@indigoai-us/hq-cli 5.345.179 → 5.345.181

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.104","bundleSha256":"40c72e049db21ee4551fa737676d8022cd090149ede9e3c9e53a9fae3f28dadc","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.105","bundleSha256":"f57aa12671cdfcf08ce39f11ce6885d6e52d5478f2ae77a75d38d79162194ce5","formatVersion":1}

package/dist/lib/bot/config.d.ts

@@ -1,6 +1,7 @@
 /**
  * bot.json — non-secret per-bot configuration (local-bots US-003/US-005).
  */
+import type { BotRuntimeAuthMap } from "./runtime-auth.js";
 export declare const BOT_RUNTIMES: readonly ["claude", "codex", "grok"];
 export type BotRuntimeId = (typeof BOT_RUNTIMES)[number];
 export declare const HQ_FLEET_RUNTIME_ENGINE_ID: "hq-fleet-runtime";
@@ -167,6 +168,13 @@ export interface BotConfig {
      * setup bots, which only need files and shell commands.
      */
     lean?: boolean;
+    /**
+     * Which model login each runtime uses (see runtime-auth.ts): unset = the
+     * owner's default sign-in; { mode: "own" } = the bot's own login under
+     * ~/.hq/bots/<name>/auth/<runtime>; { mode: "account", account } = a
+     * capacity account home. Names only, never a credential.
+     */
+    runtimeAuth?: BotRuntimeAuthMap;
 }
 export declare function readBotConfig(dir: string): BotConfig | null;
 export declare function writeBotConfig(dir: string, config: BotConfig): void;

package/dist/lib/bot/fleet-local.d.ts

@@ -99,6 +99,9 @@ export interface FleetLocalBootstrapDeps {
     start?: boolean;
     python?: FleetPython;
 }
+type FleetLocalProfileDeps = Pick<FleetLocalBootstrapDeps, "fleetHome" | "platform"> & {
+    runtimeRoot?: string;
+};
 export interface FleetLocalBootstrapResult {
     profile: string;
     runtime: string;
@@ -133,7 +136,7 @@ export interface FleetLocalRemovalResult {
     credentialsRemoved: number;
 }
 export declare const HQ_FLEET_LOCAL_RELEASE: FleetLocalReleasePin;
-export declare const HQ_FLEET_LOCAL_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAbYvc1pwOmiCUPJv8yIa3E9RXfniFA84nH2+ROmLMGZU=\n-----END PUBLIC KEY-----\n";
+export declare const HQ_FLEET_LOCAL_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEARXr2I8RNcw2c0Ep77XkYGwylresXBFn8dm9pxN2Zq/U=\n-----END PUBLIC KEY-----\n";
 export declare function fleetHome(home?: string, env?: NodeJS.ProcessEnv): string;
 export declare function verifyFleetLocalRelease(files: FleetLocalReleaseFiles, release?: FleetLocalReleasePin, publicKey?: string): void;
 export declare function resolveFleetReleaseToken(env?: NodeJS.ProcessEnv): string;
@@ -144,12 +147,13 @@ export declare const FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS: number;
 export declare function installPinnedFleetLocalDistribution(deps?: FleetLocalInstallDeps): Promise<FleetLocalInstallation>;
 /** The process id the bot's gateway recorded, when its file reads; the caller checks whether it is alive. */
 export declare function fleetLocalGatewayPid(agentUid: string, deps?: Pick<FleetLocalControlDeps, "fleetHome">): number | null;
+export declare function fleetLocalProfileNeedsAdoption(agentUid: string, deps?: Pick<FleetLocalControlDeps, "fleetHome" | "platform">): boolean;
 export declare function controlFleetLocalBot(agentUid: string, action: FleetLocalServiceAction, deps?: FleetLocalControlDeps): Record<string, unknown>;
 export declare function exportFleetLocalMachineCredential(agentUid: string, deps?: FleetLocalControlDeps): BotMachineCreds;
 export declare function fleetLocalPromotionRuntime(agentUid: string, deps?: FleetLocalControlDeps): LocalBotPromotionRuntime;
 export declare function removeFleetLocalBot(agentUid: string, deps?: FleetLocalControlDeps): FleetLocalRemovalResult;
 export declare function authenticateFleetLocalBot(input: FleetLocalAuthInput, deps?: FleetLocalControlDeps): FleetLocalAuthResult;
-export declare function writeFleetLocalProfile(input: FleetLocalProfileInput, deps?: Pick<FleetLocalBootstrapDeps, "fleetHome" | "platform">): string;
+export declare function writeFleetLocalProfile(input: FleetLocalProfileInput, deps?: FleetLocalProfileDeps): string;
 /** The runtime's inbox plugin sends the intro and runs the kickoff once, then stamps this file. */
 export declare function writeFleetLocalFirstStart(profileDir: string, firstStart: {
     intro?: string;
@@ -167,7 +171,7 @@ export declare function refreshFleetLocalInstructions(agentUid: string, systemPr
 /** Moves a fresh machine credential into the bot's secure store and deletes the file. */
 export declare function importFleetLocalMachineCredential(agentUid: string, machineCredentials: string, deps?: FleetLocalControlDeps): void;
 export declare function bootstrapFleetLocalBot(input: FleetLocalProfileInput & {
-    machineCredentials: string;
+    machineCredentials?: string;
 }, deps?: FleetLocalBootstrapDeps): Promise<FleetLocalBootstrapResult>;
 export {};
 //# sourceMappingURL=fleet-local.d.ts.map

package/dist/lib/bot/fleet-local.js

@@ -4,6 +4,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { HQ_FLEET_RUNTIME_ENGINE_ID, } from "./config.js";
+import { withBotLock } from "./lock.js";
 import { ensureFleetPython, fleetUvEnv } from "./fleet-python.js";
 import { ensureCognitoToken } from "../../utils/cognito-session.js";
 import { vaultApiFetch } from "../../utils/vault-api.js";
@@ -35,18 +36,18 @@ export function fleetProviderNeedsSignIn(provider) {
 }
 export const HQ_FLEET_LOCAL_RELEASE = {
     repository: "indigoai-us/hq-fleet-local",
-    tag: "v0.4.13",
-    version: "0.4.13",
-    artifact: "hq-fleet-local-0.4.13.zip",
-    artifactSha256: "81b129ac129578240af9091b06ae190f47f6be38ff933b35ae5459d5b78c72df",
+    tag: "v0.4.14",
+    version: "0.4.14",
+    artifact: "hq-fleet-local-0.4.14.zip",
+    artifactSha256: "9ff6ad4f7235988468e1913008c5650f5d064210078d6d20c407b17120310f47",
     runtimeArtifact: "hq-fleet-runtime-abccac13bd9e.tar",
     runtimeArtifactSha256: "29bcfe718ad7fbd3636afd00623772f2a25bc84c4f6f10d8d57f38e549d528d5",
-    manifestSha256: "42654f91264099ce173ce3a9f42e207f566e1412ea4b550dc21775d764327bbb",
-    signatureSha256: "93cf9b0a94d75c532454243e3391e421e2743f59f8e65989a5a56ec9152e2fa4",
+    manifestSha256: "88e71a733a5f57089764cbf9947fb88025c2263c5f3d62a2c6f5ab3635538871",
+    signatureSha256: "b892b54d6fcb2aaca86d049d7662fe5549a250d81877d6c529288e79ae1565d9",
     runtimeCommit: "abccac13bd9ea593b24c8cd9c0ba28d5c6050cc9",
 };
 export const HQ_FLEET_LOCAL_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAbYvc1pwOmiCUPJv8yIa3E9RXfniFA84nH2+ROmLMGZU=
+MCowBQYDK2VwAyEARXr2I8RNcw2c0Ep77XkYGwylresXBFn8dm9pxN2Zq/U=
 -----END PUBLIC KEY-----
 `;
 function digest(value) {
@@ -162,7 +163,7 @@ function trustedReleaseLink(url) {
         return false;
     }
 }
-async function downloadFleetLocalReleaseFromHq(release, fetcher, links) {
+async function downloadFleetLocalReleaseFromHq(release, fetcher, links, cachedRuntime) {
     const get = async (name, timeoutMs) => {
         const url = links.get(name);
         if (!url)
@@ -178,7 +179,7 @@ async function downloadFleetLocalReleaseFromHq(release, fetcher, links) {
     };
     const [archive, runtimeArchive, manifest, signature] = await Promise.all([
         get(release.artifact, FLEET_LOCAL_ARCHIVE_DOWNLOAD_TIMEOUT_MS),
-        get(release.runtimeArtifact, FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS),
+        cachedRuntime ?? get(release.runtimeArtifact, FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS),
         get("release-manifest.json", FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
         get("release-manifest.sig", FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
     ]);
@@ -193,7 +194,7 @@ async function responseBytes(response, label) {
 export const FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS = 30_000;
 export const FLEET_LOCAL_ARCHIVE_DOWNLOAD_TIMEOUT_MS = 5 * 60_000;
 export const FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS = 20 * 60_000;
-async function downloadFleetLocalRelease(release, fetcher, token) {
+async function downloadFleetLocalRelease(release, fetcher, token, cachedRuntime) {
     const headers = {
         Accept: "application/vnd.github+json",
         Authorization: `Bearer ${token}`,
@@ -223,7 +224,7 @@ async function downloadFleetLocalRelease(release, fetcher, token) {
     };
     const [archive, runtimeArchive, manifest, signature] = await Promise.all([
         get(release.artifact, FLEET_LOCAL_ARCHIVE_DOWNLOAD_TIMEOUT_MS),
-        get(release.runtimeArtifact, FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS),
+        cachedRuntime ?? get(release.runtimeArtifact, FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS),
         get("release-manifest.json", FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
         get("release-manifest.sig", FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
     ]);
@@ -274,6 +275,24 @@ function installFiles(target, files, release, publicKey) {
             fs.rmSync(staging, { recursive: true, force: true });
     }
 }
+function cachedRuntimeArchive(root, release) {
+    const distributions = path.join(root, "distributions", "hq-fleet-local");
+    if (!fs.existsSync(distributions))
+        return null;
+    for (const entry of fs.readdirSync(distributions, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith("."))
+            continue;
+        const directory = path.join(distributions, entry.name);
+        for (const file of fs.readdirSync(directory, { withFileTypes: true })) {
+            if (!file.isFile() || !file.name.startsWith("hq-fleet-runtime-") || !file.name.endsWith(".tar"))
+                continue;
+            const bytes = fs.readFileSync(path.join(directory, file.name));
+            if (digest(bytes) === release.runtimeArtifactSha256)
+                return bytes;
+        }
+    }
+    return null;
+}
 export async function installPinnedFleetLocalDistribution(deps = {}) {
     const release = deps.release ?? HQ_FLEET_LOCAL_RELEASE;
     const publicKey = deps.publicKey ?? HQ_FLEET_LOCAL_PUBLIC_KEY;
@@ -286,9 +305,10 @@ export async function installPinnedFleetLocalDistribution(deps = {}) {
     else {
         const fetcher = deps.fetch ?? fetch;
         const links = await (deps.hqReleaseLinks ?? fetchHqFleetReleaseLinks)(release);
+        const cachedRuntime = cachedRuntimeArchive(root, release);
         const files = links
-            ? await downloadFleetLocalReleaseFromHq(release, fetcher, links)
-            : await downloadFleetLocalRelease(release, fetcher, (deps.token ?? resolveFleetReleaseToken)());
+            ? await downloadFleetLocalReleaseFromHq(release, fetcher, links, cachedRuntime)
+            : await downloadFleetLocalRelease(release, fetcher, (deps.token ?? resolveFleetReleaseToken)(), cachedRuntime);
         verifyFleetLocalRelease(files, release, publicKey);
         installFiles(dir, files, release, publicKey);
     }
@@ -302,14 +322,83 @@ export async function installPinnedFleetLocalDistribution(deps = {}) {
         engine: engineMetadata(release),
     };
 }
+function profileName(agentUid) {
+    return agentUid.toLowerCase();
+}
 function profileRoot(agentUid, root) {
-    return path.join(root, "profiles", agentUid);
+    const profiles = path.join(root, "profiles");
+    const canonicalName = profileName(agentUid);
+    const canonical = path.join(profiles, canonicalName);
+    if (fs.existsSync(canonical))
+        return canonical;
+    try {
+        const legacy = fs.readdirSync(profiles, { withFileTypes: true })
+            .find((entry) => entry.isDirectory() && entry.name.toLowerCase() === canonicalName);
+        return legacy ? path.join(profiles, legacy.name) : canonical;
+    }
+    catch {
+        return canonical;
+    }
+}
+function adoptLegacyProfileDirectory(agentUid, root) {
+    const profiles = path.join(root, "profiles");
+    const canonicalName = profileName(agentUid);
+    fs.mkdirSync(profiles, { recursive: true, mode: 0o700 });
+    const matches = fs.readdirSync(profiles, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() && entry.name.toLowerCase() === canonicalName)
+        .map((entry) => entry.name);
+    if (matches.length > 1) {
+        throw expectedError(`HQ Fleet has conflicting profile directories for ${agentUid}.`);
+    }
+    const existing = matches[0];
+    const canonical = path.join(profiles, canonicalName);
+    if (!existing || existing === canonicalName)
+        return canonical;
+    const source = path.join(profiles, existing);
+    const temporary = path.join(profiles, `.adopt-${canonicalName}-${process.pid}-${crypto.randomUUID()}`);
+    fs.renameSync(source, temporary);
+    try {
+        fs.renameSync(temporary, canonical);
+    }
+    catch (error) {
+        fs.renameSync(temporary, source);
+        throw error;
+    }
+    return canonical;
 }
 function venvExecutable(runtimeDir, name, platform) {
     return platform === "win32"
         ? path.join(runtimeDir, "Scripts", `${name}.exe`)
         : path.join(runtimeDir, "bin", name);
 }
+function sharedRuntimeFromMarker(profileDir, root) {
+    try {
+        const marker = JSON.parse(fs.readFileSync(path.join(profileDir, "bootstrap.json"), "utf8"));
+        if (marker.schemaVersion !== 2 || typeof marker.runtimeId !== "string" || !/^[a-f0-9]{64}$/.test(marker.runtimeId))
+            return null;
+        const sharedRoot = path.join(root, "runtimes", marker.runtimeId);
+        return {
+            id: marker.runtimeId,
+            root: sharedRoot,
+            runtimeDir: path.join(sharedRoot, "runtime"),
+            sourcesDir: path.join(sharedRoot, "sources"),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function hasEmbeddedRuntime(profileDir, platform) {
+    const runtimeDir = path.join(profileDir, "runtime");
+    try {
+        if (fs.lstatSync(runtimeDir).isSymbolicLink())
+            return true;
+    }
+    catch {
+        return false;
+    }
+    return ["hq-fleet", "hq-fleet-local"].some((name) => fs.existsSync(venvExecutable(runtimeDir, name, platform)));
+}
 function fleetLocalExecutables(agentUid, deps) {
     if (!/^agt_[A-Za-z0-9_-]+$/.test(agentUid)) {
         throw expectedError(`Cannot use an HQ Fleet profile for invalid bot id ${agentUid}.`);
@@ -317,14 +406,16 @@ function fleetLocalExecutables(agentUid, deps) {
     const root = deps.fleetHome ?? fleetHome();
     const platform = deps.platform ?? process.platform;
     const profileDir = profileRoot(agentUid, root);
-    const runtimeDir = path.join(profileDir, "runtime");
+    const shared = sharedRuntimeFromMarker(profileDir, root);
+    const runtimeDir = shared?.runtimeDir ?? path.join(profileDir, "runtime");
+    const sourcesDir = shared?.sourcesDir ?? path.join(profileDir, "sources");
     const profile = path.join(profileDir, "profile.json");
     const runtime = venvExecutable(runtimeDir, "hq-fleet", platform);
     const helper = venvExecutable(runtimeDir, "hq-fleet-local", platform);
     if (![profile, runtime, helper].every((item) => fs.existsSync(item))) {
         throw expectedError(`HQ Fleet Local is not fully installed for ${agentUid}.`);
     }
-    return { profileDir, profile, runtime, helper };
+    return { profileDir, profile, runtime, helper, runtimeDir, sourcesDir };
 }
 function runJson(run, executable, args, options, label) {
     let output;
@@ -357,10 +448,39 @@ export function fleetLocalGatewayPid(agentUid, deps = {}) {
         return null;
     }
 }
+export function fleetLocalProfileNeedsAdoption(agentUid, deps = {}) {
+    if (!/^agt_[A-Za-z0-9_-]+$/.test(agentUid))
+        return true;
+    const root = deps.fleetHome ?? fleetHome();
+    const profiles = path.join(root, "profiles");
+    const canonicalName = profileName(agentUid);
+    let entries;
+    try {
+        entries = fs.readdirSync(profiles);
+    }
+    catch {
+        return true;
+    }
+    if (!entries.includes(canonicalName))
+        return true;
+    const profileDir = path.join(profiles, canonicalName);
+    const shared = sharedRuntimeFromMarker(profileDir, root);
+    if (!shared)
+        return true;
+    const platform = deps.platform ?? process.platform;
+    if (!["hq-fleet", "hq-fleet-local", "python"].every((name) => fs.existsSync(venvExecutable(shared.runtimeDir, name, platform))))
+        return true;
+    if (hasEmbeddedRuntime(profileDir, platform) || fs.existsSync(path.join(profileDir, "sources")))
+        return true;
+    return false;
+}
 export function controlFleetLocalBot(agentUid, action, deps = {}) {
     const run = deps.run ?? execFileSync;
     const files = fleetLocalExecutables(agentUid, deps);
-    return runJson(run, files.helper, ["service", action, "--profile", files.profileDir, "--runtime", files.runtime], { stdio: ["ignore", "pipe", "pipe"] }, `service ${action}`);
+    const result = runJson(run, files.helper, ["service", action, "--profile", files.profileDir, "--runtime", files.runtime], { stdio: ["ignore", "pipe", "pipe"] }, `service ${action}`);
+    if (action === "install" && result.ok === true)
+        removeEmbeddedRuntime(files.profileDir, deps.platform ?? process.platform);
+    return result;
 }
 const providerProfiles = {
     chatgpt: {
@@ -491,14 +611,15 @@ export function removeFleetLocalBot(agentUid, deps = {}) {
     const profileDir = profileRoot(agentUid, deps.fleetHome ?? fleetHome());
     if (!fs.existsSync(profileDir))
         return { removed: false, credentialsRemoved: 0 };
+    if (!fs.existsSync(path.join(profileDir, "profile.json"))) {
+        fs.rmSync(profileDir, { recursive: true, force: true });
+        return { removed: true, credentialsRemoved: 0 };
+    }
     const platform = deps.platform ?? process.platform;
-    const runtimeDir = path.join(profileDir, "runtime");
-    const partial = ![
-        path.join(profileDir, "profile.json"),
-        venvExecutable(runtimeDir, "hq-fleet", platform),
-        venvExecutable(runtimeDir, "hq-fleet-local", platform),
-    ].every((item) => fs.existsSync(item));
-    if (partial) {
+    const legacyRuntime = path.join(profileDir, "runtime");
+    const shared = sharedRuntimeFromMarker(profileDir, deps.fleetHome ?? fleetHome());
+    const installedRuntime = shared?.runtimeDir ?? legacyRuntime;
+    if (!["hq-fleet", "hq-fleet-local"].every((name) => fs.existsSync(venvExecutable(installedRuntime, name, platform)))) {
         fs.rmSync(profileDir, { recursive: true, force: true });
         return { removed: true, credentialsRemoved: 0 };
     }
@@ -614,7 +735,9 @@ export function writeFleetLocalProfile(input, deps = {}) {
     }
     const root = deps.fleetHome ?? fleetHome();
     const dir = profileRoot(input.agentUid, root);
-    const runtimeDir = path.join(dir, "runtime");
+    const markerRuntime = sharedRuntimeFromMarker(dir, root);
+    const runtimeRoot = deps.runtimeRoot ?? markerRuntime?.root ?? dir;
+    const runtimeDir = path.join(runtimeRoot, "runtime");
     const destination = path.join(dir, "profile.json");
     const temporary = path.join(dir, `.profile-${process.pid}-${crypto.randomUUID()}`);
     const profile = {
@@ -627,7 +750,7 @@ export function writeFleetLocalProfile(input, deps = {}) {
         profileDir: path.resolve(dir),
         runtime: { commit: input.installation.release.runtimeCommit, path: path.resolve(runtimeDir) },
         paths: {
-            pluginSource: path.resolve(path.join(dir, "sources", "distribution", "src", "hq_fleet_local", "plugins", "hqdm")),
+            pluginSource: path.resolve(path.join(runtimeRoot, "sources", "distribution", "src", "hq_fleet_local", "plugins", "hqdm")),
             statusFile: path.resolve(path.join(input.botDir, "status.json")),
             logsDir: path.resolve(path.join(input.botDir, "logs")),
         },
@@ -686,9 +809,13 @@ export function scanFleetLocalInstructions(agentUid, text, deps = {}) {
         throw expectedError(`Cannot use an HQ Fleet profile for invalid bot id ${agentUid}.`);
     }
     const run = deps.run ?? execFileSync;
-    const profileDir = profileRoot(agentUid, deps.fleetHome ?? fleetHome());
-    const python = venvExecutable(path.join(profileDir, "runtime"), "python", deps.platform ?? process.platform);
-    const source = path.join(profileDir, "sources", "runtime");
+    const root = deps.fleetHome ?? fleetHome();
+    const profileDir = profileRoot(agentUid, root);
+    const shared = sharedRuntimeFromMarker(profileDir, root);
+    const runtimeDir = shared?.runtimeDir ?? path.join(profileDir, "runtime");
+    const sourcesDir = shared?.sourcesDir ?? path.join(profileDir, "sources");
+    const python = venvExecutable(runtimeDir, "python", deps.platform ?? process.platform);
+    const source = path.join(sourcesDir, "runtime");
     if (!fs.existsSync(python) || !fs.existsSync(source)) {
         throw expectedError("HQ Fleet Local is not installed for this bot, so its instructions could not be checked.");
     }
@@ -744,21 +871,36 @@ export function importFleetLocalMachineCredential(agentUid, machineCredentials,
     ], { input: machineValue, stdio: ["pipe", "ignore", "pipe"] }, "machine credential import");
     fs.rmSync(machineCredentials, { force: true });
 }
-export async function bootstrapFleetLocalBot(input, deps = {}) {
-    const run = deps.run ?? execFileSync;
-    const platform = deps.platform ?? process.platform;
-    const root = deps.fleetHome ?? fleetHome();
-    const python = deps.python ?? await ensureFleetPython({ fleetHome: root, platform, run });
-    const profileDir = profileRoot(input.agentUid, root);
-    const sources = path.join(profileDir, "sources");
-    const distributionSource = path.join(sources, "distribution");
-    const runtimeSource = path.join(sources, "runtime");
-    const runtimeDir = path.join(profileDir, "runtime");
-    const marker = path.join(profileDir, "bootstrap.json");
-    fs.mkdirSync(profileDir, { recursive: true, mode: 0o700 });
-    if (!fs.existsSync(marker)) {
-        fs.rmSync(sources, { recursive: true, force: true });
-        fs.rmSync(runtimeDir, { recursive: true, force: true });
+async function installSharedFleetRuntime(installation, root, python, platform, run) {
+    const identity = digest(Buffer.from(JSON.stringify({
+        version: installation.release.version,
+        distribution: installation.release.artifactSha256,
+        runtime: installation.release.runtimeArtifactSha256,
+        python: python.python,
+        platform,
+        extras: ["mcp", "anthropic"],
+    })));
+    const shared = path.join(root, "runtimes", identity);
+    const descriptor = () => ({
+        id: identity,
+        root: shared,
+        runtimeDir: path.join(shared, "runtime"),
+        sourcesDir: path.join(shared, "sources"),
+    });
+    return withBotLock(identity, async () => {
+        const marker = path.join(shared, "ready.json");
+        const sources = path.join(shared, "sources");
+        const distributionSource = path.join(sources, "distribution");
+        const runtimeSource = path.join(sources, "runtime");
+        const runtimeDir = path.join(shared, "runtime");
+        const executables = ["python", "hq-fleet", "hq-fleet-local"];
+        if (fs.existsSync(marker)) {
+            if (!executables.every((name) => fs.existsSync(venvExecutable(runtimeDir, name, platform)))) {
+                throw expectedError("The shared HQ Fleet Runtime is incomplete. Reinstall it before creating another bot.");
+            }
+            return descriptor();
+        }
+        fs.rmSync(shared, { recursive: true, force: true });
         fs.mkdirSync(distributionSource, { recursive: true, mode: 0o700 });
         fs.mkdirSync(runtimeSource, { recursive: true, mode: 0o700 });
         const uvEnv = fleetUvEnv(python.pythonDir);
@@ -766,14 +908,14 @@ export async function bootstrapFleetLocalBot(input, deps = {}) {
             "-m",
             "zipfile",
             "-e",
-            input.installation.archive,
+            installation.archive,
             distributionSource,
         ], { stdio: "ignore" }, "distribution extraction");
         checkedRun(run, python.python, [
             "-m",
             "tarfile",
             "-e",
-            input.installation.runtimeArchive,
+            installation.runtimeArchive,
             runtimeSource,
         ], { stdio: "ignore" }, "runtime extraction");
         checkedRun(run, python.uv, [
@@ -794,35 +936,63 @@ export async function bootstrapFleetLocalBot(input, deps = {}) {
             `${runtimeSource}[mcp,anthropic]`,
             distributionSource,
         ], { stdio: ["ignore", 2, 2], env: uvEnv }, "package installation");
-        fs.writeFileSync(marker, `${JSON.stringify({ schemaVersion: 1, engine: input.installation.engine }, null, 2)}\n`, { mode: 0o600 });
-    }
-    const { systemPrompt, ...profileInput } = input;
+        if (!executables.every((name) => fs.existsSync(venvExecutable(runtimeDir, name, platform)))) {
+            throw expectedError("HQ Fleet Local installed without its runtime executables.");
+        }
+        fs.writeFileSync(marker, `${JSON.stringify({ schemaVersion: 1, engine: installation.engine })}\n`, { mode: 0o600 });
+        return descriptor();
+    }, { root: path.join(root, "runtimes"), command: "HQ Fleet Runtime installation", waitMs: 20 * 60_000, staleMs: 2 * 60 * 60_000 });
+}
+function writeNativeProfileMarker(profileDir, shared, engine) {
+    const marker = path.join(profileDir, "bootstrap.json");
+    const temporary = `${marker}.${process.pid}.${crypto.randomUUID()}`;
+    fs.writeFileSync(temporary, `${JSON.stringify({ schemaVersion: 2, runtimeId: shared.id, engine }, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(temporary, marker);
+}
+function removeEmbeddedRuntime(profileDir, platform = process.platform) {
+    fs.rmSync(path.join(profileDir, "sources"), { recursive: true, force: true });
+    if (hasEmbeddedRuntime(profileDir, platform))
+        fs.rmSync(path.join(profileDir, "runtime"), { recursive: true, force: true });
+}
+export async function bootstrapFleetLocalBot(input, deps = {}) {
+    const run = deps.run ?? execFileSync;
+    const platform = deps.platform ?? process.platform;
+    const root = deps.fleetHome ?? fleetHome();
+    const python = deps.python ?? await ensureFleetPython({ fleetHome: root, platform, run });
+    const profileDir = adoptLegacyProfileDirectory(input.agentUid, root);
+    fs.mkdirSync(profileDir, { recursive: true, mode: 0o700 });
+    const shared = await installSharedFleetRuntime(input.installation, root, python, platform, run);
+    writeNativeProfileMarker(profileDir, shared, input.installation.engine);
+    const { systemPrompt, machineCredentials, ...profileInput } = input;
     if (systemPrompt !== undefined)
         refreshFleetLocalInstructions(input.agentUid, systemPrompt, { fleetHome: root, platform, run });
-    const profile = writeFleetLocalProfile(profileInput, { fleetHome: root, platform });
-    const helper = venvExecutable(runtimeDir, "hq-fleet-local", platform);
-    const runtime = venvExecutable(runtimeDir, "hq-fleet", platform);
+    const profile = writeFleetLocalProfile(profileInput, { fleetHome: root, platform, runtimeRoot: shared.root });
+    const helper = venvExecutable(shared.runtimeDir, "hq-fleet-local", platform);
+    const runtime = venvExecutable(shared.runtimeDir, "hq-fleet", platform);
     if (!fs.existsSync(helper) || !fs.existsSync(runtime)) {
         throw expectedError("HQ Fleet Local installed without its runtime executables.");
     }
     checkedRun(run, helper, ["render-profile", "--spec", profile, "--mode", "create"], { stdio: "ignore" }, "profile rendering");
-    const machineValue = fs.readFileSync(input.machineCredentials, "utf8").trim();
-    if (!machineValue) {
-        throw expectedError(`HQ Fleet Local machine credential file is empty: ${input.machineCredentials}`);
+    if (machineCredentials) {
+        const machineValue = fs.readFileSync(machineCredentials, "utf8").trim();
+        if (!machineValue) {
+            throw expectedError(`HQ Fleet Local machine credential file is empty: ${machineCredentials}`);
+        }
+        checkedRun(run, helper, [
+            "machine-credential",
+            "import",
+            "--profile",
+            profileDir,
+            "--bot-id",
+            input.agentUid,
+        ], { input: machineValue, stdio: ["pipe", "ignore", "pipe"] }, "machine credential import");
+        fs.rmSync(machineCredentials, { force: true });
     }
-    checkedRun(run, helper, [
-        "machine-credential",
-        "import",
-        "--profile",
-        profileDir,
-        "--bot-id",
-        input.agentUid,
-    ], { input: machineValue, stdio: ["pipe", "ignore", "pipe"] }, "machine credential import");
-    fs.rmSync(input.machineCredentials, { force: true });
     checkedRun(run, helper, ["doctor-profile", "--profile", profileDir, "--runtime", runtime], { stdio: "ignore" }, "profile validation");
     const start = deps.start !== false;
     if (start) {
         checkedRun(run, helper, ["service", "install", "--profile", profileDir, "--runtime", runtime], { stdio: ["ignore", 2, 2] }, "service installation");
+        removeEmbeddedRuntime(profileDir, platform);
     }
     return { profile, runtime, helper, running: start };
 }

package/dist/lib/bot/run.js

@@ -46,6 +46,7 @@
  *
  * Everything with a side effect is injectable so the loop is unit-testable.
  */
+import { botAuthEnv, describeBotAuth, formatBotAuth } from "./runtime-auth.js";
 import { ownerContextBlock } from "./owner-context.js";
 import { randomUUID } from "node:crypto";
 import { hasPromotionHold } from "./promotion-hold.js";
@@ -558,6 +559,12 @@ export async function runBot(deps) {
     setStatus({ ...fallback(), pid, state: "starting", canDrainForPromotion: false, runtimeSignIn: null, cliVersion });
     log("info", `starting ${config.name} on hq-cli ${cliVersion} (${config.runtime}, ${kind} bot${companies.length ? ` of ${companies.join(", ")}` : ""}) as ${config.agentUid} for ${config.ownerUid}`);
     log("info", `${runtime.id} binary: ${describeRuntimeBinary(runtime, turnEnv(process.env, kind, config.agentUid, companySlug), turnCwd)}`);
+    {
+        const login = describeBotAuth(dir, config);
+        log("info", `${runtime.id} login: ${formatBotAuth(login, config.name)}`);
+        if (login.login === "own" && !login.present)
+            setStatus({ lastError: `own ${runtime.id} login missing: run hq bot login ${config.name} --runtime ${runtime.id}` });
+    }
     deps.cliUpdate?.startup(log);
     try {
         const record = await api.getAgent(config.agentUid);
@@ -1048,7 +1055,15 @@ export async function runBot(deps) {
             // resets). Claude gets the full hook set via its payload session id;
             // Codex/Grok only see HQ_SESSION_ID.
             const sid = session?.sessionId ?? randomUUID();
-            const env = withOsUser(turnEnv(process.env, kind, config.agentUid, companySlug));
+            let env;
+            try {
+                // The bot's own login or account, when set. A missing one fails the
+                // turn loudly (status + reply); it never falls back to the owner's login.
+                env = withOsUser(botAuthEnv(dir, { ...live, runtime: config.runtime }, turnEnv(process.env, kind, config.agentUid, companySlug)));
+            }
+            catch (err) {
+                throw new CompanyBindingError(`I can't answer yet: ${err instanceof Error ? err.message : String(err)} I did not use anyone else's login; this work is still pending.`);
+            }
             let bind = { env };
             if (companySlug) {
                 try {
@@ -1941,7 +1956,29 @@ export async function runBot(deps) {
             // The job's stored company is checked against the bot's current config
             // (read fresh from disk) every time it fires. A company the bot no longer
             // serves is never synced: the run is skipped and the job removed.
-            const currentCompany = currentHotSignalSyncCompany(readBotConfig(dir) ?? config);
+            const freshConfig = readBotConfig(dir);
+            if (!freshConfig) {
+                // bot.json is missing or unreadable, so which company the bot serves is
+                // unknown. Skip this run without writing anything; the job stays for the
+                // next fire.
+                const text = `Skipped the hot-channel sync for ${syncCompany}: the bot's config (bot.json) could not be read, so nothing was written. The job will try again at its next run.`;
+                markProcessed(dir, id, now().toISOString());
+                try {
+                    await sendToPerson(text);
+                }
+                catch (err) {
+                    log("warn", `report for run ${id} of job ${jobId} was not delivered: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                await completeJobRun(jobId, id, { status: "skipped-precondition", output: jobRunOutput(text) });
+                markReported("skipped-precondition");
+                await api.ackInbox(config.agentUid, id);
+                clearInflight(dir, id);
+                attempts.delete(id);
+                setStatus({ lastActivityAt: now().toISOString() });
+                log("warn", `hot-signal-sync job ${jobId} run ${id} skipped: bot.json missing or unreadable`);
+                return;
+            }
+            const currentCompany = currentHotSignalSyncCompany(freshConfig);
             if (currentCompany !== syncCompany) {
                 let removedNote = "";
                 try {