@indigoai-us/hq-cli 5.113.1 → 5.115.0

package/dist/lib/bot/run.js

@@ -5,7 +5,7 @@
  * - refuses to start unless the creds file names this bot's agt_ AND the
  *   server-side record is owned by the configured owner
  * - heartbeat every 30s (POST /v1/agents/{uid}/heartbeat, agent JWT)
- * - inbox poll every 5s: owner DMs go to ONE headless model turn (resumed by
+ * - inbox poll every 2s: owner DMs go to ONE headless model turn (resumed by
  *   session id); the reply is sent as the bot; the message is acked only after
  *   the reply is sent; processed ids persist so a crash between reply and ack
  *   never answers twice
@@ -16,12 +16,21 @@
  * - room items (channels / group chats): answered when the bot is @mentioned,
  *   or when the owner posts in a small group (see room-policy.ts); claimed
  *   first (first-claim-wins), one session per room, reply posted in the room
+ * - conversations run side by side: up to MAX_PARALLEL_TURNS turns at once,
+ *   one lane per model session (the owner DM session, or one room). Messages
+ *   in the same lane run in order, so a session is never resumed by two turns
+ *   at once and a thread's answers never arrive out of sequence.
  * - while a turn runs, each finished assistant message is posted as its own
  *   message (progress.ts); turns have no time limit
  * - every received message gets a reply: a turn that fails after the model
  *   started (error, crash, owner stop, restart) posts one "did not finish"
  *   message and is NOT run again — it may already have done outward things.
  *   inflight.json marks the turn in progress so a restart can say so.
+ * - a turn that fails because the coding tool's sign-in no longer works
+ *   (runtime-sign-in.ts) is not a failure of the message: the bot says once
+ *   per conversation that it needs a sign-in, keeps the message un-acked,
+ *   holds new turns, and tries again every SIGN_IN_RETRY_MS (and at once
+ *   after a restart). A turn that works clears it.
  * - failures before the model starts (missing binary) retry with backoff;
  *   5 model failures in 10 minutes → state `failed` and a clean exit (launchd
  *   does not respawn a clean exit). Owner stops never count.
@@ -35,17 +44,19 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fullJitterDelayMs } from "../mesh/live/backoff.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock } from "../mesh/live/daemon/pid-lock.js";
-import { patchBotConfig, readBotConfig } from "./config.js";
+import { effectiveBotCompanies, effectiveBotKind, patchBotConfig, readBotConfig, SETUP_BOT_WORKER_ID } from "./config.js";
 import { ensureBotSessionMeta } from "./company-bind.js";
 import { readBotCredsIdentity } from "./creds.js";
 import { isProcessed, markProcessed, readInboxState } from "./inbox-state.js";
-import { clearInflight, patchInflight, readInflight, writeInflight } from "./inflight.js";
+import { clearInflight, patchInflight, readInflight, readInflightTurns, writeInflight } from "./inflight.js";
 import { ProgressPoster } from "./progress.js";
 import { createBotLogger } from "./log.js";
 import { buildSystemPrompt, introDmText, nonOwnerRefusalText, readPromptSources } from "./prompt.js";
 import { FALLBACK_CLAUDE_PERMISSION_MODE, isClaudeBypassDisabled } from "./runtime/claude.js";
 import { runRuntimeTurn, RuntimeError } from "./runtime/index.js";
 import { isDmItem, resolveReplyTarget } from "./room-policy.js";
+import { isRuntimeSignInFailure, SIGN_IN_RETRY_MS, signInNeededText } from "./runtime-sign-in.js";
+import { HQ_BOT_AGENT_UID_ENV } from "../../commands/onboard-bot-membership.js";
 import { clearBotSession, readBotSession, writeBotSession } from "./session.js";
 import { defaultBotStatus, patchBotStatus, readBotStatus } from "./status.js";
 export const INBOX_POLL_INTERVAL_MS = 2_000;
@@ -57,9 +68,41 @@ export const THINKING_EMOJI = "👀";
 export const ROOM_THINKING_STATUS = "is thinking…";
 export const RECENT_MESSAGES_LIMIT = 15;
 export const RECENT_MESSAGE_MAX_CHARS = 400;
+/** Model turns a bot runs at once (each on a different conversation). */
+export const MAX_PARALLEL_TURNS = 2;
 export const KICKOFF_MESSAGE_ID = "kickoff";
+/**
+ * The environment a model turn's `hq` commands run in.
+ *
+ * The bot process carries its own machine identity in HQ_MACHINE_CREDS_FILE /
+ * HQ_MACHINE_TOKEN_STATE_DIR so its inbox, heartbeat and posts are the bot's.
+ * What a turn inherits depends on the bot's kind:
+ * - A PERSONAL bot acts as its owner on every turn (DMs, the kickoff, rooms):
+ *   everything the owner asks for — a company, a bot, an invite, a share —
+ *   belongs to the owner's account, and the cloud rightly refuses a bot that
+ *   tries to own it ("No person entity found"). Stripping the marker makes
+ *   every `hq` command in the turn use the owner's sign-in, the same one the
+ *   desktop app shares, so no command needs a special case. The bot's id
+ *   (never a credential) rides along in HQ_BOT_AGENT_UID so what the owner
+ *   creates in the turn — a company — can add the bot as a member afterwards.
+ * - A COMPANY bot acts as itself on every turn, like a cloud agent: the
+ *   machine identity stays, and the cloud evaluates it through its own
+ *   company memberships. It never acts as the owner, in DMs or in rooms.
+ * Pure so the rule is unit-testable.
+ */
+export function turnEnv(base, kind, agentUid) {
+    const env = { ...base };
+    delete env[HQ_BOT_AGENT_UID_ENV];
+    if (kind === "personal") {
+        delete env.HQ_MACHINE_CREDS_FILE;
+        delete env.HQ_MACHINE_TOKEN_STATE_DIR;
+        if (agentUid)
+            env[HQ_BOT_AGENT_UID_ENV] = agentUid;
+    }
+    return env;
+}
 /** The core worker HQ's setup bot runs. */
-export const SETUP_WORKER_ID = "setup";
+export const SETUP_WORKER_ID = SETUP_BOT_WORKER_ID;
 /** The one message a person gets when a turn on their message did not finish. */
 export function didNotFinishText(reason, progressPosted) {
     const r = reason.trim().replace(/[.\s]+$/, "");
@@ -68,6 +111,17 @@ export function didNotFinishText(reason, progressPosted) {
 /** Owner stop, `hq bot stop` or `hq bot restart`: all arrive as the same signal. */
 export const STOPPED_BY_OWNER_REASON = "I was stopped before I was done";
 export const RESTARTED_REASON = "I was restarted while I was working on it";
+/**
+ * The lane an inbox item runs in: the model session its turn resumes. Owner
+ * DMs share the DM session; each room has its own. An item that never reaches
+ * a model turn (refusal, not addressed to the bot) gets a lane of its own.
+ */
+export function inboxLaneKey(item, config) {
+    if (isDmItem(item))
+        return "dm";
+    const target = resolveReplyTarget(item, config);
+    return target?.kind === "room" ? target.sessionScope : `item:${item.messageId}`;
+}
 class FailureWindow {
     windowMs;
     limit;
@@ -117,8 +171,9 @@ export async function runBot(deps) {
     const setStatus = (patch) => patchBotStatus(dir, patch, fallback, now);
     let state = "starting";
     let stopping = false;
-    /** Aborts the model turn in progress (owner stop). */
-    let currentTurn = null;
+    /** Aborts the model turns in progress (owner stop). */
+    const currentTurns = new Set();
+    const maxParallelTurns = Math.max(1, deps.maxParallelTurns ?? MAX_PARALLEL_TURNS);
     let resolveDone;
     const done = new Promise((r) => (resolveDone = r));
     // Only override isProcessAlive when a caller injected one: spreading an
@@ -130,6 +185,9 @@ export async function runBot(deps) {
     const turnCwd = config.hqRoot;
     // HQ's setup bot is a guided conversation: no "working on it" filler between steps.
     const isSetupBot = config.workerId === SETUP_WORKER_ID;
+    // Personal: every turn acts as the owner. Company: every turn acts as the bot.
+    const kind = effectiveBotKind(config);
+    const companies = effectiveBotCompanies(config);
     const lockDeps = defaultPidLockDeps({
         pid,
         ...(deps.isProcessAlive ? { isProcessAlive: deps.isProcessAlive } : {}),
@@ -152,14 +210,14 @@ export async function runBot(deps) {
         log("error", credsProblem);
         resolveDone("failed");
         exit(0);
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     if (config.enabled === false) {
         setStatus({ state: "stopped", pid });
         log("info", "bot is disabled (hq bot start to enable)");
         resolveDone("stopped");
         exit(0);
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     if (!deps.skipPidLock) {
         const lock = acquirePidLock(dir, lockDeps);
@@ -168,32 +226,33 @@ export async function runBot(deps) {
             log("warn", msg);
             resolveDone("stopped");
             exit(0);
-            return { stop: async () => { }, done, status: () => null };
+            return { stop: async () => { }, done, status: () => null, idle: () => true };
         }
     }
     if (hasPromotionHold(dir)) {
         await finish("stopped", 0, "local bot held for cloud promotion");
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
-    setStatus({ ...fallback(), pid, state: "starting", canDrainForPromotion: false });
-    log("info", `starting ${config.name} (${config.runtime}) as ${config.agentUid} for ${config.ownerUid}`);
+    // A restart is the owner's "try again" after signing in: start clean.
+    setStatus({ ...fallback(), pid, state: "starting", canDrainForPromotion: false, runtimeSignIn: null });
+    log("info", `starting ${config.name} (${config.runtime}, ${kind} bot${companies.length ? ` of ${companies.join(", ")}` : ""}) as ${config.agentUid} for ${config.ownerUid}`);
     try {
         const record = await api.getAgent(config.agentUid);
         // Promotion keeps the identity and owner. Ownership alone must not let
         // an old local installation start consuming the cloud bot's inbox.
-        if (record.uid !== config.agentUid || record.computeMode !== "local" || record.botKind !== "personal") {
-            await finish("failed", 0, `identity ${config.agentUid} is not a personal local bot; this installation cannot run it`);
-            return { stop: async () => { }, done, status: () => null };
+        if (record.uid !== config.agentUid || record.computeMode !== "local" || record.botKind !== kind) {
+            await finish("failed", 0, `identity ${config.agentUid} is not a ${kind} local bot; this installation cannot run it`);
+            return { stop: async () => { }, done, status: () => null, idle: () => true };
         }
         const owner = record.ownerUid ?? null;
         if (owner !== config.ownerUid) {
             await finish("failed", 0, `identity ${config.agentUid} is owned by ${owner ?? "nobody"}, not ${config.ownerUid}`);
-            return { stop: async () => { }, done, status: () => null };
+            return { stop: async () => { }, done, status: () => null, idle: () => true };
         }
     }
     catch (err) {
         await finish("failed", 0, `could not verify bot identity: ${err instanceof Error ? err.message : String(err)}`);
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     // ── System prompt ──────────────────────────────────────────────────────────
     const systemPrompt = deps.systemPromptOverride ??
@@ -206,6 +265,8 @@ export async function runBot(deps) {
             workerSource: config.workerSource,
             workerId: config.workerId,
             companySlug: config.companySlug,
+            kind,
+            companies,
             memoryDir: config.memoryDir,
             sources: readPromptSources(config.hqRoot, config.workerDir, undefined, {
                 memoryDir: config.memoryDir,
@@ -218,20 +279,24 @@ export async function runBot(deps) {
     fs.writeFileSync(systemPromptFile, systemPrompt, { mode: 0o600 });
     if (hasPromotionHold(dir)) {
         await finish("stopped", 0, "local bot held for cloud promotion");
-        return { stop: async () => { }, done, status: () => null };
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     state = "running";
     setStatus({ state: "running", lastActivityAt: now().toISOString() });
     log("info", "running");
     // Read before the kickoff can write its own marker: whatever is here now was
     // left by a previous run that was cut off mid-turn.
-    const leftover = readInflight(dir);
+    const leftovers = readInflightTurns(dir);
     // ── Intro DM (once) ────────────────────────────────────────────────────────
     // The kickoff turn is tied to the intro: it runs only in the start that sent
     // the intro, so introSentAt (persisted before the turn) guarantees it never
     // runs again on a restart.
     let kickoffAfterIntro = null;
-    if (!config.introSentAt) {
+    if (config.introSentAt && config.kickoffPendingSignIn && config.kickoff?.trim()) {
+        // The kickoff was held for a sign-in on an earlier run; this start retries it.
+        kickoffAfterIntro = {};
+    }
+    else if (!config.introSentAt) {
         try {
             const sent = await api.sendDm({ toPersonUid: config.ownerUid, body: introDmText(config.name, config.runtime, config.intro) });
             patchBotConfig(dir, { introSentAt: now().toISOString() });
@@ -246,6 +311,41 @@ export async function runBot(deps) {
     // ── Heartbeat loop ─────────────────────────────────────────────────────────
     const failures = new FailureWindow(FAILURE_WINDOW_MS, FAILURE_LIMIT);
     let modelHealth = "ok";
+    // ── Coding tool sign-in ────────────────────────────────────────────────────
+    const signInRetryMs = Math.max(0, deps.signInRetryMs ?? SIGN_IN_RETRY_MS);
+    let signInIssue = null;
+    let nextSignInRetryAt = 0;
+    /** Conversations already told this time that the bot needs a sign-in. */
+    const toldAboutSignIn = new Set();
+    const markSignInBroken = (excerpt) => {
+        nextSignInRetryAt = now().getTime() + signInRetryMs;
+        modelHealth = "degraded";
+        if (signInIssue)
+            return;
+        signInIssue = { state: "expired", runtime: config.runtime, since: now().toISOString() };
+        setStatus({ runtimeSignIn: signInIssue, lastError: excerpt.slice(0, 400) });
+        log("warn", `${runtime.id} needs to sign in again on this computer; holding turns and retrying every ${Math.round(signInRetryMs / 1000)}s`);
+    };
+    const markSignInWorks = () => {
+        if (!signInIssue)
+            return;
+        signInIssue = null;
+        toldAboutSignIn.clear();
+        setStatus({ runtimeSignIn: null });
+        log("info", `${runtime.id} sign-in works again; resuming`);
+    };
+    /** Say once per conversation that the bot cannot work until its tool signs in. */
+    const tellSignInNeeded = async (conversation, post, kickoff = false) => {
+        if (toldAboutSignIn.has(conversation))
+            return;
+        try {
+            await post(signInNeededText(config.runtime, kickoff));
+            toldAboutSignIn.add(conversation);
+        }
+        catch (err) {
+            log("warn", `could not say that ${runtime.id} needs a sign-in: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    };
     const heartbeatLoop = (async () => {
         while (!stopping && state === "running") {
             try {
@@ -296,20 +396,22 @@ export async function runBot(deps) {
         // resets). Claude gets the full hook set via its payload session id;
         // Codex/Grok only see HQ_SESSION_ID.
         const sid = session?.sessionId ?? randomUUID();
-        let bind = {};
+        const env = turnEnv(process.env, kind, config.agentUid);
+        let bind = { env };
         if (config.companySlug) {
             try {
                 ensureBotSessionMeta(config.hqRoot, sid, config.companySlug, undefined, now);
-                bind = { newSessionId: sid, env: { ...process.env, HQ_SESSION_ID: sid } };
+                bind = { newSessionId: sid, env: { ...env, HQ_SESSION_ID: sid } };
             }
             catch (err) {
                 log("warn", `company bind failed for ${config.companySlug}: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
-        // Only the owner's own DM session (DMs and the kickoff). Room prompts must
-        // keep their [#channel …] header first, and a room turn can be triggered
-        // by other people, who must not be handed the owner's companies.
-        if (deps.ownerContext && sessionScope === "dm") {
+        // Only a personal bot, and only in the owner's own DM session (DMs and the
+        // kickoff). Room prompts must keep their [#channel …] header first, and a
+        // room turn can be triggered by other people, who must not be handed the
+        // owner's companies. A company bot acts as itself and never gets it.
+        if (deps.ownerContext && sessionScope === "dm" && kind === "personal") {
             try {
                 const owner = await deps.ownerContext();
                 if (owner.status === "unavailable") {
@@ -366,6 +468,7 @@ export async function runBot(deps) {
             }
         }
         modelHealth = "ok";
+        markSignInWorks();
         log("info", `model turn done in ${Math.round((now().getTime() - tTurnStart) / 1000)}s (${Math.round((tTurnStart - tReceived) / 1000)}s before it)`);
         if (turn.sessionId) {
             writeBotSession(dir, {
@@ -419,7 +522,7 @@ export async function runBot(deps) {
             },
         });
         const controller = new AbortController();
-        currentTurn = controller;
+        currentTurns.add(controller);
         poster.start();
         try {
             const turn = await executeTurn(args.prompt, args.sessionScope, args.tReceived, {
@@ -442,8 +545,7 @@ export async function runBot(deps) {
             return { outcome: { ok: false, started, aborted, excerpt, error: err }, poster };
         }
         finally {
-            if (currentTurn === controller)
-                currentTurn = null;
+            currentTurns.delete(controller);
         }
     };
     const failureReason = (outcome) => outcome.aborted ? STOPPED_BY_OWNER_REASON : `${runtime.id} stopped with an error: ${outcome.excerpt.slice(0, 160)}`;
@@ -526,11 +628,23 @@ export async function runBot(deps) {
                 return;
             }
             clearInflight(dir, KICKOFF_MESSAGE_ID);
+            if (readBotConfig(dir)?.kickoffPendingSignIn)
+                patchBotConfig(dir, { kickoffPendingSignIn: false });
             const st = readStatus();
             setStatus({ repliesSent: (st?.repliesSent ?? 0) + 1, lastActivityAt: now().toISOString() });
             log("info", `kickoff reply sent (${outcome.reply.length} chars)`);
             return;
         }
+        if (!outcome.aborted && poster.postedCount === 0 && isRuntimeSignInFailure(outcome.excerpt)) {
+            // Nothing ran: hold the kickoff until the tool can sign in, then run it.
+            clearInflight(dir, KICKOFF_MESSAGE_ID);
+            patchBotConfig(dir, { kickoffPendingSignIn: true });
+            markSignInBroken(outcome.excerpt);
+            await tellSignInNeeded("dm", (body) => api.sendDm({ toPersonUid: peerUid, body }), true);
+            return;
+        }
+        if (readBotConfig(dir)?.kickoffPendingSignIn)
+            patchBotConfig(dir, { kickoffPendingSignIn: false });
         let count = 0;
         if (!outcome.aborted)
             count = recordTurnFailure(outcome.error, "dm").count;
@@ -561,8 +675,8 @@ export async function runBot(deps) {
         }
         // A turn on this message already started once and was cut off: say so,
         // never run it again.
-        const inflight = readInflight(dir);
-        if (inflight?.messageId === id) {
+        const inflight = readInflight(dir, id);
+        if (inflight) {
             await recoverInflight(inflight);
             return;
         }
@@ -572,7 +686,7 @@ export async function runBot(deps) {
             // 404 on the server by design), then ack so it never comes back.
             try {
                 if (sender)
-                    await api.sendDm({ toPersonUid: sender, body: nonOwnerRefusalText(config.name) });
+                    await api.sendDm({ toPersonUid: sender, body: nonOwnerRefusalText(config.name, kind) });
             }
             catch {
                 /* refusal delivery is best-effort */
@@ -670,6 +784,17 @@ export async function runBot(deps) {
             return;
         }
         await clearThinking();
+        if (!outcome.aborted && poster.postedCount === 0 && isRuntimeSignInFailure(outcome.excerpt)) {
+            // The tool refused before doing anything: keep the message for when it
+            // can sign in again, and say so once in this conversation.
+            clearInflight(dir, id);
+            attempts.delete(id);
+            markSignInBroken(outcome.excerpt);
+            const conversation = markerTarget.kind === "dm" ? "dm" : `room:${markerTarget.channelId}:${item.rootEventId ?? ""}`;
+            await tellSignInNeeded(conversation, send);
+            log("warn", `kept ${id} until ${runtime.id} can sign in again`);
+            return; // un-acked: answered once the sign-in works
+        }
         if (!outcome.started) {
             // The model never ran (e.g. the binary is missing): nothing happened
             // outside this Mac, so retrying is safe.
@@ -721,9 +846,59 @@ export async function runBot(deps) {
             log("error", `kickoff turn crashed: ${err instanceof Error ? err.message : String(err)}`);
         })
         : Promise.resolve();
+    // ── Lanes: conversations side by side, each conversation in order ─────────
+    /** Messages waiting per lane, in arrival order. */
+    const lanes = new Map();
+    /** Lanes with a message being handled right now. */
+    const busyLanes = new Set();
+    /** Every message queued or being handled (the inbox re-delivers until acked). */
+    const pending = new Set();
+    const running = new Set();
+    const canStart = () => !stopping && state === "running" && !hasPromotionHold(dir);
+    const pump = () => {
+        for (const [lane, queue] of lanes) {
+            if (busyLanes.size >= maxParallelTurns || !canStart())
+                return;
+            // While the sign-in is broken, one message at a time tries it, on a timer.
+            if (signInIssue && (busyLanes.size > 0 || now().getTime() < nextSignInRetryAt))
+                return;
+            if (busyLanes.has(lane))
+                continue;
+            const item = queue.shift();
+            if (queue.length === 0)
+                lanes.delete(lane);
+            if (!item)
+                continue;
+            busyLanes.add(lane);
+            if (signInIssue)
+                nextSignInRetryAt = now().getTime() + signInRetryMs;
+            const task = handleItem(item)
+                .catch((err) => {
+                log("warn", `inbox item ${item.messageId} failed: ${err instanceof Error ? err.message : String(err)}`);
+            })
+                .finally(() => {
+                busyLanes.delete(lane);
+                pending.delete(item.messageId);
+                running.delete(task);
+                pump();
+            });
+            running.add(task);
+        }
+    };
+    const enqueue = (item) => {
+        if (pending.has(item.messageId))
+            return;
+        pending.add(item.messageId);
+        const lane = inboxLaneKey(item, config);
+        const queue = lanes.get(lane);
+        if (queue)
+            queue.push(item);
+        else
+            lanes.set(lane, [item]);
+    };
     const inboxLoop = (async () => {
-        // A turn cut off by the last restart is reported before anything new runs.
-        if (leftover) {
+        // Turns cut off by the last restart are reported before anything new runs.
+        for (const leftover of leftovers) {
             try {
                 await recoverInflight(leftover);
             }
@@ -735,19 +910,22 @@ export async function runBot(deps) {
         while (!stopping && state === "running") {
             if (hasPromotionHold(dir))
                 break;
+            // A kickoff held for a sign-in retries on the same timer as messages.
+            if (busyLanes.size === 0 &&
+                (!signInIssue || now().getTime() >= nextSignInRetryAt) &&
+                readBotConfig(dir)?.kickoffPendingSignIn) {
+                if (signInIssue)
+                    nextSignInRetryAt = now().getTime() + signInRetryMs;
+                await runKickoff().catch((err) => {
+                    log("error", `kickoff retry crashed: ${err instanceof Error ? err.message : String(err)}`);
+                });
+            }
             try {
                 const items = await api.pullInbox(config.agentUid);
                 setStatus({ lastInboxPollAt: now().toISOString() });
-                for (const item of items) {
-                    if (stopping || state !== "running" || hasPromotionHold(dir))
-                        break;
-                    try {
-                        await handleItem(item);
-                    }
-                    catch (err) {
-                        log("warn", `inbox item ${item.messageId} failed: ${err instanceof Error ? err.message : String(err)}`);
-                    }
-                }
+                for (const item of items)
+                    enqueue(item);
+                pump();
             }
             catch (err) {
                 log("warn", `inbox poll failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -756,6 +934,10 @@ export async function runBot(deps) {
                 break;
             await sleep(inboxIntervalMs);
         }
+        // Stop, drain and promotion wait for the turns already running. Queued
+        // messages were never started or acked, so the inbox delivers them again.
+        while (running.size > 0)
+            await Promise.allSettled([...running]);
     })();
     function readStatus() {
         return readBotStatus(dir);
@@ -763,7 +945,8 @@ export async function runBot(deps) {
     const stop = async (mode = "abort") => {
         if (stopping) {
             if (mode === "abort")
-                currentTurn?.abort();
+                for (const turn of currentTurns)
+                    turn.abort();
             return;
         }
         stopping = true;
@@ -771,7 +954,8 @@ export async function runBot(deps) {
         // Promotion instead drains that turn, including its reply and ACK, before
         // the coordinator snapshots memory and starts the cloud consumer.
         if (mode === "abort")
-            currentTurn?.abort();
+            for (const turn of currentTurns)
+                turn.abort();
         await Promise.allSettled([heartbeatLoop, inboxLoop]);
         await finish("stopped", 0, mode === "drain" ? "promotion drain completed" : "stop requested");
     };
@@ -789,6 +973,6 @@ export async function runBot(deps) {
         if (state === "running")
             void finish("stopped", 0, "loops ended");
     });
-    return { stop, done, status: readStatus };
+    return { stop, done, status: readStatus, idle: () => pending.size === 0 };
 }
 //# sourceMappingURL=run.js.map

package/dist/lib/bot/runtime-sign-in.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The bot's coding tool (Claude Code, Codex, Grok) is installed but its login
+ * no longer works: never signed in, expired, or revoked. The vendor CLI can
+ * still report itself as logged in (a saved but dead token), so the only
+ * reliable evidence is a turn that fails this way.
+ *
+ * Such a turn fails before the model does anything, so the message is safe to
+ * answer later. The bot says once that it needs a sign-in, keeps the message,
+ * and tries again on its own (and at once after `hq bot restart`).
+ */
+import type { BotRuntimeId } from "./config.js";
+/** Time between the bot's own retries while its sign-in is broken. */
+export declare const SIGN_IN_RETRY_MS = 60000;
+export declare function isRuntimeSignInFailure(text: string | undefined | null): boolean;
+export declare function runtimeDisplayName(runtime: BotRuntimeId | string): string;
+/** Reported in status.json and `hq bot list --json` while the sign-in is broken. */
+export interface RuntimeSignInIssue {
+    state: "expired";
+    runtime: BotRuntimeId;
+    since: string;
+}
+/** The one message a conversation gets when the bot cannot work until its tool signs in again. */
+export declare function signInNeededText(runtime: BotRuntimeId | string, kickoff?: boolean): string;
+//# sourceMappingURL=runtime-sign-in.d.ts.map

package/dist/lib/bot/runtime-sign-in.js

@@ -0,0 +1,31 @@
+/**
+ * The bot's coding tool (Claude Code, Codex, Grok) is installed but its login
+ * no longer works: never signed in, expired, or revoked. The vendor CLI can
+ * still report itself as logged in (a saved but dead token), so the only
+ * reliable evidence is a turn that fails this way.
+ *
+ * Such a turn fails before the model does anything, so the message is safe to
+ * answer later. The bot says once that it needs a sign-in, keeps the message,
+ * and tries again on its own (and at once after `hq bot restart`).
+ */
+/** Time between the bot's own retries while its sign-in is broken. */
+export const SIGN_IN_RETRY_MS = 60_000;
+const SIGN_IN_FAILURE = /failed to authenticate|authentication[_ ]failed|not logged in|not signed in|please (?:run \/login|log ?in|sign ?in)|(?:oauth|access|refresh) token (?:has been |was )?(?:expired|revoked|invalid)|oauth session expired|invalid api key|\b401\b|unauthori[sz]ed|login (?:required|expired)|sign-?in (?:required|expired)/i;
+/** Usage and rate limits are a different problem; a new sign-in does not fix them. */
+const NOT_SIGN_IN = /usage[_ ]limit|rate[_ ]limit|quota|too many requests|credits/i;
+export function isRuntimeSignInFailure(text) {
+    const t = (text ?? "").trim();
+    if (!t)
+        return false;
+    return SIGN_IN_FAILURE.test(t) && !NOT_SIGN_IN.test(t);
+}
+export function runtimeDisplayName(runtime) {
+    return runtime === "claude" ? "Claude Code" : runtime === "codex" ? "Codex" : runtime === "grok" ? "Grok" : runtime;
+}
+/** The one message a conversation gets when the bot cannot work until its tool signs in again. */
+export function signInNeededText(runtime, kickoff = false) {
+    const tool = runtimeDisplayName(runtime);
+    return (`I can't work right now: ${tool} needs you to sign in again on this computer. ` +
+        `Use "Sign in to ${tool}" in HQ, and I'll ${kickoff ? "get started" : "answer this"} as soon as it works again — no need to send it twice.`);
+}
+//# sourceMappingURL=runtime-sign-in.js.map

package/dist/lib/bot/status.d.ts

@@ -2,6 +2,7 @@
  * status.json — atomic, metadata-only runtime status (local-bots US-003).
  */
 import type { BotRuntimeId } from "./config.js";
+import type { RuntimeSignInIssue } from "./runtime-sign-in.js";
 export type BotState = "starting" | "running" | "stopped" | "failed";
 export interface BotStatusFile {
     v: 1;
@@ -29,6 +30,11 @@ export interface BotStatusFile {
      * Persisted so later turns skip the failed attempt.
      */
     claudePermissionMode?: string;
+    /**
+     * Set while the coding tool's sign-in is broken (a turn failed for that
+     * reason); cleared by the next turn that works. `null` = known to work.
+     */
+    runtimeSignIn?: RuntimeSignInIssue | null;
     updatedAt: string;
 }
 export declare function defaultBotStatus(pid: number, runtime: BotRuntimeId, now?: () => Date): BotStatusFile;