@indigoai-us/hq-cli 5.60.0 → 5.61.0

package/dist/commands/pack-install.d.ts

@@ -36,6 +36,12 @@
 import { type KeyObject } from 'node:crypto';
 import { type SecretResolver } from './mcp-registration.js';
 import type { PackManifest } from '../types.js';
+export interface ResolveLatestOptions {
+    forceRefresh?: boolean;
+    now?: number;
+    cacheTtlMs?: number;
+    fetchImpl?: typeof fetch;
+}
 export type Transport = 'npm' | 'git' | 'local' | 'marketplace';
 /** Prefix that routes a source through the HQ marketplace transport (US-006). */
 export declare const MARKETPLACE_PREFIX = "marketplace:";
@@ -181,7 +187,7 @@ export interface LatestResult {
  * @param source         the stamped `source:` from the installed package.yaml
  * @param installedVersion the installed pack's manifest `version` (npm compare)
  */
-export declare function resolveLatest(source: string, installedVersion?: string): LatestResult;
+export declare function resolveLatest(source: string, installedVersion?: string, opts?: ResolveLatestOptions): Promise<LatestResult>;
 /**
  * Async marketplace update probe (US-006): resolve the slug's latest approved
  * listing version and compare it to the installed version. Reuses the same

package/dist/commands/pack-install.js

@@ -34,7 +34,7 @@
  * from each pack's package.yaml; rationale lives in the layout-fix PR.)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0ec07d3a-ee86-51fd-adbd-2608c620ae99")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a90272ca-94a1-5905-85f8-af12a01cb58a")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -54,6 +54,58 @@ import { safeExtractTarball } from './safe-extract.js';
 import { vaultApiFetchPublic } from '../utils/vault-api.js';
 import { redactSecrets, SECRET_REDACTION, registerMcpServers, McpManifestError, } from './mcp-registration.js';
 import { readCache, listSecretCacheScopes } from '../utils/secrets-cache.js';
+const PACK_UPDATE_CACHE_TTL_MS = 12 * 60 * 60 * 1000;
+const PACK_UPDATE_FETCH_TIMEOUT_MS = 3_000;
+const gitLsRemoteMemo = new Map();
+function packUpdateCachePath() {
+    return path.join(os.homedir(), '.hq', 'pack-update-cache.json');
+}
+function readPackUpdateCache() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(packUpdateCachePath(), 'utf-8'));
+        if (!parsed || typeof parsed !== 'object' || !parsed.entries || typeof parsed.entries !== 'object') {
+            return { entries: {} };
+        }
+        return { entries: parsed.entries };
+    }
+    catch {
+        return { entries: {} };
+    }
+}
+function writePackUpdateCache(cache) {
+    try {
+        const file = packUpdateCachePath();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(cache));
+    }
+    catch {
+        // best-effort; update checks must never fail because the cache is unwritable
+    }
+}
+function cachedLatest(cacheKey, opts) {
+    if (opts.forceRefresh)
+        return undefined;
+    const entry = readPackUpdateCache().entries[cacheKey];
+    if (!entry || typeof entry.latest !== 'string' || typeof entry.fetchedAt !== 'number')
+        return undefined;
+    const now = opts.now ?? Date.now();
+    const ttl = opts.cacheTtlMs ?? PACK_UPDATE_CACHE_TTL_MS;
+    return now - entry.fetchedAt <= ttl ? entry.latest : undefined;
+}
+function storeCachedLatest(cacheKey, latest, opts) {
+    const cache = readPackUpdateCache();
+    cache.entries[cacheKey] = { latest, fetchedAt: opts.now ?? Date.now() };
+    writePackUpdateCache(cache);
+}
+async function latestWithDiskCache(cacheKey, opts, refresh) {
+    const cached = cachedLatest(cacheKey, opts);
+    if (cached)
+        return cached;
+    const latest = await refresh();
+    if (latest)
+        storeCachedLatest(cacheKey, latest, opts);
+    return latest;
+}
 /** Prefix that routes a source through the HQ marketplace transport (US-006). */
 export const MARKETPLACE_PREFIX = 'marketplace:';
 export function classify(source) {
@@ -489,13 +541,33 @@ function rsyncDir(src, dest) {
  */
 function isNamedRef(url, ref) {
     try {
-        const out = execFileSync('git', ['ls-remote', '--heads', '--tags', url, ref], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const out = gitLsRemote(['--heads', '--tags', url, ref]);
         return out.trim().length > 0;
     }
     catch {
         return false;
     }
 }
+function gitLsRemote(args) {
+    const key = args.join('\0');
+    const cached = gitLsRemoteMemo.get(key);
+    if (cached !== undefined)
+        return cached;
+    const out = execFileSync('git', ['ls-remote', ...args], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+    gitLsRemoteMemo.set(key, out);
+    return out;
+}
+async function fetchLatestNpmVersion(pkg, opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const res = await fetchImpl(`https://registry.npmjs.org/${encodeURIComponent(pkg)}/latest`, {
+        headers: { Accept: 'application/json' },
+        signal: AbortSignal.timeout(PACK_UPDATE_FETCH_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`registry returned ${res.status}`);
+    const body = (await res.json());
+    return typeof body.version === 'string' ? body.version : undefined;
+}
 /** Extract the ref (sha or named ref) recorded in a stamped git source. */
 function gitRefFromSource(source) {
     const { subpath, ref } = parseGitFragment(source);
@@ -504,6 +576,9 @@ function gitRefFromSource(source) {
     void subpath;
     return ref;
 }
+function isFullGitSha(ref) {
+    return /^[0-9a-f]{40}$/i.test(ref);
+}
 /**
  * Probe whether a newer version of an already-installed pack is available,
  * WITHOUT fetching or installing. Reuses the same git/npm primitives as the
@@ -513,7 +588,7 @@ function gitRefFromSource(source) {
  * @param source         the stamped `source:` from the installed package.yaml
  * @param installedVersion the installed pack's manifest `version` (npm compare)
  */
-export function resolveLatest(source, installedVersion) {
+export async function resolveLatest(source, installedVersion, opts = {}) {
     let transport;
     try {
         transport = classify(source);
@@ -542,15 +617,12 @@ export function resolveLatest(source, installedVersion) {
         const pkg = stripVersion(source);
         const current = installedVersion ?? (source.lastIndexOf('@') > 0 ? source.slice(source.lastIndexOf('@') + 1) : undefined);
         try {
-            const latest = execFileSync('npm', ['view', pkg, 'version'], {
-                encoding: 'utf-8',
-                stdio: ['ignore', 'pipe', 'ignore'],
-            }).trim();
+            const latest = await latestWithDiskCache(`npm:${pkg}`, opts, () => fetchLatestNpmVersion(pkg, opts));
             const updateAvailable = current && latest ? semverGt(latest, current) : null;
             return { transport, current, latest, updateAvailable };
         }
         catch (e) {
-            return { transport, current, updateAvailable: null, error: `npm view failed: ${e.message}` };
+            return { transport, current, updateAvailable: null, error: `npm registry check failed: ${e.message}` };
         }
     }
     // git
@@ -565,13 +637,12 @@ export function resolveLatest(source, installedVersion) {
     const current = gitRefFromSource(source);
     // If install followed a named ref (branch/tag), compare that ref's tip;
     // otherwise (default SHA-pin) compare the default branch HEAD.
-    const refArg = current && isNamedRef(url, current) ? current : 'HEAD';
+    const refArg = current && !isFullGitSha(current) && isNamedRef(url, current) ? current : 'HEAD';
     try {
-        const out = execFileSync('git', ['ls-remote', url, refArg], {
-            encoding: 'utf-8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-        const latest = out.split(/\s+/)[0] || undefined;
+        const latest = await latestWithDiskCache(`git:${url}#${refArg}`, opts, () => {
+            const out = gitLsRemote([url, refArg]).trim();
+            return out.split(/\s+/)[0] || undefined;
+        });
         const updateAvailable = current && latest ? !latest.startsWith(current) && !current.startsWith(latest) : null;
         return { transport, current, latest, updateAvailable };
     }
@@ -1629,4 +1700,4 @@ export async function installPack(source, opts = {}) {
     }
 }
 //# sourceMappingURL=pack-install.js.map
-//# debugId=0ec07d3a-ee86-51fd-adbd-2608c620ae99
+//# debugId=a90272ca-94a1-5905-85f8-af12a01cb58a

package/dist/commands/packs.d.ts

@@ -18,6 +18,7 @@
  * Spec: knowledge/public/hq-core/package-yaml-spec.md.
  */
 import { Command } from 'commander';
+import { type LatestResult } from './pack-install.js';
 import { type InstalledPack, type LinkStatus } from '../utils/pack-contributions.js';
 import type { PackContributeKey } from '../types.js';
 interface InstalledPackView {
@@ -48,7 +49,7 @@ interface InstalledPackView {
     };
     error?: string;
 }
-export declare function buildInstalledView(hqRoot: string, hqVersion: string | null, pack: InstalledPack, installedSources: Set<string>, checkUpdates: boolean): InstalledPackView;
+export declare function buildInstalledView(hqRoot: string, hqVersion: string | null, pack: InstalledPack, installedSources: Set<string>, checkUpdates: boolean, latestProbe?: LatestResult): InstalledPackView;
 export declare function registerPacksCommand(parent: Command): void;
 export {};
 //# sourceMappingURL=packs.d.ts.map

package/dist/commands/packs.js

@@ -18,7 +18,7 @@
  * Spec: knowledge/public/hq-core/package-yaml-spec.md.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="69746edd-f9d8-528e-8902-de799c58bd8a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f8ee3de6-a097-5e0f-8afa-63381f29032d")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as readline from 'readline';
@@ -61,7 +61,7 @@ async function confirm(question) {
     });
     return /^(y|yes)$/i.test(answer.trim());
 }
-export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, checkUpdates) {
+export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, checkUpdates, latestProbe) {
     if (!pack.manifest) {
         return {
             name: pack.name,
@@ -95,7 +95,7 @@ export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, ch
     const hqCoreSatisfied = hqVersion && requiresHqCore ? semverSatisfies(hqVersion, requiresHqCore) : null;
     let updateAvailable = null;
     if (checkUpdates && m.source) {
-        updateAvailable = resolveLatest(m.source, m.version).updateAvailable;
+        updateAvailable = latestProbe?.updateAvailable ?? null;
     }
     // US-005 — surface the pack's `initialization` block so the HQ Sync
     // "Installed" panel can render its get-started affordance. `readPackManifest`
@@ -129,13 +129,16 @@ export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, ch
         ...(initialization ? { initialization } : {}),
     };
 }
-function buildListView(hqRoot, checkUpdates, evalConditionals) {
+async function buildListView(hqRoot, checkUpdates, evalConditionals, refreshUpdates) {
     const hqVersion = readHqVersion(hqRoot);
     const packs = listInstalledPacks(hqRoot);
     const catalog = readRecommendedPackages(hqRoot);
     const catalogSources = new Set(catalog.map((c) => c.source));
     const warnings = [];
-    const installed = packs.map((p) => buildInstalledView(hqRoot, hqVersion, p, catalogSources, checkUpdates));
+    const latestProbes = await Promise.all(packs.map((p) => checkUpdates && p.manifest?.source
+        ? resolveLatest(p.manifest.source, p.manifest.version, { forceRefresh: refreshUpdates })
+        : Promise.resolve(undefined)));
+    const installed = packs.map((p, i) => buildInstalledView(hqRoot, hqVersion, p, catalogSources, checkUpdates, latestProbes[i]));
     for (const p of installed) {
         if (p.error)
             warnings.push(`${p.name}: ${p.error}`);
@@ -217,7 +220,7 @@ async function runUpdate(name, opts) {
         // other transport keeps the existing synchronous probe unchanged.
         const probe = safeClassify(source) === 'marketplace'
             ? await resolveLatestMarketplace(source, m.version)
-            : resolveLatest(source, m.version);
+            : await resolveLatest(source, m.version, { forceRefresh: true });
         const base = {
             name: pname,
             transport: probe.transport,
@@ -374,10 +377,11 @@ export function registerPacksCommand(parent) {
         .option('--json', 'Machine-readable JSON output')
         .option('--hq-root <path>', 'HQ root (default: auto-detect)')
         .option('--check-updates', 'Probe each pack for available updates (network I/O)')
+        .option('--refresh', 'Bypass cached update probes')
         .option('--eval-conditionals', 'Evaluate catalog conditional predicates (runs bash)')
         .action(async (opts) => {
         try {
-            const view = buildListView(resolveRoot(opts), !!opts.checkUpdates, !!opts.evalConditionals);
+            const view = await buildListView(resolveRoot(opts), !!opts.checkUpdates, !!opts.evalConditionals, !!opts.refresh);
             if (wantsJson(opts))
                 emitJson(view);
             else
@@ -394,6 +398,7 @@ export function registerPacksCommand(parent) {
         .option('--json', 'Machine-readable JSON output')
         .option('--hq-root <path>', 'HQ root (default: auto-detect)')
         .option('--check-only', 'Report availability without installing')
+        .option('--refresh', 'Bypass cached update probes (update refreshes by default)')
         .option('-y, --yes', 'Non-interactive (implies --allow-hooks and --allow-mcp)')
         .option('--allow-hooks', 'Install pack hooks without prompting')
         .option('--allow-mcp', 'Register pack MCP servers without prompting')
@@ -463,4 +468,4 @@ export function registerPacksCommand(parent) {
     });
 }
 //# sourceMappingURL=packs.js.map
-//# debugId=69746edd-f9d8-528e-8902-de799c58bd8a
+//# debugId=f8ee3de6-a097-5e0f-8afa-63381f29032d

package/dist/commands/secrets.d.ts

@@ -36,6 +36,11 @@ export interface SecretLoadResponse {
         message?: string;
     }>;
 }
+export interface SecretInjectionRecipe {
+    header: string;
+    scheme: "raw" | "bearer";
+    extraHeaders?: Record<string, string>;
+}
 export declare function scrubSandboxOutput(text: string, secretNames?: string[]): string;
 export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage): Promise<Map<string, string>>;
 export declare function registerSecretsCommand(program: Command): void;

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3b78d543-70d6-52e2-b19f-fa2650534e97")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ac2acbfe-d6f8-52af-9e1a-38b43474a6d5")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -153,6 +153,74 @@ function describeSecretAclPrincipal(principal) {
         ? "@all (entire company)"
         : principal.granteeId;
 }
+// Mirrors hq-pro's server-authoritative KNOWN_DESTINATION_REGISTRY
+// (src/vault-service/handlers/destination-registry.ts) — a KNOWN host's
+// --auth-style is optional because the server resolves the recipe itself.
+// This client-side copy exists purely so an UNKNOWN host with no
+// --auth-style can be rejected immediately with a clear, actionable message
+// instead of a round trip; the server remains the authoritative validator
+// (this list drifting stale merely means one extra CLI round trip, not a
+// security gap — the server still 400s an unrecognized host with no recipe).
+const KNOWN_DESTINATION_HOSTS = new Set([
+    "api.anthropic.com",
+    "api.openai.com",
+    "api.stripe.com",
+]);
+// Parses `--auth-style` into the InjectionRecipe shape the server expects.
+// Returns `null` (with a printed error) for an unrecognized value.
+function parseAuthStyle(authStyle) {
+    if (authStyle === "bearer") {
+        return { header: "authorization", scheme: "bearer" };
+    }
+    if (authStyle === "x-api-key") {
+        return { header: "x-api-key", scheme: "raw" };
+    }
+    const headerMatch = authStyle.match(/^header:(.+)$/);
+    if (headerMatch) {
+        const headerName = headerMatch[1].trim();
+        if (!headerName) {
+            console.error(chalk.red(`Invalid --auth-style 'header:': must name a header, e.g. header:X-Custom-Key`));
+            return null;
+        }
+        return { header: headerName, scheme: "raw" };
+    }
+    console.error(chalk.red(`Invalid --auth-style '${authStyle}': must be one of bearer, x-api-key, or header:NAME`));
+    return null;
+}
+// Validates `--destination` is a bare HTTPS scheme+host URL (no path, query,
+// port). Mirrors hq-pro's `validateDestinations` server-side check
+// (src/vault-service/handlers/secrets.ts) so a malformed URL is caught
+// locally with an actionable message rather than a round trip — the server
+// re-validates and remains authoritative.
+function parseDestinationUrl(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        console.error(chalk.red(`Invalid --destination '${raw}': must be a valid URL`));
+        return { ok: false };
+    }
+    if (parsed.protocol !== "https:") {
+        console.error(chalk.red(`Invalid --destination '${raw}': must use https://`));
+        return { ok: false };
+    }
+    if (!parsed.hostname) {
+        console.error(chalk.red(`Invalid --destination '${raw}': missing hostname`));
+        return { ok: false };
+    }
+    if ((parsed.pathname !== "" && parsed.pathname !== "/") ||
+        parsed.search !== "" ||
+        parsed.hash !== "") {
+        console.error(chalk.red(`Invalid --destination '${raw}': must be a bare scheme+host URL with no path, query, or fragment (e.g. https://api.openai.com)`));
+        return { ok: false };
+    }
+    if (parsed.port !== "") {
+        console.error(chalk.red(`Invalid --destination '${raw}': must not specify a port`));
+        return { ok: false };
+    }
+    return { ok: true, url: `https://${parsed.hostname}`, hostname: parsed.hostname };
+}
 function normalizeSecretTier(tier) {
     return tier === "sensitive" || tier === "nuclear" ? tier : "standard";
 }
@@ -378,12 +446,56 @@ export function registerSecretsCommand(program) {
         .command("set <name>")
         .description("Create or update a secret")
         .option("--from-stdin", "Read secret value from piped stdin")
+        .option("--high-security", "Mark the secret high-security: it can never be revealed or injected locally, only used through the HQ secret proxy (requires --destination)")
+        .option("--destination <https-url>", "Approved scheme+host HTTPS URL the proxy may forward this secret to (e.g. https://api.openai.com); required with --high-security")
+        .option("--auth-style <style>", "How the proxy attaches the key upstream: bearer | x-api-key | header:NAME. Optional for known destinations (auto-resolved server-side); required for unknown ones")
         .action(async (name, opts) => {
         try {
             if (!SECRET_NAME_PATTERN.test(name)) {
                 console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
             }
+            // secrets-proxy-per-secret-destination US-006: --high-security marks
+            // the secret so it can only ever be used through the server-side
+            // proxy (never revealed/injected locally — that refusal is the
+            // pre-existing consumption-side behavior in `get`/`exec`/`env` above,
+            // unchanged by this story). It REQUIRES a --destination: the proxy
+            // (hq-pro US-002) fails closed with no destination configured, so
+            // catching the missing pin here is a clear, immediate CLI error
+            // rather than a deferred proxy-time failure.
+            let destinations;
+            let injection;
+            if (opts.highSecurity) {
+                if (!opts.destination) {
+                    console.error(chalk.red("Error: --high-security requires --destination <https-url> (e.g. --destination https://api.openai.com)."));
+                    process.exit(1);
+                }
+                const destResult = parseDestinationUrl(opts.destination);
+                if (!destResult.ok) {
+                    process.exit(1);
+                }
+                destinations = [destResult.url];
+                if (opts.authStyle) {
+                    const recipe = parseAuthStyle(opts.authStyle);
+                    if (!recipe) {
+                        process.exit(1);
+                    }
+                    injection = recipe;
+                }
+                else if (!KNOWN_DESTINATION_HOSTS.has(destResult.hostname)) {
+                    // Unknown host + no explicit recipe: the server would reject this
+                    // 400 anyway (US-004 registry lookup only, never guesses) — fail
+                    // fast locally with an actionable message instead of a round trip.
+                    console.error(chalk.red(`Error: unknown destination host '${destResult.hostname}' — provide --auth-style <bearer|x-api-key|header:NAME> (known hosts auto-resolve: ${[...KNOWN_DESTINATION_HOSTS].join(", ")}).`));
+                    process.exit(1);
+                }
+                // Known host + no --auth-style: leave `injection` undefined so the
+                // server (US-004) auto-resolves the recipe from its registry.
+            }
+            else if (opts.destination || opts.authStyle) {
+                console.error(chalk.red("Error: --destination/--auth-style require --high-security."));
+                process.exit(1);
+            }
             let value;
             if (opts.fromStdin) {
                 if (process.stdin.isTTY) {
@@ -419,15 +531,27 @@ export function registerSecretsCommand(program) {
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}`,
                 method: "POST",
-                body: { name, value },
+                body: {
+                    name,
+                    value,
+                    // Only present when --high-security was passed — an ordinary
+                    // `set` with no flags sends exactly `{ name, value }`, byte-for-
+                    // byte unchanged from before this story.
+                    ...(opts.highSecurity ? { highSecurity: true } : {}),
+                    ...(destinations ? { destinations } : {}),
+                    ...(injection ? { injection } : {}),
+                },
             });
             if (!res.ok) {
-                const body = await res.json().catch(() => ({}));
-                console.error(chalk.red(`Failed to set secret: ${body.error ?? res.statusText}`));
+                const body = (await res.json().catch(() => ({})));
+                console.error(chalk.red(`Failed to set secret: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
             removeCacheEntry(companyUid, name);
             console.log(chalk.green(formatSecretSaved(name, scopeLabel)));
+            if (opts.highSecurity) {
+                console.log(chalk.dim(`  High-security: destination pinned to ${destinations?.[0]}. This value can never be revealed or injected locally — only used through the HQ secret proxy.`));
+            }
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -1258,4 +1382,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=3b78d543-70d6-52e2-b19f-fa2650534e97
+//# debugId=ac2acbfe-d6f8-52af-9e1a-38b43474a6d5

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
-/**
- * HQ CLI - Module management, package management, and cloud sync for HQ
- */
 import "./node-preflight.js";
+declare function isVersionRequest(argv: readonly string[]): boolean;
+export declare const __test__: {
+    isVersionRequest: typeof isVersionRequest;
+};
+export {};
 //# sourceMappingURL=index.d.ts.map