@indigoai-us/hq-cli 5.345.174 → 5.345.176

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.103","bundleSha256":"3ed362bac2c75d32a61b0e26b4253813af96458579920a798fd38a9583e855f9","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.104","bundleSha256":"40c72e049db21ee4551fa737676d8022cd090149ede9e3c9e53a9fae3f28dadc","formatVersion":1}

package/dist/lib/bot/cli-update.d.ts

@@ -23,6 +23,15 @@
  * that target for CLI_UPDATE_NOT_CONVERGED_COOLDOWN_MS instead of restarting
  * again. Restarts are also capped per window, so an install that keeps
  * flipping cannot turn into a restart loop.
+ *
+ * The same watcher covers the macOS HQ.app launcher. A bot's LaunchAgent runs
+ * `HQ.app/Contents/MacOS/hq-sync-menubar --hq-launchd-task node hq bot run`, and
+ * that launcher is what macOS privacy (TCC) attributes the bot's file access
+ * to. When an HQ.app update replaces the launcher binary under a running bot,
+ * every coding-tool turn after that fails within milliseconds ("An unknown
+ * error occurred (Unexpected)") because ~/Documents access no longer resolves,
+ * until the bot is restarted under the new launcher. So a changed launcher
+ * binary is handled like an updated CLI: confirm, drain, exit for launchd.
  */
 import type { BotLogger } from "./log.js";
 /**
@@ -62,7 +71,18 @@ export interface CliUpdate {
     from: string;
     to: string;
     packageRoot: string;
+    /** "launcher": the HQ.app launcher binary was replaced; the CLI version is unchanged. */
+    reason?: "launcher";
+}
+/** One line for the log and the exit reason. */
+export declare function describeCliUpdate(update: CliUpdate): string;
+/** Identity of a file on disk: an app update replaces the inode or changes size/mtime. */
+export interface LauncherStamp {
+    ino: number;
+    size: number;
+    mtimeMs: number;
 }
+export declare function statLauncher(p: string): LauncherStamp | null;
 interface CliUpdateLedger {
     v: 1;
     /** Written just before an update restart; settled by the next process. */
@@ -70,6 +90,7 @@ interface CliUpdateLedger {
         from: string;
         to: string;
         at: string;
+        reason?: "launcher";
     };
     /** ISO times of recent update restarts (for the per-window cap). */
     restarts: string[];
@@ -95,6 +116,9 @@ export interface CliUpdateWatcherOptions {
     dir: string;
     /** The script this process was launched with (process.argv[1]); null = do not watch. */
     entry: string | null;
+    /** The HQ.app launcher binary that started this process (macOS LaunchAgent); null = do not watch. */
+    launcher?: string | null;
+    statLauncher?: (p: string) => LauncherStamp | null;
     runningVersion?: string;
     now?: () => number;
     read?: (entry: string) => InstalledCliRead;
@@ -107,6 +131,18 @@ export interface CliUpdateWatcherOptions {
     cooldownMs?: number;
 }
 export declare function createCliUpdateWatcher(opts: CliUpdateWatcherOptions): CliUpdateWatch;
+/**
+ * The HQ.app launcher binary this process runs under, or null. A LaunchAgent
+ * written for HQ.app runs `<HQ.app>/Contents/MacOS/hq-sync-menubar
+ * --hq-launchd-task node hq ...`; the launcher spawns node and waits, so it is
+ * the direct parent. Only a parent whose command line carries the launcher
+ * flag counts.
+ */
+export declare function detectHqAppLauncher(opts?: {
+    platform?: NodeJS.Platform;
+    ppid?: number;
+    parentCommand?: (pid: number) => string | null;
+}): string | null;
 /**
  * Who starts this bot again after it exits.
  *

package/dist/lib/bot/cli-update.js

@@ -23,7 +23,17 @@
  * that target for CLI_UPDATE_NOT_CONVERGED_COOLDOWN_MS instead of restarting
  * again. Restarts are also capped per window, so an install that keeps
  * flipping cannot turn into a restart loop.
+ *
+ * The same watcher covers the macOS HQ.app launcher. A bot's LaunchAgent runs
+ * `HQ.app/Contents/MacOS/hq-sync-menubar --hq-launchd-task node hq bot run`, and
+ * that launcher is what macOS privacy (TCC) attributes the bot's file access
+ * to. When an HQ.app update replaces the launcher binary under a running bot,
+ * every coding-tool turn after that fails within milliseconds ("An unknown
+ * error occurred (Unexpected)") because ~/Documents access no longer resolves,
+ * until the bot is restarted under the new launcher. So a changed launcher
+ * binary is handled like an updated CLI: confirm, drain, exit for launchd.
  */
+import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import semver from "semver";
@@ -98,6 +108,22 @@ export function readInstalledCli(entry, io = fs) {
     }
     return { ok: false, reason: `no ${CLI_NAME} package.json above ${real}` };
 }
+/** One line for the log and the exit reason. */
+export function describeCliUpdate(update) {
+    return update.reason === "launcher"
+        ? `HQ.app was updated (${update.packageRoot}); restarting under the new launcher`
+        : `hq-cli updated ${update.from} -> ${update.to}; restarting to load it`;
+}
+export function statLauncher(p) {
+    try {
+        const st = fs.statSync(p);
+        return { ino: st.ino, size: st.size, mtimeMs: st.mtimeMs };
+    }
+    catch {
+        return null;
+    }
+}
+const sameStamp = (a, b) => a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs;
 function ledgerPath(dir) {
     return path.join(dir, CLI_UPDATE_LEDGER_FILE);
 }
@@ -133,6 +159,19 @@ export function createCliUpdateWatcher(opts) {
     const restartWindowMs = opts.restartWindowMs ?? CLI_UPDATE_RESTART_WINDOW_MS;
     const cooldownMs = opts.cooldownMs ?? CLI_UPDATE_NOT_CONVERGED_COOLDOWN_MS;
     const { dir, entry } = opts;
+    const launcher = opts.launcher ?? null;
+    const stat = opts.statLauncher ?? statLauncher;
+    /** The launcher as it was when this process started; null = not watched. */
+    const launcherBaseline = launcher ? stat(launcher) : null;
+    let launcherCandidate = null;
+    let launcherSeen = 0;
+    let lastLauncherNote = null;
+    const launcherNote = (log, level, message) => {
+        if (message === lastLauncherNote)
+            return;
+        lastLauncherNote = message;
+        log(level, message);
+    };
     let nextCheckAt = now() + checkIntervalMs;
     let candidate = null;
     let seen = 0;
@@ -151,6 +190,10 @@ export function createCliUpdateWatcher(opts) {
     return {
         runningVersion,
         startup(log) {
+            if (launcher && launcherBaseline)
+                log("info", `watching ${launcher} for HQ.app updates`);
+            else if (launcher)
+                log("warn", `not watching for HQ.app updates: ${launcher} is not readable`);
             if (!entry) {
                 log("info", "not watching for hq-cli updates (no entry script)");
                 return;
@@ -159,7 +202,10 @@ export function createCliUpdateWatcher(opts) {
             const pending = ledger.pending;
             if (pending) {
                 delete ledger.pending;
-                if (runningVersion === pending.to) {
+                if (pending.reason === "launcher") {
+                    log("info", `restarted after an HQ.app update; now running hq-cli ${runningVersion}`);
+                }
+                else if (runningVersion === pending.to) {
                     log("info", `hq-cli update converged: now running ${runningVersion} (was ${pending.from})`);
                     if (ledger.blocked?.version === runningVersion)
                         delete ledger.blocked;
@@ -183,60 +229,132 @@ export function createCliUpdateWatcher(opts) {
             log("info", `watching ${entry} for hq-cli updates (running ${runningVersion})`);
         },
         poll(log) {
-            if (!entry)
+            if (!entry && !launcherBaseline)
                 return null;
             const at = now();
             if (at < nextCheckAt)
                 return null;
             nextCheckAt = at + checkIntervalMs;
-            const installed = read(entry);
-            if (!installed.ok) {
-                candidate = null;
-                seen = 0;
-                note(log, "warn", `hq-cli install not readable, not restarting: ${installed.reason}`);
-                return null;
-            }
-            if (installed.version === runningVersion) {
-                candidate = null;
-                seen = 0;
-                lastNote = null;
-                return null;
-            }
-            if (rewriteInProgress(installed.packageRoot)) {
-                candidate = null;
-                seen = 0;
-                note(log, "info", `hq-cli ${installed.version} is still being installed; waiting for it to finish`);
-                return null;
-            }
-            if (candidate === installed.version)
-                seen += 1;
-            else {
-                candidate = installed.version;
-                seen = 1;
-            }
-            if (seen < confirmations) {
-                note(log, "info", `hq-cli ${installed.version} is installed (running ${runningVersion}); confirming before restarting`);
-                return null;
-            }
-            const ledger = readCliUpdateLedger(dir);
-            if (ledger.blocked?.version === installed.version && at < Date.parse(ledger.blocked.until)) {
-                note(log, "warn", `not restarting for hq-cli ${installed.version}: an earlier restart for it did not load it (retry after ${ledger.blocked.until})`);
-                return null;
-            }
-            if (recentRestarts(ledger, at).length >= restartLimit) {
-                note(log, "warn", `not restarting for hq-cli ${installed.version}: already restarted ${restartLimit} times for updates in the last ${Math.round(restartWindowMs / 60_000)} minutes`);
-                return null;
-            }
-            return { from: runningVersion, to: installed.version, packageRoot: installed.packageRoot };
+            return pollCli(log, at) ?? pollLauncher(log, at);
         },
         recordRestart(update) {
             const at = now();
             const ledger = readCliUpdateLedger(dir);
             ledger.restarts = [...recentRestarts(ledger, at), new Date(at).toISOString()];
-            ledger.pending = { from: update.from, to: update.to, at: new Date(at).toISOString() };
+            ledger.pending = {
+                from: update.from,
+                to: update.to,
+                at: new Date(at).toISOString(),
+                ...(update.reason ? { reason: update.reason } : {}),
+            };
             writeCliUpdateLedger(dir, ledger);
         },
     };
+    function underRestartCap(log, at, what, say = note) {
+        if (recentRestarts(readCliUpdateLedger(dir), at).length < restartLimit)
+            return true;
+        say(log, "warn", `not restarting for ${what}: already restarted ${restartLimit} times for updates in the last ${Math.round(restartWindowMs / 60_000)} minutes`);
+        return false;
+    }
+    function pollLauncher(log, at) {
+        if (!launcher || !launcherBaseline)
+            return null;
+        const current = stat(launcher);
+        if (!current) {
+            // Mid-replace: the old bundle is gone and the new one is not there yet.
+            launcherCandidate = null;
+            launcherSeen = 0;
+            launcherNote(log, "info", `${launcher} is missing (HQ.app being replaced?); waiting`);
+            return null;
+        }
+        if (sameStamp(current, launcherBaseline)) {
+            launcherCandidate = null;
+            launcherSeen = 0;
+            lastLauncherNote = null;
+            return null;
+        }
+        if (launcherCandidate && sameStamp(current, launcherCandidate))
+            launcherSeen += 1;
+        else {
+            launcherCandidate = current;
+            launcherSeen = 1;
+        }
+        if (launcherSeen < confirmations) {
+            launcherNote(log, "info", `${launcher} changed (HQ.app update); confirming before restarting`);
+            return null;
+        }
+        if (!underRestartCap(log, at, "the HQ.app update", launcherNote))
+            return null;
+        return { from: runningVersion, to: runningVersion, packageRoot: launcher, reason: "launcher" };
+    }
+    function pollCli(log, at) {
+        if (!entry)
+            return null;
+        const installed = read(entry);
+        if (!installed.ok) {
+            candidate = null;
+            seen = 0;
+            note(log, "warn", `hq-cli install not readable, not restarting: ${installed.reason}`);
+            return null;
+        }
+        if (installed.version === runningVersion) {
+            candidate = null;
+            seen = 0;
+            lastNote = null;
+            return null;
+        }
+        if (rewriteInProgress(installed.packageRoot)) {
+            candidate = null;
+            seen = 0;
+            note(log, "info", `hq-cli ${installed.version} is still being installed; waiting for it to finish`);
+            return null;
+        }
+        if (candidate === installed.version)
+            seen += 1;
+        else {
+            candidate = installed.version;
+            seen = 1;
+        }
+        if (seen < confirmations) {
+            note(log, "info", `hq-cli ${installed.version} is installed (running ${runningVersion}); confirming before restarting`);
+            return null;
+        }
+        const ledger = readCliUpdateLedger(dir);
+        if (ledger.blocked?.version === installed.version && at < Date.parse(ledger.blocked.until)) {
+            note(log, "warn", `not restarting for hq-cli ${installed.version}: an earlier restart for it did not load it (retry after ${ledger.blocked.until})`);
+            return null;
+        }
+        if (!underRestartCap(log, at, `hq-cli ${installed.version}`))
+            return null;
+        return { from: runningVersion, to: installed.version, packageRoot: installed.packageRoot };
+    }
+}
+/**
+ * The HQ.app launcher binary this process runs under, or null. A LaunchAgent
+ * written for HQ.app runs `<HQ.app>/Contents/MacOS/hq-sync-menubar
+ * --hq-launchd-task node hq ...`; the launcher spawns node and waits, so it is
+ * the direct parent. Only a parent whose command line carries the launcher
+ * flag counts.
+ */
+export function detectHqAppLauncher(opts = {}) {
+    if ((opts.platform ?? process.platform) !== "darwin")
+        return null;
+    const ppid = opts.ppid ?? process.ppid;
+    if (!ppid || ppid <= 1)
+        return null;
+    const parentCommand = opts.parentCommand ??
+        ((pid) => {
+            const r = spawnSync("ps", ["-o", "command=", "-p", String(pid)], { encoding: "utf8", timeout: 5_000 });
+            return r.status === 0 ? r.stdout.trim() : null;
+        });
+    const command = parentCommand(ppid);
+    if (!command)
+        return null;
+    const flag = command.indexOf(" --hq-launchd-task ");
+    if (flag <= 0)
+        return null;
+    const binary = command.slice(0, flag);
+    return binary.endsWith("/Contents/MacOS/hq-sync-menubar") ? binary : null;
 }
 export function detectBotSupervisor(name, opts = {}) {
     const env = opts.env ?? process.env;

package/dist/lib/bot/run.d.ts

@@ -56,6 +56,7 @@ import { type BotRuntime, type RuntimeTurnInput, type RuntimeTurnResult } from "
 import { type BotSessionScope } from "./paths.js";
 import { type DecisionDmClient } from "./decisions.js";
 import type { VaultObjectDownloader } from "../agent-kit/attachment-download.js";
+import { type RuntimeSignInCheck } from "./runtime-sign-in.js";
 import { type HeartbeatAgentUidSource, type HeartbeatCredsSource, type HeartbeatIdentityMismatchReporter } from "../heartbeat-identity.js";
 import { type BotState, type BotStatusFile } from "./status.js";
 import { type CliUpdate, type CliUpdateWatch } from "./cli-update.js";
@@ -85,6 +86,8 @@ export declare const FAILURE_WINDOW_MS: number;
 export declare const FAILURE_LIMIT = 5;
 /** Resumed-session failures with the model CLI's unknown error, in a row, before the session is cleared. */
 export declare const RESUMED_UNKNOWN_ERROR_LIMIT = 2;
+/** Wait before the one automatic re-run of a turn whose runtime crashed before it started. */
+export declare const RUNTIME_CRASH_RETRY_DELAY_MS = 3000;
 export declare const MAX_ATTEMPTS_PER_MESSAGE = 3;
 export declare const THINKING_EMOJI = "\uD83D\uDC40";
 export declare const ROOM_THINKING_STATUS = "is thinking\u2026";
@@ -195,6 +198,15 @@ export interface BotRunDeps {
      * thread are recorded through it. Unset leaves every owner DM on the model path.
      */
     decisions?: DecisionDmClient;
+    /**
+     * The bot's own sign-in check (runtime-sign-in-check.ts), run with the
+     * turn's environment at start, before each turn, and while signed out.
+     * Injected in tests; unset runs the runtime's status command. A runtime
+     * with no status command answers `signedIn: null` and turns run as before.
+     */
+    checkSignIn?: (env: NodeJS.ProcessEnv) => Promise<RuntimeSignInCheck>;
+    /** How often to ask the tool again while it is signed out (default SIGN_IN_CHECK_MS). */
+    signInCheckMs?: number;
 }
 export declare const KICKOFF_MESSAGE_ID = "kickoff";
 /**
@@ -217,6 +229,17 @@ export declare const KICKOFF_MESSAGE_ID = "kickoff";
  * Pure so the rule is unit-testable.
  */
 export declare function turnEnv(base: NodeJS.ProcessEnv, kind: BotKind, agentUid?: string, companySlug?: string): NodeJS.ProcessEnv;
+/** The account name this process runs as, or null when the OS cannot say. */
+export declare function osUserName(): string | null;
+/**
+ * Claude Code keys its macOS Keychain login on `$USER` (falling back to the
+ * literal "unknown"), so a tool spawned from an environment without USER
+ * reads a different Keychain item than the owner's terminal and is signed
+ * out. launchd and the HQ app's launcher may leave it unset; fill it (and
+ * LOGNAME) from the account this process runs as. Never overrides a USER
+ * already set. Pure.
+ */
+export declare function withOsUser(env: NodeJS.ProcessEnv, name?: string | null): NodeJS.ProcessEnv;
 /** The core worker HQ's setup bot runs. */
 export declare const SETUP_WORKER_ID = "setup";
 /**