@indigoai-us/hq-cli 5.345.104 → 5.345.105

package/dist/commands/pack-install.d.ts

@@ -170,6 +170,16 @@ interface RawListingDetail extends RawListingDetailFields {
 }
 /** Map a raw `GET /v1/listings/{id}` body into a MarketplaceListing. */
 export declare function toMarketplaceListing(raw: RawListingDetail): MarketplaceListing;
+/**
+ * Run a marketplace request again when the server answers 5xx or the network
+ * fails. A brief 502 from the API gateway ended a pack install from the app
+ * ("Failed to resolve listing … (HTTP 502)") although the next request
+ * succeeded. 4xx answers and the final attempt are returned as they are.
+ */
+export declare function withTransientRetry(request: () => Promise<Response>, opts?: {
+    delaysMs?: number[];
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<Response>;
 /** Default production marketplace deps — public listings API + presigned S3. */
 export declare function defaultMarketplaceDeps(): MarketplaceDeps;
 /**
@@ -449,8 +459,17 @@ export interface InstallPackOptions {
      * for marketplace sources, which always require a platform signature.
      */
     allowUnsigned?: boolean;
+    /** Packs whose install led to this one, for dependency installs; guards cycles. */
+    dependencyChain?: string[];
 }
 export declare function runPackInstallWithLease<T>(run: () => Promise<T>, leaseOptions?: ResidentCommandLeaseOptions): Promise<T>;
-export declare function installPack(source: string, opts?: InstallPackOptions): Promise<void>;
+/** What `installPack` installed; undefined when the install was aborted or skipped. */
+export interface InstallPackResult {
+    pkg: PackManifest;
+    /** Absolute pack root under `<hqRoot>/core/packages/<name>`. */
+    destDir: string;
+    hqRoot: string;
+}
+export declare function installPack(source: string, opts?: InstallPackOptions): Promise<InstallPackResult | undefined>;
 export {};
 //# sourceMappingURL=pack-install.d.ts.map

package/dist/commands/pack-install.js

@@ -58,6 +58,7 @@ import { formatApiKeyCapabilityDenial, peekHqApiKey, } from '../utils/resolve-va
 import { redactSecrets, SECRET_REDACTION, codexConfigFormat, codexConfigPath, isMcpRegistrationEnabled, registerMcpServers, readConfigDoc, unregisterMcpServers, McpManifestError, } from './mcp-registration.js';
 import { listSecretCacheScopes } from '../utils/secrets-cache.js';
 import { loadRevealedSecrets } from './secrets.js';
+import { parseSetupBlock } from '../lib/packages/setup-block.js';
 import { syncCodexPackHooks, syncCodexPackSkills } from '../lib/install/codex-pack-contributions.js';
 const PACK_UPDATE_CACHE_TTL_MS = 12 * 60 * 60 * 1000;
 const PACK_UPDATE_FETCH_TIMEOUT_MS = 3_000;
@@ -311,12 +312,35 @@ export function toMarketplaceListing(raw) {
         publicKey: detail.publicKey,
     };
 }
+/**
+ * Run a marketplace request again when the server answers 5xx or the network
+ * fails. A brief 502 from the API gateway ended a pack install from the app
+ * ("Failed to resolve listing … (HTTP 502)") although the next request
+ * succeeded. 4xx answers and the final attempt are returned as they are.
+ */
+export async function withTransientRetry(request, opts = {}) {
+    const delays = opts.delaysMs ?? [500, 1500];
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    for (let attempt = 0;; attempt += 1) {
+        const last = attempt >= delays.length;
+        try {
+            const res = await request();
+            if (res.status < 500 || last)
+                return res;
+        }
+        catch (err) {
+            if (last)
+                throw err;
+        }
+        await sleep(delays[attempt]);
+    }
+}
 /** Default production marketplace deps — public listings API + presigned S3. */
 export function defaultMarketplaceDeps() {
     const fetchDetail = async (listingId) => {
-        const res = await vaultApiFetchPublic({
+        const res = await withTransientRetry(() => vaultApiFetchPublic({
             path: `/v1/listings/${encodeURIComponent(listingId)}`,
-        });
+        }));
         if (!res.ok) {
             throw new Error(`Failed to resolve listing ${listingId} (HTTP ${res.status}). The pack may be unavailable or unapproved.`);
         }
@@ -340,10 +364,10 @@ export function defaultMarketplaceDeps() {
             const query = { slug, q: slug };
             if (version)
                 query.version = version;
-            const res = await vaultApiFetchPublic({
+            const res = await withTransientRetry(() => vaultApiFetchPublic({
                 path: '/v1/listings',
                 query,
-            });
+            }));
             if (!res.ok) {
                 throw new Error(`Failed to search marketplace for "${slug}" (HTTP ${res.status}).`);
             }
@@ -1149,6 +1173,17 @@ export function validateManifest(payloadDir, hqVersion, options = {}) {
             }
         }
     }
+    // setup — OPTIONAL and backwards-compatible.
+    // Absent → the pack installs exactly as before. Present → the block must be
+    // well-shaped, its bot must be a contributed worker, and every script it
+    // names must exist in the payload. The error names the failing field
+    // (lib/packages/setup-block.ts), e.g. `setup.run.script "x" does not exist`.
+    if (m.setup !== undefined) {
+        m.setup = parseSetupBlock(m.setup, {
+            packDir: payloadDir,
+            workers: contributes.workers ?? [],
+        });
+    }
     return m;
 }
 // ---------------------------------------------------------------------------
@@ -1180,7 +1215,7 @@ export function assertPackDependencies(hqRoot, pkg) {
         }
         if (!installed.has(dep.name)) {
             throw new Error(`Pack ${pkg.name} requires ${dep.name}, which is not installed. ` +
-                `Install it first, e.g.: hq install marketplace:${dep.name}`);
+                `Install it first, e.g.: hq install ${packSlugFromName(dep.name)}`);
         }
         if (dep.version) {
             const have = installed.get(dep.name);
@@ -1191,6 +1226,42 @@ export function assertPackDependencies(hqRoot, pkg) {
         }
     }
 }
+/** Marketplace slug for a pack name: `hq-pack-client-service` -> `client-service`. */
+function packSlugFromName(name) {
+    return name.startsWith('hq-pack-') ? name.slice('hq-pack-'.length) : name;
+}
+/**
+ * Install a marketplace pack's missing `requires.packs` from the marketplace
+ * first, so one install from a pack page or a pasted link brings the packs it
+ * needs. Only marketplace installs do this: the dependency comes from the same
+ * signed channel. A dependency that is installed at a version outside the
+ * range is left alone, and assertPackDependencies reports it.
+ */
+async function installMissingMarketplaceDependencies(hqRoot, pkg, opts, say) {
+    const deps = pkg.requires?.packs ?? [];
+    if (deps.length === 0)
+        return;
+    const chain = [...(opts.dependencyChain ?? []), pkg.name];
+    for (const dep of deps) {
+        if (dep.name === pkg.name)
+            continue; // assertPackDependencies refuses this
+        const installed = new Set(listInstalledPacks(hqRoot).map((p) => p.manifest?.name ?? p.name));
+        if (installed.has(dep.name))
+            continue;
+        if (chain.includes(dep.name)) {
+            throw new Error(`Pack dependency cycle: ${[...chain, dep.name].join(' -> ')}`);
+        }
+        say(chalk.dim(`-> ${pkg.name} requires ${dep.name}; installing it from the marketplace first`));
+        const result = await installPackWithoutLease(`${MARKETPLACE_PREFIX}${packSlugFromName(dep.name)}`, {
+            ...opts,
+            integrity: undefined,
+            dependencyChain: chain,
+        });
+        if (!result) {
+            throw new Error(`Pack ${pkg.name} requires ${dep.name}, and its install did not finish.`);
+        }
+    }
+}
 // ---------------------------------------------------------------------------
 // Post-install get-started line (US-005)
 // ---------------------------------------------------------------------------
@@ -1743,6 +1814,9 @@ async function installPackWithoutLease(source, opts) {
         const pkg = validateManifest(fetched.payloadDir, hqVersion, {
             allowReservedName: transport === 'local' || allowPinnedAliasName,
         });
+        if (transport === 'marketplace') {
+            await installMissingMarketplaceDependencies(hqRoot, pkg, opts, say);
+        }
         // M0 — pack-to-pack dependency pre-flight. Runs BEFORE any prompts or writes
         // so a missing/unsatisfied `requires.packs` aborts with no partial state, and
         // before we bother the operator with hook/MCP trust prompts for a pack that
@@ -1826,6 +1900,7 @@ async function installPackWithoutLease(source, opts) {
         const getStarted = getStartedLine(pkg.initialization);
         if (getStarted)
             say(chalk.cyan(getStarted));
+        return { pkg, destDir, hqRoot };
     }
     finally {
         fs.rmSync(tmpDir, { recursive: true, force: true });

package/dist/commands/pack-start-bot.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Production wiring for `hq packages install --start-bot`: the bot lifecycle
+ * seams of lib/packages/start-bot.ts bound to the real `hq bot` internals
+ * (create, restart, intro) and the bot DM API. Loaded on demand by
+ * pkg-install.ts so an ordinary install never imports the bot machinery.
+ */
+import type { InstallPackResult } from "./pack-install.js";
+import { type StartPackBotDeps, type StartPackBotResult } from "../lib/packages/start-bot.js";
+/**
+ * The model and thinking level a pack's setup bot runs on. Left unset, Claude
+ * Code used the account's default model (Claude Fable 5.1 in a 2026-10-12
+ * walkthrough), and one setup turn took nine minutes. Pack setup is guided
+ * reading and writing: Opus 5.5 at medium thinking does it well and faster.
+ * The person can still change either with `hq bot set`.
+ */
+export declare const PACK_BOT_MODEL = "claude-opus-5-5";
+export declare const PACK_BOT_EFFORT = "medium";
+export declare function defaultStartPackBotDeps(): StartPackBotDeps;
+/**
+ * Start the pack's setup bot after a successful install. Never throws: a bot
+ * that cannot start leaves the install successful (contract section 3).
+ */
+export declare function startBotForInstalledPack(result: InstallPackResult | undefined, deps?: StartPackBotDeps): Promise<StartPackBotResult | null>;
+//# sourceMappingURL=pack-start-bot.d.ts.map

package/dist/commands/pack-start-bot.js

@@ -0,0 +1,76 @@
+/**
+ * Production wiring for `hq packages install --start-bot`: the bot lifecycle
+ * seams of lib/packages/start-bot.ts bound to the real `hq bot` internals
+ * (create, restart, intro) and the bot DM API. Loaded on demand by
+ * pkg-install.ts so an ordinary install never imports the bot machinery.
+ */
+import * as fs from "node:fs";
+import chalk from "chalk";
+import { botExists, botTokenSupplier, runBotCreate, runBotIntro, runBotRestart } from "./bot.js";
+import { BotApi } from "../lib/bot/api.js";
+import { readBotConfig } from "../lib/bot/config.js";
+import { botCredsPath, botDir } from "../lib/bot/paths.js";
+import { startPackSetupBot } from "../lib/packages/start-bot.js";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { resolveCallerPersonUid } from "../utils/vault-api.js";
+/**
+ * One DM to the owner. As the bot when its identity exists on this computer
+ * (the same path `hq bot intro` uses); otherwise as the signed-in person, to
+ * themselves, with the session the install already relied on.
+ */
+async function dmOwner(name, body) {
+    const dir = botDir(name);
+    const config = readBotConfig(dir);
+    if (config && fs.existsSync(botCredsPath(dir))) {
+        await new BotApi({ token: botTokenSupplier(dir) }).sendDm({ toPersonUid: config.ownerUid, body });
+        return;
+    }
+    const token = await ensureCognitoToken({ tokenSource: "person", interactive: false });
+    const owner = await resolveCallerPersonUid(token, undefined, { command: "hq packages install --start-bot" });
+    if (!owner)
+        throw new Error("your HQ login has no person entity yet");
+    await new BotApi({ token: async () => token }).sendDm({ toPersonUid: owner, body });
+}
+/**
+ * The model and thinking level a pack's setup bot runs on. Left unset, Claude
+ * Code used the account's default model (Claude Fable 5.1 in a 2026-10-12
+ * walkthrough), and one setup turn took nine minutes. Pack setup is guided
+ * reading and writing: Opus 5.5 at medium thinking does it well and faster.
+ * The person can still change either with `hq bot set`.
+ */
+export const PACK_BOT_MODEL = "claude-opus-5-5";
+export const PACK_BOT_EFFORT = "medium";
+export function defaultStartPackBotDeps() {
+    return {
+        botExists,
+        createBot: (name, opts) => runBotCreate(name, {
+            worker: opts.worker,
+            displayName: opts.displayName,
+            intro: opts.intro,
+            kickoff: opts.kickoff,
+            lean: true,
+            model: PACK_BOT_MODEL,
+            effort: PACK_BOT_EFFORT,
+        }),
+        restartBot: (name) => runBotRestart(name, { output: "text" }),
+        sendIntro: (name) => runBotIntro(name),
+        dmOwner,
+        say: (line) => console.log(line),
+    };
+}
+/**
+ * Start the pack's setup bot after a successful install. Never throws: a bot
+ * that cannot start leaves the install successful (contract section 3).
+ */
+export async function startBotForInstalledPack(result, deps = defaultStartPackBotDeps()) {
+    if (!result)
+        return null;
+    const setup = result.pkg.setup;
+    if (!setup) {
+        deps.say(chalk.dim(`--start-bot: ${result.pkg.name} has no setup: block, so there is no bot to start.`));
+        return null;
+    }
+    deps.say(chalk.dim(`-> starting the pack's setup bot ${setup.bot.name} (${setup.bot.display_name})`));
+    return startPackSetupBot(result.pkg.name, setup, deps);
+}
+//# sourceMappingURL=pack-start-bot.js.map

package/dist/commands/packs.d.ts

@@ -41,6 +41,8 @@ interface InstalledPackView {
     }>;
     inCatalog: boolean;
     updateAvailable: boolean | null;
+    /** True when the pack declares a valid `setup:` block (chat-driven setup bot). */
+    setup?: boolean;
     /**
      * Post-install initialization (US-005). Present only when the pack's
      * package.yaml declares an `initialization` block — drives the HQ Sync
@@ -77,5 +79,12 @@ export interface UpdateDependencies {
 export declare function runUpdate(name: string | undefined, opts: UpdateOpts, deps?: UpdateDependencies): Promise<UpdateCheck[]>;
 export declare function registerPacksListCommand(parent: Command): void;
 export declare function registerPacksCommand(parent: Command): void;
+/**
+ * The source to reinstall from. A marketplace install stamps the exact version
+ * it got (`marketplace:<slug>@<version>`), so reinstalling that source fetched
+ * the same version again: `hq packs update` reported 0.4.15 as latest and put
+ * 0.4.14 back. With a newer listing known, install that version instead.
+ */
+export declare function sourceForUpdate(source: string, probe: Pick<LatestResult, "transport" | "latest" | "updateAvailable">): string;
 export {};
 //# sourceMappingURL=packs.d.ts.map

package/dist/commands/packs.js

@@ -27,8 +27,9 @@ import semverSatisfies from 'semver/functions/satisfies.js';
 import { findHqRoot } from '../utils/manifest.js';
 import { resolveHqRoot as resolveDetectedHqRoot } from './doctor.js';
 import { anywhereRuntimeAllowed } from '../lib/anywhere-person-setting.js';
-import { classify, PINNED_HQ_ANYWHERE_SOURCE, resolveLatest, resolveLatestMarketplace, runScanPackages, installPack, } from './pack-install.js';
+import { classify, PINNED_HQ_ANYWHERE_SOURCE, resolveLatest, parseMarketplaceSource, resolveLatestMarketplace, runScanPackages, installPack, } from './pack-install.js';
 import { contributionLinks, linkStatus, listInstalledPacks, findDependentPacks, readPackManifest, unwirePack, unwirePackMcp, readHqVersion, readRecommendedPackages, packagesDir, } from '../utils/pack-contributions.js';
+import { readInstalledPackSetup } from '../lib/packages/setup-block.js';
 import { syncCodexPackHooks, syncCodexPackSkills } from '../lib/install/codex-pack-contributions.js';
 function resolveRoot(opts) {
     return opts.hqRoot ? path.resolve(opts.hqRoot) : findHqRoot();
@@ -124,6 +125,10 @@ export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, ch
                 initialization.prompt = initObj.prompt;
         }
     }
+    // pack setup bots — `setup: yes` only for a block that is
+    // valid against the installed pack (its bot is a contributed worker and the
+    // scripts it names exist); `no` for packs without one or with a broken one.
+    const setup = readInstalledPackSetup(m, pack.dir) !== undefined;
     return {
         name: m.name ?? pack.name,
         version: m.version,
@@ -137,6 +142,7 @@ export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, ch
         brokenLinks,
         inCatalog: m.source ? installedSources.has(m.source) : false,
         updateAvailable,
+        setup,
         ...(initialization ? { initialization } : {}),
     };
 }
@@ -189,7 +195,7 @@ function printListHuman(view) {
             const broken = p.links.broken > 0 ? chalk.red(`  ! ${p.links.broken} broken link(s)`) : '';
             const upd = p.updateAvailable ? chalk.yellow('  ^ update available') : '';
             const hq = p.hqCoreSatisfied === false ? chalk.red('  x hqCore mismatch') : '';
-            console.log(`  ${chalk.green(p.name)}@${p.version ?? '?'}  ${chalk.dim(p.transport ?? '')}${upd}${hq}${broken}`);
+            console.log(`  ${chalk.green(p.name)}@${p.version ?? '?'}  ${chalk.dim(p.transport ?? '')}  setup: ${p.setup ? 'yes' : 'no'}${upd}${hq}${broken}`);
         }
         console.log();
     }
@@ -273,7 +279,7 @@ export async function runUpdate(name, opts, deps = {}) {
             if (opts.hqRoot)
                 process.chdir(hqRoot); // installPack resolves via findHqRoot()
             try {
-                await installPack(source, {
+                await installPack(sourceForUpdate(source, probe), {
                     allowHooks: opts.yes || opts.allowHooks,
                     allowMcp: opts.yes || opts.allowMcp,
                     followBranch: opts.branch,
@@ -514,4 +520,21 @@ export function registerPacksCommand(parent) {
         }
     });
 }
+/**
+ * The source to reinstall from. A marketplace install stamps the exact version
+ * it got (`marketplace:<slug>@<version>`), so reinstalling that source fetched
+ * the same version again: `hq packs update` reported 0.4.15 as latest and put
+ * 0.4.14 back. With a newer listing known, install that version instead.
+ */
+export function sourceForUpdate(source, probe) {
+    if (probe.transport !== "marketplace" || !probe.latest || probe.updateAvailable !== true)
+        return source;
+    try {
+        const { slug } = parseMarketplaceSource(source);
+        return `marketplace:${slug}@${probe.latest}`;
+    }
+    catch {
+        return source;
+    }
+}
 //# sourceMappingURL=packs.js.map

package/dist/commands/pkg-install.js

@@ -44,6 +44,7 @@ export function registerPackageInstallCommand(parent) {
         .option('--allow-hooks', 'Skip the hooks confirmation prompt (content-pack flow)')
         .option('--allow-mcp', 'Skip the MCP server confirmation prompt (content-pack flow)')
         .option('--allow-unsigned', 'Acknowledge an unsigned local directory source; marketplace installs always require a signature')
+        .option('--start-bot', "After install, create and start the pack's setup bot (packs with a setup: block); prints `bot: <name>`")
         .option('--branch', 'Follow a ref instead of SHA-pinning (git content-pack flow)')
         .option('--global', 'Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)')
         .option('--runtime <runtime>', 'Runtime for --global (claude | codex | chatgpt | grok)', 'claude')
@@ -128,8 +129,9 @@ export function registerPackageInstallCommand(parent) {
                 });
                 return;
             }
+            let installed;
             if (sourceMatchesPackPattern(source)) {
-                await installPack(source, {
+                installed = await installPack(source, {
                     company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
@@ -142,7 +144,7 @@ export function registerPackageInstallCommand(parent) {
                 // (/packages, /entitlements) was never deployed, so a bare slug
                 // would fail at registry setup. Resolve it through the marketplace
                 // listings transport — the live install path — instead.
-                await installPack(`${MARKETPLACE_PREFIX}${source}`, {
+                installed = await installPack(`${MARKETPLACE_PREFIX}${source}`, {
                     company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
@@ -150,6 +152,13 @@ export function registerPackageInstallCommand(parent) {
                     followBranch: opts.branch,
                 });
             }
+            // pack setup bots — a pack with a valid `setup:` block
+            // gets its bot created and started after wiring. A bot that cannot
+            // start never fails the install (the reason is printed and DMed).
+            if (opts.startBot) {
+                const { startBotForInstalledPack } = await import('./pack-start-bot.js');
+                await startBotForInstalledPack(installed);
+            }
         }
         catch (error) {
             console.error(chalk.red('Install failed:'), error instanceof Error ? error.message : 'Unknown error');

package/dist/commands/secrets.d.ts

@@ -1,12 +1,8 @@
 import type { Command } from "commander";
+export { readSessionCompanyLock } from "../lib/session-company-lock.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
 export type { SecretLoadResponse, SecretScriptLockMode, SecretTier, SecretUsage, SecretUsageChannel } from "../secrets-env-action.js";
 export type { SecretScriptUsage, SecretMetadata, SecretLoadSuccessRow } from "../secrets-env-action.js";
-type SessionCompanyLock = {
-    sessionId: string;
-    companies: string[];
-} | undefined;
-export declare function readSessionCompanyLock(env?: NodeJS.ProcessEnv): SessionCompanyLock;
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };

package/dist/commands/secrets.js

@@ -2,98 +2,9 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
 import { assertApiKeyCompany, buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
+import { readSessionCompanyLock } from "../lib/session-company-lock.js";
+export { readSessionCompanyLock } from "../lib/session-company-lock.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
-export function readSessionCompanyLock(env = process.env) {
-    const root = resolveDefaultHqRoot({ env });
-    const sessionId = resolveSessionId(root, env);
-    if (!sessionId)
-        return undefined;
-    const sessionDir = path.join(root, "workspace/sessions", sessionId);
-    const capabilityPath = path.join(sessionDir, "scope-capability.json");
-    const metaPath = path.join(sessionDir, "meta.yaml");
-    let primary;
-    let companies;
-    let hasCapability = false;
-    try {
-        fs.lstatSync(capabilityPath);
-        hasCapability = true;
-    }
-    catch (error) {
-        const code = error.code;
-        if (code !== "ENOENT" && code !== "ENOTDIR")
-            throw new Error("Cannot verify this session's company lock because its scope capability is unreadable.");
-    }
-    if (hasCapability) {
-        let value;
-        try {
-            value = JSON.parse(fs.readFileSync(capabilityPath, "utf8"));
-        }
-        catch {
-            throw new Error("Cannot verify this session's company lock because its scope capability is unreadable.");
-        }
-        if (!value || typeof value !== "object" || Array.isArray(value))
-            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
-        const cap = value;
-        if (cap.session_id !== sessionId)
-            throw new Error("Cannot verify this session's company lock because its scope capability does not match the active session.");
-        if (typeof cap.company_slug !== "string" || !/^[A-Za-z0-9_-]+$/.test(cap.company_slug))
-            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
-        primary = cap.company_slug;
-        if (cap.company_slugs === undefined)
-            companies = [primary];
-        else if (Array.isArray(cap.company_slugs)
-            && cap.company_slugs.length > 0
-            && cap.company_slugs.every((slug) => typeof slug === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(slug))
-            && cap.company_slugs[0] === primary
-            && new Set(cap.company_slugs).size === cap.company_slugs.length
-            && ((primary === "personal" && cap.company_slugs.length === 1)
-                || (primary !== "personal" && !cap.company_slugs.includes("personal"))))
-            companies = [...cap.company_slugs];
-        else
-            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
-    }
-    else {
-        try {
-            const meta = fs.readFileSync(metaPath, "utf8");
-            const read = (key) => meta.split(/\r?\n/).find((line) => new RegExp(`^\\s*${key}:`).test(line))?.replace(/^\s*[^:]+:\s*/, "").replace(/^"|"$/g, "") ?? "";
-            primary = read("company_slug");
-            const hasList = meta.split(/\r?\n/).some((line) => /^\s*company_slugs:/.test(line));
-            const listed = hasList ? read("company_slugs") : "";
-            if (hasList && (!listed || !primary))
-                throw new Error("invalid company lock");
-            companies = hasList ? listed.split(",") : primary ? [primary] : [];
-            if (companies.some((slug) => !/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(slug)))
-                throw new Error("invalid company lock");
-            if (new Set(companies).size !== companies.length)
-                throw new Error("invalid company lock");
-            if (primary && companies[0] !== primary)
-                throw new Error("invalid company lock");
-            if (companies.length > 1 && companies.includes("personal"))
-                throw new Error("invalid company lock");
-        }
-        catch (error) {
-            const code = error.code;
-            if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES")
-                return { sessionId, companies: [] };
-            throw new Error("Cannot verify this session's company lock because its metadata is invalid.");
-        }
-    }
-    const real = companies.filter((slug) => {
-        if (slug === "personal")
-            return true;
-        try {
-            const companyPath = path.join(root, "companies", slug);
-            const stat = fs.lstatSync(companyPath);
-            return stat.isDirectory() && !stat.isSymbolicLink();
-        }
-        catch {
-            return false;
-        }
-    });
-    if (primary && real[0] !== primary)
-        return { sessionId, companies: [] };
-    return { sessionId, companies: real };
-}
 function companyUidForSlug(root, slug) {
     try {
         const doc = yaml.load(fs.readFileSync(path.join(root, "companies", "manifest.yaml"), "utf8"));
@@ -147,7 +58,6 @@ import { isHqCliChild, releaseChildWrapperPackageUseLeaseAfterStart } from "../u
 import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
 import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
-import { resolveSessionId } from "../lib/core-utils/session-id.js";
 import { secretsExecChildExitCode } from "../utils/child-wrapper-exit.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";

package/dist/lib/bot/config.d.ts

@@ -148,6 +148,13 @@ export interface BotConfig {
     introSentAt?: string;
     /** The kickoff could not run because the coding tool needed a sign-in; it runs once that works. */
     kickoffPendingSignIn?: boolean;
+    /**
+     * Run Claude Code turns lean: without the computer's plugins, MCP servers and
+     * HQ's session/prompt/stop hooks, keeping only HQ's tool hooks (PreToolUse,
+     * PostToolUse). A plain reply then takes seconds instead of ~20. Set for pack
+     * setup bots, which only need files and shell commands.
+     */
+    lean?: boolean;
 }
 export declare function readBotConfig(dir: string): BotConfig | null;
 export declare function writeBotConfig(dir: string, config: BotConfig): void;

package/dist/lib/bot/daemon.js

@@ -15,6 +15,7 @@ import * as path from "node:path";
 import { spawn } from "node:child_process";
 import { resolveHqBinary, resolveNodeBinary, preferStableHqBinary } from "../mesh/live/daemon/install.js";
 import { botLogPath, launchdLabel } from "./paths.js";
+import { hqAppToolchainRoot } from "./toolchain.js";
 import { discoverLaunchdIdentity, installLaunchdPlist, launchdProgramArguments, launchdPlistProgramArguments as parsePlistArguments, parseLaunchdCommand, reloadLaunchd } from "../service-manager/launchd.js";
 import { nodeBinaryProblem, preferStableNodeBinary } from "../node-binary.js";
 export function detectBotPlatform(platform = process.platform) {
@@ -25,7 +26,7 @@ export function detectBotPlatform(platform = process.platform) {
     return "other";
 }
 export function defaultPathEntries(home) {
-    const toolchain = path.join(home, "Library", "Application Support", "Indigo HQ", "toolchain");
+    const toolchain = hqAppToolchainRoot(home);
     return [
         // launchd does not load shell profiles; npm CLIs also need env node.
         path.join(toolchain, "node", "bin"),

package/dist/lib/bot/index.d.ts

@@ -20,6 +20,8 @@ export * from "./local-name.js";
 export * from "./job-run.js";
 export * from "./job-completions.js";
 export * from "./inflight.js";
+export * from "./toolchain.js";
+export * from "./pack-link.js";
 export * from "./lock.js";
 export * from "./display-name.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/bot/index.js

@@ -20,6 +20,8 @@ export * from "./local-name.js";
 export * from "./job-run.js";
 export * from "./job-completions.js";
 export * from "./inflight.js";
+export * from "./toolchain.js";
+export * from "./pack-link.js";
 export * from "./lock.js";
 export * from "./display-name.js";
 //# sourceMappingURL=index.js.map

package/dist/lib/bot/lean-settings.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Claude Code settings for a lean bot turn (BotConfig.lean). The turn runs
+ * with `--setting-sources ""` and `--strict-mcp-config`, so no user or project
+ * settings, plugins or MCP servers load; this file brings back only HQ's tool
+ * hooks (PreToolUse, PostToolUse) from `<hqRoot>/.claude/settings.json`, with
+ * `$CLAUDE_PROJECT_DIR` spelled out as the HQ root.
+ */
+export declare const LEAN_SETTINGS_FILE = "lean-claude-settings.json";
+export declare const LEAN_HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse"];
+/** The lean settings object for an HQ root (empty hooks when HQ has none). */
+export declare function leanClaudeSettings(hqRoot: string): {
+    hooks: Record<string, unknown>;
+};
+/** Write the lean settings into the bot folder; returns the file path. */
+export declare function writeLeanClaudeSettings(botDir: string, hqRoot: string): string;
+//# sourceMappingURL=lean-settings.d.ts.map

package/dist/lib/bot/lean-settings.js

@@ -0,0 +1,34 @@
+/**
+ * Claude Code settings for a lean bot turn (BotConfig.lean). The turn runs
+ * with `--setting-sources ""` and `--strict-mcp-config`, so no user or project
+ * settings, plugins or MCP servers load; this file brings back only HQ's tool
+ * hooks (PreToolUse, PostToolUse) from `<hqRoot>/.claude/settings.json`, with
+ * `$CLAUDE_PROJECT_DIR` spelled out as the HQ root.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const LEAN_SETTINGS_FILE = "lean-claude-settings.json";
+export const LEAN_HOOK_EVENTS = ["PreToolUse", "PostToolUse"];
+/** The lean settings object for an HQ root (empty hooks when HQ has none). */
+export function leanClaudeSettings(hqRoot) {
+    let hooks = {};
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(hqRoot, ".claude", "settings.json"), "utf8"));
+        for (const event of LEAN_HOOK_EVENTS) {
+            if (raw.hooks?.[event] !== undefined)
+                hooks[event] = raw.hooks[event];
+        }
+        hooks = JSON.parse(JSON.stringify(hooks).replace(/\$\{?CLAUDE_PROJECT_DIR\}?/g, hqRoot.replace(/\\/g, "\\\\").replace(/"/g, '\\"')));
+    }
+    catch {
+        hooks = {};
+    }
+    return { hooks };
+}
+/** Write the lean settings into the bot folder; returns the file path. */
+export function writeLeanClaudeSettings(botDir, hqRoot) {
+    const file = path.join(botDir, LEAN_SETTINGS_FILE);
+    fs.writeFileSync(file, `${JSON.stringify(leanClaudeSettings(hqRoot), null, 2)}\n`, { mode: 0o600 });
+    return file;
+}
+//# sourceMappingURL=lean-settings.js.map