@indigoai-us/hq-cli 5.345.189 → 5.345.191

package/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 ## [Unreleased]
 
+## [5.345.191] — 2026-11-02
+- `hq bot list` and `hq bot status --json` rows now carry `engine: "hq-fleet-runtime"` for a bot on
+  the HQ Fleet Runtime, so the desktop app can tell a Fleet bot from a model-CLI bot (Create brief
+  uses this to prefer a Fleet bot).
+- `hq bot auth` on an HQ Fleet Runtime bot gives the restarted gateway up to 15 s to come up before
+  reporting; it used to say "signed in, but did not start" while the bot was in fact starting.
+- `hq bot status` on an HQ Fleet Runtime bot shows whether its gateway is installed as a login
+  service instead of a "launchd: not installed" line that was about the legacy bot daemon.
+- `hq bot create --no-auto-approve` now reaches an HQ Fleet Runtime bot's profile (`autoApprove:
+  false`); with hq-fleet-local 0.4.18 the default profile runs with command approvals off, like a
+  model-CLI bot, so a headless bot no longer stalls on an approval nobody can answer.
+- HQ Fleet Runtime pin moves to hq-fleet-local 0.4.18, which stores the bot's
+  machine credential with Windows DPAPI under PowerShell 5.1 and no longer
+  flashes a console on Windows. The CLI now trusts two release signing keys
+  (the 2026-10-30 key and a second key added 2026-11-01); a manifest signed by
+  either verifies, and any other key is rejected.
+- `hq bot create` / `hq bot start` (HQ Fleet Runtime): every helper, uv and
+  Python child process now always starts with `windowsHide`, which a caller's
+  options can no longer turn off, so no console window flashes on Windows.
+  A new test records every child process in a Windows create, start, stop and
+  status run and checks each one.
+
+## [5.345.190] — 2026-11-01
+- `hq files purge <path> --version-id <id>` permanently deletes one old version of a vault file, after a confirmation prompt.
+- `hq bot create` / `hq bot start` on Windows: the shared HQ Fleet Runtime now
+  installs under `%USERPROFILE%\.hq-fleet\runtimes\<16 hex>\{v,s\r,s\d}` instead
+  of the 64-character identity plus `sources\runtime`, so the runtime's deepest
+  files stay under the 260-character Windows path limit when long paths are
+  off. Before, extraction stopped partway with "HQ Fleet Local runtime
+  extraction failed." Runtimes already installed under the old layout keep
+  working, and a half-extracted old one is removed. macOS and Linux paths are
+  unchanged.
+- HQ Fleet Local install steps now include the last lines of the failing
+  command's stderr in their error, and on Windows the CLI checks the runtime
+  archive's longest path before extracting and names the path limit and
+  `LongPathsEnabled` setting when it would not fit.
+- The CLI now warns on stderr when the HQ Fleet Local release manifest's
+  `compatibility.minimum_hq_cli_version` is newer than the running CLI. It does
+  not block the install.
+- `hq-hook`: the `block-credential-file-read` port follows the fixed bash guard
+  (hq-core-staging #1753, sha256 7c6a8cfa) and its pin moves to that version.
+  Zero-padded brace ranges are read in base 10 and long or stepped ranges
+  block; letter ranges expand exactly; the mktemp scan replacement is literal
+  (no `patsub_replacement`) with capped loops; `function name { ... }` bodies
+  are analysed; extglob groups are an unknown word part; and `ls`, `stat` and
+  the other metadata commands are not trusted after an alias, hash, enable,
+  PATH change, a write into a bin directory, or when named by a path outside
+  /bin, /usr/bin, /sbin and /usr/sbin. The port also picks up the guard's
+  cygpath and `upstream-pin.env` changes. The vendored fixture and corpus are
+  refreshed. The port flag stays off.
+- `hq sync now`: when the push leg holds files after an account sign-in change
+  on this computer, the push line now shows the held count, prints how to
+  release them (`hq sync held`, `hq sync release-held`), skips the "Sync now
+  complete" line and exits 1. Before, it printed "0 uploaded, 0 skipped" and a
+  success line (feedback_2356e54f).
+
 ## [5.345.189] — 2026-11-01
 - A local bot that cannot reach HQ when it starts now retries the identity check up to five times
   (waits of 5 s, 15 s, 45 s and 2 min) on a network error (connection refused, reset, DNS failure,

package/dist/command-catalog.generated.d.ts

@@ -3243,6 +3243,35 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "purge";
+        readonly description: "Permanently delete ONE retained (noncurrent) version of an exact vault key, for example a version that held data which must not live in HQ. Owner only; audited; cannot be undone. Delete the file first if the version is current. Use --personal for your personal vault.";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <path>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "path";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--personal";
+            readonly description: "Target your own personal vault instead of a company vault (mutually exclusive with --company)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--version-id <id>";
+            readonly description: "Exact version ID to purge (see `hq files versions`)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "-y, --yes";
+            readonly description: "Skip the confirmation prompt (for scripts)";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "trash";
         readonly description: "List deleted vault keys retained as tombstones. Use --personal for your personal vault.";

package/dist/command-catalog.generated.js

@@ -3912,6 +3912,42 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "purge",
+                "description": "Permanently delete ONE retained (noncurrent) version of an exact vault key, for example a version that held data which must not live in HQ. Owner only; audited; cannot be undone. Delete the file first if the version is current. Use --personal for your personal vault.",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <path>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "path",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--personal",
+                        "description": "Target your own personal vault instead of a company vault (mutually exclusive with --company)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--version-id <id>",
+                        "description": "Exact version ID to purge (see `hq files versions`)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "-y, --yes",
+                        "description": "Skip the confirmation prompt (for scripts)",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "trash",
                 "description": "List deleted vault keys retained as tombstones. Use --personal for your personal vault.",

package/dist/commands/bot.d.ts

@@ -3,7 +3,7 @@ import { type RuntimeSignInCheck, type RuntimeSignInIssue } from "../lib/bot/run
 import type { BotStatusFile } from "../lib/bot/status.js";
 import { probeBotRuntime, type RuntimeProbeResult } from "../lib/bot/probe.js";
 import { type SpawnInteractive } from "../lib/bot/runtime-auth.js";
-import { type BotLocalConfig, type MyLocalBot, type BotKind, type BotMemoryMode, type BotNotRunnableReason, type RuntimeCrash, type BotConfig, type BotRuntimeId, type LaunchctlExec, type BotRole } from "../lib/bot/index.js";
+import { type BotLocalConfig, type MyLocalBot, type BotKind, type BotMemoryMode, type BotNotRunnableReason, type RuntimeCrash, type BotConfig, type BotRuntimeId, type LaunchctlExec, HQ_FLEET_RUNTIME_ENGINE_ID, type BotRole } from "../lib/bot/index.js";
 /** Real launchctl; every failure is a non-ok result, never a throw. */
 export declare const defaultLaunchctl: LaunchctlExec;
 /** The desktop app creates HQ's setup bot under this name, always from the `setup` worker. */
@@ -13,6 +13,8 @@ export interface BotRow {
     agentUid: string;
     ownerUid: string;
     runtime: BotRuntimeId;
+    /** `hq-fleet-runtime` for a bot on the HQ Fleet Runtime; absent for a model-CLI bot. */
+    engine?: typeof HQ_FLEET_RUNTIME_ENGINE_ID;
     needsSignIn?: boolean;
     authCommand?: string;
     serviceInstallPending?: boolean;

package/dist/commands/bot.js

@@ -57,7 +57,7 @@ import { runtimeDisplayName, signInCommand } from "../lib/bot/runtime-sign-in.js
 import { classifyRuntimeFailure, runtimeFailureReason } from "../lib/bot/runtime-failure.js";
 import { PROBE_DEFAULT_TIMEOUT_MS, probeBotRuntime } from "../lib/bot/probe.js";
 import { BOT_LOGIN_RUNTIMES, botAuthEnv, botRuntimeAuth, capacityAccountHome, describeBotAuth, formatBotAuth, isBotLoginRuntime, restoreBotSessions, setAsideBotSessions, signInBotRuntime, signOutBotRuntime, withRuntimeAuth, } from "../lib/bot/runtime-auth.js";
-import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, fleetLocalProfileNeedsAdoption, fleetProviderForRuntime, importFleetLocalMachineCredential, fleetProviderNeedsSignIn, fleetDefaultCompanies, fleetOwnerCompanies, fleetRuntimeIsDefault, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
+import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, fleetLocalProfileNeedsAdoption, fleetLocalServiceInstalled, fleetProviderForRuntime, importFleetLocalMachineCredential, fleetProviderNeedsSignIn, fleetDefaultCompanies, fleetOwnerCompanies, fleetRuntimeIsDefault, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
 function collectRepeated(value, previous) {
     return [...previous, value];
 }
@@ -152,6 +152,22 @@ function fleetBotSystemPrompt(name, config, overrides = {}) {
 function fleetAuthCommand(name, config) {
     return `hq bot auth ${name} --provider ${config.runtime === "grok" ? "grok" : config.runtime === "codex" ? "chatgpt" : "claude"}`;
 }
+/** How long a just-(re)started HQ Fleet gateway gets to write its pid before it counts as not started. */
+function fleetStartWaitMs() {
+    const raw = Number(process.env.HQ_BOT_FLEET_START_WAIT_MS);
+    return Number.isFinite(raw) && raw >= 0 ? raw : 15_000;
+}
+async function fleetGatewayComesUp(agentUid, waitMs, stepMs = 500) {
+    const deadline = Date.now() + waitMs;
+    for (;;) {
+        const pid = fleetLocalGatewayPid(agentUid);
+        if (pid !== null && isPidAlive(pid))
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        await new Promise((r) => setTimeout(r, stepMs));
+    }
+}
 function runFleetRuntimeControl(name, config, action, json) {
     if ((action === "install" || action === "start" || action === "restart") && config.fleetAuthPending === true) {
         const authCommand = fleetAuthCommand(name, config);
@@ -236,6 +252,7 @@ function rowFor(name, opts = {}) {
         agentUid: config.agentUid,
         ownerUid: config.ownerUid,
         runtime: config.runtime,
+        ...(fleet ? { engine: HQ_FLEET_RUNTIME_ENGINE_ID } : {}),
         model: config.model,
         effort: effectiveBotEffort(config),
         effortIsDefault: !config.effort,
@@ -477,6 +494,7 @@ async function adoptFleetRuntimeProfile(name, dir, config) {
         systemPrompt: fleetBotSystemPrompt(name, config),
         provider: fleetProviderForRuntime(config.runtime, config.model),
         ownerCompanies: companyScope,
+        ...(config.autoApprove === false ? { autoApprove: false } : {}),
     }, { python, start: false });
     patchBotConfig(dir, { engine: installation.engine });
     const credentials = botCredsPath(dir);
@@ -1124,6 +1142,7 @@ async function runBotCreateLocked(name, opts) {
             systemPrompt: fleetBotSystemPrompt(name, config, { kind, companies }),
             provider: fleetProvider,
             ownerCompanies,
+            ...(opts.autoApprove === false ? { autoApprove: false } : {}),
             firstStart: {
                 intro: introDmText(name, runtime, intro, { kind, companies }),
                 ...(kickoff ? { kickoff } : {}),
@@ -1452,7 +1471,12 @@ async function runBotStatus(nameArg, opts) {
         console.log(`  inbox:      last poll ${status.lastInboxPollAt}`);
     }
     console.log(`  answering:  ${row.busy ? chalk.green(`yes${row.busySince ? `, since ${row.busySince}` : ""}`) : chalk.gray("no")}`);
-    console.log(`  launchd:    ${row.daemonInstalled ? (row.daemonLoaded ? "installed, loaded" : "installed, not loaded") : "not installed"}`);
+    if (fleet) {
+        console.log(`  service:    ${fleetLocalServiceInstalled(config.agentUid) ? "installed (HQ Fleet gateway, starts at login)" : row.serviceInstallPending ? "not installed yet; installs on hq bot start" : "not installed"}`);
+    }
+    else {
+        console.log(`  launchd:    ${row.daemonInstalled ? (row.daemonLoaded ? "installed, loaded" : "installed, not loaded") : "not installed"}`);
+    }
     if (row.daemonNodeMissing) {
         console.log(`  ${chalk.red(`node missing: ${row.daemonNodeMissing}`)} — launchd cannot start ${name}; fix with: hq bot start ${name}`);
     }
@@ -2150,8 +2174,7 @@ async function runBotAuth(nameArg, opts) {
         model: result.model,
         ...(b.config.fleetAuthPending === true ? { fleetAuthPending: false, fleetServiceInstallPending: !result.restarted, enabled: result.restarted } : {}),
     });
-    const pid = fleetLocalGatewayPid(b.config.agentUid);
-    const running = pid !== null && isPidAlive(pid);
+    const running = await fleetGatewayComesUp(b.config.agentUid, result.restarted ? fleetStartWaitMs() : 0);
     if (opts.json) {
         console.log(JSON.stringify({ ok: true, name: b.name, runtime: HQ_FLEET_RUNTIME_ENGINE_ID, ...result, needsSignIn: false, running, serviceInstallPending: b.config.fleetAuthPending === true && !result.restarted }, null, 2));
         return;
@@ -2446,6 +2469,7 @@ async function adoptRemoteBotLocked(input) {
             systemPrompt: fleetBotSystemPrompt(name, config),
             provider: fleetProviderForRuntime(config.runtime, config.model),
             ownerCompanies: await fleetOwnerCompanies(),
+            ...(config.autoApprove === false ? { autoApprove: false } : {}),
             ...(input.preserveFirstStart
                 ? {
                     firstStart: {

package/dist/commands/cloud.js

@@ -2351,12 +2351,19 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         }
         const pushProgressCompany = personalMode ? null : (pushSlug ?? null);
         const planLimitTracker = createPlanLimitRefusalTracker(companySlugForBilling(pushProgressCompany));
+        // feedback_2356e54f: the push leg held files after an account switch and
+        // still printed "0 uploaded, 0 skipped" and "Sync now complete".
+        const pushIdentityHeld = createIdentityHeldTracker();
+        const pushRecord = trackingProgressRecorder(planLimitTracker, pushProgressCompany);
         const pushResult = await share({
             paths: pushPaths,
             company: targetCompany,
             vaultConfig,
             hqRoot,
-            progressRecorder: trackingProgressRecorder(planLimitTracker, pushProgressCompany),
+            progressRecorder: (event) => {
+                pushIdentityHeld.observe(event);
+                pushRecord(event);
+            },
             skipUnchanged: true,
             serverOwnedPathPolicy: "skip",
             propagateDeletes: true,
@@ -2370,7 +2377,9 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         });
         const pushRefused = planLimitTracker.summary();
         const pushUploadFailed = readUploadFailures(pushResult);
+        const pushHeldCount = pushIdentityHeld.count();
         const pushStatus = pushResult.aborted ||
+            pushHeldCount > 0 ||
             pushResult.filesExcludedByScope > 0 ||
             (pushResult.filesRefusedStale ?? 0) > 0 ||
             pushUploadFailed.count > 0 ||
@@ -2380,6 +2389,7 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         console.log(`    ${pushStatus} ` +
             `${pushResult.filesUploaded} uploaded, ${pushResult.filesSkipped} skipped, ` +
             `${pushResult.filesDeleted} deleted, ${pushResult.filesExcludedByScope} scope-excluded` +
+            (pushHeldCount > 0 ? `, ${pushHeldCount} held` : "") +
             (pushResult.aborted ? " — aborted" : "") +
             (pushRefused
                 ? ` — ${describeRefusedCount(pushRefused)} refused (new files paused)`
@@ -2397,6 +2407,9 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         for (const line of uploadFailedLines(pushUploadFailed.count, pushUploadFailed.paths)) {
             console.log(chalk.yellow(line));
         }
+        for (const line of identityHeldLines(pushHeldCount)) {
+            console.log(chalk.yellow(line));
+        }
         if (pushResult.aborted) {
             console.log(chalk.yellow("\n⚠ Sync now aborted on push leg; pull skipped."));
             throw new SyncExitError(1);
@@ -2519,7 +2532,8 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         }
         if (pushResult.filesExcludedByScope > 0 ||
             (pushResult.filesRefusedStale ?? 0) > 0 ||
-            pushUploadFailed.count > 0) {
+            pushUploadFailed.count > 0 ||
+            pushHeldCount > 0) {
             console.log(chalk.yellow("\n⚠ Sync now finished, but one or more requested uploads were refused."));
             throw new SyncExitError(1, { health: "succeeded" });
         }

package/dist/commands/files.d.ts

@@ -242,6 +242,24 @@ export declare function runFilesRestore(params: {
 }, deps?: {
     confirm?: ConfirmFn;
 }): Promise<FilesRestoreResponse | undefined>;
+export interface FilesPurgeResponse {
+    key: string;
+    purgedVersionId: string;
+}
+/**
+ * feedback_fc711fc3: permanently delete one noncurrent version. The server
+ * (hq-pro POST /v1/files/restore, action "purge") enforces owner-only access,
+ * refuses the current version and delete markers, and audits before deleting.
+ */
+export declare function runFilesPurge(params: {
+    key: string;
+    versionId: string;
+    yes: boolean;
+    personal: boolean;
+    companySlug: string | undefined;
+}, deps?: {
+    confirm?: ConfirmFn;
+}): Promise<FilesPurgeResponse | undefined>;
 export declare function runFilesTrash(params: {
     prefix: string;
     cursor?: string;

package/dist/commands/files.js

@@ -731,6 +731,30 @@ export function registerFilesCommand(program) {
             process.exit(1);
         }
     });
+    files
+        .command("purge <path>")
+        .description("Permanently delete ONE retained (noncurrent) version of an exact vault key, for example a version that held data which must not live in HQ. Owner only; audited; cannot be undone. Delete the file first if the version is current. Use --personal for your personal vault.")
+        .option("--personal", "Target your own personal vault instead of a company vault (mutually exclusive with --company)")
+        .requiredOption("--version-id <id>", "Exact version ID to purge (see `hq files versions`)")
+        .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
+        .action(async (path, opts) => {
+        try {
+            const companySlug = files.opts().company;
+            const personal = opts.personal === true;
+            assertRecoveryScope(personal, companySlug);
+            await runFilesPurge({
+                key: path,
+                versionId: opts.versionId,
+                yes: opts.yes === true,
+                personal,
+                companySlug,
+            });
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
     files
         .command("trash")
         .description("List deleted vault keys retained as tombstones. Use --personal for your personal vault.")
@@ -1767,6 +1791,55 @@ export async function runFilesRestore(params, deps = {}) {
     console.log(chalk.dim("New version: " + data.newVersionId));
     return data;
 }
+/**
+ * feedback_fc711fc3: permanently delete one noncurrent version. The server
+ * (hq-pro POST /v1/files/restore, action "purge") enforces owner-only access,
+ * refuses the current version and delete markers, and audits before deleting.
+ */
+export async function runFilesPurge(params, deps = {}) {
+    assertExactRecoveryKey(params.key);
+    if (typeof params.versionId !== "string" || params.versionId.trim() === "") {
+        throw new Error("--version-id is required and must not be empty.");
+    }
+    const confirm = deps.confirm ?? realConfirm;
+    if (!params.yes) {
+        const ok = await confirm("Permanently delete version '" + params.versionId + "' of '" + params.key + "'" +
+            (params.personal ? " in your personal vault" : "") +
+            "? This cannot be undone.");
+        if (!ok) {
+            console.log(chalk.dim("Aborted — nothing was purged."));
+            return undefined;
+        }
+    }
+    const scope = await resolveRecoveryScope(params);
+    const body = scope.personal
+        ? { personal: true, key: params.key }
+        : { company: scope.companyUid, key: params.key };
+    body.action = "purge";
+    body.purgeVersionId = params.versionId;
+    // Tripwire: a server without purge support rejects `versionId: null` with
+    // 400 instead of ignoring `action` and restoring (re-publishing) the version.
+    body.versionId = null;
+    const res = await vaultApiFetch({
+        token: scope.token,
+        path: "/v1/files/restore",
+        method: "POST",
+        body,
+    });
+    if (!res.ok) {
+        const errBody = (await res.json().catch(() => ({})));
+        const err = new FilesRecoveryHttpError(res.status, errBody.message ?? errBody.error ?? res.statusText, errBody.code);
+        throw new Error(formatFilesRecoveryError(err, params.key));
+    }
+    const data = (await res.json());
+    // Belt and braces with the tripwire above: only a server that echoes the
+    // purged version id has purged it.
+    if (data.purgedVersionId !== params.versionId) {
+        throw new Error("The server did not confirm the purge (it may not support purge yet). Check `hq files versions` before retrying.");
+    }
+    console.log(chalk.green("Purged version '" + data.purgedVersionId + "' of '" + params.key + "'."));
+    return { key: data.key ?? params.key, purgedVersionId: data.purgedVersionId };
+}
 export async function runFilesTrash(params) {
     if (params.prefix.includes("*")) {
         throw new Error("Trash prefix must be literal; wildcard expansion is not supported.");

package/dist/lib/bot/fleet-local.d.ts

@@ -41,6 +41,7 @@ export interface FleetLocalProfile {
         transport?: string;
     };
     ownerCompanies?: string[];
+    autoApprove?: boolean;
     hqRoot: string;
     profileDir: string;
     runtime: {
@@ -60,7 +61,7 @@ export interface FleetLocalInstallDeps {
     hqReleaseLinks?: (release: FleetLocalReleasePin) => Promise<Map<string, string> | null>;
     now?: () => Date;
     release?: FleetLocalReleasePin;
-    publicKey?: string;
+    publicKey?: string | readonly string[];
 }
 export interface FleetLocalProfileInput {
     agentUid: string;
@@ -79,6 +80,8 @@ export interface FleetLocalProfileInput {
     };
     /** Companies the owner's own turns may use; other senders get none of them. */
     ownerCompanies?: string[];
+    /** False keeps the runtime's command approval prompts (`hq bot create --no-auto-approve`). */
+    autoApprove?: boolean;
 }
 /** The model the HQ Fleet Runtime asks for when a Claude bot names none. */
 export declare const FLEET_CLAUDE_DEFAULT_MODEL = "claude-opus-5-5";
@@ -99,8 +102,34 @@ export interface FleetLocalBootstrapDeps {
     start?: boolean;
     python?: FleetPython;
 }
+interface SharedFleetRuntime {
+    id: string;
+    root: string;
+    runtimeDir: string;
+    sourcesDir: string;
+    /** Extracted runtime source tree (`sources/runtime`, or `s/r` on Windows). */
+    runtimeSource: string;
+    /** Extracted distribution tree (`sources/distribution`, or `s/d` on Windows). */
+    distributionSource: string;
+}
+/**
+ * Hex characters of the runtime identity used for the shared runtime
+ * directory name on Windows. The full 64-character identity plus
+ * `sources\runtime` pushed the runtime's deepest files past MAX_PATH (260).
+ */
+export declare const WINDOWS_RUNTIME_DIR_ID_LENGTH = 16;
+/** Longest path Windows accepts when long paths are turned off (MAX_PATH minus the terminator). */
+export declare const WINDOWS_MAX_PATH_CHARS = 259;
+/**
+ * Where a shared runtime lives. macOS and Linux keep the original layout
+ * (`runtimes/<64 hex>/{runtime,sources/runtime,sources/distribution}`).
+ * Windows uses `runtimes/<16 hex>/{v,s\r,s\d}` so deep runtime files stay
+ * under MAX_PATH; `ready.json` records the full identity.
+ */
+export declare function sharedRuntimeLayout(root: string, id: string, platform: NodeJS.Platform): SharedFleetRuntime;
 type FleetLocalProfileDeps = Pick<FleetLocalBootstrapDeps, "fleetHome" | "platform"> & {
     runtimeRoot?: string;
+    runtime?: SharedFleetRuntime;
 };
 export interface FleetLocalBootstrapResult {
     profile: string;
@@ -136,9 +165,22 @@ export interface FleetLocalRemovalResult {
     credentialsRemoved: number;
 }
 export declare const HQ_FLEET_LOCAL_RELEASE: FleetLocalReleasePin;
+/** hq-fleet-local trust/release-public.pem (rotated 2026-10-30; signed v0.4.17). */
 export declare const HQ_FLEET_LOCAL_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEASJoapvo0WMTg+Wu3Jvt0nzlXLOBEr+G1aJRi0JkEb4A=\n-----END PUBLIC KEY-----\n";
+/** hq-fleet-local trust/release-public-v2.pem (added 2026-11-01; signs v0.4.18). */
+export declare const HQ_FLEET_LOCAL_PUBLIC_KEY_V2 = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAmgUi7pKTJUmf3yzwcuH65wSvn1NyJrDfZHZUX08sGN8=\n-----END PUBLIC KEY-----\n";
+/** Every key a release manifest may be signed with. Any one must verify it. */
+export declare const HQ_FLEET_LOCAL_PUBLIC_KEYS: readonly string[];
+/** True when any trusted Ed25519 key verifies the manifest signature. */
+export declare function fleetLocalManifestSignatureValid(manifest: Buffer, signature: Buffer, publicKey?: string | readonly string[]): boolean;
 export declare function fleetHome(home?: string, env?: NodeJS.ProcessEnv): string;
-export declare function verifyFleetLocalRelease(files: FleetLocalReleaseFiles, release?: FleetLocalReleasePin, publicKey?: string): void;
+export declare function verifyFleetLocalRelease(files: FleetLocalReleaseFiles, release?: FleetLocalReleasePin, publicKey?: string | readonly string[]): void;
+/**
+ * Warning text when the signed manifest asks for a newer hq CLI than this
+ * one, or null. Advisory only: the pinned runtime is still installed, since
+ * blocking would strand every user until that CLI version is published.
+ */
+export declare function fleetLocalCliCompatibilityWarning(manifest: Buffer, release?: FleetLocalReleasePin, cliVersion?: string): string | null;
 /** `gh auth token` fallback for the release download token. */
 export declare const FLEET_RELEASE_TOKEN_TIMEOUT_MS = 15000;
 export declare function resolveFleetReleaseToken(env?: NodeJS.ProcessEnv, run?: FleetLocalExec): string;
@@ -149,6 +191,15 @@ export declare const FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS: number;
 export declare function installPinnedFleetLocalDistribution(deps?: FleetLocalInstallDeps): Promise<FleetLocalInstallation>;
 /** The process id the bot's gateway recorded, when its file reads; the caller checks whether it is alive. */
 export declare function fleetLocalGatewayPid(agentUid: string, deps?: Pick<FleetLocalControlDeps, "fleetHome">): number | null;
+/**
+ * Whether the bot's HQ Fleet gateway is installed as a login service. The
+ * runtime registers it with launchd as `ai.hq-fleet.gateway-<profile>`; null
+ * on platforms where hq-cli does not know the service layout.
+ */
+export declare function fleetLocalServiceInstalled(agentUid: string, deps?: {
+    platform?: NodeJS.Platform;
+    home?: string;
+}): boolean | null;
 export declare function fleetLocalProfileNeedsAdoption(agentUid: string, deps?: Pick<FleetLocalControlDeps, "fleetHome" | "platform"> & {
     release?: FleetLocalReleasePin;
 }): boolean;
@@ -172,6 +223,14 @@ export declare function writeFleetLocalSoul(agentUid: string, systemPrompt: stri
 export declare function scanFleetLocalInstructions(agentUid: string, text: string, deps?: FleetLocalControlDeps): string[];
 /** Checks the instructions with the runtime's scanner, then makes them the bot's persona. */
 export declare function refreshFleetLocalInstructions(agentUid: string, systemPrompt: string, deps?: FleetLocalControlDeps): string;
+/** Last few non-empty stderr lines of a failed child process, trimmed for an error message. */
+export declare function stderrTail(error: unknown): string;
+/**
+ * Message for a Windows extraction that cannot fit under MAX_PATH, or null
+ * when it fits or long paths are on. `longest` is the longest member name in
+ * the archive; members land at `<destination>\<name>`.
+ */
+export declare function windowsExtractionPathProblem(destination: string, longest: number, longPathsEnabled: number | null): string | null;
 /** Moves a fresh machine credential into the bot's secure store and deletes the file. */
 export declare function importFleetLocalMachineCredential(agentUid: string, machineCredentials: string, deps?: FleetLocalControlDeps): void;
 export declare function bootstrapFleetLocalBot(input: FleetLocalProfileInput & {

package/dist/lib/bot/fleet-local.js

@@ -6,6 +6,8 @@ import * as path from "node:path";
 import { HQ_FLEET_RUNTIME_ENGINE_ID, } from "./config.js";
 import { withBotLock } from "./lock.js";
 import { ensureFleetPython, fleetUvEnv } from "./fleet-python.js";
+import semver from "semver";
+import { CLI_VERSION } from "../../cli-version.js";
 import { ensureCognitoToken } from "../../utils/cognito-session.js";
 import { vaultApiFetch } from "../../utils/vault-api.js";
 /** The model the HQ Fleet Runtime asks for when a Claude bot names none. */
@@ -34,22 +36,84 @@ export function fleetProviderForRuntime(runtime, model) {
 export function fleetProviderNeedsSignIn(provider) {
     return provider.id !== "anthropic";
 }
+/**
+ * Hex characters of the runtime identity used for the shared runtime
+ * directory name on Windows. The full 64-character identity plus
+ * `sources\runtime` pushed the runtime's deepest files past MAX_PATH (260).
+ */
+export const WINDOWS_RUNTIME_DIR_ID_LENGTH = 16;
+/** Longest path Windows accepts when long paths are turned off (MAX_PATH minus the terminator). */
+export const WINDOWS_MAX_PATH_CHARS = 259;
+function legacySharedRuntimeLayout(root, id) {
+    const shared = path.join(root, "runtimes", id);
+    const sources = path.join(shared, "sources");
+    return {
+        id,
+        root: shared,
+        runtimeDir: path.join(shared, "runtime"),
+        sourcesDir: sources,
+        runtimeSource: path.join(sources, "runtime"),
+        distributionSource: path.join(sources, "distribution"),
+    };
+}
+/**
+ * Where a shared runtime lives. macOS and Linux keep the original layout
+ * (`runtimes/<64 hex>/{runtime,sources/runtime,sources/distribution}`).
+ * Windows uses `runtimes/<16 hex>/{v,s\r,s\d}` so deep runtime files stay
+ * under MAX_PATH; `ready.json` records the full identity.
+ */
+export function sharedRuntimeLayout(root, id, platform) {
+    if (platform !== "win32")
+        return legacySharedRuntimeLayout(root, id);
+    const shared = path.join(root, "runtimes", id.slice(0, WINDOWS_RUNTIME_DIR_ID_LENGTH));
+    const sources = path.join(shared, "s");
+    return {
+        id,
+        root: shared,
+        runtimeDir: path.join(shared, "v"),
+        sourcesDir: sources,
+        runtimeSource: path.join(sources, "r"),
+        distributionSource: path.join(sources, "d"),
+    };
+}
 export const HQ_FLEET_LOCAL_RELEASE = {
     repository: "indigoai-us/hq-fleet-local",
-    tag: "v0.4.17",
-    version: "0.4.17",
-    artifact: "hq-fleet-local-0.4.17.zip",
-    artifactSha256: "d2c5c49d4ef47da6003f4c2f3be7dcd2d8a287523c8577dfe0239e6e0705e4b4",
+    tag: "v0.4.18",
+    version: "0.4.18",
+    artifact: "hq-fleet-local-0.4.18.zip",
+    artifactSha256: "194ae7da24d02205061b18172a84c972754bd0607ed3b4c32af7ac10d73904a7",
     runtimeArtifact: "hq-fleet-runtime-abccac13bd9e.tar",
     runtimeArtifactSha256: "29bcfe718ad7fbd3636afd00623772f2a25bc84c4f6f10d8d57f38e549d528d5",
-    manifestSha256: "63663ffe8c6bef4f2aefa587d20431156cab4170a0f23533cdab7aab444a7d35",
-    signatureSha256: "bb4af0b453ae03fdbc18e6335ca23e2f0de42bd9e322dba7c4f31d0c8dc08aa7",
+    manifestSha256: "ce14449198a0f5d8558ecc617c19551b7a2a31dba5bd563501a93d2ee58e5ff0",
+    signatureSha256: "ca7dac6bcc2d12f6e304d1940e7b00243f9c306e7f0a72fd4aa236b7778d3a93",
     runtimeCommit: "abccac13bd9ea593b24c8cd9c0ba28d5c6050cc9",
 };
+/** hq-fleet-local trust/release-public.pem (rotated 2026-10-30; signed v0.4.17). */
 export const HQ_FLEET_LOCAL_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEASJoapvo0WMTg+Wu3Jvt0nzlXLOBEr+G1aJRi0JkEb4A=
 -----END PUBLIC KEY-----
 `;
+/** hq-fleet-local trust/release-public-v2.pem (added 2026-11-01; signs v0.4.18). */
+export const HQ_FLEET_LOCAL_PUBLIC_KEY_V2 = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAmgUi7pKTJUmf3yzwcuH65wSvn1NyJrDfZHZUX08sGN8=
+-----END PUBLIC KEY-----
+`;
+/** Every key a release manifest may be signed with. Any one must verify it. */
+export const HQ_FLEET_LOCAL_PUBLIC_KEYS = [HQ_FLEET_LOCAL_PUBLIC_KEY, HQ_FLEET_LOCAL_PUBLIC_KEY_V2];
+function publicKeyList(publicKey) {
+    return typeof publicKey === "string" ? [publicKey] : publicKey;
+}
+/** True when any trusted Ed25519 key verifies the manifest signature. */
+export function fleetLocalManifestSignatureValid(manifest, signature, publicKey = HQ_FLEET_LOCAL_PUBLIC_KEYS) {
+    return publicKeyList(publicKey).some((key) => {
+        try {
+            return crypto.verify(null, manifest, crypto.createPublicKey(key), signature);
+        }
+        catch {
+            return false;
+        }
+    });
+}
 function digest(value) {
     return crypto.createHash("sha256").update(value).digest("hex");
 }
@@ -68,7 +132,7 @@ function engineMetadata(release) {
 export function fleetHome(home = os.homedir(), env = process.env) {
     return env.HQ_FLEET_HOME?.trim() || path.join(home, ".hq-fleet");
 }
-export function verifyFleetLocalRelease(files, release = HQ_FLEET_LOCAL_RELEASE, publicKey = HQ_FLEET_LOCAL_PUBLIC_KEY) {
+export function verifyFleetLocalRelease(files, release = HQ_FLEET_LOCAL_RELEASE, publicKey = HQ_FLEET_LOCAL_PUBLIC_KEYS) {
     if (digest(files.archive) !== release.artifactSha256) {
         throw expectedError(`HQ Fleet Local ${release.version} archive hash did not match the release pin.`);
     }
@@ -100,11 +164,34 @@ export function verifyFleetLocalRelease(files, release = HQ_FLEET_LOCAL_RELEASE,
     if (signature.algorithm !== "ed25519" || typeof signature.signature !== "string") {
         throw expectedError(`HQ Fleet Local ${release.version} signature record is invalid.`);
     }
-    const valid = crypto.verify(null, files.manifest, crypto.createPublicKey(publicKey), Buffer.from(signature.signature, "base64"));
+    const valid = fleetLocalManifestSignatureValid(files.manifest, Buffer.from(signature.signature, "base64"), publicKey);
     if (!valid) {
         throw expectedError(`HQ Fleet Local ${release.version} manifest signature is invalid.`);
     }
 }
+/**
+ * Warning text when the signed manifest asks for a newer hq CLI than this
+ * one, or null. Advisory only: the pinned runtime is still installed, since
+ * blocking would strand every user until that CLI version is published.
+ */
+export function fleetLocalCliCompatibilityWarning(manifest, release = HQ_FLEET_LOCAL_RELEASE, cliVersion = CLI_VERSION) {
+    let minimum;
+    try {
+        const parsed = JSON.parse(manifest.toString("utf8"));
+        minimum = parsed.compatibility?.minimum_hq_cli_version;
+    }
+    catch {
+        return null;
+    }
+    if (typeof minimum !== "string")
+        return null;
+    const required = semver.valid(semver.coerce(minimum));
+    const current = semver.valid(semver.coerce(cliVersion));
+    if (!required || !current || semver.gte(current, required))
+        return null;
+    return `HQ Fleet Local ${release.version} asks for hq CLI ${minimum} or newer; this is ${cliVersion}. ` +
+        "Update with `npm install -g @indigoai-us/hq-cli` if the bot misbehaves.";
+}
 /** `gh auth token` fallback for the release download token. */
 export const FLEET_RELEASE_TOKEN_TIMEOUT_MS = 15_000;
 export function resolveFleetReleaseToken(env = process.env, run = execFileSync) {
@@ -261,7 +348,7 @@ function installFiles(target, files, release, publicKey) {
         fs.writeFileSync(path.join(staging, release.runtimeArtifact), files.runtimeArchive, { mode: 0o644 });
         fs.writeFileSync(path.join(staging, "release-manifest.json"), files.manifest, { mode: 0o644 });
         fs.writeFileSync(path.join(staging, "release-manifest.sig"), files.signature, { mode: 0o644 });
-        fs.writeFileSync(path.join(staging, "release-public.pem"), publicKey, { mode: 0o644 });
+        fs.writeFileSync(path.join(staging, "release-public.pem"), publicKeyList(publicKey).join(""), { mode: 0o644 });
         fs.writeFileSync(path.join(staging, "install.json"), `${JSON.stringify({ schemaVersion: 1, release, engine: engineMetadata(release) }, null, 2)}\n`, { mode: 0o644 });
         if (fs.existsSync(target))
             fs.renameSync(target, backup);
@@ -301,12 +388,18 @@ function cachedRuntimeArchive(root, release) {
 }
 export async function installPinnedFleetLocalDistribution(deps = {}) {
     const release = deps.release ?? HQ_FLEET_LOCAL_RELEASE;
-    const publicKey = deps.publicKey ?? HQ_FLEET_LOCAL_PUBLIC_KEY;
+    const publicKey = deps.publicKey ?? HQ_FLEET_LOCAL_PUBLIC_KEYS;
     const root = deps.fleetHome ?? fleetHome();
     const dir = path.join(root, "distributions", "hq-fleet-local", release.version);
     const current = installedFiles(dir, release);
+    const warnCompatibility = (manifest) => {
+        const warning = fleetLocalCliCompatibilityWarning(manifest, release);
+        if (warning)
+            process.stderr.write(`Warning: ${warning}\n`);
+    };
     if (current) {
         verifyFleetLocalRelease(current, release, publicKey);
+        warnCompatibility(current.manifest);
     }
     else {
         const fetcher = deps.fetch ?? fetch;
@@ -316,6 +409,7 @@ export async function installPinnedFleetLocalDistribution(deps = {}) {
             ? await downloadFleetLocalReleaseFromHq(release, fetcher, links, cachedRuntime)
             : await downloadFleetLocalRelease(release, fetcher, (deps.token ?? resolveFleetReleaseToken)(), cachedRuntime);
         verifyFleetLocalRelease(files, release, publicKey);
+        warnCompatibility(files.manifest);
         installFiles(dir, files, release, publicKey);
     }
     return {
@@ -377,18 +471,19 @@ function venvExecutable(runtimeDir, name, platform) {
         ? path.join(runtimeDir, "Scripts", `${name}.exe`)
         : path.join(runtimeDir, "bin", name);
 }
-function sharedRuntimeFromMarker(profileDir, root) {
+function sharedRuntimeFromMarker(profileDir, root, platform = process.platform) {
     try {
         const marker = JSON.parse(fs.readFileSync(path.join(profileDir, "bootstrap.json"), "utf8"));
         if (marker.schemaVersion !== 2 || typeof marker.runtimeId !== "string" || !/^[a-f0-9]{64}$/.test(marker.runtimeId))
             return null;
-        const sharedRoot = path.join(root, "runtimes", marker.runtimeId);
-        return {
-            id: marker.runtimeId,
-            root: sharedRoot,
-            runtimeDir: path.join(sharedRoot, "runtime"),
-            sourcesDir: path.join(sharedRoot, "sources"),
-        };
+        const layout = sharedRuntimeLayout(root, marker.runtimeId, platform);
+        if (platform === "win32" && !fs.existsSync(path.join(layout.root, "ready.json"))) {
+            // Bots installed before the short Windows layout keep using their runtime.
+            const legacy = legacySharedRuntimeLayout(root, marker.runtimeId);
+            if (fs.existsSync(path.join(legacy.root, "ready.json")))
+                return legacy;
+        }
+        return layout;
     }
     catch {
         return null;
@@ -426,7 +521,7 @@ function fleetLocalExecutables(agentUid, deps) {
     const root = deps.fleetHome ?? fleetHome();
     const platform = deps.platform ?? process.platform;
     const profileDir = profileRoot(agentUid, root);
-    const shared = sharedRuntimeFromMarker(profileDir, root);
+    const shared = sharedRuntimeFromMarker(profileDir, root, platform);
     const runtimeDir = shared?.runtimeDir ?? path.join(profileDir, "runtime");
     const sourcesDir = shared?.sourcesDir ?? path.join(profileDir, "sources");
     const profile = path.join(profileDir, "profile.json");
@@ -440,7 +535,8 @@ function fleetLocalExecutables(agentUid, deps) {
 function runJson(run, executable, args, options, label) {
     let output;
     try {
-        output = run(executable, args, { windowsHide: true, encoding: "utf8", ...options });
+        // windowsHide last: a helper, uv or Python child never opens a console window on Windows.
+        output = run(executable, args, { encoding: "utf8", ...options, windowsHide: true });
     }
     catch {
         throw expectedError(`HQ Fleet Local ${label} failed.`);
@@ -468,6 +564,31 @@ export function fleetLocalGatewayPid(agentUid, deps = {}) {
         return null;
     }
 }
+/** The first hq-fleet-local release whose profile schema accepts `autoApprove`; older ones reject unknown fields. */
+const AUTO_APPROVE_RELEASE = [0, 4, 18];
+function releaseKnowsAutoApprove(release) {
+    const parts = release.version.split(".").map((part) => Number.parseInt(part, 10));
+    for (let i = 0; i < AUTO_APPROVE_RELEASE.length; i += 1) {
+        const have = Number.isFinite(parts[i]) ? parts[i] : 0;
+        if (have !== AUTO_APPROVE_RELEASE[i])
+            return have > AUTO_APPROVE_RELEASE[i];
+    }
+    return true;
+}
+/**
+ * Whether the bot's HQ Fleet gateway is installed as a login service. The
+ * runtime registers it with launchd as `ai.hq-fleet.gateway-<profile>`; null
+ * on platforms where hq-cli does not know the service layout.
+ */
+export function fleetLocalServiceInstalled(agentUid, deps = {}) {
+    if (!/^agt_[A-Za-z0-9_-]+$/.test(agentUid))
+        return null;
+    const platform = deps.platform ?? process.platform;
+    if (platform !== "darwin")
+        return null;
+    const home = deps.home ?? os.homedir();
+    return fs.existsSync(path.join(home, "Library", "LaunchAgents", `ai.hq-fleet.gateway-${profileName(agentUid)}.plist`));
+}
 export function fleetLocalProfileNeedsAdoption(agentUid, deps = {}) {
     if (!/^agt_[A-Za-z0-9_-]+$/.test(agentUid))
         return true;
@@ -484,12 +605,12 @@ export function fleetLocalProfileNeedsAdoption(agentUid, deps = {}) {
     if (!entries.includes(canonicalName))
         return true;
     const profileDir = path.join(profiles, canonicalName);
-    const shared = sharedRuntimeFromMarker(profileDir, root);
+    const platform = deps.platform ?? process.platform;
+    const shared = sharedRuntimeFromMarker(profileDir, root, platform);
     if (!shared)
         return true;
     if (!profileEngineMatchesRelease(profileDir, deps.release ?? HQ_FLEET_LOCAL_RELEASE))
         return true;
-    const platform = deps.platform ?? process.platform;
     if (!["hq-fleet", "hq-fleet-local", "python"].every((name) => fs.existsSync(venvExecutable(shared.runtimeDir, name, platform))))
         return true;
     if (hasEmbeddedRuntime(profileDir, platform) || fs.existsSync(path.join(profileDir, "sources")))
@@ -639,7 +760,7 @@ export function removeFleetLocalBot(agentUid, deps = {}) {
     }
     const platform = deps.platform ?? process.platform;
     const legacyRuntime = path.join(profileDir, "runtime");
-    const shared = sharedRuntimeFromMarker(profileDir, deps.fleetHome ?? fleetHome());
+    const shared = sharedRuntimeFromMarker(profileDir, deps.fleetHome ?? fleetHome(), platform);
     const installedRuntime = shared?.runtimeDir ?? legacyRuntime;
     if (!["hq-fleet", "hq-fleet-local"].every((name) => fs.existsSync(venvExecutable(installedRuntime, name, platform)))) {
         fs.rmSync(profileDir, { recursive: true, force: true });
@@ -757,9 +878,11 @@ export function writeFleetLocalProfile(input, deps = {}) {
     }
     const root = deps.fleetHome ?? fleetHome();
     const dir = profileRoot(input.agentUid, root);
-    const markerRuntime = sharedRuntimeFromMarker(dir, root);
-    const runtimeRoot = deps.runtimeRoot ?? markerRuntime?.root ?? dir;
-    const runtimeDir = path.join(runtimeRoot, "runtime");
+    const layout = deps.runtime ??
+        (deps.runtimeRoot ? undefined : sharedRuntimeFromMarker(dir, root, deps.platform ?? process.platform) ?? undefined);
+    const runtimeRoot = deps.runtimeRoot ?? dir;
+    const runtimeDir = layout?.runtimeDir ?? path.join(runtimeRoot, "runtime");
+    const distributionSource = layout?.distributionSource ?? path.join(runtimeRoot, "sources", "distribution");
     const destination = path.join(dir, "profile.json");
     const temporary = path.join(dir, `.profile-${process.pid}-${crypto.randomUUID()}`);
     const profile = {
@@ -767,12 +890,13 @@ export function writeFleetLocalProfile(input, deps = {}) {
         botId: input.agentUid,
         ownerUid: input.ownerUid,
         ...(input.ownerCompanies?.length ? { ownerCompanies: [...new Set(input.ownerCompanies)].sort() } : {}),
+        ...(input.autoApprove === false && releaseKnowsAutoApprove(input.installation.release) ? { autoApprove: false } : {}),
         provider: input.provider ?? { id: "custom:personal-chatgpt", model: "gpt-5.6-sol" },
         hqRoot: path.resolve(input.hqRoot),
         profileDir: path.resolve(dir),
         runtime: { commit: input.installation.release.runtimeCommit, path: path.resolve(runtimeDir) },
         paths: {
-            pluginSource: path.resolve(path.join(runtimeRoot, "sources", "distribution", "src", "hq_fleet_local", "plugins", "hqdm")),
+            pluginSource: path.resolve(path.join(distributionSource, "src", "hq_fleet_local", "plugins", "hqdm")),
             statusFile: path.resolve(path.join(input.botDir, "status.json")),
             logsDir: path.resolve(path.join(input.botDir, "logs")),
         },
@@ -833,11 +957,11 @@ export function scanFleetLocalInstructions(agentUid, text, deps = {}) {
     const run = deps.run ?? execFileSync;
     const root = deps.fleetHome ?? fleetHome();
     const profileDir = profileRoot(agentUid, root);
-    const shared = sharedRuntimeFromMarker(profileDir, root);
+    const platform = deps.platform ?? process.platform;
+    const shared = sharedRuntimeFromMarker(profileDir, root, platform);
     const runtimeDir = shared?.runtimeDir ?? path.join(profileDir, "runtime");
-    const sourcesDir = shared?.sourcesDir ?? path.join(profileDir, "sources");
-    const python = venvExecutable(runtimeDir, "python", deps.platform ?? process.platform);
-    const source = path.join(sourcesDir, "runtime");
+    const python = venvExecutable(runtimeDir, "python", platform);
+    const source = shared?.runtimeSource ?? path.join(profileDir, "sources", "runtime");
     if (!fs.existsSync(python) || !fs.existsSync(source)) {
         throw expectedError("HQ Fleet Local is not installed for this bot, so its instructions could not be checked.");
     }
@@ -867,14 +991,83 @@ export function refreshFleetLocalInstructions(agentUid, systemPrompt, deps = {})
     }
     return writeFleetLocalSoul(agentUid, systemPrompt, deps);
 }
+const STDERR_TAIL_LINES = 6;
+const STDERR_TAIL_CHARS = 800;
+/** Last few non-empty stderr lines of a failed child process, trimmed for an error message. */
+export function stderrTail(error) {
+    const raw = error?.stderr;
+    const text = Buffer.isBuffer(raw) ? raw.toString("utf8") : typeof raw === "string" ? raw : "";
+    const lines = text.split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim().length > 0);
+    const tail = lines.slice(-STDERR_TAIL_LINES).join("\n");
+    return tail.length > STDERR_TAIL_CHARS ? `...${tail.slice(-STDERR_TAIL_CHARS)}` : tail;
+}
 function checkedRun(run, executable, args, options, label) {
+    // Keep stdout quiet but capture stderr, so a failure names its cause
+    // (for example a path-too-long error during extraction).
+    const stdio = options.stdio === "ignore" ? ["ignore", "ignore", "pipe"] : options.stdio;
     try {
-        run(executable, args, { windowsHide: true, ...options });
+        run(executable, args, {
+            maxBuffer: 16 * 1024 * 1024,
+            ...options,
+            ...(stdio === undefined ? {} : { stdio }),
+            // Last, so no caller can turn it off: no console window flashes on Windows.
+            windowsHide: true,
+        });
     }
-    catch {
-        throw expectedError(`HQ Fleet Local ${label} failed.`);
+    catch (error) {
+        const tail = stderrTail(error);
+        throw expectedError(`HQ Fleet Local ${label} failed.${tail ? `\n${tail}` : ""}`);
     }
 }
+const FLEET_TAR_PATH_PROBE = [
+    "import json, sys, tarfile",
+    "longest = 0",
+    "with tarfile.open(sys.argv[1]) as archive:",
+    "    for member in archive:",
+    "        longest = max(longest, len(member.name.rstrip('/')))",
+    "enabled = None",
+    "try:",
+    "    import winreg",
+    "    key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\\CurrentControlSet\\Control\\FileSystem')",
+    "    enabled = int(winreg.QueryValueEx(key, 'LongPathsEnabled')[0])",
+    "except Exception:",
+    "    pass",
+    "print(json.dumps({'longest': longest, 'longPathsEnabled': enabled}))",
+].join("\n");
+/**
+ * Message for a Windows extraction that cannot fit under MAX_PATH, or null
+ * when it fits or long paths are on. `longest` is the longest member name in
+ * the archive; members land at `<destination>\<name>`.
+ */
+export function windowsExtractionPathProblem(destination, longest, longPathsEnabled) {
+    const needed = destination.length + 1 + longest;
+    if (needed <= WINDOWS_MAX_PATH_CHARS || longPathsEnabled === 1)
+        return null;
+    return `The HQ Fleet Runtime cannot be extracted on this PC: its deepest file needs a ${needed}-character path under ${destination}, ` +
+        `over the Windows limit of ${WINDOWS_MAX_PATH_CHARS}, and Windows long paths are turned off (LongPathsEnabled = ${longPathsEnabled ?? "unset"}). ` +
+        "Ask an administrator to set HKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\LongPathsEnabled to 1, or set HQ_FLEET_HOME to a shorter folder such as C:\\hqf, then retry.";
+}
+function assertWindowsExtractionFits(run, python, archive, destination) {
+    let probe;
+    try {
+        const output = run(python, ["-I", "-c", FLEET_TAR_PATH_PROBE, archive], {
+            windowsHide: true,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            maxBuffer: 1024 * 1024,
+        });
+        probe = JSON.parse((Buffer.isBuffer(output) ? output.toString("utf8") : output).trim());
+    }
+    catch {
+        return; // The probe is advisory; extraction reports its own error.
+    }
+    if (typeof probe?.longest !== "number")
+        return;
+    const enabled = typeof probe.longPathsEnabled === "number" ? probe.longPathsEnabled : null;
+    const problem = windowsExtractionPathProblem(destination, probe.longest, enabled);
+    if (problem)
+        throw expectedError(problem);
+}
 /** Moves a fresh machine credential into the bot's secure store and deletes the file. */
 export function importFleetLocalMachineCredential(agentUid, machineCredentials, deps = {}) {
     const run = deps.run ?? execFileSync;
@@ -902,25 +1095,37 @@ async function installSharedFleetRuntime(installation, root, python, platform, r
         platform,
         extras: ["mcp", "anthropic"],
     })));
-    const shared = path.join(root, "runtimes", identity);
-    const descriptor = () => ({
-        id: identity,
-        root: shared,
-        runtimeDir: path.join(shared, "runtime"),
-        sourcesDir: path.join(shared, "sources"),
-    });
+    const layout = sharedRuntimeLayout(root, identity, platform);
+    const shared = layout.root;
     return withBotLock(identity, async () => {
         const marker = path.join(shared, "ready.json");
-        const sources = path.join(shared, "sources");
-        const distributionSource = path.join(sources, "distribution");
-        const runtimeSource = path.join(sources, "runtime");
-        const runtimeDir = path.join(shared, "runtime");
+        const { distributionSource, runtimeSource, runtimeDir } = layout;
         const executables = ["python", "hq-fleet", "hq-fleet-local"];
+        if (platform === "win32") {
+            const legacy = legacySharedRuntimeLayout(root, identity);
+            if (fs.existsSync(path.join(legacy.root, "ready.json")) &&
+                executables.every((name) => fs.existsSync(venvExecutable(legacy.runtimeDir, name, platform)))) {
+                // A runtime installed before the short Windows layout keeps serving bots.
+                return legacy;
+            }
+            // A half-extracted long-path runtime is never usable; clear it.
+            fs.rmSync(legacy.root, { recursive: true, force: true });
+        }
         if (fs.existsSync(marker)) {
+            let recordedId;
+            try {
+                recordedId = JSON.parse(fs.readFileSync(marker, "utf8")).runtimeId;
+            }
+            catch {
+                recordedId = undefined;
+            }
+            if (recordedId !== undefined && recordedId !== identity) {
+                throw expectedError(`The shared HQ Fleet Runtime folder ${shared} belongs to a different runtime. Remove it and retry.`);
+            }
             if (!executables.every((name) => fs.existsSync(venvExecutable(runtimeDir, name, platform)))) {
                 throw expectedError("The shared HQ Fleet Runtime is incomplete. Reinstall it before creating another bot.");
             }
-            return descriptor();
+            return layout;
         }
         fs.rmSync(shared, { recursive: true, force: true });
         fs.mkdirSync(distributionSource, { recursive: true, mode: 0o700 });
@@ -933,6 +1138,8 @@ async function installSharedFleetRuntime(installation, root, python, platform, r
             installation.archive,
             distributionSource,
         ], { stdio: "ignore" }, "distribution extraction");
+        if (platform === "win32")
+            assertWindowsExtractionFits(run, python.python, installation.runtimeArchive, runtimeSource);
         checkedRun(run, python.python, [
             "-m",
             "tarfile",
@@ -961,8 +1168,8 @@ async function installSharedFleetRuntime(installation, root, python, platform, r
         if (!executables.every((name) => fs.existsSync(venvExecutable(runtimeDir, name, platform)))) {
             throw expectedError("HQ Fleet Local installed without its runtime executables.");
         }
-        fs.writeFileSync(marker, `${JSON.stringify({ schemaVersion: 1, engine: installation.engine })}\n`, { mode: 0o600 });
-        return descriptor();
+        fs.writeFileSync(marker, `${JSON.stringify({ schemaVersion: 1, runtimeId: identity, engine: installation.engine })}\n`, { mode: 0o600 });
+        return layout;
     }, { root: path.join(root, "runtimes"), command: "HQ Fleet Runtime installation", waitMs: 20 * 60_000, staleMs: 2 * 60 * 60_000 });
 }
 function writeNativeProfileMarker(profileDir, shared, engine) {
@@ -988,7 +1195,7 @@ export async function bootstrapFleetLocalBot(input, deps = {}) {
     const { systemPrompt, machineCredentials, ...profileInput } = input;
     if (systemPrompt !== undefined)
         refreshFleetLocalInstructions(input.agentUid, systemPrompt, { fleetHome: root, platform, run });
-    const profile = writeFleetLocalProfile(profileInput, { fleetHome: root, platform, runtimeRoot: shared.root });
+    const profile = writeFleetLocalProfile(profileInput, { fleetHome: root, platform, runtime: shared });
     const helper = venvExecutable(shared.runtimeDir, "hq-fleet-local", platform);
     const runtime = venvExecutable(shared.runtimeDir, "hq-fleet", platform);
     if (!fs.existsSync(helper) || !fs.existsSync(runtime)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.189",
+  "version": "5.345.191",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.189",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.189",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.189",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.189",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.189",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.189"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.191",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.191",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.191",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.191",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.191",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.191"
   }
 }