@indigoai-us/hq-cli 5.345.180 → 5.345.181

package/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## [Unreleased]
 
+## [5.345.181] — 2026-10-30
+- Local personal and company bots now share one HQ Fleet runtime installation while keeping isolated native profiles and gateway services. Existing local Fleet bots migrate in place without losing profile state.
+
 ## [5.345.180] — 2026-10-30
 - New `hq channels add <channel> <member...>` and `hq channels remove <channel> <member>`. An owner can now add a personal bot (or a teammate) to a channel from the CLI by @handle, email, or prs_/agt_ uid, so everyone in the channel can @mention it. Before this there was no verb for it, and posting "@bot" into the channel was refused with "No channel member matches". The server's join-first refusal and the owner-or-company-admin rule for adding and removing members are explained in plain words. Feedback e165b286-b059-4d5c-bd44-ac344f00c821.
 - A local bot can now have a model login of its own, so it no longer has to use yours. `hq bot login <name> [--runtime claude|codex]` runs the runtime's own sign-in into `~/.hq/bots/<name>/auth/<runtime>/` (`CLAUDE_CONFIG_DIR` or `CODEX_HOME`). `hq bot logout <name>` signs that login out and deletes the folder. `hq bot set <name> --account <id|default>` points the bot at an existing `hq capacity` account instead. Every model turn uses the chosen login. When that login is missing or its account is gone, the turn does not fall back to your login: the bot replies in the DM saying so, keeps the message pending, and `hq bot status` shows the problem. `hq bot status` now has a `login:` line (default, own, or the account name) and never shows a token.

package/dist/commands/bot.js

@@ -57,7 +57,7 @@ import { runtimeDisplayName, signInCommand } from "../lib/bot/runtime-sign-in.js
 import { classifyRuntimeFailure, runtimeFailureReason } from "../lib/bot/runtime-failure.js";
 import { PROBE_DEFAULT_TIMEOUT_MS, probeBotRuntime } from "../lib/bot/probe.js";
 import { BOT_LOGIN_RUNTIMES, botAuthEnv, botRuntimeAuth, capacityAccountHome, describeBotAuth, formatBotAuth, isBotLoginRuntime, restoreBotSessions, setAsideBotSessions, signInBotRuntime, signOutBotRuntime, withRuntimeAuth, } from "../lib/bot/runtime-auth.js";
-import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, fleetProviderForRuntime, importFleetLocalMachineCredential, fleetProviderNeedsSignIn, fleetDefaultCompanies, fleetOwnerCompanies, fleetRuntimeIsDefault, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
+import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, fleetLocalProfileNeedsAdoption, fleetProviderForRuntime, importFleetLocalMachineCredential, fleetProviderNeedsSignIn, fleetDefaultCompanies, fleetOwnerCompanies, fleetRuntimeIsDefault, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
 function collectRepeated(value, previous) {
     return [...previous, value];
 }
@@ -153,7 +153,7 @@ function fleetAuthCommand(name, config) {
     return `hq bot auth ${name} --provider ${config.runtime === "grok" ? "grok" : config.runtime === "codex" ? "chatgpt" : "claude"}`;
 }
 function runFleetRuntimeControl(name, config, action, json) {
-    if ((action === "start" || action === "restart") && config.fleetAuthPending === true) {
+    if ((action === "install" || action === "start" || action === "restart") && config.fleetAuthPending === true) {
         const authCommand = fleetAuthCommand(name, config);
         if (json)
             console.log(JSON.stringify({ ok: false, name, running: false, state: "stopped", needsSignIn: true, authCommand }, null, 2));
@@ -161,10 +161,10 @@ function runFleetRuntimeControl(name, config, action, json) {
             throw Object.assign(new Error(`Sign this bot in first: ${authCommand}`), { expected: true });
         return;
     }
-    if (action === "start" || action === "restart") {
+    if (action === "install" || action === "start" || action === "restart") {
         refreshFleetLocalInstructions(config.agentUid, fleetBotSystemPrompt(name, config));
     }
-    const installService = config.fleetServiceInstallPending === true && (action === "start" || action === "restart");
+    const installService = action === "install" || (config.fleetServiceInstallPending === true && (action === "start" || action === "restart"));
     const result = controlFleetLocalBot(config.agentUid, installService ? "install" : action);
     if (installService && result.ok)
         patchBotConfig(botDir(name), { fleetServiceInstallPending: false, enabled: true });
@@ -434,10 +434,11 @@ async function startFleetRuntimeBot(name, dir, config, output, extra) {
             throw Object.assign(new Error(`Sign this bot in first: ${authCommand}`), { expected: true });
         return { running: false, how: "waiting for sign-in" };
     }
+    const adopted = await adoptFleetRuntimeProfile(name, dir, config);
     refreshFleetLocalInstructions(config.agentUid, fleetBotSystemPrompt(name, config));
     const before = readBotStatus(dir);
     const alreadyRunning = !!before && before.state === "running" && isPidAlive(before.pid);
-    const installService = config.fleetServiceInstallPending === true;
+    const installService = adopted || config.fleetServiceInstallPending === true;
     const result = controlFleetLocalBot(config.agentUid, installService ? "install" : alreadyRunning ? "restart" : "start");
     if (installService && result.ok)
         patchBotConfig(dir, { fleetServiceInstallPending: false, enabled: true });
@@ -459,6 +460,29 @@ async function startFleetRuntimeBot(name, dir, config, output, extra) {
         console.log(chalk.yellow(`${name} did not report running within 45s`) + chalk.dim(`  logs: ~/.hq-fleet/profiles/${config.agentUid}/logs`));
     return { running, how };
 }
+async function adoptFleetRuntimeProfile(name, dir, config) {
+    if (!fleetLocalProfileNeedsAdoption(config.agentUid))
+        return false;
+    const installation = await installPinnedFleetLocalDistribution();
+    const python = await ensureFleetPython();
+    const companyScope = effectiveBotKind(config) === "company"
+        ? effectiveBotCompanies(config)
+        : await fleetOwnerCompanies();
+    await bootstrapFleetLocalBot({
+        agentUid: config.agentUid,
+        ownerUid: config.ownerUid,
+        hqRoot: config.hqRoot,
+        botDir: dir,
+        installation,
+        systemPrompt: fleetBotSystemPrompt(name, config),
+        provider: fleetProviderForRuntime(config.runtime, config.model),
+        ownerCompanies: companyScope,
+    }, { python, start: false });
+    const credentials = botCredsPath(dir);
+    if (fs.existsSync(credentials))
+        importFleetLocalMachineCredential(config.agentUid, credentials);
+    return true;
+}
 /**
  * `output`: "json" | "text" print a result; "silent" prints nothing — used
  * when stop is a step inside rm/restart, whose own JSON must be the only
@@ -2073,7 +2097,8 @@ export function botExists(name) {
 export async function runBotRestart(nameArg, opts = {}) {
     const b = requireBot(nameArg);
     if (isFleetRuntimeBot(b.config)) {
-        runFleetRuntimeControl(b.name, b.config, "restart", opts.json === true || opts.output === "json");
+        const adopted = await adoptFleetRuntimeProfile(b.name, b.dir, b.config);
+        runFleetRuntimeControl(b.name, b.config, adopted ? "install" : "restart", opts.json === true || opts.output === "json");
         return;
     }
     const running = readBotStatus(b.dir);
@@ -2094,10 +2119,11 @@ async function runBotAuth(nameArg, opts) {
     if (opts.apiKey && !apiKey) {
         throw Object.assign(new Error("No API key was received on stdin."), { expected: true });
     }
+    const adopted = await adoptFleetRuntimeProfile(b.name, b.dir, b.config);
     const result = authenticateFleetLocalBot({
         agentUid: b.config.agentUid,
         provider: opts.provider,
-        ...(b.config.fleetAuthPending === true ? { installService: true } : {}),
+        ...(adopted || b.config.fleetAuthPending === true ? { installService: true } : {}),
         ...(opts.model ? { model: opts.model } : {}),
         ...(apiKey ? { apiKey } : {}),
         ...(opts.baseUrl ? { baseUrl: opts.baseUrl } : {}),
@@ -2529,8 +2555,9 @@ async function repairLocalBot(name, api, bot, daemon) {
     });
     createBotLogger(dir)("info", `re-issued machine credentials for ${name} (${bot.agentUid}) on ${localMachineId()}`);
     if (isFleetRuntimeBot(config)) {
+        const adopted = await adoptFleetRuntimeProfile(name, dir, config);
         importFleetLocalMachineCredential(bot.agentUid, botCredsPath(dir));
-        const restarted = controlFleetLocalBot(bot.agentUid, "restart").ok === true;
+        const restarted = controlFleetLocalBot(bot.agentUid, adopted ? "install" : "restart").ok === true;
         return restarted ? "new credentials, HQ Fleet Runtime restarted" : "new credentials; the HQ Fleet Runtime did not restart (hq bot start " + name + ")";
     }
     if (daemon && process.platform === "darwin") {
@@ -2782,7 +2809,8 @@ export function registerBotCommand(program) {
         .action((name, opts) => wrap(async () => {
         const b = requireBot(name);
         if (isFleetRuntimeBot(b.config)) {
-            runFleetRuntimeControl(b.name, b.config, "start", opts.json === true);
+            const adopted = await adoptFleetRuntimeProfile(b.name, b.dir, b.config);
+            runFleetRuntimeControl(b.name, b.config, adopted ? "install" : "start", opts.json === true);
             return;
         }
         await startBot(b.name, b.dir, b.config, opts.json ? "json" : "text");

package/dist/lib/bot/fleet-local.d.ts

@@ -99,6 +99,9 @@ export interface FleetLocalBootstrapDeps {
     start?: boolean;
     python?: FleetPython;
 }
+type FleetLocalProfileDeps = Pick<FleetLocalBootstrapDeps, "fleetHome" | "platform"> & {
+    runtimeRoot?: string;
+};
 export interface FleetLocalBootstrapResult {
     profile: string;
     runtime: string;
@@ -144,12 +147,13 @@ export declare const FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS: number;
 export declare function installPinnedFleetLocalDistribution(deps?: FleetLocalInstallDeps): Promise<FleetLocalInstallation>;
 /** The process id the bot's gateway recorded, when its file reads; the caller checks whether it is alive. */
 export declare function fleetLocalGatewayPid(agentUid: string, deps?: Pick<FleetLocalControlDeps, "fleetHome">): number | null;
+export declare function fleetLocalProfileNeedsAdoption(agentUid: string, deps?: Pick<FleetLocalControlDeps, "fleetHome" | "platform">): boolean;
 export declare function controlFleetLocalBot(agentUid: string, action: FleetLocalServiceAction, deps?: FleetLocalControlDeps): Record<string, unknown>;
 export declare function exportFleetLocalMachineCredential(agentUid: string, deps?: FleetLocalControlDeps): BotMachineCreds;
 export declare function fleetLocalPromotionRuntime(agentUid: string, deps?: FleetLocalControlDeps): LocalBotPromotionRuntime;
 export declare function removeFleetLocalBot(agentUid: string, deps?: FleetLocalControlDeps): FleetLocalRemovalResult;
 export declare function authenticateFleetLocalBot(input: FleetLocalAuthInput, deps?: FleetLocalControlDeps): FleetLocalAuthResult;
-export declare function writeFleetLocalProfile(input: FleetLocalProfileInput, deps?: Pick<FleetLocalBootstrapDeps, "fleetHome" | "platform">): string;
+export declare function writeFleetLocalProfile(input: FleetLocalProfileInput, deps?: FleetLocalProfileDeps): string;
 /** The runtime's inbox plugin sends the intro and runs the kickoff once, then stamps this file. */
 export declare function writeFleetLocalFirstStart(profileDir: string, firstStart: {
     intro?: string;
@@ -167,7 +171,7 @@ export declare function refreshFleetLocalInstructions(agentUid: string, systemPr
 /** Moves a fresh machine credential into the bot's secure store and deletes the file. */
 export declare function importFleetLocalMachineCredential(agentUid: string, machineCredentials: string, deps?: FleetLocalControlDeps): void;
 export declare function bootstrapFleetLocalBot(input: FleetLocalProfileInput & {
-    machineCredentials: string;
+    machineCredentials?: string;
 }, deps?: FleetLocalBootstrapDeps): Promise<FleetLocalBootstrapResult>;
 export {};
 //# sourceMappingURL=fleet-local.d.ts.map

package/dist/lib/bot/fleet-local.js

@@ -322,14 +322,83 @@ export async function installPinnedFleetLocalDistribution(deps = {}) {
         engine: engineMetadata(release),
     };
 }
+function profileName(agentUid) {
+    return agentUid.toLowerCase();
+}
 function profileRoot(agentUid, root) {
-    return path.join(root, "profiles", agentUid);
+    const profiles = path.join(root, "profiles");
+    const canonicalName = profileName(agentUid);
+    const canonical = path.join(profiles, canonicalName);
+    if (fs.existsSync(canonical))
+        return canonical;
+    try {
+        const legacy = fs.readdirSync(profiles, { withFileTypes: true })
+            .find((entry) => entry.isDirectory() && entry.name.toLowerCase() === canonicalName);
+        return legacy ? path.join(profiles, legacy.name) : canonical;
+    }
+    catch {
+        return canonical;
+    }
+}
+function adoptLegacyProfileDirectory(agentUid, root) {
+    const profiles = path.join(root, "profiles");
+    const canonicalName = profileName(agentUid);
+    fs.mkdirSync(profiles, { recursive: true, mode: 0o700 });
+    const matches = fs.readdirSync(profiles, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() && entry.name.toLowerCase() === canonicalName)
+        .map((entry) => entry.name);
+    if (matches.length > 1) {
+        throw expectedError(`HQ Fleet has conflicting profile directories for ${agentUid}.`);
+    }
+    const existing = matches[0];
+    const canonical = path.join(profiles, canonicalName);
+    if (!existing || existing === canonicalName)
+        return canonical;
+    const source = path.join(profiles, existing);
+    const temporary = path.join(profiles, `.adopt-${canonicalName}-${process.pid}-${crypto.randomUUID()}`);
+    fs.renameSync(source, temporary);
+    try {
+        fs.renameSync(temporary, canonical);
+    }
+    catch (error) {
+        fs.renameSync(temporary, source);
+        throw error;
+    }
+    return canonical;
 }
 function venvExecutable(runtimeDir, name, platform) {
     return platform === "win32"
         ? path.join(runtimeDir, "Scripts", `${name}.exe`)
         : path.join(runtimeDir, "bin", name);
 }
+function sharedRuntimeFromMarker(profileDir, root) {
+    try {
+        const marker = JSON.parse(fs.readFileSync(path.join(profileDir, "bootstrap.json"), "utf8"));
+        if (marker.schemaVersion !== 2 || typeof marker.runtimeId !== "string" || !/^[a-f0-9]{64}$/.test(marker.runtimeId))
+            return null;
+        const sharedRoot = path.join(root, "runtimes", marker.runtimeId);
+        return {
+            id: marker.runtimeId,
+            root: sharedRoot,
+            runtimeDir: path.join(sharedRoot, "runtime"),
+            sourcesDir: path.join(sharedRoot, "sources"),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function hasEmbeddedRuntime(profileDir, platform) {
+    const runtimeDir = path.join(profileDir, "runtime");
+    try {
+        if (fs.lstatSync(runtimeDir).isSymbolicLink())
+            return true;
+    }
+    catch {
+        return false;
+    }
+    return ["hq-fleet", "hq-fleet-local"].some((name) => fs.existsSync(venvExecutable(runtimeDir, name, platform)));
+}
 function fleetLocalExecutables(agentUid, deps) {
     if (!/^agt_[A-Za-z0-9_-]+$/.test(agentUid)) {
         throw expectedError(`Cannot use an HQ Fleet profile for invalid bot id ${agentUid}.`);
@@ -337,14 +406,16 @@ function fleetLocalExecutables(agentUid, deps) {
     const root = deps.fleetHome ?? fleetHome();
     const platform = deps.platform ?? process.platform;
     const profileDir = profileRoot(agentUid, root);
-    const runtimeDir = path.join(profileDir, "runtime");
+    const shared = sharedRuntimeFromMarker(profileDir, root);
+    const runtimeDir = shared?.runtimeDir ?? path.join(profileDir, "runtime");
+    const sourcesDir = shared?.sourcesDir ?? path.join(profileDir, "sources");
     const profile = path.join(profileDir, "profile.json");
     const runtime = venvExecutable(runtimeDir, "hq-fleet", platform);
     const helper = venvExecutable(runtimeDir, "hq-fleet-local", platform);
     if (![profile, runtime, helper].every((item) => fs.existsSync(item))) {
         throw expectedError(`HQ Fleet Local is not fully installed for ${agentUid}.`);
     }
-    return { profileDir, profile, runtime, helper };
+    return { profileDir, profile, runtime, helper, runtimeDir, sourcesDir };
 }
 function runJson(run, executable, args, options, label) {
     let output;
@@ -377,10 +448,39 @@ export function fleetLocalGatewayPid(agentUid, deps = {}) {
         return null;
     }
 }
+export function fleetLocalProfileNeedsAdoption(agentUid, deps = {}) {
+    if (!/^agt_[A-Za-z0-9_-]+$/.test(agentUid))
+        return true;
+    const root = deps.fleetHome ?? fleetHome();
+    const profiles = path.join(root, "profiles");
+    const canonicalName = profileName(agentUid);
+    let entries;
+    try {
+        entries = fs.readdirSync(profiles);
+    }
+    catch {
+        return true;
+    }
+    if (!entries.includes(canonicalName))
+        return true;
+    const profileDir = path.join(profiles, canonicalName);
+    const shared = sharedRuntimeFromMarker(profileDir, root);
+    if (!shared)
+        return true;
+    const platform = deps.platform ?? process.platform;
+    if (!["hq-fleet", "hq-fleet-local", "python"].every((name) => fs.existsSync(venvExecutable(shared.runtimeDir, name, platform))))
+        return true;
+    if (hasEmbeddedRuntime(profileDir, platform) || fs.existsSync(path.join(profileDir, "sources")))
+        return true;
+    return false;
+}
 export function controlFleetLocalBot(agentUid, action, deps = {}) {
     const run = deps.run ?? execFileSync;
     const files = fleetLocalExecutables(agentUid, deps);
-    return runJson(run, files.helper, ["service", action, "--profile", files.profileDir, "--runtime", files.runtime], { stdio: ["ignore", "pipe", "pipe"] }, `service ${action}`);
+    const result = runJson(run, files.helper, ["service", action, "--profile", files.profileDir, "--runtime", files.runtime], { stdio: ["ignore", "pipe", "pipe"] }, `service ${action}`);
+    if (action === "install" && result.ok === true)
+        removeEmbeddedRuntime(files.profileDir, deps.platform ?? process.platform);
+    return result;
 }
 const providerProfiles = {
     chatgpt: {
@@ -511,14 +611,15 @@ export function removeFleetLocalBot(agentUid, deps = {}) {
     const profileDir = profileRoot(agentUid, deps.fleetHome ?? fleetHome());
     if (!fs.existsSync(profileDir))
         return { removed: false, credentialsRemoved: 0 };
+    if (!fs.existsSync(path.join(profileDir, "profile.json"))) {
+        fs.rmSync(profileDir, { recursive: true, force: true });
+        return { removed: true, credentialsRemoved: 0 };
+    }
     const platform = deps.platform ?? process.platform;
-    const runtimeDir = path.join(profileDir, "runtime");
-    const partial = ![
-        path.join(profileDir, "profile.json"),
-        venvExecutable(runtimeDir, "hq-fleet", platform),
-        venvExecutable(runtimeDir, "hq-fleet-local", platform),
-    ].every((item) => fs.existsSync(item));
-    if (partial) {
+    const legacyRuntime = path.join(profileDir, "runtime");
+    const shared = sharedRuntimeFromMarker(profileDir, deps.fleetHome ?? fleetHome());
+    const installedRuntime = shared?.runtimeDir ?? legacyRuntime;
+    if (!["hq-fleet", "hq-fleet-local"].every((name) => fs.existsSync(venvExecutable(installedRuntime, name, platform)))) {
         fs.rmSync(profileDir, { recursive: true, force: true });
         return { removed: true, credentialsRemoved: 0 };
     }
@@ -634,7 +735,9 @@ export function writeFleetLocalProfile(input, deps = {}) {
     }
     const root = deps.fleetHome ?? fleetHome();
     const dir = profileRoot(input.agentUid, root);
-    const runtimeDir = path.join(dir, "runtime");
+    const markerRuntime = sharedRuntimeFromMarker(dir, root);
+    const runtimeRoot = deps.runtimeRoot ?? markerRuntime?.root ?? dir;
+    const runtimeDir = path.join(runtimeRoot, "runtime");
     const destination = path.join(dir, "profile.json");
     const temporary = path.join(dir, `.profile-${process.pid}-${crypto.randomUUID()}`);
     const profile = {
@@ -647,7 +750,7 @@ export function writeFleetLocalProfile(input, deps = {}) {
         profileDir: path.resolve(dir),
         runtime: { commit: input.installation.release.runtimeCommit, path: path.resolve(runtimeDir) },
         paths: {
-            pluginSource: path.resolve(path.join(dir, "sources", "distribution", "src", "hq_fleet_local", "plugins", "hqdm")),
+            pluginSource: path.resolve(path.join(runtimeRoot, "sources", "distribution", "src", "hq_fleet_local", "plugins", "hqdm")),
             statusFile: path.resolve(path.join(input.botDir, "status.json")),
             logsDir: path.resolve(path.join(input.botDir, "logs")),
         },
@@ -706,9 +809,13 @@ export function scanFleetLocalInstructions(agentUid, text, deps = {}) {
         throw expectedError(`Cannot use an HQ Fleet profile for invalid bot id ${agentUid}.`);
     }
     const run = deps.run ?? execFileSync;
-    const profileDir = profileRoot(agentUid, deps.fleetHome ?? fleetHome());
-    const python = venvExecutable(path.join(profileDir, "runtime"), "python", deps.platform ?? process.platform);
-    const source = path.join(profileDir, "sources", "runtime");
+    const root = deps.fleetHome ?? fleetHome();
+    const profileDir = profileRoot(agentUid, root);
+    const shared = sharedRuntimeFromMarker(profileDir, root);
+    const runtimeDir = shared?.runtimeDir ?? path.join(profileDir, "runtime");
+    const sourcesDir = shared?.sourcesDir ?? path.join(profileDir, "sources");
+    const python = venvExecutable(runtimeDir, "python", deps.platform ?? process.platform);
+    const source = path.join(sourcesDir, "runtime");
     if (!fs.existsSync(python) || !fs.existsSync(source)) {
         throw expectedError("HQ Fleet Local is not installed for this bot, so its instructions could not be checked.");
     }
@@ -774,6 +881,12 @@ async function installSharedFleetRuntime(installation, root, python, platform, r
         extras: ["mcp", "anthropic"],
     })));
     const shared = path.join(root, "runtimes", identity);
+    const descriptor = () => ({
+        id: identity,
+        root: shared,
+        runtimeDir: path.join(shared, "runtime"),
+        sourcesDir: path.join(shared, "sources"),
+    });
     return withBotLock(identity, async () => {
         const marker = path.join(shared, "ready.json");
         const sources = path.join(shared, "sources");
@@ -785,7 +898,7 @@ async function installSharedFleetRuntime(installation, root, python, platform, r
             if (!executables.every((name) => fs.existsSync(venvExecutable(runtimeDir, name, platform)))) {
                 throw expectedError("The shared HQ Fleet Runtime is incomplete. Reinstall it before creating another bot.");
             }
-            return shared;
+            return descriptor();
         }
         fs.rmSync(shared, { recursive: true, force: true });
         fs.mkdirSync(distributionSource, { recursive: true, mode: 0o700 });
@@ -827,54 +940,59 @@ async function installSharedFleetRuntime(installation, root, python, platform, r
             throw expectedError("HQ Fleet Local installed without its runtime executables.");
         }
         fs.writeFileSync(marker, `${JSON.stringify({ schemaVersion: 1, engine: installation.engine })}\n`, { mode: 0o600 });
-        return shared;
+        return descriptor();
     }, { root: path.join(root, "runtimes"), command: "HQ Fleet Runtime installation", waitMs: 20 * 60_000, staleMs: 2 * 60 * 60_000 });
 }
+function writeNativeProfileMarker(profileDir, shared, engine) {
+    const marker = path.join(profileDir, "bootstrap.json");
+    const temporary = `${marker}.${process.pid}.${crypto.randomUUID()}`;
+    fs.writeFileSync(temporary, `${JSON.stringify({ schemaVersion: 2, runtimeId: shared.id, engine }, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(temporary, marker);
+}
+function removeEmbeddedRuntime(profileDir, platform = process.platform) {
+    fs.rmSync(path.join(profileDir, "sources"), { recursive: true, force: true });
+    if (hasEmbeddedRuntime(profileDir, platform))
+        fs.rmSync(path.join(profileDir, "runtime"), { recursive: true, force: true });
+}
 export async function bootstrapFleetLocalBot(input, deps = {}) {
     const run = deps.run ?? execFileSync;
     const platform = deps.platform ?? process.platform;
     const root = deps.fleetHome ?? fleetHome();
     const python = deps.python ?? await ensureFleetPython({ fleetHome: root, platform, run });
-    const profileDir = profileRoot(input.agentUid, root);
-    const runtimeDir = path.join(profileDir, "runtime");
-    const marker = path.join(profileDir, "bootstrap.json");
+    const profileDir = adoptLegacyProfileDirectory(input.agentUid, root);
     fs.mkdirSync(profileDir, { recursive: true, mode: 0o700 });
-    if (!fs.existsSync(marker)) {
-        const shared = await installSharedFleetRuntime(input.installation, root, python, platform, run);
-        for (const name of ["sources", "runtime"]) {
-            const target = path.join(profileDir, name);
-            fs.rmSync(target, { recursive: true, force: true });
-            fs.symlinkSync(path.join(shared, name), target, platform === "win32" ? "junction" : "dir");
-        }
-        fs.writeFileSync(marker, `${JSON.stringify({ schemaVersion: 1, engine: input.installation.engine }, null, 2)}\n`, { mode: 0o600 });
-    }
-    const { systemPrompt, ...profileInput } = input;
+    const shared = await installSharedFleetRuntime(input.installation, root, python, platform, run);
+    writeNativeProfileMarker(profileDir, shared, input.installation.engine);
+    const { systemPrompt, machineCredentials, ...profileInput } = input;
     if (systemPrompt !== undefined)
         refreshFleetLocalInstructions(input.agentUid, systemPrompt, { fleetHome: root, platform, run });
-    const profile = writeFleetLocalProfile(profileInput, { fleetHome: root, platform });
-    const helper = venvExecutable(runtimeDir, "hq-fleet-local", platform);
-    const runtime = venvExecutable(runtimeDir, "hq-fleet", platform);
+    const profile = writeFleetLocalProfile(profileInput, { fleetHome: root, platform, runtimeRoot: shared.root });
+    const helper = venvExecutable(shared.runtimeDir, "hq-fleet-local", platform);
+    const runtime = venvExecutable(shared.runtimeDir, "hq-fleet", platform);
     if (!fs.existsSync(helper) || !fs.existsSync(runtime)) {
         throw expectedError("HQ Fleet Local installed without its runtime executables.");
     }
     checkedRun(run, helper, ["render-profile", "--spec", profile, "--mode", "create"], { stdio: "ignore" }, "profile rendering");
-    const machineValue = fs.readFileSync(input.machineCredentials, "utf8").trim();
-    if (!machineValue) {
-        throw expectedError(`HQ Fleet Local machine credential file is empty: ${input.machineCredentials}`);
+    if (machineCredentials) {
+        const machineValue = fs.readFileSync(machineCredentials, "utf8").trim();
+        if (!machineValue) {
+            throw expectedError(`HQ Fleet Local machine credential file is empty: ${machineCredentials}`);
+        }
+        checkedRun(run, helper, [
+            "machine-credential",
+            "import",
+            "--profile",
+            profileDir,
+            "--bot-id",
+            input.agentUid,
+        ], { input: machineValue, stdio: ["pipe", "ignore", "pipe"] }, "machine credential import");
+        fs.rmSync(machineCredentials, { force: true });
     }
-    checkedRun(run, helper, [
-        "machine-credential",
-        "import",
-        "--profile",
-        profileDir,
-        "--bot-id",
-        input.agentUid,
-    ], { input: machineValue, stdio: ["pipe", "ignore", "pipe"] }, "machine credential import");
-    fs.rmSync(input.machineCredentials, { force: true });
     checkedRun(run, helper, ["doctor-profile", "--profile", profileDir, "--runtime", runtime], { stdio: "ignore" }, "profile validation");
     const start = deps.start !== false;
     if (start) {
         checkedRun(run, helper, ["service", "install", "--profile", profileDir, "--runtime", runtime], { stdio: ["ignore", 2, 2] }, "service installation");
+        removeEmbeddedRuntime(profileDir, platform);
     }
     return { profile, runtime, helper, running: start };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.180",
+  "version": "5.345.181",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.180",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.180",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.180",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.180",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.180",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.180"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.181",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.181",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.181",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.181",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.181",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.181"
   }
 }