@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/commands/agent-kit.js

@@ -0,0 +1,480 @@
+/**
+ * `hq agent kit install|status|uninstall|run <service>` — the resident
+ * services that make an external agent a full team member:
+ *
+ *   sync       company vault pull loop            → component-sync
+ *   inbox      inbox poller (mirror + optional ack) → component-inbox
+ *   heartbeat  60 s POST /v1/agents/{uid}/heartbeat with enabled component status
+ *
+ * `install` renders one user-level unit per enabled service (LaunchAgent on
+ * macOS, systemd --user on Linux), each of which just runs
+ * `node hq agent kit run <service>`. The Docker entrypoint runs
+ * `hq agent kit run all`, which supervises the services enabled in kit.json,
+ * including sync only when file mirroring is configured. Hosts where the
+ * service manager is unusable, such as a missing systemd user session bus or
+ * unavailable launchd, fall back to one
+ * detached `hq agent kit run all` supervisor (pid in ~/.hq-agent/kit.pid,
+ * output in ~/.hq-agent/logs/kit.log). Logs: ~/.hq-agent/logs/<service>.log. Skills:
+ * ~/.hq-agent/skills/<name>/SKILL.md.
+ */
+import chalk from "chalk";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import { CLI_VERSION } from "../cli-version.js";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { readExternalMachineCreds, } from "../lib/agent-kit/creds.js";
+import { defaultKitConfig, enabledKitComponents, readKitConfig, writeKitConfig, } from "../lib/agent-kit/kit-config.js";
+import { createKitLogger } from "../lib/agent-kit/log.js";
+import { agentKitPaths } from "../lib/agent-kit/paths.js";
+import { isKitService, KIT_SERVICES, enabledKitServices, kitServiceSpec, kitServiceSpecs, } from "../lib/agent-kit/services.js";
+import { writeKitSkills } from "../lib/agent-kit/skills.js";
+import { runHeartbeatLoop } from "../lib/agent-kit/run/heartbeat.js";
+import { runInboxLoop } from "../lib/agent-kit/run/inbox.js";
+import { superviseKitServices } from "../lib/agent-kit/run/supervisor.js";
+import { fallbackStatus, rebootCrontabLine, ensureRebootCrontab, shouldUseFallback, startFallback, stopFallback, } from "../lib/agent-kit/fallback.js";
+import { serviceLogPath } from "../lib/agent-kit/paths.js";
+import { spawn } from "node:child_process";
+import { pendingInbox } from "../lib/agent-kit/inbox-state.js";
+import { buildWakeNotice, clearWakeConfig, currentWakeState, DEFAULT_WAKE_RETRY_MS, describeWake, fireWake, readWakeConfig, validateWakeUrl, writeWakeConfig, } from "../lib/agent-kit/wake.js";
+import { runSyncLoop } from "../lib/agent-kit/run/sync.js";
+import { resolveHqBinary, resolveNodeBinary, } from "../lib/mesh/live/daemon/install.js";
+import { installServices, servicesStatus, uninstallServices, } from "../lib/service-manager/index.js";
+import { markExpectedUserError } from "../utils/expected-cli-error.js";
+import { scrubHomeDirectoryPrefix } from "../utils/install-tree-torn.js";
+export class KitError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "KitError";
+    }
+}
+/** Load the external creds or explain exactly what to run first. */
+export function requireExternalCreds(paths) {
+    const creds = readExternalMachineCreds(paths);
+    if (!creds) {
+        const credentialsPath = scrubHomeDirectoryPrefix(paths.machineCredsPath, paths.home);
+        throw markExpectedUserError(new KitError(`No external agent credentials at ${credentialsPath}. Run ` +
+            `\`hq agent enroll <code>\` first (an admin creates the code in the HQ console).`));
+    }
+    return creds;
+}
+export function ensureKitDirs(paths) {
+    for (const d of [paths.agentDir, paths.stateDir, paths.inboxDir, paths.logsDir, paths.skillsDir]) {
+        fs.mkdirSync(d, { recursive: true, mode: 0o700 });
+    }
+}
+export function resolveServiceHost(paths) {
+    return {
+        home: paths.home,
+        nodeBinary: resolveNodeBinary(),
+        hqBinary: resolveHqBinary(),
+    };
+}
+export function installKit(paths, opts, host, deps = {}, fallbackDeps = {}) {
+    requireExternalCreds(paths);
+    ensureKitDirs(paths);
+    const existing = fs.existsSync(paths.kitConfigPath)
+        ? readKitConfig(paths, CLI_VERSION)
+        : defaultKitConfig(paths, CLI_VERSION);
+    const config = {
+        ...existing,
+        ...(opts.hqRoot ? { hqRoot: opts.hqRoot } : {}),
+        ...(opts.inboxAck !== undefined ? { inboxAck: opts.inboxAck } : {}),
+        ...(opts.syncFiles !== undefined ? { syncFiles: opts.syncFiles } : {}),
+        cliVersion: CLI_VERSION,
+    };
+    fs.mkdirSync(config.hqRoot, { recursive: true, mode: 0o700 });
+    writeKitConfig(paths, config);
+    const skills = writeKitSkills(paths);
+    const activate = opts.activate ?? deps.activate ?? true;
+    // A reinstall that turns file sync off must also remove the unit an earlier
+    // install left behind, or the loop keeps running and keeps failing.
+    if (!config.syncFiles) {
+        try {
+            uninstallServices([kitServiceSpec("sync", paths)], host, deps);
+        }
+        catch {
+            /* best effort: an absent unit is the desired end state either way */
+        }
+    }
+    const services = installServices(kitServiceSpecs(paths, { syncFiles: config.syncFiles }), host, {
+        ...deps,
+        activate,
+    });
+    if (shouldUseFallback(services, activate)) {
+        const started = startFallback(paths, host, fallbackDeps);
+        // A supervisor that does not survive a reboot is not a supervisor. Install
+        // the @reboot entry rather than printing it and hoping.
+        const reboot = ensureRebootCrontab(paths, host, fallbackDeps.cron);
+        return {
+            config,
+            skills,
+            services,
+            fallback: {
+                mode: "fallback",
+                ...started,
+                crontab: rebootCrontabLine(paths, host),
+                reboot,
+            },
+        };
+    }
+    return { config, skills, services };
+}
+export function formatServiceSet(result) {
+    const lines = [];
+    for (const u of result.units) {
+        const state = !u.installed
+            ? chalk.dim("not installed")
+            : u.running === true
+                ? chalk.green("running")
+                : u.running === false
+                    ? chalk.yellow(u.error ? `not running — ${u.error}` : "installed (not running)")
+                    : chalk.dim("installed");
+        lines.push(`  ${u.name.padEnd(10)} ${state}${u.unitPath ? chalk.dim(`  ${u.unitPath}`) : ""}`);
+    }
+    if (result.manualCommands) {
+        lines.push("  No service manager on this platform. Run each service yourself:");
+        for (const c of result.manualCommands)
+            lines.push(`    ${c}`);
+    }
+    return lines;
+}
+export function buildKitRuntime(service) {
+    const paths = agentKitPaths(os.homedir(), process.env);
+    const credsSource = process.env.HQ_MACHINE_CREDS_FILE?.trim() ? "explicit" : "default";
+    const creds = requireExternalCreds(paths);
+    ensureKitDirs(paths);
+    const config = readKitConfig(paths, CLI_VERSION);
+    // Pin every mint in this process (and any child `hq`) to the kit's creds
+    // and control plane — the same values the enrolled file carries.
+    process.env.HQ_MACHINE_CREDS_FILE = paths.machineCredsPath;
+    process.env.HQ_REQUIRE_MACHINE_IDENTITY = "1";
+    process.env.HQ_VAULT_API_URL = creds.apiBaseUrl;
+    const log = createKitLogger(paths, service, { echo: process.stdout.isTTY === true });
+    const getToken = () => ensureCognitoToken({ tokenSource: "machine", interactive: false });
+    return { paths, creds, config, getToken, log, credsSource };
+}
+export async function runKitService(service, rt) {
+    rt.log("info", `${service} starting agent=${rt.creds.entityUid} cli=${CLI_VERSION}`);
+    switch (service) {
+        case "sync":
+            await runSyncLoop({
+                paths: rt.paths,
+                hqRoot: rt.config.hqRoot,
+                intervalMs: rt.config.syncIntervalMs,
+                log: rt.log,
+            });
+            return;
+        case "heartbeat":
+            await runHeartbeatLoop({
+                paths: rt.paths,
+                agentUid: rt.creds.entityUid,
+                apiBaseUrl: rt.creds.apiBaseUrl,
+                intervalMs: rt.config.heartbeatIntervalMs,
+                getToken: rt.getToken,
+                log: rt.log,
+                components: enabledKitComponents(rt.config),
+                agentUidSource: rt.credsSource === "explicit" ? "env" : "config_file",
+                credsSource: rt.credsSource ?? "default",
+            });
+            return;
+        case "inbox":
+            await runInboxLoop({
+                paths: rt.paths,
+                agentUid: rt.creds.entityUid,
+                apiBaseUrl: rt.creds.apiBaseUrl,
+                pollMs: rt.config.inboxPollMs,
+                ack: rt.config.inboxAck,
+                getToken: rt.getToken,
+                log: rt.log,
+            });
+            return;
+    }
+}
+/** `kit run all`: supervise the kit services as child processes with restart backoff. */
+export async function runAllKitServices(rt, host) {
+    const services = enabledKitServices({ syncFiles: rt.config.syncFiles });
+    rt.log("info", `supervisor starting ${services.join(",")} agent=${rt.creds.entityUid} cli=${CLI_VERSION}`);
+    const handle = superviseKitServices({
+        services,
+        log: rt.log,
+        spawnService: (service) => {
+            const fd = fs.openSync(serviceLogPath(rt.paths, service), "a", 0o600);
+            try {
+                return spawn(host.nodeBinary, [host.hqBinary, "agent", "kit", "run", service], {
+                    stdio: ["ignore", fd, fd],
+                    env: process.env,
+                    cwd: rt.paths.agentDir,
+                });
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        },
+    });
+    await new Promise((resolve) => {
+        const stop = (signal) => {
+            rt.log("info", `supervisor stopping (${signal})`);
+            handle.stop("SIGTERM");
+            resolve();
+        };
+        process.once("SIGTERM", () => stop("SIGTERM"));
+        process.once("SIGINT", () => stop("SIGINT"));
+    });
+}
+export function formatFallbackStatus(paths, kill) {
+    const st = fallbackStatus(paths, kill);
+    if (!st)
+        return null;
+    const state = st.running
+        ? chalk.green(`running (pid ${st.pid})`)
+        : chalk.yellow(st.pid === null ? "pidfile unreadable" : `not running (stale pid ${st.pid})`);
+    return [`  mode: fallback supervisor (hq agent kit run all) ${state}${chalk.dim(`  ${st.pidFile}`)}`];
+}
+function retryMsFrom(raw) {
+    if (raw === undefined)
+        return DEFAULT_WAKE_RETRY_MS;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n < 1)
+        throw new Error("--retry-minutes must be at least 1");
+    return n * 60_000;
+}
+function fail(err) {
+    console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+    process.exit(1);
+}
+export function registerAgentKitCommand(agent) {
+    const kit = agent
+        .command("kit")
+        .description("Install, inspect, or run the external-agent background services");
+    kit
+        .command("install")
+        .description("Install the inbox and heartbeat services plus the skills directory")
+        .option("--hq-root <path>", "Local HQ tree to sync the company vault into (default: ~/.hq-agent/hq)")
+        .option("--sync-files", "Also mirror the company vault to disk. Off by default: files are read on demand through the hq MCP server")
+        .option("--no-sync-files", "Do not mirror the vault to disk (default; removes the loop if an earlier install added it)")
+        .option("--inbox-ack", "Ack mirrored inbox items on the server (default: leave acking to the bot)")
+        .option("--no-activate", "Write unit files but do not load them")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => {
+        try {
+            const paths = agentKitPaths(os.homedir(), process.env);
+            const result = installKit(paths, {
+                hqRoot: opts.hqRoot,
+                inboxAck: opts.inboxAck,
+                syncFiles: opts.syncFiles,
+                activate: opts.activate,
+            }, resolveServiceHost(paths));
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+                return;
+            }
+            console.log(chalk.green("HQ agent kit installed."));
+            console.log(result.config.syncFiles
+                ? `  files:     mirrored to ${result.config.hqRoot}`
+                : "  files:     read on demand through the hq MCP server (no local copy)");
+            console.log(`  logs:      ${paths.logsDir}`);
+            console.log(`  skills:    ${paths.skillsDir} (${result.skills.length} skills)`);
+            if (result.fallback) {
+                console.log(chalk.yellow("  services: service manager unavailable — running in fallback mode " +
+                    `(hq agent kit run all, pid ${result.fallback.pid})`));
+                console.log(`  pidfile:   ${result.fallback.pidFile}`);
+                console.log(`  kit log:   ${result.fallback.logPath}`);
+                if (result.fallback.reboot.installed) {
+                    console.log(chalk.green("  reboot:    a @reboot crontab entry was installed, so the kit restarts with the host"));
+                    console.log(chalk.dim("             That holds only if cron and this CLI survive the restart. On a container " +
+                        "whose root filesystem is rebuilt each boot, both are erased and the entry goes with " +
+                        "them — reinstall the kit from your persistent storage after a restart, or have your " +
+                        "platform start `hq agent kit run all` for you."));
+                }
+                else {
+                    console.log(chalk.red(`  reboot:    NOT protected — ${result.fallback.reboot.reason}. Until this is fixed the kit ` +
+                        "stops at the next restart and this agent silently stops seeing new messages."));
+                    console.log("  Add this line yourself with `crontab -e`:");
+                    console.log(`    ${result.fallback.crontab}`);
+                }
+            }
+            else {
+                console.log("  services:");
+                for (const line of formatServiceSet(result.services))
+                    console.log(line);
+            }
+            console.log("");
+            console.log("Next: hq agent probe");
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    kit
+        .command("status")
+        .description("Show whether each kit service is installed and running")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => {
+        try {
+            const paths = agentKitPaths(os.homedir(), process.env);
+            const fallback = fallbackStatus(paths);
+            const result = servicesStatus(kitServiceSpecs(paths, { syncFiles: true }), resolveServiceHost(paths));
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: true, ...result, ...(fallback ? { fallback } : {}) }, null, 2));
+                return;
+            }
+            const fallbackLines = formatFallbackStatus(paths);
+            if (fallbackLines)
+                for (const line of fallbackLines)
+                    console.log(line);
+            else
+                for (const line of formatServiceSet(result))
+                    console.log(line);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    kit
+        .command("uninstall")
+        .description("Stop and remove the kit services (credentials and skills are kept)")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => {
+        try {
+            const paths = agentKitPaths(os.homedir(), process.env);
+            const fallback = stopFallback(paths);
+            const result = uninstallServices(kitServiceSpecs(paths, { syncFiles: true }), resolveServiceHost(paths));
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: true, ...result, fallback }, null, 2));
+                return;
+            }
+            if (fallback.pid !== null) {
+                console.log(`  fallback supervisor pid ${fallback.pid} ${fallback.killed ? "stopped" : "was not running"}; pidfile removed`);
+            }
+            console.log(chalk.green("HQ agent kit services removed."));
+            for (const line of formatServiceSet(result))
+                console.log(line);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    const wake = kit
+        .command("wake")
+        .description("Wake this bot's own framework when HQ messages arrive (webhook URL or local command)");
+    wake
+        .command("set-url [url]")
+        .description("POST a notice to a webhook URL (e.g. a Grok Bot routine webhook) when mail is pending. Prefer --stdin so the URL stays out of shell history")
+        .option("--stdin", "Read the URL from stdin")
+        .option("--retry-minutes <n>", "Re-wake while items stay pending (default 10, minimum 1)")
+        .action(async (url, opts) => {
+        try {
+            const paths = agentKitPaths(os.homedir(), process.env);
+            requireExternalCreds(paths);
+            let raw = url;
+            if (opts.stdin) {
+                const chunks = [];
+                for await (const c of process.stdin)
+                    chunks.push(c);
+                raw = Buffer.concat(chunks).toString("utf8").trim();
+            }
+            if (!raw)
+                throw new Error("Provide the URL as an argument or with --stdin");
+            const config = { kind: "url", url: validateWakeUrl(raw), retryMs: retryMsFrom(opts.retryMinutes) };
+            writeWakeConfig(paths, config);
+            console.log(chalk.green(`Wake set: ${describeWake(config)}`));
+            console.log("Test it: hq agent kit wake test");
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    wake
+        .command("set-command <argv...>")
+        .description("Run a local command (no shell) when mail is pending; the notice JSON arrives on stdin. Use -- before the command")
+        .option("--timeout-minutes <n>", "Kill a run after this long (default 10)")
+        .option("--retry-minutes <n>", "Re-wake while items stay pending (default 10, minimum 1)")
+        .action((argv, opts) => {
+        try {
+            const paths = agentKitPaths(os.homedir(), process.env);
+            requireExternalCreds(paths);
+            const minutes = opts.timeoutMinutes ? Number(opts.timeoutMinutes) : 10;
+            if (!Number.isFinite(minutes) || minutes <= 0)
+                throw new Error("--timeout-minutes must be a positive number");
+            const config = { kind: "command", command: argv, timeoutMs: minutes * 60_000, retryMs: retryMsFrom(opts.retryMinutes) };
+            writeWakeConfig(paths, config);
+            console.log(chalk.green(`Wake set: ${describeWake(config)}`));
+            console.log("Test it: hq agent kit wake test");
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    wake
+        .command("show")
+        .description("Show the configured wake (the URL is masked)")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => {
+        const paths = agentKitPaths(os.homedir(), process.env);
+        const config = readWakeConfig(paths);
+        const state = currentWakeState(paths);
+        if (opts.json) {
+            console.log(JSON.stringify({ configured: !!config, wake: describeWake(config), lastWakeAt: state.lastWakeAt ?? null }, null, 2));
+            return;
+        }
+        console.log(`  wake:      ${describeWake(config)}`);
+        console.log(`  last wake: ${state.lastWakeAt ?? "never"}`);
+    });
+    wake
+        .command("clear")
+        .description("Remove the wake configuration")
+        .action(() => {
+        const paths = agentKitPaths(os.homedir(), process.env);
+        console.log(clearWakeConfig(paths) ? "Wake cleared." : "No wake was configured.");
+    });
+    wake
+        .command("test")
+        .description("Fire the wake once now with the current pending count")
+        .action(async () => {
+        try {
+            const paths = agentKitPaths(os.homedir(), process.env);
+            const creds = requireExternalCreds(paths);
+            ensureKitDirs(paths);
+            const config = readWakeConfig(paths);
+            if (!config)
+                throw new Error("No wake configured. Run hq agent kit wake set-url --stdin (or set-command).");
+            const log = createKitLogger(paths, "wake", { echo: false });
+            const ids = pendingInbox(paths).map((e) => e.id);
+            const result = await fireWake(config, buildWakeNotice(creds.entityUid, "test", ids, new Date()), { paths, agentUid: creds.entityUid, log });
+            console.log(result.ok ? chalk.green(result.detail) : chalk.red(result.detail));
+            if (!result.ok)
+                process.exit(1);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    kit
+        .command("run <service>")
+        .description(`Run one kit service in the foreground (${KIT_SERVICES.join("|")}), or \`all\` to supervise every service in one process`)
+        .action(async (service) => {
+        if (service === "all") {
+            try {
+                const paths = agentKitPaths(os.homedir(), process.env);
+                const rt = buildKitRuntime("all");
+                await runAllKitServices(rt, resolveServiceHost(paths));
+                process.exit(0);
+            }
+            catch (err) {
+                fail(err);
+            }
+        }
+        if (!isKitService(service)) {
+            console.error(chalk.red(`Unknown kit service "${service}". Expected one of: all, ${KIT_SERVICES.join(", ")}`));
+            process.exit(1);
+        }
+        try {
+            const rt = buildKitRuntime(service);
+            await runKitService(service, rt);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+}
+//# sourceMappingURL=agent-kit.js.map

package/dist/commands/agent-mcp.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `hq agent mcp` — stdio MCP server backed by ~/.hq-agent/machine-creds.json.
+ *
+ * The console recipes register HQ in the bot's framework as
+ *   { command: "hq", args: ["agent", "mcp"], env: { HQ_MACHINE_CREDS_FILE: … } }
+ * so this command must never print anything but JSON-RPC on stdout; all
+ * diagnostics go to stderr. Tools wrap existing CLI capability (see
+ * lib/agent-kit/mcp/tools.ts); subprocess tools re-invoke the same node +
+ * hq binary with the machine-identity env pinned.
+ */
+import { Command } from "commander";
+import { McpServer } from "../lib/agent-kit/mcp/jsonrpc.js";
+import { type HqRunResult, type McpToolClients } from "../lib/agent-kit/mcp/tools.js";
+import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
+import type { ExternalMachineCreds } from "../lib/agent-kit/creds.js";
+export { readBounded } from "../lib/agent-kit/attachment-download.js";
+export declare const AGENT_MCP_SERVER_NAME = "hq-agent";
+export declare const AGENT_MCP_INSTRUCTIONS: string;
+export declare const HQ_SUBPROCESS_TIMEOUT_MS = 120000;
+export declare function defaultRunHq(nodeBinary: string, hqBinary: string, env: NodeJS.ProcessEnv): (args: string[]) => Promise<HqRunResult>;
+export declare function defaultMcpClients(creds: ExternalMachineCreds, credsPath: string, paths?: Pick<AgentKitPaths, "inboxDir" | "attachmentsDir">): McpToolClients;
+export declare function createAgentMcpServer(clients: McpToolClients): McpServer;
+export declare function registerAgentMcpCommand(agent: Command): void;
+//# sourceMappingURL=agent-mcp.d.ts.map

package/dist/commands/agent-mcp.js

@@ -0,0 +1,127 @@
+/**
+ * `hq agent mcp` — stdio MCP server backed by ~/.hq-agent/machine-creds.json.
+ *
+ * The console recipes register HQ in the bot's framework as
+ *   { command: "hq", args: ["agent", "mcp"], env: { HQ_MACHINE_CREDS_FILE: … } }
+ * so this command must never print anything but JSON-RPC on stdout; all
+ * diagnostics go to stderr. Tools wrap existing CLI capability (see
+ * lib/agent-kit/mcp/tools.ts); subprocess tools re-invoke the same node +
+ * hq binary with the machine-identity env pinned.
+ */
+import { spawn } from "node:child_process";
+import * as os from "node:os";
+import { CLI_VERSION } from "../cli-version.js";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { McpServer } from "../lib/agent-kit/mcp/jsonrpc.js";
+import { createVaultObjectDownloader } from "../lib/agent-kit/attachment-download.js";
+import { buildAgentMcpTools } from "../lib/agent-kit/mcp/tools.js";
+import { readKitConfig } from "../lib/agent-kit/kit-config.js";
+import { agentKitPaths } from "../lib/agent-kit/paths.js";
+import { requireExternalCreds } from "./agent-kit.js";
+// Re-exported for callers that imported it from here before it moved.
+export { readBounded } from "../lib/agent-kit/attachment-download.js";
+export const AGENT_MCP_SERVER_NAME = "hq-agent";
+export const AGENT_MCP_INSTRUCTIONS = "You are acting inside HQ as an enrolled external agent. Tools run as that machine identity: " +
+    "hq_whoami (identity), hq_search / hq_files_list / hq_files_read (company vault), " +
+    "hq_attachment_fetch (download a chat attachment — a chat/attachments/… vaultPath on an inbox message — any file type), " +
+    "hq_secrets_list / hq_secrets_exec (secrets by NAME only — values are never returned), " +
+    "hq_inbox_read / hq_dm_send / hq_inbox_done (read pending HQ messages, reply, then mark each handled), hq_work_mesh_status (what the team is doing). " +
+    "Never ask a user for a token or secret value; if a secret is missing, name it and ask an admin to add it.";
+export const HQ_SUBPROCESS_TIMEOUT_MS = 120_000;
+export function defaultRunHq(nodeBinary, hqBinary, env) {
+    return (args) => new Promise((resolve) => {
+        const child = spawn(nodeBinary, [hqBinary, ...args], {
+            env,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        const timer = setTimeout(() => child.kill("SIGKILL"), HQ_SUBPROCESS_TIMEOUT_MS);
+        child.stdout.on("data", (d) => (stdout += d.toString("utf8")));
+        child.stderr.on("data", (d) => (stderr += d.toString("utf8")));
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            resolve({ code: 127, stdout, stderr: `${stderr}\n${err.message}` });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            resolve({ code: code ?? 1, stdout, stderr });
+        });
+    });
+}
+export function defaultMcpClients(creds, credsPath, paths = agentKitPaths(os.homedir(), process.env)) {
+    const env = {
+        ...process.env,
+        HQ_MACHINE_CREDS_FILE: credsPath,
+        HQ_REQUIRE_MACHINE_IDENTITY: "1",
+        HQ_VAULT_API_URL: creds.apiBaseUrl,
+        NO_COLOR: "1",
+    };
+    const getToken = () => ensureCognitoToken({ tokenSource: "machine", interactive: false });
+    let companyUid;
+    return {
+        creds,
+        paths,
+        syncFiles: readKitConfig(agentKitPaths(os.homedir(), process.env), CLI_VERSION).syncFiles,
+        runHq: defaultRunHq(process.execPath, process.argv[1], env),
+        getToken,
+        resolveCompanyUid: async () => {
+            // Pin the enrolled API: DEFAULT_VAULT_API_URL was read from env at module
+            // load, before `hq agent mcp` sets HQ_VAULT_API_URL from the creds.
+            companyUid ??= getCompanyUid(await getToken(), creds.companySlug, creds.apiBaseUrl);
+            try {
+                return await companyUid;
+            }
+            catch (err) {
+                companyUid = undefined;
+                throw err;
+            }
+        },
+        // Same presign path `hq files cat` uses; the vault API's per-key ACL decides.
+        downloadVaultObject: createVaultObjectDownloader({ getToken, baseUrl: creds.apiBaseUrl }),
+        apiJson: async (token, path, init) => {
+            const res = await vaultApiFetch({
+                token,
+                baseUrl: creds.apiBaseUrl,
+                path,
+                method: init?.method,
+                body: init?.body,
+                query: init?.query,
+            });
+            const body = await res.json().catch(() => ({}));
+            return { status: res.status, body };
+        },
+    };
+}
+export function createAgentMcpServer(clients) {
+    return new McpServer({
+        name: AGENT_MCP_SERVER_NAME,
+        version: CLI_VERSION,
+        instructions: AGENT_MCP_INSTRUCTIONS,
+        tools: buildAgentMcpTools(clients),
+    });
+}
+export function registerAgentMcpCommand(agent) {
+    agent
+        .command("mcp")
+        .description("Serve HQ as a stdio MCP server for the bot framework (whoami, search, files, secrets-exec, dm, inbox, work-mesh)")
+        .action(async () => {
+        const paths = agentKitPaths(os.homedir(), process.env);
+        let creds;
+        try {
+            creds = requireExternalCreds(paths);
+        }
+        catch (err) {
+            process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+        process.env.HQ_MACHINE_CREDS_FILE = paths.machineCredsPath;
+        process.env.HQ_REQUIRE_MACHINE_IDENTITY = "1";
+        process.env.HQ_VAULT_API_URL = creds.apiBaseUrl;
+        const server = createAgentMcpServer(defaultMcpClients(creds, paths.machineCredsPath, paths));
+        process.stderr.write(`hq agent mcp: serving as ${creds.entityUid} (${creds.companySlug})\n`);
+        await server.serve(process.stdin, process.stdout);
+    });
+}
+//# sourceMappingURL=agent-mcp.js.map