@indigoai-us/hq-cli 5.117.0 → 5.117.2

package/CHANGELOG.md

@@ -2,6 +2,58 @@
 
 ## [Unreleased]
 
+## [5.117.2] — 2026-09-16
+
+### Fixed
+
+- External agents: the work-mesh listener no longer fails every refresh with
+  "Agent callers may only use DM, channel comms, and reaction routes". It now
+  re-reads the agent's own inbox on each doorbell instead of the person-only
+  conversation routes.
+- External agents: `hq agent probe` no longer waits for a DM to itself to show up
+  in the inbox, which the server never delivers. The dm check passes when the
+  send is accepted and the agent inbox is readable.
+- External agents: kit service logs no longer write every line twice when the
+  services run under a supervisor.
+
+### Changed
+
+- HQ now calls the paid plan by its real name everywhere you see it. If your
+  workspace went over its Starter limit, the notice, the error you got when you
+  tried to write something, and the upgrade prompt used to give three different
+  names for the same plan — "HQ Workforce", "HQ Team", and "Team" — which made
+  it genuinely unclear what you were being asked to buy. They all say HQ
+  Workforce now. The free plan is called Starter rather than "free plan", to
+  match the pricing page.
+
+## [5.117.1] — 2026-09-16
+
+### Fixed
+
+- `hq agent probe` works for external agents. The work-mesh check no longer
+  reads the owner-only company roster (which answered "Not found" to an agent);
+  it passes when the realtime credential vend names the agent, the agent's own
+  inbox answers, and this host's heartbeat and mesh listener are live. The DM
+  check reads the probe message back from the agent's inbox instead of the
+  human-only thread view that refused agents. Output format is unchanged.
+- The agent kit's mesh listener stays connected. It now asks for the personal
+  realtime credentials that cover the agent's own doorbell topics (the company
+  presence credentials it used made the connection drop before subscribing),
+  subscribes only to topics those credentials grant, and polls the inbox
+  immediately when an inbox doorbell rings.
+- Inbox poll failures are diagnosable: the log names the method, full URL,
+  status and the first 300 characters of the response, and the inbox URL keeps
+  any base path from `apiBaseUrl` without doubling `/v1`.
+- `hq dm inbox` works for agent identities by reading the agent inbox;
+  `hq dm thread` tells agents to use `hq dm inbox` instead of failing with a
+  server refusal.
+- `hq agent kit install` works on hosts with no systemd user session or
+  launchd: it starts the services under one background `hq agent kit run all`
+  supervisor (restarting any service that exits), records its pid in
+  `~/.hq-agent/kit.pid`, and prints the `@reboot` crontab line that keeps it
+  running after a restart. `kit status` and `kit uninstall` understand this
+  mode.
+
 ## [5.117.0] — 2026-09-16
 
 ### Added

package/assets/bot-workers/setup/context/USER-GUIDE.md

@@ -109,9 +109,9 @@ Structured storage for agent and app state — not a replacement for markdown kn
 | `hq db status --company {co}` | Create/open local SQLite at `~/.hq/db/{co}/vault.db` (WAL) |
 | `hq db sql --company {co} -- 'SELECT …'` | Query the company local DB (read-only by default) |
 | `hq db migrate --company {co} --hq-root {HQ}` | Apply reviewable SQL under `companies/{co}/db/migrations/` |
-| `hq db provision --company {co}` | Remote DB on **HQ Team** plan only (secrets never printed) |
+| `hq db provision --company {co}` | Remote DB on **HQ Workforce** ($500/mo) or Enterprise only (secrets never printed) |
 
-Use local for single-machine agent skills and implementer standards. Use Team remote for multi-machine shared data and deploy SecretBinding. Never commit `*.db` files into the vault tree.
+Use local for single-machine agent skills and implementer standards. Use the remote DB for multi-machine shared data and deploy SecretBinding. Never commit `*.db` files into the vault tree.
 
 ### HQ CLI: Direct messages (`hq dm`)
 
@@ -318,6 +318,47 @@ HQ/
     └── threads/               # Session threads + handoff.json
 ```
 
+## Plans and limits
+
+HQ has three plans: **Starter**, **HQ Workforce** ($500/month per workspace), and
+**Enterprise**.
+
+Starter is free. It holds up to 5 members, and it does not include integrations
+or MCP, Atlas, or telemetry. Everything else — knowledge, projects, policies,
+workers, secrets, vault storage, `hq deploy`, and `hq share` — works the same as
+on the paid plans.
+
+### When a workspace goes over
+
+A Starter workspace locks as soon as it goes over 5 members. There is no grace
+period and no countdown.
+
+A locked workspace is read-only. Nothing is deleted or hidden, and everyone can
+still read everything. Writes are refused until the workspace is back inside the
+limits.
+
+There are two ways out, and only the workspace owner can do either:
+
+1. Remove members until there are 5 or fewer. Removing someone from a workspace
+   does not delete their personal HQ or the work they saved into the workspace.
+2. Upgrade to HQ Workforce at $500/month from the workspace billing page.
+
+Either one unlocks the workspace right away.
+
+Existing integration connections on a locked Starter workspace are disabled, not
+deleted. Upgrading turns them back on without reconnecting anything.
+
+### What you'll see
+
+The owner gets one email when the workspace locks, a reminder at most once every
+7 days while it stays locked, and one confirmation when it unlocks. Billing mail
+comes from billing@hqforwork.com, and billing links go to hq.computer, which is
+the console.
+
+In the console you'll see a lock banner, an upgrade wall, and a team roster that
+counts members against the limit. In a Claude Code session, `/startwork` shows a
+short notice on every turn while the workspace is over its limits.
+
 ## Meeting notes, signals & ontology
 
 HQ captures these **natively, per company** — check HQ first, not your email or a third-party notetaker.
@@ -334,7 +375,7 @@ HQ captures these **natively, per company** — check HQ first, not your email o
 
 **Your preference for "meeting notes":** defaults to HQ-native. To point a company at email instead, set `meeting_notes_source: email` in `companies/{co}/settings/knowledge/preferences.yaml` (global default lives in `personal/settings/knowledge-preferences.yaml`).
 
-> Signals extraction and the ontology gardener run on HQ cloud and will require HQ Pro once billing ships. Billing isn't live yet — today these are provisioned per-company when you cloud-back it via `/designate-team`. Reference: `core/knowledge/public/hq-core/native-knowledge-stores.md`.
+> Signals extraction and the ontology gardener run on HQ cloud and are part of HQ Workforce ($500/mo) and Enterprise. They are not included in the free Starter plan. Cloud-back a company with `/designate-team` to turn them on. Reference: `core/knowledge/public/hq-core/native-knowledge-stores.md`.
 
 ## Typical Session
 

package/assets/bot-workers/setup/context/quick-reference.md

@@ -148,7 +148,7 @@ Share-session URLs are encrypted single-use 15-minute capabilities — never per
 
 ## CLI: `hq db` (vault databases)
 
-Local SQLite per company (always) + optional remote Postgres-class on **HQ Team** ($500/mo). Guide: `core/knowledge/public/hq-core/vault-databases.md`. Requires `@indigoai-us/hq-cli` ≥ 5.62.0.
+Local SQLite per company (always, Starter included) + optional remote Postgres-class on **HQ Workforce** ($500/mo) or Enterprise. Guide: `core/knowledge/public/hq-core/vault-databases.md`. Requires `@indigoai-us/hq-cli` ≥ 5.62.0.
 
 | Command | Use |
 |---------|-----|

package/dist/command-catalog.generated.d.ts

@@ -800,6 +800,9 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly options: readonly [{
         readonly flags: "--json";
         readonly description: "Output identity metadata as JSON (never tokens)";
+    }, {
+        readonly flags: "--company <slug>";
+        readonly description: "Also report this company's workspace plan state (Starter lock)";
     }];
     readonly subcommands: readonly [];
 }, {
@@ -1276,7 +1279,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "provision";
-        readonly description: "Provision (or re-bind) the company remote vault DB via HQ control plane (Team plan)";
+        readonly description: "Provision (or re-bind) the company remote vault DB via HQ control plane (HQ Workforce plan)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options]";
@@ -4217,7 +4220,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly subcommands: readonly [];
         }, {
             readonly name: "run";
-            readonly description: "Run one kit service in the foreground (sync|mesh|inbox|heartbeat)";
+            readonly description: "Run one kit service in the foreground (sync|mesh|inbox|heartbeat), or `all` to supervise every service in one process";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly usage: "[options] <service>";
@@ -4603,7 +4606,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "upgrade";
-        readonly description: "Open Stripe Checkout to upgrade this company to HQ Team ($500/mo)";
+        readonly description: "Open Stripe Checkout to upgrade this company to HQ Workforce ($500/mo)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options]";

package/dist/command-catalog.generated.js

@@ -1021,6 +1021,10 @@ export const COMMAND_CATALOG = [
             {
                 "flags": "--json",
                 "description": "Output identity metadata as JSON (never tokens)"
+            },
+            {
+                "flags": "--company <slug>",
+                "description": "Also report this company's workspace plan state (Starter lock)"
             }
         ],
         "subcommands": []
@@ -1628,7 +1632,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "provision",
-                "description": "Provision (or re-bind) the company remote vault DB via HQ control plane (Team plan)",
+                "description": "Provision (or re-bind) the company remote vault DB via HQ control plane (HQ Workforce plan)",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options]",
@@ -5455,7 +5459,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "name": "run",
-                        "description": "Run one kit service in the foreground (sync|mesh|inbox|heartbeat)",
+                        "description": "Run one kit service in the foreground (sync|mesh|inbox|heartbeat), or `all` to supervise every service in one process",
                         "aliases": [],
                         "hidden": false,
                         "usage": "[options] <service>",
@@ -5951,7 +5955,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "upgrade",
-                "description": "Open Stripe Checkout to upgrade this company to HQ Team ($500/mo)",
+                "description": "Open Stripe Checkout to upgrade this company to HQ Workforce ($500/mo)",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options]",

package/dist/commands/agent-kit.d.ts

@@ -10,7 +10,10 @@
  * `install` renders one user-level unit per service (LaunchAgent on macOS,
  * systemd --user on Linux), each of which just runs
  * `node hq agent kit run <service>`; the Docker image runs the same four
- * commands. Logs: ~/.hq-agent/logs/<service>.log. Skills:
+ * commands. Hosts where the service manager is unusable (no systemd user
+ * session bus, permission refused, launchd unavailable) fall back to one
+ * detached `hq agent kit run all` supervisor (pid in ~/.hq-agent/kit.pid,
+ * output in ~/.hq-agent/logs/kit.log). Logs: ~/.hq-agent/logs/<service>.log. Skills:
  * ~/.hq-agent/skills/<name>/SKILL.md.
  */
 import { Command } from "commander";
@@ -19,6 +22,7 @@ import { type KitConfig } from "../lib/agent-kit/kit-config.js";
 import { type KitLogger } from "../lib/agent-kit/log.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
 import { type KitService } from "../lib/agent-kit/services.js";
+import { type DetachedSpawn, type KillFn } from "../lib/agent-kit/fallback.js";
 import { type ServiceHostPaths, type ServiceManagerDeps, type ServiceSetResult } from "../lib/service-manager/index.js";
 export declare class KitError extends Error {
     constructor(message: string);
@@ -32,12 +36,25 @@ export interface KitInstallOptions {
     inboxAck?: boolean;
     activate?: boolean;
 }
+export interface KitFallbackInfo {
+    mode: "fallback";
+    pid: number;
+    pidFile: string;
+    logPath: string;
+    /** Add to `crontab -e` so the supervisor survives a reboot. */
+    crontab: string;
+}
 export interface KitInstallResult {
     config: KitConfig;
     skills: string[];
     services: ServiceSetResult;
+    fallback?: KitFallbackInfo;
+}
+export interface KitFallbackDeps {
+    spawn?: DetachedSpawn;
+    kill?: KillFn;
 }
-export declare function installKit(paths: AgentKitPaths, opts: KitInstallOptions, host: ServiceHostPaths, deps?: ServiceManagerDeps): KitInstallResult;
+export declare function installKit(paths: AgentKitPaths, opts: KitInstallOptions, host: ServiceHostPaths, deps?: ServiceManagerDeps, fallbackDeps?: KitFallbackDeps): KitInstallResult;
 export declare function formatServiceSet(result: ServiceSetResult): string[];
 /** Shared runtime for `kit run <service>`. */
 export interface KitRuntime {
@@ -47,7 +64,10 @@ export interface KitRuntime {
     getToken: () => Promise<string>;
     log: KitLogger;
 }
-export declare function buildKitRuntime(service: KitService): KitRuntime;
+export declare function buildKitRuntime(service: KitService | "all"): KitRuntime;
 export declare function runKitService(service: KitService, rt: KitRuntime): Promise<void>;
+/** `kit run all`: supervise the four services as child processes with restart backoff. */
+export declare function runAllKitServices(rt: KitRuntime, host: ServiceHostPaths): Promise<void>;
+export declare function formatFallbackStatus(paths: AgentKitPaths, kill?: KillFn): string[] | null;
 export declare function registerAgentKitCommand(agent: Command): void;
 //# sourceMappingURL=agent-kit.d.ts.map

package/dist/commands/agent-kit.js

@@ -10,7 +10,10 @@
  * `install` renders one user-level unit per service (LaunchAgent on macOS,
  * systemd --user on Linux), each of which just runs
  * `node hq agent kit run <service>`; the Docker image runs the same four
- * commands. Logs: ~/.hq-agent/logs/<service>.log. Skills:
+ * commands. Hosts where the service manager is unusable (no systemd user
+ * session bus, permission refused, launchd unavailable) fall back to one
+ * detached `hq agent kit run all` supervisor (pid in ~/.hq-agent/kit.pid,
+ * output in ~/.hq-agent/logs/kit.log). Logs: ~/.hq-agent/logs/<service>.log. Skills:
  * ~/.hq-agent/skills/<name>/SKILL.md.
  */
 import chalk from "chalk";
@@ -25,7 +28,11 @@ import { agentKitPaths } from "../lib/agent-kit/paths.js";
 import { isKitService, KIT_SERVICES, kitServiceSpecs, } from "../lib/agent-kit/services.js";
 import { writeKitSkills } from "../lib/agent-kit/skills.js";
 import { runHeartbeatLoop } from "../lib/agent-kit/run/heartbeat.js";
-import { runInboxLoop } from "../lib/agent-kit/run/inbox.js";
+import { pollInboxOnce, runInboxLoop } from "../lib/agent-kit/run/inbox.js";
+import { superviseKitServices } from "../lib/agent-kit/run/supervisor.js";
+import { fallbackStatus, rebootCrontabLine, shouldUseFallback, startFallback, stopFallback, } from "../lib/agent-kit/fallback.js";
+import { serviceLogPath } from "../lib/agent-kit/paths.js";
+import { spawn } from "node:child_process";
 import { startMeshListener } from "../lib/agent-kit/run/mesh-listener.js";
 import { runSyncLoop } from "../lib/agent-kit/run/sync.js";
 import { resolveHqBinary, resolveNodeBinary, } from "../lib/mesh/live/daemon/install.js";
@@ -57,7 +64,7 @@ export function resolveServiceHost(paths) {
         hqBinary: resolveHqBinary(),
     };
 }
-export function installKit(paths, opts, host, deps = {}) {
+export function installKit(paths, opts, host, deps = {}, fallbackDeps = {}) {
     requireExternalCreds(paths);
     ensureKitDirs(paths);
     const existing = fs.existsSync(paths.kitConfigPath)
@@ -72,10 +79,20 @@ export function installKit(paths, opts, host, deps = {}) {
     fs.mkdirSync(config.hqRoot, { recursive: true, mode: 0o700 });
     writeKitConfig(paths, config);
     const skills = writeKitSkills(paths);
+    const activate = opts.activate ?? deps.activate ?? true;
     const services = installServices(kitServiceSpecs(paths), host, {
         ...deps,
-        activate: opts.activate ?? deps.activate ?? true,
+        activate,
     });
+    if (shouldUseFallback(services, activate)) {
+        const started = startFallback(paths, host, fallbackDeps);
+        return {
+            config,
+            skills,
+            services,
+            fallback: { mode: "fallback", ...started, crontab: rebootCrontabLine(paths, host) },
+        };
+    }
     return { config, skills, services };
 }
 export function formatServiceSet(result) {
@@ -107,7 +124,7 @@ export function buildKitRuntime(service) {
     process.env.HQ_MACHINE_CREDS_FILE = paths.machineCredsPath;
     process.env.HQ_REQUIRE_MACHINE_IDENTITY = "1";
     process.env.HQ_VAULT_API_URL = creds.apiBaseUrl;
-    const log = createKitLogger(paths, service, { echo: true });
+    const log = createKitLogger(paths, service, { echo: process.stdout.isTTY === true });
     const getToken = () => ensureCognitoToken({ tokenSource: "machine", interactive: false });
     return { paths, creds, config, getToken, log };
 }
@@ -151,6 +168,31 @@ export async function runKitService(service, rt) {
                 refreshMs: rt.config.meshRefreshMs,
                 getToken: rt.getToken,
                 log: rt.log,
+                // Any doorbell (and the periodic refresh) re-polls the agent inbox, the
+                // only conversation source agent callers are authorized to read.
+                refetch: async () => {
+                    const r = await pollInboxOnce({
+                        paths: rt.paths,
+                        agentUid: rt.creds.entityUid,
+                        apiBaseUrl: rt.creds.apiBaseUrl,
+                        pollMs: rt.config.inboxPollMs,
+                        ack: rt.config.inboxAck,
+                        getToken: rt.getToken,
+                        log: rt.log,
+                    });
+                    if (!r.ok)
+                        throw new Error("agent inbox poll failed; see inbox.log");
+                },
+                // An inbox doorbell means "poll now" rather than waiting for the loop.
+                onInboxDoorbell: () => pollInboxOnce({
+                    paths: rt.paths,
+                    agentUid: rt.creds.entityUid,
+                    apiBaseUrl: rt.creds.apiBaseUrl,
+                    pollMs: rt.config.inboxPollMs,
+                    ack: rt.config.inboxAck,
+                    getToken: rt.getToken,
+                    log: rt.log,
+                }),
             });
             const stop = () => {
                 void handle.stop().then(() => process.exit(0));
@@ -164,6 +206,45 @@ export async function runKitService(service, rt) {
         }
     }
 }
+/** `kit run all`: supervise the four services as child processes with restart backoff. */
+export async function runAllKitServices(rt, host) {
+    rt.log("info", `supervisor starting ${KIT_SERVICES.join(",")} agent=${rt.creds.entityUid} cli=${CLI_VERSION}`);
+    const handle = superviseKitServices({
+        services: KIT_SERVICES,
+        log: rt.log,
+        spawnService: (service) => {
+            const fd = fs.openSync(serviceLogPath(rt.paths, service), "a", 0o600);
+            try {
+                return spawn(host.nodeBinary, [host.hqBinary, "agent", "kit", "run", service], {
+                    stdio: ["ignore", fd, fd],
+                    env: process.env,
+                    cwd: rt.paths.agentDir,
+                });
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        },
+    });
+    await new Promise((resolve) => {
+        const stop = (signal) => {
+            rt.log("info", `supervisor stopping (${signal})`);
+            handle.stop("SIGTERM");
+            resolve();
+        };
+        process.once("SIGTERM", () => stop("SIGTERM"));
+        process.once("SIGINT", () => stop("SIGINT"));
+    });
+}
+export function formatFallbackStatus(paths, kill) {
+    const st = fallbackStatus(paths, kill);
+    if (!st)
+        return null;
+    const state = st.running
+        ? chalk.green(`running (pid ${st.pid})`)
+        : chalk.yellow(st.pid === null ? "pidfile unreadable" : `not running (stale pid ${st.pid})`);
+    return [`  mode: fallback supervisor (hq agent kit run all) ${state}${chalk.dim(`  ${st.pidFile}`)}`];
+}
 function fail(err) {
     console.error(chalk.red(err instanceof Error ? err.message : String(err)));
     process.exit(1);
@@ -191,9 +272,19 @@ export function registerAgentKitCommand(agent) {
             console.log(`  hq root:   ${result.config.hqRoot}`);
             console.log(`  logs:      ${paths.logsDir}`);
             console.log(`  skills:    ${paths.skillsDir} (${result.skills.length} skills)`);
-            console.log("  services:");
-            for (const line of formatServiceSet(result.services))
-                console.log(line);
+            if (result.fallback) {
+                console.log(chalk.yellow("  services: service manager unavailable — running in fallback mode " +
+                    `(hq agent kit run all, pid ${result.fallback.pid})`));
+                console.log(`  pidfile:   ${result.fallback.pidFile}`);
+                console.log(`  kit log:   ${result.fallback.logPath}`);
+                console.log("  To restart it after a reboot, add this line with `crontab -e`:");
+                console.log(`    ${result.fallback.crontab}`);
+            }
+            else {
+                console.log("  services:");
+                for (const line of formatServiceSet(result.services))
+                    console.log(line);
+            }
             console.log("");
             console.log("Next: hq agent probe");
         }
@@ -208,13 +299,19 @@ export function registerAgentKitCommand(agent) {
         .action((opts) => {
         try {
             const paths = agentKitPaths(os.homedir(), process.env);
+            const fallback = fallbackStatus(paths);
             const result = servicesStatus(kitServiceSpecs(paths), resolveServiceHost(paths));
             if (opts.json) {
-                console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+                console.log(JSON.stringify({ ok: true, ...result, ...(fallback ? { fallback } : {}) }, null, 2));
                 return;
             }
-            for (const line of formatServiceSet(result))
-                console.log(line);
+            const fallbackLines = formatFallbackStatus(paths);
+            if (fallbackLines)
+                for (const line of fallbackLines)
+                    console.log(line);
+            else
+                for (const line of formatServiceSet(result))
+                    console.log(line);
         }
         catch (err) {
             fail(err);
@@ -227,11 +324,15 @@ export function registerAgentKitCommand(agent) {
         .action((opts) => {
         try {
             const paths = agentKitPaths(os.homedir(), process.env);
+            const fallback = stopFallback(paths);
             const result = uninstallServices(kitServiceSpecs(paths), resolveServiceHost(paths));
             if (opts.json) {
-                console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+                console.log(JSON.stringify({ ok: true, ...result, fallback }, null, 2));
                 return;
             }
+            if (fallback.pid !== null) {
+                console.log(`  fallback supervisor pid ${fallback.pid} ${fallback.killed ? "stopped" : "was not running"}; pidfile removed`);
+            }
             console.log(chalk.green("HQ agent kit services removed."));
             for (const line of formatServiceSet(result))
                 console.log(line);
@@ -242,10 +343,21 @@ export function registerAgentKitCommand(agent) {
     });
     kit
         .command("run <service>")
-        .description(`Run one kit service in the foreground (${KIT_SERVICES.join("|")})`)
+        .description(`Run one kit service in the foreground (${KIT_SERVICES.join("|")}), or \`all\` to supervise every service in one process`)
         .action(async (service) => {
+        if (service === "all") {
+            try {
+                const paths = agentKitPaths(os.homedir(), process.env);
+                const rt = buildKitRuntime("all");
+                await runAllKitServices(rt, resolveServiceHost(paths));
+                process.exit(0);
+            }
+            catch (err) {
+                fail(err);
+            }
+        }
         if (!isKitService(service)) {
-            console.error(chalk.red(`Unknown kit service "${service}". Expected one of: ${KIT_SERVICES.join(", ")}`));
+            console.error(chalk.red(`Unknown kit service "${service}". Expected one of: all, ${KIT_SERVICES.join(", ")}`));
             process.exit(1);
         }
         try {

package/dist/commands/agent-probe.d.ts

@@ -4,9 +4,14 @@
  *
  *   whoami       mint as the machine identity; token names this agent
  *   team-sync    `hq sync pull --all` succeeds and the company folder exists
- *   work-mesh    realtime credentials vend for this agent and the roster row
- *                shows presence online/stale (heartbeat landed)
- *   dm           send a DM to self via the notify surface and read it back
+ *   work-mesh    the personal (contract-2) realtime vend names this agent, the
+ *                agent-authorized inbox route answers 200, and this host's own
+ *                presence is live: a fresh last-heartbeat.json plus an ok
+ *                component-mesh stamp from the doorbell listener. (The company
+ *                roster route is owner/admin-only and 404s for agt_ callers.)
+ *   dm           send a DM to self via POST /v1/notify/dm (accepted) and read the agent inbox (200)
+ *                through GET /v1/agents/{uid}/inbox (the agent read surface;
+ *                /v1/notify/thread is intentionally closed to agents)
  *   secrets      `GET /secrets/{companyUid}` answers 200
  *
  * Output is the exact shape the console recipes promise: one
@@ -18,6 +23,7 @@
  * the kit's last heartbeat.
  */
 import { Command } from "commander";
+import { type InboxFetchResult } from "../lib/agent-kit/run/inbox.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
 import type { ExternalMachineCreds } from "../lib/agent-kit/creds.js";
 export interface ProbeCheck {
@@ -32,8 +38,8 @@ export interface ProbeResult {
     /** Seconds since the kit's last successful heartbeat, or null if never. */
     heartbeatAgeSeconds: number | null;
 }
-export declare const DM_ROUNDTRIP_TIMEOUT_MS = 20000;
-export declare const DM_ROUNDTRIP_POLL_MS = 2000;
+/** A heartbeat older than this does not count as live presence (3 missed 60 s beats). */
+export declare const PRESENCE_FRESH_SECONDS = 180;
 export interface ProbeDeps {
     paths: AgentKitPaths;
     creds: ExternalMachineCreds;
@@ -44,11 +50,9 @@ export interface ProbeDeps {
     vendRealtime: (token: string) => Promise<{
         actorUid: string;
     }>;
-    listRoster: (token: string, companyUid: string) => Promise<Array<Record<string, unknown>>>;
+    /** GET /v1/agents/{self}/inbox — agent-authorized, self-scoped. */
+    readInbox: (token: string) => Promise<InboxFetchResult>;
     sendDm: (token: string, toUid: string, body: string) => Promise<void>;
-    readThread: (token: string, withUid: string) => Promise<Array<{
-        body: string;
-    }>>;
     listSecrets: (token: string, companyUid: string) => Promise<number>;
     postResult: (token: string, result: ProbeResult) => Promise<number>;
     now?: () => Date;
@@ -58,6 +62,8 @@ export interface ProbeDeps {
 }
 export declare function heartbeatAgeSeconds(paths: Pick<AgentKitPaths, "lastHeartbeatPath">, now?: () => Date): number | null;
 export declare function runProbe(deps: ProbeDeps): Promise<ProbeResult>;
+/** True when any inbox item (whatever its channel shape) carries the nonce. */
+export declare function inboxContainsNonce(body: unknown, nonce: string): boolean;
 export declare function formatHeartbeatAge(age: number | null): string;
 /**
  * Recipe contract: `PASS  <check>  <detail>` / `FAIL  <check>  <detail>` per