@indigoai-us/hq-cli 5.115.6 → 5.117.0

package/dist/command-catalog.generated.js

@@ -4979,10 +4979,10 @@ export const COMMAND_CATALOG = [
                 "description": "Show an agent's setup state and runtime detail",
                 "aliases": [],
                 "hidden": false,
-                "usage": "[options] <agentUid>",
+                "usage": "[options] <agent>",
                 "arguments": [
                     {
-                        "name": "agentUid",
+                        "name": "agent",
                         "required": true,
                         "variadic": false
                     }
@@ -5205,6 +5205,60 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "rotate",
+                "description": "Issue a fresh enrollment code for an external agent (old secret + host key stop minting)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <agentUid>",
+                "arguments": [
+                    {
+                        "name": "agentUid",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Company slug (resolves to companyUid)"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Emit raw JSON (code included — pipe carefully)"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "revoke",
+                "description": "Revoke an external agent: disable its login and drop it from the team",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <agentUid>",
+                "arguments": [
+                    {
+                        "name": "agentUid",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Company slug (resolves to companyUid)"
+                    },
+                    {
+                        "flags": "--remove",
+                        "description": "Also delete the agent entity (it disappears from the roster)"
+                    },
+                    {
+                        "flags": "--yes",
+                        "description": "Confirm the revoke (required)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "jobs",
                 "description": "List, pause, or cancel an agent's scheduled jobs",
@@ -5295,6 +5349,155 @@ export const COMMAND_CATALOG = [
             }
         ]
     },
+    {
+        "name": "agent",
+        "description": "Enroll and run this host as an external HQ agent",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options] [command]",
+        "arguments": [],
+        "options": [],
+        "subcommands": [
+            {
+                "name": "enroll",
+                "description": "Enroll this host as an external HQ agent using a one-time code",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <code>",
+                "arguments": [
+                    {
+                        "name": "code",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Expected company slug (warns when the code belongs elsewhere)"
+                    },
+                    {
+                        "flags": "--replace",
+                        "description": "Overwrite an existing machine identity on this host"
+                    },
+                    {
+                        "flags": "--api-base-url <url>",
+                        "description": "hq-pro control plane (default: HQ_VAULT_API_URL or production)"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "kit",
+                "description": "Install, inspect, or run the external-agent background services",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "install",
+                        "description": "Install sync, work-mesh, inbox and heartbeat services plus the skills directory",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--hq-root <path>",
+                                "description": "Local HQ tree to sync the company vault into (default: ~/.hq-agent/hq)"
+                            },
+                            {
+                                "flags": "--inbox-ack",
+                                "description": "Ack mirrored inbox items on the server (default: leave acking to the bot)"
+                            },
+                            {
+                                "flags": "--no-activate",
+                                "description": "Write unit files but do not load them"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Print machine-readable JSON"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "status",
+                        "description": "Show whether each kit service is installed and running",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "Print machine-readable JSON"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "uninstall",
+                        "description": "Stop and remove the kit services (credentials and skills are kept)",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "Print machine-readable JSON"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "run",
+                        "description": "Run one kit service in the foreground (sync|mesh|inbox|heartbeat)",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <service>",
+                        "arguments": [
+                            {
+                                "name": "service",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [],
+                        "subcommands": []
+                    }
+                ]
+            },
+            {
+                "name": "probe",
+                "description": "Verify identity, vault sync, work-mesh presence, DMs and secrets; report to the console",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "mcp",
+                "description": "Serve HQ as a stdio MCP server for the bot framework (whoami, search, files, secrets-exec, dm, inbox, work-mesh)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [],
+                "subcommands": []
+            }
+        ]
+    },
     {
         "name": "outposts",
         "description": "Manage your personal HQ Outposts (EC2 boxes)",
@@ -8034,6 +8237,78 @@ export const COMMAND_CATALOG = [
                 "usage": "[options]",
                 "arguments": [],
                 "options": [
+                    {
+                        "flags": "--remote",
+                        "description": "List the local bots your HQ account owns instead, with a here column saying which are set up on this computer"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "adopt",
+                "description": "Bring a bot you already own back to this computer: new machine credentials, its saved settings, worker folder, and startup agent",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <name>",
+                "arguments": [
+                    {
+                        "name": "name",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--runtime <runtime>",
+                        "description": "Model CLI to run it with, overriding its saved one: claude|codex|grok"
+                    },
+                    {
+                        "flags": "--model <model>",
+                        "description": "Model override passed to the runtime CLI, replacing its saved one"
+                    },
+                    {
+                        "flags": "--no-daemon",
+                        "description": "Do not install the launchd agent (macOS)"
+                    },
+                    {
+                        "flags": "--no-start",
+                        "description": "Bring it back without starting it"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "restore",
+                "description": "Bring back every local bot your HQ account owns that is not set up on this computer (after a reinstall, or on a new Mac)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--all",
+                        "description": "Also re-issue credentials and reinstall the startup agent for the bots already set up here"
+                    },
+                    {
+                        "flags": "--dry-run",
+                        "description": "Show what would be brought back, change nothing"
+                    },
+                    {
+                        "flags": "--no-daemon",
+                        "description": "Do not install the launchd agents (macOS)"
+                    },
+                    {
+                        "flags": "--no-start",
+                        "description": "Bring them back without starting them"
+                    },
                     {
                         "flags": "--json",
                         "description": "Print machine-readable JSON"
@@ -8184,6 +8459,10 @@ export const COMMAND_CATALOG = [
                         "flags": "-y, --yes",
                         "description": "Skip the confirmation prompt"
                     },
+                    {
+                        "flags": "--remote",
+                        "description": "When the bot's local settings are already gone, also delete the bot HQ still has under that name"
+                    },
                     {
                         "flags": "--json",
                         "description": "Print machine-readable JSON"

package/dist/command-registration-plan.d.ts

@@ -340,6 +340,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/agents.js";
     readonly exportName: "registerAgentsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "agent";
+    readonly parent: "program";
+    readonly module: "./commands/agent.js";
+    readonly exportName: "registerAgentCommand";
 }, {
     readonly type: "registrar";
     readonly root: "outposts";

package/dist/command-registration-plan.js

@@ -59,6 +59,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "crm", parent: "program", module: "./commands/crm.js", exportName: "registerCrmCommand" },
     { type: "registrar", root: "company", parent: "program", module: "./commands/company.js", exportName: "registerCompanyCommand" },
     { type: "registrar", root: "agents", parent: "program", module: "./commands/agents.js", exportName: "registerAgentsCommand" },
+    { type: "registrar", root: "agent", parent: "program", module: "./commands/agent.js", exportName: "registerAgentCommand" },
     { type: "registrar", root: "outposts", parent: "program", module: "./commands/outposts.js", exportName: "registerOutpostsCommand" },
     { type: "registrar", root: "billing", parent: "program", module: "./commands/billing.js", exportName: "registerBillingCommand" },
     { type: "registrar", root: "core", parent: "program", module: "./commands/core.js", exportName: "registerCoreCommands" },

package/dist/commands/agent-enroll.d.ts

@@ -0,0 +1,105 @@
+/**
+ * `hq agent enroll <code>` — turn this host into an external HQ agent.
+ *
+ * Flow (api-contract v1, POST /v1/agents/enroll):
+ *   1. refuse if this host already carries an identity (human session file or
+ *      a machine-creds file) unless --replace
+ *   2. generate an Ed25519 key pair at ~/.hq-agent/host-key{,.pub} (0600)
+ *   3. POST { code, hostPublicKey, hostInfo } — unauthenticated, one-shot
+ *   4. write ~/.hq-agent/machine-creds.json (0600) with runtime "external",
+ *      hostKeyPath, companySlug and apiBaseUrl
+ *
+ * The code is single-use and expires 15 minutes after an admin creates it,
+ * so every failure names the fix. The human session file is only checked
+ * for EXISTENCE — its contents are never read (policy
+ * never-extract-stored-session-tokens-to-forge-privileged-calls).
+ */
+import { Command } from "commander";
+import { generateHostKeyPair } from "../lib/agent-kit/creds.js";
+import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
+export declare const ENROLL_PATH = "/v1/agents/enroll";
+/** Canonical code: un-grouped, uppercase (server hashes exactly this). */
+export declare function normalizeEnrollmentCode(raw: string): string;
+/** 24 chars of Crockford base32 (no I, L, O, U). */
+export declare function isWellFormedEnrollmentCode(code: string): boolean;
+export interface HostInfo {
+    os: string;
+    arch: string;
+    hostname: string;
+    cliVersion: string;
+}
+export declare function collectHostInfo(): HostInfo;
+export type ExistingIdentity = {
+    kind: "none";
+} | {
+    kind: "human";
+    file: string;
+} | {
+    kind: "machine";
+    file: string;
+    agentUid?: string;
+};
+/**
+ * What identity already lives on this host. Existence checks only: the
+ * human token file is never opened.
+ */
+export declare function detectExistingIdentity(paths: Pick<AgentKitPaths, "machineCredsPath" | "home">, env?: NodeJS.ProcessEnv): ExistingIdentity;
+export declare function refusalMessage(existing: ExistingIdentity): string | null;
+export declare class EnrollError extends Error {
+    readonly status?: number | undefined;
+    readonly code?: string | undefined;
+    constructor(message: string, status?: number | undefined, code?: string | undefined);
+}
+/** Map a non-2xx enroll response to an actionable message (contract codes). */
+export declare function mapEnrollFailure(status: number, body: {
+    code?: unknown;
+    error?: unknown;
+    message?: unknown;
+    attemptsRemaining?: unknown;
+}, headers?: {
+    retryAfter?: string | null;
+}): EnrollError;
+export declare function mapEnrollTransportError(err: unknown, apiBaseUrl: string): EnrollError;
+export interface EnrollResponse {
+    agentUid: string;
+    companyUid: string;
+    companySlug: string;
+    credentials: {
+        username: string;
+        secret: string;
+        userPoolId?: string;
+        clientId: string;
+        region: string;
+        entityType: "agent";
+        entityUid: string;
+        runtime: "external";
+    };
+    hostFingerprint: string;
+}
+export interface EnrollDeps {
+    fetch?: typeof fetch;
+    paths?: AgentKitPaths;
+    env?: NodeJS.ProcessEnv;
+    hostInfo?: HostInfo;
+    generateKeyPair?: typeof generateHostKeyPair;
+}
+export interface EnrollOptions {
+    code: string;
+    company?: string;
+    replace?: boolean;
+    apiBaseUrl?: string;
+}
+export interface EnrollResult {
+    agentUid: string;
+    companySlug: string;
+    companyUid: string;
+    hostFingerprint: string;
+    credsPath: string;
+    hostKeyPath: string;
+    /** Set when --company disagreed with the server's company. */
+    companyMismatch?: string;
+}
+/** Pure-ish orchestration so tests can drive it without a TTY or network. */
+export declare function enrollHost(opts: EnrollOptions, deps?: EnrollDeps): Promise<EnrollResult>;
+export declare function registerAgentEnrollCommand(agent: Command): void;
+//# sourceMappingURL=agent-enroll.d.ts.map