@indigoai-us/hq-cli 5.113.0 → 5.113.1

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.113.1] — 2026-09-15
+
+### Fixed
+
+- A bot can create a bot for its owner. `hq bot` commands (create, list, rm,
+  promote) always act as the signed-in person, even when a bot runs them; they
+  used the bot's own identity, which can own no bot, so the setup bot told
+  people to open a terminal to create their first bot.
+
 ## [5.113.0] — 2026-09-15
 
 ### Added

package/dist/commands/bot.js

@@ -27,7 +27,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import * as readline from "node:readline";
 import { DEFAULT_COGNITO, ensureCognitoToken, resolveDefaultHqRoot, } from "../utils/cognito-session.js";
-import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
+import { peekHqApiKey } from "../utils/resolve-vault-credential.js";
 import { resolveCallerPersonUid } from "../utils/vault-api.js";
 import { resolveHqBinary } from "../lib/mesh/live/daemon/install.js";
 import { BotApi, BotApiError, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, isBotRuntimeId, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, } from "../lib/bot/index.js";
@@ -88,15 +88,18 @@ export function botTokenSupplier(dir) {
     return () => ensureCognitoToken({ tokenSource: "machine", interactive: false });
 }
 async function ownerToken(interactive = process.stdin.isTTY === true) {
-    // Under the desktop app (no TTY) never open a browser login; the app owns
-    // sign-in and shares the same cached session file.
-    const cred = await resolveVaultCredential({ interactive });
-    if (cred.kind !== "cognito") {
+    if (peekHqApiKey()) {
         throw Object.assign(new Error("hq bot needs your HQ login session (HQ_API_KEY is not supported here). Run `hq login`."), {
             expected: true,
         });
     }
-    return cred.token;
+    // Bots belong to a person, so `hq bot` always acts as the signed-in person,
+    // even when a bot runs it: a bot's own process exports its machine
+    // credentials, and a machine identity can own no bot ("No person entity
+    // found"), which left a setup bot unable to create its owner's first bot.
+    // Under the desktop app (no TTY) never open a browser login; the app owns
+    // sign-in and shares the same cached session file.
+    return ensureCognitoToken({ tokenSource: "person", interactive });
 }
 function rowFor(name, opts = {}) {
     const dir = botDir(name);

package/dist/lib/bot/prompt.js

@@ -253,6 +253,7 @@ export function buildSystemPrompt(input) {
         `Their HQ folder is ${input.hqRoot}; it is your working directory, so its files, skills, and \`hq\` commands are available directly.\n` +
         `\`hq\` commands you run authenticate as you, the bot (${input.agentUid}), not as your owner: \`hq whoami\`, membership and company lookups describe the bot, ` +
         `and a bot usually belongs to no company. Never use them to say who your owner is or which companies they belong to. ` +
+        `The exception is \`hq bot\` (create, list, rm, promote): it always acts as your owner, so you can create a bot for them when they ask; its owner is your owner. ` +
         `Direct messages from your owner start with an "Owner context" block checked with your owner's own sign-in; that is the only source for your owner's companies. ` +
         `If it says the check failed, say you could not check; never say your owner has no company unless that block says so. ` +
         `Room messages do not carry it: in a room, never state which companies your owner belongs to.\n` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.113.0",
+  "version": "5.113.1",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {