@indigoai-us/hq-cli 5.60.0 → 5.62.0

package/dist/commands/outposts.js

@@ -0,0 +1,255 @@
+/**
+ * `hq outposts` — manage your personal HQ Outposts (EC2 boxes) from the
+ * terminal instead of the web console. Targets the hq-pro `/outpost/*`
+ * control plane on `DEFAULT_VAULT_API_URL` via the shared `vaultApiFetch`
+ * helper — the same routes the console's outpost panel calls.
+ *
+ * Outposts are PERSONAL / caller-scoped: hq-pro keys every `/outpost/*` route
+ * on the caller's Cognito sub, so there is no `--company`. `--id <outpostId>`
+ * selects a specific box (passed as the `outpostId` query param); when omitted
+ * hq-pro targets the caller's primary slot.
+ *
+ * Subcommands:
+ *   hq outposts list                — every Outpost you own (row summaries)
+ *   hq outposts status [--id]       — live detail for one box
+ *   hq outposts codex-enable [--id] — enable / retry Codex on the box
+ *   hq outposts login [--id]        — request a fresh login URL
+ *   hq outposts destroy [--id] --yes — tear the box down (destructive; flag-guarded)
+ *
+ * NOTE: hq-pro exposes no rename or settings-mutation route for Outposts (the
+ * web console can't rename them either), so this CLI wraps only the lifecycle
+ * and status routes that exist. Renaming an Outpost is not a backend capability.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b01c6828-502e-5f7a-b15c-acafef4fa143")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+/** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
+export class OutpostHttpError extends Error {
+    status;
+    step;
+    constructor(status, message, step) {
+        super(message);
+        this.name = "OutpostHttpError";
+        this.status = status;
+        this.step = step;
+    }
+}
+/**
+ * Authenticated JSON round-trip against the outpost control plane. Throws
+ * `OutpostHttpError` on any non-2xx (never swallows — hq-never-swallow-errors),
+ * decoding hq-pro's `{ error | message, step }` envelope for the reason. The
+ * `step` is preserved so callers can recognise the `destroy` route's
+ * `teardown-incomplete` 409 (which means "retry", not "failed").
+ */
+export async function outpostRequest(opts) {
+    const res = await vaultApiFetch(opts);
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        const message = typeof body.message === "string"
+            ? body.message
+            : typeof body.error === "string"
+                ? body.error
+                : res.statusText;
+        throw new OutpostHttpError(res.status, message, body.step);
+    }
+    return (await res.json());
+}
+export async function listOutposts(token) {
+    const data = await outpostRequest({
+        token,
+        path: "/outpost/list",
+    });
+    return data.outposts ?? [];
+}
+export async function getOutpostStatus(token, outpostId) {
+    return outpostRequest({
+        token,
+        path: "/outpost/status",
+        query: outpostId ? { outpostId } : undefined,
+    });
+}
+export async function enableCodex(token, outpostId) {
+    return outpostRequest({
+        token,
+        path: "/outpost/codex/enable",
+        method: "POST",
+        query: outpostId ? { outpostId } : undefined,
+    });
+}
+export async function regenerateLoginUrl(token, outpostId) {
+    return outpostRequest({
+        token,
+        path: "/outpost/regenerate-login-url",
+        method: "POST",
+        query: outpostId ? { outpostId } : undefined,
+    });
+}
+export async function destroyOutpost(token, outpostId) {
+    return outpostRequest({
+        token,
+        path: "/outpost/destroy",
+        method: "POST",
+        query: outpostId ? { outpostId } : undefined,
+    });
+}
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+function fail(err) {
+    if (err instanceof OutpostHttpError) {
+        console.error(chalk.red(err.message));
+    }
+    else {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+    }
+    process.exit(1);
+}
+/** Print a top-level object as `key: value`, JSON-ifying nested values. */
+function printKeyValues(obj) {
+    for (const [k, v] of Object.entries(obj)) {
+        const rendered = v && typeof v === "object" ? JSON.stringify(v) : String(v);
+        console.log(`${chalk.bold(k)}: ${rendered}`);
+    }
+}
+export function registerOutpostsCommand(program) {
+    const outposts = program
+        .command("outposts")
+        .description("Manage your personal HQ Outposts (EC2 boxes)");
+    outposts
+        .command("list")
+        .description("List every Outpost you own")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const rows = await listOutposts(token);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(rows, null, 2) + "\n");
+                return;
+            }
+            if (rows.length === 0) {
+                console.log(chalk.gray("You don't own any Outposts yet."));
+                return;
+            }
+            const idW = Math.max(2, ...rows.map((r) => (r.outpostId ?? "").length));
+            const stateW = Math.max(5, ...rows.map((r) => (r.state ?? "").length));
+            const nameW = Math.max(4, ...rows.map((r) => (r.instanceName ?? "").length));
+            const regionW = Math.max(6, ...rows.map((r) => (r.region ?? "").length));
+            const rtW = Math.max(7, ...rows.map((r) => (r.agentRuntime ?? "").length));
+            console.log(chalk.bold([
+                "ID".padEnd(idW),
+                "STATE".padEnd(stateW),
+                "INSTANCE".padEnd(nameW),
+                "REGION".padEnd(regionW),
+                "RUNTIME".padEnd(rtW),
+                "PLATFORM",
+            ].join("  ")));
+            for (const r of rows) {
+                console.log([
+                    (r.outpostId ?? "").padEnd(idW),
+                    (r.state ?? "").padEnd(stateW),
+                    (r.instanceName ?? "").padEnd(nameW),
+                    (r.region ?? "").padEnd(regionW),
+                    (r.agentRuntime ?? "").padEnd(rtW),
+                    r.platform ?? "",
+                ].join("  "));
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    outposts
+        .command("status")
+        .description("Show live detail for one Outpost")
+        .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const status = await getOutpostStatus(token, opts.id);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(status, null, 2) + "\n");
+                return;
+            }
+            printKeyValues(status);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    outposts
+        .command("codex-enable")
+        .description("Enable (or retry) Codex on an Outpost")
+        .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const result = await enableCodex(token, opts.id);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log(chalk.green("Codex enablement requested for the Outpost."));
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    outposts
+        .command("login")
+        .description("Request a fresh login URL for an Outpost")
+        .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const result = await regenerateLoginUrl(token, opts.id);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log(chalk.green("Login-URL regeneration requested. The box mints a fresh URL shortly — " +
+                "check `hq outposts status` to pick it up."));
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    outposts
+        .command("destroy")
+        .description("Tear down (permanently destroy) an Outpost")
+        .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--yes", "Confirm the irreversible teardown (required)")
+        .action(async function (opts) {
+        const target = opts.id ?? "your primary Outpost";
+        if (!opts.yes) {
+            console.error(chalk.yellow(`This will permanently destroy ${target} and delete its cloud resources. ` +
+                `This cannot be undone.\n` +
+                `Re-run with --yes to confirm: hq outposts destroy${opts.id ? ` --id ${opts.id}` : ""} --yes`));
+            process.exit(1);
+        }
+        try {
+            const token = await ensureCognitoToken();
+            await destroyOutpost(token, opts.id);
+            console.log(chalk.green(`Destroyed ${target}.`));
+        }
+        catch (err) {
+            // A 409 teardown-incomplete is not a failure — the gateway's 30s cap
+            // fired while the Lambda keeps working. The row is preserved and the
+            // operation is idempotent, so tell the caller to retry.
+            if (err instanceof OutpostHttpError &&
+                (err.status === 409 || err.step === "teardown-incomplete")) {
+                console.log(chalk.yellow(`Teardown still in progress for ${target} — this is expected for large boxes. ` +
+                    `Re-run the same destroy command to finish (it's idempotent).`));
+                return;
+            }
+            fail(err);
+        }
+    });
+}
+//# sourceMappingURL=outposts.js.map
+//# debugId=b01c6828-502e-5f7a-b15c-acafef4fa143

package/dist/commands/pack-install.d.ts

@@ -36,6 +36,12 @@
 import { type KeyObject } from 'node:crypto';
 import { type SecretResolver } from './mcp-registration.js';
 import type { PackManifest } from '../types.js';
+export interface ResolveLatestOptions {
+    forceRefresh?: boolean;
+    now?: number;
+    cacheTtlMs?: number;
+    fetchImpl?: typeof fetch;
+}
 export type Transport = 'npm' | 'git' | 'local' | 'marketplace';
 /** Prefix that routes a source through the HQ marketplace transport (US-006). */
 export declare const MARKETPLACE_PREFIX = "marketplace:";
@@ -181,7 +187,7 @@ export interface LatestResult {
  * @param source         the stamped `source:` from the installed package.yaml
  * @param installedVersion the installed pack's manifest `version` (npm compare)
  */
-export declare function resolveLatest(source: string, installedVersion?: string): LatestResult;
+export declare function resolveLatest(source: string, installedVersion?: string, opts?: ResolveLatestOptions): Promise<LatestResult>;
 /**
  * Async marketplace update probe (US-006): resolve the slug's latest approved
  * listing version and compare it to the installed version. Reuses the same

package/dist/commands/pack-install.js

@@ -34,7 +34,7 @@
  * from each pack's package.yaml; rationale lives in the layout-fix PR.)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0ec07d3a-ee86-51fd-adbd-2608c620ae99")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a90272ca-94a1-5905-85f8-af12a01cb58a")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -54,6 +54,58 @@ import { safeExtractTarball } from './safe-extract.js';
 import { vaultApiFetchPublic } from '../utils/vault-api.js';
 import { redactSecrets, SECRET_REDACTION, registerMcpServers, McpManifestError, } from './mcp-registration.js';
 import { readCache, listSecretCacheScopes } from '../utils/secrets-cache.js';
+const PACK_UPDATE_CACHE_TTL_MS = 12 * 60 * 60 * 1000;
+const PACK_UPDATE_FETCH_TIMEOUT_MS = 3_000;
+const gitLsRemoteMemo = new Map();
+function packUpdateCachePath() {
+    return path.join(os.homedir(), '.hq', 'pack-update-cache.json');
+}
+function readPackUpdateCache() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(packUpdateCachePath(), 'utf-8'));
+        if (!parsed || typeof parsed !== 'object' || !parsed.entries || typeof parsed.entries !== 'object') {
+            return { entries: {} };
+        }
+        return { entries: parsed.entries };
+    }
+    catch {
+        return { entries: {} };
+    }
+}
+function writePackUpdateCache(cache) {
+    try {
+        const file = packUpdateCachePath();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(cache));
+    }
+    catch {
+        // best-effort; update checks must never fail because the cache is unwritable
+    }
+}
+function cachedLatest(cacheKey, opts) {
+    if (opts.forceRefresh)
+        return undefined;
+    const entry = readPackUpdateCache().entries[cacheKey];
+    if (!entry || typeof entry.latest !== 'string' || typeof entry.fetchedAt !== 'number')
+        return undefined;
+    const now = opts.now ?? Date.now();
+    const ttl = opts.cacheTtlMs ?? PACK_UPDATE_CACHE_TTL_MS;
+    return now - entry.fetchedAt <= ttl ? entry.latest : undefined;
+}
+function storeCachedLatest(cacheKey, latest, opts) {
+    const cache = readPackUpdateCache();
+    cache.entries[cacheKey] = { latest, fetchedAt: opts.now ?? Date.now() };
+    writePackUpdateCache(cache);
+}
+async function latestWithDiskCache(cacheKey, opts, refresh) {
+    const cached = cachedLatest(cacheKey, opts);
+    if (cached)
+        return cached;
+    const latest = await refresh();
+    if (latest)
+        storeCachedLatest(cacheKey, latest, opts);
+    return latest;
+}
 /** Prefix that routes a source through the HQ marketplace transport (US-006). */
 export const MARKETPLACE_PREFIX = 'marketplace:';
 export function classify(source) {
@@ -489,13 +541,33 @@ function rsyncDir(src, dest) {
  */
 function isNamedRef(url, ref) {
     try {
-        const out = execFileSync('git', ['ls-remote', '--heads', '--tags', url, ref], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const out = gitLsRemote(['--heads', '--tags', url, ref]);
         return out.trim().length > 0;
     }
     catch {
         return false;
     }
 }
+function gitLsRemote(args) {
+    const key = args.join('\0');
+    const cached = gitLsRemoteMemo.get(key);
+    if (cached !== undefined)
+        return cached;
+    const out = execFileSync('git', ['ls-remote', ...args], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+    gitLsRemoteMemo.set(key, out);
+    return out;
+}
+async function fetchLatestNpmVersion(pkg, opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const res = await fetchImpl(`https://registry.npmjs.org/${encodeURIComponent(pkg)}/latest`, {
+        headers: { Accept: 'application/json' },
+        signal: AbortSignal.timeout(PACK_UPDATE_FETCH_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`registry returned ${res.status}`);
+    const body = (await res.json());
+    return typeof body.version === 'string' ? body.version : undefined;
+}
 /** Extract the ref (sha or named ref) recorded in a stamped git source. */
 function gitRefFromSource(source) {
     const { subpath, ref } = parseGitFragment(source);
@@ -504,6 +576,9 @@ function gitRefFromSource(source) {
     void subpath;
     return ref;
 }
+function isFullGitSha(ref) {
+    return /^[0-9a-f]{40}$/i.test(ref);
+}
 /**
  * Probe whether a newer version of an already-installed pack is available,
  * WITHOUT fetching or installing. Reuses the same git/npm primitives as the
@@ -513,7 +588,7 @@ function gitRefFromSource(source) {
  * @param source         the stamped `source:` from the installed package.yaml
  * @param installedVersion the installed pack's manifest `version` (npm compare)
  */
-export function resolveLatest(source, installedVersion) {
+export async function resolveLatest(source, installedVersion, opts = {}) {
     let transport;
     try {
         transport = classify(source);
@@ -542,15 +617,12 @@ export function resolveLatest(source, installedVersion) {
         const pkg = stripVersion(source);
         const current = installedVersion ?? (source.lastIndexOf('@') > 0 ? source.slice(source.lastIndexOf('@') + 1) : undefined);
         try {
-            const latest = execFileSync('npm', ['view', pkg, 'version'], {
-                encoding: 'utf-8',
-                stdio: ['ignore', 'pipe', 'ignore'],
-            }).trim();
+            const latest = await latestWithDiskCache(`npm:${pkg}`, opts, () => fetchLatestNpmVersion(pkg, opts));
             const updateAvailable = current && latest ? semverGt(latest, current) : null;
             return { transport, current, latest, updateAvailable };
         }
         catch (e) {
-            return { transport, current, updateAvailable: null, error: `npm view failed: ${e.message}` };
+            return { transport, current, updateAvailable: null, error: `npm registry check failed: ${e.message}` };
         }
     }
     // git
@@ -565,13 +637,12 @@ export function resolveLatest(source, installedVersion) {
     const current = gitRefFromSource(source);
     // If install followed a named ref (branch/tag), compare that ref's tip;
     // otherwise (default SHA-pin) compare the default branch HEAD.
-    const refArg = current && isNamedRef(url, current) ? current : 'HEAD';
+    const refArg = current && !isFullGitSha(current) && isNamedRef(url, current) ? current : 'HEAD';
     try {
-        const out = execFileSync('git', ['ls-remote', url, refArg], {
-            encoding: 'utf-8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-        const latest = out.split(/\s+/)[0] || undefined;
+        const latest = await latestWithDiskCache(`git:${url}#${refArg}`, opts, () => {
+            const out = gitLsRemote([url, refArg]).trim();
+            return out.split(/\s+/)[0] || undefined;
+        });
         const updateAvailable = current && latest ? !latest.startsWith(current) && !current.startsWith(latest) : null;
         return { transport, current, latest, updateAvailable };
     }
@@ -1629,4 +1700,4 @@ export async function installPack(source, opts = {}) {
     }
 }
 //# sourceMappingURL=pack-install.js.map
-//# debugId=0ec07d3a-ee86-51fd-adbd-2608c620ae99
+//# debugId=a90272ca-94a1-5905-85f8-af12a01cb58a

package/dist/commands/packs.d.ts

@@ -18,6 +18,7 @@
  * Spec: knowledge/public/hq-core/package-yaml-spec.md.
  */
 import { Command } from 'commander';
+import { type LatestResult } from './pack-install.js';
 import { type InstalledPack, type LinkStatus } from '../utils/pack-contributions.js';
 import type { PackContributeKey } from '../types.js';
 interface InstalledPackView {
@@ -48,7 +49,7 @@ interface InstalledPackView {
     };
     error?: string;
 }
-export declare function buildInstalledView(hqRoot: string, hqVersion: string | null, pack: InstalledPack, installedSources: Set<string>, checkUpdates: boolean): InstalledPackView;
+export declare function buildInstalledView(hqRoot: string, hqVersion: string | null, pack: InstalledPack, installedSources: Set<string>, checkUpdates: boolean, latestProbe?: LatestResult): InstalledPackView;
 export declare function registerPacksCommand(parent: Command): void;
 export {};
 //# sourceMappingURL=packs.d.ts.map

package/dist/commands/packs.js

@@ -18,7 +18,7 @@
  * Spec: knowledge/public/hq-core/package-yaml-spec.md.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="69746edd-f9d8-528e-8902-de799c58bd8a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f8ee3de6-a097-5e0f-8afa-63381f29032d")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as readline from 'readline';
@@ -61,7 +61,7 @@ async function confirm(question) {
     });
     return /^(y|yes)$/i.test(answer.trim());
 }
-export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, checkUpdates) {
+export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, checkUpdates, latestProbe) {
     if (!pack.manifest) {
         return {
             name: pack.name,
@@ -95,7 +95,7 @@ export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, ch
     const hqCoreSatisfied = hqVersion && requiresHqCore ? semverSatisfies(hqVersion, requiresHqCore) : null;
     let updateAvailable = null;
     if (checkUpdates && m.source) {
-        updateAvailable = resolveLatest(m.source, m.version).updateAvailable;
+        updateAvailable = latestProbe?.updateAvailable ?? null;
     }
     // US-005 — surface the pack's `initialization` block so the HQ Sync
     // "Installed" panel can render its get-started affordance. `readPackManifest`
@@ -129,13 +129,16 @@ export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, ch
         ...(initialization ? { initialization } : {}),
     };
 }
-function buildListView(hqRoot, checkUpdates, evalConditionals) {
+async function buildListView(hqRoot, checkUpdates, evalConditionals, refreshUpdates) {
     const hqVersion = readHqVersion(hqRoot);
     const packs = listInstalledPacks(hqRoot);
     const catalog = readRecommendedPackages(hqRoot);
     const catalogSources = new Set(catalog.map((c) => c.source));
     const warnings = [];
-    const installed = packs.map((p) => buildInstalledView(hqRoot, hqVersion, p, catalogSources, checkUpdates));
+    const latestProbes = await Promise.all(packs.map((p) => checkUpdates && p.manifest?.source
+        ? resolveLatest(p.manifest.source, p.manifest.version, { forceRefresh: refreshUpdates })
+        : Promise.resolve(undefined)));
+    const installed = packs.map((p, i) => buildInstalledView(hqRoot, hqVersion, p, catalogSources, checkUpdates, latestProbes[i]));
     for (const p of installed) {
         if (p.error)
             warnings.push(`${p.name}: ${p.error}`);
@@ -217,7 +220,7 @@ async function runUpdate(name, opts) {
         // other transport keeps the existing synchronous probe unchanged.
         const probe = safeClassify(source) === 'marketplace'
             ? await resolveLatestMarketplace(source, m.version)
-            : resolveLatest(source, m.version);
+            : await resolveLatest(source, m.version, { forceRefresh: true });
         const base = {
             name: pname,
             transport: probe.transport,
@@ -374,10 +377,11 @@ export function registerPacksCommand(parent) {
         .option('--json', 'Machine-readable JSON output')
         .option('--hq-root <path>', 'HQ root (default: auto-detect)')
         .option('--check-updates', 'Probe each pack for available updates (network I/O)')
+        .option('--refresh', 'Bypass cached update probes')
         .option('--eval-conditionals', 'Evaluate catalog conditional predicates (runs bash)')
         .action(async (opts) => {
         try {
-            const view = buildListView(resolveRoot(opts), !!opts.checkUpdates, !!opts.evalConditionals);
+            const view = await buildListView(resolveRoot(opts), !!opts.checkUpdates, !!opts.evalConditionals, !!opts.refresh);
             if (wantsJson(opts))
                 emitJson(view);
             else
@@ -394,6 +398,7 @@ export function registerPacksCommand(parent) {
         .option('--json', 'Machine-readable JSON output')
         .option('--hq-root <path>', 'HQ root (default: auto-detect)')
         .option('--check-only', 'Report availability without installing')
+        .option('--refresh', 'Bypass cached update probes (update refreshes by default)')
         .option('-y, --yes', 'Non-interactive (implies --allow-hooks and --allow-mcp)')
         .option('--allow-hooks', 'Install pack hooks without prompting')
         .option('--allow-mcp', 'Register pack MCP servers without prompting')
@@ -463,4 +468,4 @@ export function registerPacksCommand(parent) {
     });
 }
 //# sourceMappingURL=packs.js.map
-//# debugId=69746edd-f9d8-528e-8902-de799c58bd8a
+//# debugId=f8ee3de6-a097-5e0f-8afa-63381f29032d

package/dist/commands/secrets.d.ts

@@ -36,6 +36,19 @@ export interface SecretLoadResponse {
         message?: string;
     }>;
 }
+export interface SecretInjectionRecipe {
+    header: string;
+    scheme: "raw" | "bearer";
+    extraHeaders?: Record<string, string>;
+}
+export declare function parseDestinationUrl(raw: string): {
+    ok: true;
+    url: string;
+    hostname: string;
+} | {
+    ok: false;
+};
+export declare function collectSecretNames(value: string, previous?: string[]): string[];
 export declare function scrubSandboxOutput(text: string, secretNames?: string[]): string;
 export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage): Promise<Map<string, string>>;
 export declare function registerSecretsCommand(program: Command): void;