@indigoai-us/hq-cli 5.116.0 → 5.117.1

package/CHANGELOG.md

@@ -2,6 +2,131 @@
 
 ## [Unreleased]
 
+## [5.117.1] — 2026-09-16
+
+### Fixed
+
+- `hq agent probe` works for external agents. The work-mesh check no longer
+  reads the owner-only company roster (which answered "Not found" to an agent);
+  it passes when the realtime credential vend names the agent, the agent's own
+  inbox answers, and this host's heartbeat and mesh listener are live. The DM
+  check reads the probe message back from the agent's inbox instead of the
+  human-only thread view that refused agents. Output format is unchanged.
+- The agent kit's mesh listener stays connected. It now asks for the personal
+  realtime credentials that cover the agent's own doorbell topics (the company
+  presence credentials it used made the connection drop before subscribing),
+  subscribes only to topics those credentials grant, and polls the inbox
+  immediately when an inbox doorbell rings.
+- Inbox poll failures are diagnosable: the log names the method, full URL,
+  status and the first 300 characters of the response, and the inbox URL keeps
+  any base path from `apiBaseUrl` without doubling `/v1`.
+- `hq dm inbox` works for agent identities by reading the agent inbox;
+  `hq dm thread` tells agents to use `hq dm inbox` instead of failing with a
+  server refusal.
+- `hq agent kit install` works on hosts with no systemd user session or
+  launchd: it starts the services under one background `hq agent kit run all`
+  supervisor (restarting any service that exits), records its pid in
+  `~/.hq-agent/kit.pid`, and prints the `@reboot` crontab line that keeps it
+  running after a restart. `kit status` and `kit uninstall` understand this
+  mode.
+
+## [5.117.0] — 2026-09-16
+
+### Added
+
+- Your local bots can come back after a reinstall. A bot is an identity HQ
+  keeps for you plus the state that runs it on one computer; wiping that
+  computer's HQ folder, or moving to a new Mac, used to leave every bot dead
+  with no way back — making a new one was refused, because the old one still
+  existed. Now `hq bot restore` brings back every bot you own that is missing
+  from this computer, with its own settings, memory folder and startup agent,
+  keeping the same identity and the same conversation. `hq bot adopt <name>`
+  does one bot, `hq bot list --remote` shows every bot you own and which of
+  them are set up here, and trying to create a bot you already own now says so
+  and points at adopting it instead. Bots made before this shipped come back on
+  sensible defaults, and HQ tells you it did that.
+
+### Fixed
+
+- `hq bot restore` no longer brings back a bot this Mac cannot run. A company
+  bot — one that acts for a company rather than as you — was being set up here
+  as a personal bot: it got credentials, a folder, a memory folder and a startup
+  entry, was counted as restored with nothing reported as failed, and then died
+  at every start and at every login, while the Mac offered "check that Claude
+  Code is signed in" as the remedy, which could never help. Restore, `hq bot
+  adopt` and `hq bot list --remote` now ask exactly the question the bot's own
+  startup asks, before anything is written or any password is rotated. A bot
+  that cannot run here is listed plainly, counted as skipped rather than
+  restored, and refused by adopt with one sentence saying where it does run —
+  and nothing is left behind on this computer.
+- Bringing a bot back no longer leaves a second copy of it. A bot you created
+  here as `qa-x` is `qa-x-<your suffix>` in HQ, and bringing it back built a
+  whole second folder under that longer name: a second startup entry, a second
+  memory folder, and the original folder left behind holding the live password
+  of a bot nothing could reach any more. HQ now recognises the folder a bot
+  already has on this computer — by the identity inside it, even when a wipe
+  left only its credentials — and repairs that one in place. A bot that is not
+  here at all comes back under the name you created it with. If that name
+  already belongs to a different bot, both are kept, under names that tell them
+  apart.
+- `hq bot list --remote --json` now says `ok: true` when it worked. Every
+  failure said `ok: false`, and the success document had no `ok` at all, so
+  anything that learned to check it read a good listing as a failure.
+- A bot's long answer now reaches you, in several messages. HQ Cloud refuses any
+  single message over 4000 characters, and nothing split one up: an answer over
+  that length was refused, saved, and sent again unchanged on every check — a
+  test machine recorded the same rejection 231 times in eight minutes while the
+  person saw no reply and no error at all, and the bot's 44 seconds of work was
+  thrown away. A reply that is too long is now cut into numbered parts — on
+  paragraph breaks where it can, on sentences otherwise, and never leaving a
+  block of code half-open — and posted in order. If something goes wrong partway
+  through, only the parts you have not seen are sent again. And if a message
+  truly cannot be delivered, the bot stops after five tries and tells you so in
+  one short line, instead of asking the server to do the impossible for as long
+  as it runs.
+- A bot's startup entry no longer outlives the bot. When a bot's local setup was
+  gone, the startup entry macOS keeps for it relaunched it every five seconds,
+  forever, filling its log with the same failure (one test machine recorded 267
+  of them in a row). HQ now says once what happened, tells you how to bring the
+  bot back, removes the startup entry it no longer needs, and stops cleanly so
+  nothing relaunches it. This works when macOS itself is the one running the
+  bot, which is the case that matters: the first version did its tidying in an
+  order that had macOS shut the bot down before it could finish, so the startup
+  entry survived and brought the same dead bot back at every login, and the
+  explanation never reached the bot's log. HQ now writes the explanation and
+  removes the entry first, and lets go of itself last.
+
+- You can remove a bot whose settings this computer has already lost. A wiped
+  HQ folder could leave a bot half-here — a folder and a startup entry, no
+  settings — and nothing could clear it: removing it said there was no such
+  bot and suggested creating one, and creating one said you already had it.
+  `hq bot rm <name>` now clears whatever is actually left on this computer, and
+  `hq bot rm <name> --remote` also removes the bot HQ still holds under that
+  name. It checks with HQ before it deletes anything local, so a service that
+  cannot answer leaves nothing half-done.
+
+- Removing a bot now tells the truth when HQ only gets part of the way. When
+  HQ's own teardown of a bot's cloud identity stopped half-way, the
+  machine-readable form said the removal had failed but gave no reason and no
+  explanation, reported success to anything checking the exit code, and printed
+  the raw cloud error — including internal infrastructure addresses — straight
+  at you. It now says one plain sentence, names the reason in the same
+  vocabulary as everything else, and exits non-zero, and no internal detail is
+  repeated anywhere. It also stops making you run the command twice for
+  nothing: when the part HQ could not finish would fail the same way every
+  time, the bot is removed from this computer and you are told the leftover is
+  HQ's to clear; when it is something HQ may yet finish, your settings are kept
+  exactly as they were so running the same command again picks the job back up.
+
+- Bringing bots back now fails in plain language when HQ Cloud is too old for
+  it. `hq bot adopt`, `hq bot restore`, and `hq bot list --remote` all ask HQ
+  which bots you own; against an HQ Cloud without that capability, the raw
+  network error was printed at you, and the machine-readable form printed
+  nothing at all — so the desktop app had nothing it could read. Each now says
+  one plain sentence, and `--json` always returns a result naming the reason,
+  so the app can quietly fall back to showing the bots that are on this
+  computer.
+
 ## [5.116.0] — 2026-09-16
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -4217,7 +4217,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly subcommands: readonly [];
         }, {
             readonly name: "run";
-            readonly description: "Run one kit service in the foreground (sync|mesh|inbox|heartbeat)";
+            readonly description: "Run one kit service in the foreground (sync|mesh|inbox|heartbeat), or `all` to supervise every service in one process";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly usage: "[options] <service>";
@@ -6374,6 +6374,61 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly usage: "[options]";
         readonly arguments: readonly [];
         readonly options: readonly [{
+            readonly flags: "--remote";
+            readonly description: "List the local bots your HQ account owns instead, with a here column saying which are set up on this computer";
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print machine-readable JSON";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "adopt";
+        readonly description: "Bring a bot you already own back to this computer: new machine credentials, its saved settings, worker folder, and startup agent";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <name>";
+        readonly arguments: readonly [{
+            readonly name: "name";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--runtime <runtime>";
+            readonly description: "Model CLI to run it with, overriding its saved one: claude|codex|grok";
+        }, {
+            readonly flags: "--model <model>";
+            readonly description: "Model override passed to the runtime CLI, replacing its saved one";
+        }, {
+            readonly flags: "--no-daemon";
+            readonly description: "Do not install the launchd agent (macOS)";
+        }, {
+            readonly flags: "--no-start";
+            readonly description: "Bring it back without starting it";
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print machine-readable JSON";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "restore";
+        readonly description: "Bring back every local bot your HQ account owns that is not set up on this computer (after a reinstall, or on a new Mac)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--all";
+            readonly description: "Also re-issue credentials and reinstall the startup agent for the bots already set up here";
+        }, {
+            readonly flags: "--dry-run";
+            readonly description: "Show what would be brought back, change nothing";
+        }, {
+            readonly flags: "--no-daemon";
+            readonly description: "Do not install the launchd agents (macOS)";
+        }, {
+            readonly flags: "--no-start";
+            readonly description: "Bring them back without starting them";
+        }, {
             readonly flags: "--json";
             readonly description: "Print machine-readable JSON";
         }];
@@ -6488,6 +6543,9 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [{
             readonly flags: "-y, --yes";
             readonly description: "Skip the confirmation prompt";
+        }, {
+            readonly flags: "--remote";
+            readonly description: "When the bot's local settings are already gone, also delete the bot HQ still has under that name";
         }, {
             readonly flags: "--json";
             readonly description: "Print machine-readable JSON";

package/dist/command-catalog.generated.js

@@ -5455,7 +5455,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "name": "run",
-                        "description": "Run one kit service in the foreground (sync|mesh|inbox|heartbeat)",
+                        "description": "Run one kit service in the foreground (sync|mesh|inbox|heartbeat), or `all` to supervise every service in one process",
                         "aliases": [],
                         "hidden": false,
                         "usage": "[options] <service>",
@@ -8237,6 +8237,78 @@ export const COMMAND_CATALOG = [
                 "usage": "[options]",
                 "arguments": [],
                 "options": [
+                    {
+                        "flags": "--remote",
+                        "description": "List the local bots your HQ account owns instead, with a here column saying which are set up on this computer"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "adopt",
+                "description": "Bring a bot you already own back to this computer: new machine credentials, its saved settings, worker folder, and startup agent",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <name>",
+                "arguments": [
+                    {
+                        "name": "name",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--runtime <runtime>",
+                        "description": "Model CLI to run it with, overriding its saved one: claude|codex|grok"
+                    },
+                    {
+                        "flags": "--model <model>",
+                        "description": "Model override passed to the runtime CLI, replacing its saved one"
+                    },
+                    {
+                        "flags": "--no-daemon",
+                        "description": "Do not install the launchd agent (macOS)"
+                    },
+                    {
+                        "flags": "--no-start",
+                        "description": "Bring it back without starting it"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "restore",
+                "description": "Bring back every local bot your HQ account owns that is not set up on this computer (after a reinstall, or on a new Mac)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--all",
+                        "description": "Also re-issue credentials and reinstall the startup agent for the bots already set up here"
+                    },
+                    {
+                        "flags": "--dry-run",
+                        "description": "Show what would be brought back, change nothing"
+                    },
+                    {
+                        "flags": "--no-daemon",
+                        "description": "Do not install the launchd agents (macOS)"
+                    },
+                    {
+                        "flags": "--no-start",
+                        "description": "Bring them back without starting them"
+                    },
                     {
                         "flags": "--json",
                         "description": "Print machine-readable JSON"
@@ -8387,6 +8459,10 @@ export const COMMAND_CATALOG = [
                         "flags": "-y, --yes",
                         "description": "Skip the confirmation prompt"
                     },
+                    {
+                        "flags": "--remote",
+                        "description": "When the bot's local settings are already gone, also delete the bot HQ still has under that name"
+                    },
                     {
                         "flags": "--json",
                         "description": "Print machine-readable JSON"

package/dist/commands/agent-kit.d.ts

@@ -10,7 +10,10 @@
  * `install` renders one user-level unit per service (LaunchAgent on macOS,
  * systemd --user on Linux), each of which just runs
  * `node hq agent kit run <service>`; the Docker image runs the same four
- * commands. Logs: ~/.hq-agent/logs/<service>.log. Skills:
+ * commands. Hosts where the service manager is unusable (no systemd user
+ * session bus, permission refused, launchd unavailable) fall back to one
+ * detached `hq agent kit run all` supervisor (pid in ~/.hq-agent/kit.pid,
+ * output in ~/.hq-agent/logs/kit.log). Logs: ~/.hq-agent/logs/<service>.log. Skills:
  * ~/.hq-agent/skills/<name>/SKILL.md.
  */
 import { Command } from "commander";
@@ -19,6 +22,7 @@ import { type KitConfig } from "../lib/agent-kit/kit-config.js";
 import { type KitLogger } from "../lib/agent-kit/log.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
 import { type KitService } from "../lib/agent-kit/services.js";
+import { type DetachedSpawn, type KillFn } from "../lib/agent-kit/fallback.js";
 import { type ServiceHostPaths, type ServiceManagerDeps, type ServiceSetResult } from "../lib/service-manager/index.js";
 export declare class KitError extends Error {
     constructor(message: string);
@@ -32,12 +36,25 @@ export interface KitInstallOptions {
     inboxAck?: boolean;
     activate?: boolean;
 }
+export interface KitFallbackInfo {
+    mode: "fallback";
+    pid: number;
+    pidFile: string;
+    logPath: string;
+    /** Add to `crontab -e` so the supervisor survives a reboot. */
+    crontab: string;
+}
 export interface KitInstallResult {
     config: KitConfig;
     skills: string[];
     services: ServiceSetResult;
+    fallback?: KitFallbackInfo;
+}
+export interface KitFallbackDeps {
+    spawn?: DetachedSpawn;
+    kill?: KillFn;
 }
-export declare function installKit(paths: AgentKitPaths, opts: KitInstallOptions, host: ServiceHostPaths, deps?: ServiceManagerDeps): KitInstallResult;
+export declare function installKit(paths: AgentKitPaths, opts: KitInstallOptions, host: ServiceHostPaths, deps?: ServiceManagerDeps, fallbackDeps?: KitFallbackDeps): KitInstallResult;
 export declare function formatServiceSet(result: ServiceSetResult): string[];
 /** Shared runtime for `kit run <service>`. */
 export interface KitRuntime {
@@ -47,7 +64,10 @@ export interface KitRuntime {
     getToken: () => Promise<string>;
     log: KitLogger;
 }
-export declare function buildKitRuntime(service: KitService): KitRuntime;
+export declare function buildKitRuntime(service: KitService | "all"): KitRuntime;
 export declare function runKitService(service: KitService, rt: KitRuntime): Promise<void>;
+/** `kit run all`: supervise the four services as child processes with restart backoff. */
+export declare function runAllKitServices(rt: KitRuntime, host: ServiceHostPaths): Promise<void>;
+export declare function formatFallbackStatus(paths: AgentKitPaths, kill?: KillFn): string[] | null;
 export declare function registerAgentKitCommand(agent: Command): void;
 //# sourceMappingURL=agent-kit.d.ts.map

package/dist/commands/agent-kit.js

@@ -10,7 +10,10 @@
  * `install` renders one user-level unit per service (LaunchAgent on macOS,
  * systemd --user on Linux), each of which just runs
  * `node hq agent kit run <service>`; the Docker image runs the same four
- * commands. Logs: ~/.hq-agent/logs/<service>.log. Skills:
+ * commands. Hosts where the service manager is unusable (no systemd user
+ * session bus, permission refused, launchd unavailable) fall back to one
+ * detached `hq agent kit run all` supervisor (pid in ~/.hq-agent/kit.pid,
+ * output in ~/.hq-agent/logs/kit.log). Logs: ~/.hq-agent/logs/<service>.log. Skills:
  * ~/.hq-agent/skills/<name>/SKILL.md.
  */
 import chalk from "chalk";
@@ -25,7 +28,11 @@ import { agentKitPaths } from "../lib/agent-kit/paths.js";
 import { isKitService, KIT_SERVICES, kitServiceSpecs, } from "../lib/agent-kit/services.js";
 import { writeKitSkills } from "../lib/agent-kit/skills.js";
 import { runHeartbeatLoop } from "../lib/agent-kit/run/heartbeat.js";
-import { runInboxLoop } from "../lib/agent-kit/run/inbox.js";
+import { pollInboxOnce, runInboxLoop } from "../lib/agent-kit/run/inbox.js";
+import { superviseKitServices } from "../lib/agent-kit/run/supervisor.js";
+import { fallbackStatus, rebootCrontabLine, shouldUseFallback, startFallback, stopFallback, } from "../lib/agent-kit/fallback.js";
+import { serviceLogPath } from "../lib/agent-kit/paths.js";
+import { spawn } from "node:child_process";
 import { startMeshListener } from "../lib/agent-kit/run/mesh-listener.js";
 import { runSyncLoop } from "../lib/agent-kit/run/sync.js";
 import { resolveHqBinary, resolveNodeBinary, } from "../lib/mesh/live/daemon/install.js";
@@ -57,7 +64,7 @@ export function resolveServiceHost(paths) {
         hqBinary: resolveHqBinary(),
     };
 }
-export function installKit(paths, opts, host, deps = {}) {
+export function installKit(paths, opts, host, deps = {}, fallbackDeps = {}) {
     requireExternalCreds(paths);
     ensureKitDirs(paths);
     const existing = fs.existsSync(paths.kitConfigPath)
@@ -72,10 +79,20 @@ export function installKit(paths, opts, host, deps = {}) {
     fs.mkdirSync(config.hqRoot, { recursive: true, mode: 0o700 });
     writeKitConfig(paths, config);
     const skills = writeKitSkills(paths);
+    const activate = opts.activate ?? deps.activate ?? true;
     const services = installServices(kitServiceSpecs(paths), host, {
         ...deps,
-        activate: opts.activate ?? deps.activate ?? true,
+        activate,
     });
+    if (shouldUseFallback(services, activate)) {
+        const started = startFallback(paths, host, fallbackDeps);
+        return {
+            config,
+            skills,
+            services,
+            fallback: { mode: "fallback", ...started, crontab: rebootCrontabLine(paths, host) },
+        };
+    }
     return { config, skills, services };
 }
 export function formatServiceSet(result) {
@@ -151,6 +168,16 @@ export async function runKitService(service, rt) {
                 refreshMs: rt.config.meshRefreshMs,
                 getToken: rt.getToken,
                 log: rt.log,
+                // An inbox doorbell means "poll now" rather than waiting for the loop.
+                onInboxDoorbell: () => pollInboxOnce({
+                    paths: rt.paths,
+                    agentUid: rt.creds.entityUid,
+                    apiBaseUrl: rt.creds.apiBaseUrl,
+                    pollMs: rt.config.inboxPollMs,
+                    ack: rt.config.inboxAck,
+                    getToken: rt.getToken,
+                    log: rt.log,
+                }),
             });
             const stop = () => {
                 void handle.stop().then(() => process.exit(0));
@@ -164,6 +191,45 @@ export async function runKitService(service, rt) {
         }
     }
 }
+/** `kit run all`: supervise the four services as child processes with restart backoff. */
+export async function runAllKitServices(rt, host) {
+    rt.log("info", `supervisor starting ${KIT_SERVICES.join(",")} agent=${rt.creds.entityUid} cli=${CLI_VERSION}`);
+    const handle = superviseKitServices({
+        services: KIT_SERVICES,
+        log: rt.log,
+        spawnService: (service) => {
+            const fd = fs.openSync(serviceLogPath(rt.paths, service), "a", 0o600);
+            try {
+                return spawn(host.nodeBinary, [host.hqBinary, "agent", "kit", "run", service], {
+                    stdio: ["ignore", fd, fd],
+                    env: process.env,
+                    cwd: rt.paths.agentDir,
+                });
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        },
+    });
+    await new Promise((resolve) => {
+        const stop = (signal) => {
+            rt.log("info", `supervisor stopping (${signal})`);
+            handle.stop("SIGTERM");
+            resolve();
+        };
+        process.once("SIGTERM", () => stop("SIGTERM"));
+        process.once("SIGINT", () => stop("SIGINT"));
+    });
+}
+export function formatFallbackStatus(paths, kill) {
+    const st = fallbackStatus(paths, kill);
+    if (!st)
+        return null;
+    const state = st.running
+        ? chalk.green(`running (pid ${st.pid})`)
+        : chalk.yellow(st.pid === null ? "pidfile unreadable" : `not running (stale pid ${st.pid})`);
+    return [`  mode: fallback supervisor (hq agent kit run all) ${state}${chalk.dim(`  ${st.pidFile}`)}`];
+}
 function fail(err) {
     console.error(chalk.red(err instanceof Error ? err.message : String(err)));
     process.exit(1);
@@ -191,9 +257,19 @@ export function registerAgentKitCommand(agent) {
             console.log(`  hq root:   ${result.config.hqRoot}`);
             console.log(`  logs:      ${paths.logsDir}`);
             console.log(`  skills:    ${paths.skillsDir} (${result.skills.length} skills)`);
-            console.log("  services:");
-            for (const line of formatServiceSet(result.services))
-                console.log(line);
+            if (result.fallback) {
+                console.log(chalk.yellow("  services: service manager unavailable — running in fallback mode " +
+                    `(hq agent kit run all, pid ${result.fallback.pid})`));
+                console.log(`  pidfile:   ${result.fallback.pidFile}`);
+                console.log(`  kit log:   ${result.fallback.logPath}`);
+                console.log("  To restart it after a reboot, add this line with `crontab -e`:");
+                console.log(`    ${result.fallback.crontab}`);
+            }
+            else {
+                console.log("  services:");
+                for (const line of formatServiceSet(result.services))
+                    console.log(line);
+            }
             console.log("");
             console.log("Next: hq agent probe");
         }
@@ -208,13 +284,19 @@ export function registerAgentKitCommand(agent) {
         .action((opts) => {
         try {
             const paths = agentKitPaths(os.homedir(), process.env);
+            const fallback = fallbackStatus(paths);
             const result = servicesStatus(kitServiceSpecs(paths), resolveServiceHost(paths));
             if (opts.json) {
-                console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+                console.log(JSON.stringify({ ok: true, ...result, ...(fallback ? { fallback } : {}) }, null, 2));
                 return;
             }
-            for (const line of formatServiceSet(result))
-                console.log(line);
+            const fallbackLines = formatFallbackStatus(paths);
+            if (fallbackLines)
+                for (const line of fallbackLines)
+                    console.log(line);
+            else
+                for (const line of formatServiceSet(result))
+                    console.log(line);
         }
         catch (err) {
             fail(err);
@@ -227,11 +309,15 @@ export function registerAgentKitCommand(agent) {
         .action((opts) => {
         try {
             const paths = agentKitPaths(os.homedir(), process.env);
+            const fallback = stopFallback(paths);
             const result = uninstallServices(kitServiceSpecs(paths), resolveServiceHost(paths));
             if (opts.json) {
-                console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+                console.log(JSON.stringify({ ok: true, ...result, fallback }, null, 2));
                 return;
             }
+            if (fallback.pid !== null) {
+                console.log(`  fallback supervisor pid ${fallback.pid} ${fallback.killed ? "stopped" : "was not running"}; pidfile removed`);
+            }
             console.log(chalk.green("HQ agent kit services removed."));
             for (const line of formatServiceSet(result))
                 console.log(line);
@@ -242,10 +328,21 @@ export function registerAgentKitCommand(agent) {
     });
     kit
         .command("run <service>")
-        .description(`Run one kit service in the foreground (${KIT_SERVICES.join("|")})`)
+        .description(`Run one kit service in the foreground (${KIT_SERVICES.join("|")}), or \`all\` to supervise every service in one process`)
         .action(async (service) => {
+        if (service === "all") {
+            try {
+                const paths = agentKitPaths(os.homedir(), process.env);
+                const rt = buildKitRuntime("all");
+                await runAllKitServices(rt, resolveServiceHost(paths));
+                process.exit(0);
+            }
+            catch (err) {
+                fail(err);
+            }
+        }
         if (!isKitService(service)) {
-            console.error(chalk.red(`Unknown kit service "${service}". Expected one of: ${KIT_SERVICES.join(", ")}`));
+            console.error(chalk.red(`Unknown kit service "${service}". Expected one of: all, ${KIT_SERVICES.join(", ")}`));
             process.exit(1);
         }
         try {

package/dist/commands/agent-probe.d.ts

@@ -4,9 +4,14 @@
  *
  *   whoami       mint as the machine identity; token names this agent
  *   team-sync    `hq sync pull --all` succeeds and the company folder exists
- *   work-mesh    realtime credentials vend for this agent and the roster row
- *                shows presence online/stale (heartbeat landed)
- *   dm           send a DM to self via the notify surface and read it back
+ *   work-mesh    the personal (contract-2) realtime vend names this agent, the
+ *                agent-authorized inbox route answers 200, and this host's own
+ *                presence is live: a fresh last-heartbeat.json plus an ok
+ *                component-mesh stamp from the doorbell listener. (The company
+ *                roster route is owner/admin-only and 404s for agt_ callers.)
+ *   dm           send a DM to self via POST /v1/notify/dm and read it back
+ *                through GET /v1/agents/{uid}/inbox (the agent read surface;
+ *                /v1/notify/thread is intentionally closed to agents)
  *   secrets      `GET /secrets/{companyUid}` answers 200
  *
  * Output is the exact shape the console recipes promise: one
@@ -18,6 +23,7 @@
  * the kit's last heartbeat.
  */
 import { Command } from "commander";
+import { type InboxFetchResult } from "../lib/agent-kit/run/inbox.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
 import type { ExternalMachineCreds } from "../lib/agent-kit/creds.js";
 export interface ProbeCheck {
@@ -34,6 +40,8 @@ export interface ProbeResult {
 }
 export declare const DM_ROUNDTRIP_TIMEOUT_MS = 20000;
 export declare const DM_ROUNDTRIP_POLL_MS = 2000;
+/** A heartbeat older than this does not count as live presence (3 missed 60 s beats). */
+export declare const PRESENCE_FRESH_SECONDS = 180;
 export interface ProbeDeps {
     paths: AgentKitPaths;
     creds: ExternalMachineCreds;
@@ -44,11 +52,9 @@ export interface ProbeDeps {
     vendRealtime: (token: string) => Promise<{
         actorUid: string;
     }>;
-    listRoster: (token: string, companyUid: string) => Promise<Array<Record<string, unknown>>>;
+    /** GET /v1/agents/{self}/inbox — agent-authorized, self-scoped. */
+    readInbox: (token: string) => Promise<InboxFetchResult>;
     sendDm: (token: string, toUid: string, body: string) => Promise<void>;
-    readThread: (token: string, withUid: string) => Promise<Array<{
-        body: string;
-    }>>;
     listSecrets: (token: string, companyUid: string) => Promise<number>;
     postResult: (token: string, result: ProbeResult) => Promise<number>;
     now?: () => Date;
@@ -58,6 +64,8 @@ export interface ProbeDeps {
 }
 export declare function heartbeatAgeSeconds(paths: Pick<AgentKitPaths, "lastHeartbeatPath">, now?: () => Date): number | null;
 export declare function runProbe(deps: ProbeDeps): Promise<ProbeResult>;
+/** True when any inbox item (whatever its channel shape) carries the nonce. */
+export declare function inboxContainsNonce(body: unknown, nonce: string): boolean;
 export declare function formatHeartbeatAge(age: number | null): string;
 /**
  * Recipe contract: `PASS  <check>  <detail>` / `FAIL  <check>  <detail>` per