@indigoai-us/hq-cli 5.114.0 → 5.115.1

package/dist/lib/bot/run.js

@@ -26,6 +26,11 @@
  *   started (error, crash, owner stop, restart) posts one "did not finish"
  *   message and is NOT run again — it may already have done outward things.
  *   inflight.json marks the turn in progress so a restart can say so.
+ * - a turn that fails because the coding tool's sign-in no longer works
+ *   (runtime-sign-in.ts) is not a failure of the message: the bot says once
+ *   per conversation that it needs a sign-in, keeps the message un-acked,
+ *   holds new turns, and tries again every SIGN_IN_RETRY_MS (and at once
+ *   after a restart). A turn that works clears it.
  * - failures before the model starts (missing binary) retry with backoff;
  *   5 model failures in 10 minutes → state `failed` and a clean exit (launchd
  *   does not respawn a clean exit). Owner stops never count.
@@ -39,7 +44,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fullJitterDelayMs } from "../mesh/live/backoff.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock } from "../mesh/live/daemon/pid-lock.js";
-import { patchBotConfig, readBotConfig } from "./config.js";
+import { effectiveBotCompanies, effectiveBotKind, patchBotConfig, readBotConfig, SETUP_BOT_WORKER_ID } from "./config.js";
 import { ensureBotSessionMeta } from "./company-bind.js";
 import { readBotCredsIdentity } from "./creds.js";
 import { isProcessed, markProcessed, readInboxState } from "./inbox-state.js";
@@ -50,6 +55,8 @@ import { buildSystemPrompt, introDmText, nonOwnerRefusalText, readPromptSources
 import { FALLBACK_CLAUDE_PERMISSION_MODE, isClaudeBypassDisabled } from "./runtime/claude.js";
 import { runRuntimeTurn, RuntimeError } from "./runtime/index.js";
 import { isDmItem, resolveReplyTarget } from "./room-policy.js";
+import { isRuntimeSignInFailure, SIGN_IN_RETRY_MS, signInNeededText } from "./runtime-sign-in.js";
+import { HQ_BOT_AGENT_UID_ENV } from "../../commands/onboard-bot-membership.js";
 import { clearBotSession, readBotSession, writeBotSession } from "./session.js";
 import { defaultBotStatus, patchBotStatus, readBotStatus } from "./status.js";
 export const INBOX_POLL_INTERVAL_MS = 2_000;
@@ -64,8 +71,38 @@ export const RECENT_MESSAGE_MAX_CHARS = 400;
 /** Model turns a bot runs at once (each on a different conversation). */
 export const MAX_PARALLEL_TURNS = 2;
 export const KICKOFF_MESSAGE_ID = "kickoff";
+/**
+ * The environment a model turn's `hq` commands run in.
+ *
+ * The bot process carries its own machine identity in HQ_MACHINE_CREDS_FILE /
+ * HQ_MACHINE_TOKEN_STATE_DIR so its inbox, heartbeat and posts are the bot's.
+ * What a turn inherits depends on the bot's kind:
+ * - A PERSONAL bot acts as its owner on every turn (DMs, the kickoff, rooms):
+ *   everything the owner asks for — a company, a bot, an invite, a share —
+ *   belongs to the owner's account, and the cloud rightly refuses a bot that
+ *   tries to own it ("No person entity found"). Stripping the marker makes
+ *   every `hq` command in the turn use the owner's sign-in, the same one the
+ *   desktop app shares, so no command needs a special case. The bot's id
+ *   (never a credential) rides along in HQ_BOT_AGENT_UID so what the owner
+ *   creates in the turn — a company — can add the bot as a member afterwards.
+ * - A COMPANY bot acts as itself on every turn, like a cloud agent: the
+ *   machine identity stays, and the cloud evaluates it through its own
+ *   company memberships. It never acts as the owner, in DMs or in rooms.
+ * Pure so the rule is unit-testable.
+ */
+export function turnEnv(base, kind, agentUid) {
+    const env = { ...base };
+    delete env[HQ_BOT_AGENT_UID_ENV];
+    if (kind === "personal") {
+        delete env.HQ_MACHINE_CREDS_FILE;
+        delete env.HQ_MACHINE_TOKEN_STATE_DIR;
+        if (agentUid)
+            env[HQ_BOT_AGENT_UID_ENV] = agentUid;
+    }
+    return env;
+}
 /** The core worker HQ's setup bot runs. */
-export const SETUP_WORKER_ID = "setup";
+export const SETUP_WORKER_ID = SETUP_BOT_WORKER_ID;
 /** The one message a person gets when a turn on their message did not finish. */
 export function didNotFinishText(reason, progressPosted) {
     const r = reason.trim().replace(/[.\s]+$/, "");
@@ -148,6 +185,9 @@ export async function runBot(deps) {
     const turnCwd = config.hqRoot;
     // HQ's setup bot is a guided conversation: no "working on it" filler between steps.
     const isSetupBot = config.workerId === SETUP_WORKER_ID;
+    // Personal: every turn acts as the owner. Company: every turn acts as the bot.
+    const kind = effectiveBotKind(config);
+    const companies = effectiveBotCompanies(config);
     const lockDeps = defaultPidLockDeps({
         pid,
         ...(deps.isProcessAlive ? { isProcessAlive: deps.isProcessAlive } : {}),
@@ -193,14 +233,15 @@ export async function runBot(deps) {
         await finish("stopped", 0, "local bot held for cloud promotion");
         return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
-    setStatus({ ...fallback(), pid, state: "starting", canDrainForPromotion: false });
-    log("info", `starting ${config.name} (${config.runtime}) as ${config.agentUid} for ${config.ownerUid}`);
+    // A restart is the owner's "try again" after signing in: start clean.
+    setStatus({ ...fallback(), pid, state: "starting", canDrainForPromotion: false, runtimeSignIn: null });
+    log("info", `starting ${config.name} (${config.runtime}, ${kind} bot${companies.length ? ` of ${companies.join(", ")}` : ""}) as ${config.agentUid} for ${config.ownerUid}`);
     try {
         const record = await api.getAgent(config.agentUid);
         // Promotion keeps the identity and owner. Ownership alone must not let
         // an old local installation start consuming the cloud bot's inbox.
-        if (record.uid !== config.agentUid || record.computeMode !== "local" || record.botKind !== "personal") {
-            await finish("failed", 0, `identity ${config.agentUid} is not a personal local bot; this installation cannot run it`);
+        if (record.uid !== config.agentUid || record.computeMode !== "local" || record.botKind !== kind) {
+            await finish("failed", 0, `identity ${config.agentUid} is not a ${kind} local bot; this installation cannot run it`);
             return { stop: async () => { }, done, status: () => null, idle: () => true };
         }
         const owner = record.ownerUid ?? null;
@@ -224,6 +265,8 @@ export async function runBot(deps) {
             workerSource: config.workerSource,
             workerId: config.workerId,
             companySlug: config.companySlug,
+            kind,
+            companies,
             memoryDir: config.memoryDir,
             sources: readPromptSources(config.hqRoot, config.workerDir, undefined, {
                 memoryDir: config.memoryDir,
@@ -249,7 +292,11 @@ export async function runBot(deps) {
     // the intro, so introSentAt (persisted before the turn) guarantees it never
     // runs again on a restart.
     let kickoffAfterIntro = null;
-    if (!config.introSentAt) {
+    if (config.introSentAt && config.kickoffPendingSignIn && config.kickoff?.trim()) {
+        // The kickoff was held for a sign-in on an earlier run; this start retries it.
+        kickoffAfterIntro = {};
+    }
+    else if (!config.introSentAt) {
         try {
             const sent = await api.sendDm({ toPersonUid: config.ownerUid, body: introDmText(config.name, config.runtime, config.intro) });
             patchBotConfig(dir, { introSentAt: now().toISOString() });
@@ -264,6 +311,41 @@ export async function runBot(deps) {
     // ── Heartbeat loop ─────────────────────────────────────────────────────────
     const failures = new FailureWindow(FAILURE_WINDOW_MS, FAILURE_LIMIT);
     let modelHealth = "ok";
+    // ── Coding tool sign-in ────────────────────────────────────────────────────
+    const signInRetryMs = Math.max(0, deps.signInRetryMs ?? SIGN_IN_RETRY_MS);
+    let signInIssue = null;
+    let nextSignInRetryAt = 0;
+    /** Conversations already told this time that the bot needs a sign-in. */
+    const toldAboutSignIn = new Set();
+    const markSignInBroken = (excerpt) => {
+        nextSignInRetryAt = now().getTime() + signInRetryMs;
+        modelHealth = "degraded";
+        if (signInIssue)
+            return;
+        signInIssue = { state: "expired", runtime: config.runtime, since: now().toISOString() };
+        setStatus({ runtimeSignIn: signInIssue, lastError: excerpt.slice(0, 400) });
+        log("warn", `${runtime.id} needs to sign in again on this computer; holding turns and retrying every ${Math.round(signInRetryMs / 1000)}s`);
+    };
+    const markSignInWorks = () => {
+        if (!signInIssue)
+            return;
+        signInIssue = null;
+        toldAboutSignIn.clear();
+        setStatus({ runtimeSignIn: null });
+        log("info", `${runtime.id} sign-in works again; resuming`);
+    };
+    /** Say once per conversation that the bot cannot work until its tool signs in. */
+    const tellSignInNeeded = async (conversation, post, kickoff = false) => {
+        if (toldAboutSignIn.has(conversation))
+            return;
+        try {
+            await post(signInNeededText(config.runtime, kickoff));
+            toldAboutSignIn.add(conversation);
+        }
+        catch (err) {
+            log("warn", `could not say that ${runtime.id} needs a sign-in: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    };
     const heartbeatLoop = (async () => {
         while (!stopping && state === "running") {
             try {
@@ -314,20 +396,22 @@ export async function runBot(deps) {
         // resets). Claude gets the full hook set via its payload session id;
         // Codex/Grok only see HQ_SESSION_ID.
         const sid = session?.sessionId ?? randomUUID();
-        let bind = {};
+        const env = turnEnv(process.env, kind, config.agentUid);
+        let bind = { env };
         if (config.companySlug) {
             try {
                 ensureBotSessionMeta(config.hqRoot, sid, config.companySlug, undefined, now);
-                bind = { newSessionId: sid, env: { ...process.env, HQ_SESSION_ID: sid } };
+                bind = { newSessionId: sid, env: { ...env, HQ_SESSION_ID: sid } };
             }
             catch (err) {
                 log("warn", `company bind failed for ${config.companySlug}: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
-        // Only the owner's own DM session (DMs and the kickoff). Room prompts must
-        // keep their [#channel …] header first, and a room turn can be triggered
-        // by other people, who must not be handed the owner's companies.
-        if (deps.ownerContext && sessionScope === "dm") {
+        // Only a personal bot, and only in the owner's own DM session (DMs and the
+        // kickoff). Room prompts must keep their [#channel …] header first, and a
+        // room turn can be triggered by other people, who must not be handed the
+        // owner's companies. A company bot acts as itself and never gets it.
+        if (deps.ownerContext && sessionScope === "dm" && kind === "personal") {
             try {
                 const owner = await deps.ownerContext();
                 if (owner.status === "unavailable") {
@@ -384,6 +468,7 @@ export async function runBot(deps) {
             }
         }
         modelHealth = "ok";
+        markSignInWorks();
         log("info", `model turn done in ${Math.round((now().getTime() - tTurnStart) / 1000)}s (${Math.round((tTurnStart - tReceived) / 1000)}s before it)`);
         if (turn.sessionId) {
             writeBotSession(dir, {
@@ -543,11 +628,23 @@ export async function runBot(deps) {
                 return;
             }
             clearInflight(dir, KICKOFF_MESSAGE_ID);
+            if (readBotConfig(dir)?.kickoffPendingSignIn)
+                patchBotConfig(dir, { kickoffPendingSignIn: false });
             const st = readStatus();
             setStatus({ repliesSent: (st?.repliesSent ?? 0) + 1, lastActivityAt: now().toISOString() });
             log("info", `kickoff reply sent (${outcome.reply.length} chars)`);
             return;
         }
+        if (!outcome.aborted && poster.postedCount === 0 && isRuntimeSignInFailure(outcome.excerpt)) {
+            // Nothing ran: hold the kickoff until the tool can sign in, then run it.
+            clearInflight(dir, KICKOFF_MESSAGE_ID);
+            patchBotConfig(dir, { kickoffPendingSignIn: true });
+            markSignInBroken(outcome.excerpt);
+            await tellSignInNeeded("dm", (body) => api.sendDm({ toPersonUid: peerUid, body }), true);
+            return;
+        }
+        if (readBotConfig(dir)?.kickoffPendingSignIn)
+            patchBotConfig(dir, { kickoffPendingSignIn: false });
         let count = 0;
         if (!outcome.aborted)
             count = recordTurnFailure(outcome.error, "dm").count;
@@ -589,7 +686,7 @@ export async function runBot(deps) {
             // 404 on the server by design), then ack so it never comes back.
             try {
                 if (sender)
-                    await api.sendDm({ toPersonUid: sender, body: nonOwnerRefusalText(config.name) });
+                    await api.sendDm({ toPersonUid: sender, body: nonOwnerRefusalText(config.name, kind) });
             }
             catch {
                 /* refusal delivery is best-effort */
@@ -687,6 +784,17 @@ export async function runBot(deps) {
             return;
         }
         await clearThinking();
+        if (!outcome.aborted && poster.postedCount === 0 && isRuntimeSignInFailure(outcome.excerpt)) {
+            // The tool refused before doing anything: keep the message for when it
+            // can sign in again, and say so once in this conversation.
+            clearInflight(dir, id);
+            attempts.delete(id);
+            markSignInBroken(outcome.excerpt);
+            const conversation = markerTarget.kind === "dm" ? "dm" : `room:${markerTarget.channelId}:${item.rootEventId ?? ""}`;
+            await tellSignInNeeded(conversation, send);
+            log("warn", `kept ${id} until ${runtime.id} can sign in again`);
+            return; // un-acked: answered once the sign-in works
+        }
         if (!outcome.started) {
             // The model never ran (e.g. the binary is missing): nothing happened
             // outside this Mac, so retrying is safe.
@@ -751,6 +859,9 @@ export async function runBot(deps) {
         for (const [lane, queue] of lanes) {
             if (busyLanes.size >= maxParallelTurns || !canStart())
                 return;
+            // While the sign-in is broken, one message at a time tries it, on a timer.
+            if (signInIssue && (busyLanes.size > 0 || now().getTime() < nextSignInRetryAt))
+                return;
             if (busyLanes.has(lane))
                 continue;
             const item = queue.shift();
@@ -759,6 +870,8 @@ export async function runBot(deps) {
             if (!item)
                 continue;
             busyLanes.add(lane);
+            if (signInIssue)
+                nextSignInRetryAt = now().getTime() + signInRetryMs;
             const task = handleItem(item)
                 .catch((err) => {
                 log("warn", `inbox item ${item.messageId} failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -797,6 +910,16 @@ export async function runBot(deps) {
         while (!stopping && state === "running") {
             if (hasPromotionHold(dir))
                 break;
+            // A kickoff held for a sign-in retries on the same timer as messages.
+            if (busyLanes.size === 0 &&
+                (!signInIssue || now().getTime() >= nextSignInRetryAt) &&
+                readBotConfig(dir)?.kickoffPendingSignIn) {
+                if (signInIssue)
+                    nextSignInRetryAt = now().getTime() + signInRetryMs;
+                await runKickoff().catch((err) => {
+                    log("error", `kickoff retry crashed: ${err instanceof Error ? err.message : String(err)}`);
+                });
+            }
             try {
                 const items = await api.pullInbox(config.agentUid);
                 setStatus({ lastInboxPollAt: now().toISOString() });

package/dist/lib/bot/runtime-sign-in.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The bot's coding tool (Claude Code, Codex, Grok) is installed but its login
+ * no longer works: never signed in, expired, or revoked. The vendor CLI can
+ * still report itself as logged in (a saved but dead token), so the only
+ * reliable evidence is a turn that fails this way.
+ *
+ * Such a turn fails before the model does anything, so the message is safe to
+ * answer later. The bot says once that it needs a sign-in, keeps the message,
+ * and tries again on its own (and at once after `hq bot restart`).
+ */
+import type { BotRuntimeId } from "./config.js";
+/** Time between the bot's own retries while its sign-in is broken. */
+export declare const SIGN_IN_RETRY_MS = 60000;
+export declare function isRuntimeSignInFailure(text: string | undefined | null): boolean;
+export declare function runtimeDisplayName(runtime: BotRuntimeId | string): string;
+/** Reported in status.json and `hq bot list --json` while the sign-in is broken. */
+export interface RuntimeSignInIssue {
+    state: "expired";
+    runtime: BotRuntimeId;
+    since: string;
+}
+/** The one message a conversation gets when the bot cannot work until its tool signs in again. */
+export declare function signInNeededText(runtime: BotRuntimeId | string, kickoff?: boolean): string;
+//# sourceMappingURL=runtime-sign-in.d.ts.map

package/dist/lib/bot/runtime-sign-in.js

@@ -0,0 +1,31 @@
+/**
+ * The bot's coding tool (Claude Code, Codex, Grok) is installed but its login
+ * no longer works: never signed in, expired, or revoked. The vendor CLI can
+ * still report itself as logged in (a saved but dead token), so the only
+ * reliable evidence is a turn that fails this way.
+ *
+ * Such a turn fails before the model does anything, so the message is safe to
+ * answer later. The bot says once that it needs a sign-in, keeps the message,
+ * and tries again on its own (and at once after `hq bot restart`).
+ */
+/** Time between the bot's own retries while its sign-in is broken. */
+export const SIGN_IN_RETRY_MS = 60_000;
+const SIGN_IN_FAILURE = /failed to authenticate|authentication[_ ]failed|not logged in|not signed in|please (?:run \/login|log ?in|sign ?in)|(?:oauth|access|refresh) token (?:has been |was )?(?:expired|revoked|invalid)|oauth session expired|invalid api key|\b401\b|unauthori[sz]ed|login (?:required|expired)|sign-?in (?:required|expired)/i;
+/** Usage and rate limits are a different problem; a new sign-in does not fix them. */
+const NOT_SIGN_IN = /usage[_ ]limit|rate[_ ]limit|quota|too many requests|credits/i;
+export function isRuntimeSignInFailure(text) {
+    const t = (text ?? "").trim();
+    if (!t)
+        return false;
+    return SIGN_IN_FAILURE.test(t) && !NOT_SIGN_IN.test(t);
+}
+export function runtimeDisplayName(runtime) {
+    return runtime === "claude" ? "Claude Code" : runtime === "codex" ? "Codex" : runtime === "grok" ? "Grok" : runtime;
+}
+/** The one message a conversation gets when the bot cannot work until its tool signs in again. */
+export function signInNeededText(runtime, kickoff = false) {
+    const tool = runtimeDisplayName(runtime);
+    return (`I can't work right now: ${tool} needs you to sign in again on this computer. ` +
+        `Use "Sign in to ${tool}" in HQ, and I'll ${kickoff ? "get started" : "answer this"} as soon as it works again — no need to send it twice.`);
+}
+//# sourceMappingURL=runtime-sign-in.js.map

package/dist/lib/bot/status.d.ts

@@ -2,6 +2,7 @@
  * status.json — atomic, metadata-only runtime status (local-bots US-003).
  */
 import type { BotRuntimeId } from "./config.js";
+import type { RuntimeSignInIssue } from "./runtime-sign-in.js";
 export type BotState = "starting" | "running" | "stopped" | "failed";
 export interface BotStatusFile {
     v: 1;
@@ -29,6 +30,11 @@ export interface BotStatusFile {
      * Persisted so later turns skip the failed attempt.
      */
     claudePermissionMode?: string;
+    /**
+     * Set while the coding tool's sign-in is broken (a turn failed for that
+     * reason); cleared by the next turn that works. `null` = known to work.
+     */
+    runtimeSignIn?: RuntimeSignInIssue | null;
     updatedAt: string;
 }
 export declare function defaultBotStatus(pid: number, runtime: BotRuntimeId, now?: () => Date): BotStatusFile;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.114.0",
+  "version": "5.115.1",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {