@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/lib/agent-kit/attachment-download.js

@@ -0,0 +1,47 @@
+/**
+ * Vault object download for chat attachments, shared by `hq agent mcp`
+ * (hq_attachment_fetch) and the local bot runner (`hq bot run`).
+ *
+ * Bytes come through the same vault presign path `hq files cat` uses
+ * (`createCompanyPresignClient` → POST /v1/files/presign) with the caller's own
+ * machine token, so the server's per-key ACL stays the authority. The body is
+ * read with a hard byte cap so a crafted key cannot pull a large object into
+ * memory.
+ */
+import { GetObjectCommand } from "@aws-sdk/client-s3";
+import { createCompanyPresignClient } from "../../commands/files-browse.js";
+import { MAX_ATTACHMENT_BYTES } from "./mcp/attachments.js";
+/** Drain a stream into memory, refusing past `max` bytes. */
+export async function readBounded(body, max) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of body) {
+        const b = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += b.length;
+        if (total > max) {
+            body.destroy();
+            throw new Error(`object exceeds the ${max}-byte attachment limit`);
+        }
+        chunks.push(b);
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * A downloader bound to one identity. `baseUrl` pins the API the token is sent
+ * to (an enrolled agent passes its own `apiBaseUrl`; undefined = the default
+ * vault API, the same one the caller's other API calls use).
+ */
+export function createVaultObjectDownloader(opts) {
+    return async (scopeUid, key) => {
+        const client = createCompanyPresignClient({
+            token: await opts.getToken(),
+            companyUid: scopeUid,
+            ...(opts.baseUrl ? { baseUrl: opts.baseUrl } : {}),
+        });
+        const res = await client.send(new GetObjectCommand({ Bucket: scopeUid, Key: key }));
+        if (!res.Body)
+            throw new Error(`no body returned for '${key}'`);
+        return readBounded(res.Body, MAX_ATTACHMENT_BYTES);
+    };
+}
+//# sourceMappingURL=attachment-download.js.map

package/dist/lib/agent-kit/creds.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Host key + machine-creds file handling for external agents.
+ *
+ * The private key and the creds file are the whole credential: a stolen
+ * creds file without the key mints nothing (hq-cloud signs every mint with
+ * the key), so both are written 0600 and never printed. Nothing in this
+ * module reads `~/.hq/cognito-tokens.json` — a human's session is never
+ * consulted, copied, or reused by an agent identity (policy
+ * never-extract-stored-session-tokens-to-forge-privileged-calls).
+ *
+ * NOT EVERY FILESYSTEM CAN KEEP THAT PROMISE. A CIFS/SMB mount (Azure Files
+ * is the one that found this) is mounted with a fixed `file_mode` and fails
+ * `chmod` outright with EPERM; an NFS export or a Docker volume may accept
+ * the call and ignore it. A bot whose only persistent storage is such a
+ * share used to be unable to enroll at all — enrollment died on the chmod,
+ * leaving a stray temp file behind, and the only alternative was to keep the
+ * identity on disposable storage where a rebuild erases it.
+ *
+ * So the write no longer fails there: it reports whether owner-only
+ * permissions actually took, and the caller says so out loud. The file is
+ * still requested 0600 at creation, the outcome is read back from the
+ * filesystem rather than assumed, and a host that cannot honour it learns
+ * that its credential is readable by anything else with access to the same
+ * share. Refusing to enroll would not have made that credential safer; it
+ * would only have moved it somewhere it silently disappears.
+ */
+import type { AgentKitPaths, KitComponent } from "./paths.js";
+import { type PrivateFileOutcome } from "./private-file.js";
+/** Exact `machine-creds.json` shape for an external agent (api-contract v1). */
+export interface ExternalMachineCreds {
+    username: string;
+    secret: string;
+    /** Cognito user pool the machine user lives in (informational for the host). */
+    userPoolId?: string;
+    clientId: string;
+    region: string;
+    entityType: "agent";
+    entityUid: string;
+    runtime: "external";
+    hostKeyPath: string;
+    companySlug: string;
+    apiBaseUrl: string;
+}
+export interface HostKeyPair {
+    privatePem: string;
+    publicPem: string;
+    /** SHA-256 of the DER (SPKI) public key, hex, first 16 chars. */
+    fingerprint: string;
+}
+/** Contract fingerprint: sha256(DER SPKI public key) hex, first 16 chars. */
+export declare function hostFingerprint(publicPem: string): string;
+export declare function generateHostKeyPair(): HostKeyPair;
+export type { PrivateFileOutcome } from "./private-file.js";
+export declare function writeHostKeyPair(paths: Pick<AgentKitPaths, "hostKeyPath" | "hostKeyPubPath">, pair: HostKeyPair): PrivateFileOutcome;
+export declare function writeMachineCreds(paths: Pick<AgentKitPaths, "machineCredsPath">, creds: ExternalMachineCreds): PrivateFileOutcome;
+/**
+ * Read the creds file without trusting it: returns null unless it is an
+ * external-agent file with every contract field present.
+ */
+export declare function readExternalMachineCreds(paths: Pick<AgentKitPaths, "machineCredsPath">): ExternalMachineCreds | null;
+/** Whether ANY machine-creds file exists (external or hosted) at the kit path. */
+export declare function machineCredsFileExists(paths: Pick<AgentKitPaths, "machineCredsPath">): boolean;
+/**
+ * Component health stamp the kit services write and the heartbeat reads:
+ * `<status> <iso8601>` — same line shape as the hosted box's component files.
+ */
+export type ComponentStatus = "ok" | "error";
+export declare function writeComponentStatus(paths: Pick<AgentKitPaths, "stateDir">, component: KitComponent, status: ComponentStatus, now?: () => Date): void;
+export interface ComponentReading {
+    status: ComponentStatus;
+    at: Date | null;
+}
+/**
+ * Read a component stamp. A missing file, an unparseable line, or a stamp
+ * older than `staleAfterMs` reads as `error` — silence is never health.
+ */
+export declare function readComponentStatus(paths: Pick<AgentKitPaths, "stateDir">, component: KitComponent, staleAfterMs: number, now?: () => Date): ComponentReading;
+export type HostKeyPathCheck = {
+    status: "ok";
+    hostKeyPath: string;
+} | {
+    status: "healed";
+    hostKeyPath: string;
+    previous: string;
+} | {
+    status: "missing";
+    hostKeyPath: string;
+} | {
+    status: "no-creds";
+};
+/**
+ * Make the recorded host-key path point at a key that exists.
+ *
+ * The creds file records the key's absolute path, and hq-cloud signs every
+ * token mint with the key at that path. When the identity is moved or copied —
+ * the Runneth pilot copied its files from a disposable $HOME to persistent
+ * storage — the recorded path goes stale, and nothing fails until the cached
+ * token expires up to an hour later. Then every mint fails and the agent goes
+ * silent until someone re-enrolls it.
+ *
+ * The key always travels with the creds file, so when the recorded path is
+ * gone and a key sits beside the creds file, point at that one. The key
+ * itself is never read or copied here; only the recorded path changes.
+ */
+export declare function ensureHostKeyPath(paths: Pick<AgentKitPaths, "machineCredsPath">): HostKeyPathCheck;
+//# sourceMappingURL=creds.d.ts.map

package/dist/lib/agent-kit/creds.js

@@ -0,0 +1,163 @@
+/**
+ * Host key + machine-creds file handling for external agents.
+ *
+ * The private key and the creds file are the whole credential: a stolen
+ * creds file without the key mints nothing (hq-cloud signs every mint with
+ * the key), so both are written 0600 and never printed. Nothing in this
+ * module reads `~/.hq/cognito-tokens.json` — a human's session is never
+ * consulted, copied, or reused by an agent identity (policy
+ * never-extract-stored-session-tokens-to-forge-privileged-calls).
+ *
+ * NOT EVERY FILESYSTEM CAN KEEP THAT PROMISE. A CIFS/SMB mount (Azure Files
+ * is the one that found this) is mounted with a fixed `file_mode` and fails
+ * `chmod` outright with EPERM; an NFS export or a Docker volume may accept
+ * the call and ignore it. A bot whose only persistent storage is such a
+ * share used to be unable to enroll at all — enrollment died on the chmod,
+ * leaving a stray temp file behind, and the only alternative was to keep the
+ * identity on disposable storage where a rebuild erases it.
+ *
+ * So the write no longer fails there: it reports whether owner-only
+ * permissions actually took, and the caller says so out loud. The file is
+ * still requested 0600 at creation, the outcome is read back from the
+ * filesystem rather than assumed, and a host that cannot honour it learns
+ * that its credential is readable by anything else with access to the same
+ * share. Refusing to enroll would not have made that credential safer; it
+ * would only have moved it somewhere it silently disappears.
+ */
+import { createHash, createPublicKey, generateKeyPairSync } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { componentStatePath, HOST_KEY_NAME } from "./paths.js";
+import { writePrivateFile, } from "./private-file.js";
+/** Contract fingerprint: sha256(DER SPKI public key) hex, first 16 chars. */
+export function hostFingerprint(publicPem) {
+    const der = createPublicKey(publicPem).export({ type: "spki", format: "der" });
+    return createHash("sha256").update(der).digest("hex").slice(0, 16);
+}
+export function generateHostKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const privatePem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    const publicPem = publicKey.export({ type: "spki", format: "pem" }).toString();
+    return { privatePem, publicPem, fingerprint: hostFingerprint(publicPem) };
+}
+export function writeHostKeyPair(paths, pair) {
+    const key = writePrivateFile(paths.hostKeyPath, pair.privatePem, 0o600);
+    // The public half is public; its mode is not a promise worth reporting.
+    writePrivateFile(paths.hostKeyPubPath, pair.publicPem, 0o644);
+    return key;
+}
+export function writeMachineCreds(paths, creds) {
+    return writePrivateFile(paths.machineCredsPath, `${JSON.stringify(creds, null, 2)}\n`, 0o600);
+}
+/**
+ * Read the creds file without trusting it: returns null unless it is an
+ * external-agent file with every contract field present.
+ */
+export function readExternalMachineCreds(paths) {
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(paths.machineCredsPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!raw || typeof raw !== "object")
+        return null;
+    const r = raw;
+    const str = (k) => typeof r[k] === "string" && r[k].length > 0 ? r[k] : null;
+    const username = str("username");
+    const secret = str("secret");
+    const clientId = str("clientId");
+    const region = str("region");
+    const entityUid = str("entityUid");
+    const userPoolId = str("userPoolId");
+    const hostKeyPath = str("hostKeyPath");
+    const companySlug = str("companySlug");
+    const apiBaseUrl = str("apiBaseUrl");
+    if (r.runtime !== "external" ||
+        r.entityType !== "agent" ||
+        !username ||
+        !secret ||
+        !clientId ||
+        !region ||
+        !entityUid ||
+        !entityUid.startsWith("agt_") ||
+        !hostKeyPath ||
+        !companySlug ||
+        !apiBaseUrl) {
+        return null;
+    }
+    return {
+        username,
+        secret,
+        ...(userPoolId ? { userPoolId } : {}),
+        clientId,
+        region,
+        entityType: "agent",
+        entityUid,
+        runtime: "external",
+        hostKeyPath,
+        companySlug,
+        apiBaseUrl,
+    };
+}
+/** Whether ANY machine-creds file exists (external or hosted) at the kit path. */
+export function machineCredsFileExists(paths) {
+    return fs.existsSync(paths.machineCredsPath);
+}
+export function writeComponentStatus(paths, component, status, now = () => new Date()) {
+    fs.mkdirSync(paths.stateDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(componentStatePath(paths, component), `${status} ${now().toISOString()}\n`, { mode: 0o600 });
+}
+/**
+ * Read a component stamp. A missing file, an unparseable line, or a stamp
+ * older than `staleAfterMs` reads as `error` — silence is never health.
+ */
+export function readComponentStatus(paths, component, staleAfterMs, now = () => new Date()) {
+    let line;
+    try {
+        line = fs.readFileSync(componentStatePath(paths, component), "utf8").trim();
+    }
+    catch {
+        return { status: "error", at: null };
+    }
+    const [status, iso] = line.split(/\s+/, 2);
+    const at = iso ? new Date(iso) : null;
+    if (status !== "ok" || !at || Number.isNaN(at.getTime())) {
+        return { status: "error", at: at && !Number.isNaN(at.getTime()) ? at : null };
+    }
+    if (now().getTime() - at.getTime() > staleAfterMs) {
+        return { status: "error", at };
+    }
+    return { status: "ok", at };
+}
+/**
+ * Make the recorded host-key path point at a key that exists.
+ *
+ * The creds file records the key's absolute path, and hq-cloud signs every
+ * token mint with the key at that path. When the identity is moved or copied —
+ * the Runneth pilot copied its files from a disposable $HOME to persistent
+ * storage — the recorded path goes stale, and nothing fails until the cached
+ * token expires up to an hour later. Then every mint fails and the agent goes
+ * silent until someone re-enrolls it.
+ *
+ * The key always travels with the creds file, so when the recorded path is
+ * gone and a key sits beside the creds file, point at that one. The key
+ * itself is never read or copied here; only the recorded path changes.
+ */
+export function ensureHostKeyPath(paths) {
+    const creds = readExternalMachineCreds(paths);
+    if (!creds)
+        return { status: "no-creds" };
+    if (fs.existsSync(creds.hostKeyPath))
+        return { status: "ok", hostKeyPath: creds.hostKeyPath };
+    const sibling = path.join(path.dirname(paths.machineCredsPath), HOST_KEY_NAME);
+    if (sibling === creds.hostKeyPath || !fs.existsSync(sibling)) {
+        return { status: "missing", hostKeyPath: creds.hostKeyPath };
+    }
+    const raw = JSON.parse(fs.readFileSync(paths.machineCredsPath, "utf8"));
+    raw.hostKeyPath = sibling;
+    writePrivateFile(paths.machineCredsPath, `${JSON.stringify(raw, null, 2)}\n`, 0o600);
+    return { status: "healed", hostKeyPath: sibling, previous: creds.hostKeyPath };
+}
+//# sourceMappingURL=creds.js.map

package/dist/lib/agent-kit/fallback.d.ts

@@ -0,0 +1,78 @@
+/**
+ * No-service-manager fallback for `hq agent kit install`.
+ *
+ * When systemd --user cannot be reached (no user session bus, permission
+ * refused) or launchd is unavailable, the kit is started as ONE detached
+ * `hq agent kit run all` supervisor with output appended to
+ * ~/.hq-agent/logs/kit.log and its pid recorded in ~/.hq-agent/kit.pid.
+ * `kit status` reads the pidfile; `kit uninstall` kills it and removes it.
+ */
+import type { ServiceHostPaths, ServiceSetResult } from "../service-manager/index.js";
+import type { AgentKitPaths } from "./paths.js";
+export declare function kitPidPath(paths: Pick<AgentKitPaths, "agentDir">): string;
+/** True when an activation error means the service manager itself is unusable. */
+export declare function isServiceManagerUnavailable(error: string | undefined): boolean;
+/**
+ * Pick the fallback when activation was requested and the host has no service
+ * manager integration, or every failure is a service-manager-unavailable error.
+ */
+export declare function shouldUseFallback(result: ServiceSetResult, activate: boolean): boolean;
+export declare function readKitPid(paths: Pick<AgentKitPaths, "agentDir">): number | null;
+export type KillFn = (pid: number, signal?: NodeJS.Signals | 0) => boolean;
+export declare function isPidAlive(pid: number, kill?: KillFn): boolean;
+export interface FallbackStatus {
+    pidFile: string;
+    pid: number | null;
+    running: boolean;
+}
+export declare function fallbackStatus(paths: Pick<AgentKitPaths, "agentDir">, kill?: KillFn): FallbackStatus | null;
+/** Kill a recorded supervisor (if alive) and remove the pidfile. */
+export declare function stopFallback(paths: Pick<AgentKitPaths, "agentDir">, kill?: KillFn): {
+    pid: number | null;
+    killed: boolean;
+};
+export interface DetachedSpawn {
+    (cmd: string, args: string[], opts: {
+        detached: true;
+        windowsHide: true;
+        stdio: ["ignore", number, number];
+        env: NodeJS.ProcessEnv;
+        cwd: string;
+    }): {
+        pid?: number;
+        unref(): void;
+    };
+}
+/** crontab line that restarts the fallback supervisor after a reboot. */
+export declare function rebootCrontabLine(paths: Pick<AgentKitPaths, "agentDir" | "logsDir">, host: ServiceHostPaths): string;
+export declare function startFallback(paths: AgentKitPaths, host: ServiceHostPaths, deps?: {
+    spawn?: DetachedSpawn;
+    kill?: KillFn;
+    env?: NodeJS.ProcessEnv;
+}): {
+    pid: number;
+    logPath: string;
+    pidFile: string;
+};
+/**
+ * Marker for the crontab entry this module owns. Present so a reinstall
+ * replaces its own line instead of stacking duplicates, and so a human reading
+ * their crontab can see what wrote it and that removing it is safe.
+ */
+export declare const REBOOT_CRON_MARKER = "# hq-agent-kit (managed): restart the HQ agent kit after a reboot";
+export interface CronRunner {
+    (args: string[], input?: string): {
+        status: number;
+        stdout: string;
+        stderr: string;
+    };
+}
+export interface RebootCronResult {
+    installed: boolean;
+    /** Why it could not be installed, for the caller to print verbatim. */
+    reason?: string;
+}
+/** Drop any previously managed block, leaving every other entry untouched. */
+export declare function stripManagedCron(existing: string): string;
+export declare function ensureRebootCrontab(paths: Pick<AgentKitPaths, "agentDir" | "logsDir">, host: ServiceHostPaths, run?: CronRunner): RebootCronResult;
+//# sourceMappingURL=fallback.d.ts.map

package/dist/lib/agent-kit/fallback.js

@@ -0,0 +1,210 @@
+/**
+ * No-service-manager fallback for `hq agent kit install`.
+ *
+ * When systemd --user cannot be reached (no user session bus, permission
+ * refused) or launchd is unavailable, the kit is started as ONE detached
+ * `hq agent kit run all` supervisor with output appended to
+ * ~/.hq-agent/logs/kit.log and its pid recorded in ~/.hq-agent/kit.pid.
+ * `kit status` reads the pidfile; `kit uninstall` kills it and removes it.
+ */
+import { spawn, spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { kitServiceEnv } from "./services.js";
+import { writePrivateFile } from "./private-file.js";
+const KIT_PID_NAME = "kit.pid";
+const KIT_FALLBACK_LOG_NAME = "kit.log";
+export function kitPidPath(paths) {
+    return path.join(paths.agentDir, KIT_PID_NAME);
+}
+function kitFallbackLogPath(paths) {
+    return path.join(paths.logsDir, KIT_FALLBACK_LOG_NAME);
+}
+const UNAVAILABLE_PATTERNS = [
+    /no user session bus/i,
+    /failed to connect to (?:user )?bus/i,
+    /DBUS_SESSION_BUS_ADDRESS/i,
+    /XDG_RUNTIME_DIR/i,
+    /permission denied/i,
+    /operation not permitted/i,
+    /access denied/i,
+    /\bENOENT\b/i,
+    /command not found|spawnSync \S+ ENOENT/i,
+    /launchctl bootstrap failed/i,
+    /System has not been booted with systemd/i,
+];
+/** True when an activation error means the service manager itself is unusable. */
+export function isServiceManagerUnavailable(error) {
+    if (!error)
+        return false;
+    return UNAVAILABLE_PATTERNS.some((re) => re.test(error));
+}
+/**
+ * Pick the fallback when activation was requested and the host has no service
+ * manager integration, or every failure is a service-manager-unavailable error.
+ */
+export function shouldUseFallback(result, activate) {
+    if (!activate)
+        return false;
+    if (result.platform === "other")
+        return true;
+    const failed = result.units.filter((u) => u.running === false);
+    return failed.length > 0 && failed.some((u) => isServiceManagerUnavailable(u.error));
+}
+export function readKitPid(paths) {
+    try {
+        const n = Number.parseInt(fs.readFileSync(kitPidPath(paths), "utf8").trim(), 10);
+        return Number.isInteger(n) && n > 0 ? n : null;
+    }
+    catch {
+        return null;
+    }
+}
+const defaultKill = (pid, signal) => process.kill(pid, signal);
+export function isPidAlive(pid, kill = defaultKill) {
+    try {
+        kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM: exists but owned by someone else — still alive.
+        return err?.code === "EPERM";
+    }
+}
+export function fallbackStatus(paths, kill) {
+    if (!fs.existsSync(kitPidPath(paths)))
+        return null;
+    const pid = readKitPid(paths);
+    return { pidFile: kitPidPath(paths), pid, running: pid !== null && isPidAlive(pid, kill) };
+}
+/** Kill a recorded supervisor (if alive) and remove the pidfile. */
+export function stopFallback(paths, kill = defaultKill) {
+    const pid = readKitPid(paths);
+    let killed = false;
+    if (pid !== null && isPidAlive(pid, kill)) {
+        try {
+            kill(pid, "SIGTERM");
+            killed = true;
+        }
+        catch {
+            killed = false;
+        }
+    }
+    fs.rmSync(kitPidPath(paths), { force: true });
+    return { pid, killed };
+}
+function fallbackCommand(host) {
+    return { cmd: host.nodeBinary, args: [host.hqBinary, "agent", "kit", "run", "all"] };
+}
+/** crontab line that restarts the fallback supervisor after a reboot. */
+export function rebootCrontabLine(paths, host) {
+    const q = (v) => `'${v.replace(/'/g, `'\\''`)}'`;
+    const { cmd, args } = fallbackCommand(host);
+    return `@reboot HQ_AGENT_DIR=${q(paths.agentDir)} ${[cmd, ...args].map(q).join(" ")} >> ${q(kitFallbackLogPath(paths))} 2>&1`;
+}
+export function startFallback(paths, host, deps = {}) {
+    // Re-install replaces a running supervisor, like a unit restart.
+    stopFallback(paths, deps.kill);
+    fs.mkdirSync(paths.logsDir, { recursive: true, mode: 0o700 });
+    const logPath = kitFallbackLogPath(paths);
+    const fd = fs.openSync(logPath, "a", 0o600);
+    const doSpawn = deps.spawn ?? ((cmd, args, opts) => spawn(cmd, args, opts));
+    const { cmd, args } = fallbackCommand(host);
+    try {
+        const child = doSpawn(cmd, args, {
+            detached: true,
+            windowsHide: true,
+            stdio: ["ignore", fd, fd],
+            env: { ...(deps.env ?? process.env), HOME: host.home, ...kitServiceEnv(paths) },
+            cwd: paths.agentDir,
+        });
+        if (!child.pid)
+            throw new Error(`could not start ${cmd} ${args.join(" ")}`);
+        child.unref();
+        writePrivateFile(kitPidPath(paths), `${child.pid}\n`, 0o600);
+        return { pid: child.pid, logPath, pidFile: kitPidPath(paths) };
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/**
+ * Marker for the crontab entry this module owns. Present so a reinstall
+ * replaces its own line instead of stacking duplicates, and so a human reading
+ * their crontab can see what wrote it and that removing it is safe.
+ */
+export const REBOOT_CRON_MARKER = "# hq-agent-kit (managed): restart the HQ agent kit after a reboot";
+/** Drop any previously managed block, leaving every other entry untouched. */
+export function stripManagedCron(existing) {
+    const lines = existing.split("\n");
+    const out = [];
+    for (let i = 0; i < lines.length; i++) {
+        if (lines[i].trim() === REBOOT_CRON_MARKER) {
+            // Skip the marker and the entry it introduces.
+            if (i + 1 < lines.length && lines[i + 1].startsWith("@reboot"))
+                i += 1;
+            continue;
+        }
+        out.push(lines[i]);
+    }
+    return out.join("\n").replace(/\n{3,}/g, "\n\n").replace(/^\n+/, "");
+}
+/**
+ * Install the @reboot entry that brings the fallback supervisor back after a
+ * restart.
+ *
+ * Printing the line and trusting it to be pasted is what the installer used to
+ * do, and it is how the Muse pilot lost its messages: the host rebooted, the
+ * supervisor died with it, nothing restarted it, and the bot went quiet while
+ * every surface still reported healthy. A supervisor that does not survive a
+ * reboot is not a supervisor, so the entry is now written for real.
+ *
+ * Failure is NOT fatal — a host with no crontab is still a working kit until
+ * it restarts — but it is reported, so the caller can tell the operator the
+ * one thing they must then do by hand.
+ */
+/** No cron on the host: spawn failed outright, or the shell could not find it. */
+function isMissingCrontab(r) {
+    return r.status === 127 || /\bENOENT\b|command not found|not found/i.test(r.stderr);
+}
+export function ensureRebootCrontab(paths, host, run) {
+    const exec = run ??
+        ((args, input) => {
+            const r = spawnSync("crontab", args, { input, encoding: "utf8" });
+            if (r.error)
+                return { status: 127, stdout: "", stderr: r.error.message };
+            return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+        });
+    const listed = exec(["-l"]);
+    // A minimal host image often ships without cron at all, which is not an
+    // error the operator can act on unless it is named. Observed on the Muse
+    // pilot: the reboot entry could not be written because the cron package was
+    // simply not installed, and the raw ENOENT did not say so.
+    if (isMissingCrontab(listed)) {
+        return {
+            installed: false,
+            reason: "the `crontab` command is not installed on this host (install your distribution's cron package, " +
+                "for example `apt-get install -y cron` or `apk add busybox-cron`), then run `hq agent kit install` again",
+        };
+    }
+    // An empty crontab exits non-zero with "no crontab for <user>"; that is not
+    // a failure, it just means there is nothing to preserve. Anything else is.
+    const noCrontabYet = listed.status !== 0 && /no crontab for/i.test(listed.stderr);
+    if (listed.status !== 0 && !noCrontabYet) {
+        return {
+            installed: false,
+            reason: `could not read the crontab (${(listed.stderr || "").trim() || `exit ${listed.status}`})`,
+        };
+    }
+    const kept = stripManagedCron(noCrontabYet ? "" : listed.stdout);
+    const body = `${kept.trimEnd()}\n${REBOOT_CRON_MARKER}\n${rebootCrontabLine(paths, host)}\n`.replace(/^\n+/, "");
+    const wrote = exec(["-"], body);
+    if (wrote.status !== 0) {
+        return {
+            installed: false,
+            reason: `could not write the crontab (${(wrote.stderr || "").trim() || `exit ${wrote.status}`})`,
+        };
+    }
+    return { installed: true };
+}
+//# sourceMappingURL=fallback.js.map