@indigoai-us/hq-cli 5.345.171 → 5.345.172

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.102","bundleSha256":"54baedb34f8744f3dbbfa970785c6de703a33145081969bed5b266a2fc4d4d9e","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.103","bundleSha256":"3ed362bac2c75d32a61b0e26b4253813af96458579920a798fd38a9583e855f9","formatVersion":1}

package/dist/lib/bot/fleet-local.d.ts

@@ -1,5 +1,6 @@
 import { type BotEngineMetadata } from "./config.js";
 import type { BotMachineCreds } from "./creds.js";
+import { type FleetPython } from "./fleet-python.js";
 import type { LocalBotPromotionRuntime } from "./promote.js";
 export interface FleetLocalReleasePin {
     repository: string;
@@ -65,6 +66,8 @@ export interface FleetLocalProfileInput {
     hqRoot: string;
     botDir: string;
     installation: FleetLocalInstallation;
+    /** The bot's standing HQ instructions; written as the runtime's SOUL.md persona. */
+    systemPrompt?: string;
 }
 type FleetLocalExec = (executable: string, args: string[], options: Record<string, unknown>) => Buffer | string;
 export interface FleetLocalBootstrapDeps {
@@ -72,6 +75,7 @@ export interface FleetLocalBootstrapDeps {
     platform?: NodeJS.Platform;
     run?: FleetLocalExec;
     start?: boolean;
+    python?: FleetPython;
 }
 export interface FleetLocalBootstrapResult {
     profile: string;
@@ -114,14 +118,25 @@ export declare const FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS = 30000;
 export declare const FLEET_LOCAL_ARCHIVE_DOWNLOAD_TIMEOUT_MS: number;
 export declare const FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS: number;
 export declare function installPinnedFleetLocalDistribution(deps?: FleetLocalInstallDeps): Promise<FleetLocalInstallation>;
+/** The process id the bot's gateway recorded, when its file reads; the caller checks whether it is alive. */
+export declare function fleetLocalGatewayPid(agentUid: string, deps?: Pick<FleetLocalControlDeps, "fleetHome">): number | null;
 export declare function controlFleetLocalBot(agentUid: string, action: FleetLocalServiceAction, deps?: FleetLocalControlDeps): Record<string, unknown>;
 export declare function exportFleetLocalMachineCredential(agentUid: string, deps?: FleetLocalControlDeps): BotMachineCreds;
 export declare function fleetLocalPromotionRuntime(agentUid: string, deps?: FleetLocalControlDeps): LocalBotPromotionRuntime;
 export declare function removeFleetLocalBot(agentUid: string, deps?: FleetLocalControlDeps): FleetLocalRemovalResult;
 export declare function authenticateFleetLocalBot(input: FleetLocalAuthInput, deps?: FleetLocalControlDeps): FleetLocalAuthResult;
 export declare function writeFleetLocalProfile(input: FleetLocalProfileInput, deps?: Pick<FleetLocalBootstrapDeps, "fleetHome" | "platform">): string;
+export declare function writeFleetLocalSoul(agentUid: string, systemPrompt: string, deps?: Pick<FleetLocalControlDeps, "fleetHome">): string;
+/**
+ * The pinned runtime refuses a persona file that trips its context-file
+ * scanner and then starts with no identity at all. The same scanner, run with
+ * the bot's own interpreter, says beforehand what it would refuse.
+ */
+export declare function scanFleetLocalInstructions(agentUid: string, text: string, deps?: FleetLocalControlDeps): string[];
+/** Checks the instructions with the runtime's scanner, then makes them the bot's persona. */
+export declare function refreshFleetLocalInstructions(agentUid: string, systemPrompt: string, deps?: FleetLocalControlDeps): string;
 export declare function bootstrapFleetLocalBot(input: FleetLocalProfileInput & {
     machineCredentials: string;
-}, deps?: FleetLocalBootstrapDeps): FleetLocalBootstrapResult;
+}, deps?: FleetLocalBootstrapDeps): Promise<FleetLocalBootstrapResult>;
 export {};
 //# sourceMappingURL=fleet-local.d.ts.map

package/dist/lib/bot/fleet-local.js

@@ -4,16 +4,17 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { HQ_FLEET_RUNTIME_ENGINE_ID, } from "./config.js";
+import { ensureFleetPython, fleetUvEnv } from "./fleet-python.js";
 export const HQ_FLEET_LOCAL_RELEASE = {
     repository: "indigoai-us/hq-fleet-local",
-    tag: "v0.4.2",
-    version: "0.4.2",
-    artifact: "hq-fleet-local-0.4.2.zip",
-    artifactSha256: "61af88c3e783f5cc6bc1bf99920e981680f67d3485fae6edc52cdfee61ce2108",
+    tag: "v0.4.5",
+    version: "0.4.5",
+    artifact: "hq-fleet-local-0.4.5.zip",
+    artifactSha256: "5dc05b1a9c8a3fce0d748c1f642a908c4166958cf4e1c3cec8ee3799148eef80",
     runtimeArtifact: "hq-fleet-runtime-abccac13bd9e.tar",
     runtimeArtifactSha256: "29bcfe718ad7fbd3636afd00623772f2a25bc84c4f6f10d8d57f38e549d528d5",
-    manifestSha256: "d55a4b84d08659991f8bf2dba4b8590bd7874bf3adf4dad6bc1e08eac5462884",
-    signatureSha256: "31f0d27890f54956f3684e9401d04ed49b9f57fcb6da0440c25f5a31c5db1082",
+    manifestSha256: "ffb81d7cbb61cdd05e91208ac3eccf045789d9e068309da3164fe002991f7780",
+    signatureSha256: "3792d43c191c65c731e9f27a003d86334b4695a43feb8ac23a7b679f79531616",
     runtimeCommit: "abccac13bd9ea593b24c8cd9c0ba28d5c6050cc9",
 };
 export const HQ_FLEET_LOCAL_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
@@ -252,6 +253,19 @@ function runJson(run, executable, args, options, label) {
         throw expectedError(`HQ Fleet Local ${label} returned an invalid result.`);
     }
 }
+/** The process id the bot's gateway recorded, when its file reads; the caller checks whether it is alive. */
+export function fleetLocalGatewayPid(agentUid, deps = {}) {
+    if (!/^agt_[A-Za-z0-9_-]+$/.test(agentUid))
+        return null;
+    const file = path.join(profileRoot(agentUid, deps.fleetHome ?? fleetHome()), "gateway.pid");
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        return typeof parsed.pid === "number" && Number.isInteger(parsed.pid) && parsed.pid > 0 ? parsed.pid : null;
+    }
+    catch {
+        return null;
+    }
+}
 export function controlFleetLocalBot(agentUid, action, deps = {}) {
     const run = deps.run ?? execFileSync;
     const files = fleetLocalExecutables(agentUid, deps);
@@ -518,36 +532,69 @@ export function writeFleetLocalProfile(input, deps = {}) {
     fs.mkdirSync(profile.paths.logsDir, { recursive: true, mode: 0o700 });
     fs.writeFileSync(temporary, `${JSON.stringify(profile, null, 2)}\n`, { mode: 0o600 });
     fs.renameSync(temporary, destination);
+    if (input.systemPrompt !== undefined)
+        writeFleetLocalSoul(input.agentUid, input.systemPrompt, { fleetHome: root });
     return destination;
 }
-function pythonCommand(run, platform) {
-    const candidates = platform === "win32"
-        ? [
-            { executable: "py", prefix: ["-3.13"] },
-            { executable: "py", prefix: ["-3.12"] },
-            { executable: "py", prefix: ["-3.11"] },
-            { executable: "python3", prefix: [] },
-        ]
-        : [
-            { executable: "python3.13", prefix: [] },
-            { executable: "python3.12", prefix: [] },
-            { executable: "python3.11", prefix: [] },
-            { executable: "python3", prefix: [] },
-        ];
-    for (const candidate of candidates) {
-        try {
-            run(candidate.executable, [
-                ...candidate.prefix,
-                "-c",
-                "import sys; raise SystemExit(0 if (3,11) <= sys.version_info[:2] < (3,14) else 1)",
-            ], { stdio: "ignore", windowsHide: true });
-            return candidate;
-        }
-        catch {
-            continue;
-        }
+export function writeFleetLocalSoul(agentUid, systemPrompt, deps = {}) {
+    if (!/^agt_[A-Za-z0-9_-]+$/.test(agentUid)) {
+        throw expectedError(`Cannot use an HQ Fleet profile for invalid bot id ${agentUid}.`);
+    }
+    const dir = profileRoot(agentUid, deps.fleetHome ?? fleetHome());
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const soul = path.join(dir, "SOUL.md");
+    const temporary = path.join(dir, `.soul-${process.pid}-${crypto.randomUUID()}`);
+    fs.writeFileSync(temporary, `${systemPrompt.trimEnd()}\n`, { mode: 0o600 });
+    fs.renameSync(temporary, soul);
+    return soul;
+}
+const FLEET_INSTRUCTION_SCAN = [
+    "import json, sys",
+    "sys.path.insert(0, sys.argv[1])",
+    "from tools.threat_patterns import scan_for_threats",
+    "print(json.dumps(scan_for_threats(sys.stdin.read(), scope='context')))",
+].join("\n");
+/**
+ * The pinned runtime refuses a persona file that trips its context-file
+ * scanner and then starts with no identity at all. The same scanner, run with
+ * the bot's own interpreter, says beforehand what it would refuse.
+ */
+export function scanFleetLocalInstructions(agentUid, text, deps = {}) {
+    if (!/^agt_[A-Za-z0-9_-]+$/.test(agentUid)) {
+        throw expectedError(`Cannot use an HQ Fleet profile for invalid bot id ${agentUid}.`);
     }
-    throw expectedError("HQ Fleet Runtime needs Python 3.11, 3.12, or 3.13. Install one and retry.");
+    const run = deps.run ?? execFileSync;
+    const profileDir = profileRoot(agentUid, deps.fleetHome ?? fleetHome());
+    const python = venvExecutable(path.join(profileDir, "runtime"), "python", deps.platform ?? process.platform);
+    const source = path.join(profileDir, "sources", "runtime");
+    if (!fs.existsSync(python) || !fs.existsSync(source)) {
+        throw expectedError("HQ Fleet Local is not installed for this bot, so its instructions could not be checked.");
+    }
+    const failure = expectedError("HQ Fleet Local could not check the bot's instructions with its runtime.");
+    let parsed;
+    try {
+        const output = run(python, ["-I", "-c", FLEET_INSTRUCTION_SCAN, source], {
+            input: text,
+            stdio: ["pipe", "pipe", "pipe"],
+            encoding: "utf8",
+            windowsHide: true,
+        });
+        parsed = JSON.parse((Buffer.isBuffer(output) ? output.toString("utf8") : output).trim());
+    }
+    catch {
+        throw failure;
+    }
+    if (!Array.isArray(parsed) || !parsed.every((item) => typeof item === "string"))
+        throw failure;
+    return parsed;
+}
+/** Checks the instructions with the runtime's scanner, then makes them the bot's persona. */
+export function refreshFleetLocalInstructions(agentUid, systemPrompt, deps = {}) {
+    const findings = scanFleetLocalInstructions(agentUid, systemPrompt, deps);
+    if (findings.length > 0) {
+        throw expectedError(`The bot's instructions contain wording the HQ Fleet Runtime refuses to load (${findings.join(", ")}). Reword the bot's persona.md, worker.yaml or memory notes and try again.`);
+    }
+    return writeFleetLocalSoul(agentUid, systemPrompt, deps);
 }
 function checkedRun(run, executable, args, options, label) {
     try {
@@ -557,58 +604,62 @@ function checkedRun(run, executable, args, options, label) {
         throw expectedError(`HQ Fleet Local ${label} failed.`);
     }
 }
-export function bootstrapFleetLocalBot(input, deps = {}) {
+export async function bootstrapFleetLocalBot(input, deps = {}) {
     const run = deps.run ?? execFileSync;
     const platform = deps.platform ?? process.platform;
     const root = deps.fleetHome ?? fleetHome();
+    const python = deps.python ?? await ensureFleetPython({ fleetHome: root, platform, run });
     const profileDir = profileRoot(input.agentUid, root);
     const sources = path.join(profileDir, "sources");
     const distributionSource = path.join(sources, "distribution");
     const runtimeSource = path.join(sources, "runtime");
     const runtimeDir = path.join(profileDir, "runtime");
     const marker = path.join(profileDir, "bootstrap.json");
-    const python = pythonCommand(run, platform);
     fs.mkdirSync(profileDir, { recursive: true, mode: 0o700 });
     if (!fs.existsSync(marker)) {
         fs.rmSync(sources, { recursive: true, force: true });
         fs.rmSync(runtimeDir, { recursive: true, force: true });
         fs.mkdirSync(distributionSource, { recursive: true, mode: 0o700 });
         fs.mkdirSync(runtimeSource, { recursive: true, mode: 0o700 });
-        checkedRun(run, python.executable, [
-            ...python.prefix,
+        const uvEnv = fleetUvEnv(python.pythonDir);
+        checkedRun(run, python.python, [
             "-m",
             "zipfile",
             "-e",
             input.installation.archive,
             distributionSource,
         ], { stdio: "ignore" }, "distribution extraction");
-        checkedRun(run, python.executable, [
-            ...python.prefix,
+        checkedRun(run, python.python, [
             "-m",
             "tarfile",
             "-e",
             input.installation.runtimeArchive,
             runtimeSource,
         ], { stdio: "ignore" }, "runtime extraction");
-        checkedRun(run, python.executable, [
-            ...python.prefix,
-            "-m",
+        checkedRun(run, python.uv, [
             "venv",
+            "--no-config",
+            "--python",
+            python.python,
             runtimeDir,
-        ], { stdio: "ignore" }, "environment creation");
+        ], { stdio: "ignore", env: uvEnv }, "environment creation");
         const runtimePython = venvExecutable(runtimeDir, "python", platform);
-        checkedRun(run, runtimePython, [
-            "-m",
+        checkedRun(run, python.uv, [
             "pip",
             "install",
-            "--disable-pip-version-check",
+            "--no-config",
+            "--python",
+            runtimePython,
             "--editable",
             `${runtimeSource}[all,messaging,slack,anthropic]`,
             distributionSource,
-        ], { stdio: ["ignore", 2, 2] }, "package installation");
+        ], { stdio: ["ignore", 2, 2], env: uvEnv }, "package installation");
         fs.writeFileSync(marker, `${JSON.stringify({ schemaVersion: 1, engine: input.installation.engine }, null, 2)}\n`, { mode: 0o600 });
     }
-    const profile = writeFleetLocalProfile(input, { fleetHome: root, platform });
+    const { systemPrompt, ...profileInput } = input;
+    if (systemPrompt !== undefined)
+        refreshFleetLocalInstructions(input.agentUid, systemPrompt, { fleetHome: root, platform, run });
+    const profile = writeFleetLocalProfile(profileInput, { fleetHome: root, platform });
     const helper = venvExecutable(runtimeDir, "hq-fleet-local", platform);
     const runtime = venvExecutable(runtimeDir, "hq-fleet", platform);
     if (!fs.existsSync(helper) || !fs.existsSync(runtime)) {

package/dist/lib/bot/fleet-python.d.ts

@@ -0,0 +1,47 @@
+type Exec = (executable: string, args: string[], options: Record<string, unknown>) => Buffer | string;
+export interface FleetPythonToolAsset {
+    name: string;
+    sha256: string;
+}
+export interface FleetPythonToolPin {
+    repository: string;
+    version: string;
+    assets: Record<string, FleetPythonToolAsset>;
+}
+export interface FleetPythonDeps {
+    fleetHome?: string;
+    platform?: NodeJS.Platform;
+    arch?: NodeJS.Architecture;
+    fetch?: typeof fetch;
+    run?: Exec;
+    tool?: FleetPythonToolPin;
+    pythonVersion?: string;
+    env?: NodeJS.ProcessEnv;
+}
+export interface FleetPython {
+    uv: string;
+    python: string;
+    pythonDir: string;
+}
+export declare const HQ_FLEET_PYTHON_VERSION = "3.13.17";
+export declare const HQ_FLEET_PYTHON_TOOL: FleetPythonToolPin;
+export declare const FLEET_PYTHON_TOOL_DOWNLOAD_TIMEOUT_MS: number;
+/** One lock for the whole machine: the installer and the private Python are shared by every bot. */
+export declare const FLEET_PYTHON_LOCK_NAME = "hq-fleet-python";
+/**
+ * The environment uv runs with: the user's own uv settings (index mirrors,
+ * cache, insecure hosts, config files) are dropped so the private install only
+ * ever sees the pinned sources.
+ */
+export declare function fleetUvEnv(pythonDir: string, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** The operating system's own tar when it is where it always is, so a `tar` on PATH or in the current folder is never run. */
+export declare function tarExecutable(platform: NodeJS.Platform, env?: NodeJS.ProcessEnv): string;
+export declare function fleetPythonToolPath(deps?: FleetPythonDeps): string;
+/**
+ * The pinned installer and private Python, installed once per machine under
+ * the fleet folder and reused by every bot. Concurrent creates wait for each
+ * other on one machine-wide lock instead of racing over the shared folder.
+ */
+export declare function ensureFleetPython(deps?: FleetPythonDeps): Promise<FleetPython>;
+export {};
+//# sourceMappingURL=fleet-python.d.ts.map

package/dist/lib/bot/fleet-python.js

@@ -0,0 +1,218 @@
+import { execFileSync } from "node:child_process";
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fleetHome } from "./fleet-local.js";
+import { withBotLock } from "./lock.js";
+export const HQ_FLEET_PYTHON_VERSION = "3.13.17";
+export const HQ_FLEET_PYTHON_TOOL = {
+    repository: "astral-sh/uv",
+    version: "0.13.5",
+    assets: {
+        "darwin-arm64": { name: "uv-aarch64-apple-darwin.tar.gz", sha256: "743f85035a1996ecb350659e01cd9faea9709829be09b1b4b03c73eaf3c9cd73" },
+        "darwin-x64": { name: "uv-x86_64-apple-darwin.tar.gz", sha256: "b0f52b0e3945b4107d89024ea38e625683011fbfc05a0d98f9fa2d6dcee28c66" },
+        "linux-arm64": { name: "uv-aarch64-unknown-linux-gnu.tar.gz", sha256: "4bb69cf95ed13f23713bb7bc09f241896ea0c75b7c557e615a20604b82f9c403" },
+        "linux-x64": { name: "uv-x86_64-unknown-linux-gnu.tar.gz", sha256: "f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f" },
+        "win32-arm64": { name: "uv-aarch64-pc-windows-msvc.zip", sha256: "09f47edf90726084a70f9426f6e3ca4f46e9bf7cbf23b1716ec64d60b055fae3" },
+        "win32-x64": { name: "uv-x86_64-pc-windows-msvc.zip", sha256: "a38b8d1902b7cfbc76b423ba1bb456f623f42064cdc72628b6075b89afd1019a" },
+    },
+};
+export const FLEET_PYTHON_TOOL_DOWNLOAD_TIMEOUT_MS = 5 * 60_000;
+/** One lock for the whole machine: the installer and the private Python are shared by every bot. */
+export const FLEET_PYTHON_LOCK_NAME = "hq-fleet-python";
+function expectedError(message) {
+    return Object.assign(new Error(message), { expected: true });
+}
+function toolBinaryName(platform) {
+    return platform === "win32" ? "uv.exe" : "uv";
+}
+/** The last lines a failed child process wrote, or its exit code, so the user sees why. */
+function causeOf(error) {
+    if (error && typeof error === "object") {
+        const failure = error;
+        const stderr = failure.stderr === undefined ? "" : (Buffer.isBuffer(failure.stderr) ? failure.stderr.toString("utf8") : String(failure.stderr));
+        const tail = stderr.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(-3).join(" ");
+        if (tail)
+            return tail;
+        if (typeof failure.status === "number")
+            return `exit code ${failure.status}`;
+        if (failure.message)
+            return failure.message;
+    }
+    return String(error);
+}
+/**
+ * The environment uv runs with: the user's own uv settings (index mirrors,
+ * cache, insecure hosts, config files) are dropped so the private install only
+ * ever sees the pinned sources.
+ */
+export function fleetUvEnv(pythonDir, base = process.env) {
+    const env = {};
+    for (const [key, value] of Object.entries(base)) {
+        if (!key.toUpperCase().startsWith("UV_"))
+            env[key] = value;
+    }
+    env.UV_PYTHON_INSTALL_DIR = pythonDir;
+    env.UV_NO_CONFIG = "1";
+    return env;
+}
+/** The operating system's own tar when it is where it always is, so a `tar` on PATH or in the current folder is never run. */
+export function tarExecutable(platform, env = process.env) {
+    const candidates = platform === "win32"
+        ? [path.join(env.SystemRoot ?? env.windir ?? "C:\\Windows", "System32", "tar.exe")]
+        : ["/usr/bin/tar", "/bin/tar"];
+    for (const candidate of candidates) {
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    return "tar";
+}
+export function fleetPythonToolPath(deps = {}) {
+    const root = deps.fleetHome ?? fleetHome();
+    const tool = deps.tool ?? HQ_FLEET_PYTHON_TOOL;
+    return path.join(root, "tools", "uv", tool.version, toolBinaryName(deps.platform ?? process.platform));
+}
+function findFile(dir, name) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const child = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            const found = findFile(child, name);
+            if (found)
+                return found;
+        }
+        else if (entry.isFile() && entry.name === name) {
+            return child;
+        }
+    }
+    return null;
+}
+function installedTool(binary) {
+    try {
+        const stat = fs.statSync(binary);
+        return stat.isFile() && stat.size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function installTool(deps) {
+    const platform = deps.platform ?? process.platform;
+    const arch = deps.arch ?? process.arch;
+    const tool = deps.tool ?? HQ_FLEET_PYTHON_TOOL;
+    const binary = fleetPythonToolPath(deps);
+    if (installedTool(binary))
+        return binary;
+    const asset = tool.assets[`${platform}-${arch}`];
+    if (!asset) {
+        throw expectedError(`HQ Fleet Local does not support ${platform} on ${arch} yet.`);
+    }
+    const fetcher = deps.fetch ?? fetch;
+    const run = deps.run ?? execFileSync;
+    const url = `https://github.com/${tool.repository}/releases/download/${tool.version}/${asset.name}`;
+    let response;
+    try {
+        response = await fetcher(url, { signal: AbortSignal.timeout(FLEET_PYTHON_TOOL_DOWNLOAD_TIMEOUT_MS) });
+    }
+    catch {
+        throw expectedError("Could not download the HQ Fleet Local runtime installer. Check your internet connection and retry.");
+    }
+    if (!response.ok) {
+        throw expectedError(`Could not download the HQ Fleet Local runtime installer: GitHub returned HTTP ${response.status}.`);
+    }
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (crypto.createHash("sha256").update(bytes).digest("hex") !== asset.sha256) {
+        throw expectedError("The HQ Fleet Local runtime installer download did not match its pinned checksum.");
+    }
+    const toolDir = path.dirname(binary);
+    const staging = `${toolDir}.staging-${process.pid}-${crypto.randomUUID()}`;
+    fs.mkdirSync(staging, { recursive: true, mode: 0o700 });
+    try {
+        const archive = path.join(staging, asset.name);
+        fs.writeFileSync(archive, bytes, { mode: 0o600 });
+        const extracted = path.join(staging, "extracted");
+        fs.mkdirSync(extracted, { mode: 0o700 });
+        try {
+            run(tarExecutable(platform, deps.env ?? process.env), ["-xf", archive, "-C", extracted], { stdio: ["ignore", "ignore", "pipe"], windowsHide: true });
+        }
+        catch (error) {
+            throw expectedError(`HQ Fleet Local could not unpack its runtime installer (${causeOf(error)}).`);
+        }
+        const unpacked = findFile(extracted, toolBinaryName(platform));
+        if (!unpacked)
+            throw expectedError("The HQ Fleet Local runtime installer archive did not contain the installer.");
+        const prepared = path.join(staging, "tool");
+        fs.mkdirSync(prepared, { mode: 0o700 });
+        fs.copyFileSync(unpacked, path.join(prepared, path.basename(binary)));
+        fs.chmodSync(path.join(prepared, path.basename(binary)), 0o700);
+        fs.mkdirSync(path.dirname(toolDir), { recursive: true, mode: 0o700 });
+        fs.rmSync(toolDir, { recursive: true, force: true });
+        fs.renameSync(prepared, toolDir);
+    }
+    finally {
+        fs.rmSync(staging, { recursive: true, force: true });
+    }
+    return binary;
+}
+function realpathOrSelf(target) {
+    try {
+        return fs.realpathSync.native(target);
+    }
+    catch {
+        return path.resolve(target);
+    }
+}
+function isInside(parent, child, platform) {
+    const fold = (value) => (platform === "win32" ? value.toLowerCase() : value);
+    const relative = path.relative(fold(realpathOrSelf(parent)), fold(realpathOrSelf(child)));
+    return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+async function ensureFleetPythonLocked(root, deps) {
+    const platform = deps.platform ?? process.platform;
+    const run = deps.run ?? execFileSync;
+    const version = deps.pythonVersion ?? HQ_FLEET_PYTHON_VERSION;
+    const pythonDir = path.join(root, "python");
+    const uv = await installTool(deps);
+    const env = fleetUvEnv(pythonDir, deps.env ?? process.env);
+    fs.mkdirSync(pythonDir, { recursive: true, mode: 0o700 });
+    try {
+        run(uv, ["python", "install", version, "--no-config", "--no-bin", "--no-registry", "--install-dir", pythonDir], {
+            stdio: ["ignore", "ignore", "pipe"],
+            env,
+            windowsHide: true,
+        });
+    }
+    catch (error) {
+        throw expectedError(`HQ Fleet Local could not install its private Python ${version} (${causeOf(error)}). If this mentions a download, check your internet connection and retry.`);
+    }
+    let found;
+    try {
+        const output = run(uv, ["python", "find", version, "--managed-python", "--no-config"], {
+            stdio: ["ignore", "pipe", "pipe"],
+            env,
+            encoding: "utf8",
+            windowsHide: true,
+        });
+        found = (Buffer.isBuffer(output) ? output.toString("utf8") : output).trim();
+    }
+    catch (error) {
+        throw expectedError(`HQ Fleet Local installed its private Python but could not locate it (${causeOf(error)}).`);
+    }
+    const python = path.resolve(found);
+    if (!found || !fs.existsSync(python) || !isInside(pythonDir, python, platform)) {
+        throw expectedError("HQ Fleet Local found a Python outside its private install and refused to use it.");
+    }
+    return { uv, python, pythonDir };
+}
+/**
+ * The pinned installer and private Python, installed once per machine under
+ * the fleet folder and reused by every bot. Concurrent creates wait for each
+ * other on one machine-wide lock instead of racing over the shared folder.
+ */
+export async function ensureFleetPython(deps = {}) {
+    const root = deps.fleetHome ?? fleetHome();
+    return withBotLock(FLEET_PYTHON_LOCK_NAME, () => ensureFleetPythonLocked(root, deps), {
+        command: "hq bot create",
+        root,
+    });
+}
+//# sourceMappingURL=fleet-python.js.map

package/dist/lib/bot/index.d.ts

@@ -26,4 +26,5 @@ export * from "./lock.js";
 export * from "./display-name.js";
 export * from "./decisions.js";
 export * from "./fleet-local.js";
+export * from "./fleet-python.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/bot/index.js

@@ -26,4 +26,5 @@ export * from "./lock.js";
 export * from "./display-name.js";
 export * from "./decisions.js";
 export * from "./fleet-local.js";
+export * from "./fleet-python.js";
 //# sourceMappingURL=index.js.map

package/dist/lib/bot/prompt.d.ts

@@ -103,6 +103,11 @@ export interface BuildSystemPromptInput {
     } | null;
     /** hqRoot-relative (default `${workerDir}/memory`) or absolute. */
     memoryDir?: string;
+    /**
+     * The bot runs on the HQ Fleet Runtime, which labels every message with the
+     * sender's HQ identity and prepends no "Owner context" block.
+     */
+    fleetRuntime?: boolean;
 }
 /**
  * One paragraph saying which kind of bot this is and what that means for the
@@ -110,7 +115,7 @@ export interface BuildSystemPromptInput {
  * acts as its owner everywhere; a company bot acts as itself and cannot
  * create anything for the owner.
  */
-export declare function botKindParagraph(input: Pick<BuildSystemPromptInput, "agentUid" | "ownerUid" | "kind" | "companies">): string;
+export declare function botKindParagraph(input: Pick<BuildSystemPromptInput, "agentUid" | "ownerUid" | "kind" | "companies" | "fleetRuntime">): string;
 /**
  * The standing instructions the bot runs under. The DM body is delivered as
  * the user turn; this text is the system prompt (claude/codex) or the prompt

package/dist/lib/bot/prompt.js

@@ -278,12 +278,17 @@ export function botKindParagraph(input) {
             `If asked to, say plainly that you are a company bot and cannot do that, and suggest your owner ask one of their personal bots (or do it themselves in HQ). ` +
             `Nobody's messages carry an "Owner context" block; never state which companies your owner belongs to.`);
     }
+    const ownerContext = input.fleetRuntime
+        ? `The runtime labels every message with the sender's HQ identity: messages from ${input.ownerUid} are your owner's, and only those carry your owner's authority. ` +
+            `When you need to know which companies your owner belongs to, run \`hq whoami\` yourself; never guess. ` +
+            `Other people read your answers in rooms: in a room, never state which companies your owner belongs to, and never repeat anything from their files or your DMs.`
+        : `Direct messages from your owner start with an "Owner context" block checked with your owner's own sign-in; that is the only source for your owner's companies. ` +
+            `If it says the check failed, say you could not check; never say your owner has no company unless that block says so. ` +
+            `Room messages do not carry it, and other people read your answers there: in a room, never state which companies your owner belongs to, and never repeat anything from their files or your DMs.`;
     return (`You are a PERSONAL bot: you act as your owner, ${input.ownerUid}. ` +
         `Every \`hq\` command you run — in direct messages, in rooms, and on your first task — runs with your owner's own sign-in, so it reaches everything they can: all of their companies and files. ` +
         `Creating a company, a bot, an invite or a share for them works directly, so do it yourself when they ask — never tell them to open a terminal or run a command. ` +
-        `Direct messages from your owner start with an "Owner context" block checked with your owner's own sign-in; that is the only source for your owner's companies. ` +
-        `If it says the check failed, say you could not check; never say your owner has no company unless that block says so. ` +
-        `Room messages do not carry it, and other people read your answers there: in a room, never state which companies your owner belongs to, and never repeat anything from their files or your DMs.`);
+        ownerContext);
 }
 /**
  * The standing instructions the bot runs under. The DM body is delivered as

package/dist/lib/daemon/catalog.d.ts

@@ -11,11 +11,11 @@
  */
 import type { MachineType } from "./machine-type.js";
 import type { SyncOwner } from "./config.js";
-import type { SyncCoreCanaryPlan } from "./sync-core-canary.js";
+import { type SyncCoreVaultPlan } from "../sync-core/engine-home.js";
 import type { RemoteControlPoolsConfig } from "./remote-control-pools.js";
 import { type SyncRunnerProcess } from "./sync-runner.js";
 import { type VaultSyncSwitches } from "../vault-sync-switches.js";
-export declare const SERVICE_NAMES: readonly ["sync", "mesh", "heartbeat", "inbox", "bots", "remote-control", "codex-remote-control", "session-host", "lanes-reconcile", "search-index", "jobs-reconcile", "updater", "housekeeping"];
+export declare const SERVICE_NAMES: readonly ["sync", "sync-core", "mesh", "heartbeat", "inbox", "bots", "remote-control", "codex-remote-control", "session-host", "lanes-reconcile", "search-index", "jobs-reconcile", "updater", "housekeeping"];
 export type ServiceName = (typeof SERVICE_NAMES)[number];
 export declare function isServiceName(value: unknown): value is ServiceName;
 export declare const SERVICE_DESCRIPTIONS: Record<ServiceName, string>;
@@ -86,6 +86,13 @@ export interface UnitPlan {
         idleIntervalSec: number;
     };
 }
+export interface SyncCoreRunning {
+    personal: boolean;
+    companies: ReadonlySet<string>;
+}
+export declare const SYNC_CORE_RECONCILE_UNIT = "sync-core";
+export declare const SYNC_CORE_RECONCILE_INTERVAL_SEC = 600;
+export declare const SYNC_CORE_LEGACY_SETTLE_MS: number;
 export interface PlanContext {
     machineType: MachineType;
     platform: NodeJS.Platform;
@@ -113,9 +120,10 @@ export interface PlanContext {
     vaultSync?: VaultSyncSwitches;
     /** Persisted/effective owner selected for this machine. */
     syncOwner: SyncOwner;
-    syncCoreCanary?: SyncCoreCanaryPlan;
+    syncCoreVaults?: readonly SyncCoreVaultPlan[];
+    syncCoreRunning?: SyncCoreRunning;
     legacySyncReadyForCore?: boolean;
-    syncCoreCanaryRunning?: boolean;
+    now?: number;
     /** A legacy desktop app or sync unit is still managing sync. */
     desktopAppManagesSync: boolean;
     /** Full process list, or null when the daemon could not read it. */