@indigoai-us/hq-cli 5.68.0 → 5.68.2

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [5.68.1]
+
+### Fixed
+
+- **`hq outposts exec` now runs from the box's HQ folder by default.** The
+  command was sent with no working directory, so cwd depended on the transport:
+  SSM boxes (root, no `$HOME`) ran from `/usr/bin` and Lightsail/SSH boxes ran
+  from the login home. `exec -- pwd` printed `/usr/bin` on EC2, and relative
+  paths resolved against the wrong place. The command is now wrapped to `cd`
+  into the box's HQ checkout first (`$HOME/hq`, falling back to ec2-user's home
+  for the SSM/root path), with a `|| true` so exec still runs when no HQ folder
+  is present. Applies to both the SSM and SSH-fallback paths.
+
 ## [5.62.1]
 
 ### Added

package/dist/commands/outposts.d.ts

@@ -94,6 +94,20 @@ export interface OutpostExecResult {
  * `step` distinguishes not-ready / platform-unsupported / timeout / ssm.
  */
 export declare function execOutpost(token: string, command: string, outpostId?: string): Promise<OutpostExecResult>;
+/**
+ * Prefix that best-effort `cd`s into the box's HQ checkout before running the
+ * caller's command. `exec` runs over two transports with two different default
+ * working directories — SSM runs as root with no `$HOME` (cwd `/usr/bin`) and
+ * SSH lands in the login user's home — so without this, `hq outposts exec -- pwd`
+ * printed an unhelpful, transport-dependent directory. We resolve the HQ folder
+ * in-shell: `$HOME/hq` for the login/SSH user, falling back to ec2-user's home
+ * for the SSM/root path. The trailing `|| true` keeps the command running from
+ * the default directory when no HQ checkout is present, so exec never fails
+ * merely because the box has no HQ folder.
+ */
+export declare const REMOTE_HQ_DIR_PREFIX = "cd \"$HOME/hq\" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true";
+/** Wrap `command` so it runs from the box's HQ folder (see REMOTE_HQ_DIR_PREFIX). */
+export declare function withRemoteHqDir(command: string): string;
 /** SSH connection details vended by `POST /outpost/ssh-access`. */
 export interface OutpostSshAccess {
     outpostId: string;

package/dist/commands/outposts.js

@@ -21,7 +21,7 @@
  * and status routes that exist. Renaming an Outpost is not a backend capability.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="951a0bc6-7dc3-5b10-b8f6-728df1074817")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c4ce2b27-be72-5025-a4e7-2d4725c67c26")}catch(e){}}();
 import chalk from "chalk";
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
@@ -138,6 +138,22 @@ export async function execOutpost(token, command, outpostId) {
         query: outpostId ? { outpostId } : undefined,
     });
 }
+/**
+ * Prefix that best-effort `cd`s into the box's HQ checkout before running the
+ * caller's command. `exec` runs over two transports with two different default
+ * working directories — SSM runs as root with no `$HOME` (cwd `/usr/bin`) and
+ * SSH lands in the login user's home — so without this, `hq outposts exec -- pwd`
+ * printed an unhelpful, transport-dependent directory. We resolve the HQ folder
+ * in-shell: `$HOME/hq` for the login/SSH user, falling back to ec2-user's home
+ * for the SSM/root path. The trailing `|| true` keeps the command running from
+ * the default directory when no HQ checkout is present, so exec never fails
+ * merely because the box has no HQ folder.
+ */
+export const REMOTE_HQ_DIR_PREFIX = 'cd "$HOME/hq" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true';
+/** Wrap `command` so it runs from the box's HQ folder (see REMOTE_HQ_DIR_PREFIX). */
+export function withRemoteHqDir(command) {
+    return `${REMOTE_HQ_DIR_PREFIX}; ${command}`;
+}
 /**
  * Fetch SSH connection info + key for the caller's Outpost and open the caller's
  * IP on the box's SSH port. Used to reach a Lightsail box (no SSM). Throws
@@ -365,8 +381,10 @@ export function registerOutpostsCommand(program) {
                 process.exit(1);
             }
             const token = await ensureCognitoToken();
+            // Run from the box's HQ folder by default (works over both SSM and SSH).
+            const remoteCommand = withRemoteHqDir(command);
             try {
-                const result = await execOutpost(token, command, opts.id);
+                const result = await execOutpost(token, remoteCommand, opts.id);
                 if (opts.json) {
                     process.stdout.write(JSON.stringify(result, null, 2) + "\n");
                 }
@@ -392,7 +410,7 @@ export function registerOutpostsCommand(program) {
                 if (err instanceof OutpostHttpError &&
                     err.step === "platform-unsupported") {
                     const access = await getOutpostSshAccess(token, opts.id);
-                    const ssh = execViaSsh(access, command);
+                    const ssh = execViaSsh(access, remoteCommand);
                     if (ssh.error) {
                         console.error(chalk.red(`Could not run the command over SSH: ${ssh.error}`));
                         process.exit(1);
@@ -496,4 +514,4 @@ export function registerOutpostsCommand(program) {
     });
 }
 //# sourceMappingURL=outposts.js.map
-//# debugId=951a0bc6-7dc3-5b10-b8f6-728df1074817
+//# debugId=c4ce2b27-be72-5025-a4e7-2d4725c67c26

package/dist/commands/packs.d.ts

@@ -6,10 +6,9 @@
  *   hq packs update       Re-install the latest of an installed pack.
  *   hq packs uninstall    Un-wire + archive a pack (clean, no dangling symlinks).
  *
- * Distinct from `hq packages ...` (the entitlement-gated REGISTRY system tracked
- * in packages/registry.yaml). Content packs have no registry file -- the
- * filesystem under core/packages/ is the source of truth. Today `hq install`
- * is the only clean content-pack op; this adds the rest.
+ * Also exposed through `hq packages list`, because package installs use this
+ * content-pack system. Content packs have no registry file -- the filesystem
+ * under core/packages/ is the source of truth.
  *
  * Every subcommand supports `--json` for machine consumers (the HQ Sync
  * menubar app). JSON is also the default when stdout is not a TTY, matching
@@ -50,6 +49,7 @@ interface InstalledPackView {
     error?: string;
 }
 export declare function buildInstalledView(hqRoot: string, hqVersion: string | null, pack: InstalledPack, installedSources: Set<string>, checkUpdates: boolean, latestProbe?: LatestResult): InstalledPackView;
+export declare function registerPacksListCommand(parent: Command): void;
 export declare function registerPacksCommand(parent: Command): void;
 export {};
 //# sourceMappingURL=packs.d.ts.map

package/dist/commands/packs.js

@@ -6,10 +6,9 @@
  *   hq packs update       Re-install the latest of an installed pack.
  *   hq packs uninstall    Un-wire + archive a pack (clean, no dangling symlinks).
  *
- * Distinct from `hq packages ...` (the entitlement-gated REGISTRY system tracked
- * in packages/registry.yaml). Content packs have no registry file -- the
- * filesystem under core/packages/ is the source of truth. Today `hq install`
- * is the only clean content-pack op; this adds the rest.
+ * Also exposed through `hq packages list`, because package installs use this
+ * content-pack system. Content packs have no registry file -- the filesystem
+ * under core/packages/ is the source of truth.
  *
  * Every subcommand supports `--json` for machine consumers (the HQ Sync
  * menubar app). JSON is also the default when stdout is not a TTY, matching
@@ -18,7 +17,7 @@
  * Spec: knowledge/public/hq-core/package-yaml-spec.md.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f8ee3de6-a097-5e0f-8afa-63381f29032d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b743f774-8d9b-594b-9ce4-e7f5a44faca0")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as readline from 'readline';
@@ -368,9 +367,8 @@ async function runUninstall(name, opts) {
 // ---------------------------------------------------------------------------
 // Registration
 // ---------------------------------------------------------------------------
-export function registerPacksCommand(parent) {
-    const packs = parent.command('packs').description('Content-pack lifecycle (install via `hq install`)');
-    packs
+export function registerPacksListCommand(parent) {
+    parent
         .command('list')
         .alias('ls')
         .description('List installed content packs and the curated catalog')
@@ -392,6 +390,10 @@ export function registerPacksCommand(parent) {
             process.exit(1);
         }
     });
+}
+export function registerPacksCommand(parent) {
+    const packs = parent.command('packs').description('Content-pack lifecycle (install via `hq install`)');
+    registerPacksListCommand(packs);
     packs
         .command('update [name]')
         .description('Update an installed content pack (re-install latest)')
@@ -468,4 +470,4 @@ export function registerPacksCommand(parent) {
     });
 }
 //# sourceMappingURL=packs.js.map
-//# debugId=f8ee3de6-a097-5e0f-8afa-63381f29032d
+//# debugId=b743f774-8d9b-594b-9ce4-e7f5a44faca0

package/dist/commands/pkg-list.d.ts

@@ -1,7 +1,8 @@
 /**
- * hq packages list — show installed packages and available entitlements (US-005)
+ * hq packages list — list filesystem-backed content packs.
  *
- * Graceful offline: if registry is unreachable, show cached data with a note.
+ * Package installs use the content-pack installer, so this command delegates
+ * to the same list view as `hq packs list`.
  */
 import { Command } from 'commander';
 export declare function registerPackageListCommand(parent: Command): void;

package/dist/commands/pkg-list.js

@@ -1,99 +1,14 @@
 /**
- * hq packages list — show installed packages and available entitlements (US-005)
+ * hq packages list — list filesystem-backed content packs.
  *
- * Graceful offline: if registry is unreachable, show cached data with a note.
+ * Package installs use the content-pack installer, so this command delegates
+ * to the same list view as `hq packs list`.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a2386adb-d4c5-5725-b406-4246ac40425a")}catch(e){}}();
-import chalk from 'chalk';
-import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
-import { readRegistry } from '../utils/registry.js';
-import { loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
-import { getRegistryUrl, RegistryClient, } from '../utils/registry-client.js';
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="96eb060c-c1d0-5874-918f-e818f92c6242")}catch(e){}}();
+import { registerPacksListCommand } from './packs.js';
 export function registerPackageListCommand(parent) {
-    parent
-        .command('list')
-        .alias('ls')
-        .description('List installed and available packages')
-        .option('--json', 'Machine-readable JSON output')
-        .action(async (opts) => {
-        try {
-            await listPackages(opts.json === true || !process.stdout.isTTY);
-        }
-        catch (error) {
-            console.error(chalk.red('List failed:'), error instanceof Error ? error.message : 'Unknown error');
-            process.exit(1);
-        }
-    });
-}
-async function gatherRegistryPackages() {
-    const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
-    const installed = readRegistry(hqRoot);
-    let entitlements = [];
-    let offline = false;
-    try {
-        const cached = loadCachedTokens();
-        if (cached && !isExpiring(cached, 120)) {
-            const client = new RegistryClient(getRegistryUrl(), cached.accessToken);
-            const result = await client.getMyEntitlements();
-            entitlements = result.entitlements;
-        }
-    }
-    catch {
-        offline = true;
-    }
-    const installedSlugs = new Set(installed.map((p) => p.slug));
-    const available = entitlements.filter((e) => !installedSlugs.has(e.slug));
-    return { installed, available, offline };
-}
-async function listPackages(json) {
-    if (json) {
-        const { installed, available, offline } = await gatherRegistryPackages();
-        process.stdout.write(JSON.stringify({ installed, available, offline }, null, 2) + '\n');
-        return;
-    }
-    const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
-    const installed = readRegistry(hqRoot);
-    // Print installed packages
-    if (installed.length > 0) {
-        console.log(chalk.bold('Installed packages:\n'));
-        for (const pkg of installed) {
-            const scope = pkg.scope ? chalk.dim(` (${pkg.scope})`) : '';
-            console.log(`  ${chalk.green(pkg.slug)}@${pkg.version}${scope}`);
-            console.log(chalk.dim(`    Installed: ${pkg.installed_at.slice(0, 10)}  Updated: ${pkg.updated_at.slice(0, 10)}`));
-        }
-        console.log();
-    }
-    else {
-        console.log(chalk.dim('No packages installed.\n'));
-    }
-    // Try to show available (but not installed) packages from entitlements
-    let entitlements = [];
-    let offline = false;
-    try {
-        const cached = loadCachedTokens();
-        if (cached && !isExpiring(cached, 120)) {
-            const registryUrl = getRegistryUrl();
-            const client = new RegistryClient(registryUrl, cached.accessToken);
-            const result = await client.getMyEntitlements();
-            entitlements = result.entitlements;
-        }
-    }
-    catch {
-        offline = true;
-    }
-    const installedSlugs = new Set(installed.map((p) => p.slug));
-    const available = entitlements.filter((e) => !installedSlugs.has(e.slug));
-    if (available.length > 0) {
-        console.log(chalk.bold('Available (not installed):\n'));
-        for (const ent of available) {
-            console.log(`  ${chalk.cyan(ent.slug)} ${chalk.dim(`[${ent.tier}]`)}  ${chalk.yellow('available')}`);
-        }
-        console.log(chalk.dim('\nRun "hq packages install <slug>" to install.\n'));
-    }
-    if (offline) {
-        console.log(chalk.yellow('Note: Could not reach registry — showing cached data only.'));
-    }
+    registerPacksListCommand(parent);
 }
 //# sourceMappingURL=pkg-list.js.map
-//# debugId=a2386adb-d4c5-5725-b406-4246ac40425a
+//# debugId=96eb060c-c1d0-5874-918f-e818f92c6242

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.68.0",
+  "version": "5.68.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/outposts.test.ts

@@ -52,7 +52,7 @@ vi.mock("node:child_process", async (importOriginal) => {
 
 import { spawnSync } from "node:child_process";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { registerOutpostsCommand } from "./outposts.js";
+import { registerOutpostsCommand, withRemoteHqDir } from "./outposts.js";
 
 const mockSpawnSync = vi.mocked(spawnSync);
 
@@ -262,6 +262,18 @@ describe("hq outposts exec", () => {
     process.exitCode = undefined;
   });
 
+  it("wraps the command to run from the box's HQ folder, then runs it", () => {
+    const wrapped = withRemoteHqDir("pwd");
+    // cd into $HOME/hq (SSH/login user) …
+    expect(wrapped).toContain('cd "$HOME/hq"');
+    // … falling back to ec2-user's home for the SSM/root path (no $HOME) …
+    expect(wrapped).toContain("cd ~ec2-user/hq");
+    // … never failing merely because the box has no HQ folder …
+    expect(wrapped).toContain("|| true");
+    // … and the caller's command still runs after the cd.
+    expect(wrapped.endsWith("; pwd")).toBe(true);
+  });
+
   it("POSTs /outpost/exec with the joined command and streams stdout", async () => {
     const stdoutSpy = vi
       .spyOn(process.stdout, "write")
@@ -285,7 +297,10 @@ describe("hq outposts exec", () => {
     const [url, init] = fetchSpy.mock.calls[0];
     expect(String(url)).toContain("/outpost/exec");
     expect(init?.method).toBe("POST");
-    expect(JSON.parse(init?.body as string)).toEqual({ command: "echo hello world" });
+    // The command is wrapped so it runs from the box's HQ folder.
+    expect(JSON.parse(init?.body as string)).toEqual({
+      command: withRemoteHqDir("echo hello world"),
+    });
     const printed = stdoutSpy.mock.calls.map((c) => String(c[0])).join("");
     expect(printed).toContain("hello world\n");
     expect(process.exitCode).toBe(0);
@@ -416,7 +431,7 @@ describe("hq outposts exec — Lightsail SSH fallback", () => {
     const args = mockSpawnSync.mock.calls[0][1] as string[];
     expect(mockSpawnSync.mock.calls[0][0]).toBe("ssh");
     expect(args).toContain("ec2-user@52.2.2.2");
-    expect(args[args.length - 1]).toBe("uname -a");
+    expect(args[args.length - 1]).toBe(withRemoteHqDir("uname -a"));
     expect(args).toContain("BatchMode=yes");
     const printed = stdoutSpy.mock.calls.map((c) => String(c[0])).join("");
     expect(printed).toContain("lightsail-out\n");

package/src/commands/outposts.ts

@@ -227,6 +227,25 @@ export async function execOutpost(
   });
 }
 
+/**
+ * Prefix that best-effort `cd`s into the box's HQ checkout before running the
+ * caller's command. `exec` runs over two transports with two different default
+ * working directories — SSM runs as root with no `$HOME` (cwd `/usr/bin`) and
+ * SSH lands in the login user's home — so without this, `hq outposts exec -- pwd`
+ * printed an unhelpful, transport-dependent directory. We resolve the HQ folder
+ * in-shell: `$HOME/hq` for the login/SSH user, falling back to ec2-user's home
+ * for the SSM/root path. The trailing `|| true` keeps the command running from
+ * the default directory when no HQ checkout is present, so exec never fails
+ * merely because the box has no HQ folder.
+ */
+export const REMOTE_HQ_DIR_PREFIX =
+  'cd "$HOME/hq" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true';
+
+/** Wrap `command` so it runs from the box's HQ folder (see REMOTE_HQ_DIR_PREFIX). */
+export function withRemoteHqDir(command: string): string {
+  return `${REMOTE_HQ_DIR_PREFIX}; ${command}`;
+}
+
 /** SSH connection details vended by `POST /outpost/ssh-access`. */
 export interface OutpostSshAccess {
   outpostId: string;
@@ -519,8 +538,11 @@ export function registerOutpostsCommand(program: Command): void {
         }
         const token = await ensureCognitoToken();
 
+        // Run from the box's HQ folder by default (works over both SSM and SSH).
+        const remoteCommand = withRemoteHqDir(command);
+
         try {
-          const result = await execOutpost(token, command, opts.id);
+          const result = await execOutpost(token, remoteCommand, opts.id);
           if (opts.json) {
             process.stdout.write(JSON.stringify(result, null, 2) + "\n");
           } else {
@@ -546,7 +568,7 @@ export function registerOutpostsCommand(program: Command): void {
             err.step === "platform-unsupported"
           ) {
             const access = await getOutpostSshAccess(token, opts.id);
-            const ssh = execViaSsh(access, command);
+            const ssh = execViaSsh(access, remoteCommand);
             if (ssh.error) {
               console.error(chalk.red(`Could not run the command over SSH: ${ssh.error}`));
               process.exit(1);

package/src/commands/packs.ts

@@ -6,10 +6,9 @@
  *   hq packs update       Re-install the latest of an installed pack.
  *   hq packs uninstall    Un-wire + archive a pack (clean, no dangling symlinks).
  *
- * Distinct from `hq packages ...` (the entitlement-gated REGISTRY system tracked
- * in packages/registry.yaml). Content packs have no registry file -- the
- * filesystem under core/packages/ is the source of truth. Today `hq install`
- * is the only clean content-pack op; this adds the rest.
+ * Also exposed through `hq packages list`, because package installs use this
+ * content-pack system. Content packs have no registry file -- the filesystem
+ * under core/packages/ is the source of truth.
  *
  * Every subcommand supports `--json` for machine consumers (the HQ Sync
  * menubar app). JSON is also the default when stdout is not a TTY, matching
@@ -521,10 +520,8 @@ async function runUninstall(name: string, opts: UninstallOpts): Promise<Uninstal
 // Registration
 // ---------------------------------------------------------------------------
 
-export function registerPacksCommand(parent: Command): void {
-  const packs = parent.command('packs').description('Content-pack lifecycle (install via `hq install`)');
-
-  packs
+export function registerPacksListCommand(parent: Command): void {
+  parent
     .command('list')
     .alias('ls')
     .description('List installed content packs and the curated catalog')
@@ -550,6 +547,12 @@ export function registerPacksCommand(parent: Command): void {
         }
       },
     );
+}
+
+export function registerPacksCommand(parent: Command): void {
+  const packs = parent.command('packs').description('Content-pack lifecycle (install via `hq install`)');
+
+  registerPacksListCommand(packs);
 
   packs
     .command('update [name]')

package/src/commands/pkg-list.test.ts

@@ -0,0 +1,79 @@
+// @vitest-environment node
+/**
+ * Regression: `hq packages list` must use the same filesystem-backed pack
+ * discovery as `hq packs list`, matching the live package install path.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { Command } from 'commander';
+
+vi.mock('./pack-install.js', () => ({
+  classify: vi.fn(() => 'local'),
+  resolveLatest: vi.fn(),
+  resolveLatestMarketplace: vi.fn(),
+  runScanPackages: vi.fn(),
+  installPack: vi.fn(),
+}));
+
+import { registerPackageListCommand } from './pkg-list.js';
+import { registerPacksCommand } from './packs.js';
+
+describe('hq packages list content-pack discovery', () => {
+  let hqRoot: string;
+  let previousCwd: string;
+
+  beforeEach(() => {
+    hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'hq-pkg-list-'));
+    previousCwd = process.cwd();
+    fs.mkdirSync(path.join(hqRoot, '.claude'));
+    fs.mkdirSync(path.join(hqRoot, 'companies'));
+    fs.mkdirSync(path.join(hqRoot, 'core', 'packages', 'hq-pack-fixture'), {
+      recursive: true,
+    });
+    fs.writeFileSync(path.join(hqRoot, 'core', 'core.yaml'), 'hqVersion: 14.0.0\n');
+    fs.writeFileSync(
+      path.join(hqRoot, 'core', 'packages', 'hq-pack-fixture', 'package.yaml'),
+      'name: hq-pack-fixture\nversion: 1.2.3\n',
+    );
+    process.chdir(hqRoot);
+  });
+
+  afterEach(() => {
+    process.chdir(previousCwd);
+    fs.rmSync(hqRoot, { recursive: true, force: true });
+    vi.restoreAllMocks();
+  });
+
+  async function captureJson(register: (program: Command) => void, args: string[]) {
+    const stdout = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    const program = new Command();
+    program.exitOverride();
+    register(program);
+    await program.parseAsync(args, { from: 'user' });
+    const output = stdout.mock.calls.map((call) => String(call[0])).join('');
+    stdout.mockRestore();
+    return JSON.parse(output) as {
+      installed: Array<{ name: string; version?: string }>;
+    };
+  }
+
+  it('reports a pack installed under core/packages through both list commands', async () => {
+    const packagesView = await captureJson(
+      (program) => {
+        const packages = program.command('packages');
+        registerPackageListCommand(packages);
+      },
+      ['packages', 'list', '--json'],
+    );
+    const packsView = await captureJson(registerPacksCommand, ['packs', 'list', '--json']);
+
+    expect(packagesView.installed).toContainEqual(
+      expect.objectContaining({ name: 'hq-pack-fixture', version: '1.2.3' }),
+    );
+    expect(packsView.installed).toContainEqual(
+      expect.objectContaining({ name: 'hq-pack-fixture', version: '1.2.3' }),
+    );
+  });
+});

package/src/commands/pkg-list.ts

@@ -1,129 +1,13 @@
 /**
- * hq packages list — show installed packages and available entitlements (US-005)
+ * hq packages list — list filesystem-backed content packs.
  *
- * Graceful offline: if registry is unreachable, show cached data with a note.
+ * Package installs use the content-pack installer, so this command delegates
+ * to the same list view as `hq packs list`.
  */
 
 import { Command } from 'commander';
-import chalk from 'chalk';
-import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
-import { readRegistry } from '../utils/registry.js';
-import { loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
-import {
-  getRegistryUrl,
-  RegistryClient,
-  type EntitlementEntry,
-} from '../utils/registry-client.js';
+import { registerPacksListCommand } from './packs.js';
 
 export function registerPackageListCommand(parent: Command): void {
-  parent
-    .command('list')
-    .alias('ls')
-    .description('List installed and available packages')
-    .option('--json', 'Machine-readable JSON output')
-    .action(async (opts: { json?: boolean }) => {
-      try {
-        await listPackages(opts.json === true || !process.stdout.isTTY);
-      } catch (error) {
-        console.error(
-          chalk.red('List failed:'),
-          error instanceof Error ? error.message : 'Unknown error'
-        );
-        process.exit(1);
-      }
-    });
-}
-
-async function gatherRegistryPackages(): Promise<{
-  installed: ReturnType<typeof readRegistry>;
-  available: EntitlementEntry[];
-  offline: boolean;
-}> {
-  const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
-  const installed = readRegistry(hqRoot);
-  let entitlements: EntitlementEntry[] = [];
-  let offline = false;
-  try {
-    const cached = loadCachedTokens();
-    if (cached && !isExpiring(cached, 120)) {
-      const client = new RegistryClient(getRegistryUrl(), cached.accessToken);
-      const result = await client.getMyEntitlements();
-      entitlements = result.entitlements;
-    }
-  } catch {
-    offline = true;
-  }
-  const installedSlugs = new Set(installed.map((p) => p.slug));
-  const available = entitlements.filter((e) => !installedSlugs.has(e.slug));
-  return { installed, available, offline };
-}
-
-async function listPackages(json: boolean): Promise<void> {
-  if (json) {
-    const { installed, available, offline } = await gatherRegistryPackages();
-    process.stdout.write(JSON.stringify({ installed, available, offline }, null, 2) + '\n');
-    return;
-  }
-
-  const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
-  const installed = readRegistry(hqRoot);
-
-  // Print installed packages
-  if (installed.length > 0) {
-    console.log(chalk.bold('Installed packages:\n'));
-    for (const pkg of installed) {
-      const scope = pkg.scope ? chalk.dim(` (${pkg.scope})`) : '';
-      console.log(`  ${chalk.green(pkg.slug)}@${pkg.version}${scope}`);
-      console.log(
-        chalk.dim(
-          `    Installed: ${pkg.installed_at.slice(0, 10)}  Updated: ${pkg.updated_at.slice(0, 10)}`
-        )
-      );
-    }
-    console.log();
-  } else {
-    console.log(chalk.dim('No packages installed.\n'));
-  }
-
-  // Try to show available (but not installed) packages from entitlements
-  let entitlements: EntitlementEntry[] = [];
-  let offline = false;
-
-  try {
-    const cached = loadCachedTokens();
-    if (cached && !isExpiring(cached, 120)) {
-      const registryUrl = getRegistryUrl();
-      const client = new RegistryClient(
-        registryUrl,
-        cached.accessToken
-      );
-      const result = await client.getMyEntitlements();
-      entitlements = result.entitlements;
-    }
-  } catch {
-    offline = true;
-  }
-
-  const installedSlugs = new Set(installed.map((p) => p.slug));
-  const available = entitlements.filter((e) => !installedSlugs.has(e.slug));
-
-  if (available.length > 0) {
-    console.log(chalk.bold('Available (not installed):\n'));
-    for (const ent of available) {
-      console.log(
-        `  ${chalk.cyan(ent.slug)} ${chalk.dim(`[${ent.tier}]`)}  ${chalk.yellow('available')}`
-      );
-    }
-    console.log(
-      chalk.dim('\nRun "hq packages install <slug>" to install.\n')
-    );
-  }
-
-  if (offline) {
-    console.log(
-      chalk.yellow(
-        'Note: Could not reach registry — showing cached data only.'
-      )
-    );
-  }
+  registerPacksListCommand(parent);
 }