@indigoai-us/hq-cli 5.109.16 → 5.111.0

package/dist/commands/skill.d.ts

@@ -5,12 +5,13 @@
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
- * SKILL.md and cannot overwrite live content. Structured suggest/list/review
- * commands intentionally are not registered.
+ * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
+ * a skill and its files for the whole company (confirmation unless --yes).
+ * Structured suggest/list/review commands intentionally are not registered.
  */
 import { Command } from "commander";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { surfaceCompanySkill } from "../lib/company-skill-wrapper.js";
 export declare const SKILL_UID_PATTERN: RegExp;
 export declare const SKILL_SLUG_PATTERN: RegExp;
@@ -98,9 +99,17 @@ export declare function mapSkillError(status: number, body: Record<string, unkno
 export declare function skillApiError(status: number, body: Record<string, unknown>, opts?: {
     machineIdentity?: boolean;
 }): Error;
+export type SkillConfirmFn = (message: string) => Promise<boolean>;
+/**
+ * Resolve a delete target: a `skl_…` uid, a SKILL.md path or its directory, or
+ * a bare skill slug under `companies/<company>/skills/<slug>/`.
+ */
+export declare function resolveDeleteTarget(target: string, cwd: string, hqRoot: string, companySlug: string): string;
 interface SkillCommandDeps {
     ensureToken?: typeof ensureCognitoToken;
     apiFetch?: typeof vaultApiFetch;
+    confirm?: SkillConfirmFn;
+    resolveCompanyUid?: typeof getCompanyUid;
     cwd?: () => string;
     hqRoot?: string;
     syncFile?: (input: SkillSyncInput) => Promise<SkillSyncResult>;

package/dist/commands/skill.js

@@ -5,8 +5,9 @@
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
- * SKILL.md and cannot overwrite live content. Structured suggest/list/review
- * commands intentionally are not registered.
+ * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
+ * a skill and its files for the whole company (confirmation unless --yes).
+ * Structured suggest/list/review commands intentionally are not registered.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -14,7 +15,8 @@ import chalk from "chalk";
 import yaml from "js-yaml";
 import { share } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken, DEFAULT_HQ_ROOT, buildVaultConfig, isMachineIdentity, } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import * as readline from "node:readline";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { surfaceCompanySkill } from "../lib/company-skill-wrapper.js";
 import { AuthError } from "../utils/auth-error.js";
 import { redactErrorText } from "../utils/redact-error-text.js";
@@ -322,6 +324,31 @@ export function skillApiError(status, body, opts = {}) {
     }
     return new Error(message);
 }
+function realConfirm(message) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(`${message} [y/N] `, (answer) => {
+            rl.close();
+            resolve(/^y(es)?$/i.test(answer.trim()));
+        });
+    });
+}
+/**
+ * Resolve a delete target: a `skl_…` uid, a SKILL.md path or its directory, or
+ * a bare skill slug under `companies/<company>/skills/<slug>/`.
+ */
+export function resolveDeleteTarget(target, cwd, hqRoot, companySlug) {
+    if (SKILL_UID_PATTERN.test(target))
+        return target;
+    const asPath = path.resolve(cwd, target);
+    if (!fs.existsSync(asPath) && SKILL_SLUG_PATTERN.test(target)) {
+        return resolveSkillUid(canonicalCompanySkillPath(hqRoot, companySlug, target), cwd);
+    }
+    return resolveSkillUid(target, cwd);
+}
 export function registerSkillCommand(program, deps = {}) {
     const ensureToken = deps.ensureToken ?? ensureCognitoToken;
     const apiFetch = deps.apiFetch ?? vaultApiFetch;
@@ -329,6 +356,8 @@ export function registerSkillCommand(program, deps = {}) {
     const hqRoot = deps.hqRoot ?? DEFAULT_HQ_ROOT;
     const syncFile = deps.syncFile ?? defaultSyncFile;
     const surfaceSkillFn = deps.surfaceSkillFn ?? surfaceCompanySkill;
+    const confirm = deps.confirm ?? realConfirm;
+    const resolveCompanyUid = deps.resolveCompanyUid ?? getCompanyUid;
     const skill = program
         .command("skill")
         .description("Create company skills and discuss improvements")
@@ -516,6 +545,53 @@ export function registerSkillCommand(program, deps = {}) {
         console.log(`  Message:  ${posted.body}`);
         console.log(chalk.dim("  Review it in HQ Console → Skills → Improvements"));
     });
+    skill
+        .command("delete <target>")
+        .description("Delete a company skill and all of its files for everyone (skl_… uid, SKILL.md path, or skill slug). Prompts for confirmation unless --yes.")
+        .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
+        .action(async (target, opts) => {
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        const skillUid = resolveDeleteTarget(target, cwd(), resolvedRoot, companySlug);
+        const token = await ensureToken();
+        const companyUid = await resolveCompanyUid(token, companySlug);
+        const skillPath = `/v1/skills/${encodeURIComponent(companyUid)}/${encodeURIComponent(skillUid)}`;
+        const detail = await apiFetch({ token, path: skillPath, method: "GET" });
+        if (!detail.ok) {
+            const body = (await detail.json().catch(() => ({})));
+            throw skillApiError(detail.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const { skill: record } = (await detail.json());
+        const name = typeof record?.name === "string" ? record.name : skillUid;
+        if (opts.yes !== true) {
+            if (!process.stdin.isTTY) {
+                throw localSkillError(`Refusing to delete '${name}' without confirmation. Re-run with --yes.`);
+            }
+            const ok = await confirm(`Delete skill '${name}' (${skillUid}) and all of its files for everyone in ${companySlug}? This can't be undone from the CLI.`);
+            if (!ok) {
+                console.log("Cancelled — nothing was deleted.");
+                return;
+            }
+        }
+        const response = await apiFetch({ token, path: skillPath, method: "DELETE" });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            throw skillApiError(response.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const result = (await response.json());
+        console.log(chalk.green(`Skill deleted: ${name}`));
+        console.log(`  Skill:    ${skillUid}`);
+        console.log(`  Files:    ${typeof result.filesDeleted === "number" ? result.filesDeleted : 0} removed`);
+        if (result.tombstoneIncomplete === true) {
+            console.warn(chalk.yellow("⚠ Some synced computers may not be told to remove their copy. Delete it locally if it reappears."));
+        }
+        console.log(chalk.dim("  Local copies are removed on the next sync (hq sync now)."));
+    });
     return skill;
 }
 //# sourceMappingURL=skill.js.map

package/dist/commands/workers.d.ts

@@ -1,18 +1,6 @@
 import { Command } from "commander";
-export interface RegistryWorker {
-    id: string;
-    path: string;
-    type: string;
-    visibility: string;
-    company?: string;
-    team?: string;
-    status?: string;
-    description?: string;
-    triggers?: string;
-    grants?: string;
-}
-/** Read + parse the worker registry. Empty array if it does not exist. */
-export declare function readWorkerRegistry(hqRoot: string): RegistryWorker[];
+export { readWorkerRegistry, type RegistryWorker } from "../lib/workers-registry/read.js";
+import { type RegistryWorker } from "../lib/workers-registry/read.js";
 /**
  * Best-effort active company: workspace/sessions/.current -> meta.yaml
  * company_slug. Undefined when no session context is set. Pure/read-only.

package/dist/commands/workers.js

@@ -7,14 +7,8 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
 import { GROUP_ID_PATTERN, EMAIL_PATTERN, normalizeFilePrefix } from "./_patterns.js";
 import { findHqRoot } from "../utils/manifest.js";
-/** Read + parse the worker registry. Empty array if it does not exist. */
-export function readWorkerRegistry(hqRoot) {
-    const p = path.join(hqRoot, "core/workers/registry.yaml");
-    if (!fs.existsSync(p))
-        return [];
-    const doc = parseUserYaml(fs.readFileSync(p, "utf8"), p);
-    return doc?.workers ?? [];
-}
+export { readWorkerRegistry } from "../lib/workers-registry/read.js";
+import { readWorkerRegistry } from "../lib/workers-registry/read.js";
 /**
  * Best-effort active company: workspace/sessions/.current -> meta.yaml
  * company_slug. Undefined when no session context is set. Pure/read-only.

package/dist/lib/bot/api.d.ts

@@ -0,0 +1,202 @@
+/**
+ * Typed HQ API client for the bot runtime (local-bots US-004).
+ *
+ * Every call goes through the shared `vaultApiFetch` helper with a token
+ * supplier so the bot's machine identity (agt_) is minted and refreshed by the
+ * existing Cognito machinery. `fetch` is injectable for tests.
+ */
+import { vaultApiFetch } from "../../utils/vault-api.js";
+export type TokenSupplier = () => Promise<string>;
+/**
+ * One agent-inbox item. DMs carry the base fields; room (channel / group chat)
+ * items add the optional room fields (server: hq-pro-core
+ * room-agent-delivery.ts `RoomInboxMessage`).
+ */
+export interface InboxItem {
+    messageId: string;
+    channel: string;
+    eventId?: string;
+    fromPersonUid?: string;
+    fromDisplayName?: string;
+    text?: string;
+    rootEventId?: string;
+    receivedAt?: string;
+    /** Room items only (channel === "room"). */
+    channelId?: string;
+    channelName?: string;
+    channelScope?: string;
+    mentionedMe?: boolean;
+    memberCount?: number;
+    senderTrust?: "member";
+}
+/** @deprecated use InboxItem */
+export type DmInboxItem = InboxItem;
+/** A simplified channel message for the "Recent messages" context block. */
+export interface ChannelMessageSummary {
+    eventId?: string;
+    fromPersonUid?: string;
+    fromDisplayName?: string;
+    body: string;
+    createdAt?: string;
+}
+export interface AgentRecord {
+    uid: string;
+    name?: string;
+    ownerUid?: string | null;
+    computeMode?: string;
+    botKind?: string;
+    online?: boolean;
+    runtime?: {
+        status?: string;
+        lastHeartbeat?: {
+            at?: string;
+        } | null;
+    };
+}
+export declare class BotApiError extends Error {
+    readonly status: number;
+    readonly path: string;
+    readonly code?: string | undefined;
+    constructor(status: number, path: string, code?: string | undefined, detail?: string);
+}
+export interface BotApiOptions {
+    token: TokenSupplier;
+    baseUrl?: string;
+    fetchImpl?: typeof vaultApiFetch;
+}
+export interface BotPromotionState {
+    version: number;
+    operationId: string;
+    agentUid: string;
+    ownerUid: string;
+    companyUid: string;
+    snapshotSha256: string;
+    phase: "preparing" | "local-stopped" | "imported" | "cloud-ready" | "active" | "cancelled";
+    updatedAt: string;
+}
+export interface BotPromotionUpload {
+    url: string;
+    method: "PUT";
+    headers: Record<string, string>;
+    bytes: number;
+    sha256: string;
+    expiresInSeconds: number;
+}
+export declare class BotApi {
+    private readonly opts;
+    private readonly fetchImpl;
+    constructor(opts: BotApiOptions);
+    private call;
+    /** GET /v1/agents/{uid} — owner-only local bot record (403/404 for others). */
+    getAgent(agentUid: string): Promise<AgentRecord>;
+    /** POST /v1/agents/{uid}/heartbeat — agent-JWT only. */
+    heartbeat(agentUid: string, components: Record<string, "ok" | "degraded" | "failed" | "unknown">): Promise<{
+        ok: boolean;
+        at?: string;
+        local?: boolean;
+    }>;
+    /** GET /v1/agents/{uid}/inbox → { messages } (agent-JWT only). */
+    pullInbox(agentUid: string): Promise<InboxItem[]>;
+    /** POST /v1/agents/{uid}/inbox/{messageId}/ack */
+    ackInbox(agentUid: string, messageId: string): Promise<void>;
+    /** POST /v1/notify/dm — send as the bot (agent identity). */
+    sendDm(input: {
+        toPersonUid: string;
+        body: string;
+        rootEventId?: string;
+    }): Promise<{
+        eventId?: string;
+        createdAt?: string;
+        state?: string;
+    }>;
+    /** POST|DELETE /v1/notify/reactions on a DM message (best-effort thinking status). */
+    setReaction(input: {
+        peerUid: string;
+        messageId: string;
+        emoji: string;
+    }, present: boolean): Promise<boolean>;
+    /**
+     * POST /v1/notify/channels/{id}/claims — first-claim-wins on a room unit.
+     * 200 → true (this bot answers), 409 THREAD_ALREADY_CLAIMED → false
+     * (someone else does). Anything else throws.
+     */
+    claimChannelUnit(channelId: string, unitId: string): Promise<boolean>;
+    /** POST /v1/notify/channels/{id}/messages — post in a room as the bot. */
+    sendChannelMessage(input: {
+        channelId: string;
+        body: string;
+        rootEventId?: string;
+    }): Promise<{
+        eventId?: string;
+        createdAt?: string;
+        rootEventId?: string;
+    }>;
+    /**
+     * POST /v1/notify/channels/{id}/agent-status — ephemeral "thinking" hint in
+     * a room (never durable; the server clears it on the next event). Best-effort.
+     */
+    postAgentStatus(channelId: string, status: string, threadRoot?: string): Promise<boolean>;
+    /**
+     * GET /v1/notify/channels/{id}/messages?limit=N — the newest N messages,
+     * returned oldest-first so they read as a transcript.
+     */
+    fetchChannelMessages(channelId: string, limit?: number): Promise<ChannelMessageSummary[]>;
+    /** POST /v1/agents — person identity creates a local bot (US-002). */
+    /** Promotion mutations must use a human owner token, not bot credentials. */
+    preparePromotion(agentUid: string, input: {
+        companyUid: string;
+        operationId: string;
+        snapshotSha256: string;
+    }): Promise<BotPromotionState>;
+    promotionDetails(agentUid: string, companyUid: string): Promise<{
+        promotion: BotPromotionState | null;
+        failure?: string;
+        pairing: {
+            url: string;
+            code: string;
+            capturedAt?: string;
+        } | null;
+    }>;
+    promotionStatus(agentUid: string, companyUid: string): Promise<BotPromotionState | null>;
+    resumePromotion(agentUid: string, input: {
+        companyUid: string;
+        operationId: string;
+    }): Promise<{
+        promotion: BotPromotionState;
+        pending: boolean;
+    }>;
+    confirmPromotionStopped(agentUid: string, input: {
+        companyUid: string;
+        operationId: string;
+        proof: string;
+    }): Promise<BotPromotionState>;
+    promotionUpload(agentUid: string, input: {
+        companyUid: string;
+        operationId: string;
+        sha256: string;
+        bytes: number;
+        kind: "snapshot" | "machine-credential";
+    }): Promise<{
+        promotion: BotPromotionState;
+        upload: BotPromotionUpload;
+    }>;
+    createLocalBot(input: {
+        name: string;
+        slug?: string;
+    }): Promise<{
+        agent: AgentRecord;
+        identity: {
+            cognitoUsername: string;
+            secret: string;
+        };
+    }>;
+    /** DELETE /v1/agents/{uid} — owner tears the identity down. */
+    deleteLocalBot(agentUid: string): Promise<{
+        uid: string;
+        terminal: boolean;
+        compensations: string[];
+        failures?: Record<string, string>;
+        code?: string;
+    }>;
+}
+//# sourceMappingURL=api.d.ts.map

package/dist/lib/bot/api.js

@@ -0,0 +1,202 @@
+/**
+ * Typed HQ API client for the bot runtime (local-bots US-004).
+ *
+ * Every call goes through the shared `vaultApiFetch` helper with a token
+ * supplier so the bot's machine identity (agt_) is minted and refreshed by the
+ * existing Cognito machinery. `fetch` is injectable for tests.
+ */
+import { vaultApiFetch } from "../../utils/vault-api.js";
+export class BotApiError extends Error {
+    status;
+    path;
+    code;
+    constructor(status, path, code, detail) {
+        super(`HQ API ${path} → ${status}${code ? ` ${code}` : ""}${detail ? `: ${detail}` : ""}`);
+        this.status = status;
+        this.path = path;
+        this.code = code;
+        this.name = "BotApiError";
+    }
+}
+async function readError(res) {
+    try {
+        const body = (await res.json());
+        return {
+            code: typeof body.code === "string" ? body.code : undefined,
+            detail: typeof body.error === "string"
+                ? body.error
+                : typeof body.message === "string"
+                    ? body.message
+                    : undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}
+export class BotApi {
+    opts;
+    fetchImpl;
+    constructor(opts) {
+        this.opts = opts;
+        this.fetchImpl = opts.fetchImpl ?? vaultApiFetch;
+    }
+    async call(path, init = {}, accept = [200, 201, 202]) {
+        const token = await this.opts.token();
+        const res = await this.fetchImpl({
+            token,
+            path,
+            method: init.method,
+            body: init.body,
+            query: init.query,
+            ...(this.opts.baseUrl ? { baseUrl: this.opts.baseUrl } : {}),
+        });
+        if (!accept.includes(res.status)) {
+            const err = await readError(res);
+            throw new BotApiError(res.status, path, err.code, err.detail);
+        }
+        const text = await res.text();
+        return { status: res.status, body: (text ? JSON.parse(text) : {}) };
+    }
+    /** GET /v1/agents/{uid} — owner-only local bot record (403/404 for others). */
+    async getAgent(agentUid) {
+        const { body } = await this.call(`/v1/agents/${encodeURIComponent(agentUid)}`);
+        return body.agent ?? body;
+    }
+    /** POST /v1/agents/{uid}/heartbeat — agent-JWT only. */
+    async heartbeat(agentUid, components) {
+        const { body } = await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/heartbeat`, { method: "POST", body: { components } });
+        return body;
+    }
+    /** GET /v1/agents/{uid}/inbox → { messages } (agent-JWT only). */
+    async pullInbox(agentUid) {
+        const { body } = await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/inbox`);
+        return body.messages ?? body.items ?? [];
+    }
+    /** POST /v1/agents/{uid}/inbox/{messageId}/ack */
+    async ackInbox(agentUid, messageId) {
+        await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/inbox/${encodeURIComponent(messageId)}/ack`, { method: "POST", body: {} });
+    }
+    /** POST /v1/notify/dm — send as the bot (agent identity). */
+    async sendDm(input) {
+        const payload = { toPersonUid: input.toPersonUid, body: input.body };
+        if (input.rootEventId)
+            payload.rootEventId = input.rootEventId;
+        const { body } = await this.call("/v1/notify/dm", { method: "POST", body: payload });
+        return body;
+    }
+    /** POST|DELETE /v1/notify/reactions on a DM message (best-effort thinking status). */
+    async setReaction(input, present) {
+        try {
+            await this.call("/v1/notify/reactions", {
+                method: present ? "POST" : "DELETE",
+                body: { messageScope: `dm:${input.peerUid}`, messageId: input.messageId, emoji: input.emoji },
+            }, [200, 201, 204]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * POST /v1/notify/channels/{id}/claims — first-claim-wins on a room unit.
+     * 200 → true (this bot answers), 409 THREAD_ALREADY_CLAIMED → false
+     * (someone else does). Anything else throws.
+     */
+    async claimChannelUnit(channelId, unitId) {
+        try {
+            await this.call(`/v1/notify/channels/${encodeURIComponent(channelId)}/claims`, { method: "POST", body: { unitId } }, [200]);
+            return true;
+        }
+        catch (err) {
+            if (err instanceof BotApiError && err.status === 409)
+                return false;
+            throw err;
+        }
+    }
+    /** POST /v1/notify/channels/{id}/messages — post in a room as the bot. */
+    async sendChannelMessage(input) {
+        const payload = { body: input.body };
+        if (input.rootEventId)
+            payload.rootEventId = input.rootEventId;
+        const { body } = await this.call(`/v1/notify/channels/${encodeURIComponent(input.channelId)}/messages`, { method: "POST", body: payload });
+        return body;
+    }
+    /**
+     * POST /v1/notify/channels/{id}/agent-status — ephemeral "thinking" hint in
+     * a room (never durable; the server clears it on the next event). Best-effort.
+     */
+    async postAgentStatus(channelId, status, threadRoot) {
+        try {
+            await this.call(`/v1/notify/channels/${encodeURIComponent(channelId)}/agent-status`, { method: "POST", body: { status, ...(threadRoot ? { threadRoot } : {}) } }, [200]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * GET /v1/notify/channels/{id}/messages?limit=N — the newest N messages,
+     * returned oldest-first so they read as a transcript.
+     */
+    async fetchChannelMessages(channelId, limit = 15) {
+        const { body } = await this.call(`/v1/notify/channels/${encodeURIComponent(channelId)}/messages`, { query: { limit: String(limit) } });
+        const rows = Array.isArray(body.messages) ? body.messages : [];
+        const out = [];
+        for (const row of rows) {
+            const text = typeof row.body === "string" ? row.body.trim() : "";
+            if (!text)
+                continue;
+            out.push({
+                ...(typeof row.eventId === "string" ? { eventId: row.eventId } : {}),
+                ...(typeof row.fromPersonUid === "string" ? { fromPersonUid: row.fromPersonUid } : {}),
+                ...(typeof row.fromDisplayName === "string" && row.fromDisplayName.trim()
+                    ? { fromDisplayName: row.fromDisplayName.trim() }
+                    : {}),
+                body: text,
+                ...(typeof row.createdAt === "string" ? { createdAt: row.createdAt } : {}),
+            });
+        }
+        out.sort((a, b) => (a.createdAt ?? "").localeCompare(b.createdAt ?? ""));
+        return out;
+    }
+    /** POST /v1/agents — person identity creates a local bot (US-002). */
+    /** Promotion mutations must use a human owner token, not bot credentials. */
+    async preparePromotion(agentUid, input) {
+        return (await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/promote/prepare`, { method: "POST", body: input })).body.promotion;
+    }
+    async promotionDetails(agentUid, companyUid) {
+        return (await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/promote?companyUid=${encodeURIComponent(companyUid)}`, { method: "GET" })).body;
+    }
+    async promotionStatus(agentUid, companyUid) {
+        return (await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/promote?companyUid=${encodeURIComponent(companyUid)}`, { method: "GET" })).body.promotion;
+    }
+    async resumePromotion(agentUid, input) {
+        return (await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/promote/resume`, { method: "POST", body: input })).body;
+    }
+    async confirmPromotionStopped(agentUid, input) {
+        return (await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/promote/local-stopped`, { method: "POST", body: input })).body.promotion;
+    }
+    async promotionUpload(agentUid, input) {
+        return (await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/promote/snapshot-upload`, { method: "POST", body: input })).body;
+    }
+    async createLocalBot(input) {
+        const { body } = await this.call("/v1/agents", {
+            method: "POST",
+            body: {
+                name: input.name,
+                ...(input.slug ? { slug: input.slug } : {}),
+                computeMode: "local",
+                botKind: "personal",
+                role: "local-bot",
+            },
+        });
+        return body;
+    }
+    /** DELETE /v1/agents/{uid} — owner tears the identity down. */
+    async deleteLocalBot(agentUid) {
+        const { body } = await this.call(`/v1/agents/${encodeURIComponent(agentUid)}`, { method: "DELETE" });
+        return body;
+    }
+}
+//# sourceMappingURL=api.js.map

package/dist/lib/bot/company-bind.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Company bind for worker-sourced bots (local-bots Feature 4).
+ *
+ * HQ's company hooks key on workspace/sessions/<sid>/meta.yaml `company_slug`,
+ * where <sid> is the Claude session id carried in the hook payload. A bot that
+ * runs a company worker writes that file for the session id it is about to
+ * use, before every turn, so the hooks resolve the company exactly as they do
+ * for the owner. Idempotent: an existing file keeps its other keys and only
+ * has `company_slug` replaced.
+ *
+ * Coverage note: Claude bots get the full company hook set (their session id
+ * is in the hook payload). Codex/Grok bots only see HQ_SESSION_ID in the env.
+ */
+export interface CompanyBindFs {
+    existsSync: (p: string) => boolean;
+    readFileSync: (p: string) => string;
+    writeFileSync: (p: string, body: string) => void;
+    mkdirSync: (p: string) => void;
+}
+export declare const defaultCompanyBindFs: CompanyBindFs;
+export declare function botSessionMetaRelPath(sessionId: string): string;
+export declare function ensureBotSessionMeta(hqRoot: string, sessionId: string, companySlug: string, io?: CompanyBindFs, now?: () => Date): {
+    path: string;
+    created: boolean;
+    changed: boolean;
+};
+//# sourceMappingURL=company-bind.d.ts.map