@indigoai-us/hq-cli 5.59.0 → 5.61.0

package/src/commands/packs.ts

@@ -144,6 +144,7 @@ export function buildInstalledView(
   pack: InstalledPack,
   installedSources: Set<string>,
   checkUpdates: boolean,
+  latestProbe?: LatestResult,
 ): InstalledPackView {
   if (!pack.manifest) {
     return {
@@ -178,7 +179,7 @@ export function buildInstalledView(
 
   let updateAvailable: boolean | null = null;
   if (checkUpdates && m.source) {
-    updateAvailable = resolveLatest(m.source, m.version).updateAvailable;
+    updateAvailable = latestProbe?.updateAvailable ?? null;
   }
 
   // US-005 — surface the pack's `initialization` block so the HQ Sync
@@ -214,15 +215,27 @@ export function buildInstalledView(
   };
 }
 
-function buildListView(hqRoot: string, checkUpdates: boolean, evalConditionals: boolean): PacksListView {
+async function buildListView(
+  hqRoot: string,
+  checkUpdates: boolean,
+  evalConditionals: boolean,
+  refreshUpdates: boolean,
+): Promise<PacksListView> {
   const hqVersion = readHqVersion(hqRoot);
   const packs = listInstalledPacks(hqRoot);
   const catalog = readRecommendedPackages(hqRoot);
   const catalogSources = new Set(catalog.map((c) => c.source));
   const warnings: string[] = [];
 
-  const installed = packs.map((p) =>
-    buildInstalledView(hqRoot, hqVersion, p, catalogSources, checkUpdates),
+  const latestProbes = await Promise.all(
+    packs.map((p) =>
+      checkUpdates && p.manifest?.source
+        ? resolveLatest(p.manifest.source, p.manifest.version, { forceRefresh: refreshUpdates })
+        : Promise.resolve(undefined),
+    ),
+  );
+  const installed = packs.map((p, i) =>
+    buildInstalledView(hqRoot, hqVersion, p, catalogSources, checkUpdates, latestProbes[i]),
   );
   for (const p of installed) {
     if (p.error) warnings.push(`${p.name}: ${p.error}`);
@@ -303,6 +316,7 @@ interface UpdateCheck {
 
 interface UpdateOpts extends CommonOpts {
   checkOnly?: boolean;
+  refresh?: boolean;
   yes?: boolean;
   allowHooks?: boolean;
   allowMcp?: boolean;
@@ -334,7 +348,7 @@ async function runUpdate(name: string | undefined, opts: UpdateOpts): Promise<Up
     const probe: LatestResult =
       safeClassify(source) === 'marketplace'
         ? await resolveLatestMarketplace(source, m.version)
-        : resolveLatest(source, m.version);
+        : await resolveLatest(source, m.version, { forceRefresh: true });
     const base: UpdateCheck = {
       name: pname,
       transport: probe.transport,
@@ -517,11 +531,17 @@ export function registerPacksCommand(parent: Command): void {
     .option('--json', 'Machine-readable JSON output')
     .option('--hq-root <path>', 'HQ root (default: auto-detect)')
     .option('--check-updates', 'Probe each pack for available updates (network I/O)')
+    .option('--refresh', 'Bypass cached update probes')
     .option('--eval-conditionals', 'Evaluate catalog conditional predicates (runs bash)')
     .action(
-      async (opts: CommonOpts & { checkUpdates?: boolean; evalConditionals?: boolean }) => {
+      async (opts: CommonOpts & { checkUpdates?: boolean; evalConditionals?: boolean; refresh?: boolean }) => {
         try {
-          const view = buildListView(resolveRoot(opts), !!opts.checkUpdates, !!opts.evalConditionals);
+          const view = await buildListView(
+            resolveRoot(opts),
+            !!opts.checkUpdates,
+            !!opts.evalConditionals,
+            !!opts.refresh,
+          );
           if (wantsJson(opts)) emitJson(view);
           else printListHuman(view);
         } catch (e) {
@@ -537,6 +557,7 @@ export function registerPacksCommand(parent: Command): void {
     .option('--json', 'Machine-readable JSON output')
     .option('--hq-root <path>', 'HQ root (default: auto-detect)')
     .option('--check-only', 'Report availability without installing')
+    .option('--refresh', 'Bypass cached update probes (update refreshes by default)')
     .option('-y, --yes', 'Non-interactive (implies --allow-hooks and --allow-mcp)')
     .option('--allow-hooks', 'Install pack hooks without prompting')
     .option('--allow-mcp', 'Register pack MCP servers without prompting')

package/src/commands/secrets.test.ts

@@ -264,6 +264,95 @@ describe("secrets sandbox", () => {
     expect(stdoutSpy).toHaveBeenCalledWith("token [REDACTED]\nAPI_KEY=[REDACTED]\n");
   });
 
+  it("terminates sandbox output with exactly one newline when output is present", async () => {
+    pollJobSpy.mockResolvedValueOnce({
+      jobId: "job_123",
+      status: "succeeded",
+      output: "123",
+      exitCode: 0,
+      success: true,
+    });
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "sandbox",
+      "--only",
+      "API_KEY",
+      "--",
+      "my-skill",
+    ]);
+
+    expect(stdoutSpy.mock.calls.flat().join("")).toBe("123\n");
+
+    stdoutSpy.mockClear();
+    pollJobSpy.mockResolvedValueOnce({
+      jobId: "job_123",
+      status: "succeeded",
+      output: "123\n",
+      exitCode: 0,
+      success: true,
+    });
+
+    await buildProgram().parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "sandbox",
+      "--only",
+      "API_KEY",
+      "--",
+      "my-skill",
+    ]);
+
+    expect(stdoutSpy.mock.calls.flat().join("")).toBe("123\n");
+
+    stdoutSpy.mockClear();
+    pollJobSpy.mockResolvedValueOnce({
+      jobId: "job_123",
+      status: "succeeded",
+      output: "",
+      exitCode: 0,
+      success: true,
+    });
+
+    await buildProgram().parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "sandbox",
+      "--only",
+      "API_KEY",
+      "--",
+      "my-skill",
+    ]);
+
+    expect(stdoutSpy).not.toHaveBeenCalled();
+
+    stdoutSpy.mockClear();
+    pollJobSpy.mockResolvedValueOnce({
+      jobId: "job_123",
+      status: "succeeded",
+      exitCode: 0,
+      success: true,
+    });
+
+    await buildProgram().parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "sandbox",
+      "--only",
+      "API_KEY",
+      "--",
+      "my-skill",
+    ]);
+
+    expect(stdoutSpy).not.toHaveBeenCalled();
+  });
+
   it("exits non-zero when the sandbox command fails", async () => {
     pollJobSpy.mockResolvedValueOnce({
       jobId: "job_123",
@@ -439,6 +528,324 @@ describe("US-003 — CLI refuses high-security secrets on local injection", () =
   });
 });
 
+// secrets-proxy-per-secret-destination US-006: hq-cli creation-side parity.
+// `hq secrets set NAME --high-security --destination <url> [--auth-style ...]`
+// POSTs `highSecurity`/`destinations`/`injection` to the vault API — the CLI
+// counterpart to the console create-form (US-005) and the server contract
+// (US-001/US-004). Value input is exercised via --from-stdin (unaffected by
+// this story) so these tests isolate the new flag-handling/validation.
+describe("US-006 — hq secrets set --high-security --destination parity", () => {
+  let exitSpy: MockInstance<typeof process.exit>;
+  let stdinIsTTYSpy: MockInstance<() => boolean> | undefined;
+
+  beforeEach(() => {
+    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
+      throw new Error("__exit__");
+    }) as never);
+  });
+
+  afterEach(() => {
+    stdinIsTTYSpy?.mockRestore();
+    stdinIsTTYSpy = undefined;
+  });
+
+  // Drives the value through the existing --from-stdin path (unchanged by
+  // this story) by feeding a piped-stdin double: mocks isTTY=false and
+  // replaces the data/end listeners `readFromPipedStdin` attaches.
+  function stubPipedStdin(value: string): void {
+    Object.defineProperty(process.stdin, "isTTY", {
+      configurable: true,
+      value: false,
+    });
+    vi.spyOn(process.stdin, "on").mockImplementation(((
+      event: string,
+      cb: (...args: unknown[]) => void,
+    ) => {
+      if (event === "data") cb(value);
+      if (event === "end") cb();
+      return process.stdin;
+    }) as never);
+  }
+
+  it("with no flags, the POST body is byte-for-byte unchanged (just name+value)", async () => {
+    stubPipedStdin("plain-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "MY_KEY",
+      "--from-stdin",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: { name: "MY_KEY", value: "plain-value" },
+    });
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+
+  it("--high-security with a KNOWN destination auto-resolves the recipe (no --auth-style needed)", async () => {
+    stubPipedStdin("sk-secret-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "OPENAI_KEY",
+      "--from-stdin",
+      "--high-security",
+      "--destination",
+      "https://api.openai.com",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: {
+        name: "OPENAI_KEY",
+        value: "sk-secret-value",
+        highSecurity: true,
+        destinations: ["https://api.openai.com"],
+      },
+    });
+    expect(errSpy).not.toHaveBeenCalled();
+    expect(logSpy.mock.calls.flat().join(" ")).toMatch(/high-security/i);
+  });
+
+  it("--auth-style bearer maps to {header: authorization, scheme: bearer}", async () => {
+    stubPipedStdin("bearer-token-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "SOME_BEARER_KEY",
+      "--from-stdin",
+      "--high-security",
+      "--destination",
+      "https://api.example.com",
+      "--auth-style",
+      "bearer",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: {
+        name: "SOME_BEARER_KEY",
+        value: "bearer-token-value",
+        highSecurity: true,
+        destinations: ["https://api.example.com"],
+        injection: { header: "authorization", scheme: "bearer" },
+      },
+    });
+  });
+
+  it("--auth-style x-api-key maps to {header: x-api-key, scheme: raw}", async () => {
+    stubPipedStdin("raw-key-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "SOME_RAW_KEY",
+      "--from-stdin",
+      "--high-security",
+      "--destination",
+      "https://api.example.com",
+      "--auth-style",
+      "x-api-key",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: {
+        name: "SOME_RAW_KEY",
+        value: "raw-key-value",
+        highSecurity: true,
+        destinations: ["https://api.example.com"],
+        injection: { header: "x-api-key", scheme: "raw" },
+      },
+    });
+  });
+
+  it("--auth-style header:NAME maps to a custom raw header", async () => {
+    stubPipedStdin("custom-header-value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "set",
+      "CUSTOM_HEADER_KEY",
+      "--from-stdin",
+      "--high-security",
+      "--destination",
+      "https://api.example.com",
+      "--auth-style",
+      "header:X-Custom-Key",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice",
+      method: "POST",
+      body: {
+        name: "CUSTOM_HEADER_KEY",
+        value: "custom-header-value",
+        highSecurity: true,
+        destinations: ["https://api.example.com"],
+        injection: { header: "X-Custom-Key", scheme: "raw" },
+      },
+    });
+  });
+
+  it("--high-security with an UNKNOWN host and no --auth-style errors clearly, client-side (no request sent)", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "UNKNOWN_HOST_KEY",
+        "--from-stdin",
+        "--high-security",
+        "--destination",
+        "https://api.unknown-vendor.example",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/unknown destination host/i);
+    expect(errText).toMatch(/--auth-style/);
+    // Client-side rejection — never reaches the network.
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("--high-security with no --destination errors clearly (non-zero exit, no request sent)", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "MISSING_DEST_KEY",
+        "--from-stdin",
+        "--high-security",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/--high-security/);
+    expect(errText).toMatch(/--destination/);
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("--destination without --high-security errors clearly (non-zero exit, no request sent)", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "STRAY_DEST_KEY",
+        "--from-stdin",
+        "--destination",
+        "https://api.openai.com",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("an invalid --destination URL (path segment) errors clearly, client-side", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "BAD_URL_KEY",
+        "--from-stdin",
+        "--high-security",
+        "--destination",
+        "https://api.openai.com/v1",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/no path, query, or fragment/i);
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("surfaces the server's rejection message when the backend 400s (e.g. unknown host drift)", async () => {
+    stubPipedStdin("value");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes(
+        {
+          error:
+            "unknown destination host api.newer-vendor.com: provide an injection recipe (header + scheme)",
+        },
+        400,
+      ),
+    );
+
+    const program = buildProgram();
+    // A host absent from the CLI's own known-set copy but WOULD be flagged
+    // client-side too (this asserts the server-error surfacing path itself
+    // stays intact, using --auth-style to bypass the client-side check and
+    // reach the network).
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "set",
+        "DRIFT_KEY",
+        "--from-stdin",
+        "--high-security",
+        "--destination",
+        "https://api.newer-vendor.com",
+        "--auth-style",
+        "bearer",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/unknown destination host/i);
+  });
+});
+
 describe("secrets generate-link", () => {
   it("mints one-time submission links for personal secrets", async () => {
     const program = buildProgram();