@indigoai-us/hq-cli 5.103.20 → 5.103.22

package/dist/commands/integrations-core.js

@@ -199,6 +199,14 @@ export function toolPrefixForProvider(provider) {
 export function bareProvider(provider) {
     return provider.replace(/^factory:/, "");
 }
+/** Turn a factory display name into the human-friendly slug people type. */
+function humanSlug(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
 /**
  * Read the whole admin surface: connections with their governance state, the
  * viewer's role, and the recent audit feed. Several verbs need more than the
@@ -231,8 +239,10 @@ export async function fetchConnections(token, companyUid) {
 }
 /**
  * Resolve one connection by `--connection acct_…` or `--provider linear`
- * (matches `factory:<slug>` and bare provider ids, case-insensitive). Errors
- * list what IS connected so the fix is one command away.
+ * (matches `factory:<slug>`, bare provider ids, and an installation's human
+ * display-name slug, case-insensitive). The legacy provider id remains a
+ * first-class match, so scripts that saved opaque historical slugs keep
+ * working. Errors list what IS connected so the fix is one command away.
  */
 export function selectConnection(connections, opts) {
     const active = connections.filter((c) => c.status !== "revoked");
@@ -245,16 +255,40 @@ export function selectConnection(connections, opts) {
     }
     if (opts.provider) {
         const want = opts.provider.trim().toLowerCase();
-        const match = active.find((c) => {
-            const bare = bareProvider(c.provider).toLowerCase();
-            return bare === want || c.provider.toLowerCase() === want;
-        });
-        if (!match) {
-            const available = active.map((c) => bareProvider(c.provider)).join(", ");
-            throw new IntegrationsCliError(`No connected app matches '${opts.provider}'.` +
-                (available ? ` Connected: ${available}.` : " Nothing is connected yet — connect apps with `hq integrations connect <app>`."), { expected: true });
+        const wantHumanSlug = humanSlug(opts.provider);
+        // A reconnect normally leaves a revoked historical row alongside its new
+        // active connection. Prefer the active inventory before applying the
+        // provider/name/alias precedence below; fall back to history only when no
+        // active row matches this selector at all. `--connection` above remains
+        // the explicit way to inspect or act on a particular historical row.
+        const activeMatches = connections.filter((c) => c.status !== "revoked" &&
+            (bareProvider(c.provider).toLowerCase() === want ||
+                c.provider.toLowerCase() === want ||
+                c.installation?.displayName?.trim().toLowerCase() === want ||
+                (wantHumanSlug !== "" &&
+                    humanSlug(c.installation?.displayName ?? "") === wantHumanSlug)));
+        const candidates = activeMatches.length > 0 ? activeMatches : connections;
+        const providerMatch = candidates.find((c) => bareProvider(c.provider).toLowerCase() === want || c.provider.toLowerCase() === want);
+        if (providerMatch)
+            return providerMatch;
+        const displayNameMatch = candidates.find((c) => c.installation?.displayName?.trim().toLowerCase() === want);
+        if (displayNameMatch)
+            return displayNameMatch;
+        const aliasMatches = wantHumanSlug
+            ? candidates.filter((c) => {
+                const displayName = c.installation?.displayName;
+                const displayNameSlug = displayName ? humanSlug(displayName) : "";
+                return displayNameSlug !== "" && displayNameSlug === wantHumanSlug;
+            })
+            : [];
+        if (aliasMatches.length === 1)
+            return aliasMatches[0];
+        if (aliasMatches.length > 1) {
+            throw new IntegrationsCliError(`Display-name alias '${opts.provider}' matches multiple connected apps. Use --connection to choose one.`, { expected: true });
         }
-        return match;
+        const available = connections.map((c) => bareProvider(c.provider)).join(", ");
+        throw new IntegrationsCliError(`No connected app matches '${opts.provider}'.` +
+            (available ? ` Connected: ${available}.` : " Nothing is connected yet — connect apps with `hq integrations connect <app>`."), { expected: true });
     }
     if (active.length === 1)
         return active[0];
@@ -264,17 +298,59 @@ export function selectConnection(connections, opts) {
     throw new IntegrationsCliError(`Multiple apps are connected — pick one with --provider:\n` +
         active.map((c) => `  --provider ${bareProvider(c.provider)}`).join("\n"), { expected: true });
 }
+/**
+ * The hostname re-add needs. Prefer the server's canonical installation domain;
+ * an older row may only retain its MCP URL, and provider is the last-resort
+ * human-safe query when neither was stored.
+ */
+export function connectionDomain(connection) {
+    const domain = connection.installation?.domain?.trim();
+    if (domain)
+        return domain;
+    const url = connection.installation?.surface?.url;
+    if (url) {
+        try {
+            const host = new URL(url).hostname;
+            if (host)
+                return host;
+        }
+        catch {
+            // The saved endpoint is advisory here. A malformed legacy URL must not
+            // prevent recovery when the provider slug can still be re-added.
+        }
+    }
+    return bareProvider(connection.provider);
+}
+/** A revoked row is still addressable, but it cannot make a live MCP call. */
+export function revokedConnectionDetails(connection, companySlug) {
+    const domain = connectionDomain(connection);
+    return {
+        status: "revoked",
+        reason: "This connection was revoked and cannot be used until it is re-added.",
+        fixPath: `hq integrations connect ${domain}` +
+            (companySlug ? ` --company ${companySlug}` : ""),
+    };
+}
 /**
  * Resolve a connection the caller named positionally OR through the
  * `--provider` / `--connection` flags. Every management verb takes an optional
  * `<app>` argument for ergonomics (`hq integrations policy linear …`), which is
  * matched exactly like `--provider` unless it looks like a connection id.
  */
-export async function resolveConnection(token, companyUid, app, opts) {
+export async function resolveConnection(token, companyUid, app, opts, recoveryOpts = {}) {
     const connections = await fetchConnections(token, companyUid);
     if (app && !opts.provider && !opts.connection) {
         return selectConnection(connections, app.startsWith("acct_") ? { connection: app } : { provider: app });
     }
+    // Normal management verbs deliberately ignore revoked rows for implicit
+    // selection. Reconnect's explicit --connect recovery is the one exception:
+    // a sole revoked row is unambiguous and needs its saved domain to revive.
+    if (recoveryOpts.allowSingleRevoked &&
+        !opts.provider &&
+        !opts.connection &&
+        connections.length === 1) {
+        return connections[0];
+    }
     return selectConnection(connections, opts);
 }
 export async function callGateway(token, params) {

package/dist/commands/integrations-import.d.ts

@@ -0,0 +1,24 @@
+import { Command } from "commander";
+import { type McpManifest } from "./mcp-registration.js";
+export type DesktopConnector = McpManifest & {
+    [key: string]: unknown;
+};
+export type ImportStatus = "imported" | "needs-signin" | "shared-for-local" | "skipped";
+export interface ImportOutcome {
+    name: string;
+    status: ImportStatus;
+    reason?: string;
+    provider?: string;
+    path?: string;
+    installCommand?: string;
+    authorizationUrl?: string;
+    redactedArgumentCredentials?: boolean;
+}
+/** Claude Desktop's documented connector-config location for the current OS. */
+export declare function claudeDesktopConfigPath(platform?: NodeJS.Platform, home?: string, env?: NodeJS.ProcessEnv): string;
+/** Read only the supported Claude Desktop `mcpServers` object. */
+export declare function readClaudeDesktopConnectors(configPath?: string): Record<string, DesktopConnector>;
+/** Never persist local desktop credentials in a company-synced connector file. */
+export declare function stripConnectorSecrets(entry: DesktopConnector): McpManifest;
+export declare function registerImportCommands(integrations: Command): void;
+//# sourceMappingURL=integrations-import.d.ts.map

package/dist/commands/integrations-import.js

@@ -0,0 +1,364 @@
+/**
+ * Import Claude Desktop MCP connectors into an HQ company.
+ *
+ * Remote servers are handed to integration-factory; stdio servers remain local
+ * and are shared as secret-stripped manifests for each teammate to install.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import chalk from "chalk";
+import { ensureCognitoIdToken, ensureCognitoToken, resolveDefaultHqRoot } from "../utils/cognito-session.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { bareProvider, IntegrationsCliError, printJson } from "./integrations-core.js";
+import { installIntegration, startOAuth } from "./integrations-api.js";
+import { loadRevealedSecrets } from "./secrets.js";
+import { registerServer } from "./mcp-registration.js";
+const OAUTH_REQUIRED_CODE = "INTEGRATION_FACTORY_OAUTH_REQUIRED";
+/** Claude Desktop's documented connector-config location for the current OS. */
+export function claudeDesktopConfigPath(platform = process.platform, home = os.homedir(), env = process.env) {
+    if (platform === "darwin") {
+        return path.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    }
+    if (platform === "win32") {
+        const appData = env.APPDATA?.trim();
+        return path.join(appData || path.join(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+    }
+    return path.join(home, ".config", "Claude", "claude_desktop_config.json");
+}
+/** Read only the supported Claude Desktop `mcpServers` object. */
+export function readClaudeDesktopConnectors(configPath = claudeDesktopConfigPath()) {
+    if (!fs.existsSync(configPath))
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new IntegrationsCliError(`Could not parse Claude Desktop connector config at ${configPath}: ${message}`, {
+            expected: true,
+        });
+    }
+    if (!parsed || typeof parsed !== "object")
+        return {};
+    const servers = parsed.mcpServers;
+    if (!servers || typeof servers !== "object" || Array.isArray(servers))
+        return {};
+    return Object.fromEntries(Object.entries(servers).filter((entry) => Boolean(entry[1]) && typeof entry[1] === "object" && !Array.isArray(entry[1])));
+}
+function selectedNames(value) {
+    if (value === undefined)
+        return undefined;
+    const names = value.split(",").map((name) => name.trim()).filter(Boolean);
+    if (names.length === 0) {
+        throw new IntegrationsCliError("--only needs at least one connector name.", { expected: true });
+    }
+    return new Set(names);
+}
+function providerSlug(name) {
+    const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+    return slug || "desktop-mcp";
+}
+function safeConnectorName(name) {
+    return /^[a-z0-9_-]+$/.test(name) ? name : null;
+}
+function secretReference(name) {
+    const normalized = name.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+    const resolverSafe = /^[A-Z]/.test(normalized) ? normalized : `SECRET_${normalized.replace(/^_+/, "")}`;
+    return `\${secret:${resolverSafe || "CONNECTOR_SECRET"}}`;
+}
+const CREDENTIAL_ARGUMENT_FLAG = /^(?:--)?(?:api[-_]?key|token|password|secret|apikey|auth|bearer|client[-_]?secret)$/i;
+function argumentSecretName(flag) {
+    return flag.replace(/^--?/, "").toUpperCase().replace(/[^A-Z0-9]+/g, "_") || "ARGUMENT_SECRET";
+}
+/** Redact explicit credential flags and standalone token-shaped argument values. */
+function redactConnectorArguments(args) {
+    let redacted = false;
+    const clean = args.map((arg, index) => {
+        const [flag, inlineValue] = arg.split("=", 2);
+        if (CREDENTIAL_ARGUMENT_FLAG.test(flag)) {
+            redacted = true;
+            return inlineValue === undefined ? arg : `${flag}=${secretReference(argumentSecretName(flag))}`;
+        }
+        if (index > 0 && CREDENTIAL_ARGUMENT_FLAG.test(args[index - 1])) {
+            redacted = true;
+            return secretReference(argumentSecretName(args[index - 1]));
+        }
+        // Avoid treating package names and URLs as tokens, but err on the side of
+        // safety for opaque, mixed-character strings commonly used as credentials.
+        if (!arg.startsWith("-") && !/[/@:]/.test(arg) && arg.length >= 16 && /[A-Za-z]/.test(arg) && /\d/.test(arg)) {
+            redacted = true;
+            return secretReference("ARGUMENT_SECRET");
+        }
+        return arg;
+    });
+    return { args: clean, redacted };
+}
+function connectorArguments(entry) {
+    return Array.isArray(entry.args) && entry.args.every((arg) => typeof arg === "string") ? entry.args : [];
+}
+function hasRedactedArgumentCredentials(entry) {
+    return redactConnectorArguments(connectorArguments(entry)).redacted;
+}
+/** Never persist local desktop credentials in a company-synced connector file. */
+export function stripConnectorSecrets(entry) {
+    const stringMap = (value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return undefined;
+        const clean = Object.entries(value).filter((pair) => typeof pair[1] === "string")
+            .map(([key]) => [key, secretReference(key)]);
+        return clean.length > 0 ? Object.fromEntries(clean) : undefined;
+    };
+    const args = redactConnectorArguments(connectorArguments(entry)).args;
+    return {
+        type: typeof entry.command === "string" ? "stdio" : entry.type,
+        ...(typeof entry.command === "string" ? { command: entry.command } : {}),
+        ...(typeof entry.url === "string" ? { url: entry.url } : {}),
+        ...(typeof entry.command === "string" ? { args } : {}),
+        ...(stringMap(entry.env) ? { env: stringMap(entry.env) } : {}),
+        ...(stringMap(entry.headers) ? { headers: stringMap(entry.headers) } : {}),
+    };
+}
+function isLocal(entry) {
+    return typeof entry.command === "string";
+}
+function isRemote(entry) {
+    return typeof entry.url === "string";
+}
+function staticCredential(entry) {
+    if (!entry.headers || typeof entry.headers !== "object" || Array.isArray(entry.headers))
+        return undefined;
+    for (const [key, raw] of Object.entries(entry.headers)) {
+        if (typeof raw !== "string" || raw.trim() === "")
+            continue;
+        if (!/(authorization|api[-_]?key|token|secret)/i.test(key))
+            continue;
+        if (/^authorization$/i.test(key) && /^Bearer\s+/i.test(raw)) {
+            return { value: raw.replace(/^Bearer\s+/i, "").trim() };
+        }
+        return { value: raw.trim(), authScheme: { placement: "header", header: key } };
+    }
+    return undefined;
+}
+function oauthRequired(error) {
+    return error instanceof IntegrationsCliError &&
+        (error.code === OAUTH_REQUIRED_CODE || error.oauthProtected === true);
+}
+function reconnectCommand(name, provider) {
+    return `hq integrations reconnect ${name} --provider ${bareProvider(provider)}`;
+}
+function connectorPath(hqRoot, company, name) {
+    return path.join(hqRoot, "companies", company, "settings", "connectors", `${name}.json`);
+}
+/**
+ * The API's default-company resolver returns a UID, while the synced on-disk
+ * layout is deliberately slug-addressed. Read the same active membership set
+ * to retain its canonical slug instead of inventing a folder from an ID.
+ */
+async function companyFolderSlug(token, companyUid) {
+    const response = await vaultApiFetch({ token, path: "/membership/me" });
+    if (!response.ok) {
+        throw new IntegrationsCliError("Could not resolve the active company's slug for the shared connector folder.", {
+            expected: true,
+        });
+    }
+    const body = (await response.json());
+    const membership = body.memberships?.find((candidate) => candidate.status === "active" && candidate.companyUid === companyUid);
+    const folderSlug = membership?.companyFolderSlug ?? membership?.companySlug;
+    if (!folderSlug) {
+        throw new IntegrationsCliError("The active company has no slug. Re-run with --company <slug> to choose the shared connector folder.", { expected: true });
+    }
+    return folderSlug;
+}
+function writeLocalConnector(hqRoot, company, name, entry) {
+    const target = connectorPath(hqRoot, company, name);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, `${JSON.stringify(stripConnectorSecrets(entry), null, 2)}\n`, { mode: 0o600 });
+    return target;
+}
+async function importRemote(token, companyUid, name, entry, dryRun) {
+    const provider = providerSlug(name);
+    if (dryRun)
+        return { name, status: "imported", reason: "would connect remote MCP endpoint", provider };
+    const credential = staticCredential(entry);
+    try {
+        const result = await installIntegration(token, companyUid, {
+            mcpUrl: entry.url,
+            provider,
+            displayName: name,
+            ...(credential ? { authMode: "bearer", bearerToken: credential.value, ...(credential.authScheme ? { authScheme: credential.authScheme } : {}) } : {}),
+        });
+        const resultProvider = bareProvider(result.connection.provider);
+        if (result.installation.status === "needs_credentials" || result.credential?.configured === false) {
+            return {
+                name,
+                status: "needs-signin",
+                provider: resultProvider,
+                reason: reconnectCommand(name, resultProvider),
+            };
+        }
+        return { name, status: "imported", provider: resultProvider };
+    }
+    catch (error) {
+        if (!oauthRequired(error))
+            throw error;
+        // Start the server-authoritative OAuth record but deliberately do not open a
+        // browser: a Desktop session cannot be transferred headlessly to HQ cloud.
+        const pending = await startOAuth(token, companyUid, {
+            mcpUrl: entry.url,
+            provider,
+            displayName: name,
+        });
+        return {
+            name,
+            status: "needs-signin",
+            provider: bareProvider(pending.provider),
+            reason: reconnectCommand(name, pending.provider),
+            authorizationUrl: pending.authorizationUrl,
+        };
+    }
+}
+function renderOutcomes(outcomes) {
+    console.log("Connector                 Outcome             Details");
+    for (const outcome of outcomes) {
+        console.log(`${outcome.name.padEnd(25)} ${outcome.status.padEnd(19)} ${outcome.reason ?? outcome.path ?? ""}`);
+    }
+    for (const outcome of outcomes.filter((item) => item.status === "shared-for-local")) {
+        console.log(chalk.dim(`  Shared manifest: ${outcome.path}`));
+        console.log(chalk.dim(`  Teammate install: ${outcome.installCommand}`));
+    }
+    if (outcomes.some((item) => item.status === "shared-for-local")) {
+        console.log(chalk.yellow("  Local connector credentials were replaced with ${secret:ENV_NAME}. Set them with `hq secrets` before installing."));
+    }
+    if (outcomes.some((item) => item.redactedArgumentCredentials)) {
+        console.log(chalk.yellow("  Local connector argument credentials were replaced with ${secret:FLAG_NAME}. Set them with `hq secrets` before installing."));
+    }
+    for (const outcome of outcomes.filter((item) => item.status === "needs-signin")) {
+        console.log(chalk.yellow(`  ${outcome.name} needs sign-in: ${outcome.reason}`));
+        if (outcome.authorizationUrl)
+            console.log(chalk.yellow(`  Open this URL to sign in:\n  ${outcome.authorizationUrl}`));
+    }
+}
+export function registerImportCommands(integrations) {
+    integrations
+        .command("import")
+        .description("Import Claude Desktop connectors into company Integrations")
+        .option("--company <slug>", "Company slug (defaults to your single active company)")
+        .option("--dry-run", "Detect and classify connectors without writing or connecting")
+        .option("--only <name[,name...]>", "Import only these Claude Desktop connector names")
+        .option("--json", "Machine-readable per-connector outcomes")
+        .option("--config <path>", "Claude Desktop config path (defaults to this OS's standard location)")
+        .action(async (opts) => {
+        const configPath = opts.config ?? claudeDesktopConfigPath();
+        const connectors = readClaudeDesktopConnectors(configPath);
+        const only = selectedNames(opts.only);
+        const entries = Object.entries(connectors).filter(([name]) => !only || only.has(name));
+        if (entries.length === 0) {
+            if (opts.json) {
+                printJson([]);
+            }
+            else {
+                console.log(`No Claude Desktop connectors found at ${configPath}`);
+            }
+            return;
+        }
+        const token = await ensureCognitoIdToken();
+        // getCompanyUid owns the single-membership fallback and multi-company
+        // disambiguation, exactly like every other integrations verb.
+        const companyUid = await getCompanyUid(token, opts.company);
+        const outcomes = [];
+        let company;
+        let hqRoot;
+        const localCompany = async () => company ??= await companyFolderSlug(token, companyUid);
+        const localHqRoot = () => hqRoot ??= resolveDefaultHqRoot({ onMissing: "throw" });
+        const normalizedNames = new Map();
+        for (const [name] of entries) {
+            if (!safeConnectorName(name))
+                continue;
+            const provider = providerSlug(name);
+            normalizedNames.set(provider, [...(normalizedNames.get(provider) ?? []), name]);
+        }
+        for (const [name, entry] of entries) {
+            const safeName = safeConnectorName(name);
+            if (!safeName) {
+                outcomes.push({ name, status: "skipped", reason: "name must use lowercase letters, digits, _ or -" });
+                continue;
+            }
+            const collisions = normalizedNames.get(providerSlug(name)) ?? [];
+            if (collisions.length > 1) {
+                outcomes.push({
+                    name,
+                    status: "skipped",
+                    reason: `normalized provider name '${providerSlug(name)}' collides with ${collisions.filter((other) => other !== name).join(", ")}`,
+                });
+                continue;
+            }
+            if (isLocal(entry)) {
+                const resolvedCompany = await localCompany();
+                const target = connectorPath(localHqRoot(), resolvedCompany, safeName);
+                outcomes.push({
+                    name,
+                    status: "shared-for-local",
+                    ...(opts.dryRun ? { reason: "would write secret-stripped local manifest" } : { path: writeLocalConnector(localHqRoot(), resolvedCompany, safeName, entry) }),
+                    installCommand: `hq integrations install-local ${safeName} --company ${resolvedCompany}`,
+                    ...(hasRedactedArgumentCredentials(entry) ? { redactedArgumentCredentials: true } : {}),
+                });
+                // Keep dry-run output useful without leaking a filesystem write target.
+                if (opts.dryRun)
+                    outcomes[outcomes.length - 1].path = target;
+                continue;
+            }
+            if (isRemote(entry) && typeof entry.url === "string") {
+                outcomes.push(await importRemote(token, companyUid, name, entry, Boolean(opts.dryRun)));
+                continue;
+            }
+            outcomes.push({ name, status: "skipped", reason: "unsupported MCP entry (expected command for local stdio or url for remote MCP)" });
+        }
+        if (opts.json)
+            printJson(outcomes);
+        else
+            renderOutcomes(outcomes);
+    });
+    integrations
+        .command("install-local <name>")
+        .description("Register a company-shared local connector in this machine's Claude/Codex MCP config")
+        .option("--company <slug>", "Company slug (defaults to your single active company)")
+        .option("--json", "Machine-readable registration result")
+        .action(async (name, opts) => {
+        const safeName = safeConnectorName(name);
+        if (!safeName) {
+            throw new IntegrationsCliError("Connector name must use lowercase letters, digits, _ or -.", { expected: true });
+        }
+        const token = await ensureCognitoToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const company = await companyFolderSlug(token, companyUid);
+        const hqRoot = resolveDefaultHqRoot({ onMissing: "throw" });
+        const manifestPath = connectorPath(hqRoot, company, safeName);
+        if (!fs.existsSync(manifestPath)) {
+            throw new IntegrationsCliError(`Shared connector not found: ${manifestPath}`, { expected: true });
+        }
+        let manifest;
+        try {
+            manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new IntegrationsCliError(`Could not parse shared connector ${manifestPath}: ${message}`, { expected: true });
+        }
+        const secretNames = [...Object.values({ ...(manifest.env ?? {}), ...(manifest.headers ?? {}) }), ...(manifest.args ?? [])]
+            .flatMap((value) => [...value.matchAll(/\$\{secret:([A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]*)*)\}/g)].map((match) => match[1]));
+        const secrets = await loadRevealedSecrets(token, companyUid, secretNames);
+        const result = registerServer({
+            name: safeName,
+            manifest,
+            pack: `company-${company}-connectors`,
+            resolveSecret: (secret) => secrets.get(secret) ?? null,
+        });
+        if (opts.json)
+            printJson(result);
+        else
+            console.log(`Registered ${safeName} in local MCP config (Claude${"skipped" in result.codex ? "; Codex not installed" : " and Codex"}).`);
+    });
+}
+//# sourceMappingURL=integrations-import.js.map

package/dist/commands/integrations-manage.d.ts

@@ -1,6 +1,6 @@
 /**
  * `hq integrations show | policy | grants | grant | ungrant | access | share |
- * unshare | audit | pending | disconnect`.
+ * unshare | audit | pending | disconnect | purge`.
  *
  * The govern-and-remove half of the lifecycle. Two different permission
  * surfaces live here and are easy to confuse, so they get separate verbs: