+export class AuthError extends Error {
+    constructor(message = "Your HQ session has expired or you're not signed in. Run `hq login` and try again.") {
+        super(message);
+        this.name = "AuthError";
+        // Preserve `instanceof` across the TS→ES5/ES2015 transpile target.
+        Object.setPrototypeOf(this, AuthError.prototype);
+    }
+}
+/**
+ * True when `err` is an expected auth-state failure the user must resolve with
+ * `hq login`. Callers should print `err.message` and SKIP Sentry capture while
+ * preserving a non-zero exit. Genuine faults are plain `Error`s and return
+ * `false`, so real bugs still report.
+ */
+export function isAuthError(err) {
+    return err instanceof AuthError;
+}
+//# sourceMappingURL=auth-error.js.map

package/dist/utils/company-selection-error.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Thrown when the CLI cannot resolve a single company on the user's behalf and
+ * the user must re-run with `--company <slug-or-uid>`:
+ *   - they have multiple active memberships and passed no `--company`,
+ *   - they have no active membership and passed no `--company`, or
+ *   - a `--company` slug collides across companies, none in their namespace.
+ *
+ * The `message` is already user-facing and actionable — the top-level handler
+ * prints it verbatim and skips Sentry capture.
+ */
+export declare class CompanySelectionError extends Error {
+    constructor(message: string);
+}
+/**
+ * True when `err` is a company-selection disambiguation prompt the user must
+ * resolve with `--company`. Callers should print `err.message` and SKIP Sentry
+ * capture (expected usage, no defect) while preserving a non-zero exit. Genuine
+ * faults are plain `Error`s and return `false`, so real bugs still report.
+ */
+export declare function isCompanySelectionError(err: unknown): boolean;
+//# sourceMappingURL=company-selection-error.d.ts.map

package/dist/utils/company-selection-error.js

@@ -0,0 +1,44 @@
+// src/utils/company-selection-error.ts
+//
+// Classify the "the caller must pick a company with --company" conditions
+// (HQ-CLI-7). These are expected, user-actionable disambiguation prompts —
+// NOT hq-cli defects — so the top-level catch prints the message and exits
+// non-zero but SKIPS Sentry capture, mirroring the EPIPE (HQ-6B),
+// intercepted-process-exit (HQ-CLI-3), and environmental-FS (HQ-CLI-2)
+// carve-outs.
+//
+// HQ-CLI-7: a user with THREE active company memberships ran `hq integrations`
+// with no `--company`. `resolveCompanyFromMemberships` correctly threw
+// "Multiple active companies found. Re-run with --company <slug-or-uid>…" —
+// the message literally tells the user how to proceed — but it propagated to
+// the CLI's top-level handler as a plain Error and was shipped to Sentry as a
+// fatal. The command needs the human to disambiguate; the code cannot pick a
+// company for them, so this is normal usage, not a crash to triage.
+/**
+ * Thrown when the CLI cannot resolve a single company on the user's behalf and
+ * the user must re-run with `--company <slug-or-uid>`:
+ *   - they have multiple active memberships and passed no `--company`,
+ *   - they have no active membership and passed no `--company`, or
+ *   - a `--company` slug collides across companies, none in their namespace.
+ *
+ * The `message` is already user-facing and actionable — the top-level handler
+ * prints it verbatim and skips Sentry capture.
+ */
+export class CompanySelectionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CompanySelectionError";
+        // Preserve `instanceof` across the TS→ES5/ES2015 transpile target.
+        Object.setPrototypeOf(this, CompanySelectionError.prototype);
+    }
+}
+/**
+ * True when `err` is a company-selection disambiguation prompt the user must
+ * resolve with `--company`. Callers should print `err.message` and SKIP Sentry
+ * capture (expected usage, no defect) while preserving a non-zero exit. Genuine
+ * faults are plain `Error`s and return `false`, so real bugs still report.
+ */
+export function isCompanySelectionError(err) {
+    return err instanceof CompanySelectionError;
+}
+//# sourceMappingURL=company-selection-error.js.map

package/dist/utils/expected-cli-error.d.ts

@@ -0,0 +1,15 @@
+/**
+ * An error the CLI should surface to the user (clear message, exit 1) but NOT
+ * report to Sentry. Carriers set `expected: true`.
+ */
+export interface ExpectedUserError extends Error {
+    expected: true;
+}
+/**
+ * True when `err` is an Error explicitly marked `expected === true`. A non-null
+ * result means the top-level handler should print `err.message` and skip Sentry
+ * capture. Anything else (unmarked errors, non-Error values) returns false so
+ * genuine faults still reach Sentry.
+ */
+export declare function isExpectedUserError(err: unknown): err is ExpectedUserError;
+//# sourceMappingURL=expected-cli-error.d.ts.map

package/dist/utils/expected-cli-error.js

@@ -0,0 +1,29 @@
+// src/utils/expected-cli-error.ts
+//
+// Classify errors that are the CALLER's request/state/permission rather than an
+// hq-cli code defect: a bad flag, malformed input, a correctly-denied client
+// 4xx (e.g. a non-owner running `hq integrations approve`). These are
+// user-facing and actionable — the CLI prints a clear message and does NOT
+// report them to Sentry, otherwise a correctly-enforced authorization denial
+// floods the tracker with identical, unfixable crash reports.
+//
+// This is the caller-side analog of hq-pro's `expectedDenialResponse`, and a
+// sibling of `environmental-error.ts` (HQ-CLI-2) and
+// `intercepted-process-exit.ts` (HQ-CLI-3): errors that are NOT hq-cli defects
+// are surfaced to the user but skipped for Sentry capture.
+//
+// HQ-CLI-6: `hq integrations approve|reject` by a non-owner got a correct 403
+// ("Only a company owner can approve or reject queued integration writes"); the
+// thrown error propagated to the top-level handler, which captured it to Sentry
+// as an error-level crash and printed nothing to the user.
+/**
+ * True when `err` is an Error explicitly marked `expected === true`. A non-null
+ * result means the top-level handler should print `err.message` and skip Sentry
+ * capture. Anything else (unmarked errors, non-Error values) returns false so
+ * genuine faults still reach Sentry.
+ */
+export function isExpectedUserError(err) {
+    return (err instanceof Error &&
+        err.expected === true);
+}
+//# sourceMappingURL=expected-cli-error.js.map

package/dist/utils/vault-api.js

@@ -1,5 +1,7 @@
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
 import { Sentry } from '../sentry.js';
+import { AuthError } from './auth-error.js';
+import { CompanySelectionError } from './company-selection-error.js';
 export async function vaultApiFetch(opts) {
     const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
     if (opts.query) {
@@ -82,12 +84,21 @@ const COMPANY_UID_PREFIX = 'cmp_';
 export function looksLikeCompanyUid(ref) {
     return ref.startsWith(COMPANY_UID_PREFIX);
 }
+// A 401 from ANY vault resolution call means the caller's HQ session is
+// expired or missing — an expected auth state fixed by `hq login`, not a
+// code defect. Raise a typed AuthError so the top-level handler prints an
+// actionable message and skips Sentry capture (HQ-CLI-8).
+function raiseIfUnauthorized(res) {
+    if (res.status === 401)
+        throw new AuthError();
+}
 async function resolveCompanyByUid(token, uid) {
     const res = await vaultApiFetch({
         token,
         path: `/entity/${encodeURIComponent(uid)}`,
     });
     if (!res.ok) {
+        raiseIfUnauthorized(res);
         const body = (await res.json().catch(() => ({})));
         throw new Error(`Failed to resolve company '${uid}': ${body.error ?? res.statusText}`);
     }
@@ -119,11 +130,13 @@ async function resolveSlugInCallerNamespace(token, slug) {
         query: { type: 'company', slug },
     });
     if (!res.ok) {
+        raiseIfUnauthorized(res);
         // Namespace lookup unavailable (e.g. membership table not configured →
-        // 503, or the caller has no person entity). Signal "couldn't resolve here"
-        // and let the caller fall back to the global lookup. vaultApiFetch already
-        // recorded the non-2xx as a Sentry breadcrumb, so this is not a silent
-        // swallow.
+        // 503, or the caller has no person entity). A 401 short-circuits above
+        // because the token is bad and the global fallback would only 401 again;
+        // other non-2xx statuses signal "couldn't resolve here" and let the caller
+        // fall back to the global lookup. vaultApiFetch already recorded the
+        // non-2xx as a Sentry breadcrumb, so this is not a silent swallow.
         return null;
     }
     const data = (await res.json());
@@ -151,6 +164,7 @@ async function resolveCompanyUid(token, ref) {
         path: `/entity/by-slug/company/${encodeURIComponent(ref)}`,
     });
     if (!res.ok) {
+        raiseIfUnauthorized(res);
         const body = (await res.json().catch(() => ({})));
         // Residual true ambiguity: the slug matches multiple live companies and
         // NONE is in the caller's namespace (server returns 409 SlugNotUniqueError
@@ -158,7 +172,7 @@ async function resolveCompanyUid(token, ref) {
         // tell them exactly how — re-run with `--company <uid>` — and list the
         // candidates, instead of echoing the generic server message.
         if (res.status === 409 && Array.isArray(body.uids) && body.uids.length > 0) {
-            throw new Error(`Company slug '${ref}' matches ${body.uids.length} companies and none ` +
+            throw new CompanySelectionError(`Company slug '${ref}' matches ${body.uids.length} companies and none ` +
                 `is in your namespace. Re-run with --company <uid> to pick one:\n` +
                 body.uids.map((u) => `  --company ${u}`).join('\n'));
         }
@@ -178,13 +192,13 @@ async function resolveCompanyFromMemberships(token) {
     const data = (await res.json());
     const active = data.memberships.filter((m) => m.status === 'active');
     if (active.length === 0) {
-        throw new Error('No active company memberships found. Use --company <slug> to specify.');
+        throw new CompanySelectionError('No active company memberships found. Use --company <slug> to specify.');
     }
     if (active.length === 1) {
         return active[0].companyUid;
     }
     const uids = active.map((m) => m.companyUid);
-    throw new Error(`Multiple active companies found. Re-run with --company <slug-or-uid> to ` +
+    throw new CompanySelectionError(`Multiple active companies found. Re-run with --company <slug-or-uid> to ` +
         `pick one:\n` +
         uids.map((u) => `  --company ${u}`).join('\n'));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.73.0",
+  "version": "5.74.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -20,6 +20,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1049.0",
     "@indigoai-us/hq-cloud": "^6.14.4",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
@@ -34,7 +35,6 @@
     "varlock": "1.0.0"
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "^3.1049.0",
     "@eslint/js": "^10.0.1",
     "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",