@indigoai-us/hq-cli 5.345.173 → 5.345.175

package/dist/commands/deploy-domains.js

@@ -615,6 +615,223 @@ async function removeAction(domainArg, options) {
         console.log(displayText(warning));
     }
 }
+// ---------------------------------------------------------------------------
+// Company deploy domain (`base`): one domain for every app of the company
+// (`<app>.<domain>`), served by hq-deploy's /api/orgs/:orgSlug/base-domain
+// routes, the same ones the desktop Deployments panel uses. The flag,
+// Enterprise and price checks run on the server (hq-pro), so this command
+// prints the server's answer: billingBasis and monthlyPriceUsd.
+/** Hard deadline for `base status --wait`, so a script never waits forever. */
+export const BASE_WAIT_DEFAULT_MINUTES = 15;
+export const BASE_WAIT_MAX_MINUTES = 60;
+const BASE_POLL_INTERVAL_MS = 15_000;
+/** Clock hooks for `base status --wait`. Tests replace these. */
+export const deployDomainsClock = {
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+};
+const BASE_MESSAGES = {
+    DOMAIN_NOT_ENTITLED: "A company deploy domain is not enabled for this company yet.",
+    BASE_DOMAIN_NOT_FOUND: "This company has no deploy domain. Add one with 'hq deploy domains base add <domain>'.",
+    BASE_DOMAIN_ALREADY_SET: "This company already has a deploy domain. Remove it first with 'hq deploy domains base remove'.",
+    BASE_DOMAIN_CLAIM_EXPIRED: "The claim expired before it went live. Add the domain again to get new DNS records.",
+    BASE_DOMAIN_CLAIMED: "That domain is already the deploy domain of another company.",
+    ORG_ACCESS_DENIED: "You are not a member of that company.",
+};
+async function baseError(response, orgSlug) {
+    const clone = response.clone();
+    const body = await readBody(clone);
+    const code = apiCode(body, response.status);
+    if (BASE_MESSAGES[code] && !SERVER_WORDED_CODES.has(code)) {
+        return new DeployDomainsError(BASE_MESSAGES[code], code, response.status);
+    }
+    if (response.status === 409 && !DEPLOY_MESSAGES[code]) {
+        const serverMessage = apiField(body, "message");
+        if (typeof serverMessage === "string" && serverMessage.trim()) {
+            return new DeployDomainsError(displayText(serverMessage), code, response.status);
+        }
+    }
+    return deployError(response, orgSlug);
+}
+/**
+ * The price line for a company deploy domain, from the server's answer:
+ * Enterprise includes it; a company with a price override (or comped) pays
+ * what the server says, $0 included; otherwise the server's price, falling
+ * back to the published premium price, then $500.
+ */
+export function baseDomainPriceLine(body, pricing) {
+    const basis = body.billingBasis;
+    const price = typeof body.monthlyPriceUsd === "number" && body.monthlyPriceUsd >= 0 ? body.monthlyPriceUsd : undefined;
+    if (basis === "enterprise")
+        return "Included with the Enterprise plan: no monthly charge.";
+    if (basis === "comped")
+        return `This company deploy domain is included for this company: ${usd(price ?? 0)}/month.`;
+    if (basis === "paid") {
+        const published = domainsBlock(pricing)?.premiumUsd;
+        const amount = price ?? (typeof published === "number" && published > 0 ? published : 500);
+        return amount === 0
+            ? "This company deploy domain is $0/month for this company (price override)."
+            : `This company deploy domain adds ${usd(amount)}/month to the company bill.`;
+    }
+    return undefined;
+}
+/** The approval question for `base add`, before the server says the basis. */
+export function baseAddConfirmQuestion(domain, orgSlug, pricing) {
+    const premium = domainsBlock(pricing)?.premiumUsd;
+    const price = typeof premium === "number" && premium > 0 ? `${usd(premium)}/month` : "a monthly add-on";
+    return `Make ${displayText(domain)} the deploy domain of '${orgSlug}', so every app serves at <app>.${displayText(domain)}? ` +
+        `It costs ${price}, billed to '${orgSlug}', unless the company is Enterprise or has a price override.`;
+}
+function baseSlug(options) {
+    if (options.company !== undefined)
+        return resolveSlug(options.company, undefined);
+    const binding = readLinkedApp(path.resolve(options.path ?? process.cwd()));
+    return resolveSlug(undefined, binding?.orgSlug);
+}
+function baseRoute(orgSlug, suffix = "") {
+    return `/api/orgs/${encodeURIComponent(orgSlug)}/base-domain${suffix}`;
+}
+function baseState(body) {
+    const certificate = body.certificate && typeof body.certificate === "object" ? body.certificate : {};
+    const serving = body.serving && typeof body.serving === "object" ? body.serving : {};
+    const status = typeof body.status === "string" ? body.status : "unknown";
+    const servingStatus = typeof serving.status === "string" ? serving.status : null;
+    return {
+        ...(typeof body.baseDomain === "string" ? { baseDomain: body.baseDomain } : {}),
+        status,
+        certStatus: typeof certificate.status === "string" ? certificate.status : null,
+        servingStatus,
+        servingError: typeof serving.error === "string" && serving.error ? serving.error : null,
+        records: dnsRecords(body.records),
+        live: status === "live" || servingStatus === "live",
+        raw: body,
+    };
+}
+function describeBaseState(state) {
+    if (state.live)
+        return "live";
+    if (state.status === "failed")
+        return "failed";
+    if (state.certStatus !== "ISSUED")
+        return `waiting for DNS validation (certificate ${state.certStatus ?? "not requested"})`;
+    return `certificate issued, serving ${state.servingStatus ?? "not attached yet"}`;
+}
+async function baseAddAction(domainArg, options) {
+    const domain = normalizeDomain(domainArg);
+    const token = await ensureCognitoToken();
+    const orgSlug = baseSlug(options);
+    const pricing = await fetchPricingBody();
+    await confirm(baseAddConfirmQuestion(domain, orgSlug, pricing), options.yes, "add the company deploy domain");
+    const response = await request(token, orgSlug, baseRoute(orgSlug), "POST", { baseDomain: domain });
+    if (!response.ok)
+        throw await baseError(response, orgSlug);
+    const body = await readBody(response);
+    const state = baseState(body);
+    const priceLine = baseDomainPriceLine(body, pricing);
+    if (options.json) {
+        console.log(safeJson({
+            ok: true,
+            orgSlug,
+            baseDomain: state.baseDomain ?? domain,
+            status: state.status,
+            certificate: state.certStatus,
+            records: state.records,
+            ...(typeof body.billingBasis === "string" ? { billingBasis: body.billingBasis } : {}),
+            ...(typeof body.monthlyPriceUsd === "number" ? { monthlyPriceUsd: body.monthlyPriceUsd } : {}),
+            ...(priceLine ? { billingMessage: priceLine } : {}),
+        }));
+        return;
+    }
+    console.log(`${displayText(domain)} is now the deploy domain of '${orgSlug}'. It is not live yet.`);
+    if (priceLine)
+        console.log(priceLine);
+    printDnsRecords(state.records);
+    if (state.records.length < 2) {
+        console.log("The certificate's validation record can take a few seconds to appear; 'hq deploy domains base status' prints it.");
+    }
+    console.log("When the records are in place, run: hq deploy domains base status --wait");
+}
+async function baseStatusAction(options) {
+    const token = await ensureCognitoToken();
+    const orgSlug = baseSlug(options);
+    const minutes = options.timeout === undefined ? BASE_WAIT_DEFAULT_MINUTES : Number(options.timeout);
+    if (!Number.isFinite(minutes) || minutes <= 0 || minutes > BASE_WAIT_MAX_MINUTES) {
+        throw new DeployDomainsError(`--timeout must be 1 to ${BASE_WAIT_MAX_MINUTES} minutes.`, "INVALID_TIMEOUT");
+    }
+    const deadline = deployDomainsClock.now() + minutes * 60_000;
+    let state;
+    let attempts = 0;
+    for (;;) {
+        attempts += 1;
+        // Refresh advances the claim itself: it re-checks the certificate and,
+        // once issued, attaches serving and polls it to live.
+        const response = await request(token, orgSlug, baseRoute(orgSlug, "/refresh"), "POST");
+        if (!response.ok)
+            throw await baseError(response, orgSlug);
+        state = baseState(await readBody(response));
+        if (state.live || state.status === "failed" || !options.wait)
+            break;
+        if (!options.json)
+            console.error(`${new Date(deployDomainsClock.now()).toISOString()}  ${describeBaseState(state)}`);
+        if (deployDomainsClock.now() + BASE_POLL_INTERVAL_MS > deadline)
+            break;
+        await deployDomainsClock.sleep(BASE_POLL_INTERVAL_MS);
+    }
+    const timedOut = Boolean(options.wait) && !state.live && state.status !== "failed";
+    if (!state.live)
+        process.exitCode = state.status === "failed" ? 1 : REFRESH_NOT_SERVING_EXIT_CODE;
+    if (options.json) {
+        console.log(safeJson({
+            ok: true,
+            orgSlug,
+            baseDomain: state.baseDomain ?? null,
+            status: state.status,
+            live: state.live,
+            certificate: state.certStatus,
+            serving: state.servingStatus,
+            ...(state.servingError ? { servingError: state.servingError } : {}),
+            records: state.live ? [] : state.records,
+            attempts,
+            ...(timedOut ? { timedOut: true } : {}),
+        }));
+        return;
+    }
+    const name = displayText(state.baseDomain ?? "The company deploy domain");
+    if (state.live) {
+        console.log(`${name} is live. Every app of '${orgSlug}' serves at <app>.${name}.`);
+        return;
+    }
+    if (state.status === "failed") {
+        console.log(`${name} failed to go live${state.servingError ? `: ${displayText(state.servingError)}` : "."} Remove it and add it again.`);
+        return;
+    }
+    console.log(`${name} is not live yet: ${describeBaseState(state)}.`);
+    printDnsRecords(state.records);
+    console.log(timedOut
+        ? `Stopped waiting after ${minutes} minutes. Run 'hq deploy domains base status --wait' again to keep waiting.`
+        : "Run 'hq deploy domains base status --wait' to wait until it is live.");
+}
+async function baseRemoveAction(options) {
+    const token = await ensureCognitoToken();
+    const orgSlug = baseSlug(options);
+    await confirm(`Remove the deploy domain of '${orgSlug}'? Every app stops serving on it, and if it is billed, its monthly charge stops.`, options.yes, "remove the company deploy domain");
+    const response = await request(token, orgSlug, baseRoute(orgSlug), "DELETE");
+    if (!response.ok)
+        throw await baseError(response, orgSlug);
+    const body = await readBody(response);
+    const removed = body.removed === true;
+    const billingRemovalPending = body.billingRemovalPending === true;
+    const warning = typeof body.warning === "string" ? body.warning : undefined;
+    if (options.json) {
+        console.log(safeJson({ ok: true, orgSlug, removed, billingRemovalPending, ...(warning ? { warning } : {}) }));
+        return;
+    }
+    console.log(removed ? `Removed the deploy domain of '${orgSlug}'.` : `'${orgSlug}' had no deploy domain to remove.`);
+    if (warning)
+        console.log(displayText(warning));
+    else if (billingRemovalPending)
+        console.log("Its charge could not be stopped right away. HQ keeps retrying until the charge is removed.");
+}
 async function purchaseRequest(token, companyUid, suffix, body) {
     try {
         return await vaultApiFetch({
@@ -782,6 +999,26 @@ export function registerDeployDomainsCommand(deploy) {
         .description("Unlink a custom domain from an app")
         .option("--env <name>", "pick the environment when the domain points at more than one")
         .option("--yes", "remove without a prompt")).action((domain, options) => run(options.json, () => removeAction(domain, options)));
+    const base = domains
+        .command("base")
+        .description("Manage the company deploy domain: one domain for every app (<app>.<domain>)");
+    const baseCommon = (command) => command
+        .option("--company <slug>", "use this company instead of the linked or active company")
+        .option("--path <dir>", "folder linked to an app of the company (default: current folder)")
+        .option("--json", "print machine-readable JSON");
+    baseCommon(base
+        .command("add <domain>")
+        .description("Claim a company deploy domain; prints the price and the DNS records")
+        .option("--yes", "add without a prompt (the domain can add a monthly charge)")).action((domain, options) => run(options.json, () => baseAddAction(domain, options)));
+    baseCommon(base
+        .command("status")
+        .description(`Check the company deploy domain and advance it toward live (exits ${REFRESH_NOT_SERVING_EXIT_CODE} while not live)`)
+        .option("--wait", "keep checking until it is live or the timeout passes")
+        .option("--timeout <minutes>", `stop waiting after this many minutes (default ${BASE_WAIT_DEFAULT_MINUTES}, at most ${BASE_WAIT_MAX_MINUTES})`)).action((options) => run(options.json, () => baseStatusAction(options)));
+    baseCommon(base
+        .command("remove")
+        .description("Release the company deploy domain")
+        .option("--yes", "remove without a prompt")).action((options) => run(options.json, () => baseRemoveAction(options)));
     domains
         .command("search <query>")
         .description("Check whether a domain can be bought, and its price")

package/dist/commands/dm.d.ts

@@ -392,6 +392,13 @@ export interface CallerIdentity {
  * Pure → unit-testable.
  */
 export declare function callerFromToken(token: string): CallerIdentity;
+/**
+ * Vault scope uid for `--attach`. Human Cognito sessions do not carry
+ * `custom:entityUid` (hq-pro sets that only on agent and outpost tokens), so
+ * JWT peek is not enough after a normal `hq login`. Fall back to the
+ * canonical person lookup used by `--personal` files and secrets.
+ */
+export declare function callerUidForAttach(token: string): Promise<string>;
 /**
  * Newest-first channel history → the caller's most recent top-level eventId.
  * Replies (those with rootEventId) are skipped. Pure → unit-testable.

package/dist/commands/dm.js

@@ -1,7 +1,7 @@
 import chalk from "chalk";
 import { readFileSync } from "node:fs";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { resolveDestinationCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { resolveCallerPersonUid, resolveDestinationCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
 import { redactAgentInboxItem as redactInboxCredentials } from "../lib/agent-kit/inbox-redact.js";
@@ -792,9 +792,9 @@ async function runChannelSend(channelName, message, opts) {
         // personal channels in the caller's personal vault.
         let uploaded = [];
         if (localFiles.length > 0) {
-            const callerUid = callerFromToken(token).personUid;
+            const callerUid = await callerUidForAttach(token);
             const scopeUid = channel.companyUid?.trim()
-                ? attachmentScopeForChannel(channel, callerUid ?? "")
+                ? attachmentScopeForChannel(channel, callerUid)
                 : personalScopeForCaller(callerUid);
             uploaded = await uploadDmAttachments({
                 token,
@@ -989,7 +989,7 @@ async function runDmSend(recipient, message, rawOpts) {
         if (localFiles.length > 0) {
             // A 1:1 attachment is stored in the SENDER's personal vault under the
             // sorted participant pair; the server lets either member read it.
-            const callerUid = callerFromToken(token).personUid;
+            const callerUid = await callerUidForAttach(token);
             const scopeUid = personalScopeForCaller(callerUid);
             const peerUid = await resolveDmPeerUid(token, recipient);
             uploaded = await uploadDmAttachments({
@@ -1363,6 +1363,18 @@ export function callerFromToken(token) {
         ...(emailNorm ? { email: emailNorm } : {}),
     };
 }
+/**
+ * Vault scope uid for `--attach`. Human Cognito sessions do not carry
+ * `custom:entityUid` (hq-pro sets that only on agent and outpost tokens), so
+ * JWT peek is not enough after a normal `hq login`. Fall back to the
+ * canonical person lookup used by `--personal` files and secrets.
+ */
+export async function callerUidForAttach(token) {
+    const fromJwt = callerFromToken(token).personUid;
+    if (fromJwt)
+        return fromJwt;
+    return resolveCallerPersonUid(token, undefined, { command: "hq dm --attach" });
+}
 function isCallerMessage(m, me) {
     if (me.personUid && m.fromPersonUid === me.personUid)
         return true;

package/dist/lib/bot/fleet-local.d.ts

@@ -56,6 +56,7 @@ export interface FleetLocalInstallDeps {
     fleetHome?: string;
     fetch?: typeof fetch;
     token?: () => string;
+    hqReleaseLinks?: (release: FleetLocalReleasePin) => Promise<Map<string, string> | null>;
     now?: () => Date;
     release?: FleetLocalReleasePin;
     publicKey?: string;
@@ -114,6 +115,7 @@ export declare const HQ_FLEET_LOCAL_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMC
 export declare function fleetHome(home?: string, env?: NodeJS.ProcessEnv): string;
 export declare function verifyFleetLocalRelease(files: FleetLocalReleaseFiles, release?: FleetLocalReleasePin, publicKey?: string): void;
 export declare function resolveFleetReleaseToken(env?: NodeJS.ProcessEnv): string;
+export declare function fetchHqFleetReleaseLinks(release: FleetLocalReleasePin): Promise<Map<string, string> | null>;
 export declare const FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS = 30000;
 export declare const FLEET_LOCAL_ARCHIVE_DOWNLOAD_TIMEOUT_MS: number;
 export declare const FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS: number;

package/dist/lib/bot/fleet-local.js

@@ -5,16 +5,18 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { HQ_FLEET_RUNTIME_ENGINE_ID, } from "./config.js";
 import { ensureFleetPython, fleetUvEnv } from "./fleet-python.js";
+import { ensureCognitoToken } from "../../utils/cognito-session.js";
+import { vaultApiFetch } from "../../utils/vault-api.js";
 export const HQ_FLEET_LOCAL_RELEASE = {
     repository: "indigoai-us/hq-fleet-local",
-    tag: "v0.4.5",
-    version: "0.4.5",
-    artifact: "hq-fleet-local-0.4.5.zip",
-    artifactSha256: "5dc05b1a9c8a3fce0d748c1f642a908c4166958cf4e1c3cec8ee3799148eef80",
+    tag: "v0.4.6",
+    version: "0.4.6",
+    artifact: "hq-fleet-local-0.4.6.zip",
+    artifactSha256: "24e48887dd4450ad63eda11e61f78363b0cc53b3fc87e3fd21bfe97e4a430865",
     runtimeArtifact: "hq-fleet-runtime-abccac13bd9e.tar",
     runtimeArtifactSha256: "29bcfe718ad7fbd3636afd00623772f2a25bc84c4f6f10d8d57f38e549d528d5",
-    manifestSha256: "ffb81d7cbb61cdd05e91208ac3eccf045789d9e068309da3164fe002991f7780",
-    signatureSha256: "3792d43c191c65c731e9f27a003d86334b4695a43feb8ac23a7b679f79531616",
+    manifestSha256: "5cc06b30a724419c22f4ab116db1ae745158d33c4aa46c7be04d29639172af1d",
+    signatureSha256: "b7a6c771dc674423b56db36f58b5a2a2a49eb2e27b33a41206fcc228a11d1def",
     runtimeCommit: "abccac13bd9ea593b24c8cd9c0ba28d5c6050cc9",
 };
 export const HQ_FLEET_LOCAL_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
@@ -92,9 +94,69 @@ export function resolveFleetReleaseToken(env = process.env) {
             return value;
     }
     catch {
-        throw expectedError("HQ Fleet Local is a private Indigo preview. Sign in with GitHub CLI or set HQ_FLEET_RELEASE_GITHUB_TOKEN before creating this bot.");
+        throw expectedError("HQ could not provide the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
     }
-    throw expectedError("GitHub CLI returned an empty token for the private HQ Fleet Local release. Run gh auth login and retry.");
+    throw expectedError("HQ could not provide the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
+}
+export async function fetchHqFleetReleaseLinks(release) {
+    let token;
+    try {
+        token = await ensureCognitoToken({ tokenSource: "person", interactive: false });
+    }
+    catch {
+        return null;
+    }
+    const response = await vaultApiFetch({
+        token,
+        path: `/v1/fleet-local/releases/${encodeURIComponent(release.version)}`,
+        signal: AbortSignal.timeout(FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
+    });
+    if (response.status === 401 || response.status === 403) {
+        throw expectedError("HQ refused the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
+    }
+    if (response.status === 404)
+        return null;
+    if (!response.ok) {
+        throw expectedError(`Could not get the HQ Fleet Local ${release.tag} download: HQ returned HTTP ${response.status}.`);
+    }
+    const body = (await response.json());
+    const links = new Map();
+    for (const asset of body.assets ?? []) {
+        if (typeof asset.name === "string" && typeof asset.url === "string")
+            links.set(asset.name, asset.url);
+    }
+    return links.size > 0 ? links : null;
+}
+function trustedReleaseLink(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" && parsed.hostname.endsWith(".amazonaws.com");
+    }
+    catch {
+        return false;
+    }
+}
+async function downloadFleetLocalReleaseFromHq(release, fetcher, links) {
+    const get = async (name, timeoutMs) => {
+        const url = links.get(name);
+        if (!url)
+            throw expectedError(`HQ Fleet Local ${release.tag} is missing release asset ${name}.`);
+        if (!trustedReleaseLink(url)) {
+            throw expectedError(`HQ Fleet Local ${release.tag} returned an untrusted download link for ${name}.`);
+        }
+        const response = await fetcher(url, { signal: AbortSignal.timeout(timeoutMs) });
+        if (!response.ok) {
+            throw expectedError(`Could not download ${name}: HQ storage returned HTTP ${response.status}.`);
+        }
+        return Buffer.from(await response.arrayBuffer());
+    };
+    const [archive, runtimeArchive, manifest, signature] = await Promise.all([
+        get(release.artifact, FLEET_LOCAL_ARCHIVE_DOWNLOAD_TIMEOUT_MS),
+        get(release.runtimeArtifact, FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS),
+        get("release-manifest.json", FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
+        get("release-manifest.sig", FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
+    ]);
+    return { archive, runtimeArchive, manifest, signature };
 }
 async function responseBytes(response, label) {
     if (!response.ok) {
@@ -196,8 +258,11 @@ export async function installPinnedFleetLocalDistribution(deps = {}) {
         verifyFleetLocalRelease(current, release, publicKey);
     }
     else {
-        const token = (deps.token ?? resolveFleetReleaseToken)();
-        const files = await downloadFleetLocalRelease(release, deps.fetch ?? fetch, token);
+        const fetcher = deps.fetch ?? fetch;
+        const links = await (deps.hqReleaseLinks ?? fetchHqFleetReleaseLinks)(release);
+        const files = links
+            ? await downloadFleetLocalReleaseFromHq(release, fetcher, links)
+            : await downloadFleetLocalRelease(release, fetcher, (deps.token ?? resolveFleetReleaseToken)());
         verifyFleetLocalRelease(files, release, publicKey);
         installFiles(dir, files, release, publicKey);
     }

package/dist/lib/bot/run.d.ts

@@ -85,6 +85,8 @@ export declare const FAILURE_WINDOW_MS: number;
 export declare const FAILURE_LIMIT = 5;
 /** Resumed-session failures with the model CLI's unknown error, in a row, before the session is cleared. */
 export declare const RESUMED_UNKNOWN_ERROR_LIMIT = 2;
+/** Wait before the one automatic re-run of a turn whose runtime crashed before it started. */
+export declare const RUNTIME_CRASH_RETRY_DELAY_MS = 3000;
 export declare const MAX_ATTEMPTS_PER_MESSAGE = 3;
 export declare const THINKING_EMOJI = "\uD83D\uDC40";
 export declare const ROOM_THINKING_STATUS = "is thinking\u2026";

package/dist/lib/bot/run.js

@@ -129,6 +129,8 @@ export const FAILURE_WINDOW_MS = 10 * 60 * 1000;
 export const FAILURE_LIMIT = 5;
 /** Resumed-session failures with the model CLI's unknown error, in a row, before the session is cleared. */
 export const RESUMED_UNKNOWN_ERROR_LIMIT = 2;
+/** Wait before the one automatic re-run of a turn whose runtime crashed before it started. */
+export const RUNTIME_CRASH_RETRY_DELAY_MS = 3_000;
 /** The model CLI's own message, exactly; "Unexpected token" in a stack trace is not it. */
 const RESUMED_UNKNOWN_ERROR = /an unknown error occurred \(unexpected\)/i;
 export const MAX_ATTEMPTS_PER_MESSAGE = 3;
@@ -693,7 +695,7 @@ export async function runBot(deps) {
         // nothing while their next messages wait out the hold.
         if (tell) {
             try {
-                await tell(holdNoticeText(modelHoldMs, messagePending, cls ? runtimeFailureText(cls, runtime.id) : undefined));
+                await tell(holdNoticeText(modelHoldMs, messagePending, cls ? runtimeFailureText(cls, runtime.id, "message", config.name) : undefined));
             }
             catch (err) {
                 log("warn", `could not say that turns are on hold: ${err instanceof Error ? err.message : String(err)}`);
@@ -1039,16 +1041,35 @@ export async function runBot(deps) {
             }
             return turn;
         };
-        const session = readBotSession(dir, config.runtime, sessionScope);
+        const attemptOnce = async () => {
+            const session = readBotSession(dir, config.runtime, sessionScope);
+            try {
+                return await runAttempt(session, await composePrompt(session));
+            }
+            catch (err) {
+                if (!missingResumedSession(err))
+                    throw err;
+                clearBotSession(dir, sessionScope);
+                log("warn", "saved model session is gone; starting a new one with recent DM history");
+                return await runAttempt(null, await composePrompt(null));
+            }
+        };
         try {
-            return await runAttempt(session, await composePrompt(session));
+            return await attemptOnce();
         }
         catch (err) {
-            if (!missingResumedSession(err))
+            // The coding tool's process died before the turn started (Bun's
+            // "error: An unknown error occurred (Unexpected)" after a long idle,
+            // October 2026). A fresh process usually works: wait a moment and run
+            // the same turn once more. If that fails too, the caller's normal
+            // failure path tells the person (with the Heal bot card).
+            if (stream.signal?.aborted || classifyRuntimeError(err) !== "runtime-crashed")
                 throw err;
-            clearBotSession(dir, sessionScope);
-            log("warn", "saved model session is gone; starting a new one with recent DM history");
-            return await runAttempt(null, await composePrompt(null));
+            log("info", "runtime crashed before the turn started; retrying once");
+            await sleep(RUNTIME_CRASH_RETRY_DELAY_MS, stream.signal);
+            if (stream.signal?.aborted)
+                throw err;
+            return await attemptOnce();
         }
     };
     /** Failure bookkeeping shared by every model turn: window, health, status, log, stale session. */
@@ -1059,7 +1080,20 @@ export async function runBot(deps) {
         const count = failures.record(now().getTime());
         modelHealth = count >= FAILURE_LIMIT ? "failed" : "degraded";
         setStatus({ restarts: (readStatus()?.restarts ?? 0) + 1, recentFailures: count, lastError: excerpt.slice(0, 400) });
-        log("error", `model turn failed (${count}/${FAILURE_LIMIT} in window, ${classifyRuntimeError(err)}): ${excerpt}`);
+        const cls = classifyRuntimeError(err);
+        log("error", `model turn failed (${count}/${FAILURE_LIMIT} in window, ${cls}): ${excerpt}`);
+        if (cls === "runtime-crashed" && err instanceof RuntimeError) {
+            const stderr = (err.stderrFull ?? err.stderrExcerpt).slice(0, 2000);
+            log("error", `runtime crash evidence: exit ${err.exitCode ?? "?"}, lived ${err.durationMs ?? "?"} ms, binary ${err.binaryPath ?? runtime.binary}; stderr: ${JSON.stringify(stderr)}; stdout head: ${JSON.stringify((err.stdoutHead ?? "").slice(0, 300))}`);
+            setStatus({
+                lastCrash: {
+                    at: now().toISOString(),
+                    code: err.exitCode,
+                    ...(err.durationMs !== undefined ? { durationMs: err.durationMs } : {}),
+                    stderr,
+                },
+            });
+        }
         // A resumed session that no longer exists must not poison every turn: the
         // next turn starts fresh with the recent DM history prepended. The model
         // CLI's "An unknown error occurred (Unexpected)" (every turn of a
@@ -1683,7 +1717,7 @@ export async function runBot(deps) {
                 runtime: runtime.id,
                 botName: config.name,
                 context: "kickoff",
-                ...(outcome.started && poster.postedCount > 0 ? { text: runtimeDidNotFinishText(cls, runtime.id, true) } : {}),
+                ...(outcome.started && poster.postedCount > 0 ? { text: runtimeDidNotFinishText(cls, runtime.id, true, config.name) } : {}),
             });
         try {
             await postRepair(target, notice);
@@ -1852,7 +1886,7 @@ export async function runBot(deps) {
             }
             // A missing tool does not come back between retries: say so now.
             if (attempt >= MAX_ATTEMPTS_PER_MESSAGE || cls === "not-installed") {
-                const plain = runtimeFailureText(cls, runtime.id);
+                const plain = runtimeFailureText(cls, runtime.id, "message", config.name);
                 await sendToPerson(`I couldn't run this one. ${plain}`).catch(() => undefined);
                 await completeJobRun(jobId, id, { status: "failed", output: jobRunOutput(plain), disposition: `${runtime.id} could not be started` });
                 markReported("failed");
@@ -1872,12 +1906,12 @@ export async function runBot(deps) {
         // reports and says this real reason, not "the bot was restarted".
         // What the cloud stores as the run's output: plain words, never the raw
         // runtime text (that is in the bot log and status.json).
-        const jobOutput = outcome.aborted ? `${STOPPED_BY_OWNER_REASON}.` : runtimeFailureText(failureClass(outcome), runtime.id);
+        const jobOutput = outcome.aborted ? `${STOPPED_BY_OWNER_REASON}.` : runtimeFailureText(failureClass(outcome), runtime.id, "message", config.name);
         patchInflight(dir, id, { jobFailure: { reason, output: jobOutput } });
         try {
             await sendToPerson(outcome.aborted
                 ? didNotFinishText(reason, poster.postedCount > 0)
-                : runtimeDidNotFinishText(failureClass(outcome), runtime.id, poster.postedCount > 0));
+                : runtimeDidNotFinishText(failureClass(outcome), runtime.id, poster.postedCount > 0, config.name));
         }
         catch (err) {
             // Leave it un-acked with the marker: the next poll reports it.
@@ -2381,7 +2415,7 @@ export async function runBot(deps) {
                     runtime: runtime.id,
                     botName: config.name,
                     context: "message",
-                    text: runtimeDidNotFinishText(cls, runtime.id, poster.postedCount > 0),
+                    text: runtimeDidNotFinishText(cls, runtime.id, poster.postedCount > 0, config.name),
                     retryOf: item.eventId ?? id,
                 }), item.rootEventId);
             }

package/dist/lib/bot/runtime/index.js

@@ -394,12 +394,15 @@ export async function runRuntimeTurn(runtime, input, deps = {}) {
     let modelFallback = remembered ? { from: remembered.from, to: remembered.to } : undefined;
     /** The retries on supported models failed too: report the first failure (its cause is the old CLI). */
     let fallbackFailure;
+    let spawnedAt = nowMs();
     try {
         result = await spawnImpl(binary, args, spawnOptions);
         if (runtime.id === "grok" && result.code !== 0 && !input.signal?.aborted) {
             const retryArgs = grokRetryArgsAfterInvalidOutputFormat(args, result.stderr);
-            if (retryArgs)
+            if (retryArgs) {
+                spawnedAt = nowMs();
                 result = await spawnImpl(binary, retryArgs, spawnOptions);
+            }
         }
         if (remembered) {
             // A turn on the remembered model: it either still works or the memo is wrong.
@@ -439,6 +442,7 @@ export async function runRuntimeTurn(runtime, input, deps = {}) {
                         continue;
                     tried.push(to);
                     const retryArgs = runtime.buildArgs({ ...turnInput, model: to }, { outputFile, newSessionId });
+                    spawnedAt = nowMs();
                     const retry = await spawnImpl(binary, retryArgs, spawnOptions);
                     if (input.signal?.aborted) {
                         // The owner stopped it: report the stop, remember nothing.
@@ -493,6 +497,11 @@ export async function runRuntimeTurn(runtime, input, deps = {}) {
         }
     }
     if (result.code !== 0 || result.signal) {
+        const durationMs = Math.max(0, nowMs() - spawnedAt);
+        const sawStreamEvent = result.stdout.split("\n").some((line) => {
+            const ev = parseJsonLine(line);
+            return ev !== null && (ev.type === "system" || ev.type === "assistant" || ev.type === "result");
+        });
         const reason = runtime.failureReason?.(result.stdout, result.stderr);
         // Streaming runtimes write JSON events to stdout: never show those to a
         // person as the reason. stderr, then a plain description, instead.
@@ -505,7 +514,14 @@ export async function runRuntimeTurn(runtime, input, deps = {}) {
                 : result.signal
                     ? `the ${runtime.binary} process was killed (${result.signal})`
                     : `${runtime.binary} exited with code ${result.code}`;
-        throw new RuntimeError(`${runtime.binary} exited with ${result.code ?? `signal ${result.signal}`}${reason ? `: ${reason.slice(0, 200)}` : ""}${fallbackFailure ? ` (${fallbackFailure})` : ""}`, reason ? reason.slice(0, 400) : fallback, result.code, !reason && stdoutTail ? { excerptIsOutputTail: true } : {});
+        throw new RuntimeError(`${runtime.binary} exited with ${result.code ?? `signal ${result.signal}`}${reason ? `: ${reason.slice(0, 200)}` : ""}${fallbackFailure ? ` (${fallbackFailure})` : ""}`, reason ? reason.slice(0, 400) : fallback, result.code, {
+            ...(!reason && stdoutTail ? { excerptIsOutputTail: true } : {}),
+            durationMs,
+            sawStreamEvent,
+            binaryPath: binary,
+            stderrFull: result.stderr.slice(0, 2000),
+            stdoutHead: result.stdout.slice(0, 300),
+        });
     }
     const parsed = runtime.parseOutput(result.stdout, { outputFile, outputFileText });
     // A turn that ran on the requested model and succeeded: nothing to remember.

package/dist/lib/bot/runtime/types.d.ts

@@ -128,10 +128,23 @@ export declare class RuntimeError extends Error {
      * must never decide what went wrong; only the message may.
      */
     readonly excerptIsOutputTail: boolean;
+    /** How long the runtime process lived, in ms, when known. */
+    readonly durationMs: number | undefined;
+    /** True when stdout carried at least one stream event (`system`, `assistant`, `result`): the turn started. */
+    readonly sawStreamEvent: boolean;
+    /** Crash evidence for the bot log: the binary spawned, full stderr and the head of stdout (bounded). */
+    readonly binaryPath: string | undefined;
+    readonly stderrFull: string | undefined;
+    readonly stdoutHead: string | undefined;
     constructor(message: string, stderrExcerpt: string, exitCode: number | null, opts?: {
         started?: boolean;
         aborted?: boolean;
         excerptIsOutputTail?: boolean;
+        durationMs?: number;
+        sawStreamEvent?: boolean;
+        binaryPath?: string;
+        stderrFull?: string;
+        stdoutHead?: string;
     });
 }
 export interface BotRuntime {