@indigoai-us/hq-cli 5.105.2 → 5.106.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [5.106.0] — 2026-09-02
+
+### Fixed
+
+- `hq integrations inspect` now accepts a pasted endpoint URL. Passing
+  `https://mcp.example.com/mcp` used to be treated as free-text search and
+  answered "No integrations.sh results found" for an app listed under exactly
+  that host; it is now looked up by host.
+
+### Changed
+
+- The Connect-an-app catalog now says when a listed app's availability could
+  not be re-confirmed on the last sweep. Such apps are tagged
+  `not recently verified` so a stale entry reads as unconfirmed rather than as
+  freshly checked. The apps are still listed and still connectable.
+
 ## [5.105.2] — 2026-09-02
 
 ### Fixed

package/dist/commands/integrations-api.d.ts

@@ -22,6 +22,17 @@ export interface CatalogEntry {
      */
     source?: "hq-discovered" | "integrations.sh" | "hq-recommended";
     authClass?: "none" | "key" | "oauth";
+    /**
+     * Present when the app is listed on a CARRIED-FORWARD verdict: the latest
+     * catalog generation's probe answered HTTP 403, which establishes nothing,
+     * so the previous run's classification was kept rather than dropping the app
+     * on ambiguous evidence.
+     *
+     * The app is still offered — this qualifies the listing, it does not retract
+     * it. Absent (never `false`) on a freshly verified entry, so "no claim" and
+     * "claim is false" stay distinguishable.
+     */
+    verificationCarriedForward?: true;
     /** Opaque server-owned id; prefer it over echoing connection details back. */
     entryId?: string;
 }

package/dist/commands/integrations-connect.js

@@ -84,6 +84,27 @@ const BRING_YOUR_OWN_CLIENT_CODES = new Set([
 function looksLikeDomain(value) {
     return /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(value) && !value.includes(" ");
 }
+/**
+ * The host inside an endpoint URL, or the value unchanged when it is not one.
+ *
+ * `hq integrations inspect` is the "what does this expose before I connect it"
+ * command, so the natural thing to paste is the endpoint URL itself. Without
+ * this, `https://vyg.app/mcp` failed `looksLikeDomain` and went out as a free
+ * text SEARCH, which answered "No integrations.sh results found" for an app
+ * that is in the catalog under exactly that host. hq-pro accepts a URL-shaped
+ * domain, so the only thing missing was sending it as one.
+ */
+function hostFromEndpointUrl(value) {
+    const trimmed = value.trim();
+    if (!/^https?:\/\//i.test(trimmed))
+        return trimmed;
+    try {
+        return new URL(trimmed).hostname;
+    }
+    catch {
+        return trimmed;
+    }
+}
 /**
  * True when this shell is almost certainly on a different machine from the
  * person's browser. Not a security boundary — just the signal that a loopback
@@ -828,6 +849,11 @@ export function registerConnectCommands(integrations) {
                 entry.source === "hq-recommended" ? "recommended" : null,
                 entry.source === "hq-discovered" ? "community" : null,
                 entry.mcpReady ? null : "not one-click",
+                // The listing is a claim about connectability, and for these apps HQ
+                // could not re-confirm it: the last probe was inconclusive and the
+                // previous verdict was carried forward. Say so on the row rather
+                // than let it read the same as an app checked this morning.
+                entry.verificationCarriedForward ? "not recently verified" : null,
             ]
                 .filter(Boolean)
                 .join(" · ");
@@ -845,7 +871,10 @@ export function registerConnectCommands(integrations) {
         .action(async (app, opts) => {
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const blueprint = await pullBlueprint(token, companyUid, looksLikeDomain(app) ? { domain: app } : { query: app });
+        // A pasted endpoint URL names one host; look that host up rather than
+        // searching the catalog for the URL as free text.
+        const host = hostFromEndpointUrl(app);
+        const blueprint = await pullBlueprint(token, companyUid, looksLikeDomain(host) ? { domain: host } : { query: app });
         if (opts.json) {
             printJson(blueprint);
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.105.2",
+  "version": "5.106.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {