@indigoai-us/hq-cli 5.345.178 → 5.345.180

package/dist/lib/bot/local-jobs.js

@@ -237,10 +237,14 @@ function rateIntervalMs(expr) {
 function isRunnableSchedule(expr) {
     return rateIntervalMs(expr) !== null || parseCron(expr) !== null;
 }
+/** Where the current schedule starts counting: its last change, else creation. */
+function scheduleOrigin(job) {
+    return Date.parse(job.scheduledFrom ?? job.createdAt);
+}
 export function latestDueFire(job, now) {
     const interval = rateIntervalMs(job.cron);
     if (interval) {
-        const origin = Date.parse(job.createdAt);
+        const origin = scheduleOrigin(job);
         const steps = Math.floor((now.getTime() - origin) / interval);
         if (steps < 1)
             return null;
@@ -252,7 +256,7 @@ export function latestDueFire(job, now) {
         return null;
     const start = new Date(now);
     start.setUTCSeconds(0, 0);
-    const floor = Math.max(job.lastFiredAt ? Date.parse(job.lastFiredAt) : Date.parse(job.createdAt), start.getTime() - LOOKBACK_MINUTES * 60_000);
+    const floor = Math.max(job.lastFiredAt ? Date.parse(job.lastFiredAt) : Date.parse(job.createdAt), job.scheduledFrom ? Date.parse(job.scheduledFrom) : 0, start.getTime() - LOOKBACK_MINUTES * 60_000);
     for (let t = start.getTime(); t > floor; t -= 60_000) {
         const at = new Date(t);
         if (cronMatches(cron, at, job.timezone))
@@ -264,7 +268,7 @@ export function latestDueFire(job, now) {
 export function nextDueFire(job, now) {
     const interval = rateIntervalMs(job.cron);
     if (interval) {
-        const origin = Date.parse(job.createdAt);
+        const origin = scheduleOrigin(job);
         const steps = Math.max(0, Math.floor((now.getTime() - origin) / interval)) + 1;
         return new Date(origin + steps * interval);
     }
@@ -310,6 +314,53 @@ export function addLocalJob(dir, input, now = new Date()) {
     withJobsLock(dir, () => writeLocalJobs(dir, [...readLocalJobs(dir), job]));
     return job;
 }
+/**
+ * Add a job unless one already matches, as one locked read-and-write, so two
+ * bot starts racing each other still leave a single job.
+ */
+export function ensureLocalJob(dir, matches, input, now = new Date()) {
+    if (!isRunnableSchedule(input.cron))
+        throw new Error(`"${input.cron}" is not a schedule this bot can run.`);
+    return withJobsLock(dir, () => {
+        const jobs = readLocalJobs(dir);
+        const existing = jobs.find(matches);
+        if (existing)
+            return { job: existing, created: false };
+        const job = {
+            jobId: `job_${randomUUID().replace(/-/g, "").slice(0, 20)}`,
+            prompt: input.prompt,
+            cron: input.cron,
+            timezone: input.timezone,
+            ...(input.context ? { context: input.context } : {}),
+            createdAt: now.toISOString(),
+        };
+        writeLocalJobs(dir, [...jobs, job]);
+        return { job, created: true };
+    });
+}
+/**
+ * Change a job's schedule in place, keeping its id, instruction, context and
+ * run history. Returns null when the bot has no job with that id.
+ */
+export function rescheduleLocalJob(dir, jobId, schedule, now = new Date()) {
+    if (!isRunnableSchedule(schedule.cron))
+        throw new Error(`"${schedule.cron}" is not a schedule this bot can run.`);
+    return withJobsLock(dir, () => {
+        const jobs = readLocalJobs(dir);
+        const index = jobs.findIndex((job) => job.jobId === jobId);
+        if (index < 0)
+            return null;
+        const updated = {
+            ...jobs[index],
+            cron: schedule.cron,
+            timezone: schedule.timezone,
+            scheduledFrom: now.toISOString(),
+        };
+        jobs[index] = updated;
+        writeLocalJobs(dir, jobs);
+        return updated;
+    });
+}
 /** Remove a job. Returns false when the bot has no job with that id. */
 function removeLocalJob(dir, jobId) {
     return withJobsLock(dir, () => {
@@ -321,6 +372,16 @@ function removeLocalJob(dir, jobId) {
         return true;
     });
 }
+/** Remove every job `matches` picks, as one locked read-and-write. Returns the removed jobs. */
+export function removeLocalJobsWhere(dir, matches) {
+    return withJobsLock(dir, () => {
+        const jobs = readLocalJobs(dir);
+        const removed = jobs.filter(matches);
+        if (removed.length > 0)
+            writeLocalJobs(dir, jobs.filter((job) => !matches(job)));
+        return removed;
+    });
+}
 // ─── Firing ──────────────────────────────────────────────────────────────────
 /**
  * Hand over every job that is due now. Each fire is recorded (lastFiredAt and
@@ -430,8 +491,8 @@ export function withLocalJobs(api, dir, clock = () => new Date()) {
 /** The most jobs one bot may hold (the same cap the cloud uses). */
 const MAX_LOCAL_JOBS = 25;
 /**
- * `hq bot jobs` against the bot's own folder: the same three calls the cloud
- * client offers, answered from `jobs.json`.
+ * `hq bot jobs` against the bot's own folder: the same calls the cloud client
+ * offers, plus reschedule, answered from `jobs.json`.
  */
 export function localJobsClient(dir, clock = () => new Date()) {
     return {
@@ -454,6 +515,12 @@ export function localJobsClient(dir, clock = () => new Date()) {
                 throw new BotApiError(404, "local jobs", "JOB_NOT_FOUND", `Job '${jobId}' not found`);
             }
         },
+        async rescheduleJob(_agentUid, jobId, schedule) {
+            const job = rescheduleLocalJob(dir, jobId, schedule, clock());
+            if (!job)
+                throw new BotApiError(404, "local jobs", "JOB_NOT_FOUND", `Job '${jobId}' not found`);
+            return toJobRecord(job, clock());
+        },
     };
 }
 //# sourceMappingURL=local-jobs.js.map

package/dist/lib/bot/run.d.ts

@@ -134,6 +134,21 @@ export interface BotRunDeps {
     inboxPollBackoffEnabled?: () => Promise<boolean>;
     /** Default-off gate for the per-job quiet-success option. */
     jobQuietOptionEnabled?: () => boolean | Promise<boolean>;
+    /**
+     * The built-in hot-signal-sync job (jobs/hot-signal-sync.ts), run in-process
+     * with no model turn. Unset = a fired run of that job fails with a plain
+     * report instead of handing the instruction to the model.
+     */
+    hotSignalSync?: (input: {
+        company: string;
+        catchUp: boolean;
+        now: () => Date;
+        /** The signals-failure alert to the owner, sent even when the job is quiet (US-012). */
+        sendAlert: (text: string) => Promise<void>;
+    }) => Promise<{
+        ok: boolean;
+        text: string;
+    }>;
     heartbeatIntervalMs?: number;
     /** Override the rendered system prompt (tests). */
     systemPromptOverride?: string;

package/dist/lib/bot/run.js

@@ -46,6 +46,7 @@
  *
  * Everything with a side effect is injectable so the loop is unit-testable.
  */
+import { botAuthEnv, describeBotAuth, formatBotAuth } from "./runtime-auth.js";
 import { ownerContextBlock } from "./owner-context.js";
 import { randomUUID } from "node:crypto";
 import { hasPromotionHold } from "./promotion-hold.js";
@@ -82,6 +83,7 @@ import { isAgentSender, isDmItem, isMetaNonReply, resolveReplyTarget } from "./r
 import { resolveRoomMentionsForBot, roomPostHasMentionTokens, } from "./room-mentions.js";
 import { buildJobTurnPrompt, isCatchUpRun, isJobItem, jobReportHeader, jobRunOutput, machineTimeZone, planJobRuns, stripJobHeader, SUPERSEDED_DISPOSITION } from "./job-run.js";
 import { botJobQuietOptionEnabled } from "./job-quiet-flag.js";
+import { currentHotSignalSyncCompany, hotSignalSyncJobCompany, removeStaleHotSignalSyncJobs } from "./jobs/hot-signal-sync.js";
 import { clearPendingJobCompletion, isCompletionDue, isCompletionExpired, isCompletionForOtherAgent, readPendingJobCompletions, recordPendingJobCompletion } from "./job-completions.js";
 import { SIGN_IN_CHECK_FRESH_MS, SIGN_IN_CHECK_MS, SIGN_IN_RETRY_MS, signInNeededText, signedOutExcerpt, } from "./runtime-sign-in.js";
 import { checkRuntimeSignIn } from "./runtime-sign-in-check.js";
@@ -557,6 +559,12 @@ export async function runBot(deps) {
     setStatus({ ...fallback(), pid, state: "starting", canDrainForPromotion: false, runtimeSignIn: null, cliVersion });
     log("info", `starting ${config.name} on hq-cli ${cliVersion} (${config.runtime}, ${kind} bot${companies.length ? ` of ${companies.join(", ")}` : ""}) as ${config.agentUid} for ${config.ownerUid}`);
     log("info", `${runtime.id} binary: ${describeRuntimeBinary(runtime, turnEnv(process.env, kind, config.agentUid, companySlug), turnCwd)}`);
+    {
+        const login = describeBotAuth(dir, config);
+        log("info", `${runtime.id} login: ${formatBotAuth(login, config.name)}`);
+        if (login.login === "own" && !login.present)
+            setStatus({ lastError: `own ${runtime.id} login missing: run hq bot login ${config.name} --runtime ${runtime.id}` });
+    }
     deps.cliUpdate?.startup(log);
     try {
         const record = await api.getAgent(config.agentUid);
@@ -1047,7 +1055,15 @@ export async function runBot(deps) {
             // resets). Claude gets the full hook set via its payload session id;
             // Codex/Grok only see HQ_SESSION_ID.
             const sid = session?.sessionId ?? randomUUID();
-            const env = withOsUser(turnEnv(process.env, kind, config.agentUid, companySlug));
+            let env;
+            try {
+                // The bot's own login or account, when set. A missing one fails the
+                // turn loudly (status + reply); it never falls back to the owner's login.
+                env = withOsUser(botAuthEnv(dir, { ...live, runtime: config.runtime }, turnEnv(process.env, kind, config.agentUid, companySlug)));
+            }
+            catch (err) {
+                throw new CompanyBindingError(`I can't answer yet: ${err instanceof Error ? err.message : String(err)} I did not use anyone else's login; this work is still pending.`);
+            }
             let bind = { env };
             if (companySlug) {
                 try {
@@ -1932,6 +1948,88 @@ export async function runBot(deps) {
         const markReported = (status) => {
             patchInflight(dir, id, { jobCompleted: status });
         };
+        // The built-in hot-signal-sync job runs here, in the bot, with no model
+        // turn. It is marked processed as soon as the sync finishes, so a report
+        // that fails to post (or a redelivered item) never syncs a second time.
+        const syncCompany = hotSignalSyncJobCompany(job.context);
+        if (syncCompany) {
+            // The job's stored company is checked against the bot's current config
+            // (read fresh from disk) every time it fires. A company the bot no longer
+            // serves is never synced: the run is skipped and the job removed.
+            const freshConfig = readBotConfig(dir);
+            if (!freshConfig) {
+                // bot.json is missing or unreadable, so which company the bot serves is
+                // unknown. Skip this run without writing anything; the job stays for the
+                // next fire.
+                const text = `Skipped the hot-channel sync for ${syncCompany}: the bot's config (bot.json) could not be read, so nothing was written. The job will try again at its next run.`;
+                markProcessed(dir, id, now().toISOString());
+                try {
+                    await sendToPerson(text);
+                }
+                catch (err) {
+                    log("warn", `report for run ${id} of job ${jobId} was not delivered: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                await completeJobRun(jobId, id, { status: "skipped-precondition", output: jobRunOutput(text) });
+                markReported("skipped-precondition");
+                await api.ackInbox(config.agentUid, id);
+                clearInflight(dir, id);
+                attempts.delete(id);
+                setStatus({ lastActivityAt: now().toISOString() });
+                log("warn", `hot-signal-sync job ${jobId} run ${id} skipped: bot.json missing or unreadable`);
+                return;
+            }
+            const currentCompany = currentHotSignalSyncCompany(freshConfig);
+            if (currentCompany !== syncCompany) {
+                let removedNote = "";
+                try {
+                    removeStaleHotSignalSyncJobs(dir, currentCompany);
+                    removedNote = ` Removed job ${jobId}.`;
+                }
+                catch (err) {
+                    removedNote = ` Could not remove job ${jobId}: ${err instanceof Error ? err.message : String(err)}`;
+                }
+                const text = `Skipped the hot-channel sync for ${syncCompany}: this bot no longer syncs that company (current: ${currentCompany ?? "none"}). Nothing was written.${removedNote}`;
+                markProcessed(dir, id, now().toISOString());
+                try {
+                    await sendToPerson(text);
+                }
+                catch (err) {
+                    log("warn", `report for run ${id} of job ${jobId} was not delivered: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                await completeJobRun(jobId, id, { status: "skipped-precondition", output: jobRunOutput(text) });
+                markReported("skipped-precondition");
+                await api.ackInbox(config.agentUid, id);
+                clearInflight(dir, id);
+                attempts.delete(id);
+                setStatus({ lastActivityAt: now().toISOString() });
+                log("info", `hot-signal-sync job ${jobId} run ${id} skipped: company ${syncCompany} no longer served (current: ${currentCompany ?? "none"})`);
+                return;
+            }
+            const result = deps.hotSignalSync
+                ? await deps.hotSignalSync({ company: syncCompany, catchUp, now, sendAlert: (text) => sendToPerson(text) })
+                : { ok: false, text: `This bot cannot run the hot-channel sync for ${syncCompany}.` };
+            markProcessed(dir, id, now().toISOString());
+            const status = result.ok ? "succeeded" : "failed";
+            if (!(quietJob && result.ok)) {
+                try {
+                    await sendToPerson(result.text);
+                }
+                catch (err) {
+                    log("warn", `report for run ${id} of job ${jobId} was not delivered: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            await completeJobRun(jobId, id, { status, output: jobRunOutput(result.text) });
+            markReported(status);
+            await api.ackInbox(config.agentUid, id);
+            clearInflight(dir, id);
+            attempts.delete(id);
+            setStatus({
+                ...(!(quietJob && result.ok) ? { repliesSent: (readStatus()?.repliesSent ?? 0) + 1 } : {}),
+                lastActivityAt: now().toISOString(),
+            });
+            log("info", `hot-signal-sync job ${jobId} run ${id} ${status} for ${syncCompany}${catchUp ? " (catch-up)" : ""}`);
+            return;
+        }
         const { outcome, poster } = await runTurnWithProgress({
             marker: { messageId: id, target: markerTarget, jobId, jobHeader: header, agentUid: config.agentUid },
             prompt: buildJobTurnPrompt(job, { now: now(), timeZone }),

package/dist/lib/bot/runtime-auth.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Which model login a local bot uses, per runtime.
+ *
+ * - default: the owner's own sign-in for that runtime (no config dir set).
+ * - own:     a sign-in that belongs to the bot alone, kept in
+ *            ~/.hq/bots/<name>/auth/<runtime>/ (CLAUDE_CONFIG_DIR / CODEX_HOME).
+ * - account: an existing `hq capacity` / lanes account home, by id.
+ *
+ * Also the session set-aside a runtime switch needs: session files belong to
+ * one runtime, so they move to a backup folder and the new runtime starts
+ * fresh. DM history, memory and the cloud identity are never touched.
+ *
+ * This module never reads, prints, copies or hashes a credential. It only
+ * names directories and checks whether they exist.
+ */
+import type { BotConfig, BotRuntimeId } from "./config.js";
+import type { LanesConfig } from "../lanes/types.js";
+/** Runtimes `hq bot login` can sign in for (each has a config-dir variable and a login command). */
+export declare const BOT_LOGIN_RUNTIMES: readonly ["claude", "codex"];
+export type BotLoginRuntime = (typeof BOT_LOGIN_RUNTIMES)[number];
+export declare function isBotLoginRuntime(value: unknown): value is BotLoginRuntime;
+export type BotRuntimeAuth = {
+    mode: "own";
+} | {
+    mode: "account";
+    account: string;
+};
+export type BotRuntimeAuthMap = Partial<Record<BotRuntimeId, BotRuntimeAuth>>;
+export declare const BOT_AUTH_DIRNAME = "auth";
+export declare const BOT_SESSION_ARCHIVE_DIRNAME = "session-archive";
+export declare const VENDOR_LOGIN: Record<BotLoginRuntime, {
+    command: string;
+    args: string[];
+}>;
+export declare const VENDOR_LOGOUT: Record<BotLoginRuntime, {
+    command: string;
+    args: string[];
+}>;
+/** The bot's own config home for a runtime: <botDir>/auth/<runtime>. */
+export declare function botOwnAuthHome(dir: string, runtime: BotRuntimeId): string;
+/** The saved login choice for a runtime, or null for the owner's default. Tolerant of junk on read. */
+export declare function botRuntimeAuth(config: Pick<BotConfig, "runtime" | "runtimeAuth">, runtime?: BotRuntimeId): BotRuntimeAuth | null;
+/** A copy of the map with `runtime` set to `auth` (null = back to the owner's default). */
+export declare function withRuntimeAuth(map: BotRuntimeAuthMap | undefined, runtime: BotRuntimeId, auth: BotRuntimeAuth | null): BotRuntimeAuthMap | undefined;
+export interface AccountLookupDeps {
+    loadConfig?: (hqRoot: string) => LanesConfig;
+    existsSync?: (p: string) => boolean;
+}
+/** The home directory of a capacity account for a runtime. Throws an expected error when it is not usable. */
+export declare function capacityAccountHome(hqRoot: string, runtime: BotRuntimeId, accountId: string, deps?: AccountLookupDeps): string;
+/**
+ * The environment a bot's model turn runs with: `base` with the runtime's
+ * config-dir variable pointed at the bot's chosen login. A missing own login
+ * or a gone account is an error: falling back to the owner's login is the
+ * thing this setting exists to prevent.
+ */
+export declare function botAuthEnv(dir: string, config: Pick<BotConfig, "name" | "runtime" | "runtimeAuth" | "hqRoot">, base: NodeJS.ProcessEnv, deps?: AccountLookupDeps): NodeJS.ProcessEnv;
+export interface BotAuthDescription {
+    runtime: BotRuntimeId;
+    login: "default" | "own" | "account" | "invalid";
+    account?: string;
+    /** The config-dir variable the bot's turns set (never its value's contents). */
+    envVar?: string;
+    /** Own login: whether its folder exists. Never a token check. */
+    present?: boolean;
+}
+export declare function describeBotAuth(dir: string, config: Pick<BotConfig, "runtime" | "runtimeAuth">, existsSync?: (p: string) => boolean): BotAuthDescription;
+export declare function formatBotAuth(d: BotAuthDescription, name: string): string;
+export type SpawnInteractive = (command: string, args: string[], env: NodeJS.ProcessEnv) => {
+    status: number | null;
+    error?: Error;
+};
+/** Runs the vendor's own login/logout with the terminal attached. Its output goes to the terminal only, never to HQ's log. */
+export declare const defaultSpawnInteractive: SpawnInteractive;
+/** Logout runs quietly: nothing it prints is shown or logged. */
+export declare const defaultSpawnQuiet: SpawnInteractive;
+/**
+ * Sign a bot in with its own login for `runtime`. The vendor CLI writes the
+ * credential into the bot's home (or, for Claude on macOS, a keychain item
+ * keyed by that home). HQ never sees it.
+ */
+export declare function signInBotRuntime(dir: string, runtime: BotLoginRuntime, deps?: {
+    spawn?: SpawnInteractive;
+    quietSpawn?: SpawnInteractive;
+    env?: NodeJS.ProcessEnv;
+}): {
+    home: string;
+    created: boolean;
+};
+/**
+ * Sign the bot's own login out and delete its home. The vendor logout runs
+ * first so a Claude keychain item keyed by the home is removed too.
+ */
+export declare function signOutBotRuntime(dir: string, runtime: BotLoginRuntime, deps?: {
+    spawn?: SpawnInteractive;
+    env?: NodeJS.ProcessEnv;
+}): {
+    removed: boolean;
+    vendorLogout: "ok" | "failed" | "skipped";
+};
+/** True for the model-session files of a bot dir (owner DM, other DMs, rooms, jobs). */
+export declare function isBotSessionFile(name: string): boolean;
+export interface SessionSetAside {
+    archiveDir: string;
+    moved: string[];
+}
+/**
+ * Before a runtime switch: back up bot.json and move every session file into
+ * <dir>/session-archive/<stamp>-<oldRuntime>/, so the new runtime starts
+ * fresh and the old sessions can be put back.
+ */
+export declare function setAsideBotSessions(dir: string, oldRuntime: BotRuntimeId, now?: Date): SessionSetAside;
+/**
+ * Undo setAsideBotSessions: the moved session files go back. bot.json is not
+ * overwritten (the bot may have written fields since); the caller patches the
+ * settings it changed back. The backup folder stays for manual recovery.
+ */
+export declare function restoreBotSessions(dir: string, aside: SessionSetAside): void;
+//# sourceMappingURL=runtime-auth.d.ts.map

package/dist/lib/bot/runtime-auth.js

@@ -0,0 +1,251 @@
+/**
+ * Which model login a local bot uses, per runtime.
+ *
+ * - default: the owner's own sign-in for that runtime (no config dir set).
+ * - own:     a sign-in that belongs to the bot alone, kept in
+ *            ~/.hq/bots/<name>/auth/<runtime>/ (CLAUDE_CONFIG_DIR / CODEX_HOME).
+ * - account: an existing `hq capacity` / lanes account home, by id.
+ *
+ * Also the session set-aside a runtime switch needs: session files belong to
+ * one runtime, so they move to a backup folder and the new runtime starts
+ * fresh. DM history, memory and the cloud identity are never touched.
+ *
+ * This module never reads, prints, copies or hashes a credential. It only
+ * names directories and checks whether they exist.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { botConfigPath } from "./paths.js";
+import { PROVIDER_HOME_ENV, isDefaultProviderHome, withProviderHomeEnv } from "../lanes/provider-home.js";
+import { effectiveAccountHome } from "../lanes/account-home.js";
+import { loadLanesConfig } from "../lanes/config.js";
+/** Runtimes `hq bot login` can sign in for (each has a config-dir variable and a login command). */
+export const BOT_LOGIN_RUNTIMES = ["claude", "codex"];
+export function isBotLoginRuntime(value) {
+    return typeof value === "string" && BOT_LOGIN_RUNTIMES.includes(value);
+}
+export const BOT_AUTH_DIRNAME = "auth";
+export const BOT_SESSION_ARCHIVE_DIRNAME = "session-archive";
+const ACCOUNT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+export const VENDOR_LOGIN = {
+    claude: { command: "claude", args: ["auth", "login"] },
+    codex: { command: "codex", args: ["login"] },
+};
+export const VENDOR_LOGOUT = {
+    claude: { command: "claude", args: ["auth", "logout"] },
+    codex: { command: "codex", args: ["logout"] },
+};
+function expected(message) {
+    return Object.assign(new Error(message), { expected: true });
+}
+/** The bot's own config home for a runtime: <botDir>/auth/<runtime>. */
+export function botOwnAuthHome(dir, runtime) {
+    return path.join(dir, BOT_AUTH_DIRNAME, runtime);
+}
+/** The saved login choice for a runtime, or null for the owner's default. Tolerant of junk on read. */
+export function botRuntimeAuth(config, runtime = config.runtime) {
+    const raw = config.runtimeAuth?.[runtime];
+    if (!raw || typeof raw !== "object")
+        return null;
+    if (raw.mode === "own")
+        return { mode: "own" };
+    if (raw.mode === "account" && typeof raw.account === "string" && ACCOUNT_ID_RE.test(raw.account)) {
+        return { mode: "account", account: raw.account };
+    }
+    return null;
+}
+/** A copy of the map with `runtime` set to `auth` (null = back to the owner's default). */
+export function withRuntimeAuth(map, runtime, auth) {
+    const next = { ...(map ?? {}) };
+    if (auth)
+        next[runtime] = auth;
+    else
+        delete next[runtime];
+    return Object.keys(next).length ? next : undefined;
+}
+/** The home directory of a capacity account for a runtime. Throws an expected error when it is not usable. */
+export function capacityAccountHome(hqRoot, runtime, accountId, deps = {}) {
+    if (!ACCOUNT_ID_RE.test(accountId))
+        throw expected(`"${accountId.slice(0, 40)}" is not an account id.`);
+    const cfg = (deps.loadConfig ?? loadLanesConfig)(hqRoot);
+    const provider = cfg.providers[runtime];
+    const account = provider?.accounts[accountId];
+    if (!account) {
+        const known = Object.keys(provider?.accounts ?? {});
+        throw expected(`No ${runtime} account named "${accountId}"${known.length ? ` (known: ${known.join(", ")})` : ""}. Add one with: hq capacity login ${runtime}`);
+    }
+    if (!account.enabled)
+        throw expected(`The ${runtime} account "${accountId}" is disabled.`);
+    const home = effectiveAccountHome(account).home;
+    if (isDefaultProviderHome(runtime, home)) {
+        throw expected(`The ${runtime} account "${accountId}" is your default ${runtime} login, so it would not give the bot a login of its own. Pick another account, or use: hq bot login`);
+    }
+    if (!(deps.existsSync ?? fs.existsSync)(home))
+        throw expected(`The ${runtime} account "${accountId}" has no home folder on this computer. Sign it in with: hq capacity login ${runtime} --account ${accountId}`);
+    return home;
+}
+/**
+ * The environment a bot's model turn runs with: `base` with the runtime's
+ * config-dir variable pointed at the bot's chosen login. A missing own login
+ * or a gone account is an error: falling back to the owner's login is the
+ * thing this setting exists to prevent.
+ */
+export function botAuthEnv(dir, config, base, deps = {}) {
+    const auth = botRuntimeAuth(config);
+    const runtime = config.runtime;
+    if (!auth) {
+        // A saved choice HQ cannot read is not the owner's default: refuse it.
+        if (config.runtimeAuth?.[runtime] !== undefined) {
+            throw expected(`${config.name}'s saved ${runtime} login setting is not readable. Set it again with: hq bot login ${config.name} --runtime ${runtime}, or hq bot set ${config.name} --account <id|default>`);
+        }
+        return { ...base };
+    }
+    if (auth.mode === "own") {
+        const home = botOwnAuthHome(dir, runtime);
+        if (!(deps.existsSync ?? fs.existsSync)(home)) {
+            throw expected(`${config.name} is set to its own ${runtime} login but has none on this computer. Sign it in with: hq bot login ${config.name} --runtime ${runtime}`);
+        }
+        return withProviderHomeEnv(base, runtime, home);
+    }
+    return withProviderHomeEnv(base, runtime, capacityAccountHome(config.hqRoot, runtime, auth.account, deps));
+}
+export function describeBotAuth(dir, config, existsSync = fs.existsSync) {
+    const auth = botRuntimeAuth(config);
+    const runtime = config.runtime;
+    if (!auth)
+        return config.runtimeAuth?.[runtime] !== undefined ? { runtime, login: "invalid" } : { runtime, login: "default" };
+    const envVar = PROVIDER_HOME_ENV[runtime];
+    if (auth.mode === "own")
+        return { runtime, login: "own", ...(envVar ? { envVar } : {}), present: existsSync(botOwnAuthHome(dir, runtime)) };
+    return { runtime, login: "account", account: auth.account, ...(envVar ? { envVar } : {}) };
+}
+export function formatBotAuth(d, name) {
+    if (d.login === "default")
+        return `default (your own ${d.runtime} sign-in)`;
+    if (d.login === "invalid")
+        return `unreadable setting; turns are refused until it is set again (hq bot login ${name} --runtime ${d.runtime})`;
+    if (d.login === "account")
+        return `account ${d.account}`;
+    return d.present ? `own (signed in for ${name} only)` : `own, but not signed in (run: hq bot login ${name} --runtime ${d.runtime})`;
+}
+/** Runs the vendor's own login/logout with the terminal attached. Its output goes to the terminal only, never to HQ's log. */
+export const defaultSpawnInteractive = (command, args, env) => {
+    const r = spawnSync(command, args, { stdio: "inherit", env });
+    return { status: r.status, ...(r.error ? { error: r.error } : {}) };
+};
+/** Logout runs quietly: nothing it prints is shown or logged. */
+export const defaultSpawnQuiet = (command, args, env) => {
+    const r = spawnSync(command, args, { stdio: ["ignore", "ignore", "ignore"], env, timeout: 30_000 });
+    return { status: r.status, ...(r.error ? { error: r.error } : {}) };
+};
+/** Refuse to touch anything that is not exactly <dir>/auth/<runtime>. */
+function assertOwnAuthHome(dir, home) {
+    const root = path.resolve(dir, BOT_AUTH_DIRNAME);
+    const rel = path.relative(root, path.resolve(home));
+    if (!rel || rel.startsWith("..") || path.isAbsolute(rel) || rel.includes(path.sep)) {
+        throw new Error(`refusing to touch ${home}: not a bot login folder`);
+    }
+    for (const p of [root, home]) {
+        let link = false;
+        try {
+            link = fs.lstatSync(p).isSymbolicLink();
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        if (link)
+            throw new Error(`refusing to touch ${p}: it is a symbolic link`);
+    }
+}
+/**
+ * Sign a bot in with its own login for `runtime`. The vendor CLI writes the
+ * credential into the bot's home (or, for Claude on macOS, a keychain item
+ * keyed by that home). HQ never sees it.
+ */
+export function signInBotRuntime(dir, runtime, deps = {}) {
+    const home = botOwnAuthHome(dir, runtime);
+    assertOwnAuthHome(dir, home);
+    const created = !fs.existsSync(home);
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    fs.chmodSync(path.join(dir, BOT_AUTH_DIRNAME), 0o700);
+    fs.chmodSync(home, 0o700);
+    const { command, args } = VENDOR_LOGIN[runtime];
+    const r = (deps.spawn ?? defaultSpawnInteractive)(command, args, withProviderHomeEnv(deps.env ?? process.env, runtime, home));
+    if (r.error || r.status !== 0) {
+        // A first sign-in that failed leaves nothing behind.
+        if (created) {
+            // A keychain item keyed by this folder may already exist: sign it out first.
+            const { command: out, args: outArgs } = VENDOR_LOGOUT[runtime];
+            (deps.quietSpawn ?? defaultSpawnQuiet)(out, outArgs, withProviderHomeEnv(deps.env ?? process.env, runtime, home));
+            fs.rmSync(home, { recursive: true, force: true });
+        }
+        const why = r.error?.code === "ENOENT" ? `${command} is not installed` : `${command} ${args.join(" ")} did not finish (exit ${r.status ?? "signal"})`;
+        throw expected(`Sign-in failed: ${why}. Nothing was changed.`);
+    }
+    return { home, created };
+}
+/**
+ * Sign the bot's own login out and delete its home. The vendor logout runs
+ * first so a Claude keychain item keyed by the home is removed too.
+ */
+export function signOutBotRuntime(dir, runtime, deps = {}) {
+    const home = botOwnAuthHome(dir, runtime);
+    assertOwnAuthHome(dir, home);
+    if (!fs.existsSync(home))
+        return { removed: false, vendorLogout: "skipped" };
+    const { command, args } = VENDOR_LOGOUT[runtime];
+    const r = (deps.spawn ?? defaultSpawnQuiet)(command, args, withProviderHomeEnv(deps.env ?? process.env, runtime, home));
+    if (r.error || r.status !== 0) {
+        // Keep the folder: it is the only handle on a keychain item keyed by it.
+        return { removed: false, vendorLogout: "failed" };
+    }
+    fs.rmSync(home, { recursive: true, force: true });
+    return { removed: true, vendorLogout: "ok" };
+}
+/** True for the model-session files of a bot dir (owner DM, other DMs, rooms, jobs). */
+export function isBotSessionFile(name) {
+    return name === "session.json" || /^session-(dm|room|job)-[A-Za-z0-9._-]+\.json$/.test(name);
+}
+/**
+ * Before a runtime switch: back up bot.json and move every session file into
+ * <dir>/session-archive/<stamp>-<oldRuntime>/, so the new runtime starts
+ * fresh and the old sessions can be put back.
+ */
+export function setAsideBotSessions(dir, oldRuntime, now = new Date()) {
+    const stamp = now.toISOString().replace(/[:.]/g, "-");
+    const archiveDir = path.join(dir, BOT_SESSION_ARCHIVE_DIRNAME, `${stamp}-${oldRuntime}`);
+    fs.mkdirSync(archiveDir, { recursive: true, mode: 0o700 });
+    fs.copyFileSync(botConfigPath(dir), path.join(archiveDir, "bot.json"));
+    const moved = [];
+    try {
+        for (const name of fs.readdirSync(dir)) {
+            if (!isBotSessionFile(name))
+                continue;
+            fs.renameSync(path.join(dir, name), path.join(archiveDir, name));
+            moved.push(name);
+        }
+    }
+    catch (err) {
+        restoreBotSessions(dir, { archiveDir, moved });
+        throw err;
+    }
+    return { archiveDir, moved };
+}
+/**
+ * Undo setAsideBotSessions: the moved session files go back. bot.json is not
+ * overwritten (the bot may have written fields since); the caller patches the
+ * settings it changed back. The backup folder stays for manual recovery.
+ */
+export function restoreBotSessions(dir, aside) {
+    for (const name of fs.readdirSync(dir)) {
+        // Files the new runtime wrote in the meantime are not the old runtime's.
+        if (isBotSessionFile(name) && !aside.moved.includes(name))
+            fs.rmSync(path.join(dir, name), { force: true });
+    }
+    for (const name of aside.moved) {
+        fs.copyFileSync(path.join(aside.archiveDir, name), path.join(dir, name));
+    }
+}
+//# sourceMappingURL=runtime-auth.js.map

package/dist/lib/daemon/catalog.d.ts

@@ -189,6 +189,7 @@ export declare function hqCloudUnits(machineType: MachineType, enabled: readonly
 export declare const CODEX_RUNNER_SCRIPT = "/usr/local/bin/outpost-codex-runner.sh";
 /** The outpost's Claude runner script, read for the session name it uses. */
 export declare const CLAUDE_RUNNER_SCRIPT = "/usr/local/bin/outpost-runner.sh";
+export declare function daemonAloneRunsLegacySync(ctx: PlanContext): boolean;
 /** Turn enabled services into concrete units for this host. */
 export declare function planUnits(services: readonly ServiceName[], ctx: PlanContext): UnitPlan[];
 export {};