@indigoai-us/hq-cli 5.84.0 → 5.85.1

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [5.85.1]
+
+### Fixed
+
+- Integration/provider failures now print a bounded, credential-scrubbed
+  diagnostic to stderr while remaining captured in Sentry, so failed remote
+  MCP calls no longer exit silently. (#298)
+- Package-root resolution now recovers safely from transient manifest loss and
+  reports bounded diagnostics when a packaged install is genuinely broken.
+  (#297)
+
+## [5.85.0]
+
+### Changed
+
+- Checkpoint Stop-gate eligibility is now runtime-specific: Claude Code is
+  enabled for every HQ account, Codex is enabled only for the designated
+  operator account (including delegated identities), and other Codex accounts
+  and runtimes remain disabled. Runtime-specific verdict caches prevent one
+  host's eligibility from leaking into another. (#295)
+
 ## [5.84.0]
 
 ### Added

package/dist/commands/core-checkpoint.js

@@ -307,12 +307,23 @@ function writeStamps(liveRoot, sessionId) {
         fs.writeFileSync(stampPath, timestamp);
     return stampPaths;
 }
-function gateEligibility() {
+const CODEX_CHECKPOINT_ACCOUNT = "hassaan@getindigo.ai";
+function checkpointGateRuntime() {
+    const runtime = (process.env.HQ_CHECKPOINT_RUNTIME ?? "claude").trim().toLowerCase();
+    if (runtime === "claude" || runtime === "codex")
+        return runtime;
+    return "other";
+}
+function gateEligibility(runtime) {
     const forced = process.env.HQ_CHECKPOINT_GATE;
     if (forced === "0")
         return false;
     if (forced === "1")
         return true;
+    if (runtime === "claude")
+        return true;
+    if (runtime !== "codex")
+        return false;
     try {
         const tokenPath = path.join(homedir(), ".hq", "cognito-tokens.json");
         const tokens = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
@@ -320,19 +331,7 @@ function gateEligibility() {
             return false;
         const claims = peekIdToken(tokens.idToken);
         const candidateEmails = [claims.email, claims["custom:delegatedEmail"]];
-        const configured = (process.env.HQ_CHECKPOINT_GATE_DOMAINS ?? "")
-            .split(",")
-            .map((candidate) => candidate.trim().toLowerCase())
-            .filter(Boolean);
-        const hasEligibleDomain = (candidate) => {
-            if (typeof candidate !== "string")
-                return false;
-            const domain = candidate.split("@").at(-1)?.toLowerCase();
-            if (!domain)
-                return false;
-            return domain === "getindigo.ai" || configured.includes(domain);
-        };
-        return candidateEmails.some(hasEligibleDomain);
+        return candidateEmails.some((candidate) => typeof candidate === "string" && candidate.toLowerCase() === CODEX_CHECKPOINT_ACCOUNT);
     }
     catch {
         return false;
@@ -341,8 +340,9 @@ function gateEligibility() {
 function writeGateVerdict(liveRoot) {
     const stateDir = path.join(liveRoot, "workspace", "orchestrator", "hook-state");
     fs.mkdirSync(stateDir, { recursive: true });
-    const eligible = gateEligibility();
-    fs.writeFileSync(path.join(stateDir, "checkpoint-gate-eligible"), eligible ? "1" : "0");
+    const runtime = checkpointGateRuntime();
+    const eligible = gateEligibility(runtime);
+    fs.writeFileSync(path.join(stateDir, `checkpoint-gate-eligible-${runtime}`), eligible ? "1" : "0");
     printResult(eligible ? "eligible" : "ineligible");
 }
 function backendOnPath(name) {

package/dist/main.d.ts

@@ -3,5 +3,13 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 import "./node-preflight.js";
+import { Sentry } from "./sentry.js";
 export declare function runCli(): Promise<void>;
+export type TopLevelErrorDependencies = {
+    sentry: Pick<typeof Sentry, "captureException">;
+    stderr: Pick<typeof process.stderr, "write">;
+    setExitCode: (code: number) => void;
+};
+/** Classify a top-level failure without making the CLI process boundary opaque to tests. */
+export declare function handleTopLevelError(err: unknown, deps?: TopLevelErrorDependencies): void;
 //# sourceMappingURL=main.d.ts.map

package/dist/main.js

@@ -70,6 +70,8 @@ import { CLI_VERSION } from "./cli-version.js";
 import { emitCliSessionStarted } from "./utils/cli-telemetry.js";
 import { settleWithin } from "./utils/settle-with-timeout.js";
 import { emitPlanLimitNag } from "./lib/plan-limit-nag.js";
+import { isPackageRootResolutionError, packageRootCaptureContext, } from "./utils/package-root-diagnostics.js";
+import { unexpectedCliErrorMessage } from "./utils/unexpected-cli-error.js";
 /** Hard upper bound for non-user-visible release-health finalization. */
 const RELEASE_HEALTH_SETTLE_TIMEOUT_MS = 3_000;
 // Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes
@@ -247,71 +249,7 @@ export async function runCli() {
         await program.parseAsync();
     }
     catch (err) {
-        // A broken pipe (EPIPE) means the reader of `hq`'s output closed it early
-        // (`hq … | head`, `source <(hq …)`, a parent that exited). That is normal
-        // Unix behavior with no user-facing degradation — exit cleanly (0) and
-        // skip Sentry capture instead of shipping a fatal (HQ-6B). A synchronous
-        // `write EPIPE` thrown out of console.log lands here rather than on the
-        // stream 'error' listener above.
-        if (isEpipe(err)) {
-            process.exitCode = 0;
-        }
-        else if (isInterceptedProcessExit(err)) {
-            // A security/audit FUZZ harness replaced `process.exit` with a throw so it
-            // can keep exercising the binary. Commander calling `process.exit` for
-            // normal CLI control flow (e.g. an unknown command → exit 1) then surfaces
-            // here as that synthetic marker. It is a test-harness artifact, NOT an
-            // hq-cli defect — a real user's `process.exit` just exits, so nothing is
-            // thrown or captured. Skip Sentry capture (no signal, no user-facing
-            // degradation) and preserve the intended non-zero exit (HQ-CLI-3).
-            process.exitCode = 1;
-        }
-        else if (isCompanySelectionError(err)) {
-            // The user has multiple (or zero) active company memberships and ran a
-            // command that needs exactly one without `--company`, or a `--company`
-            // slug collided across companies. That's an expected, user-actionable
-            // disambiguation prompt — the message already tells them exactly how to
-            // proceed (re-run with `--company <slug-or-uid>`) — not an hq-cli defect.
-            // The CLI can't pick a company for them. Print the actionable message and
-            // exit non-zero, but skip Sentry capture so a normal "pick a company"
-            // prompt doesn't flood the tracker with unfixable "crashes" (HQ-CLI-7).
-            process.stderr.write(`hq: ${err.message}\n`);
-            process.exitCode = 1;
-        }
-        else if (isAuthError(err)) {
-            // HQ-CLI-8: the vault API returned 401 Unauthorized — the caller's HQ
-            // session is expired or missing. That's an expected auth state the user
-            // fixes with `hq login`, not an hq-cli defect. Print the actionable
-            // message and skip Sentry so an expired login doesn't flood the tracker
-            // with identical, unfixable "crashes".
-            process.stderr.write(`hq: ${err.message}\n`);
-            process.exitCode = 1;
-        }
-        else if (isExpectedUserError(err)) {
-            // HQ-CLI-6: a user-facing, client-caused error (a non-owner running
-            // `hq integrations approve`, a stale queueId, a bad --args, an unknown
-            // connection) is the caller's request/state/permission, not an hq-cli
-            // defect. Print the actionable message and skip Sentry so a correctly-
-            // denied 4xx doesn't flood the tracker with identical, unfixable crash
-            // reports. Genuine server (5xx) / unknown failures still capture below.
-            process.stderr.write(`hq: ${err.message}\n`);
-            process.exitCode = 1;
-        }
-        else {
-            // A full disk / exhausted quota / read-only filesystem is the user's
-            // machine, not an HQ code defect. Surface a clear, actionable message and
-            // skip Sentry capture so one full disk doesn't flood the tracker with
-            // identical, unfixable crash reports (HQ-CLI-2). Genuine errors still go
-            // to Sentry and still exit 1.
-            const envMsg = environmentalFsErrorMessage(err);
-            if (envMsg) {
-                process.stderr.write(`hq: ${envMsg}\n`);
-            }
-            else {
-                Sentry.captureException(err);
-            }
-            process.exitCode = 1;
-        }
+        handleTopLevelError(err);
     }
     finally {
         // Plan-limit nag (US-016): stderr-only, never throws, never touches
@@ -326,4 +264,89 @@ export async function runCli() {
         await settleWithin([refreshVersionCache(), Sentry.flush(2000)], RELEASE_HEALTH_SETTLE_TIMEOUT_MS);
     }
 }
+const defaultTopLevelErrorDependencies = {
+    sentry: Sentry,
+    stderr: process.stderr,
+    setExitCode: (code) => {
+        process.exitCode = code;
+    },
+};
+/** Classify a top-level failure without making the CLI process boundary opaque to tests. */
+export function handleTopLevelError(err, deps = defaultTopLevelErrorDependencies) {
+    // A broken pipe (EPIPE) means the reader of `hq`'s output closed it early
+    // (`hq … | head`, `source <(hq …)`, a parent that exited). That is normal
+    // Unix behavior with no user-facing degradation — exit cleanly (0) and
+    // skip Sentry capture instead of shipping a fatal (HQ-6B). A synchronous
+    // `write EPIPE` thrown out of console.log lands here rather than on the
+    // stream 'error' listener above.
+    if (isEpipe(err)) {
+        deps.setExitCode(0);
+    }
+    else if (isInterceptedProcessExit(err)) {
+        // A security/audit FUZZ harness replaced `process.exit` with a throw so it
+        // can keep exercising the binary. Commander calling `process.exit` for
+        // normal CLI control flow (e.g. an unknown command → exit 1) then surfaces
+        // here as that synthetic marker. It is a test-harness artifact, NOT an
+        // hq-cli defect — a real user's `process.exit` just exits, so nothing is
+        // thrown or captured. Skip Sentry capture (no signal, no user-facing
+        // degradation) and preserve the intended non-zero exit (HQ-CLI-3).
+        deps.setExitCode(1);
+    }
+    else if (isCompanySelectionError(err)) {
+        // The user has multiple (or zero) active company memberships and ran a
+        // command that needs exactly one without `--company`, or a `--company`
+        // slug collided across companies. That's an expected, user-actionable
+        // disambiguation prompt — the message already tells them exactly how to
+        // proceed (re-run with `--company <slug-or-uid>`) — not an hq-cli defect.
+        // The CLI can't pick a company for them. Print the actionable message and
+        // exit non-zero, but skip Sentry capture so a normal "pick a company"
+        // prompt doesn't flood the tracker with unfixable "crashes" (HQ-CLI-7).
+        deps.stderr.write(`hq: ${err.message}\n`);
+        deps.setExitCode(1);
+    }
+    else if (isAuthError(err)) {
+        // HQ-CLI-8: the vault API returned 401 Unauthorized — the caller's HQ
+        // session is expired or missing. That's an expected auth state the user
+        // fixes with `hq login`, not an hq-cli defect. Print the actionable
+        // message and skip Sentry so an expired login doesn't flood the tracker
+        // with identical, unfixable "crashes".
+        deps.stderr.write(`hq: ${err.message}\n`);
+        deps.setExitCode(1);
+    }
+    else if (isExpectedUserError(err)) {
+        // HQ-CLI-6: a user-facing, client-caused error (a non-owner running
+        // `hq integrations approve`, a stale queueId, a bad --args, an unknown
+        // connection) is the caller's request/state/permission, not an hq-cli
+        // defect. Print the actionable message and skip Sentry so a correctly-
+        // denied 4xx doesn't flood the tracker with identical, unfixable crash
+        // reports. Genuine server (5xx) / unknown failures still capture below.
+        deps.stderr.write(`hq: ${err.message}\n`);
+        deps.setExitCode(1);
+    }
+    else if (isPackageRootResolutionError(err)) {
+        deps.stderr.write(`hq: ${err.message}\n`);
+        deps.sentry.captureException(err, {
+            contexts: packageRootCaptureContext(err),
+        });
+        deps.setExitCode(1);
+    }
+    else {
+        // A full disk / exhausted quota / read-only filesystem is the user's
+        // machine, not an HQ code defect. Surface a clear, actionable message and
+        // skip Sentry capture so one full disk doesn't flood the tracker with
+        // identical, unfixable crash reports (HQ-CLI-2). Genuine errors still go
+        // to Sentry and still exit 1.
+        const envMsg = environmentalFsErrorMessage(err);
+        if (envMsg) {
+            deps.stderr.write(`hq: ${envMsg}\n`);
+        }
+        else {
+            deps.sentry.captureException(err);
+            const userMessage = unexpectedCliErrorMessage(err);
+            if (userMessage)
+                deps.stderr.write(`hq: ${userMessage}\n`);
+        }
+        deps.setExitCode(1);
+    }
+}
 //# sourceMappingURL=main.js.map

package/dist/utils/hq-roots.d.ts

@@ -24,6 +24,7 @@
  * `import.meta.url`. A relocated script asking "where is HQ" must get the live
  * tree, not the package it happens to be bundled in.
  */
+import * as fs from "fs";
 /** Where bundled scaffold assets live, relative to the package root. */
 export declare const BUNDLED_ASSET_DIR: string;
 /**
@@ -35,6 +36,21 @@ export declare const BUNDLED_ASSET_DIR: string;
  * checkout without a personal overlay, and a personal-only overlay.
  */
 export declare function isHqRoot(dir: string): boolean;
+export type PackageRootFs = Pick<typeof fs, "existsSync" | "readFileSync" | "realpathSync" | "statSync">;
+export type PackageRootResolverOptions = {
+    /** Directory containing the currently-running compiled module. */
+    moduleDir: string;
+    /** Full module path used only in safe diagnostic output. */
+    modulePath?: string;
+    /** Injectable filesystem seam for resolver tests. */
+    fs?: PackageRootFs;
+};
+/**
+ * Make a resolver for this package's root. It caches only a successful lookup:
+ * a concurrently replaced manifest must be retried by the next command, not
+ * converted into a permanent process failure.
+ */
+export declare function createPackageRootResolver(options: PackageRootResolverOptions): () => string;
 /**
  * This package's installed root — the directory holding its `package.json`.
  *

package/dist/utils/hq-roots.js

@@ -27,6 +27,7 @@
 import * as fs from "fs";
 import * as path from "path";
 import { fileURLToPath } from "url";
+import { PackageRootResolutionError, } from "./package-root-diagnostics.js";
 /** This package's name, used to identify its root when walking upward. */
 const CLI_PACKAGE_NAME = "@indigoai-us/hq-cli";
 /**
@@ -60,54 +61,135 @@ export function isHqRoot(dir) {
             fs.existsSync(path.join(dir, "core")) ||
             fs.existsSync(path.join(dir, "personal"))));
 }
-function realpathOrResolve(p) {
+function realpathOrResolve(p, fileSystem = fs) {
     try {
-        return fs.realpathSync(p);
+        return fileSystem.realpathSync(p);
     }
     catch {
         return path.resolve(p);
     }
 }
-let cachedPackageRoot;
+function errorCode(err) {
+    if (err && typeof err === "object" && "code" in err) {
+        const code = err.code;
+        return typeof code === "string" ? code : undefined;
+    }
+    return undefined;
+}
+function failureOutcome(code) {
+    if (code === "ENOENT")
+        return "no-manifest";
+    if (code === "EACCES")
+        return "eacces";
+    if (code === "EISDIR")
+        return "eisdir";
+    return "read-error";
+}
 /**
- * This package's installed root — the directory holding its `package.json`.
- *
- * Walks up from the compiled module (`dist/utils/hq-roots.js`) until it finds a
- * `package.json` whose name matches, rather than hard-coding `..` hops, so the
- * answer survives a change in output layout.
+ * Make a resolver for this package's root. It caches only a successful lookup:
+ * a concurrently replaced manifest must be retried by the next command, not
+ * converted into a permanent process failure.
  */
-export function packageRoot() {
-    if (cachedPackageRoot === null) {
-        throw new Error(`Could not locate the ${CLI_PACKAGE_NAME} package root from ${import.meta.url}.`);
-    }
-    if (cachedPackageRoot !== undefined)
-        return cachedPackageRoot;
-    let dir = path.dirname(fileURLToPath(import.meta.url));
-    for (;;) {
-        const manifest = path.join(dir, "package.json");
-        if (fs.existsSync(manifest)) {
+export function createPackageRootResolver(options) {
+    const fileSystem = options.fs ?? fs;
+    const modulePath = options.modulePath ?? options.moduleDir;
+    let cachedPackageRoot;
+    return () => {
+        if (cachedPackageRoot !== undefined)
+            return cachedPackageRoot;
+        const visited = [];
+        let dir = options.moduleDir;
+        for (;;) {
+            const manifest = path.join(dir, "package.json");
             try {
-                const parsed = JSON.parse(fs.readFileSync(manifest, "utf8"));
+                const parsed = JSON.parse(fileSystem.readFileSync(manifest, "utf8"));
                 if (parsed.name === CLI_PACKAGE_NAME) {
-                    cachedPackageRoot = realpathOrResolve(dir);
+                    cachedPackageRoot = realpathOrResolve(dir, fileSystem);
                     return cachedPackageRoot;
                 }
+                visited.push({
+                    directory: dir,
+                    outcome: "name-mismatch",
+                    manifestName: String(parsed.name),
+                });
             }
-            catch {
-                // A malformed package.json on the way up is not our package; keep going.
+            catch (err) {
+                const code = errorCode(err);
+                if (code) {
+                    visited.push({ directory: dir, outcome: failureOutcome(code), code });
+                }
+                else {
+                    visited.push({ directory: dir, outcome: "parse-error" });
+                }
             }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
         }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    cachedPackageRoot = null;
-    throw new Error(`Could not locate the ${CLI_PACKAGE_NAME} package root from ${import.meta.url}.`);
+        let fallbackRejectedBecause = "no dist-owner ancestor";
+        try {
+            const resolvedModuleDir = fileSystem.realpathSync(options.moduleDir);
+            let candidate = resolvedModuleDir;
+            for (;;) {
+                const relativeModulePath = path.relative(candidate, resolvedModuleDir);
+                if (relativeModulePath.split(path.sep)[0] === "dist") {
+                    const assetDir = path.join(candidate, BUNDLED_ASSET_DIR);
+                    try {
+                        if (fileSystem.existsSync(assetDir) && fileSystem.statSync(assetDir).isDirectory()) {
+                            cachedPackageRoot = candidate;
+                            return cachedPackageRoot;
+                        }
+                        fallbackRejectedBecause =
+                            "deepest dist-owner lacks assets/scaffold";
+                    }
+                    catch (err) {
+                        fallbackRejectedBecause =
+                            `could not inspect deepest dist-owner assets/scaffold (${errorCode(err) ?? "unknown"})`;
+                    }
+                    // Never climb to a shallower dist owner after the nearest owner fails.
+                    break;
+                }
+                const parent = path.dirname(candidate);
+                if (parent === candidate)
+                    break;
+                candidate = parent;
+            }
+        }
+        catch (err) {
+            fallbackRejectedBecause =
+                `could not realpath module directory (${errorCode(err) ?? "unknown"})`;
+        }
+        throw new PackageRootResolutionError({
+            modulePath,
+            startDir: options.moduleDir,
+            strategiesTried: ["manifest-walk", "dist-owner-fallback"],
+            visited,
+            fallbackRejectedBecause,
+        });
+    };
+}
+const currentModulePath = fileURLToPath(import.meta.url);
+let defaultPackageRootResolver = createPackageRootResolver({
+    moduleDir: path.dirname(currentModulePath),
+    modulePath: currentModulePath,
+});
+/**
+ * This package's installed root — the directory holding its `package.json`.
+ *
+ * Walks up from the compiled module (`dist/utils/hq-roots.js`) until it finds a
+ * `package.json` whose name matches, rather than hard-coding `..` hops, so the
+ * answer survives a change in output layout.
+ */
+export function packageRoot() {
+    return defaultPackageRootResolver();
 }
 /** Reset the memoized package root. Tests only. */
 export function __resetPackageRootCache() {
-    cachedPackageRoot = undefined;
+    defaultPackageRootResolver = createPackageRootResolver({
+        moduleDir: path.dirname(currentModulePath),
+        modulePath: currentModulePath,
+    });
 }
 /**
  * Resolve the user's live HQ installation.

package/dist/utils/package-root-diagnostics.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Bounded diagnostics for failures to locate the CLI package root.
+ *
+ * These values are sent to Sentry, whose general scrubber deliberately keeps
+ * filesystem paths intact. Keep this module the single construction boundary
+ * so a malformed install cannot turn an error report into an unbounded or
+ * multi-line payload.
+ */
+export type PackageRootVisitOutcome = "no-manifest" | "eacces" | "eisdir" | "parse-error" | "name-mismatch" | "read-error" | "omitted";
+export type PackageRootVisit = {
+    directory: string;
+    outcome: PackageRootVisitOutcome;
+    code?: string;
+    manifestName?: string;
+};
+export type PackageRootResolutionDiagnostics = {
+    modulePath: string;
+    startDir: string;
+    strategiesTried: string[];
+    visited: PackageRootVisit[];
+    fallbackRejectedBecause: string;
+};
+type RawDiagnostics = {
+    modulePath: string;
+    startDir: string;
+    strategiesTried: string[];
+    visited: PackageRootVisit[];
+    fallbackRejectedBecause: string;
+};
+/** Replace every Unicode control character before bounding a diagnostic value. */
+export declare function boundedDiagnosticValue(value: unknown, maxBytes: number): string;
+/** An unmarked packaging fault that should remain visible in Sentry. */
+export declare class PackageRootResolutionError extends Error {
+    readonly diagnostics: PackageRootResolutionDiagnostics;
+    constructor(raw: RawDiagnostics);
+}
+export declare function isPackageRootResolutionError(err: unknown): err is PackageRootResolutionError;
+/**
+ * Produce the exact Sentry contexts shape while enforcing a whole-payload cap.
+ * The tail is dropped first because nearest directories contain the useful
+ * evidence for a package-root walk.
+ */
+export declare function packageRootCaptureContext(err: PackageRootResolutionError): {
+    package_root_resolution: PackageRootResolutionDiagnostics;
+};
+export {};
+//# sourceMappingURL=package-root-diagnostics.d.ts.map

package/dist/utils/package-root-diagnostics.js

@@ -0,0 +1,120 @@
+/**
+ * Bounded diagnostics for failures to locate the CLI package root.
+ *
+ * These values are sent to Sentry, whose general scrubber deliberately keeps
+ * filesystem paths intact. Keep this module the single construction boundary
+ * so a malformed install cannot turn an error report into an unbounded or
+ * multi-line payload.
+ */
+import { beforeSend } from "../sentry-before-send.js";
+const CONTROL_CHARACTER = /[\p{C}\p{Zl}\p{Zp}]/gu;
+const REPLACEMENT = "?";
+const ELLIPSIS = "…";
+const MODULE_PATH_BYTES = 256;
+const START_DIR_BYTES = 256;
+const DIRECTORY_BYTES = 256;
+const MANIFEST_NAME_BYTES = 64;
+const CODE_BYTES = 32;
+const MESSAGE_BYTES = 2048;
+const CONTEXT_BYTES = 4096;
+const MAX_VISITED = 12;
+/** Replace every Unicode control character before bounding a diagnostic value. */
+export function boundedDiagnosticValue(value, maxBytes) {
+    const normalized = String(value).replace(CONTROL_CHARACTER, REPLACEMENT);
+    if (Buffer.byteLength(normalized, "utf8") <= maxBytes)
+        return normalized;
+    const markerBytes = Buffer.byteLength(ELLIPSIS, "utf8");
+    let result = "";
+    let used = 0;
+    for (const character of normalized) {
+        const bytes = Buffer.byteLength(character, "utf8");
+        if (used + bytes + markerBytes > maxBytes)
+            break;
+        result += character;
+        used += bytes;
+    }
+    return result + ELLIPSIS;
+}
+function boundedVisit(visit) {
+    return {
+        directory: boundedDiagnosticValue(visit.directory, DIRECTORY_BYTES),
+        outcome: visit.outcome,
+        ...(visit.code === undefined
+            ? {}
+            : { code: boundedDiagnosticValue(visit.code, CODE_BYTES) }),
+        ...(visit.manifestName === undefined
+            ? {}
+            : { manifestName: boundedDiagnosticValue(visit.manifestName, MANIFEST_NAME_BYTES) }),
+    };
+}
+function boundedVisits(visits) {
+    if (visits.length <= MAX_VISITED)
+        return visits.map(boundedVisit);
+    const shown = visits.slice(0, MAX_VISITED - 1).map(boundedVisit);
+    shown.push({
+        directory: `${visits.length - shown.length} more omitted`,
+        outcome: "omitted",
+    });
+    return shown;
+}
+function normalizeDiagnostics(raw) {
+    return {
+        modulePath: boundedDiagnosticValue(raw.modulePath, MODULE_PATH_BYTES),
+        startDir: boundedDiagnosticValue(raw.startDir, START_DIR_BYTES),
+        strategiesTried: raw.strategiesTried.map((strategy) => boundedDiagnosticValue(strategy, CODE_BYTES)),
+        visited: boundedVisits(raw.visited),
+        fallbackRejectedBecause: boundedDiagnosticValue(raw.fallbackRejectedBecause, DIRECTORY_BYTES),
+    };
+}
+function messageFor(diagnostics) {
+    return boundedDiagnosticValue("Could not locate the @indigoai-us/hq-cli package root from " +
+        `${diagnostics.modulePath}; manifest walk exhausted from ${diagnostics.startDir}; ` +
+        `dist-owner fallback ${diagnostics.fallbackRejectedBecause}.`, MESSAGE_BYTES);
+}
+/** An unmarked packaging fault that should remain visible in Sentry. */
+export class PackageRootResolutionError extends Error {
+    diagnostics;
+    constructor(raw) {
+        const diagnostics = normalizeDiagnostics(raw);
+        super(messageFor(diagnostics));
+        this.name = "PackageRootResolutionError";
+        this.diagnostics = diagnostics;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export function isPackageRootResolutionError(err) {
+    return err instanceof PackageRootResolutionError;
+}
+/**
+ * Produce the exact Sentry contexts shape while enforcing a whole-payload cap.
+ * The tail is dropped first because nearest directories contain the useful
+ * evidence for a package-root walk.
+ */
+export function packageRootCaptureContext(err) {
+    const context = {
+        ...err.diagnostics,
+        strategiesTried: [...err.diagnostics.strategiesTried],
+        visited: err.diagnostics.visited.map((visit) => ({ ...visit })),
+    };
+    let sentryContext = scrubbedContext(context);
+    while (Buffer.byteLength(JSON.stringify({ package_root_resolution: sentryContext }), "utf8") >
+        CONTEXT_BYTES &&
+        context.visited.length > 0) {
+        context.visited.pop();
+        sentryContext = scrubbedContext(context);
+    }
+    return { package_root_resolution: sentryContext };
+}
+/** Apply the repository's canonical credential scrubber before calculating caps. */
+function scrubbedContext(context) {
+    const event = {
+        type: undefined,
+        contexts: { package_root_resolution: context },
+    };
+    const scrubbed = beforeSend(event, {});
+    if (!scrubbed?.contexts?.package_root_resolution) {
+        throw new Error("Package root diagnostics were unexpectedly dropped by Sentry scrubbing.");
+    }
+    return scrubbed.contexts.package_root_resolution;
+}
+//# sourceMappingURL=package-root-diagnostics.js.map

package/dist/utils/unexpected-cli-error.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Return a bounded operator-facing diagnostic for unexpected errors whose
+ * messages are already part of a user-facing protocol contract. Unknown
+ * exceptions remain Sentry-only so local implementation details and secrets
+ * are not printed indiscriminately.
+ */
+export declare function unexpectedCliErrorMessage(err: unknown): string | null;
+//# sourceMappingURL=unexpected-cli-error.d.ts.map

package/dist/utils/unexpected-cli-error.js

@@ -0,0 +1,24 @@
+import { IntegrationsCliError } from "../commands/integrations.js";
+/**
+ * Return a bounded operator-facing diagnostic for unexpected errors whose
+ * messages are already part of a user-facing protocol contract. Unknown
+ * exceptions remain Sentry-only so local implementation details and secrets
+ * are not printed indiscriminately.
+ */
+export function unexpectedCliErrorMessage(err) {
+    if (!(err instanceof IntegrationsCliError) || err.expected)
+        return null;
+    const message = err.message
+        .replace(/-----BEGIN[^-]+PRIVATE KEY-----[\s\S]*?-----END[^-]+PRIVATE KEY-----/g, "[REDACTED]")
+        .replace(/\p{Cc}/gu, " ")
+        .replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, "[REDACTED]")
+        .replace(/\b(password|secret|client[_-]?secret|api[_-]?key|(?:id|access|refresh)[_-]?token|token|authorization)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s&"'<>;,}]+)/gi, (_match, label) => `${label}=[REDACTED]`)
+        .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]")
+        .replace(/\b(?:hqk_|xox[abprs]-|github_pat_|gh[pousr]_)[A-Za-z0-9_-]+\b/gi, "[REDACTED]")
+        .replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]")
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, 1_000);
+    return message || "Integration request failed";
+}
+//# sourceMappingURL=unexpected-cli-error.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.84.0",
+  "version": "5.85.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {