@indigoai-us/hq-cli 5.115.0 → 5.115.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [5.115.1] — 2026-09-15
+
+### Fixed
+
+- `hq bot create --kind company` now sends the bot's companies with the create, as the cloud requires, so a company bot can actually be created; the cloud makes it a member of each company, and a company you are not an owner or admin of is refused before anything is created.
+
 ## [5.115.0] — 2026-09-15
 
 ### Added

package/dist/commands/bot.js

@@ -30,7 +30,7 @@ import * as path from "node:path";
 import * as readline from "node:readline";
 import { DEFAULT_COGNITO, ensureCognitoToken, resolveDefaultHqRoot, } from "../utils/cognito-session.js";
 import { peekHqApiKey } from "../utils/resolve-vault-credential.js";
-import { resolveCallerPersonUid } from "../utils/vault-api.js";
+import { getCompanyUid, resolveCallerPersonUid } from "../utils/vault-api.js";
 import { resolveHqBinary } from "../lib/mesh/live/daemon/install.js";
 import { runtimeDisplayName } from "../lib/bot/runtime-sign-in.js";
 import { BotApi, BotApiError, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, } from "../lib/bot/index.js";
@@ -368,11 +368,32 @@ export async function runBotCreate(nameArg, opts) {
     if (!owner)
         throw Object.assign(new Error("Your HQ login has no person entity yet; open the HQ desktop app once, then retry."), { expected: true });
     const api = new BotApi({ token: async () => token });
+    // A company bot's companies are resolved first (a typo must not cost an
+    // identity) and sent with the create: the server makes the bot a member of
+    // each and refuses the whole create if the owner cannot add agents there.
+    const companyUids = [];
+    for (const slug of companies) {
+        try {
+            companyUids.push(await getCompanyUid(token, slug));
+        }
+        catch (err) {
+            throw Object.assign(new Error(`Cannot create ${name}: ${err instanceof Error ? err.message : String(err)} (company "${slug}").`), { expected: true });
+        }
+    }
     let created;
     try {
-        created = await api.createLocalBot({ name, kind });
+        created = await api.createLocalBot({
+            name,
+            kind,
+            ...(kind === "company" ? { companyUid: companyUids[0], companyMemberships: companyUids.slice(1) } : {}),
+        });
     }
     catch (err) {
+        if (err instanceof BotApiError && err.code === "COMPANY_BOT_CREATE_NOT_ALLOWED") {
+            throw Object.assign(new Error(`The server refused to create ${name}: ${err.message} Only an owner or admin of each company can create a company bot there.`), {
+                expected: true,
+            });
+        }
         if (err instanceof BotApiError && err.code === "LOCAL_BOT_CAP_REACHED") {
             // Only an older server still enforces a cap; current hq-pro-agents has none.
             throw Object.assign(new Error("The server refused another bot (its bot limit is reached). Remove one with hq bot rm <name>, or update the server."), {
@@ -427,13 +448,17 @@ export async function runBotCreate(nameArg, opts) {
     };
     writeBotConfig(dir, config);
     // A company bot acts as itself, so it must be a member of each of its
-    // companies: the owner invites it now (person token). Only the companies
-    // it actually joined are recorded, so after a failed invite the identity
+    // companies. Only the companies it actually joined are recorded, so after a failed invite the identity
     // and bot.json stay on disk and `hq bot companies <name> --add <slug>`
     // retries exactly the missing ones (or `hq bot rm <name>` undoes it all).
     if (kind === "company") {
-        const outcome = await addBotToCompanies({ agentUid, companies, token });
-        config.companies = outcome.done;
+        // The server already made it a member of the companies it reports back;
+        // only the rest (an older server reports none) are invited here.
+        const joined = new Set(created.agent.companyMemberships ?? []);
+        const already = companies.filter((_, i) => joined.has(companyUids[i]));
+        const missing = companies.filter((_, i) => !joined.has(companyUids[i]));
+        const outcome = await addBotToCompanies({ agentUid, companies: missing, token });
+        config.companies = [...already, ...outcome.done];
         writeBotConfig(dir, config);
         if (outcome.failed.length > 0) {
             createBotLogger(dir)("error", `created ${name} (${agentUid}) but could not add it to: ${describeCompanyFailures(outcome.failed)}`);

package/dist/lib/bot/api.d.ts

@@ -45,6 +45,8 @@ export interface AgentRecord {
     ownerUid?: string | null;
     computeMode?: string;
     botKind?: string;
+    /** Company bots: the `cmp_` uids the server made it a member of. */
+    companyMemberships?: string[];
     online?: boolean;
     runtime?: {
         status?: string;
@@ -189,6 +191,9 @@ export declare class BotApi {
         name: string;
         slug?: string;
         kind?: "personal" | "company";
+        /** Company bots: the company it acts for, plus any further companies. The server makes it a member of each. */
+        companyUid?: string;
+        companyMemberships?: string[];
     }): Promise<{
         agent: AgentRecord;
         identity: {

package/dist/lib/bot/api.js

@@ -193,6 +193,8 @@ export class BotApi {
                 ...(input.slug ? { slug: input.slug } : {}),
                 computeMode: "local",
                 botKind: input.kind ?? "personal",
+                ...(input.companyUid ? { companyUid: input.companyUid } : {}),
+                ...(input.companyMemberships?.length ? { companyMemberships: input.companyMemberships } : {}),
                 role: "local-bot",
             },
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.115.0",
+  "version": "5.115.1",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {