@indigoai-us/hq-cli 5.103.20 → 5.103.22

package/dist/commands/integrations-manage.js

@@ -1,6 +1,6 @@
 /**
  * `hq integrations show | policy | grants | grant | ungrant | access | share |
- * unshare | audit | pending | disconnect`.
+ * unshare | audit | pending | disconnect | purge`.
  *
  * The govern-and-remove half of the lifecycle. Two different permission
  * surfaces live here and are easy to confuse, so they get separate verbs:
@@ -16,8 +16,8 @@ import readline from "node:readline";
 import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
-import { IntegrationsCliError, bareProvider, fetchAdminSurface, printJson, resolveConnection, selectConnection, } from "./integrations-core.js";
-import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
+import { IntegrationsCliError, bareProvider, fetchConnections, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
+import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
 const WRITE_POLICIES = ["auto-allow", "confirm", "deny"];
 const PERMISSIONS = ["read", "write", "admin"];
 /** Plain-English gloss for each write policy, used in every policy readout. */
@@ -97,6 +97,67 @@ function confirm(message) {
 function connectionLabel(connection) {
     return connection.installation?.displayName ?? bareProvider(connection.provider);
 }
+/**
+ * The category of match must mirror `selectConnection`: an exact provider id
+ * takes precedence over a display name, which takes precedence over its human
+ * slug. Unlike ordinary verbs, purge deliberately operates on historical
+ * revoked rows, so it must not inherit selectConnection's active-first policy.
+ */
+function purgeSelectorMatches(connections, selector) {
+    if (selector.connection) {
+        return connections.filter((connection) => connection.id === selector.connection);
+    }
+    if (selector.provider) {
+        const want = selector.provider.trim().toLowerCase();
+        const wantHumanSlug = humanSlug(selector.provider);
+        const providerMatches = connections.filter((connection) => bareProvider(connection.provider).toLowerCase() === want ||
+            connection.provider.toLowerCase() === want);
+        if (providerMatches.length > 0)
+            return providerMatches;
+        const displayNameMatches = connections.filter((connection) => connection.installation?.displayName?.trim().toLowerCase() === want);
+        if (displayNameMatches.length > 0)
+            return displayNameMatches;
+        if (wantHumanSlug) {
+            return connections.filter((connection) => {
+                const displayName = connection.installation?.displayName;
+                return displayName !== undefined && humanSlug(displayName) === wantHumanSlug;
+            });
+        }
+        return [];
+    }
+    return connections;
+}
+function humanSlug(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
+function purgeSelector(app, opts) {
+    if (app && !opts.provider && !opts.connection) {
+        return app.startsWith("acct_") ? { connection: app } : { provider: app };
+    }
+    return opts;
+}
+async function resolveRevokedPurgeConnection(token, companyUid, app, opts) {
+    const selector = purgeSelector(app, opts);
+    const connections = await fetchConnections(token, companyUid);
+    const matches = purgeSelectorMatches(connections, selector);
+    const revoked = matches.filter((connection) => connection.status === "revoked");
+    if (revoked.length === 1)
+        return revoked[0];
+    if (revoked.length > 1) {
+        const selected = selector.connection ?? selector.provider ?? "the supplied selector";
+        throw new IntegrationsCliError(`Multiple revoked connections match '${selected}'. Use --connection <acct_id> to choose one:\n` +
+            revoked.map((connection) => `  --connection ${connection.id} (${connectionLabel(connection)})`).join("\n"), { expected: true });
+    }
+    if (matches.length > 0) {
+        throw new IntegrationsCliError(`${connectionLabel(matches[0])} is still connected. Disconnect it first, then purge it.`, { expected: true });
+    }
+    // Keep the existing command group's not-found wording and error taxonomy.
+    return selectConnection(connections, selector);
+}
 /**
  * Governance writes are owner-only on hq-pro AND the allowlist PATCH is a
  * whole-list REPLACE. A non-owner reads an identity-redacted grant list, so
@@ -144,7 +205,9 @@ export function registerManageCommands(integrations) {
             ? selectConnection(surface.connections, app.startsWith("acct_") ? { connection: app } : { provider: app })
             : selectConnection(surface.connections, opts);
         if (opts.json) {
-            printJson(connection);
+            printJson(connection.status === "revoked"
+                ? { ...connection, ...revokedConnectionDetails(connection, opts.company) }
+                : connection);
             return;
         }
         const install = connection.installation;
@@ -153,6 +216,11 @@ export function registerManageCommands(integrations) {
         if (install?.id)
             console.log(chalk.dim(`  installation: ${install.id}`));
         console.log(chalk.dim(`  status:      ${connection.status}`));
+        if (connection.status === "revoked") {
+            const details = revokedConnectionDetails(connection, opts.company);
+            console.log(chalk.yellow(`  Revoked — ${details.reason}`));
+            console.log(chalk.yellow(`  Re-add: ${details.fixPath}`));
+        }
         if (install?.domain)
             console.log(chalk.dim(`  domain:      ${install.domain}`));
         if (install?.surface?.url)
@@ -218,6 +286,47 @@ export function registerManageCommands(integrations) {
         }
         console.log(chalk.green(`${connectionLabel(connection)}: ${writePolicy} — ${POLICY_BLURB[writePolicy]}`));
     });
+    integrations
+        .command("read-safe <tool>")
+        .description("Mark a read-only tool as safe to run without approval (owner only)")
+        .option("--company <slug>", "Company slug, e.g. indigo")
+        .option("--provider <slug>", "Connected app (e.g. linear)")
+        .option("--connection <id>", "Connection id (acct_…)")
+        .option("--unset", "Remove the read-safe override")
+        .option("--off", "Alias for --unset")
+        .option("--json", "Machine-readable output")
+        .action(async (tool, opts) => {
+        const toolName = tool.trim();
+        if (!toolName) {
+            throw new IntegrationsCliError("Tool name cannot be empty.", { expected: true });
+        }
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const connection = await resolveConnection(token, companyUid, undefined, opts);
+        const readSafe = !(opts.unset || opts.off);
+        try {
+            await setReadSafe(token, companyUid, connection.id, toolName, readSafe);
+        }
+        catch (error) {
+            if (error instanceof IntegrationsCliError) {
+                if (error.status === 403) {
+                    throw new IntegrationsCliError("This command is owner only. Ask a company owner to manage read-safe tools.", { expected: true });
+                }
+                if (readSafe && (error.status === 409 || error.status === 422)) {
+                    throw new IntegrationsCliError(`${toolName} is a write tool and can't be marked read-safe (its changes always need approval).`, { expected: true });
+                }
+            }
+            throw error;
+        }
+        const outcome = { connectionId: connection.id, toolName, readSafe };
+        if (opts.json) {
+            printJson(outcome);
+            return;
+        }
+        console.log(chalk.green(readSafe
+            ? `${toolName} on ${connectionLabel(connection)} is now read-safe and skips approval.`
+            : `${toolName} on ${connectionLabel(connection)} is no longer read-safe; its override was removed.`));
+    });
     integrations
         .command("grants [app]")
         .description("Show who is authorized to run an app's change-making tools")
@@ -518,6 +627,52 @@ export function registerManageCommands(integrations) {
         }
         console.log(chalk.green(`Disconnected ${connectionLabel(connection)}.`));
     });
+    integrations
+        .command("purge [app]")
+        .description("Permanently remove a revoked connection from the list (owner only)")
+        .option("--company <slug>", "Company slug, e.g. indigo")
+        .option("--provider <slug>", "Connected app (e.g. linear)")
+        .option("--connection <id>", "Connection id (acct_…)")
+        .option("--yes", "Skip the permanent-removal confirmation prompt")
+        .option("--json", "Machine-readable output")
+        .action(async (app, opts) => {
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const connection = await resolveRevokedPurgeConnection(token, companyUid, app, opts);
+        const label = connectionLabel(connection);
+        if (!opts.yes) {
+            // Warning + prompt go to stderr: with --json, stdout must stay parseable.
+            console.error(`Purging ${chalk.bold(label)} permanently removes its revoked connection record. It cannot be restored.`);
+            const ok = await confirm(`Permanently purge ${label}?`);
+            if (!ok) {
+                // A non-TTY run lands here too: refusing is the only safe default
+                // when nobody can confirm a permanent deletion.
+                throw new IntegrationsCliError("Not purged. Re-run with --yes if you are sure.", { expected: true });
+            }
+        }
+        try {
+            await purgeConnection(token, companyUid, connection.id);
+        }
+        catch (error) {
+            if (error instanceof IntegrationsCliError && error.status === 409) {
+                throw new IntegrationsCliError(`${label} is still connected. Disconnect it first, then purge it.`, { expected: true, status: 409, code: error.code });
+            }
+            if (error instanceof IntegrationsCliError && error.status === 403) {
+                throw new IntegrationsCliError("Purging a connection is owner only. Ask a company owner to run this.", { expected: true, status: 403, code: error.code });
+            }
+            throw error;
+        }
+        const outcome = {
+            connectionId: connection.id,
+            provider: bareProvider(connection.provider),
+            status: "purged",
+        };
+        if (opts.json) {
+            printJson(outcome);
+            return;
+        }
+        console.log(chalk.green(`Purged ${label}. It will no longer appear in \`hq integrations list\`.`));
+    });
 }
 /** Order-insensitive identity of an allowlist, for change detection. */
 export function allowlistFingerprint(grants) {

package/dist/commands/integrations.d.ts

@@ -14,6 +14,7 @@
  *   hq integrations discover <docsUrl>       Find a server from its docs page.
  *   hq integrations connect <app>            Connect it (no-auth, key, OAuth).
  *   hq integrations reconnect [app]          Re-authenticate a broken app.
+ *   hq integrations import                   Import Claude Desktop connectors.
  *
  * Use:
  *   hq integrations list --company indigo    Connected apps for a company.
@@ -25,10 +26,12 @@
  *
  * Govern and remove:
  *   hq integrations policy [app] --set <m>   Approval setting for changes.
+ *   hq integrations read-safe <tool>          Mark/unmark a trusted read-only tool.
  *   hq integrations grants|grant|ungrant     Per-tool authorization to run change-making tools.
  *   hq integrations access|share|unshare     Who may use the app.
  *   hq integrations audit                    Recent activity.
  *   hq integrations disconnect [app]         Remove it and its credentials.
+ *   hq integrations purge [app]              Permanently remove a revoked connection row.
  *
  * Governance: reads flow freely; calls that can change the app are subject to
  * the connection's write policy (default: a person approves first). A queued

package/dist/commands/integrations.js

@@ -14,6 +14,7 @@
  *   hq integrations discover <docsUrl>       Find a server from its docs page.
  *   hq integrations connect <app>            Connect it (no-auth, key, OAuth).
  *   hq integrations reconnect [app]          Re-authenticate a broken app.
+ *   hq integrations import                   Import Claude Desktop connectors.
  *
  * Use:
  *   hq integrations list --company indigo    Connected apps for a company.
@@ -25,10 +26,12 @@
  *
  * Govern and remove:
  *   hq integrations policy [app] --set <m>   Approval setting for changes.
+ *   hq integrations read-safe <tool>          Mark/unmark a trusted read-only tool.
  *   hq integrations grants|grant|ungrant     Per-tool authorization to run change-making tools.
  *   hq integrations access|share|unshare     Who may use the app.
  *   hq integrations audit                    Recent activity.
  *   hq integrations disconnect [app]         Remove it and its credentials.
+ *   hq integrations purge [app]              Permanently remove a revoked connection row.
  *
  * Governance: reads flow freely; calls that can change the app are subject to
  * the connection's write policy (default: a person approves first). A queued
@@ -49,10 +52,113 @@ import { randomUUID } from "node:crypto";
 import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
-import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, isClientError, printJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, isClientError, printJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
+import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
 export { IntegrationsCliError, callGateway, fetchConnections, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
+/**
+ * Gateway metadata is additive and may be absent when talking to an older
+ * gateway. Parse it defensively so an unknown or malformed value never breaks
+ * tool discovery.
+ */
+function effectiveToolMode(tool) {
+    const raw = tool._meta?.["hq/effective-mode"];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const mode = raw.mode;
+    const approvalRequired = raw.approvalRequired;
+    if ((mode !== "read" && mode !== "write") || typeof approvalRequired !== "boolean") {
+        return null;
+    }
+    const denied = raw.denied;
+    const policy = raw.policy;
+    return {
+        mode,
+        approvalRequired,
+        ...(denied === true ? { denied: true } : {}),
+        ...(policy === "deny" ? { policy: "deny" } : {}),
+    };
+}
+function toolBadge(tool) {
+    const effectiveMode = effectiveToolMode(tool);
+    if (!effectiveMode)
+        return null;
+    if (effectiveMode.mode === "read")
+        return "read";
+    if (effectiveMode.denied)
+        return "denied";
+    return effectiveMode.approvalRequired ? "approval-required" : "write";
+}
+function formatToolBadge(tool) {
+    const badge = toolBadge(tool);
+    if (!badge)
+        return "";
+    const label = `[${badge}]`;
+    switch (badge) {
+        case "read":
+            return chalk.green(label);
+        case "approval-required":
+            return chalk.yellow(label);
+        case "denied":
+            return chalk.red(label);
+        case "write":
+            return chalk.blue(label);
+    }
+}
+/** Add gateway policy metadata where scripts can consume it directly. */
+function toolJsonView(tool) {
+    const effectiveMode = effectiveToolMode(tool);
+    return effectiveMode ? { ...tool, effectiveMode } : tool;
+}
+/**
+ * The gateway relays MCP tool schemas verbatim. Keep the default listing
+ * compact, but make required inputs visible before a caller has to discover
+ * them through a validation error.
+ */
+function requiredInputHint(inputSchema) {
+    if (!inputSchema || typeof inputSchema !== "object")
+        return null;
+    const required = inputSchema.required;
+    if (!Array.isArray(required))
+        return null;
+    const names = required.filter((name) => typeof name === "string");
+    return names.length > 0 ? `requires: ${names.join(", ")}` : null;
+}
+/** The user-facing slug stays first; the factory's display name is additive. */
+function connectionLabel(connection) {
+    const slug = bareProvider(connection.provider);
+    const displayName = connection.installation?.displayName?.trim();
+    return displayName && displayName.toLowerCase() !== slug.toLowerCase()
+        ? `${slug} (${displayName})`
+        : slug;
+}
+function printToolSchema(tool) {
+    if (tool.inputSchema === undefined) {
+        console.log(chalk.dim("  Input schema was not reported by this app."));
+        return;
+    }
+    const schema = JSON.stringify(tool.inputSchema, null, 2);
+    console.log(chalk.dim("  Input schema:"));
+    console.log(chalk.dim(schema.split("\n").map((line) => `  ${line}`).join("\n")));
+}
+function reportRevokedConnection(connection, opts) {
+    if (connection.status !== "revoked")
+        return false;
+    const details = revokedConnectionDetails(connection, opts.company);
+    if (opts.json) {
+        printJson(details);
+    }
+    else {
+        console.log(chalk.yellow(`${connectionLabel(connection)}: status=revoked`));
+        console.log(chalk.yellow(`  ${details.reason}`));
+        console.log(`  Re-add: ${details.fixPath}`);
+    }
+    if (opts.fail) {
+        throw new IntegrationsCliError(`status=revoked. ${details.reason} Re-add with: ${details.fixPath}`, { expected: true });
+    }
+    return true;
+}
 export function registerIntegrationsCommand(program) {
     const integrations = program
         .command("integrations")
@@ -75,7 +181,6 @@ export function registerIntegrationsCommand(program) {
             return;
         }
         for (const c of connections) {
-            const name = c.installation?.displayName ?? bareProvider(c.provider);
             const flags = [
                 c.status,
                 c.writePolicy ? `writes: ${c.writePolicy}` : null,
@@ -83,21 +188,25 @@ export function registerIntegrationsCommand(program) {
             ]
                 .filter(Boolean)
                 .join(" · ");
-            console.log(`${chalk.bold(name)}  (${bareProvider(c.provider)})  ${chalk.dim(flags)}`);
+            console.log(`${chalk.bold(connectionLabel(c))}  ${chalk.dim(flags)}`);
             console.log(chalk.dim(`  connection: ${c.id}`));
         }
     });
+    registerImportCommands(integrations);
     integrations
         .command("tools")
         .description("List what a connected app can do")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--company <slug>", "Company slug, e.g. indigo")
+        .option("--describe <tool>", "Print the full input schema for one tool")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+        if (reportRevokedConnection(connection, opts))
+            return;
         const prefix = toolPrefixForProvider(connection.provider);
         const message = await callGateway(token, {
             companyUid,
@@ -105,20 +214,43 @@ export function registerIntegrationsCommand(program) {
             arguments: { companyUid, connectionId: connection.id },
         });
         const payload = unwrapGatewayResult(message.result);
-        if (opts.json) {
-            printJson(payload);
-            return;
-        }
         const tools = payload?.tools ?? [];
         if (tools.length === 0) {
+            if (opts.json) {
+                printJson(payload);
+                return;
+            }
             console.log("The app reported no tools.");
             return;
         }
+        if (opts.describe) {
+            const tool = tools.find((candidate) => candidate.name === opts.describe);
+            if (!tool) {
+                throw new IntegrationsCliError(`No tool named '${opts.describe}' on ${connectionLabel(connection)}.`, { expected: true });
+            }
+            if (opts.json) {
+                printJson(toolJsonView(tool));
+                return;
+            }
+            const badge = formatToolBadge(tool);
+            console.log(`${chalk.bold(tool.name)}${badge ? `  ${badge}` : ""}  ${chalk.dim(`on ${connectionLabel(connection)}`)}`);
+            if (tool.description)
+                console.log(chalk.dim(`  ${tool.description}`));
+            printToolSchema(tool);
+            return;
+        }
+        if (opts.json) {
+            printJson({ ...payload, tools: tools.map(toolJsonView) });
+            return;
+        }
+        console.log(chalk.dim(`App: ${connectionLabel(connection)}`));
         for (const tool of tools) {
             const label = tool.title && tool.title !== tool.name ? `  ${chalk.dim(tool.title)}` : "";
-            console.log(`${chalk.bold(tool.name)}${label}`);
+            const required = requiredInputHint(tool.inputSchema);
+            const badge = formatToolBadge(tool);
+            console.log(`${chalk.bold(tool.name)}${badge ? `  ${badge}` : ""}${label}${required ? `  ${chalk.dim(required)}` : ""}`);
         }
-        console.log(chalk.dim(`\n${tools.length} tools. Call one with: hq integrations call <tool> --provider ${bareProvider(connection.provider)} --args '<json>'`));
+        console.log(chalk.dim(`\n${tools.length} tools. Describe inputs: hq integrations tools --provider ${bareProvider(connection.provider)} --describe <tool>\nCall one with: hq integrations call <tool> --provider ${bareProvider(connection.provider)} --args '<json>'`));
     });
     integrations
         .command("call <tool>")
@@ -144,6 +276,8 @@ export function registerIntegrationsCommand(program) {
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+        if (reportRevokedConnection(connection, { ...opts, fail: true }))
+            return;
         const prefix = toolPrefixForProvider(connection.provider);
         const idempotencyKey = opts.idempotencyKey ?? `hq-cli-${randomUUID()}`;
         const message = await callGateway(token, {

package/dist/commands/mcp-registration.d.ts

@@ -471,7 +471,7 @@ export declare const claudeConfigFormat: ConfigFormat<Record<string, unknown>>;
 /**
  * Build the Claude server definition emitted into `mcpServers.<name>` from a
  * manifest: pass the transport fields through, resolve `${secret:}` in every
- * header/env value (recording the plaintexts in `secretSink` for redaction), and
+ * argument/header/env value (recording the plaintexts in `secretSink` for redaction), and
  * stamp `_hqPack` provenance. The output object's key order is deterministic so a
  * re-run produces a byte-identical def (idempotency depends on stable serialize).
  */
@@ -673,7 +673,7 @@ export declare const codexConfigFormat: ConfigFormat<CodexTomlDoc>;
 export declare function appendCodexTable(originalText: string, name: string, def: TomlTable): string;
 /**
  * Build the Codex server table emitted as `[mcp_servers.<name>]`: pass the
- * transport fields through, resolve `${secret:}` in every header/env value
+ * transport fields through, resolve `${secret:}` in every argument/header/env value
  * (recording plaintexts in `secretSink` for redaction), stamp `_hqPack` provenance,
  * and write the per-tool `approval_mode` from the manifest where present (the Codex-
  * specific field — `[mcp_servers.<name>.tools.<t>]` with `approval_mode = "…"`).

package/dist/commands/mcp-registration.js

@@ -934,7 +934,7 @@ export const claudeConfigFormat = {
 /**
  * Build the Claude server definition emitted into `mcpServers.<name>` from a
  * manifest: pass the transport fields through, resolve `${secret:}` in every
- * header/env value (recording the plaintexts in `secretSink` for redaction), and
+ * argument/header/env value (recording the plaintexts in `secretSink` for redaction), and
  * stamp `_hqPack` provenance. The output object's key order is deterministic so a
  * re-run produces a byte-identical def (idempotency depends on stable serialize).
  */
@@ -944,8 +944,9 @@ export function buildClaudeServerDef(manifest, pack, resolve, secretSink) {
         def.url = manifest.url;
     if (manifest.command !== undefined)
         def.command = manifest.command;
-    if (manifest.args !== undefined)
-        def.args = manifest.args;
+    if (manifest.args !== undefined) {
+        def.args = manifest.args.map((arg) => resolveSecretRefs(arg, resolve, secretSink));
+    }
     if (manifest.headers !== undefined) {
         def.headers = resolveStringMap(manifest.headers, resolve, secretSink);
     }
@@ -1371,7 +1372,7 @@ export function appendCodexTable(originalText, name, def) {
 }
 /**
  * Build the Codex server table emitted as `[mcp_servers.<name>]`: pass the
- * transport fields through, resolve `${secret:}` in every header/env value
+ * transport fields through, resolve `${secret:}` in every argument/header/env value
  * (recording plaintexts in `secretSink` for redaction), stamp `_hqPack` provenance,
  * and write the per-tool `approval_mode` from the manifest where present (the Codex-
  * specific field — `[mcp_servers.<name>.tools.<t>]` with `approval_mode = "…"`).
@@ -1384,8 +1385,9 @@ export function buildCodexServerDef(manifest, pack, resolve, secretSink) {
         def.url = manifest.url;
     if (manifest.command !== undefined)
         def.command = manifest.command;
-    if (manifest.args !== undefined)
-        def.args = manifest.args;
+    if (manifest.args !== undefined) {
+        def.args = manifest.args.map((arg) => resolveSecretRefs(arg, resolve, secretSink));
+    }
     if (manifest.headers !== undefined) {
         def.headers = resolveStringMap(manifest.headers, resolve, secretSink);
     }

package/dist/utils/vault-api.d.ts

@@ -34,6 +34,18 @@ export interface VaultApiOptions {
  * network call; this stays the backstop for a new call site that forgets to.
  */
 export declare function rewritePathForApiKey(path: string): string | null;
+/**
+ * Client-family identifier sent on every authenticated vault-API request.
+ *
+ * hq-pro reads this exact header into its closed `RosterClientFamily` enum
+ * (`roster-client-family.ts`) and tags each agents-request Sentry event with it
+ * (`handler.ts` setSentryClientFamily). Sending it means an event this CLI
+ * raises reads `hq_client=hq_cli` and names its origin instead of `absent` — the
+ * missing attribution behind Sentry hq-pro 7617401436. It is a fixed literal,
+ * never caller-supplied text, used only for telemetry/attribution: no
+ * authorization or request signing depends on it.
+ */
+export declare const HQ_CLIENT_NAME = "@indigoai-us/hq-cli";
 export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
 /**
  * Public (NONE-auth) GET against the vault API — no bearer token. The

package/dist/utils/vault-api.js

@@ -124,6 +124,18 @@ export function rewritePathForApiKey(path) {
     }
     return null;
 }
+/**
+ * Client-family identifier sent on every authenticated vault-API request.
+ *
+ * hq-pro reads this exact header into its closed `RosterClientFamily` enum
+ * (`roster-client-family.ts`) and tags each agents-request Sentry event with it
+ * (`handler.ts` setSentryClientFamily). Sending it means an event this CLI
+ * raises reads `hq_client=hq_cli` and names its origin instead of `absent` — the
+ * missing attribution behind Sentry hq-pro 7617401436. It is a fixed literal,
+ * never caller-supplied text, used only for telemetry/attribution: no
+ * authorization or request signing depends on it.
+ */
+export const HQ_CLIENT_NAME = "@indigoai-us/hq-cli";
 export async function vaultApiFetch(opts) {
     let path = opts.path;
     if (opts.token.startsWith("hqk_")) {
@@ -156,6 +168,7 @@ export async function vaultApiFetch(opts) {
             headers: {
                 Authorization: `Bearer ${opts.token}`,
                 'Content-Type': 'application/json',
+                'x-hq-client-name': HQ_CLIENT_NAME,
             },
             body: opts.body ? JSON.stringify(opts.body) : undefined,
             signal: opts.signal,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.103.20",
+  "version": "5.103.22",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {