@indigoai-us/hq-cli 5.140.0 → 5.141.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.141.0] — 2026-09-23
+
+- `hq bot jobs` now checks the bot's configured agent ID against the machine credential before calling the jobs API. A mismatch reports both IDs and explains how to fix the bot configuration or re-mint its credentials.
+
 ## [5.140.0] — 2026-09-23
 
 ### Fixed

package/dist/commands/bot-jobs.js

@@ -20,6 +20,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { BotApi, BotApiError } from "../lib/bot/api.js";
 import { effectiveBotKind } from "../lib/bot/config.js";
+import { identityMismatchMessage, tokenAgentUid } from "../lib/heartbeat-identity.js";
 // ─── Schedule translation ────────────────────────────────────────────────────
 /** Mirrors hq-pro-agents `MIN_RECURRING_INTERVAL_SECONDS`. */
 export const MIN_RECURRING_INTERVAL_SECONDS = 5 * 60;
@@ -363,10 +364,19 @@ export async function runBotJobs(nameArg, opts, deps) {
     const { name, dir, config } = deps.requireBot(nameArg);
     const kind = effectiveBotKind(config);
     const out = deps.out ?? ((line) => console.log(line));
-    const api = deps.apiFor
-        ? deps.apiFor(dir)
-        : new BotApi({ token: deps.botTokenSupplier(dir) });
     const ctx = { botName: name, kind };
+    let client;
+    const jobsApi = async () => {
+        if (client)
+            return client;
+        const token = await deps.botTokenSupplier(dir)();
+        const tokenUid = tokenAgentUid(token);
+        if (tokenUid && tokenUid !== config.agentUid) {
+            refuse(identityMismatchMessage("bot jobs", config.agentUid, tokenUid));
+        }
+        client = deps.apiFor ? deps.apiFor(dir) : new BotApi({ token: async () => token });
+        return client;
+    };
     if (opts.add !== undefined && opts.rm !== undefined) {
         refuse("Add a job or remove one, not both in the same command.");
     }
@@ -374,6 +384,7 @@ export async function runBotJobs(nameArg, opts, deps) {
         const jobId = opts.rm.trim();
         if (!jobId)
             refuse("Say which job to remove: --rm <jobId>");
+        const api = await jobsApi();
         try {
             await api.cancelJob(config.agentUid, jobId);
         }
@@ -395,6 +406,7 @@ export async function runBotJobs(nameArg, opts, deps) {
             ? parse(opts.every, { hqRoot: config.hqRoot, timezone })
             : { cron: opts.cron, timezone };
         const body = buildCreateJobBody({ prompt: opts.add, cron: schedule.cron, timezone: schedule.timezone });
+        const api = await jobsApi();
         let created;
         try {
             created = await api.createJob(config.agentUid, body);
@@ -414,6 +426,7 @@ export async function runBotJobs(nameArg, opts, deps) {
         return;
     }
     let jobs;
+    const api = await jobsApi();
     try {
         jobs = await api.listJobs(config.agentUid);
     }

package/dist/lib/agent-kit/run/heartbeat.js

@@ -14,7 +14,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import { CLI_VERSION } from "../../../cli-version.js";
-import { captureHeartbeatIdentityMismatch, isHeartbeatIdentityMismatch, parseHeartbeatFailureBody, tokenAgentUid, } from "../../heartbeat-identity.js";
+import { captureHeartbeatIdentityMismatch, identityMismatchMessage, isHeartbeatIdentityMismatch, parseHeartbeatFailureBody, tokenAgentUid, } from "../../heartbeat-identity.js";
 import { vaultApiFetch } from "../../../utils/vault-api.js";
 import { readComponentStatus } from "../creds.js";
 import { KIT_COMPONENTS } from "../paths.js";
@@ -90,7 +90,7 @@ async function beatOnceResult(deps) {
                     ...(tokenUid ? { tokenAgentUid: tokenUid } : {}),
                 });
                 const tokenLabel = tokenUid ?? "unknown";
-                deps.log("warn", `heartbeat stopped: identity mismatch configured agentUid=${deps.agentUid} token agentUid=${tokenLabel}`);
+                deps.log("warn", identityMismatchMessage("heartbeat", deps.agentUid, tokenLabel));
                 (deps.reportIdentityMismatch ?? captureHeartbeatIdentityMismatch)({
                     runner: "agent-kit",
                     configuredAgentUid: deps.agentUid,

package/dist/lib/bot/run.js

@@ -69,7 +69,7 @@ import { buildJobTurnPrompt, isCatchUpRun, isJobItem, jobReportHeader, jobRunOut
 import { clearPendingJobCompletion, isCompletionDue, isCompletionExpired, isCompletionForOtherAgent, readPendingJobCompletions, recordPendingJobCompletion } from "./job-completions.js";
 import { isRuntimeSignInFailure, SIGN_IN_RETRY_MS, signInNeededText } from "./runtime-sign-in.js";
 import { HQ_BOT_AGENT_UID_ENV } from "../../commands/onboard-bot-membership.js";
-import { captureHeartbeatIdentityMismatch, isHeartbeatIdentityMismatch, } from "../heartbeat-identity.js";
+import { captureHeartbeatIdentityMismatch, identityMismatchMessage, isHeartbeatIdentityMismatch, } from "../heartbeat-identity.js";
 import { clearBotSession, readBotSession, writeBotSession } from "./session.js";
 import { defaultBotStatus, patchBotStatus, readBotStatus } from "./status.js";
 export const INBOX_POLL_INTERVAL_MS = 2_000;
@@ -459,7 +459,7 @@ export async function runBot(deps) {
                 if (err instanceof BotApiError &&
                     isHeartbeatIdentityMismatch({ status: err.status, code: err.code, message: err.detail })) {
                     const tokenLabel = err.tokenAgentUid ?? "unknown";
-                    const reason = `heartbeat stopped: identity mismatch configured agentUid=${config.agentUid} token agentUid=${tokenLabel}`;
+                    const reason = identityMismatchMessage("heartbeat", config.agentUid, tokenLabel);
                     setStatus({
                         lastHeartbeatOk: false,
                         lastHeartbeatError: reason.slice(0, 400),

package/dist/lib/heartbeat-identity.d.ts

@@ -1,5 +1,6 @@
 import type { CaptureContext } from "@sentry/node";
 export declare const HEARTBEAT_IDENTITY_MISMATCH_CODE = "AGENT_IDENTITY_MISMATCH";
+export declare function identityMismatchMessage(surface: "heartbeat" | "bot jobs", configuredAgentUid: string, tokenAgentUid?: string): string;
 export type HeartbeatRunner = "agent-kit" | "bot";
 export type HeartbeatAgentUidSource = "config_file" | "env" | "flag";
 export type HeartbeatCredsSource = "explicit" | "default";

package/dist/lib/heartbeat-identity.js

@@ -2,6 +2,11 @@ import { CLI_VERSION } from "../cli-version.js";
 import { Sentry } from "../sentry.js";
 import { peekIdToken } from "../utils/id-token.js";
 export const HEARTBEAT_IDENTITY_MISMATCH_CODE = "AGENT_IDENTITY_MISMATCH";
+export function identityMismatchMessage(surface, configuredAgentUid, tokenAgentUid) {
+    return (`${surface} stopped: identity mismatch configured agentUid=${configuredAgentUid} ` +
+        `token agentUid=${tokenAgentUid ?? "unknown"}; fix the bot config to use the token agentUid, ` +
+        `or re-mint credentials for the configured agentUid.`);
+}
 const AGENT_UID_RE = /^agt_[A-Za-z0-9_-]{1,100}$/;
 function normalize(value) {
     return (value ?? "").replace(/[^A-Za-z0-9]/g, "").toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.140.0",
+  "version": "5.141.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {