@indigoai-us/hq-cli 5.113.0 → 5.114.0

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [5.114.0] — 2026-09-15
+
+### Changed
+
+- Local bots now work on two conversations at once. A question in one
+  channel no longer waits for the bot to finish answering in another; messages
+  in the same conversation (your DMs with the bot, or one channel) are still
+  answered in order. A restart or stop during two turns reports each one that
+  did not finish.
+
+### Fixed
+
+- The log bundle attached to `hq feedback` reports is now a zip instead of a
+  gzip. Slack refuses a gzip file from the HQ app at any size, so for several
+  weeks every report's logs were uploaded and then silently dropped before
+  anyone could read them. Nothing about what the bundle contains or how it is
+  redacted has changed.
+
+## [5.113.1] — 2026-09-15
+
+### Fixed
+
+- A bot can create a bot for its owner. `hq bot` commands (create, list, rm,
+  promote) always act as the signed-in person, even when a bot runs them; they
+  used the bot's own identity, which can own no bot, so the setup bot told
+  people to open a terminal to create their first bot.
+
 ## [5.113.0] — 2026-09-15
 
 ### Added

package/dist/commands/bot.js

@@ -27,7 +27,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import * as readline from "node:readline";
 import { DEFAULT_COGNITO, ensureCognitoToken, resolveDefaultHqRoot, } from "../utils/cognito-session.js";
-import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
+import { peekHqApiKey } from "../utils/resolve-vault-credential.js";
 import { resolveCallerPersonUid } from "../utils/vault-api.js";
 import { resolveHqBinary } from "../lib/mesh/live/daemon/install.js";
 import { BotApi, BotApiError, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, isBotRuntimeId, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, } from "../lib/bot/index.js";
@@ -88,15 +88,18 @@ export function botTokenSupplier(dir) {
     return () => ensureCognitoToken({ tokenSource: "machine", interactive: false });
 }
 async function ownerToken(interactive = process.stdin.isTTY === true) {
-    // Under the desktop app (no TTY) never open a browser login; the app owns
-    // sign-in and shares the same cached session file.
-    const cred = await resolveVaultCredential({ interactive });
-    if (cred.kind !== "cognito") {
+    if (peekHqApiKey()) {
         throw Object.assign(new Error("hq bot needs your HQ login session (HQ_API_KEY is not supported here). Run `hq login`."), {
             expected: true,
         });
     }
-    return cred.token;
+    // Bots belong to a person, so `hq bot` always acts as the signed-in person,
+    // even when a bot runs it: a bot's own process exports its machine
+    // credentials, and a machine identity can own no bot ("No person entity
+    // found"), which left a setup bot unable to create its owner's first bot.
+    // Under the desktop app (no TTY) never open a browser login; the app owns
+    // sign-in and shares the same cached session file.
+    return ensureCognitoToken({ tokenSource: "person", interactive });
 }
 function rowFor(name, opts = {}) {
     const dir = botDir(name);

package/dist/lib/bot/inflight.d.ts

@@ -1,11 +1,17 @@
 /**
- * inflight.json — the message a model turn is working on right now.
+ * inflight.json — the messages model turns are working on right now.
  *
- * Written before the model process starts and removed once the message is
- * answered (or answered with "did not finish"). If the bot restarts while the
- * file exists, the turn was cut off: the bot tells the person instead of
- * running the message again, because the first run may already have done
- * things outside this Mac (sent something, published something).
+ * A marker is written before the model process starts and removed once the
+ * message is answered (or answered with "did not finish"). If the bot restarts
+ * while a marker exists, that turn was cut off: the bot tells the person
+ * instead of running the message again, because the first run may already
+ * have done things outside this Mac (sent something, published something).
+ *
+ * A bot works on up to two conversations at once, so the file holds one marker
+ * per running turn (`v: 2`). A `v: 1` file (a single marker, written before
+ * turns ran in parallel) is still read. Every write is a synchronous
+ * read-modify-rename, so turns in the same process cannot lose each other's
+ * markers.
  */
 export declare const BOT_INFLIGHT_NAME = "inflight.json";
 export interface InflightTurn {
@@ -33,8 +39,13 @@ export interface InflightTurn {
     reply?: string;
 }
 export declare function botInflightPath(dir: string): string;
-export declare function readInflight(dir: string): InflightTurn | null;
+/** Every turn that was in progress, oldest first. */
+export declare function readInflightTurns(dir: string): InflightTurn[];
+/** The marker for one message, or null. */
+export declare function readInflight(dir: string, messageId?: string): InflightTurn | null;
+/** Add or replace the marker for `turn.messageId`; other turns' markers stay. */
 export declare function writeInflight(dir: string, turn: InflightTurn): void;
 export declare function patchInflight(dir: string, messageId: string, patch: Partial<InflightTurn>): void;
+/** Remove one message's marker, or every marker when no id is given. */
 export declare function clearInflight(dir: string, messageId?: string): void;
 //# sourceMappingURL=inflight.d.ts.map

package/dist/lib/bot/inflight.js

@@ -1,11 +1,17 @@
 /**
- * inflight.json — the message a model turn is working on right now.
+ * inflight.json — the messages model turns are working on right now.
  *
- * Written before the model process starts and removed once the message is
- * answered (or answered with "did not finish"). If the bot restarts while the
- * file exists, the turn was cut off: the bot tells the person instead of
- * running the message again, because the first run may already have done
- * things outside this Mac (sent something, published something).
+ * A marker is written before the model process starts and removed once the
+ * message is answered (or answered with "did not finish"). If the bot restarts
+ * while a marker exists, that turn was cut off: the bot tells the person
+ * instead of running the message again, because the first run may already
+ * have done things outside this Mac (sent something, published something).
+ *
+ * A bot works on up to two conversations at once, so the file holds one marker
+ * per running turn (`v: 2`). A `v: 1` file (a single marker, written before
+ * turns ran in parallel) is still read. Every write is a synchronous
+ * read-modify-rename, so turns in the same process cannot lose each other's
+ * markers.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -13,32 +19,65 @@ export const BOT_INFLIGHT_NAME = "inflight.json";
 export function botInflightPath(dir) {
     return path.join(dir, BOT_INFLIGHT_NAME);
 }
-export function readInflight(dir) {
+function isTurn(raw) {
+    const t = raw;
+    return t?.v === 1 && typeof t.messageId === "string" && Boolean(t.target);
+}
+/** Every turn that was in progress, oldest first. */
+export function readInflightTurns(dir) {
     try {
         const raw = JSON.parse(fs.readFileSync(botInflightPath(dir), "utf8"));
-        if (raw?.v !== 1 || typeof raw.messageId !== "string" || !raw.target)
-            return null;
-        return raw;
+        if (isTurn(raw))
+            return [raw];
+        const file = raw;
+        if (file?.v !== 2 || !Array.isArray(file.turns))
+            return [];
+        return file.turns.filter(isTurn);
     }
     catch {
-        return null;
+        return [];
     }
 }
-export function writeInflight(dir, turn) {
+/** The marker for one message, or null. */
+export function readInflight(dir, messageId) {
+    const turns = readInflightTurns(dir);
+    if (messageId === undefined)
+        return turns[0] ?? null;
+    return turns.find((t) => t.messageId === messageId) ?? null;
+}
+function writeTurns(dir, turns) {
+    if (turns.length === 0) {
+        fs.rmSync(botInflightPath(dir), { force: true });
+        return;
+    }
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     const tmp = path.join(dir, `.inflight.tmp.${process.pid}.${Date.now()}`);
-    fs.writeFileSync(tmp, `${JSON.stringify(turn, null, 2)}\n`, { mode: 0o600 });
+    const file = { v: 2, turns };
+    fs.writeFileSync(tmp, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
     fs.renameSync(tmp, botInflightPath(dir));
 }
+/** Add or replace the marker for `turn.messageId`; other turns' markers stay. */
+export function writeInflight(dir, turn) {
+    const others = readInflightTurns(dir).filter((t) => t.messageId !== turn.messageId);
+    writeTurns(dir, [...others, turn]);
+}
 export function patchInflight(dir, messageId, patch) {
-    const current = readInflight(dir);
-    if (!current || current.messageId !== messageId)
+    const turns = readInflightTurns(dir);
+    const index = turns.findIndex((t) => t.messageId === messageId);
+    if (index < 0)
         return;
-    writeInflight(dir, { ...current, ...patch });
+    turns[index] = { ...turns[index], ...patch };
+    writeTurns(dir, turns);
 }
+/** Remove one message's marker, or every marker when no id is given. */
 export function clearInflight(dir, messageId) {
-    if (messageId !== undefined && readInflight(dir)?.messageId !== messageId)
+    if (messageId === undefined) {
+        writeTurns(dir, []);
         return;
-    fs.rmSync(botInflightPath(dir), { force: true });
+    }
+    const turns = readInflightTurns(dir);
+    const rest = turns.filter((t) => t.messageId !== messageId);
+    if (rest.length !== turns.length)
+        writeTurns(dir, rest);
 }
 //# sourceMappingURL=inflight.js.map

package/dist/lib/bot/prompt.js

@@ -253,6 +253,7 @@ export function buildSystemPrompt(input) {
         `Their HQ folder is ${input.hqRoot}; it is your working directory, so its files, skills, and \`hq\` commands are available directly.\n` +
         `\`hq\` commands you run authenticate as you, the bot (${input.agentUid}), not as your owner: \`hq whoami\`, membership and company lookups describe the bot, ` +
         `and a bot usually belongs to no company. Never use them to say who your owner is or which companies they belong to. ` +
+        `The exception is \`hq bot\` (create, list, rm, promote): it always acts as your owner, so you can create a bot for them when they ask; its owner is your owner. ` +
         `Direct messages from your owner start with an "Owner context" block checked with your owner's own sign-in; that is the only source for your owner's companies. ` +
         `If it says the check failed, say you could not check; never say your owner has no company unless that block says so. ` +
         `Room messages do not carry it: in a room, never state which companies your owner belongs to.\n` +

package/dist/lib/bot/run.d.ts

@@ -5,7 +5,7 @@
  * - refuses to start unless the creds file names this bot's agt_ AND the
  *   server-side record is owned by the configured owner
  * - heartbeat every 30s (POST /v1/agents/{uid}/heartbeat, agent JWT)
- * - inbox poll every 5s: owner DMs go to ONE headless model turn (resumed by
+ * - inbox poll every 2s: owner DMs go to ONE headless model turn (resumed by
  *   session id); the reply is sent as the bot; the message is acked only after
  *   the reply is sent; processed ids persist so a crash between reply and ack
  *   never answers twice
@@ -16,6 +16,10 @@
  * - room items (channels / group chats): answered when the bot is @mentioned,
  *   or when the owner posts in a small group (see room-policy.ts); claimed
  *   first (first-claim-wins), one session per room, reply posted in the room
+ * - conversations run side by side: up to MAX_PARALLEL_TURNS turns at once,
+ *   one lane per model session (the owner DM session, or one room). Messages
+ *   in the same lane run in order, so a session is never resumed by two turns
+ *   at once and a thread's answers never arrive out of sequence.
  * - while a turn runs, each finished assistant message is posted as its own
  *   message (progress.ts); turns have no time limit
  * - every received message gets a reply: a turn that fails after the model
@@ -29,7 +33,7 @@
  * Everything with a side effect is injectable so the loop is unit-testable.
  */
 import { type OwnerContext } from "./owner-context.js";
-import type { BotApi } from "./api.js";
+import type { BotApi, InboxItem } from "./api.js";
 import type { BotConfig } from "./config.js";
 import { type ProgressPosterOptions } from "./progress.js";
 import { type BotLogger } from "./log.js";
@@ -44,6 +48,8 @@ export declare const THINKING_EMOJI = "\uD83D\uDC40";
 export declare const ROOM_THINKING_STATUS = "is thinking\u2026";
 export declare const RECENT_MESSAGES_LIMIT = 15;
 export declare const RECENT_MESSAGE_MAX_CHARS = 400;
+/** Model turns a bot runs at once (each on a different conversation). */
+export declare const MAX_PARALLEL_TURNS = 2;
 export type SleepFn = (ms: number) => Promise<void>;
 export interface BotRunDeps {
     dir: string;
@@ -78,6 +84,8 @@ export interface BotRunDeps {
      * Omitted in tests that do not exercise it.
      */
     ownerContext?: () => Promise<OwnerContext>;
+    /** Turns run at once across conversations (default MAX_PARALLEL_TURNS). */
+    maxParallelTurns?: number;
 }
 export declare const KICKOFF_MESSAGE_ID = "kickoff";
 /** The core worker HQ's setup bot runs. */
@@ -92,7 +100,15 @@ export interface BotHandle {
     /** Resolves when both loops have ended (state stopped or failed). */
     done: Promise<BotState>;
     status(): BotStatusFile | null;
+    /** True when no inbox message is queued or being worked on. */
+    idle(): boolean;
 }
+/**
+ * The lane an inbox item runs in: the model session its turn resumes. Owner
+ * DMs share the DM session; each room has its own. An item that never reaches
+ * a model turn (refusal, not addressed to the bot) gets a lane of its own.
+ */
+export declare function inboxLaneKey(item: InboxItem, config: Pick<BotConfig, "ownerUid" | "agentUid" | "name">): string;
 export declare function preflightCreds(dir: string, config: BotConfig): string | null;
 export declare function runBot(deps: BotRunDeps): Promise<BotHandle>;
 //# sourceMappingURL=run.d.ts.map

package/dist/lib/bot/run.js

@@ -5,7 +5,7 @@
  * - refuses to start unless the creds file names this bot's agt_ AND the
  *   server-side record is owned by the configured owner
  * - heartbeat every 30s (POST /v1/agents/{uid}/heartbeat, agent JWT)
- * - inbox poll every 5s: owner DMs go to ONE headless model turn (resumed by
+ * - inbox poll every 2s: owner DMs go to ONE headless model turn (resumed by
  *   session id); the reply is sent as the bot; the message is acked only after
  *   the reply is sent; processed ids persist so a crash between reply and ack
  *   never answers twice
@@ -16,6 +16,10 @@
  * - room items (channels / group chats): answered when the bot is @mentioned,
  *   or when the owner posts in a small group (see room-policy.ts); claimed
  *   first (first-claim-wins), one session per room, reply posted in the room
+ * - conversations run side by side: up to MAX_PARALLEL_TURNS turns at once,
+ *   one lane per model session (the owner DM session, or one room). Messages
+ *   in the same lane run in order, so a session is never resumed by two turns
+ *   at once and a thread's answers never arrive out of sequence.
  * - while a turn runs, each finished assistant message is posted as its own
  *   message (progress.ts); turns have no time limit
  * - every received message gets a reply: a turn that fails after the model
@@ -39,7 +43,7 @@ import { patchBotConfig, readBotConfig } from "./config.js";
 import { ensureBotSessionMeta } from "./company-bind.js";
 import { readBotCredsIdentity } from "./creds.js";
 import { isProcessed, markProcessed, readInboxState } from "./inbox-state.js";
-import { clearInflight, patchInflight, readInflight, writeInflight } from "./inflight.js";
+import { clearInflight, patchInflight, readInflight, readInflightTurns, writeInflight } from "./inflight.js";
 import { ProgressPoster } from "./progress.js";
 import { createBotLogger } from "./log.js";
 import { buildSystemPrompt, introDmText, nonOwnerRefusalText, readPromptSources } from "./prompt.js";
@@ -57,6 +61,8 @@ export const THINKING_EMOJI = "👀";
 export const ROOM_THINKING_STATUS = "is thinking…";
 export const RECENT_MESSAGES_LIMIT = 15;
 export const RECENT_MESSAGE_MAX_CHARS = 400;
+/** Model turns a bot runs at once (each on a different conversation). */
+export const MAX_PARALLEL_TURNS = 2;
 export const KICKOFF_MESSAGE_ID = "kickoff";
 /** The core worker HQ's setup bot runs. */
 export const SETUP_WORKER_ID = "setup";
@@ -68,6 +74,17 @@ export function didNotFinishText(reason, progressPosted) {
 /** Owner stop, `hq bot stop` or `hq bot restart`: all arrive as the same signal. */
 export const STOPPED_BY_OWNER_REASON = "I was stopped before I was done";
 export const RESTARTED_REASON = "I was restarted while I was working on it";
+/**
+ * The lane an inbox item runs in: the model session its turn resumes. Owner
+ * DMs share the DM session; each room has its own. An item that never reaches
+ * a model turn (refusal, not addressed to the bot) gets a lane of its own.
+ */
+export function inboxLaneKey(item, config) {
+    if (isDmItem(item))
+        return "dm";
+    const target = resolveReplyTarget(item, config);
+    return target?.kind === "room" ? target.sessionScope : `item:${item.messageId}`;
+}
 class FailureWindow {
     windowMs;
     limit;
@@ -117,8 +134,9 @@ export async function runBot(deps) {
     const setStatus = (patch) => patchBotStatus(dir, patch, fallback, now);
     let state = "starting";
     let stopping = false;
-    /** Aborts the model turn in progress (owner stop). */
-    let currentTurn = null;
+    /** Aborts the model turns in progress (owner stop). */
+    const currentTurns = new Set();
+    const maxParallelTurns = Math.max(1, deps.maxParallelTurns ?? MAX_PARALLEL_TURNS);
     let resolveDone;
     const done = new Promise((r) => (resolveDone = r));
     // Only override isProcessAlive when a caller injected one: spreading an
@@ -152,14 +170,14 @@ export async function runBot(deps) {
         log("error", credsProblem);
         resolveDone("failed");
         exit(0);
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     if (config.enabled === false) {
         setStatus({ state: "stopped", pid });
         log("info", "bot is disabled (hq bot start to enable)");
         resolveDone("stopped");
         exit(0);
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     if (!deps.skipPidLock) {
         const lock = acquirePidLock(dir, lockDeps);
@@ -168,12 +186,12 @@ export async function runBot(deps) {
             log("warn", msg);
             resolveDone("stopped");
             exit(0);
-            return { stop: async () => { }, done, status: () => null };
+            return { stop: async () => { }, done, status: () => null, idle: () => true };
         }
     }
     if (hasPromotionHold(dir)) {
         await finish("stopped", 0, "local bot held for cloud promotion");
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     setStatus({ ...fallback(), pid, state: "starting", canDrainForPromotion: false });
     log("info", `starting ${config.name} (${config.runtime}) as ${config.agentUid} for ${config.ownerUid}`);
@@ -183,17 +201,17 @@ export async function runBot(deps) {
         // an old local installation start consuming the cloud bot's inbox.
         if (record.uid !== config.agentUid || record.computeMode !== "local" || record.botKind !== "personal") {
             await finish("failed", 0, `identity ${config.agentUid} is not a personal local bot; this installation cannot run it`);
-            return { stop: async () => { }, done, status: () => null };
+            return { stop: async () => { }, done, status: () => null, idle: () => true };
         }
         const owner = record.ownerUid ?? null;
         if (owner !== config.ownerUid) {
             await finish("failed", 0, `identity ${config.agentUid} is owned by ${owner ?? "nobody"}, not ${config.ownerUid}`);
-            return { stop: async () => { }, done, status: () => null };
+            return { stop: async () => { }, done, status: () => null, idle: () => true };
         }
     }
     catch (err) {
         await finish("failed", 0, `could not verify bot identity: ${err instanceof Error ? err.message : String(err)}`);
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     // ── System prompt ──────────────────────────────────────────────────────────
     const systemPrompt = deps.systemPromptOverride ??
@@ -218,14 +236,14 @@ export async function runBot(deps) {
     fs.writeFileSync(systemPromptFile, systemPrompt, { mode: 0o600 });
     if (hasPromotionHold(dir)) {
         await finish("stopped", 0, "local bot held for cloud promotion");
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     state = "running";
     setStatus({ state: "running", lastActivityAt: now().toISOString() });
     log("info", "running");
     // Read before the kickoff can write its own marker: whatever is here now was
     // left by a previous run that was cut off mid-turn.
-    const leftover = readInflight(dir);
+    const leftovers = readInflightTurns(dir);
     // ── Intro DM (once) ────────────────────────────────────────────────────────
     // The kickoff turn is tied to the intro: it runs only in the start that sent
     // the intro, so introSentAt (persisted before the turn) guarantees it never
@@ -419,7 +437,7 @@ export async function runBot(deps) {
             },
         });
         const controller = new AbortController();
-        currentTurn = controller;
+        currentTurns.add(controller);
         poster.start();
         try {
             const turn = await executeTurn(args.prompt, args.sessionScope, args.tReceived, {
@@ -442,8 +460,7 @@ export async function runBot(deps) {
             return { outcome: { ok: false, started, aborted, excerpt, error: err }, poster };
         }
         finally {
-            if (currentTurn === controller)
-                currentTurn = null;
+            currentTurns.delete(controller);
         }
     };
     const failureReason = (outcome) => outcome.aborted ? STOPPED_BY_OWNER_REASON : `${runtime.id} stopped with an error: ${outcome.excerpt.slice(0, 160)}`;
@@ -561,8 +578,8 @@ export async function runBot(deps) {
         }
         // A turn on this message already started once and was cut off: say so,
         // never run it again.
-        const inflight = readInflight(dir);
-        if (inflight?.messageId === id) {
+        const inflight = readInflight(dir, id);
+        if (inflight) {
             await recoverInflight(inflight);
             return;
         }
@@ -721,9 +738,54 @@ export async function runBot(deps) {
             log("error", `kickoff turn crashed: ${err instanceof Error ? err.message : String(err)}`);
         })
         : Promise.resolve();
+    // ── Lanes: conversations side by side, each conversation in order ─────────
+    /** Messages waiting per lane, in arrival order. */
+    const lanes = new Map();
+    /** Lanes with a message being handled right now. */
+    const busyLanes = new Set();
+    /** Every message queued or being handled (the inbox re-delivers until acked). */
+    const pending = new Set();
+    const running = new Set();
+    const canStart = () => !stopping && state === "running" && !hasPromotionHold(dir);
+    const pump = () => {
+        for (const [lane, queue] of lanes) {
+            if (busyLanes.size >= maxParallelTurns || !canStart())
+                return;
+            if (busyLanes.has(lane))
+                continue;
+            const item = queue.shift();
+            if (queue.length === 0)
+                lanes.delete(lane);
+            if (!item)
+                continue;
+            busyLanes.add(lane);
+            const task = handleItem(item)
+                .catch((err) => {
+                log("warn", `inbox item ${item.messageId} failed: ${err instanceof Error ? err.message : String(err)}`);
+            })
+                .finally(() => {
+                busyLanes.delete(lane);
+                pending.delete(item.messageId);
+                running.delete(task);
+                pump();
+            });
+            running.add(task);
+        }
+    };
+    const enqueue = (item) => {
+        if (pending.has(item.messageId))
+            return;
+        pending.add(item.messageId);
+        const lane = inboxLaneKey(item, config);
+        const queue = lanes.get(lane);
+        if (queue)
+            queue.push(item);
+        else
+            lanes.set(lane, [item]);
+    };
     const inboxLoop = (async () => {
-        // A turn cut off by the last restart is reported before anything new runs.
-        if (leftover) {
+        // Turns cut off by the last restart are reported before anything new runs.
+        for (const leftover of leftovers) {
             try {
                 await recoverInflight(leftover);
             }
@@ -738,16 +800,9 @@ export async function runBot(deps) {
             try {
                 const items = await api.pullInbox(config.agentUid);
                 setStatus({ lastInboxPollAt: now().toISOString() });
-                for (const item of items) {
-                    if (stopping || state !== "running" || hasPromotionHold(dir))
-                        break;
-                    try {
-                        await handleItem(item);
-                    }
-                    catch (err) {
-                        log("warn", `inbox item ${item.messageId} failed: ${err instanceof Error ? err.message : String(err)}`);
-                    }
-                }
+                for (const item of items)
+                    enqueue(item);
+                pump();
             }
             catch (err) {
                 log("warn", `inbox poll failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -756,6 +811,10 @@ export async function runBot(deps) {
                 break;
             await sleep(inboxIntervalMs);
         }
+        // Stop, drain and promotion wait for the turns already running. Queued
+        // messages were never started or acked, so the inbox delivers them again.
+        while (running.size > 0)
+            await Promise.allSettled([...running]);
     })();
     function readStatus() {
         return readBotStatus(dir);
@@ -763,7 +822,8 @@ export async function runBot(deps) {
     const stop = async (mode = "abort") => {
         if (stopping) {
             if (mode === "abort")
-                currentTurn?.abort();
+                for (const turn of currentTurns)
+                    turn.abort();
             return;
         }
         stopping = true;
@@ -771,7 +831,8 @@ export async function runBot(deps) {
         // Promotion instead drains that turn, including its reply and ACK, before
         // the coordinator snapshots memory and starts the cloud consumer.
         if (mode === "abort")
-            currentTurn?.abort();
+            for (const turn of currentTurns)
+                turn.abort();
         await Promise.allSettled([heartbeatLoop, inboxLoop]);
         await finish("stopped", 0, mode === "drain" ? "promotion drain completed" : "stop requested");
     };
@@ -789,6 +850,6 @@ export async function runBot(deps) {
         if (state === "running")
             void finish("stopped", 0, "loops ended");
     });
-    return { stop, done, status: readStatus };
+    return { stop, done, status: readStatus, idle: () => pending.size === 0 };
 }
 //# sourceMappingURL=run.js.map

package/dist/utils/feedback-log-bundle.d.ts

@@ -6,7 +6,7 @@
  * body above 64 KiB, and `diagnostics` is written into a DynamoDB item, which
  * caps at 400 KB. Neither can be tuned into carrying a real log history, so the
  * inline blob is deliberately a ~40 KiB summary of 16 KiB tails. This module
- * produces the other half: a gzipped bundle uploaded direct to S3, carrying the
+ * produces the other half: a zipped bundle uploaded direct to S3, carrying the
  * files whole rather than in tail-sized slivers.
  *
  * Three properties are load-bearing and none may be traded away:
@@ -25,17 +25,33 @@
  *   3. BOUNDED MEMORY. 50 MB compressed is roughly a gigabyte of raw log text
  *      at the ratio these files compress at. Nothing is ever fully materialised:
  *      files are read in slices, redacted a line at a time, and streamed into
- *      gzip, with only the compressed output retained.
+ *      the deflate stream, with only the compressed output retained.
  *
- * Output format — gzipped NDJSON, one JSON record per line:
+ * WHY ZIP AND NOT GZIP. This bundle is attached to a Slack thread by the
+ * hq-pro feedback worker, and Slack's `files.completeUploadExternal` refuses a
+ * gzip member from this app at ANY size — a 52-byte gzip was rejected with
+ * `internal_error`, while the same bytes as zip were accepted. That was the
+ * root cause of roughly 110 consecutive silent attachment failures. The worker
+ * carries a gz-to-zip repack so older CLIs still get an attachable bundle;
+ * emitting zip here means the common path never pays for that unpack, and the
+ * archive is the format the destination actually accepts.
+ *
+ * A single deflate member wrapped in a ZIP32 container, one entry. The stream
+ * is raw deflate so the container's own CRC and sizes are the only integrity
+ * record; crc32 is folded in incrementally as lines are written, and the local
+ * header, central directory, and EOCD are assembled once at finish. The size
+ * budget is charged on the container, not the member, so the ~98 bytes of
+ * framing can never be what pushes an upload past the server's ceiling.
+ *
+ * Output format inside the entry — NDJSON, one JSON record per line:
  *   {"kind":"manifest","version":1,...}                    exactly one, first
  *   {"kind":"file","name":"logs/hq-sync.log",...}          one per file
  *   {"kind":"chunk","name":"logs/hq-sync.log","seq":0,...} many per file
  *   {"kind":"summary","fileCount":12,...}                  exactly one, last
  *
- * NDJSON rather than tar so there is no archive dependency, so a truncated
- * bundle is still parseable line-by-line up to the cut, and so the records
- * carry the same redaction metadata the inline blob already reports.
+ * NDJSON inside the entry rather than a tar of separate members, so a
+ * truncated bundle is still parseable line-by-line up to the cut, and so the
+ * records carry the same redaction metadata the inline blob already reports.
  */
 import { type LogCandidate } from "./feedback-logs.js";
 import { vaultApiFetch } from "./vault-api.js";
@@ -45,10 +61,17 @@ import { vaultApiFetch } from "./vault-api.js";
  * stay in step or the CLI will build bundles the server will not accept.
  */
 export declare const LOG_BUNDLE_MAX_BYTES: number;
+/**
+ * What the presign request declares, and what the server must answer with.
+ * Mirrors `LOG_BUNDLE_FORMAT_ZIP` / `LOG_BUNDLE_ZIP_CONTENT_TYPE` in the hq-pro
+ * handler `feedback-log-bundles.ts`.
+ */
+export declare const LOG_BUNDLE_FORMAT = "zip";
+export declare const LOG_BUNDLE_CONTENT_TYPE = "application/zip";
 /**
  * Headroom between the size we stop feeding at and the hard cap.
  *
- * gzip reports compressed bytes only as its internal buffer flushes, so the
+ * deflate reports compressed bytes only as its internal buffer flushes, so the
  * running total lags the bytes actually consumed. The lag is bounded by that
  * buffer (tens of KiB); a 1 MiB margin covers it with three orders of magnitude
  * to spare, and the final size is asserted against the real cap regardless.
@@ -62,9 +85,9 @@ export declare const LOG_BUNDLE_SAFETY_MARGIN_BYTES: number;
  */
 export declare const LOG_BUNDLE_MAX_FILE_RAW_BYTES: number;
 export interface LogBundleResult {
-    /** The gzipped NDJSON bytes, ready to PUT. */
-    gzip: Buffer;
-    /** `gzip.byteLength` — what the presign request must declare. */
+    /** The zipped NDJSON bytes, ready to PUT. */
+    bytes: Buffer;
+    /** `bytes.byteLength` — what the presign request must declare. */
     sizeBytes: number;
     /** How many files contributed at least one chunk. */
     fileCount: number;
@@ -95,6 +118,12 @@ export interface BuildLogBundleOptions {
     homeDir?: string;
     /** Override the per-file raw ceiling (tests). */
     maxFileRawBytes?: number;
+    /**
+     * Uncompressed ceiling for the zip entry. Clamped to what ZIP32 can describe,
+     * so a caller can lower this but never raise it past the format's limit.
+     * Exists so the ceiling is exercisable without a test that allocates 4 GiB.
+     */
+    maxEntryBytes?: number;
 }
 /**
  * Order candidates so that, when the cap truncates collection, what survives is
@@ -107,6 +136,27 @@ export interface BuildLogBundleOptions {
  * crowd out a stale claim in the inline collector.
  */
 export declare function orderBundleCandidates(hqDir: string): LogCandidate[];
+/**
+ * Name of the single entry inside the zip. The `.ndjson` extension is what
+ * tells a triager (and `jq`) what is inside once it is unzipped.
+ */
+export declare const LOG_BUNDLE_ENTRY_NAME = "hq-logs.ndjson";
+/** The line collection actually stops at. Never above what ZIP32 can describe. */
+export declare const ZIP32_UNCOMPRESSED_STOP_BYTES: number;
+/**
+ * Resolve the entry ceiling a caller asked for. A caller may lower it; nothing
+ * may raise it past what the container can describe, because a ceiling above
+ * the format's limit is not a ceiling at all.
+ */
+export declare function entryCeiling(requested?: number): number;
+export declare function crc32Fallback(buf: Buffer, seed?: number): number;
+/** Exported for the test that proves the fallback agrees with the native one. */
+export declare function crc32(buf: Buffer, seed?: number): number;
+/**
+ * Bytes of ZIP framing around one entry: local header, central directory
+ * header, end-of-central-directory. The name is stored twice.
+ */
+export declare function zipOverheadBytes(entryName: string): number;
 /**
  * Read `absPath` in slices, redacting whole lines, invoking `onChunk` with
  * roughly {@link CHUNK_TEXT_BYTES} of redacted text at a time.
@@ -120,7 +170,7 @@ export declare function streamRedactedFile(absPath: string, sizeBytes: number, m
     stopped: boolean;
 }>;
 /**
- * Build a gzipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
+ * Build a zipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
  *
  * Returns `undefined` when nothing eligible exists, so the caller can skip the
  * upload entirely. Never throws: a bug report must not fail over its own

package/dist/utils/feedback-log-bundle.js

@@ -6,7 +6,7 @@
  * body above 64 KiB, and `diagnostics` is written into a DynamoDB item, which
  * caps at 400 KB. Neither can be tuned into carrying a real log history, so the
  * inline blob is deliberately a ~40 KiB summary of 16 KiB tails. This module
- * produces the other half: a gzipped bundle uploaded direct to S3, carrying the
+ * produces the other half: a zipped bundle uploaded direct to S3, carrying the
  * files whole rather than in tail-sized slivers.
  *
  * Three properties are load-bearing and none may be traded away:
@@ -25,17 +25,33 @@
  *   3. BOUNDED MEMORY. 50 MB compressed is roughly a gigabyte of raw log text
  *      at the ratio these files compress at. Nothing is ever fully materialised:
  *      files are read in slices, redacted a line at a time, and streamed into
- *      gzip, with only the compressed output retained.
+ *      the deflate stream, with only the compressed output retained.
  *
- * Output format — gzipped NDJSON, one JSON record per line:
+ * WHY ZIP AND NOT GZIP. This bundle is attached to a Slack thread by the
+ * hq-pro feedback worker, and Slack's `files.completeUploadExternal` refuses a
+ * gzip member from this app at ANY size — a 52-byte gzip was rejected with
+ * `internal_error`, while the same bytes as zip were accepted. That was the
+ * root cause of roughly 110 consecutive silent attachment failures. The worker
+ * carries a gz-to-zip repack so older CLIs still get an attachable bundle;
+ * emitting zip here means the common path never pays for that unpack, and the
+ * archive is the format the destination actually accepts.
+ *
+ * A single deflate member wrapped in a ZIP32 container, one entry. The stream
+ * is raw deflate so the container's own CRC and sizes are the only integrity
+ * record; crc32 is folded in incrementally as lines are written, and the local
+ * header, central directory, and EOCD are assembled once at finish. The size
+ * budget is charged on the container, not the member, so the ~98 bytes of
+ * framing can never be what pushes an upload past the server's ceiling.
+ *
+ * Output format inside the entry — NDJSON, one JSON record per line:
  *   {"kind":"manifest","version":1,...}                    exactly one, first
  *   {"kind":"file","name":"logs/hq-sync.log",...}          one per file
  *   {"kind":"chunk","name":"logs/hq-sync.log","seq":0,...} many per file
  *   {"kind":"summary","fileCount":12,...}                  exactly one, last
  *
- * NDJSON rather than tar so there is no archive dependency, so a truncated
- * bundle is still parseable line-by-line up to the cut, and so the records
- * carry the same redaction metadata the inline blob already reports.
+ * NDJSON inside the entry rather than a tar of separate members, so a
+ * truncated bundle is still parseable line-by-line up to the cut, and so the
+ * records carry the same redaction metadata the inline blob already reports.
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -50,10 +66,17 @@ import { vaultApiFetch } from "./vault-api.js";
  * stay in step or the CLI will build bundles the server will not accept.
  */
 export const LOG_BUNDLE_MAX_BYTES = 50 * 1024 * 1024;
+/**
+ * What the presign request declares, and what the server must answer with.
+ * Mirrors `LOG_BUNDLE_FORMAT_ZIP` / `LOG_BUNDLE_ZIP_CONTENT_TYPE` in the hq-pro
+ * handler `feedback-log-bundles.ts`.
+ */
+export const LOG_BUNDLE_FORMAT = "zip";
+export const LOG_BUNDLE_CONTENT_TYPE = "application/zip";
 /**
  * Headroom between the size we stop feeding at and the hard cap.
  *
- * gzip reports compressed bytes only as its internal buffer flushes, so the
+ * deflate reports compressed bytes only as its internal buffer flushes, so the
  * running total lags the bytes actually consumed. The lag is bounded by that
  * buffer (tens of KiB); a 1 MiB margin covers it with three orders of magnitude
  * to spare, and the final size is asserted against the real cap regardless.
@@ -132,24 +155,171 @@ export function orderBundleCandidates(hqDir) {
     const logs = discoverLogFiles(hqDir).sort((a, b) => b.modifiedMs - a.modifiedMs || a.name.localeCompare(b.name));
     return [...state, ...logs];
 }
-function createGzipSink() {
-    const gzip = zlib.createGzip({ level: 9 });
+/**
+ * Name of the single entry inside the zip. The `.ndjson` extension is what
+ * tells a triager (and `jq`) what is inside once it is unzipped.
+ */
+export const LOG_BUNDLE_ENTRY_NAME = "hq-logs.ndjson";
+/**
+ * ZIP32 stores the uncompressed size in 32 bits, so a bundle whose contents
+ * exceed 4 GiB cannot be described by the container at all.
+ *
+ * The compressed cap does not prevent this. Log text compresses at roughly 24x
+ * in practice but there is no upper bound on the ratio — repetitive logs go
+ * far higher — and discovery admits an unbounded number of files at up to
+ * {@link LOG_BUNDLE_MAX_FILE_RAW_BYTES} each. Collection stops at the line
+ * below and reports `truncated`, which is what the caller already handles;
+ * without it `writeUInt32LE` throws at finish and the outer catch discards the
+ * whole bundle, so the installation with the most logs would send none.
+ */
+const ZIP32_MAX_UNCOMPRESSED_BYTES = 0xffffffff;
+/**
+ * Room left below the ZIP32 ceiling for the chunk in flight plus the closing
+ * summary record. A chunk is written whole before the budget is re-checked.
+ */
+const ZIP32_UNCOMPRESSED_MARGIN_BYTES = 1024 * 1024;
+/** The line collection actually stops at. Never above what ZIP32 can describe. */
+export const ZIP32_UNCOMPRESSED_STOP_BYTES = ZIP32_MAX_UNCOMPRESSED_BYTES - ZIP32_UNCOMPRESSED_MARGIN_BYTES;
+/**
+ * Resolve the entry ceiling a caller asked for. A caller may lower it; nothing
+ * may raise it past what the container can describe, because a ceiling above
+ * the format's limit is not a ceiling at all.
+ */
+export function entryCeiling(requested) {
+    if (requested === undefined || !Number.isFinite(requested)) {
+        return ZIP32_UNCOMPRESSED_STOP_BYTES;
+    }
+    return Math.max(0, Math.min(requested, ZIP32_UNCOMPRESSED_STOP_BYTES));
+}
+/**
+ * crc32 with a fallback, because `zlib.crc32` is newer than this package's
+ * floor: it landed in Node 22.2.0 and was backported only to 20.15.0, while
+ * `engines.node` is `>=20.0.0`. On Node 20.0-20.14 and 21.x the native call is
+ * undefined, the first sink write throws, and `buildLogBundle` catches it and
+ * returns undefined — every report on those runtimes silently loses its log
+ * bundle. The table is built once, on first use, and only when needed.
+ */
+let crcTable = null;
+export function crc32Fallback(buf, seed = 0) {
+    if (!crcTable) {
+        crcTable = new Uint32Array(256);
+        for (let i = 0; i < 256; i++) {
+            let c = i;
+            for (let k = 0; k < 8; k++)
+                c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+            crcTable[i] = c >>> 0;
+        }
+    }
+    let crc = ~seed >>> 0;
+    for (let i = 0; i < buf.length; i++) {
+        crc = (crcTable[(crc ^ buf[i]) & 0xff] ^ (crc >>> 8)) >>> 0;
+    }
+    return (~crc >>> 0) >>> 0;
+}
+/** Exported for the test that proves the fallback agrees with the native one. */
+export function crc32(buf, seed = 0) {
+    const native = zlib.crc32;
+    return typeof native === "function" ? native(buf, seed) : crc32Fallback(buf, seed);
+}
+/** Local file header, central directory header, and EOCD signatures. */
+const ZIP_LOCAL_SIG = 0x04034b50;
+const ZIP_CENTRAL_SIG = 0x02014b50;
+const ZIP_EOCD_SIG = 0x06054b50;
+/** Deflate, no data descriptor: sizes and CRC are known before a header is written. */
+const ZIP_METHOD_DEFLATE = 8;
+const ZIP_VERSION = 20;
+/**
+ * A fixed MS-DOS timestamp, so the same logs produce the same bytes.
+ *
+ * Deliberately not the wall clock: a bundle's timing lives in the manifest
+ * record, which is redacted content the recipient can read, rather than in
+ * archive metadata that no tool here surfaces. 0x0021 is 1980-01-01, the
+ * earliest the format can represent.
+ */
+const ZIP_DOS_TIME = 0;
+const ZIP_DOS_DATE = 0x0021;
+/**
+ * Bytes of ZIP framing around one entry: local header, central directory
+ * header, end-of-central-directory. The name is stored twice.
+ */
+export function zipOverheadBytes(entryName) {
+    return 30 + 46 + 22 + Buffer.byteLength(entryName, "utf8") * 2;
+}
+function createZipSink(entryName = LOG_BUNDLE_ENTRY_NAME, maxUncompressed = ZIP32_UNCOMPRESSED_STOP_BYTES) {
+    const name = Buffer.from(entryName, "utf8");
+    const deflate = zlib.createDeflateRaw({ level: 9 });
     const parts = [];
+    const overhead = zipOverheadBytes(entryName);
     let compressed = 0;
+    let uncompressed = 0;
+    let crc = 0;
     let failure = null;
-    gzip.on("data", (chunk) => {
+    deflate.on("data", (chunk) => {
         parts.push(chunk);
         compressed += chunk.byteLength;
     });
-    gzip.on("error", (err) => {
+    deflate.on("error", (err) => {
         failure = err;
     });
+    function container(body) {
+        const local = Buffer.alloc(30);
+        local.writeUInt32LE(ZIP_LOCAL_SIG, 0);
+        local.writeUInt16LE(ZIP_VERSION, 4);
+        local.writeUInt16LE(0, 6); // flags
+        local.writeUInt16LE(ZIP_METHOD_DEFLATE, 8);
+        local.writeUInt16LE(ZIP_DOS_TIME, 10);
+        local.writeUInt16LE(ZIP_DOS_DATE, 12);
+        local.writeUInt32LE(crc >>> 0, 14);
+        local.writeUInt32LE(body.byteLength, 18);
+        local.writeUInt32LE(uncompressed, 22);
+        local.writeUInt16LE(name.byteLength, 26);
+        local.writeUInt16LE(0, 28); // extra length
+        const central = Buffer.alloc(46);
+        central.writeUInt32LE(ZIP_CENTRAL_SIG, 0);
+        central.writeUInt16LE(ZIP_VERSION, 4); // version made by
+        central.writeUInt16LE(ZIP_VERSION, 6); // version needed
+        central.writeUInt16LE(0, 8); // flags
+        central.writeUInt16LE(ZIP_METHOD_DEFLATE, 10);
+        central.writeUInt16LE(ZIP_DOS_TIME, 12);
+        central.writeUInt16LE(ZIP_DOS_DATE, 14);
+        central.writeUInt32LE(crc >>> 0, 16);
+        central.writeUInt32LE(body.byteLength, 20);
+        central.writeUInt32LE(uncompressed, 24);
+        central.writeUInt16LE(name.byteLength, 28);
+        central.writeUInt16LE(0, 30); // extra
+        central.writeUInt16LE(0, 32); // comment
+        central.writeUInt16LE(0, 34); // disk number start
+        central.writeUInt16LE(0, 36); // internal attrs
+        central.writeUInt32LE(0, 38); // external attrs
+        central.writeUInt32LE(0, 42); // local header offset
+        const centralSize = central.byteLength + name.byteLength;
+        const centralOffset = local.byteLength + name.byteLength + body.byteLength;
+        const eocd = Buffer.alloc(22);
+        eocd.writeUInt32LE(ZIP_EOCD_SIG, 0);
+        eocd.writeUInt16LE(0, 4); // this disk
+        eocd.writeUInt16LE(0, 6); // disk with central dir
+        eocd.writeUInt16LE(1, 8); // entries on this disk
+        eocd.writeUInt16LE(1, 10); // entries total
+        eocd.writeUInt32LE(centralSize, 12);
+        eocd.writeUInt32LE(centralOffset, 16);
+        eocd.writeUInt16LE(0, 20); // comment length
+        return Buffer.concat([local, name, body, central, name, eocd]);
+    }
     return {
-        compressedBytes: () => compressed,
+        // The budget is charged on what will be PUT, framing included, so the
+        // container can never be what carries the upload over the server's cap.
+        compressedBytes: () => overhead + compressed,
+        atUncompressedLimit: () => uncompressed > maxUncompressed,
         write: (line) => new Promise((resolve, reject) => {
             if (failure)
                 return reject(failure);
-            gzip.write(line, "utf8", (err) => (err ? reject(err) : resolve()));
+            const buf = Buffer.from(line, "utf8");
+            // Folded in as we go: the whole point of this module is that the
+            // uncompressed text is never materialised, so there is nothing to
+            // checksum at the end.
+            crc = crc32(buf, crc);
+            uncompressed += buf.byteLength;
+            deflate.write(buf, (err) => (err ? reject(err) : resolve()));
         }),
         // Z_SYNC_FLUSH costs a handful of bytes per boundary and a little ratio.
         // That is the price of a budget that is enforced rather than estimated:
@@ -159,13 +329,13 @@ function createGzipSink() {
         sync: () => new Promise((resolve, reject) => {
             if (failure)
                 return reject(failure);
-            gzip.flush(zlib.constants.Z_SYNC_FLUSH, () => resolve());
+            deflate.flush(zlib.constants.Z_SYNC_FLUSH, () => resolve());
         }),
         finish: () => new Promise((resolve, reject) => {
-            gzip.on("end", () => (failure ? reject(failure) : resolve(Buffer.concat(parts))));
-            gzip.on("error", reject);
-            gzip.end();
-            gzip.resume();
+            deflate.on("end", () => failure ? reject(failure) : resolve(container(Buffer.concat(parts))));
+            deflate.on("error", reject);
+            deflate.end();
+            deflate.resume();
         }),
     };
 }
@@ -268,7 +438,7 @@ export async function streamRedactedFile(absPath, sizeBytes, maxRawBytes, chunkB
     }
 }
 /**
- * Build a gzipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
+ * Build a zipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
  *
  * Returns `undefined` when nothing eligible exists, so the caller can skip the
  * upload entirely. Never throws: a bug report must not fail over its own
@@ -294,7 +464,7 @@ export async function buildLogBundle(opts = {}) {
     if (candidates.length === 0)
         return undefined;
     try {
-        const sink = createGzipSink();
+        const sink = createZipSink(LOG_BUNDLE_ENTRY_NAME, entryCeiling(opts.maxEntryBytes));
         let fileCount = 0;
         let rawBytes = 0;
         let redactions = 0;
@@ -309,7 +479,7 @@ export async function buildLogBundle(opts = {}) {
         }));
         for (const candidate of candidates) {
             await sink.sync();
-            if (sink.compressedBytes() > stopAt) {
+            if (sink.compressedBytes() > stopAt || sink.atUncompressedLimit()) {
                 truncated = true;
                 break;
             }
@@ -334,7 +504,7 @@ export async function buildLogBundle(opts = {}) {
                     // Stop feeding once the compressed total reaches the stop line.
                     // The sync is what makes that total trustworthy.
                     await sink.sync();
-                    return sink.compressedBytes() <= stopAt;
+                    return sink.compressedBytes() <= stopAt && !sink.atUncompressedLimit();
                 });
                 stopped = result.stopped;
             }
@@ -349,18 +519,18 @@ export async function buildLogBundle(opts = {}) {
             }
         }
         await sink.write(record({ kind: "summary", fileCount, rawBytes, redactions, truncated }));
-        const gzip = await sink.finish();
+        const bytes = await sink.finish();
         // Nothing but a manifest and a summary is not worth uploading.
         if (fileCount === 0)
             return undefined;
         // Final authority. The stop line plus margin should make this unreachable,
         // but the server refuses to presign above the cap, so a bundle that
         // overshot is useless and must not be offered.
-        if (gzip.byteLength > maxBytes)
+        if (bytes.byteLength > maxBytes)
             return undefined;
         return {
-            gzip,
-            sizeBytes: gzip.byteLength,
+            bytes,
+            sizeBytes: bytes.byteLength,
             fileCount,
             truncated,
             rawBytes,
@@ -395,7 +565,10 @@ export async function uploadLogBundle(opts) {
             token: opts.token,
             path: "/v1/feedback/logs/presign",
             method: "POST",
-            body: { sizeBytes: bundle.sizeBytes },
+            // The server owns the key and the signed content type, so it has to be
+            // told which format is coming; without this it mints a `.ndjson.gz` slot
+            // signed `application/gzip` and the PUT would be a lie on both counts.
+            body: { sizeBytes: bundle.sizeBytes, format: LOG_BUNDLE_FORMAT },
         });
         if (!res.ok)
             return undefined;
@@ -404,15 +577,22 @@ export async function uploadLogBundle(opts) {
         if (!slot || typeof slot.key !== "string" || typeof slot.url !== "string") {
             return undefined;
         }
+        // A server too old to know about `format` answers with a gzip slot. Its
+        // signature binds `application/gzip` and its key claims `.gz`, and these
+        // bytes are neither. Skipping is the honest outcome and costs only the
+        // bundle — the submission still carries the inline logs, which is exactly
+        // what happens when bundles are disabled entirely.
+        if (slot.contentType !== LOG_BUNDLE_CONTENT_TYPE)
+            return undefined;
         const doFetch = opts.fetchImpl ?? fetch;
         const put = await doFetch(slot.url, {
             method: "PUT",
             headers: {
-                "Content-Type": typeof slot.contentType === "string" ? slot.contentType : "application/gzip",
+                "Content-Type": slot.contentType,
                 // Must match the length bound into the signature, or S3 rejects it.
                 "Content-Length": String(bundle.sizeBytes),
             },
-            body: new Uint8Array(bundle.gzip),
+            body: new Uint8Array(bundle.bytes),
         });
         if (!put.ok)
             return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.113.0",
+  "version": "5.114.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {