@indigoai-us/hq-cli 5.103.21 → 5.103.23

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [5.103.23] — 2026-08-26
+
+### Changed
+
+- The bundled sync engine now requires `@indigoai-us/hq-cloud` 6.15.71, so new
+  company skills are registered and stamped with a stable skill UID before
+  their first upload while comment-only skill proposals remain available from
+  the CLI.
+
+## [5.103.22] — 2026-08-25
+
+### Fixed
+
+- `hq auth login` now points account signup guidance at the canonical `onboarding.hq.computer` host instead of the retired Indigo onboarding domain.
+
 ## [5.103.21] — 2026-08-24
 
 ### Fixed

package/dist/commands/auth.d.ts

@@ -8,7 +8,7 @@
  *   hq auth status    — show whether a valid session is cached + expiry
  *
  * Sign-up is owned by the onboarding web app at
- * https://onboarding.indigo-hq.com. `hq auth login` signs an existing account
+ * https://onboarding.hq.computer. `hq auth login` signs an existing account
  * into this machine by writing ~/.hq/cognito-tokens.json; once cached, the
  * session is kept valid by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.

package/dist/commands/auth.js

@@ -8,7 +8,7 @@
  *   hq auth status    — show whether a valid session is cached + expiry
  *
  * Sign-up is owned by the onboarding web app at
- * https://onboarding.indigo-hq.com. `hq auth login` signs an existing account
+ * https://onboarding.hq.computer. `hq auth login` signs an existing account
  * into this machine by writing ~/.hq/cognito-tokens.json; once cached, the
  * session is kept valid by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
@@ -96,7 +96,7 @@ export function registerAuthCommands(program) {
                 console.error(chalk.dim(callbackPortCollisionGuidance(DEFAULT_COGNITO.port ?? 8765)));
             }
             else {
-                console.error(chalk.dim("  If you do not have an account, sign up at https://onboarding.indigo-hq.com"));
+                console.error(chalk.dim("  If you do not have an account, sign up at https://onboarding.hq.computer"));
             }
             process.exit(1);
         }

package/dist/commands/integrations-api.d.ts

@@ -156,6 +156,14 @@ export declare function uninstallIntegration(token: string, companyUid: string,
     installationId: string;
     connectionId: string;
 }>;
+/**
+ * Permanently remove a revoked connection tombstone. The admin purge endpoint
+ * deliberately accepts only the connection id: it derives the company and
+ * enforces owner authorization from the authenticated connection record.
+ */
+export declare function purgeConnection(token: string, companyUid: string, connectionId: string): Promise<{
+    connectionId: string;
+}>;
 export interface OAuthStartResult {
     provider: string;
     displayName: string;
@@ -197,6 +205,11 @@ export declare function updateGovernance(token: string, companyUid: string, inpu
     writePolicy?: WritePolicy;
     writeAllowlist: WriteAllowlistGrant[];
 }>;
+/**
+ * Mark or unmark one tool as read-safe. The service owns tool classification:
+ * it refuses attempts to mark write/destructive tools read-safe.
+ */
+export declare function setReadSafe(token: string, companyUid: string, connectionId: string, toolName: string, readSafe: boolean): Promise<void>;
 export interface ConnectionAccess {
     connectionId: string;
     provider: string;

package/dist/commands/integrations-api.js

@@ -74,6 +74,27 @@ export async function uninstallIntegration(token, companyUid, installationId) {
         await raiseForResponse(res, "Failed to disconnect the app");
     return (await res.json());
 }
+/**
+ * Permanently remove a revoked connection tombstone. The admin purge endpoint
+ * deliberately accepts only the connection id: it derives the company and
+ * enforces owner authorization from the authenticated connection record.
+ */
+export async function purgeConnection(token, companyUid, connectionId) {
+    // Keep the company in this client's call signature with the other
+    // connection mutations. It is resolved before the target connection so a
+    // caller cannot use a slug from a different company, but the server's purge
+    // contract intentionally takes only connectionId in its body.
+    void companyUid;
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/admin/purge",
+        method: "POST",
+        body: { connectionId },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to purge the revoked connection");
+    return (await res.json());
+}
 export async function startOAuth(token, companyUid, input) {
     const res = await vaultApiFetch({
         token,
@@ -110,6 +131,20 @@ export async function updateGovernance(token, companyUid, input) {
         await raiseForResponse(res, "Failed to update the app's settings");
     return (await res.json());
 }
+/**
+ * Mark or unmark one tool as read-safe. The service owns tool classification:
+ * it refuses attempts to mark write/destructive tools read-safe.
+ */
+export async function setReadSafe(token, companyUid, connectionId, toolName, readSafe) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/admin/read-safe",
+        method: "POST",
+        body: { companyUid, connectionId, toolName, readSafe },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to update the tool's read-safe setting");
+}
 /**
  * Live open-approval list, read from hq-pro's confirm-queue state (not the
  * audit feed). Unlike the audit-derived reconstruction this replaces, a call

package/dist/commands/integrations-connect.js

@@ -20,7 +20,7 @@ import chalk from "chalk";
 import open from "open";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
-import { IntegrationsCliError, bareProvider, printJson, resolveConnection, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, connectionDomain, printJson, revokedConnectionDetails, resolveConnection, } from "./integrations-core.js";
 import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBlueprint, startOAuth, } from "./integrations-api.js";
 import { startLoopbackListener } from "./integrations-oauth.js";
 /** hq-pro's machine code for "this endpoint needs a browser sign-in". */
@@ -183,7 +183,7 @@ async function resolveKey(opts, appLabel) {
  * most-specific-first so an explicit flag always wins over the positional
  * argument's heuristics.
  */
-async function resolveTarget(token, companyUid, app, opts) {
+async function resolveTarget(token, companyUid, app, opts, preserveDomain = false) {
     if (opts.docsUrl) {
         const found = await discoverDocs(token, companyUid, opts.docsUrl);
         if (!found.discovery || !found.discoveryReceiptId) {
@@ -222,6 +222,17 @@ async function resolveTarget(token, companyUid, app, opts) {
         // authClass, both of which make the connect cleaner than a raw domain
         // lookup. Missing it is fine — the domain path still works.
         const match = await findCatalogEntry(token, companyUid, app);
+        if (preserveDomain) {
+            // Reviving a revoked connection is keyed by its canonical domain in
+            // hq-pro. A catalog entry id is useful auth metadata, but replacing the
+            // domain with it can create a distinct connection instead of reviving
+            // the original acct_ row.
+            return {
+                ref: { domain: app },
+                ...(match?.authClass ? { authClass: match.authClass } : {}),
+                label: match?.name || app,
+            };
+        }
         return catalogEntryToTarget(match, { ref: { domain: app }, label: app });
     }
     // A bare name (`notion`, `atlassian`) is how the catalog reads to a person —
@@ -424,14 +435,15 @@ async function completeCredentialIfNeeded(token, companyUid, target, opts, resul
     });
 }
 /** Print the outcome of a successful connect. */
-function reportInstall(result, opts) {
+function reportInstall(result, opts, expectedRevivedConnectionId) {
     if (opts.json) {
         printJson(result);
         return;
     }
     const { installation, connection } = result;
     const toolCount = result.mcp?.tools?.length;
-    console.log(chalk.green(`Connected ${chalk.bold(installation.displayName)}`) +
+    const revived = connection.id === expectedRevivedConnectionId;
+    console.log(chalk.green(`${revived ? "Revived" : "Connected"} ${chalk.bold(installation.displayName)}`) +
         (typeof toolCount === "number" ? chalk.dim(` — ${toolCount} tools available`) : ""));
     console.log(chalk.dim(`  connection: ${connection.id}`));
     if (installation.status === "needs_credentials") {
@@ -439,6 +451,49 @@ function reportInstall(result, opts) {
     }
     console.log(chalk.dim(`  Try it: hq integrations tools --provider ${bareProvider(connection.provider)}`));
 }
+/**
+ * The shared `connect <domain>` execution path. Reconnect's revoked fallback
+ * intentionally comes through here rather than re-installing its saved MCP
+ * URL: hq-pro recognizes the domain and revives the revoked row in place.
+ */
+async function connectApp(token, companyUid, app, opts, expectedRevivedConnectionId) {
+    const target = await resolveTarget(token, companyUid, app, opts, expectedRevivedConnectionId !== undefined);
+    const authMode = opts.auth ?? target.authClass;
+    if (authMode === "oauth") {
+        const result = await connectViaOAuth(token, companyUid, target, opts);
+        if (result)
+            reportInstall(result, opts, expectedRevivedConnectionId);
+        return;
+    }
+    // A key is only collected when something already says one is needed, or
+    // the caller supplied one — otherwise a no-auth app would pointlessly
+    // prompt.
+    const wantsKey = authMode === "key" || Boolean(opts.token || opts.tokenStdin);
+    const bearerToken = wantsKey ? await resolveKey(opts, target.label) : undefined;
+    try {
+        const result = await installIntegration(token, companyUid, {
+            ...target.ref,
+            ...(bearerToken
+                ? { authMode: "bearer", bearerToken }
+                : authMode === "none"
+                    ? { authMode: "none" }
+                    : {}),
+        });
+        reportInstall(await completeCredentialIfNeeded(token, companyUid, target, opts, result), opts, expectedRevivedConnectionId);
+    }
+    catch (err) {
+        // Server-authoritative detection: the endpoint turned out to be
+        // OAuth-protected, so run the browser flow instead of making the
+        // caller re-issue the command with --auth oauth.
+        if (isOAuthRequiredError(err)) {
+            const result = await connectViaOAuth(token, companyUid, target, opts);
+            if (result)
+                reportInstall(result, opts, expectedRevivedConnectionId);
+            return;
+        }
+        throw err;
+    }
+}
 export function registerConnectCommands(integrations) {
     integrations
         .command("catalog [query]")
@@ -561,46 +616,11 @@ export function registerConnectCommands(integrations) {
         assertAuthMode(opts.auth);
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const target = await resolveTarget(token, companyUid, app, opts);
-        const authMode = opts.auth ?? target.authClass;
-        if (authMode === "oauth") {
-            const result = await connectViaOAuth(token, companyUid, target, opts);
-            if (result)
-                reportInstall(result, opts);
-            return;
-        }
-        // A key is only collected when something already says one is needed, or
-        // the caller supplied one — otherwise a no-auth app would pointlessly
-        // prompt.
-        const wantsKey = authMode === "key" || Boolean(opts.token || opts.tokenStdin);
-        const bearerToken = wantsKey ? await resolveKey(opts, target.label) : undefined;
-        try {
-            const result = await installIntegration(token, companyUid, {
-                ...target.ref,
-                ...(bearerToken
-                    ? { authMode: "bearer", bearerToken }
-                    : authMode === "none"
-                        ? { authMode: "none" }
-                        : {}),
-            });
-            reportInstall(await completeCredentialIfNeeded(token, companyUid, target, opts, result), opts);
-        }
-        catch (err) {
-            // Server-authoritative detection: the endpoint turned out to be
-            // OAuth-protected, so run the browser flow instead of making the
-            // caller re-issue the command with --auth oauth.
-            if (isOAuthRequiredError(err)) {
-                const result = await connectViaOAuth(token, companyUid, target, opts);
-                if (result)
-                    reportInstall(result, opts);
-                return;
-            }
-            throw err;
-        }
+        await connectApp(token, companyUid, app, opts);
     });
     integrations
         .command("reconnect [app]")
-        .description("Re-authenticate a connected app whose credentials stopped working")
+        .description("Re-authenticate a connected app; use --connect to re-add a revoked app")
         .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
@@ -609,6 +629,7 @@ export function registerConnectCommands(integrations) {
         .option("--auth <mode>", "Force the auth mode: none, key, or oauth (default: detect)")
         .option("--no-browser", "Print the sign-in URL instead of opening a browser")
         .option("--timeout <seconds>", "How long to wait for a browser sign-in (default 300)")
+        .option("--connect", "For a revoked row, run `connect <domain>` to re-add and revive it")
         .option("--json", "Machine-readable output")
         .action(async (app, opts) => {
         // Same validation as `connect`. Without it a typo like `--auth oauth2`
@@ -618,7 +639,23 @@ export function registerConnectCommands(integrations) {
         assertAuthMode(opts.auth);
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const connection = await resolveConnection(token, companyUid, app, opts);
+        const connection = await resolveConnection(token, companyUid, app, opts, {
+            allowSingleRevoked: Boolean(opts.connect),
+        });
+        if (connection.status === "revoked") {
+            const details = revokedConnectionDetails(connection, opts.company);
+            if (!opts.connect) {
+                if (opts.json)
+                    printJson(details);
+                else {
+                    console.log(chalk.yellow(details.reason));
+                    console.log(chalk.yellow(`Re-add it with: ${details.fixPath}`));
+                }
+                return;
+            }
+            await connectApp(token, companyUid, connectionDomain(connection), opts, connection.id);
+            return;
+        }
         const url = connection.installation?.surface?.url;
         if (!url) {
             throw new IntegrationsCliError(`${bareProvider(connection.provider)} was not installed through the app catalog, so it cannot be reconnected from here.`, { expected: true });

package/dist/commands/integrations-core.d.ts

@@ -74,6 +74,16 @@ export interface AdminConnection {
     };
     installation?: FactoryInstallation | null;
 }
+/**
+ * The actionable state returned instead of attempting to use a revoked
+ * connection. Keep this machine-readable so commands and scripts get the same
+ * recovery path instead of treating a listed row as absent.
+ */
+export interface RevokedConnectionDetails {
+    status: "revoked";
+    reason: string;
+    fixPath: string;
+}
 export interface AdminAuditEvent {
     timestamp: string;
     memberOrAgent: string;
@@ -210,6 +220,14 @@ export declare function selectConnection(connections: AdminConnection[], opts: {
     connection?: string;
     provider?: string;
 }): AdminConnection;
+/**
+ * The hostname re-add needs. Prefer the server's canonical installation domain;
+ * an older row may only retain its MCP URL, and provider is the last-resort
+ * human-safe query when neither was stored.
+ */
+export declare function connectionDomain(connection: AdminConnection): string;
+/** A revoked row is still addressable, but it cannot make a live MCP call. */
+export declare function revokedConnectionDetails(connection: AdminConnection, companySlug?: string): RevokedConnectionDetails;
 /**
  * Resolve a connection the caller named positionally OR through the
  * `--provider` / `--connection` flags. Every management verb takes an optional
@@ -219,6 +237,8 @@ export declare function selectConnection(connections: AdminConnection[], opts: {
 export declare function resolveConnection(token: string, companyUid: string, app: string | undefined, opts: {
     provider?: string;
     connection?: string;
+}, recoveryOpts?: {
+    allowSingleRevoked?: boolean;
 }): Promise<AdminConnection>;
 export declare function callGateway(token: string, params: Record<string, unknown>): Promise<GatewayMessage>;
 /**

package/dist/commands/integrations-core.js

@@ -256,14 +256,26 @@ export function selectConnection(connections, opts) {
     if (opts.provider) {
         const want = opts.provider.trim().toLowerCase();
         const wantHumanSlug = humanSlug(opts.provider);
-        const providerMatch = active.find((c) => bareProvider(c.provider).toLowerCase() === want || c.provider.toLowerCase() === want);
+        // A reconnect normally leaves a revoked historical row alongside its new
+        // active connection. Prefer the active inventory before applying the
+        // provider/name/alias precedence below; fall back to history only when no
+        // active row matches this selector at all. `--connection` above remains
+        // the explicit way to inspect or act on a particular historical row.
+        const activeMatches = connections.filter((c) => c.status !== "revoked" &&
+            (bareProvider(c.provider).toLowerCase() === want ||
+                c.provider.toLowerCase() === want ||
+                c.installation?.displayName?.trim().toLowerCase() === want ||
+                (wantHumanSlug !== "" &&
+                    humanSlug(c.installation?.displayName ?? "") === wantHumanSlug)));
+        const candidates = activeMatches.length > 0 ? activeMatches : connections;
+        const providerMatch = candidates.find((c) => bareProvider(c.provider).toLowerCase() === want || c.provider.toLowerCase() === want);
         if (providerMatch)
             return providerMatch;
-        const displayNameMatch = active.find((c) => c.installation?.displayName?.trim().toLowerCase() === want);
+        const displayNameMatch = candidates.find((c) => c.installation?.displayName?.trim().toLowerCase() === want);
         if (displayNameMatch)
             return displayNameMatch;
         const aliasMatches = wantHumanSlug
-            ? active.filter((c) => {
+            ? candidates.filter((c) => {
                 const displayName = c.installation?.displayName;
                 const displayNameSlug = displayName ? humanSlug(displayName) : "";
                 return displayNameSlug !== "" && displayNameSlug === wantHumanSlug;
@@ -274,7 +286,7 @@ export function selectConnection(connections, opts) {
         if (aliasMatches.length > 1) {
             throw new IntegrationsCliError(`Display-name alias '${opts.provider}' matches multiple connected apps. Use --connection to choose one.`, { expected: true });
         }
-        const available = active.map((c) => bareProvider(c.provider)).join(", ");
+        const available = connections.map((c) => bareProvider(c.provider)).join(", ");
         throw new IntegrationsCliError(`No connected app matches '${opts.provider}'.` +
             (available ? ` Connected: ${available}.` : " Nothing is connected yet — connect apps with `hq integrations connect <app>`."), { expected: true });
     }
@@ -286,17 +298,59 @@ export function selectConnection(connections, opts) {
     throw new IntegrationsCliError(`Multiple apps are connected — pick one with --provider:\n` +
         active.map((c) => `  --provider ${bareProvider(c.provider)}`).join("\n"), { expected: true });
 }
+/**
+ * The hostname re-add needs. Prefer the server's canonical installation domain;
+ * an older row may only retain its MCP URL, and provider is the last-resort
+ * human-safe query when neither was stored.
+ */
+export function connectionDomain(connection) {
+    const domain = connection.installation?.domain?.trim();
+    if (domain)
+        return domain;
+    const url = connection.installation?.surface?.url;
+    if (url) {
+        try {
+            const host = new URL(url).hostname;
+            if (host)
+                return host;
+        }
+        catch {
+            // The saved endpoint is advisory here. A malformed legacy URL must not
+            // prevent recovery when the provider slug can still be re-added.
+        }
+    }
+    return bareProvider(connection.provider);
+}
+/** A revoked row is still addressable, but it cannot make a live MCP call. */
+export function revokedConnectionDetails(connection, companySlug) {
+    const domain = connectionDomain(connection);
+    return {
+        status: "revoked",
+        reason: "This connection was revoked and cannot be used until it is re-added.",
+        fixPath: `hq integrations connect ${domain}` +
+            (companySlug ? ` --company ${companySlug}` : ""),
+    };
+}
 /**
  * Resolve a connection the caller named positionally OR through the
  * `--provider` / `--connection` flags. Every management verb takes an optional
  * `<app>` argument for ergonomics (`hq integrations policy linear …`), which is
  * matched exactly like `--provider` unless it looks like a connection id.
  */
-export async function resolveConnection(token, companyUid, app, opts) {
+export async function resolveConnection(token, companyUid, app, opts, recoveryOpts = {}) {
     const connections = await fetchConnections(token, companyUid);
     if (app && !opts.provider && !opts.connection) {
         return selectConnection(connections, app.startsWith("acct_") ? { connection: app } : { provider: app });
     }
+    // Normal management verbs deliberately ignore revoked rows for implicit
+    // selection. Reconnect's explicit --connect recovery is the one exception:
+    // a sole revoked row is unambiguous and needs its saved domain to revive.
+    if (recoveryOpts.allowSingleRevoked &&
+        !opts.provider &&
+        !opts.connection &&
+        connections.length === 1) {
+        return connections[0];
+    }
     return selectConnection(connections, opts);
 }
 export async function callGateway(token, params) {

package/dist/commands/integrations-manage.d.ts

@@ -1,6 +1,6 @@
 /**
  * `hq integrations show | policy | grants | grant | ungrant | access | share |
- * unshare | audit | pending | disconnect`.
+ * unshare | audit | pending | disconnect | purge`.
  *
  * The govern-and-remove half of the lifecycle. Two different permission
  * surfaces live here and are easy to confuse, so they get separate verbs: