@indigoai-us/hq-cli 5.59.0 → 5.61.0

package/src/commands/meetings.ts

@@ -5,35 +5,67 @@ import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 
 interface MeetingListItem {
   meetingId: string;
-  title: string;
-  startTime: string;
-  endTime: string;
-  duration: number;
-  participantCount: number;
-  status: string;
-  hasTranscript: boolean;
-  hasNotes: boolean;
+  sourceShape?: "markdown" | "json";
+  title?: string | null;
+  startTime?: string;
+  endTime?: string;
+  duration?: number;
+  participantCount?: number;
+  status?: string;
+  hasTranscript?: boolean;
+  hasNotes?: boolean;
+  channel?: string;
+  ingested_at?: string;
+  hasSignals?: boolean;
+  companyId?: string;
+  attributed?: boolean;
 }
 
 interface MeetingDetail {
   meetingId: string;
-  title: string;
-  startTime: string;
-  endTime: string;
-  duration: number;
-  participants: Array<{ email: string; name: string | null; role: string }>;
-  calendarEventId: string | null;
-  botProvider: string;
-  sourceApp: string;
-  companyId: string;
-  status: string;
-  recallBotId: string | null;
-  isShared: boolean;
-  createdAt: string;
-  updatedAt: string;
-  documentUrl: string;
-  hasTranscript: boolean;
-  hasNotes: boolean;
+  sourceShape?: "markdown" | "json";
+  title?: string;
+  startTime?: string;
+  endTime?: string;
+  duration?: number;
+  participants?: Array<{ email: string; name: string | null; role: string }>;
+  calendarEventId?: string | null;
+  botProvider?: string;
+  sourceApp?: string;
+  companyId?: string;
+  status?: string;
+  recallBotId?: string | null;
+  isShared?: boolean;
+  createdAt?: string;
+  updatedAt?: string;
+  documentUrl?: string;
+  hasTranscript?: boolean;
+  hasNotes?: boolean;
+  source?: MarkdownMeetingSource;
+  signals?: Record<string, unknown>;
+}
+
+interface MarkdownMeetingFrontmatter {
+  title?: string;
+  channel?: string;
+  origin?: string;
+  company_id?: string;
+  meeting_url?: string;
+  meeting_platform?: string;
+  calendar_event_id?: string | null;
+  scheduled_start_time?: string;
+  created_at?: string;
+  updated_at?: string;
+  ingested_at?: string;
+  recall_bot_id?: string | null;
+  bot_status?: string;
+  auto_scheduled?: boolean;
+}
+
+interface MarkdownMeetingSource {
+  path?: string;
+  presigned_url?: string;
+  frontmatter?: MarkdownMeetingFrontmatter;
 }
 
 interface TranscriptSegment {
@@ -78,6 +110,17 @@ function formatDuration(seconds: number): string {
   return `${s}s`;
 }
 
+function safeFormatDuration(seconds: unknown): string {
+  return typeof seconds === "number" && Number.isFinite(seconds) ? formatDuration(seconds) : "-";
+}
+
+function safeFormatDate(iso: unknown, options?: Intl.DateTimeFormatOptions): string {
+  if (typeof iso !== "string" || iso.length === 0) return "-";
+  const date = new Date(iso);
+  if (Number.isNaN(date.getTime())) return "-";
+  return options ? date.toLocaleString("en-US", options) : date.toLocaleString();
+}
+
 function formatTimestamp(ts: number): string {
   const m = Math.floor(ts / 60);
   const s = Math.floor(ts % 60);
@@ -99,6 +142,45 @@ function statusBadge(status: string): string {
   }
 }
 
+function isMarkdownShape(x: unknown): x is MeetingDetail & {
+  source: MarkdownMeetingSource;
+} {
+  if (!x || typeof x !== "object") return false;
+  const candidate = x as {
+    sourceShape?: string;
+    source?: { frontmatter?: unknown };
+  };
+  return candidate.sourceShape === "markdown" || Boolean(candidate.source?.frontmatter);
+}
+
+function hasSignals(signals: unknown): signals is Record<string, unknown> {
+  return Boolean(
+    signals &&
+      typeof signals === "object" &&
+      !Array.isArray(signals) &&
+      Object.keys(signals).length > 0,
+  );
+}
+
+function renderSignals(signals: Record<string, unknown>): void {
+  console.log(chalk.bold("Signals"));
+  for (const [key, value] of Object.entries(signals)) {
+    if (value === null || value === undefined) {
+      console.log(`  ${key}: -`);
+    } else if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      console.log(`  ${key}: ${String(value)}`);
+    } else {
+      const rendered = JSON.stringify(value, null, 2)
+        .split("\n")
+        .map((line) => `    ${line}`)
+        .join("\n");
+      console.log(`  ${key}:`);
+      console.log(rendered);
+    }
+  }
+  console.log();
+}
+
 async function resolveShortId(
   token: string,
   prefix: string,
@@ -181,16 +263,19 @@ function printMeetingTable(meetings: MeetingListItem[]): void {
     const id = m.meetingId.slice(0, 8);
     const fullTitle = displayTitle(m);
     const title = fullTitle.length > TITLE_W ? fullTitle.slice(0, TITLE_W - 1) + "…" : fullTitle;
-    const date = new Date(m.startTime).toLocaleDateString("en-US", {
+    const date = safeFormatDate(m.startTime, {
       month: "short",
       day: "numeric",
       hour: "2-digit",
       minute: "2-digit",
     });
-    const dur = formatDuration(m.duration);
+    const dur = safeFormatDuration(m.duration);
+    const status = m.status ? statusBadge(m.status) : chalk.dim("-");
+    const parts = typeof m.participantCount === "number" ? String(m.participantCount) : "-";
     const flags = [
       m.hasTranscript ? "T" : "",
       m.hasNotes ? "N" : "",
+      m.hasSignals ? "S" : "",
     ].filter(Boolean).join("") || "-";
 
     console.log(
@@ -199,9 +284,9 @@ function printMeetingTable(meetings: MeetingListItem[]): void {
         title.padEnd(TITLE_W),
         chalk.dim(date.padEnd(DATE_W)),
         dur.padEnd(DUR_W),
-        statusBadge(m.status).padEnd(STATUS_W + 10), // chalk adds escape chars
-        String(m.participantCount).padEnd(PARTS_W),
-        flags,
+        status.padEnd(STATUS_W + 10), // chalk adds escape chars
+        parts.padEnd(PARTS_W),
+        flags.padEnd(FLAGS_W),
       ].join("  "),
     );
   }
@@ -286,17 +371,39 @@ export function registerMeetingsCommand(program: Command): void {
           return;
         }
 
-        console.log(chalk.bold(`\n${detail.title}\n`));
+        if (isMarkdownShape(detail)) {
+          const fm = detail.source.frontmatter ?? {};
+          console.log(chalk.bold(`\n${fm.title || "(untitled)"}\n`));
+          console.log(`  ID:          ${chalk.cyan(detail.meetingId)}`);
+          console.log(`  Status:      ${fm.bot_status || "-"}`);
+          console.log(`  Date:        ${safeFormatDate(fm.scheduled_start_time || fm.created_at)}`);
+          console.log(`  Platform:    ${fm.meeting_platform || "-"}`);
+          console.log(`  Origin:      ${fm.origin || "-"}`);
+          console.log(`  Company:     ${fm.company_id || "-"}`);
+          if (fm.meeting_url) console.log(`  Meeting URL: ${fm.meeting_url}`);
+          if (hasSignals(detail.signals)) {
+            console.log(`  Signals:     ${Object.keys(detail.signals).length}`);
+          }
+          console.log(
+            chalk.dim(
+              `\n  This meeting is stored as a markdown document. Use \`hq meetings transcript ${detail.meetingId.slice(0, 8)}\` to view the full document.`,
+            ),
+          );
+          console.log();
+          return;
+        }
+
+        console.log(chalk.bold(`\n${detail.title ?? "(untitled)"}\n`));
         console.log(`  ID:       ${chalk.cyan(detail.meetingId)}`);
-        console.log(`  Status:   ${statusBadge(detail.status)}`);
-        console.log(`  Date:     ${new Date(detail.startTime).toLocaleString()}`);
-        console.log(`  Duration: ${formatDuration(detail.duration)}`);
-        console.log(`  Source:   ${detail.sourceApp} (${detail.botProvider})`);
+        console.log(`  Status:   ${detail.status ? statusBadge(detail.status) : chalk.dim("-")}`);
+        console.log(`  Date:     ${safeFormatDate(detail.startTime)}`);
+        console.log(`  Duration: ${safeFormatDuration(detail.duration)}`);
+        console.log(`  Source:   ${detail.sourceApp ?? "-"} (${detail.botProvider ?? "-"})`);
         console.log(`  Shared:   ${detail.isShared ? "yes" : "no"}`);
 
-        if (detail.participants.length > 0) {
+        if ((detail.participants?.length ?? 0) > 0) {
           console.log(chalk.bold("\n  Participants:"));
-          for (const p of detail.participants) {
+          for (const p of detail.participants ?? []) {
             const name = p.name ?? p.email;
             const role = p.role === "organizer" ? chalk.yellow(" (organizer)") : "";
             console.log(`    - ${name}${role}`);
@@ -447,6 +554,32 @@ export function registerMeetingsCommand(program: Command): void {
         if (!res.ok) await handleApiError(res);
 
         const detail = (await res.json()) as MeetingDetail;
+
+        if (isMarkdownShape(detail)) {
+          const documentUrl = detail.source.presigned_url;
+          if (!documentUrl) {
+            console.error(chalk.red("No document available for this meeting."));
+            process.exit(1);
+          }
+
+          const docRes = await fetch(documentUrl);
+          if (!docRes.ok) {
+            console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
+            process.exit(1);
+          }
+
+          const markdown = await docRes.text();
+
+          if (meetings.opts().json) {
+            console.log(JSON.stringify({ meetingId: detail.meetingId, sourceShape: "markdown", markdown }, null, 2));
+            return;
+          }
+
+          console.log(chalk.bold(`\nTranscript: ${detail.source.frontmatter?.title || "(untitled)"}\n`));
+          console.log(markdown);
+          return;
+        }
+
         if (!detail.documentUrl) {
           console.error(chalk.red("No document URL available for this meeting."));
           process.exit(1);
@@ -503,6 +636,42 @@ export function registerMeetingsCommand(program: Command): void {
         if (!res.ok) await handleApiError(res);
 
         const detail = (await res.json()) as MeetingDetail;
+
+        if (isMarkdownShape(detail)) {
+          if (hasSignals(detail.signals)) {
+            if (meetings.opts().json) {
+              console.log(JSON.stringify(detail.signals, null, 2));
+              return;
+            }
+            console.log(chalk.bold(`\nMeeting Notes: ${detail.source.frontmatter?.title || "(untitled)"}\n`));
+            renderSignals(detail.signals);
+            return;
+          }
+
+          const documentUrl = detail.source.presigned_url;
+          if (!documentUrl) {
+            console.log(chalk.yellow("No notes available for this meeting."));
+            return;
+          }
+
+          const docRes = await fetch(documentUrl);
+          if (!docRes.ok) {
+            console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
+            process.exit(1);
+          }
+
+          const markdown = await docRes.text();
+
+          if (meetings.opts().json) {
+            console.log(JSON.stringify({ meetingId: detail.meetingId, sourceShape: "markdown", markdown }, null, 2));
+            return;
+          }
+
+          console.log(chalk.bold(`\nMeeting Notes: ${detail.source.frontmatter?.title || "(untitled)"}\n`));
+          console.log(markdown);
+          return;
+        }
+
         if (!detail.documentUrl) {
           console.error(chalk.red("No document URL available for this meeting."));
           process.exit(1);

package/src/commands/pack-install.ts

@@ -68,6 +68,80 @@ import {
 import { readCache, listSecretCacheScopes } from '../utils/secrets-cache.js';
 import type { PackManifest, PackContributeKey } from '../types.js';
 
+const PACK_UPDATE_CACHE_TTL_MS = 12 * 60 * 60 * 1000;
+const PACK_UPDATE_FETCH_TIMEOUT_MS = 3_000;
+
+interface PackUpdateCacheEntry {
+  latest: string;
+  fetchedAt: number;
+}
+
+interface PackUpdateCacheFile {
+  entries: Record<string, PackUpdateCacheEntry>;
+}
+
+export interface ResolveLatestOptions {
+  forceRefresh?: boolean;
+  now?: number;
+  cacheTtlMs?: number;
+  fetchImpl?: typeof fetch;
+}
+
+const gitLsRemoteMemo = new Map<string, string>();
+
+function packUpdateCachePath(): string {
+  return path.join(os.homedir(), '.hq', 'pack-update-cache.json');
+}
+
+function readPackUpdateCache(): PackUpdateCacheFile {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(packUpdateCachePath(), 'utf-8')) as Partial<PackUpdateCacheFile>;
+    if (!parsed || typeof parsed !== 'object' || !parsed.entries || typeof parsed.entries !== 'object') {
+      return { entries: {} };
+    }
+    return { entries: parsed.entries as Record<string, PackUpdateCacheEntry> };
+  } catch {
+    return { entries: {} };
+  }
+}
+
+function writePackUpdateCache(cache: PackUpdateCacheFile): void {
+  try {
+    const file = packUpdateCachePath();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(cache));
+  } catch {
+    // best-effort; update checks must never fail because the cache is unwritable
+  }
+}
+
+function cachedLatest(cacheKey: string, opts: ResolveLatestOptions): string | undefined {
+  if (opts.forceRefresh) return undefined;
+  const entry = readPackUpdateCache().entries[cacheKey];
+  if (!entry || typeof entry.latest !== 'string' || typeof entry.fetchedAt !== 'number') return undefined;
+  const now = opts.now ?? Date.now();
+  const ttl = opts.cacheTtlMs ?? PACK_UPDATE_CACHE_TTL_MS;
+  return now - entry.fetchedAt <= ttl ? entry.latest : undefined;
+}
+
+function storeCachedLatest(cacheKey: string, latest: string, opts: ResolveLatestOptions): void {
+  const cache = readPackUpdateCache();
+  cache.entries[cacheKey] = { latest, fetchedAt: opts.now ?? Date.now() };
+  writePackUpdateCache(cache);
+}
+
+async function latestWithDiskCache(
+  cacheKey: string,
+  opts: ResolveLatestOptions,
+  refresh: () => Promise<string | undefined> | string | undefined,
+): Promise<string | undefined> {
+  const cached = cachedLatest(cacheKey, opts);
+  if (cached) return cached;
+  const latest = await refresh();
+  if (latest) storeCachedLatest(cacheKey, latest, opts);
+  return latest;
+}
+
 // ---------------------------------------------------------------------------
 // Source classification
 // ---------------------------------------------------------------------------
@@ -676,17 +750,37 @@ function rsyncDir(src: string, dest: string): void {
  */
 function isNamedRef(url: string, ref: string): boolean {
   try {
-    const out = execFileSync(
-      'git',
-      ['ls-remote', '--heads', '--tags', url, ref],
-      { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] },
-    );
+    const out = gitLsRemote(['--heads', '--tags', url, ref]);
     return out.trim().length > 0;
   } catch {
     return false;
   }
 }
 
+function gitLsRemote(args: string[]): string {
+  const key = args.join('\0');
+  const cached = gitLsRemoteMemo.get(key);
+  if (cached !== undefined) return cached;
+  const out = execFileSync(
+    'git',
+    ['ls-remote', ...args],
+    { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] },
+  );
+  gitLsRemoteMemo.set(key, out);
+  return out;
+}
+
+async function fetchLatestNpmVersion(pkg: string, opts: ResolveLatestOptions): Promise<string | undefined> {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const res = await fetchImpl(`https://registry.npmjs.org/${encodeURIComponent(pkg)}/latest`, {
+    headers: { Accept: 'application/json' },
+    signal: AbortSignal.timeout(PACK_UPDATE_FETCH_TIMEOUT_MS),
+  });
+  if (!res.ok) throw new Error(`registry returned ${res.status}`);
+  const body = (await res.json()) as { version?: unknown };
+  return typeof body.version === 'string' ? body.version : undefined;
+}
+
 // ---------------------------------------------------------------------------
 // Update-availability probe (no install) — used by `hq packs update --check-only`
 // ---------------------------------------------------------------------------
@@ -711,6 +805,10 @@ function gitRefFromSource(source: string): string | undefined {
   return ref;
 }
 
+function isFullGitSha(ref: string): boolean {
+  return /^[0-9a-f]{40}$/i.test(ref);
+}
+
 /**
  * Probe whether a newer version of an already-installed pack is available,
  * WITHOUT fetching or installing. Reuses the same git/npm primitives as the
@@ -720,10 +818,11 @@ function gitRefFromSource(source: string): string | undefined {
  * @param source         the stamped `source:` from the installed package.yaml
  * @param installedVersion the installed pack's manifest `version` (npm compare)
  */
-export function resolveLatest(
+export async function resolveLatest(
   source: string,
   installedVersion?: string,
-): LatestResult {
+  opts: ResolveLatestOptions = {},
+): Promise<LatestResult> {
   let transport: Transport;
   try {
     transport = classify(source);
@@ -755,15 +854,14 @@ export function resolveLatest(
     const current =
       installedVersion ?? (source.lastIndexOf('@') > 0 ? source.slice(source.lastIndexOf('@') + 1) : undefined);
     try {
-      const latest = execFileSync('npm', ['view', pkg, 'version'], {
-        encoding: 'utf-8',
-        stdio: ['ignore', 'pipe', 'ignore'],
-      }).trim();
+      const latest = await latestWithDiskCache(`npm:${pkg}`, opts, () =>
+        fetchLatestNpmVersion(pkg, opts),
+      );
       const updateAvailable =
         current && latest ? semverGt(latest, current) : null;
       return { transport, current, latest, updateAvailable };
     } catch (e) {
-      return { transport, current, updateAvailable: null, error: `npm view failed: ${(e as Error).message}` };
+      return { transport, current, updateAvailable: null, error: `npm registry check failed: ${(e as Error).message}` };
     }
   }
 
@@ -778,13 +876,12 @@ export function resolveLatest(
   const current = gitRefFromSource(source);
   // If install followed a named ref (branch/tag), compare that ref's tip;
   // otherwise (default SHA-pin) compare the default branch HEAD.
-  const refArg = current && isNamedRef(url, current) ? current : 'HEAD';
+  const refArg = current && !isFullGitSha(current) && isNamedRef(url, current) ? current : 'HEAD';
   try {
-    const out = execFileSync('git', ['ls-remote', url, refArg], {
-      encoding: 'utf-8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-    const latest = out.split(/\s+/)[0] || undefined;
+    const latest = await latestWithDiskCache(`git:${url}#${refArg}`, opts, () => {
+      const out = gitLsRemote([url, refArg]).trim();
+      return out.split(/\s+/)[0] || undefined;
+    });
     const updateAvailable =
       current && latest ? !latest.startsWith(current) && !current.startsWith(latest) : null;
     return { transport, current, latest, updateAvailable };

package/src/commands/pack-update-cache.test.ts

@@ -0,0 +1,149 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { execFileSync } from 'child_process';
+
+vi.mock('child_process', () => ({
+  execFileSync: vi.fn(),
+  spawnSync: vi.fn(() => ({ status: 0 })),
+}));
+
+vi.mock('../utils/vault-api.js', () => ({
+  vaultApiFetchPublic: vi.fn(),
+}));
+
+const tmpHome = path.join(os.tmpdir(), `hq-pack-update-cache-${process.pid}`);
+
+beforeEach(() => {
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+  fs.mkdirSync(tmpHome, { recursive: true });
+  vi.stubEnv('HOME', tmpHome);
+  vi.mocked(execFileSync).mockReset();
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+async function loadModule() {
+  vi.resetModules();
+  return await import('./pack-install.js');
+}
+
+describe('resolveLatest pack update cache', () => {
+  it('fetches npm registry metadata over HTTP once, then compares cached latest against the installed version at read time', async () => {
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({ version: '2.0.0' }),
+    } as unknown as Response);
+    vi.stubGlobal('fetch', fetchMock);
+
+    const { resolveLatest } = await loadModule();
+
+    const staleInstall = await resolveLatest('@scope/pack@1.0.0', '1.0.0', {
+      forceRefresh: true,
+    });
+    const currentInstall = await resolveLatest('@scope/pack@1.0.0', '2.0.0');
+
+    expect(staleInstall).toMatchObject({
+      transport: 'npm',
+      current: '1.0.0',
+      latest: '2.0.0',
+      updateAvailable: true,
+    });
+    expect(currentInstall).toMatchObject({
+      transport: 'npm',
+      current: '2.0.0',
+      latest: '2.0.0',
+      updateAvailable: false,
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(execFileSync)).not.toHaveBeenCalledWith(
+      'npm',
+      ['view', '@scope/pack', 'version'],
+      expect.anything(),
+    );
+    expect(fs.existsSync(path.join(tmpHome, '.hq', 'pack-update-cache.json'))).toBe(true);
+  });
+
+  it('bypasses a fresh npm cache entry when forceRefresh is set', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ version: '2.0.0' }),
+      } as unknown as Response)
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ version: '3.0.0' }),
+      } as unknown as Response);
+    vi.stubGlobal('fetch', fetchMock);
+
+    const { resolveLatest } = await loadModule();
+
+    await resolveLatest('@scope/pack@1.0.0', '1.0.0', { forceRefresh: true });
+    const refreshed = await resolveLatest('@scope/pack@1.0.0', '1.0.0', {
+      forceRefresh: true,
+    });
+
+    expect(refreshed).toMatchObject({
+      latest: '3.0.0',
+      updateAvailable: true,
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('shares git ls-remote probes by URL and ref within one process', async () => {
+    vi.mocked(execFileSync).mockImplementation((_cmd, args) => {
+      const argv = args as string[];
+      if (argv[1] === '--heads') return '';
+      if (argv[0] === 'ls-remote') return 'abcdef1234567890\tHEAD\n';
+      throw new Error(`unexpected command: ${argv.join(' ')}`);
+    });
+
+    const { resolveLatest } = await loadModule();
+
+    const first = await resolveLatest('https://example.test/repo.git#123456', '1.0.0');
+    const second = await resolveLatest('https://example.test/repo.git#123456', '1.0.0');
+
+    expect(first.latest).toBe('abcdef1234567890');
+    expect(second.latest).toBe('abcdef1234567890');
+    const lsRemoteCalls = vi
+      .mocked(execFileSync)
+      .mock.calls.filter(([cmd, args]) => cmd === 'git' && (args as string[])[0] === 'ls-remote');
+    expect(lsRemoteCalls).toHaveLength(2);
+  });
+
+  it('uses a fresh git disk cache entry without probing git for SHA-pinned sources', async () => {
+    const installedSha = '1111111111111111111111111111111111111111';
+    vi.mocked(execFileSync).mockImplementation((_cmd, args) => {
+      const argv = args as string[];
+      if (argv[0] === 'ls-remote') return 'abcdef1234567890\tHEAD\n';
+      throw new Error(`unexpected command: ${argv.join(' ')}`);
+    });
+
+    const firstModule = await loadModule();
+    await firstModule.resolveLatest(`https://example.test/repo.git#${installedSha}`, '1.0.0', {
+      forceRefresh: true,
+    });
+
+    vi.mocked(execFileSync).mockReset();
+    const secondModule = await loadModule();
+    const cached = await secondModule.resolveLatest(
+      `https://example.test/repo.git#${installedSha}`,
+      '1.0.0',
+    );
+
+    expect(cached).toMatchObject({
+      transport: 'git',
+      current: installedSha,
+      latest: 'abcdef1234567890',
+      updateAvailable: true,
+    });
+    expect(vi.mocked(execFileSync)).not.toHaveBeenCalled();
+  });
+});