@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/lib/bot/paths.js

@@ -0,0 +1,131 @@
+/**
+ * Local bot on-disk layout (local-bots US-003/US-005).
+ *
+ *   ~/.hq/bots/<name>/
+ *     bot.json            config (name, agt_ uid, owner, runtime, hqRoot)
+ *     memory/             the bot's memory when created with --memory local
+ *     machine-creds.json  0600 Cognito machine creds (never printed)
+ *     token-state/        per-bot machine token cache (HQ_MACHINE_TOKEN_STATE_DIR)
+ *     status.json         pid, state, restarts, last heartbeat
+ *     inbox-state.json    processed messageIds (idempotency across restarts)
+ *     session.json        model-CLI session id for the owner DM
+ *     session-dm-<hexPeerUid>.json  one session per other DM correspondent
+ *     session-room-<channelId>.json  one session per room the bot answers in
+ *     session-job-<jobId>.json       one session per scheduled job the bot runs
+ *     job-completions.json  run completions the cloud has not accepted yet
+ *     pid                 single-file pid lock
+ *     logs/bot.log        rotated at 5MB
+ *
+ * Injectable root (HQ_BOTS_ROOT) so tests never touch the real HOME.
+ */
+import * as os from "node:os";
+import * as path from "node:path";
+export const BOTS_DIRNAME = "bots";
+export const BOT_CONFIG_NAME = "bot.json";
+export const BOT_CREDS_NAME = "machine-creds.json";
+export const BOT_STATUS_NAME = "status.json";
+export const BOT_INBOX_STATE_NAME = "inbox-state.json";
+export const BOT_SESSION_NAME = "session.json";
+export const BOT_TOKEN_STATE_DIRNAME = "token-state";
+export const BOT_LOGS_DIRNAME = "logs";
+export const BOT_LOG_NAME = "bot.log";
+export const BOT_LOG_MAX_BYTES = 5 * 1024 * 1024;
+export const LAUNCHD_LABEL_PREFIX = "ai.getindigo.hq-bot";
+/** Lowercase slug: letters, digits, single hyphens; 1–40 chars. */
+const BOT_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
+export function isValidBotName(name) {
+    return BOT_NAME_RE.test(name) && !name.includes("--");
+}
+export function validateBotName(name) {
+    const trimmed = (name ?? "").trim();
+    if (!isValidBotName(trimmed)) {
+        throw Object.assign(new Error(`Invalid bot name "${name}": use 1–40 lowercase letters, digits, and single hyphens (e.g. "assistant", "scout-2").`), { expected: true });
+    }
+    return trimmed;
+}
+export function botsRoot(home = os.homedir(), env = process.env) {
+    const override = env.HQ_BOTS_ROOT?.trim();
+    if (override)
+        return override;
+    return path.join(home, ".hq", BOTS_DIRNAME);
+}
+export function botDir(name, root) {
+    return path.join(root ?? botsRoot(), name);
+}
+export function botConfigPath(dir) {
+    return path.join(dir, BOT_CONFIG_NAME);
+}
+export function botCredsPath(dir) {
+    return path.join(dir, BOT_CREDS_NAME);
+}
+export function botStatusPath(dir) {
+    return path.join(dir, BOT_STATUS_NAME);
+}
+export function botInboxStatePath(dir) {
+    return path.join(dir, BOT_INBOX_STATE_NAME);
+}
+/** Preserve the owner session; keep every other correspondent separate. */
+export function dmSessionScope(peerUid, ownerUid) {
+    return peerUid === ownerUid ? "dm" : `dm:${peerUid}`;
+}
+export function roomSessionScope(channelId) {
+    return `room:${channelId}`;
+}
+/**
+ * One session per scheduled job. A job turn must never resume the owner's DM
+ * conversation (a scheduled run is not a reply), and two different jobs must
+ * not share a session either — each recurring routine keeps its own history.
+ */
+export function jobSessionScope(jobId) {
+    return `job:${jobId}`;
+}
+export function botSessionPath(dir, scope = "dm") {
+    if (scope === "dm")
+        return path.join(dir, BOT_SESSION_NAME);
+    if (scope.startsWith("dm:"))
+        return path.join(dir, `session-dm-${Buffer.from(scope.slice(3)).toString("hex")}.json`);
+    if (scope.startsWith("job:")) {
+        const jobId = scope.slice("job:".length).replace(/[^A-Za-z0-9_-]/g, "_");
+        return path.join(dir, `session-job-${jobId}.json`);
+    }
+    const channelId = scope.slice("room:".length).replace(/[^A-Za-z0-9_-]/g, "_");
+    return path.join(dir, `session-room-${channelId}.json`);
+}
+export function botTokenStateDir(dir) {
+    return path.join(dir, BOT_TOKEN_STATE_DIRNAME);
+}
+/**
+ * Scratch working directory for model turns. Deliberately OUTSIDE the HQ git
+ * tree: Claude/Grok/Codex scan the working tree on every turn, and HQ's tree
+ * (tens of thousands of entries, a huge `git status`) cost ~20 s per reply on
+ * 2026-09-11. The system prompt tells the bot where HQ is; it `cd`s there when
+ * a request needs the files or `hq` commands.
+ */
+export function botTurnCwd(dir) {
+    return path.join(dir, "cwd");
+}
+/** ~/.hq/bots/<name>/memory — "local" memory, outside the synced HQ tree. */
+export function botLocalMemoryDir(dir) {
+    return path.join(dir, "memory");
+}
+/**
+ * ~/.hq/bots/<name>/attachments — chat attachments the runner downloads for a
+ * turn (dir 0700, files 0600), one subfolder per vault scope.
+ */
+export function botAttachmentsDir(dir) {
+    return path.join(dir, "attachments");
+}
+export function botLogsDir(dir) {
+    return path.join(dir, BOT_LOGS_DIRNAME);
+}
+export function botLogPath(dir) {
+    return path.join(dir, BOT_LOGS_DIRNAME, BOT_LOG_NAME);
+}
+export function launchdLabel(name) {
+    return `${LAUNCHD_LABEL_PREFIX}.${name}`;
+}
+/** personal/workers/<name>/ relative to the HQ root. */
+export function botWorkerRelDir(name) {
+    return path.join("personal", "workers", name);
+}
+//# sourceMappingURL=paths.js.map

package/dist/lib/bot/progress.d.ts

@@ -0,0 +1,132 @@
+/**
+ * In-between messages for one bot turn.
+ *
+ * While the model works, each finished assistant message ("I'll look up the
+ * page first.", "Found it — publishing now.") is posted to the same place the
+ * final reply goes, instead of being held back and glued into one reply at the
+ * end. Rules:
+ *
+ * - whole messages only (the runtime parsers never pass deltas, reasoning,
+ *   tool arguments or tool results); empty text is skipped
+ * - messages arriving close together are joined with a blank line into one
+ *   post, and posts are spaced at least `minGapMs` apart
+ * - if nothing has been said `workingNoticeMs` into the turn, ONE short
+ *   "working on it" note goes out
+ * - the final answer is posted only when it adds something: text already
+ *   posted (or about to be) is never repeated, including Grok's final result
+ *   that is just every message concatenated
+ * - an in-between message that asks the person something (it has a "?") is
+ *   held, not posted: the model often asks, keeps working, then asks the same
+ *   thing again in its final answer, and the person read the question twice.
+ *   It goes out only if the turn ends without a final answer of its own
+ *
+ * Posts are sent strictly in order. A failed post is logged by the caller's
+ * `send` and does not stop the turn.
+ */
+export declare const PROGRESS_COALESCE_MS = 2000;
+export declare const PROGRESS_MIN_GAP_MS = 4000;
+export declare const WORKING_NOTICE_MS = 60000;
+export declare const WORKING_NOTICE_TEXT = "Working on it \u2014 I'll reply here when it's done.";
+export interface ProgressPosterOptions {
+    /** Post one message; resolve true when it was delivered. */
+    send: (body: string) => Promise<boolean>;
+    /**
+     * If provided, the final reply is sent through this instead of `send`.
+     * Use to tag the final reply differently from in-between progress messages.
+     */
+    sendFinal?: (body: string) => Promise<boolean>;
+    now?: () => number;
+    setTimer?: (fn: () => void, ms: number) => unknown;
+    clearTimer?: (handle: unknown) => void;
+    coalesceMs?: number;
+    minGapMs?: number;
+    workingNoticeMs?: number;
+    workingNoticeText?: string;
+    /**
+     * Unmentioned room turn: hold every in-between message and the working
+     * notice, and post nothing until the turn ends. `finish` then posts the
+     * in-between messages followed by the final answer when it adds something
+     * (when the turn is not silent); `abandon` posts nothing.
+     */
+    buffer?: boolean;
+    /**
+     * Never post a message the model wrote right before a tool call. Those are
+     * the model's notes to itself ("Now write the worker."), not replies: the
+     * runtime stream shows them as a text block followed by a tool_use. A
+     * message is held until the next event says which it was: a tool call drops
+     * it, anything else (another message, the end of the turn) keeps it.
+     */
+    dropPreToolMessages?: boolean;
+}
+/** Whitespace-insensitive form used to recognise repeated text. */
+export declare function normalizeForCompare(text: string): string;
+/** Matches {"action":"no_reply"} anywhere in a model reply, with or without preamble text. */
+export declare function containsNoReplySentinel(text: string): boolean;
+export declare class ProgressPoster {
+    private readonly send;
+    private readonly sendFinalFn?;
+    private readonly now;
+    private readonly setTimer;
+    private readonly clearTimer;
+    private readonly coalesceMs;
+    private readonly minGapMs;
+    private readonly workingNoticeMs;
+    private readonly workingNoticeText;
+    private readonly buffer;
+    private readonly dropPreTool;
+    /** dropPreToolMessages: messages waiting to learn whether a tool call follows. */
+    private candidates;
+    private pending;
+    /** In-between questions, held until the turn ends (see the header). */
+    private heldQuestions;
+    /** Every message the model has said this turn (posted or pending), in order. */
+    private readonly said;
+    private flushTimer;
+    private noticeTimer;
+    private lastPostAt;
+    private chain;
+    private finished;
+    private noticeSent;
+    private delivered;
+    /**
+     * Posts handed to the send chain this turn, counted when queued rather than
+     * when delivered. The "(no reply)" fallback checks this: a post still in
+     * flight when the turn ends has not bumped `delivered` yet, and counting only
+     * deliveries posted the placeholder right after a real message.
+     */
+    private queued;
+    constructor(opts: ProgressPosterOptions);
+    /** Arm the one-time "working on it" note. Call when the turn starts. */
+    start(): void;
+    /** One finished assistant message from the model. */
+    message(text: string): void;
+    /** The model called a tool: whatever it wrote just before was a note to itself. */
+    tool(): void;
+    private promoteCandidates;
+    private accept;
+    /** Posts that actually reached the chat (progress, notice and final). */
+    get postedCount(): number;
+    /** True once any message from the model was said this turn (not counting the notice). */
+    get saidAnything(): boolean;
+    /**
+     * The turn succeeded: post whatever is pending, then the final answer unless
+     * it repeats what was already said. Resolves once everything is sent.
+     *
+     * When `sendFinal` was provided, progress items flush through `send` and the
+     * final reply goes through `sendFinal` — keeping their audience tags distinct.
+     */
+    finish(finalText: string): Promise<void>;
+    /**
+     * The turn failed: post what the model already said (it is real progress),
+     * then stop. The caller posts its own "did not finish" message afterwards.
+     */
+    abandon(): Promise<void>;
+    private repeatsSaid;
+    private scheduleFlush;
+    private flushNow;
+    private enqueue;
+    private enqueueWith;
+    private cancelFlush;
+    private cancelNotice;
+}
+//# sourceMappingURL=progress.d.ts.map

package/dist/lib/bot/progress.js

@@ -0,0 +1,289 @@
+/**
+ * In-between messages for one bot turn.
+ *
+ * While the model works, each finished assistant message ("I'll look up the
+ * page first.", "Found it — publishing now.") is posted to the same place the
+ * final reply goes, instead of being held back and glued into one reply at the
+ * end. Rules:
+ *
+ * - whole messages only (the runtime parsers never pass deltas, reasoning,
+ *   tool arguments or tool results); empty text is skipped
+ * - messages arriving close together are joined with a blank line into one
+ *   post, and posts are spaced at least `minGapMs` apart
+ * - if nothing has been said `workingNoticeMs` into the turn, ONE short
+ *   "working on it" note goes out
+ * - the final answer is posted only when it adds something: text already
+ *   posted (or about to be) is never repeated, including Grok's final result
+ *   that is just every message concatenated
+ * - an in-between message that asks the person something (it has a "?") is
+ *   held, not posted: the model often asks, keeps working, then asks the same
+ *   thing again in its final answer, and the person read the question twice.
+ *   It goes out only if the turn ends without a final answer of its own
+ *
+ * Posts are sent strictly in order. A failed post is logged by the caller's
+ * `send` and does not stop the turn.
+ */
+export const PROGRESS_COALESCE_MS = 2_000;
+export const PROGRESS_MIN_GAP_MS = 4_000;
+export const WORKING_NOTICE_MS = 60_000;
+export const WORKING_NOTICE_TEXT = "Working on it — I'll reply here when it's done.";
+/** Whitespace-insensitive form used to recognise repeated text. */
+export function normalizeForCompare(text) {
+    return text.replace(/\s+/g, "");
+}
+/** Matches {"action":"no_reply"} anywhere in a model reply, with or without preamble text. */
+export function containsNoReplySentinel(text) {
+    return /\{\s*"action"\s*:\s*"no_reply"\s*\}/.test(text);
+}
+export class ProgressPoster {
+    send;
+    sendFinalFn;
+    now;
+    setTimer;
+    clearTimer;
+    coalesceMs;
+    minGapMs;
+    workingNoticeMs;
+    workingNoticeText;
+    buffer;
+    dropPreTool;
+    /** dropPreToolMessages: messages waiting to learn whether a tool call follows. */
+    candidates = [];
+    pending = [];
+    /** In-between questions, held until the turn ends (see the header). */
+    heldQuestions = [];
+    /** Every message the model has said this turn (posted or pending), in order. */
+    said = [];
+    flushTimer = null;
+    noticeTimer = null;
+    lastPostAt = Number.NEGATIVE_INFINITY;
+    chain = Promise.resolve();
+    finished = false;
+    noticeSent = false;
+    delivered = 0;
+    /**
+     * Posts handed to the send chain this turn, counted when queued rather than
+     * when delivered. The "(no reply)" fallback checks this: a post still in
+     * flight when the turn ends has not bumped `delivered` yet, and counting only
+     * deliveries posted the placeholder right after a real message.
+     */
+    queued = 0;
+    constructor(opts) {
+        this.send = opts.send;
+        this.sendFinalFn = opts.sendFinal;
+        this.now = opts.now ?? Date.now;
+        this.setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+        this.clearTimer = opts.clearTimer ?? ((h) => clearTimeout(h));
+        this.coalesceMs = opts.coalesceMs ?? PROGRESS_COALESCE_MS;
+        this.minGapMs = opts.minGapMs ?? PROGRESS_MIN_GAP_MS;
+        this.workingNoticeMs = opts.workingNoticeMs ?? WORKING_NOTICE_MS;
+        this.workingNoticeText = opts.workingNoticeText ?? WORKING_NOTICE_TEXT;
+        this.buffer = opts.buffer ?? false;
+        this.dropPreTool = opts.dropPreToolMessages ?? false;
+    }
+    /** Arm the one-time "working on it" note. Call when the turn starts. */
+    start() {
+        if (this.buffer)
+            return;
+        if (this.finished || this.noticeTimer !== null || this.workingNoticeMs <= 0)
+            return;
+        this.noticeTimer = this.setTimer(() => {
+            this.noticeTimer = null;
+            if (this.finished || this.said.length > 0 || this.noticeSent)
+                return;
+            this.noticeSent = true;
+            this.enqueue(this.workingNoticeText);
+        }, this.workingNoticeMs);
+    }
+    /** One finished assistant message from the model. */
+    message(text) {
+        const t = text.trim();
+        if (this.finished || !t)
+            return;
+        // Never treat the no_reply sentinel as something the model "said": it is a
+        // silence signal, not content, and must never be posted as progress.
+        if (containsNoReplySentinel(t))
+            return;
+        if (this.dropPreTool) {
+            // The previous message was not followed by a tool call: it was real.
+            this.promoteCandidates();
+            this.candidates.push(t);
+            return;
+        }
+        this.accept(t);
+    }
+    /** The model called a tool: whatever it wrote just before was a note to itself. */
+    tool() {
+        if (this.finished || !this.dropPreTool)
+            return;
+        this.candidates = [];
+    }
+    promoteCandidates() {
+        const kept = this.candidates;
+        this.candidates = [];
+        for (const t of kept)
+            this.accept(t);
+    }
+    accept(t) {
+        this.cancelNotice();
+        this.said.push(t);
+        // An unmentioned room turn holds every in-between message: nothing is posted
+        // until the turn ends, and then only the final answer.
+        if (this.buffer)
+            return;
+        if (t.includes("?")) {
+            this.heldQuestions.push(t);
+            return;
+        }
+        this.pending.push(t);
+        this.scheduleFlush();
+    }
+    /** Posts that actually reached the chat (progress, notice and final). */
+    get postedCount() {
+        return this.delivered;
+    }
+    /** True once any message from the model was said this turn (not counting the notice). */
+    get saidAnything() {
+        return this.said.length > 0;
+    }
+    /**
+     * The turn succeeded: post whatever is pending, then the final answer unless
+     * it repeats what was already said. Resolves once everything is sent.
+     *
+     * When `sendFinal` was provided, progress items flush through `send` and the
+     * final reply goes through `sendFinal` — keeping their audience tags distinct.
+     */
+    async finish(finalText) {
+        if (this.finished)
+            return this.chain;
+        // A message the turn ended on (no tool after it) is real.
+        this.promoteCandidates();
+        this.finished = true;
+        this.cancelNotice();
+        this.cancelFlush();
+        const final = finalText.trim();
+        // Buffered (unmentioned room): nothing was posted during the turn. Post the
+        // collected in-between messages (the sentinel is already excluded from
+        // `said`), then the final answer when it adds something the in-between
+        // messages did not already say — mirroring the streaming path's
+        // repeatsSaid logic. claude/codex answer mid-turn and end with a short
+        // sign-off, so dropping the in-between messages would lose the real answer;
+        // Grok's final is every message concatenated, so it repeats and is skipped.
+        // A silent turn (run.ts decides via sentinel/empty) never reaches here.
+        if (this.buffer) {
+            this.pending = [];
+            this.heldQuestions = [];
+            for (const s of this.said) {
+                if (!containsNoReplySentinel(s))
+                    this.pending.push(s);
+            }
+            if (final && !containsNoReplySentinel(final) && !this.repeatsSaid(final)) {
+                if (this.sendFinalFn) {
+                    // Keep the audience split: collected messages go through send, the
+                    // final reply through sendFinal.
+                    this.flushNow();
+                    this.enqueueWith(final, this.sendFinalFn);
+                    return this.chain;
+                }
+                this.pending.push(final);
+            }
+            this.flushNow();
+            return this.chain;
+        }
+        const held = this.heldQuestions;
+        this.heldQuestions = [];
+        const shouldAddFinal = Boolean(final && !this.repeatsSaid(final));
+        if (!shouldAddFinal && held.length > 0)
+            this.pending.push(...held);
+        if (this.pending.length === 0 && this.queued === 0 && !shouldAddFinal)
+            this.pending.push("(no reply)");
+        if (this.sendFinalFn && shouldAddFinal) {
+            // Flush any remaining progress messages first, then the final reply separately.
+            this.flushNow();
+            this.enqueueWith(final, this.sendFinalFn);
+        }
+        else {
+            if (shouldAddFinal)
+                this.pending.push(final);
+            this.flushNow();
+        }
+        return this.chain;
+    }
+    /**
+     * The turn failed: post what the model already said (it is real progress),
+     * then stop. The caller posts its own "did not finish" message afterwards.
+     */
+    async abandon() {
+        if (this.finished)
+            return this.chain;
+        this.finished = true;
+        this.cancelNotice();
+        this.cancelFlush();
+        // Buffered turns never post salvage: nothing streamed, so there is nothing
+        // to salvage, and the caller decides whether to post anything.
+        if (this.buffer) {
+            this.pending = [];
+            this.heldQuestions = [];
+            return this.chain;
+        }
+        this.pending.push(...this.heldQuestions);
+        this.heldQuestions = [];
+        this.flushNow();
+        return this.chain;
+    }
+    repeatsSaid(final) {
+        const f = normalizeForCompare(final);
+        if (!f)
+            return true;
+        if (this.said.some((s) => normalizeForCompare(s) === f))
+            return true;
+        // Grok-style: the final result is every message joined, with or without separators.
+        return this.said.length > 1 && normalizeForCompare(this.said.join("")) === f;
+    }
+    scheduleFlush() {
+        this.cancelFlush();
+        const at = Math.max(this.now() + this.coalesceMs, this.lastPostAt + this.minGapMs);
+        this.flushTimer = this.setTimer(() => {
+            this.flushTimer = null;
+            this.flushNow();
+        }, Math.max(0, at - this.now()));
+    }
+    flushNow() {
+        if (this.pending.length === 0)
+            return;
+        const body = this.pending.join("\n\n");
+        this.pending = [];
+        this.enqueue(body);
+    }
+    enqueue(body) {
+        this.enqueueWith(body, this.send);
+    }
+    enqueueWith(body, sendFn) {
+        // Defence in depth: never let the silence sentinel reach the chat, whatever
+        // path built this body.
+        if (containsNoReplySentinel(body))
+            return;
+        this.queued += 1;
+        this.lastPostAt = this.now();
+        this.chain = this.chain.then(async () => {
+            try {
+                if (await sendFn(body))
+                    this.delivered += 1;
+            }
+            catch {
+                /* the caller's send logs; a failed post never breaks the turn */
+            }
+        });
+    }
+    cancelFlush() {
+        if (this.flushTimer !== null)
+            this.clearTimer(this.flushTimer);
+        this.flushTimer = null;
+    }
+    cancelNotice() {
+        if (this.noticeTimer !== null)
+            this.clearTimer(this.noticeTimer);
+        this.noticeTimer = null;
+    }
+}
+//# sourceMappingURL=progress.js.map

package/dist/lib/bot/promote.d.ts

@@ -0,0 +1,16 @@
+import type { BotApi, BotPromotionState } from "./api.js";
+import type { BotConfig } from "./config.js";
+/** One recoverable local-to-cloud step, used by CLI and desktop. Never kills the
+ * local runtime, recopies provider login files, or changes another bot.
+ */
+export declare function promoteLocalBot(input: {
+    dir: string;
+    config: BotConfig;
+    companyUid: string;
+    api: BotApi;
+    drainTimeoutMs?: number;
+}): Promise<{
+    promotion: BotPromotionState;
+    pending: boolean;
+}>;
+//# sourceMappingURL=promote.d.ts.map

package/dist/lib/bot/promote.js

@@ -0,0 +1,106 @@
+import { recordActivePromotion } from "./promotion-receipt.js";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { randomUUID } from "node:crypto";
+import { botCredsPath } from "./paths.js";
+import { snapshotBotContinuity, validateBotContinuity } from "./continuity.js";
+import { attestPromotionDrain, holdForPromotion, waitForPromotionDrain } from "./promotion-hold.js";
+import { uploadLocalBotPromotion } from "./promotion-upload.js";
+/** Private bounded reads; never expose parser errors containing credential bytes. */
+function readPrivateJson(file, limit) {
+    if (fs.realpathSync(file) !== path.resolve(file))
+        throw new Error("Promotion files cannot use symlinks");
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size > limit || (stat.mode & 0o077))
+            throw new Error("Promotion requires a bounded private regular file");
+        const bytes = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const n = fs.readSync(fd, bytes, offset, bytes.length - offset, offset);
+            if (!n)
+                throw new Error("Promotion file changed");
+            offset += n;
+        }
+        try {
+            return JSON.parse(bytes.toString("utf8"));
+        }
+        catch {
+            throw new Error("Promotion file contains invalid JSON");
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/** One recoverable local-to-cloud step, used by CLI and desktop. Never kills the
+ * local runtime, recopies provider login files, or changes another bot.
+ */
+export async function promoteLocalBot(input) {
+    const { dir, config, companyUid, api } = input;
+    const existing = await api.promotionStatus(config.agentUid, companyUid);
+    const holdFile = path.join(dir, "promotion-hold.json");
+    const localHold = fs.existsSync(holdFile) ? readPrivateJson(holdFile, 2048) : null;
+    const operationId = existing?.operationId ?? localHold?.operationId ?? randomUUID();
+    if (!/^[A-Za-z0-9_-]{16,128}$/.test(operationId))
+        throw new Error("Invalid saved promotion operation");
+    const hold = { agentUid: config.agentUid, ownerUid: config.ownerUid, companyUid, operationId };
+    if (existing && (existing.agentUid !== config.agentUid || existing.ownerUid !== config.ownerUid || existing.companyUid !== companyUid))
+        throw new Error("Promotion belongs to another bot or destination");
+    if (existing?.phase === "cancelled")
+        throw new Error("This promotion was cancelled");
+    holdForPromotion(dir, hold);
+    if (existing?.phase === "active") {
+        recordActivePromotion(dir, hold, existing);
+        return { promotion: existing, pending: false };
+    }
+    await waitForPromotionDrain(dir, input.drainTimeoutMs ?? 60_000);
+    const file = path.join(dir, `promotion-snapshot-${operationId}.json`);
+    if (!fs.existsSync(file)) {
+        if (existing)
+            throw new Error("The original frozen snapshot is missing. Restore it before retrying.");
+        const snapshot = snapshotBotContinuity(config, dir);
+        const temp = `${file}.${randomUUID()}.tmp`;
+        fs.writeFileSync(temp, JSON.stringify(snapshot), { mode: 0o600, flag: "wx" });
+        try {
+            fs.linkSync(temp, file);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        finally {
+            fs.unlinkSync(temp);
+        }
+    }
+    const bundle = readPrivateJson(file, 48 * 1024 * 1024);
+    validateBotContinuity(bundle, { agentUid: config.agentUid, ownerUid: config.ownerUid });
+    if (existing && existing.snapshotSha256 !== bundle.digest)
+        throw new Error("Frozen snapshot does not match the cloud operation");
+    let state = existing;
+    if (!state || state.phase === "preparing") {
+        const machine = readPrivateJson(botCredsPath(dir), 8192);
+        if (!machine || typeof machine !== "object" || typeof machine.secret !== "string")
+            throw new Error("Invalid bot machine credential");
+        try {
+            state = await uploadLocalBotPromotion({ api, bundle, machine, companyUid, operationId });
+            const proof = await attestPromotionDrain(dir, hold, bundle.digest, machine);
+            state = await api.confirmPromotionStopped(config.agentUid, { companyUid, operationId, proof });
+        }
+        finally {
+            machine.secret = "";
+        }
+    }
+    if (state.phase === "local-stopped" || state.phase === "imported" || state.phase === "cloud-ready") {
+        const result = await api.resumePromotion(config.agentUid, { companyUid, operationId });
+        if (result.promotion.phase === "active")
+            recordActivePromotion(dir, hold, result.promotion);
+        return result;
+    }
+    return { promotion: state, pending: state.phase !== "active" };
+}
+//# sourceMappingURL=promote.js.map