@indigoai-us/hq-cli 5.115.6 → 5.117.0

package/dist/lib/agent-kit/run/inbox.js

@@ -0,0 +1,152 @@
+/**
+ * Kit service: inbox poller.
+ *
+ * Mirrors the poll half of the hosted box's hq-agent-inbox.sh: every
+ * `inboxPollMs` GET /v1/agents/{uid}/inbox, take `.messages[]`, and stamp
+ * `component-inbox` ok on a 200 (any other status → error, token re-minted
+ * on the next pass). The hosted watcher then dispatches each item to a
+ * provider and acks it; an external bot brings its own brain, so this
+ * service only MIRRORS: each new item is written once to
+ * ~/.hq-agent/inbox/<id>.json and appended to inbox.jsonl for the bot to
+ * consume, and the work-mesh conversation cache is refreshed so `hq dm`
+ * and the skills see the same state.
+ *
+ * Acking is opt-in (kit.json `inboxAck`): with it off the server keeps the
+ * item until the bot acks (`POST /v1/agents/{uid}/inbox/{id}/ack`), and the
+ * poller dedupes by id so the same item is never mirrored twice.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { vaultApiFetch } from "../../../utils/vault-api.js";
+import { warmMeshConversationCache } from "../../mesh/api.js";
+import { writeComponentStatus } from "../creds.js";
+export const SEEN_IDS_NAME = "seen-ids.json";
+export const INBOX_JSONL_NAME = "inbox.jsonl";
+export const MAX_SEEN_IDS = 5000;
+/** Pull `{id}` out of each server item; items without a string id are dropped. */
+export function extractInboxItems(body) {
+    const rec = body && typeof body === "object" ? body : {};
+    const messages = Array.isArray(rec.messages) ? rec.messages : [];
+    const items = [];
+    for (const m of messages) {
+        if (!m || typeof m !== "object")
+            continue;
+        const raw = m;
+        const id = typeof raw.id === "string" ? raw.id : typeof raw.messageId === "string" ? raw.messageId : null;
+        if (!id || !/^[A-Za-z0-9._:-]{1,200}$/.test(id))
+            continue;
+        items.push({ id, raw });
+    }
+    return items;
+}
+export function readSeenIds(paths) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(paths.inboxDir, SEEN_IDS_NAME), "utf8"));
+        return new Set(Array.isArray(raw) ? raw.filter((x) => typeof x === "string") : []);
+    }
+    catch {
+        return new Set();
+    }
+}
+export function writeSeenIds(paths, seen) {
+    fs.mkdirSync(paths.inboxDir, { recursive: true, mode: 0o700 });
+    const list = [...seen].slice(-MAX_SEEN_IDS);
+    fs.writeFileSync(path.join(paths.inboxDir, SEEN_IDS_NAME), JSON.stringify(list), { mode: 0o600 });
+}
+export function mirrorInboxItem(paths, item) {
+    fs.mkdirSync(paths.inboxDir, { recursive: true, mode: 0o700 });
+    const dest = path.join(paths.inboxDir, `${item.id}.json`);
+    fs.writeFileSync(dest, `${JSON.stringify(item.raw, null, 2)}\n`, { mode: 0o600 });
+    fs.appendFileSync(path.join(paths.inboxDir, INBOX_JSONL_NAME), `${JSON.stringify({ id: item.id, mirroredAt: new Date().toISOString(), ...item.raw })}\n`, { mode: 0o600 });
+    return dest;
+}
+export function defaultFetchInbox(agentUid, apiBaseUrl) {
+    return async (token) => {
+        const res = await vaultApiFetch({
+            token,
+            baseUrl: apiBaseUrl,
+            path: `/v1/agents/${encodeURIComponent(agentUid)}/inbox`,
+        });
+        const body = await res.json().catch(() => ({}));
+        return { status: res.status, body };
+    };
+}
+export function defaultAckItem(agentUid, apiBaseUrl) {
+    return async (token, id) => {
+        const res = await vaultApiFetch({
+            token,
+            baseUrl: apiBaseUrl,
+            path: `/v1/agents/${encodeURIComponent(agentUid)}/inbox/${encodeURIComponent(id)}/ack`,
+            method: "POST",
+        });
+        return res.status;
+    };
+}
+export async function pollInboxOnce(deps) {
+    const fetchInbox = deps.fetchInbox ?? defaultFetchInbox(deps.agentUid, deps.apiBaseUrl);
+    const ackItem = deps.ackItem ?? defaultAckItem(deps.agentUid, deps.apiBaseUrl);
+    const warmCache = deps.warmCache ?? ((token, uid) => warmMeshConversationCache(token, uid));
+    let token;
+    try {
+        token = await deps.getToken();
+    }
+    catch (err) {
+        writeComponentStatus(deps.paths, "inbox", "error");
+        deps.log("error", `inbox token mint failed: ${err instanceof Error ? err.message : String(err)}`);
+        return { ok: false, mirrored: 0 };
+    }
+    let res;
+    try {
+        res = await fetchInbox(token);
+    }
+    catch (err) {
+        writeComponentStatus(deps.paths, "inbox", "error");
+        deps.log("error", `inbox fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+        return { ok: false, mirrored: 0 };
+    }
+    if (res.status !== 200) {
+        writeComponentStatus(deps.paths, "inbox", "error");
+        deps.log("warn", `inbox poll ${res.status}`);
+        return { ok: false, mirrored: 0 };
+    }
+    writeComponentStatus(deps.paths, "inbox", "ok");
+    const seen = readSeenIds(deps.paths);
+    const fresh = extractInboxItems(res.body).filter((i) => !seen.has(i.id));
+    for (const item of fresh) {
+        mirrorInboxItem(deps.paths, item);
+        seen.add(item.id);
+        if (deps.ack) {
+            try {
+                const status = await ackItem(token, item.id);
+                if (status < 200 || status >= 300)
+                    deps.log("warn", `ack ${item.id} → ${status}`);
+            }
+            catch (err) {
+                deps.log("warn", `ack ${item.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
+    if (fresh.length > 0) {
+        writeSeenIds(deps.paths, seen);
+        deps.log("info", `inbox mirrored ${fresh.length} item(s)`);
+        try {
+            await warmCache(token, deps.agentUid);
+        }
+        catch (err) {
+            deps.log("warn", `cache refresh failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return { ok: true, mirrored: fresh.length };
+}
+export async function runInboxLoop(deps) {
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let polls = 0;
+    for (;;) {
+        await pollInboxOnce(deps);
+        polls += 1;
+        if (deps.maxPolls !== undefined && polls >= deps.maxPolls)
+            return;
+        await sleep(deps.pollMs);
+    }
+}
+//# sourceMappingURL=inbox.js.map

package/dist/lib/agent-kit/run/mesh-listener.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Kit service: work-mesh doorbell listener.
+ *
+ * Policy hq-work-mesh-source-of-truth: the work mesh (REST) is the source of
+ * truth; MQTT carries IDS-ONLY doorbells on the agent's personal topics
+ * `hq/{agt_*}/{dm,work,sessions,notifications}`. This listener is the cache
+ * writer: on any doorbell it refetches through the REST API into
+ * ~/.hq/work-mesh/cache (warmMeshConversationCache) — message bodies are
+ * never taken from MQTT. A periodic refresh covers missed doorbells.
+ *
+ * Credentials come from the same contract-3 vend the mesh daemon uses
+ * (POST /v1/realtime/credentials); the WSS URL is SigV4-presigned. The
+ * connection is rebuilt before the vended credentials expire. `component-mesh`
+ * is stamped ok while subscribed and refreshing, error otherwise.
+ */
+import { type IClientOptions } from "mqtt";
+import { type CredentialsFetcher } from "../../mesh/live/daemon/credentials.js";
+import type { KitLogger } from "../log.js";
+import type { AgentKitPaths } from "../paths.js";
+export declare const DOORBELL_KINDS: readonly ["dm", "work", "sessions", "notifications"];
+export declare const DOORBELL_DEBOUNCE_MS = 2000;
+export declare const RECONNECT_BASE_MS = 1000;
+export declare const RECONNECT_MAX_MS = 60000;
+export declare function doorbellTopics(actorUid: string): string[];
+/** Minimal mqtt client surface the listener needs (test seam). */
+export interface DoorbellMqttClient {
+    on(event: string, handler: (...args: any[]) => void): unknown;
+    subscribe(topics: string | string[], opts: {
+        qos: 0 | 1 | 2;
+    }, callback?: (err: Error | null) => void): unknown;
+    end(force?: boolean, opts?: unknown, cb?: () => void): unknown;
+}
+export type DoorbellConnectFn = (url: string, opts: IClientOptions) => DoorbellMqttClient;
+export interface MeshListenerDeps {
+    paths: AgentKitPaths;
+    agentUid: string;
+    apiBaseUrl: string;
+    refreshMs: number;
+    getToken: () => Promise<string>;
+    log: KitLogger;
+    fetchCredentials?: CredentialsFetcher;
+    connect?: DoorbellConnectFn;
+    refetch?: (token: string, actorUid: string) => Promise<unknown>;
+    now?: () => Date;
+    random?: () => number;
+    setTimeout?: (fn: () => void, ms: number) => unknown;
+    clearTimeout?: (handle: unknown) => void;
+}
+export interface MeshListenerHandle {
+    stop: () => Promise<void>;
+    /** Force a cache refetch (tests / doorbell path). */
+    refetchNow: (reason: string) => Promise<void>;
+    /** Simulate a doorbell (tests). */
+    ring: (topic: string) => void;
+    state: () => "idle" | "connecting" | "subscribed" | "closed";
+}
+export declare function startMeshListener(deps: MeshListenerDeps): Promise<MeshListenerHandle>;
+//# sourceMappingURL=mesh-listener.d.ts.map

package/dist/lib/agent-kit/run/mesh-listener.js

@@ -0,0 +1,193 @@
+/**
+ * Kit service: work-mesh doorbell listener.
+ *
+ * Policy hq-work-mesh-source-of-truth: the work mesh (REST) is the source of
+ * truth; MQTT carries IDS-ONLY doorbells on the agent's personal topics
+ * `hq/{agt_*}/{dm,work,sessions,notifications}`. This listener is the cache
+ * writer: on any doorbell it refetches through the REST API into
+ * ~/.hq/work-mesh/cache (warmMeshConversationCache) — message bodies are
+ * never taken from MQTT. A periodic refresh covers missed doorbells.
+ *
+ * Credentials come from the same contract-3 vend the mesh daemon uses
+ * (POST /v1/realtime/credentials); the WSS URL is SigV4-presigned. The
+ * connection is rebuilt before the vended credentials expire. `component-mesh`
+ * is stamped ok while subscribed and refreshing, error otherwise.
+ */
+import mqtt from "mqtt";
+import { warmMeshConversationCache } from "../../mesh/api.js";
+import { createContract3Fetcher, MQTT_KEEPALIVE_SECONDS, renewalDelayMs, } from "../../mesh/live/daemon/credentials.js";
+import { presignIotWssUrl } from "../../mesh/live/daemon/presign.js";
+import { writeComponentStatus } from "../creds.js";
+export const DOORBELL_KINDS = ["dm", "work", "sessions", "notifications"];
+export const DOORBELL_DEBOUNCE_MS = 2_000;
+export const RECONNECT_BASE_MS = 1_000;
+export const RECONNECT_MAX_MS = 60_000;
+export function doorbellTopics(actorUid) {
+    return DOORBELL_KINDS.map((k) => `hq/${actorUid}/${k}`);
+}
+function backoff(attempt, random) {
+    const cap = Math.min(RECONNECT_MAX_MS, RECONNECT_BASE_MS * 2 ** attempt);
+    return Math.max(RECONNECT_BASE_MS, Math.floor(random() * cap));
+}
+export async function startMeshListener(deps) {
+    const now = deps.now ?? (() => new Date());
+    const random = deps.random ?? Math.random;
+    const setT = deps.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
+    const clearT = deps.clearTimeout ?? ((h) => clearTimeout(h));
+    const connect = deps.connect ?? ((url, opts) => mqtt.connect(url, opts));
+    const refetch = deps.refetch ?? ((token, uid) => warmMeshConversationCache(token, uid));
+    const fetchCredentials = deps.fetchCredentials ??
+        (async () => {
+            const token = await deps.getToken();
+            return createContract3Fetcher({ token, baseUrl: deps.apiBaseUrl })();
+        });
+    let state = "idle";
+    let client = null;
+    let stopped = false;
+    let attempt = 0;
+    let debounce = null;
+    let renewal = null;
+    let periodic = null;
+    let refetching = null;
+    let pendingReason = null;
+    const doRefetch = async (reason) => {
+        if (refetching) {
+            pendingReason = reason;
+            return refetching;
+        }
+        refetching = (async () => {
+            try {
+                const token = await deps.getToken();
+                await refetch(token, deps.agentUid);
+                writeComponentStatus(deps.paths, "mesh", state === "subscribed" ? "ok" : "error");
+                deps.log("info", `cache refetched (${reason})`);
+            }
+            catch (err) {
+                writeComponentStatus(deps.paths, "mesh", "error");
+                deps.log("error", `refetch failed (${reason}): ${err instanceof Error ? err.message : String(err)}`);
+            }
+            finally {
+                refetching = null;
+            }
+            if (pendingReason) {
+                const next = pendingReason;
+                pendingReason = null;
+                await doRefetch(next);
+            }
+        })();
+        return refetching;
+    };
+    const ring = (topic) => {
+        if (debounce)
+            clearT(debounce);
+        debounce = setT(() => {
+            debounce = null;
+            void doRefetch(`doorbell ${topic}`);
+        }, DOORBELL_DEBOUNCE_MS);
+    };
+    const schedulePeriodic = () => {
+        if (periodic)
+            clearT(periodic);
+        periodic = setT(() => {
+            periodic = null;
+            void doRefetch("periodic").then(schedulePeriodic);
+        }, deps.refreshMs);
+    };
+    const scheduleReconnect = () => {
+        if (stopped)
+            return;
+        const delay = backoff(attempt, random);
+        attempt += 1;
+        deps.log("warn", `mqtt reconnect in ${delay}ms (attempt ${attempt})`);
+        setT(() => void connectOnce(), delay);
+    };
+    const connectOnce = async () => {
+        if (stopped)
+            return;
+        state = "connecting";
+        let bundle;
+        try {
+            bundle = await fetchCredentials();
+            if (bundle.actorUid !== deps.agentUid) {
+                throw new Error(`realtime vend is for ${bundle.actorUid}, expected ${deps.agentUid}`);
+            }
+        }
+        catch (err) {
+            writeComponentStatus(deps.paths, "mesh", "error");
+            deps.log("error", `credential vend failed: ${err instanceof Error ? err.message : String(err)}`);
+            scheduleReconnect();
+            return;
+        }
+        const url = presignIotWssUrl(bundle.credentials, bundle.iotEndpoint, bundle.region, now());
+        const c = connect(url, {
+            clientId: bundle.clientId,
+            keepalive: MQTT_KEEPALIVE_SECONDS,
+            clean: true,
+            reconnectPeriod: 0,
+            protocolVersion: 4,
+        });
+        client = c;
+        let settled = false;
+        c.on("connect", () => {
+            c.subscribe(doorbellTopics(bundle.actorUid), { qos: 1 }, (err) => {
+                if (err) {
+                    deps.log("error", `subscribe failed: ${err.message}`);
+                    c.end(true);
+                    return;
+                }
+                settled = true;
+                attempt = 0;
+                state = "subscribed";
+                writeComponentStatus(deps.paths, "mesh", "ok");
+                deps.log("info", `subscribed to ${doorbellTopics(bundle.actorUid).length} doorbell topics`);
+                void doRefetch("connect");
+                if (renewal)
+                    clearT(renewal);
+                renewal = setT(() => {
+                    deps.log("info", "renewing realtime credentials");
+                    c.end(true);
+                }, renewalDelayMs(now().getTime(), bundle.expiresAt));
+            });
+        });
+        c.on("message", (topic) => {
+            // Ids-only doorbell: the payload is never parsed for content.
+            ring(topic);
+        });
+        c.on("error", (err) => {
+            deps.log("warn", `mqtt error: ${err.message}`);
+        });
+        c.on("close", () => {
+            if (client !== c)
+                return;
+            client = null;
+            const wasSubscribed = state === "subscribed";
+            state = stopped ? "closed" : "idle";
+            writeComponentStatus(deps.paths, "mesh", "error");
+            if (!settled || !wasSubscribed)
+                deps.log("warn", "mqtt closed before subscribe settled");
+            scheduleReconnect();
+        });
+    };
+    schedulePeriodic();
+    await connectOnce();
+    return {
+        stop: async () => {
+            stopped = true;
+            state = "closed";
+            if (debounce)
+                clearT(debounce);
+            if (renewal)
+                clearT(renewal);
+            if (periodic)
+                clearT(periodic);
+            const c = client;
+            client = null;
+            if (c)
+                await new Promise((r) => c.end(true, undefined, () => r()));
+        },
+        refetchNow: doRefetch,
+        ring,
+        state: () => state,
+    };
+}
+//# sourceMappingURL=mesh-listener.js.map

package/dist/lib/agent-kit/run/sync.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Kit service: company vault sync loop.
+ *
+ * Mirrors the hosted box's hq-agent-sync.service, which runs hq-cloud's
+ * `hq-sync-runner --companies --direction both --on-conflict keep` on a
+ * loop and writes `component-sync`. Here the equivalent is the CLI's own
+ * `hq sync pull --all --on-conflict keep --hq-root <kit hqRoot>`, run as a
+ * child of the same node + hq binary this service was launched with, so the
+ * machine identity, creds path and version are exactly the service's own.
+ *
+ * Honest health: exit 0 = ok, anything else = error (the heartbeat turns a
+ * stale stamp into error on its own).
+ */
+import type { KitLogger } from "../log.js";
+import type { AgentKitPaths } from "../paths.js";
+export interface SyncRunDeps {
+    paths: AgentKitPaths;
+    hqRoot: string;
+    intervalMs: number;
+    log: KitLogger;
+    nodeBinary?: string;
+    hqBinary?: string;
+    /** Injected child runner (tests). Resolves with the exit code. */
+    runPull?: (args: string[]) => Promise<number>;
+    sleep?: (ms: number) => Promise<void>;
+    /** Stop after this many passes (tests); default runs forever. */
+    maxPasses?: number;
+}
+export declare function syncPullArgs(hqRoot: string): string[];
+export declare function defaultRunPull(nodeBinary: string, hqBinary: string, env: NodeJS.ProcessEnv): (args: string[]) => Promise<number>;
+export declare function runSyncOnce(deps: SyncRunDeps): Promise<boolean>;
+export declare function runSyncLoop(deps: SyncRunDeps): Promise<void>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/lib/agent-kit/run/sync.js

@@ -0,0 +1,58 @@
+/**
+ * Kit service: company vault sync loop.
+ *
+ * Mirrors the hosted box's hq-agent-sync.service, which runs hq-cloud's
+ * `hq-sync-runner --companies --direction both --on-conflict keep` on a
+ * loop and writes `component-sync`. Here the equivalent is the CLI's own
+ * `hq sync pull --all --on-conflict keep --hq-root <kit hqRoot>`, run as a
+ * child of the same node + hq binary this service was launched with, so the
+ * machine identity, creds path and version are exactly the service's own.
+ *
+ * Honest health: exit 0 = ok, anything else = error (the heartbeat turns a
+ * stale stamp into error on its own).
+ */
+import { spawn } from "node:child_process";
+import { writeComponentStatus } from "../creds.js";
+export function syncPullArgs(hqRoot) {
+    return ["sync", "pull", "--all", "--on-conflict", "keep", "--hq-root", hqRoot];
+}
+export function defaultRunPull(nodeBinary, hqBinary, env) {
+    return (args) => new Promise((resolve) => {
+        const child = spawn(nodeBinary, [hqBinary, ...args], {
+            env,
+            stdio: ["ignore", "inherit", "inherit"],
+        });
+        child.on("error", () => resolve(127));
+        child.on("exit", (code) => resolve(code ?? 1));
+    });
+}
+export async function runSyncOnce(deps) {
+    const runPull = deps.runPull ??
+        defaultRunPull(deps.nodeBinary ?? process.execPath, deps.hqBinary ?? process.argv[1], process.env);
+    const args = syncPullArgs(deps.hqRoot);
+    deps.log("info", `sync start hq-root=${deps.hqRoot}`);
+    let code;
+    try {
+        code = await runPull(args);
+    }
+    catch (err) {
+        deps.log("error", `sync spawn failed: ${err instanceof Error ? err.message : String(err)}`);
+        code = 1;
+    }
+    const ok = code === 0;
+    writeComponentStatus(deps.paths, "sync", ok ? "ok" : "error");
+    deps.log(ok ? "info" : "error", `sync ${ok ? "ok" : `failed exit=${code}`}`);
+    return ok;
+}
+export async function runSyncLoop(deps) {
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let passes = 0;
+    for (;;) {
+        await runSyncOnce(deps);
+        passes += 1;
+        if (deps.maxPasses !== undefined && passes >= deps.maxPasses)
+            return;
+        await sleep(deps.intervalMs);
+    }
+}
+//# sourceMappingURL=sync.js.map

package/dist/lib/agent-kit/services.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The four kit services and how each is launched. Every unit runs
+ * `node hq agent kit run <service>`; the service reads kit.json and the
+ * machine-creds file itself, so the units carry paths and nothing else.
+ */
+import type { ServiceSpec } from "../service-manager/types.js";
+import type { AgentKitPaths } from "./paths.js";
+export type KitService = "sync" | "mesh" | "inbox" | "heartbeat";
+export declare const KIT_SERVICES: readonly KitService[];
+export declare const KIT_LABEL_PREFIX = "ai.getindigo.hq-agent";
+export declare function isKitService(value: string): value is KitService;
+/**
+ * Environment every service inherits. HQ_MACHINE_CREDS_FILE pins hq-cloud's
+ * mint to the kit's creds file; HQ_REQUIRE_MACHINE_IDENTITY makes a missing
+ * file a loud error instead of a browser-login hang; HQ_AGENT_DIR keeps a
+ * relocated kit consistent across restarts.
+ */
+export declare function kitServiceEnv(paths: AgentKitPaths): Record<string, string>;
+export declare function kitServiceSpec(service: KitService, paths: AgentKitPaths): ServiceSpec;
+export declare function kitServiceSpecs(paths: AgentKitPaths): ServiceSpec[];
+//# sourceMappingURL=services.d.ts.map

package/dist/lib/agent-kit/services.js

@@ -0,0 +1,46 @@
+/**
+ * The four kit services and how each is launched. Every unit runs
+ * `node hq agent kit run <service>`; the service reads kit.json and the
+ * machine-creds file itself, so the units carry paths and nothing else.
+ */
+import { serviceLogPath } from "./paths.js";
+export const KIT_SERVICES = ["sync", "mesh", "inbox", "heartbeat"];
+export const KIT_LABEL_PREFIX = "ai.getindigo.hq-agent";
+export function isKitService(value) {
+    return KIT_SERVICES.includes(value);
+}
+const DESCRIPTIONS = {
+    sync: "HQ agent kit: company vault sync loop",
+    mesh: "HQ agent kit: work-mesh doorbell listener",
+    inbox: "HQ agent kit: inbox poller",
+    heartbeat: "HQ agent kit: heartbeat reporter",
+};
+/**
+ * Environment every service inherits. HQ_MACHINE_CREDS_FILE pins hq-cloud's
+ * mint to the kit's creds file; HQ_REQUIRE_MACHINE_IDENTITY makes a missing
+ * file a loud error instead of a browser-login hang; HQ_AGENT_DIR keeps a
+ * relocated kit consistent across restarts.
+ */
+export function kitServiceEnv(paths) {
+    return {
+        HQ_AGENT_DIR: paths.agentDir,
+        HQ_MACHINE_CREDS_FILE: paths.machineCredsPath,
+        HQ_REQUIRE_MACHINE_IDENTITY: "1",
+    };
+}
+export function kitServiceSpec(service, paths) {
+    return {
+        name: service,
+        label: `${KIT_LABEL_PREFIX}.${service}`,
+        description: DESCRIPTIONS[service],
+        args: ["agent", "kit", "run", service],
+        logPath: serviceLogPath(paths, service),
+        workingDir: paths.agentDir,
+        env: kitServiceEnv(paths),
+        restartSec: 10,
+    };
+}
+export function kitServiceSpecs(paths) {
+    return KIT_SERVICES.map((s) => kitServiceSpec(s, paths));
+}
+//# sourceMappingURL=services.js.map

package/dist/lib/agent-kit/skills.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The skills directory the kit ships to ~/.hq-agent/skills/<name>/SKILL.md.
+ *
+ * agentskills.io format: YAML frontmatter with `name` and `description`, then
+ * markdown the bot's framework loads as an instruction. Each skill drives
+ * the `hq` CLI, which authenticates as the machine identity on its own, so
+ * no skill ever embeds or asks for a token or secret value.
+ */
+import type { AgentKitPaths } from "./paths.js";
+export interface KitSkill {
+    name: string;
+    description: string;
+    body: string;
+}
+export declare const KIT_SKILLS: readonly KitSkill[];
+export declare function renderSkillMarkdown(skill: KitSkill): string;
+export declare function writeKitSkills(paths: Pick<AgentKitPaths, "skillsDir">): string[];
+//# sourceMappingURL=skills.d.ts.map