feat: guest login credentials, stale-key handling, and sign-in link refresh - #306

hookdeck 2.5.0

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre>## Summary

This release makes the CLI safe to run where there is no human: CI, Docker, `nohup`, and AI agents. Nine fixes, most sharing one failure shape — the CLI would silently do something other than what you asked, and the first symptom was missing traffic rather than an error. `hookdeck listen` now works headlessly and honours `HOOKDECK_API_KEY`, `--local` no longer touches your global config, and empty secrets are rejected instead of quietly producing a source that verifies nothing.

It also ships the guest login improvements merged after v2.4.0.

## New features

- **`hookdeck listen` reads `HOOKDECK_API_KEY`.** Running the CLI in CI no longer needs a separate `hookdeck ci` step — export a Project API key and `listen` exchanges it for CLI credentials, saves them, and connects to your project:

  ```sh
  export HOOKDECK_API_KEY="your-project-api-key"
  hookdeck listen 3000 shopify orders
  ```

  Precedence is `--cli-key`, then your stored login, then `HOOKDECK_API_KEY`. An existing login is never repointed by the environment — but a temporary guest profile is, so a machine that once ran `listen` without credentials still picks up your project when the variable is set. Replacing a guest profile prints a notice with the sandbox URL rather than swapping accounts silently.

- **`hookdeck listen` detects when there is no terminal** and uses compact output automatically, so it works under CI, Docker, `nohup`, and coding agents with no flags. Pass `--output compact` or `--output quiet` to get the same behaviour on a machine that does have a terminal.

## Fixes

Three of these turn a silent success into a clear failure. Nothing was removed or renamed, but if you have automation that depended on the old behaviour, these are the ones to check.

- **`hookdeck listen` no longer dies at startup without a terminal.** It defaulted to a full-screen UI that opens `/dev/tty`; anywhere without one it failed with `could not open a new TTY` and **exited 0 having forwarded nothing** — no tunnel, no error, nothing to attribute the failure to. ([#333](hookdeck/hookdeck-cli#333), [#339](hookdeck/hookdeck-cli#339))

- **`hookdeck listen` no longer silently creates a guest account when `HOOKDECK_API_KEY` is set.** Events still arrived on your machine, so it looked like it worked — but they went to a throwaway account with no connection, delivery history, retries, or issue triggers, not the project you configured. ([#334](hookdeck/hookdeck-cli#334))

- **`hookdeck ci --local` and `hookdeck login --local` no longer rewrite your global config.** `--local` added a second write rather than redirecting the first, so it silently switched the active project for every other `hookdeck` command on the machine — the opposite of what the flag is for. ([#332](hookdeck/hookdeck-cli#332))

- **Empty secret and identity flags are now rejected.** An unexported shell variable expands to an empty string, and the CLI accepted it: `hookdeck gateway source create --type STRIPE --webhook-secret "$UNSET_VAR"` produced a source with **no verification at all** while looking configured, so it rejected every genuinely signed request. `--webhook-secret ""`, `--source-webhook-secret ""`, `--name ""` and similar now error with a message naming the likely cause. To clear verification deliberately, use the JSON escape hatch: `--config '{"auth": null}'`. ([#335](hookdeck/hookdeck-cli#335))

- **`delete` and `dismiss` no longer exit 0 without doing anything.** Without a terminal these commands skipped the confirmation prompt, printed `Deletion cancelled.` and exited 0 — so a CI job deleted nothing and reported success. They now exit non-zero and tell you to pass `--force`. ([#338](hookdeck/hookdeck-cli#338))

- **Unauthenticated commands no longer hang for four minutes.** Any command run without credentials dropped into interactive sign-in, blocking on a prompt and opening a browser even on a machine with no display. Without a terminal it now exits immediately with instructions for `hookdeck ci`, `HOOKDECK_API_KEY` and `hookdeck login --cli-key`. ([#337](hookdeck/hookdeck-cli#337))

## Improvements / behavior changes

- **Guest login improvements** (merged after v2.4.0): guest credentials are now persisted and attested on login, guest sign-in links refresh while `listen` runs, and a stale key is preserved rather than discarded when validation returns 401. Note one behaviour change: with a guest profile, `hookdeck login` now always opens the browser to claim your sandbox instead of short-circuiting on a valid key. To attach the CLI to an existing Hookdeck account, run `hookdeck logout` then `hookdeck login`. ([#306](hookdeck/hookdeck-cli#306))

- README and `hookdeck listen --help` now describe running in CI accurately. The previous CI example showed a full-screen UI as the expected output while documenting an environment variable `listen` ignored — the exact combination the two bugs above disprove.

## Internal / reliability / infrastructure

- The root `--cli-key` flag is now hidden, matching `--api-key` beside it. Authentication is command-specific — `hookdeck login --cli-key`, `hookdeck listen --cli-key`, `hookdeck ci --api-key` — and those remain documented. The global flag still works for anyone already passing it; it is simply no longer advertised as a global option. It was added in #306 and never shipped in a release, so nothing that worked in v2.4.0 changes.
- Dropped `go-github` v28, whose only use was a single unauthenticated release check and whose only other effect was linking `golang.org/x/crypto/openpgp` — the unmaintained package flagged by GO-2026-5932, for which no fixed version exists. Replaced with a direct `net/http` call, which is now covered by tests for the first time. ([#331](hookdeck/hookdeck-cli#331))
- Added a `govulncheck` job to CI, so a clean scan is enforced rather than asserted once.
- Fixed the release skill's CI gate, which read the legacy commit-status API that GitHub Actions never writes and so reported `pending` unconditionally, blocking every release. ([#336](hookdeck/hookdeck-cli#336))

**Full Changelog**: hookdeck/hookdeck-cli@v2.4.0...v2.5.0









</pre>
  <p>View the full release notes at <a href="https://github.com/hookdeck/hookdeck-cli/releases/tag/v2.5.0">https://github.com/hookdeck/hookdeck-cli/releases/tag/v2.5.0</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!16506