@indigoai-us/hq-cli 5.345.177 → 5.345.179

package/dist/commands/bot.js

@@ -1,4 +1,8 @@
 import { withLocalJobs } from "../lib/bot/local-jobs.js";
+import { currentHotSignalSyncCompany, ensureHotSignalSyncJob, removeStaleHotSignalSyncJobs, runHotSignalSyncJob } from "../lib/bot/jobs/hot-signal-sync.js";
+import { createClaudeSignalsPass } from "../lib/hot-channels/signals-pass.js";
+import { machineTimeZone } from "../lib/bot/job-run.js";
+import { runCompanyHotChannelSync } from "./sources.js";
 import { OwnerContextCache, lookupOwnerContext } from "../lib/bot/owner-context.js";
 import { hasActivePromotion } from "../lib/bot/promotion-receipt.js";
 import { readInflightTurns } from "../lib/bot/inflight.js";
@@ -52,7 +56,7 @@ import { isAncestorProcess } from "../lib/bot/self-process.js";
 import { runtimeDisplayName, signInCommand } from "../lib/bot/runtime-sign-in.js";
 import { classifyRuntimeFailure, runtimeFailureReason } from "../lib/bot/runtime-failure.js";
 import { PROBE_DEFAULT_TIMEOUT_MS, probeBotRuntime } from "../lib/bot/probe.js";
-import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
+import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, fleetProviderForRuntime, importFleetLocalMachineCredential, fleetProviderNeedsSignIn, fleetDefaultCompanies, fleetOwnerCompanies, fleetRuntimeIsDefault, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
 function collectRepeated(value, previous) {
     return [...previous, value];
 }
@@ -144,11 +148,25 @@ function fleetBotSystemPrompt(name, config, overrides = {}) {
         }),
     });
 }
+function fleetAuthCommand(name, config) {
+    return `hq bot auth ${name} --provider ${config.runtime === "grok" ? "grok" : config.runtime === "codex" ? "chatgpt" : "claude"}`;
+}
 function runFleetRuntimeControl(name, config, action, json) {
+    if ((action === "start" || action === "restart") && config.fleetAuthPending === true) {
+        const authCommand = fleetAuthCommand(name, config);
+        if (json)
+            console.log(JSON.stringify({ ok: false, name, running: false, state: "stopped", needsSignIn: true, authCommand }, null, 2));
+        else
+            throw Object.assign(new Error(`Sign this bot in first: ${authCommand}`), { expected: true });
+        return;
+    }
     if (action === "start" || action === "restart") {
         refreshFleetLocalInstructions(config.agentUid, fleetBotSystemPrompt(name, config));
     }
-    const result = controlFleetLocalBot(config.agentUid, action);
+    const installService = config.fleetServiceInstallPending === true && (action === "start" || action === "restart");
+    const result = controlFleetLocalBot(config.agentUid, installService ? "install" : action);
+    if (installService && result.ok)
+        patchBotConfig(botDir(name), { fleetServiceInstallPending: false, enabled: true });
     if (json) {
         console.log(JSON.stringify({ name, runtime: HQ_FLEET_RUNTIME_ENGINE_ID, ...result }, null, 2));
         return;
@@ -192,7 +210,7 @@ function rowFor(name, opts = {}) {
     const dir = botDir(name);
     const config = readBotConfig(dir);
     const fleet = isFleetRuntimeBot(config);
-    const status = fleet ? null : readBotStatus(dir);
+    const status = readBotStatus(dir);
     const pid = fleet ? fleetLocalGatewayPid(config.agentUid) : (status?.pid ?? null);
     const processAlive = pid !== null && isPidAlive(pid) && (fleet || status?.state === "running");
     // Turns this bot has taken and not finished: what "thinking" means.
@@ -220,7 +238,7 @@ function rowFor(name, opts = {}) {
         model: config.model,
         effort: effectiveBotEffort(config),
         effortIsDefault: !config.effort,
-        state: processAlive ? "running" : status?.state === "failed" ? "failed" : "stopped",
+        state: processAlive ? "running" : !fleet && status?.state === "failed" ? "failed" : "stopped",
         pid: processAlive ? pid : null,
         processAlive,
         hosting: hasActivePromotion(dir, config.agentUid, config.ownerUid) ? "cloud" : "local",
@@ -234,8 +252,10 @@ function rowFor(name, opts = {}) {
         busySince: processAlive ? (inflightTurns[0]?.startedAt ?? null) : null,
         runtimeSignIn: status?.runtimeSignIn ?? null,
         runtimeSignInCheck: status?.runtimeSignInCheck ?? null,
-        runtimeSignedIn: runtimeSignedIn(status, processAlive),
-        signInCommand: signInCommand(config.runtime),
+        runtimeSignedIn: config.fleetAuthPending === true ? false : runtimeSignedIn(status, processAlive),
+        ...(fleet && config.fleetAuthPending === true ? { needsSignIn: true, authCommand: fleetAuthCommand(name, config) } : {}),
+        ...(fleet && config.fleetServiceInstallPending === true ? { needsSignIn: false, serviceInstallPending: true } : {}),
+        signInCommand: fleet ? fleetAuthCommand(name, config) : signInCommand(config.runtime),
         runtimeCrash: processAlive ? runtimeCrashSinceStart(status) : null,
         daemonInstalled,
         daemonLoaded,
@@ -340,6 +360,8 @@ function stopProcess(dir) {
 async function startBot(name, dir, config, output, extra = {}) {
     if (hasPromotionHold(dir))
         throw new Error("This bot is held for cloud promotion. Continue its promotion before changing local settings or lifecycle.");
+    if (isFleetRuntimeBot(config))
+        return startFleetRuntimeBot(name, dir, config, output, extra);
     if (config.enabled === false)
         patchBotConfig(dir, { enabled: true });
     const paths = buildBotDaemonPaths({ name, botDir: dir, hqRoot: config.hqRoot });
@@ -401,6 +423,41 @@ async function startBot(name, dir, config, output, extra = {}) {
     }
     return { running, how };
 }
+/** Start (or restart) an HQ Fleet Runtime bot under its own service, with fresh instructions. */
+async function startFleetRuntimeBot(name, dir, config, output, extra) {
+    if (config.fleetAuthPending === true) {
+        const authCommand = fleetAuthCommand(name, config);
+        if (output === "json")
+            console.log(JSON.stringify({ ok: false, name, running: false, needsSignIn: true, authCommand }, null, 2));
+        else if (output !== "silent")
+            throw Object.assign(new Error(`Sign this bot in first: ${authCommand}`), { expected: true });
+        return { running: false, how: "waiting for sign-in" };
+    }
+    refreshFleetLocalInstructions(config.agentUid, fleetBotSystemPrompt(name, config));
+    const before = readBotStatus(dir);
+    const alreadyRunning = !!before && before.state === "running" && isPidAlive(before.pid);
+    const installService = config.fleetServiceInstallPending === true;
+    const result = controlFleetLocalBot(config.agentUid, installService ? "install" : alreadyRunning ? "restart" : "start");
+    if (installService && result.ok)
+        patchBotConfig(dir, { fleetServiceInstallPending: false, enabled: true });
+    const how = alreadyRunning ? "restarted by the HQ Fleet Runtime" : "started by the HQ Fleet Runtime";
+    const running = result.ok === true && (await waitFor(() => {
+        const s = readBotStatus(dir);
+        return !!s && s.state === "running" && isPidAlive(s.pid);
+    }, 45_000));
+    const status = readBotStatus(dir);
+    if (output === "silent")
+        return { running, how };
+    if (output === "json") {
+        console.log(JSON.stringify({ ok: running, name, ...extra, running, how, state: status?.state ?? "unknown", pid: status?.pid ?? null, lastError: null }, null, 2));
+        return { running, how };
+    }
+    if (running)
+        console.log(chalk.green(`${name} is running`) + chalk.dim(` (${how})`));
+    else
+        console.log(chalk.yellow(`${name} did not report running within 45s`) + chalk.dim(`  logs: ~/.hq-fleet/profiles/${config.agentUid}/logs`));
+    return { running, how };
+}
 /**
  * `output`: "json" | "text" print a result; "silent" prints nothing — used
  * when stop is a step inside rm/restart, whose own JSON must be the only
@@ -436,6 +493,14 @@ function requestSelfStopDrain(botPid) {
 async function stopBot(name, dir, config, output) {
     if (hasPromotionHold(dir))
         throw new Error("This bot is held for cloud promotion. Continue its promotion before changing local settings or lifecycle.");
+    if (isFleetRuntimeBot(config)) {
+        const result = controlFleetLocalBot(config.agentUid, "stop");
+        if (output === "json")
+            console.log(JSON.stringify({ ok: result.ok === true, name, stopped: result.ok === true, how: "stopped by the HQ Fleet Runtime" }, null, 2));
+        else if (output === "text")
+            console.log(chalk.green(`${name} stopped`));
+        return;
+    }
     const paths = buildBotDaemonPaths({ name, botDir: dir, hqRoot: config.hqRoot });
     const hqDaemon = daemonPaths();
     const before = readBotStatus(dir);
@@ -546,6 +611,28 @@ export function resolveCreateKind(opts, worker) {
     }
     return { kind, companies };
 }
+async function promptFleetProvider() {
+    if (process.stdin.isTTY !== true || process.stderr.isTTY !== true) {
+        throw Object.assign(new Error("--provider is required with --hq-fleet-runtime in a non-interactive command (claude, codex, or grok)."), { expected: true });
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await new Promise((resolve) => {
+            rl.question("Provider: 1) Codex  2) Claude  3) Grok [1]: ", resolve);
+        });
+        const selected = answer.trim().toLowerCase();
+        if (selected === "" || selected === "1" || selected === "codex")
+            return "codex";
+        if (selected === "2" || selected === "claude")
+            return "claude";
+        if (selected === "3" || selected === "grok")
+            return "grok";
+        throw Object.assign(new Error("Provider must be claude, codex, or grok."), { expected: true });
+    }
+    finally {
+        rl.close();
+    }
+}
 /**
  * `hq bot create`. Runs under the bot's lock, so a create racing an adopt,
  * restore, rm or set of the same bot waits for it instead of tripping over
@@ -664,11 +751,21 @@ async function finishExistingSetupBot(name, dir, config, displayName, opts) {
         console.log(chalk.yellow(`${name} did not report running within 15s`) + chalk.dim(`  logs: hq bot logs ${name}`));
 }
 async function runBotCreateLocked(name, opts) {
-    const useFleetRuntime = opts.hqFleetRuntime === true;
-    if (useFleetRuntime && (opts.runtime || opts.model || opts.effort || opts.lean)) {
-        throw Object.assign(new Error("--hq-fleet-runtime selects the local HQ runtime. Do not combine it with --runtime, --model, --effort, or --lean."), { expected: true });
+    const requestedFleetRuntime = opts.hqFleetRuntime === true;
+    if (requestedFleetRuntime && opts.legacyRuntime) {
+        throw Object.assign(new Error("Pick one of --hq-fleet-runtime and --legacy-runtime."), { expected: true });
     }
-    const runtime = opts.runtime ?? "claude";
+    if (requestedFleetRuntime && (opts.effort || opts.lean)) {
+        throw Object.assign(new Error("--hq-fleet-runtime sets its own thinking level. Do not combine it with --effort or --lean."), { expected: true });
+    }
+    if (opts.provider && !isBotRuntimeId(opts.provider)) {
+        throw Object.assign(new Error(`--provider must be one of ${BOT_RUNTIMES.join(", ")}`), { expected: true });
+    }
+    if (opts.provider && opts.runtime && opts.provider !== opts.runtime) {
+        throw Object.assign(new Error("--provider and --runtime must name the same provider when both are used."), { expected: true });
+    }
+    const selectedProvider = opts.provider ?? opts.runtime ?? (requestedFleetRuntime ? await promptFleetProvider() : undefined);
+    const runtime = selectedProvider ?? "claude";
     if (!isBotRuntimeId(runtime)) {
         throw Object.assign(new Error(`--runtime must be one of ${BOT_RUNTIMES.join(", ")}`), { expected: true });
     }
@@ -703,6 +800,15 @@ async function runBotCreateLocked(name, opts) {
     // cost an identity).
     const worker = opts.worker?.trim() ? resolveBotWorker(hqRoot, opts.worker) : null;
     const { kind, companies } = resolveCreateKind(opts, worker);
+    // Companies with the fleet-default flag get their personal bots on
+    // the HQ Fleet Runtime; --legacy-runtime keeps the model-CLI runner.
+    const fleetCandidate = requestedFleetRuntime ||
+        (!opts.legacyRuntime && kind === "personal" && !opts.effort && !opts.lean);
+    // Owner turns on the bot may use only these companies: the owner's own,
+    // and only where the company turned the flag on.
+    const flaggedCompanies = fleetCandidate && kind === "personal" ? await fleetDefaultCompanies(hqRoot) : [];
+    const useFleetRuntime = requestedFleetRuntime || (fleetCandidate && fleetRuntimeIsDefault(flaggedCompanies));
+    const ownerCompanies = useFleetRuntime && kind === "personal" ? await fleetOwnerCompanies() : [];
     if (useFleetRuntime && kind !== "personal") {
         throw Object.assign(new Error("--hq-fleet-runtime creates a personal bot. Drop --kind company and --company."), {
             expected: true,
@@ -726,6 +832,8 @@ async function runBotCreateLocked(name, opts) {
         ? await installPinnedFleetLocalDistribution()
         : null;
     const fleetPython = fleetInstallation ? await ensureFleetPython() : null;
+    const fleetProvider = fleetInstallation ? fleetProviderForRuntime(runtime, model) : null;
+    const fleetAuthPending = fleetProvider !== null && fleetProviderNeedsSignIn(fleetProvider);
     const token = await ownerToken();
     const owner = await resolveCallerPersonUid(token, undefined, { command: "hq bot create" });
     if (!owner)
@@ -932,7 +1040,8 @@ async function runBotCreateLocked(name, opts) {
         ...(kickoff ? { kickoff } : {}),
         ...(opts.lean && runtime === "claude" ? { lean: true } : {}),
         createdAt: new Date().toISOString(),
-        enabled: true,
+        enabled: !fleetAuthPending,
+        ...(fleetAuthPending ? { fleetAuthPending: true } : {}),
     };
     writeBotConfig(dir, config);
     // A company bot acts as itself, so it must be a member of each of its
@@ -971,7 +1080,13 @@ async function runBotCreateLocked(name, opts) {
             installation: fleetInstallation,
             machineCredentials: botCredsPath(dir),
             systemPrompt: fleetBotSystemPrompt(name, config, { kind, companies }),
-        }, { start: opts.start !== false, python: fleetPython })
+            provider: fleetProvider,
+            ownerCompanies,
+            firstStart: {
+                intro: introDmText(name, runtime, intro, { kind, companies }),
+                ...(kickoff ? { kickoff } : {}),
+            },
+        }, { start: opts.start !== false && !fleetAuthPending, python: fleetPython })
         : null;
     const fleetProfile = fleetBootstrap?.profile ?? null;
     const runtimeLabel = fleetInstallation ? HQ_FLEET_RUNTIME_ENGINE_ID : runtime;
@@ -998,6 +1113,7 @@ async function runBotCreateLocked(name, opts) {
         kickoff: kickoff ?? null,
         model: model ?? null,
         effort: fleetInstallation ? null : effort ?? DEFAULT_BOT_EFFORT,
+        ...(fleetProvider ? { provider: fleetProvider.id, needsSignIn: fleetAuthPending, ...(fleetAuthPending ? { authCommand: fleetAuthCommand(name, config) } : {}) } : {}),
     };
     let daemonMessage = null;
     if (!fleetInstallation && opts.daemon !== false && process.platform === "darwin") {
@@ -1015,6 +1131,9 @@ async function runBotCreateLocked(name, opts) {
         console.log(chalk.dim(`  state:  ${dir}`));
         if (fleetProfile)
             console.log(chalk.dim(`  profile: ${fleetProfile}`));
+        if (fleetProvider && fleetProviderNeedsSignIn(fleetProvider)) {
+            console.log(chalk.yellow(`  sign it in before it can answer: hq bot auth ${name} --provider ${runtime === "grok" ? "grok" : "chatgpt"}`));
+        }
         if (daemonMessage)
             console.log(chalk.dim(`  ${daemonMessage}`));
     }
@@ -1159,6 +1278,27 @@ async function runBotResident(nameArg) {
     const token = botTokenSupplier(dir);
     // The bot's own schedule lives in its folder and fires from this loop.
     const api = withLocalJobs(new BotApi({ token }), dir);
+    // The built-in hot-signal-sync job, registered once in the bot's own
+    // jobs.json (06:30 daily in this computer's time zone until the owner
+    // reschedules it with `hq bot jobs`). It runs in-process, with no model turn.
+    const syncCompany = hotSignalSyncCompany(config);
+    try {
+        // A job for a company the bot no longer serves is removed before anything runs.
+        for (const stale of removeStaleHotSignalSyncJobs(dir, syncCompany)) {
+            console.log(`Removed the hot-channel sync job ${stale.jobId}: this bot no longer syncs that company.`);
+        }
+    }
+    catch (err) {
+        console.error(`Could not check the hot-channel sync jobs: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (syncCompany) {
+        try {
+            ensureHotSignalSyncJob(dir, { company: syncCompany, timezone: machineTimeZone() });
+        }
+        catch (err) {
+            console.error(`Could not register the hot-channel sync job for ${syncCompany}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     const owner = new OwnerContextCache(() => lookupOwnerContext(config.ownerUid), Date.now, undefined, config.ownerUid);
     const handle = await runBot({
         dir,
@@ -1166,6 +1306,15 @@ async function runBotResident(nameArg) {
         api,
         runtime: runtimeFor(config.runtime),
         ownerContext: () => owner.get(),
+        hotSignalSync: ({ company, catchUp, now, sendAlert }) => runHotSignalSyncJob({
+            company,
+            catchUp,
+            now,
+            sendAlert,
+            sync: (input) => runCompanyHotChannelSync({ hqRoot: config.hqRoot, ...input }),
+            // A new pass per run: the login preflight and the 20-document cap are per run.
+            signalsPass: createClaudeSignalsPass({ hqRoot: config.hqRoot, company }),
+        }),
         // US-005: decision picks in the owner DM, with the bot's own machine token
         // (never the owner's login).
         decisions: new DecisionsClient(token),
@@ -1232,25 +1381,26 @@ async function runBotList(opts) {
 }
 async function runBotStatus(nameArg, opts) {
     const { name, dir, config } = requireBot(nameArg);
-    if (isFleetRuntimeBot(config)) {
-        runFleetRuntimeControl(name, config, "status", opts.json === true);
-        return;
-    }
+    const fleet = isFleetRuntimeBot(config);
     const row = rowFor(name);
     await decorateOnline([row]);
     const status = readBotStatus(dir);
     const creds = readBotCredsIdentity(dir);
     if (opts.json) {
-        console.log(JSON.stringify({ ...row, credsPresent: !!creds, status }, null, 2));
+        console.log(JSON.stringify({ ...row, ...(fleet ? { engine: config.engine } : {}), credsPresent: fleet || !!creds, status }, null, 2));
         return;
     }
     console.log(`${chalk.bold(name)}  ${row.agentUid}`);
+    if (fleet)
+        console.log(`  engine:     HQ Fleet Runtime ${config.engine?.version ?? ""}  ${chalk.dim(`logs ~/.hq-fleet/profiles/${config.agentUid}/logs`)}`);
     console.log(`  kind:       ${describeKind(row.kind, row.companies)}`);
     console.log(`  runtime:    ${row.runtime}  model ${row.model ?? "default"}  thinking ${row.effort}${row.effortIsDefault ? " (default)" : ""}`);
     if (row.workerId)
         console.log(`  worker:     ${row.workerId}${row.companySlug ? ` (company ${row.companySlug})` : ""}  ${chalk.dim(row.workerDir)}`);
     console.log(`  memory:     ${row.memory}  ${chalk.dim(row.memoryDir)}`);
     console.log(`  process:    ${row.processAlive ? chalk.green(`running (pid ${row.pid})`) : chalk.gray(row.state)}`);
+    if (row.needsSignIn)
+        console.log(`  sign-in:    required (${row.authCommand})`);
     console.log(`  HQ online:  ${humanOnline(row)}${row.lastHeartbeatAt ? chalk.dim(`  last heartbeat ${row.lastHeartbeatAt}`) : ""}${row.lastHeartbeatOk === false && status?.lastHeartbeatError ? chalk.dim(`  (${status.lastHeartbeatError})`) : ""}`);
     if (status?.lastInboxPollOk === false) {
         console.log(`  inbox:      ${chalk.red("cannot receive")}${status.lastInboxError ? chalk.dim(`  ${status.lastInboxError}`) : ""}`);
@@ -1263,7 +1413,7 @@ async function runBotStatus(nameArg, opts) {
     if (row.daemonNodeMissing) {
         console.log(`  ${chalk.red(`node missing: ${row.daemonNodeMissing}`)} — launchd cannot start ${name}; fix with: hq bot start ${name}`);
     }
-    console.log(`  creds:      ${creds ? `present for ${creds.entityUid}` : chalk.red("missing")}`);
+    console.log(`  creds:      ${fleet ? "in the system keychain" : creds ? `present for ${creds.entityUid}` : chalk.red("missing")}`);
     if (status) {
         console.log(`  started:    ${status.startedAt}   restarts: ${status.restarts}   replies: ${status.repliesSent}`);
         if (status.cliVersion)
@@ -1729,17 +1879,30 @@ async function runBotAuth(nameArg, opts) {
     const result = authenticateFleetLocalBot({
         agentUid: b.config.agentUid,
         provider: opts.provider,
+        ...(b.config.fleetAuthPending === true ? { installService: true } : {}),
         ...(opts.model ? { model: opts.model } : {}),
         ...(apiKey ? { apiKey } : {}),
         ...(opts.baseUrl ? { baseUrl: opts.baseUrl } : {}),
         ...(opts.transport ? { transport: opts.transport } : {}),
         openBrowser: opts.browser !== false,
     });
+    const signedInRuntime = result.runtimeProvider === "anthropic" ? "claude" : result.runtimeProvider === "xai-oauth" ? "grok" : result.runtimeProvider === "openai-codex" ? "codex" : null;
+    if (result.authenticated !== true)
+        throw Object.assign(new Error("The provider has not completed sign-in."), { expected: true });
+    patchBotConfig(b.dir, {
+        ...(signedInRuntime ? { runtime: signedInRuntime } : {}),
+        model: result.model,
+        ...(b.config.fleetAuthPending === true ? { fleetAuthPending: false, fleetServiceInstallPending: !result.restarted, enabled: result.restarted } : {}),
+    });
+    const pid = fleetLocalGatewayPid(b.config.agentUid);
+    const running = pid !== null && isPidAlive(pid);
     if (opts.json) {
-        console.log(JSON.stringify({ ok: true, name: b.name, runtime: HQ_FLEET_RUNTIME_ENGINE_ID, ...result }, null, 2));
+        console.log(JSON.stringify({ ok: true, name: b.name, runtime: HQ_FLEET_RUNTIME_ENGINE_ID, ...result, needsSignIn: false, running, serviceInstallPending: b.config.fleetAuthPending === true && !result.restarted }, null, 2));
         return;
     }
-    console.log(chalk.green(`${b.name} is signed in to ${result.provider} and running ${result.model}.`));
+    console.log(running
+        ? chalk.green(`${b.name} is signed in to ${result.provider} and running ${result.model}.`)
+        : chalk.yellow(`${b.name} is signed in to ${result.provider}, but did not start. Run hq bot start ${b.name}.`));
 }
 // ── adopt / restore (bring a bot you own back to this computer) ──────────────
 /**
@@ -1993,6 +2156,9 @@ async function adoptRemoteBotLocked(input) {
         region: DEFAULT_COGNITO.region,
     });
     const local = parseBotLocalConfig(reissued.localConfig ?? bot.localConfig);
+    const fleetEngine = local?.engine?.id === HQ_FLEET_RUNTIME_ENGINE_ID;
+    if (fleetEngine && local && !local.runtime)
+        local.runtime = "codex";
     const { config, notes } = configFromLocalConfig({
         name,
         agentUid: bot.agentUid,
@@ -2003,14 +2169,40 @@ async function adoptRemoteBotLocked(input) {
         ...(input.overrides ? { overrides: input.overrides } : {}),
         ...(input.preserveFirstStart ? { preserveFirstStart: true } : {}),
     });
+    // A bot made on the HQ Fleet Runtime comes back on it, on the release this CLI pins.
+    const fleetInstallation = fleetEngine ? await installPinnedFleetLocalDistribution() : null;
+    const fleetPython = fleetInstallation ? await ensureFleetPython() : null;
+    if (fleetInstallation)
+        config.engine = fleetInstallation.engine;
     writeBotConfig(dir, config);
     const scaffoldOpts = { memoryDir: config.memoryDir };
     const scaffold = config.workerSource === "worker"
         ? scaffoldBotMemory(input.hqRoot, name, undefined, scaffoldOpts)
         : scaffoldBotWorker(input.hqRoot, name, bot.agentUid, config.runtime, undefined, scaffoldOpts);
+    if (fleetInstallation && fleetPython) {
+        await bootstrapFleetLocalBot({
+            agentUid: bot.agentUid,
+            ownerUid: config.ownerUid,
+            hqRoot: input.hqRoot,
+            botDir: dir,
+            installation: fleetInstallation,
+            machineCredentials: botCredsPath(dir),
+            systemPrompt: fleetBotSystemPrompt(name, config),
+            provider: fleetProviderForRuntime(config.runtime, config.model),
+            ownerCompanies: await fleetOwnerCompanies(),
+            ...(input.preserveFirstStart
+                ? {
+                    firstStart: {
+                        intro: introDmText(name, config.runtime, config.intro, { kind: effectiveBotKind(config), companies: effectiveBotCompanies(config) }),
+                        ...(config.kickoff ? { kickoff: config.kickoff } : {}),
+                    },
+                }
+                : {}),
+        }, { python: fleetPython, start: false });
+    }
     createBotLogger(dir)("info", `adopted ${name} (${bot.agentUid}) on ${localMachineId()} kind=${config.kind}${local ? "" : " (no saved settings; defaults)"} runtime=${config.runtime}`);
     let daemonMessage = null;
-    if (input.daemon && process.platform === "darwin") {
+    if (!fleetInstallation && input.daemon && process.platform === "darwin") {
         daemonMessage = installBotAgent(buildBotDaemonPaths({ name, botDir: dir, hqRoot: input.hqRoot })).message;
     }
     return {
@@ -2118,6 +2310,11 @@ async function repairLocalBot(name, api, bot, daemon) {
         region: DEFAULT_COGNITO.region,
     });
     createBotLogger(dir)("info", `re-issued machine credentials for ${name} (${bot.agentUid}) on ${localMachineId()}`);
+    if (isFleetRuntimeBot(config)) {
+        importFleetLocalMachineCredential(bot.agentUid, botCredsPath(dir));
+        const restarted = controlFleetLocalBot(bot.agentUid, "restart").ok === true;
+        return restarted ? "new credentials, HQ Fleet Runtime restarted" : "new credentials; the HQ Fleet Runtime did not restart (hq bot start " + name + ")";
+    }
     if (daemon && process.platform === "darwin") {
         installBotAgent(buildBotDaemonPaths({ name, botDir: dir, hqRoot: config.hqRoot }));
     }
@@ -2308,7 +2505,9 @@ export function registerBotCommand(program) {
         .option("--kind <kind>", `personal (acts as you, everywhere you are) or company (acts as itself, as a member of its companies). Default: personal, or company when created from a company worker`)
         .option("--company <slug>", "Company bots: a company the bot is a member of (repeat for several); the owner invites it on creation", collectRepeated, [])
         .option("--runtime <runtime>", `Model CLI to run the bot with: ${BOT_RUNTIMES.join("|")}`)
+        .option("--provider <provider>", `HQ Fleet provider: ${BOT_RUNTIMES.join("|")} (interactive Fleet creation prompts when omitted)`)
         .option("--hq-fleet-runtime", "Create this personal bot with the local HQ Fleet Runtime")
+        .option("--legacy-runtime", "Run this bot with the model CLI even where the HQ Fleet Runtime is the default")
         .option("--model <model>", "Model override passed to the runtime CLI")
         .option("--effort <level>", `Thinking level: claude ${BOT_EFFORT_LEVELS.claude.join("|")}; codex ${BOT_EFFORT_LEVELS.codex.join("|")}; grok ${BOT_EFFORT_LEVELS.grok.join("|")} (default ${DEFAULT_BOT_EFFORT})`)
         .option("--no-auto-approve", "Keep the runtime's permission gates (default: everything pre-approved; a headless bot cannot answer prompts)")
@@ -2476,4 +2675,14 @@ export function registerBotCommand(program) {
         console.log(opts.json ? JSON.stringify({ ok: true, ...r }, null, 2) : r.message);
     })());
 }
+/**
+ * The company a bot's hot-signal-sync job syncs: the bot's own company, else
+ * the first company it serves. Null = none, and no job is registered. There is
+ * no fallback to the HQ's active company: a personal bot syncs a company only
+ * when it was given one explicitly (`--company`), so the job never writes into
+ * a vault the bot does not belong to.
+ */
+export function hotSignalSyncCompany(config) {
+    return currentHotSignalSyncCompany(config);
+}
 //# sourceMappingURL=bot.js.map

package/dist/commands/cloud.d.ts

@@ -41,6 +41,50 @@ export declare class SyncExitError extends Error {
         health?: "failed" | "succeeded";
     });
 }
+/** Shown when the session expires during a sync and cannot be renewed. */
+export declare const SYNC_SESSION_EXPIRED_MESSAGE = "Your HQ session expired during sync and could not be refreshed. Run `hq login`, then rerun the sync.";
+/** Shown when the refresh failed for a network or server reason. */
+export declare const SYNC_REFRESH_UNAVAILABLE_MESSAGE = "Could not refresh your HQ session during sync because the sign-in service did not respond. Check your connection, then rerun the sync.";
+/** Shown when the start token carries no principal to bind the run to. */
+export declare const SYNC_NO_IDENTITY_MESSAGE = "The HQ session token does not identify an account, so the sync did not start. Run `hq login`, then rerun the sync.";
+/** Shown when the token would change to a different account mid-run. */
+export declare const SYNC_IDENTITY_CHANGED_MESSAGE = "The signed-in HQ account changed while this sync was running, so the sync stopped instead of continuing as a different account. Rerun the sync as the account you want.";
+/**
+ * The session token expired during a sync run and the non-interactive
+ * refresh failed. `kind` separates a rejected session (sign in again) from a
+ * network or server failure (retry later).
+ */
+export declare class SyncSessionExpiredError extends Error {
+    readonly kind: "reauth" | "unavailable";
+    readonly reason?: string | undefined;
+    constructor(kind: "reauth" | "unavailable", reason?: string | undefined);
+}
+export interface SyncVaultConfigDeps {
+    /** Non-interactive token resolver: returns the cached token or refreshes it. */
+    ensureToken?: () => Promise<string>;
+}
+/** The last token failure recorded by a {@link buildSyncVaultConfig} config. */
+export declare function syncAuthFailureFor(config: VaultServiceConfig | undefined): Error | null;
+/**
+ * Vault config for a sync run whose token stays valid for the whole run.
+ *
+ * `initialToken` is resolved (and, on a TTY, logged in) before the run starts.
+ * The config carries a getter instead of that string, so every vault request
+ * re-reads the cached session and refreshes it when it is close to expiry.
+ * When a request still gets a 401, hq-cloud's VaultClient calls the getter
+ * once more and retries once if the token changed (no loop). A multi-company
+ * `hq sync pull --all` can outlast the one-hour Cognito access token; a
+ * captured string made every later target fail with 401 (feedback_3d3fab0b).
+ *
+ * The getter is bound to the principal of `initialToken`. If a later token
+ * belongs to a different principal (a mid-run `hq login` as another account,
+ * or the machine-identity fallback after a rejected person refresh), it throws
+ * an {@link IdentitySwapRefusal} and the run stops. It never continues as a
+ * different principal.
+ *
+ * Mid-run refreshes never open a browser.
+ */
+export declare function buildSyncVaultConfig(initialToken: string, deps?: SyncVaultConfigDeps): VaultServiceConfig;
 /**
  * Preserve the vault's typed write-scope refusal at the CLI boundary. This is
  * deliberately duck-typed so hq-cli remains compatible while hq-cloud and the
@@ -50,6 +94,7 @@ export declare function formatSyncFailure(err: unknown, ctx?: {
     hqRoot?: string;
     cwd?: string;
     companySlug?: string;
+    vaultConfig?: VaultServiceConfig;
 }): string;
 /**
  * The `.hqinclude` line that admits a named path: its HQ-relative spelling,
@@ -259,6 +304,8 @@ export interface SyncCallResult {
     aborted: boolean;
 }
 export interface PullAllDeps {
+    /** Formats a per-target failure; the real path binds the run's vault config. */
+    formatFailure?: (err: unknown) => string;
     vaultClient: PullAllVaultClient;
     sync: (options: SyncCallOptions) => Promise<SyncCallResult>;
     /**
@@ -352,6 +399,8 @@ export interface ShareCallResult {
     planLimit?: PlanLimitRefusalSummary | null;
 }
 export interface PushAllDeps {
+    /** Formats a per-target failure; the real path binds the run's vault config. */
+    formatFailure?: (err: unknown) => string;
     vaultClient: PullAllVaultClient;
     share: (options: ShareCallOptions) => Promise<ShareCallResult>;
     beforeShare?: (input: {