@indigoai-us/hq-cli 5.345.193 → 5.345.195

package/CHANGELOG.md

@@ -2,6 +2,73 @@
 
 ## [Unreleased]
 
+## [5.345.195] — 2026-11-03
+- Legacy local bots now move to the HQ Fleet Runtime. A Claude bot moves on
+  its next start (`hq bot start`, `hq bot restart`, or its launchd or
+  `hq daemon` start at login): it keeps its identity, settings, worker folder
+  and scheduled jobs, its legacy runner stops, and its legacy startup agent is
+  removed. If the Fleet install fails, the bot runs on its legacy runner that
+  time and tries again at its next start. A ChatGPT or Grok bot needs its own
+  sign-in on the Fleet Runtime, so it stays on its legacy runner until the
+  owner runs `hq bot auth <name>`, which now moves it; a failed sign-in puts it
+  back on its legacy runner. Set `HQ_BOT_KEEP_LEGACY_RUNTIME=1` to keep a bot
+  on its legacy runner. `hq bot run` on a bot that already moved removes a
+  leftover legacy startup agent and exits 0 instead of failing, so launchd
+  stops relaunching it.
+- `hq-hook`: the `policy-enforcement-gate` port is now a full native port of the gate at
+  hq-core-staging 7a5677db (#1746, sha256 0a5f4849). It answers PreToolUse, PostToolUse and
+  UserPromptSubmit with the same exit code, stdout, stderr and state files as the bash gate, on
+  macOS and on Windows with Git Bash. The bridge pin moves to that version only, and the old
+  allow-only port and its fixture are removed. The port hands a call back to bash (exit 75) only
+  when the gate's `hook-lib.sh` or `session-id.sh` is not the pinned version, or a host program
+  it needs is missing. The port flag stays off.
+- `hq-hook`: in the gate port, a one-time override token is removed only once the native answer stands; a hand-back (exit 75) or a `shadow` run leaves it for bash. Under Git Bash a project root in MSYS form, or a hook bash that is not Git Bash, goes back to bash, and read receipts follow `pwd -P` spelling.
+- The native hook package release no longer reports a successful npm publish as a
+  failure. The download check now waits for npm to serve the exact new version,
+  polling every 15 seconds for up to 15 minutes, before it compares the published
+  bytes with the tested package. A re-run skips the publish when npm already has
+  that version with the same integrity, and fails with a clear message when the
+  published bytes differ.
+- Local bots now install HQ Fleet Local 0.4.21 on HQ Fleet Runtime main 24211b85.
+  The owner's own DMs run commands without approval prompts, while teammate, job
+  and email turns keep prompting unless the bot was created with `--auto-approve`.
+  A bot reads up to four HQ DM inbox items at once, so one slow request no longer
+  holds up the rest, and a restart no longer replays messages it already handled.
+  Existing Fleet bots move to 0.4.21 at their next start.
+
+## [5.345.194] — 2026-11-03
+- Meeting and other hot-channel documents that land over the signals pass's
+  20-document limit now get signals on a later run. Before this fix, a large
+  refresh (for example 40 meetings at once) left everything past the first 20
+  without signals for good. Each run now works through the channel's backlog,
+  newest first, up to 20 documents, even when the run landed nothing new. For
+  a channel with an ontology worklist the backlog is the worklist; for a hot
+  channel without one (such as meeting pointers) the pass keeps its own queue
+  in `sources/_signals-pending/`. When there is nothing to process, claude is
+  not called.
+- New `hq sources signals --company <co> --since <date>` processes landed
+  documents from that date on that never got signals, and `--key
+  sources/<channel>/<id>.md` (repeatable) processes one again. The 20-document
+  limit still applies (`--max-docs` changes it); what it leaves stays queued
+  for the next run. `--dry-run` lists what would be queued.
+- `hq signals run --company <co> --redo sources/<channel>/<file>.md` (can be
+  repeated) processes an ontology source item again. It needs the ontology
+  worklist script with `--redo` (hq-core-staging #1781).
+- The six native hook packages (one per platform, `@indigoai-us/hq-hook-win32-x64`
+  and siblings) now publish to npm through OIDC trusted publishing without a
+  provenance statement. The v5.345.193 release failed every hook package job
+  because npm rejects provenance from a private source repository (E422), and
+  hq-cli is private. The main `@indigoai-us/hq-cli` package already publishes
+  this way.
+- `hq whoami --json` now reports the signed-in person's `personUid` (`prs_*`).
+  Person sign-in tokens carry no entity claims, so the field was always null
+  for people, and the Daily Brief read only the email-keyed signals folder and
+  missed each company's signals for that person. whoami now asks the vault for
+  the caller's person entity, the same lookup `hq secrets --personal` uses,
+  bounded to 1 second. When the lookup fails or times out, `personUid` stays
+  null and the rest of the output is unchanged. Machine (agent) identities and
+  expired sessions make no lookup.
+
 ## [5.345.193] — 2026-11-03
 - HQ's setup assistant answers the desktop app's end-of-setup handoff as the
   assistant it is: who it is and what it can help with (questions, finding

package/dist/command-catalog.generated.d.ts

@@ -5335,6 +5335,51 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly defaultValue: "<runtime-path>";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "signals";
+        readonly description: "Process landed sources for signals again: queue them for the signals pass and run it now (the pass's document cap still applies)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--company <slug>";
+            readonly description: "Company slug (defaults to .hq/config.json activeCompany)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--since <date>";
+            readonly description: "Landed documents from this date on (YYYY-MM-DD is local midnight) that have no signals yet";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--key <key>";
+            readonly description: "A landed document to process again, signals or not (sources/<channel>/<id>.md; repeatable)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--channel <channel>";
+            readonly description: "Limit --since to one channel";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--max-docs <n>";
+            readonly description: "Documents sent to claude in this run (default 20)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--dry-run";
+            readonly description: "Print what would be queued; queue nothing and call no model";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print the report as JSON";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--hq-root <path>";
+            readonly description: "Local HQ tree root (default: <runtime-path>)";
+            readonly hidden: false;
+            readonly defaultValue: "<runtime-path>";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "sync";
         readonly description: "Run every hot channel now: each adapter once per connection you can use";
@@ -5540,6 +5585,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--report-found";
             readonly description: "Print the owner's run reply only when the run found new signals; print nothing otherwise";
             readonly hidden: false;
+        }, {
+            readonly flags: "--redo <file>";
+            readonly description: "Process a source item again (sources/<channel>/<file>.md; repeatable; needs --company): the extract step re-queues it in the ontology worklist before listing";
+            readonly hidden: false;
         }, {
             readonly flags: "--hq-root <path>";
             readonly description: "HQ root (default: <runtime-path>)";

package/dist/command-catalog.generated.js

@@ -6471,6 +6471,61 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "signals",
+                "description": "Process landed sources for signals again: queue them for the signals pass and run it now (the pass's document cap still applies)",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Company slug (defaults to .hq/config.json activeCompany)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--since <date>",
+                        "description": "Landed documents from this date on (YYYY-MM-DD is local midnight) that have no signals yet",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--key <key>",
+                        "description": "A landed document to process again, signals or not (sources/<channel>/<id>.md; repeatable)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--channel <channel>",
+                        "description": "Limit --since to one channel",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--max-docs <n>",
+                        "description": "Documents sent to claude in this run (default 20)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--dry-run",
+                        "description": "Print what would be queued; queue nothing and call no model",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print the report as JSON",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--hq-root <path>",
+                        "description": "Local HQ tree root (default: <runtime-path>)",
+                        "hidden": false,
+                        "defaultValue": "<runtime-path>"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "sync",
                 "description": "Run every hot channel now: each adapter once per connection you can use",
@@ -6728,6 +6783,11 @@ export const COMMAND_CATALOG = [
                         "description": "Print the owner's run reply only when the run found new signals; print nothing otherwise",
                         "hidden": false
                     },
+                    {
+                        "flags": "--redo <file>",
+                        "description": "Process a source item again (sources/<channel>/<file>.md; repeatable; needs --company): the extract step re-queues it in the ontology worklist before listing",
+                        "hidden": false
+                    },
                     {
                         "flags": "--hq-root <path>",
                         "description": "HQ root (default: <runtime-path>)",

package/dist/commands/bot.js

@@ -1,4 +1,5 @@
 import { withLocalJobs } from "../lib/bot/local-jobs.js";
+import { fleetMoveFailurePath, fleetMoveRecentlyFailed, legacyConversionDecision, writeFleetMoveFailure } from "../lib/bot/legacy-convert.js";
 import { runSignals } from "../lib/signals/engine.js";
 import { BOT_SIGNALS_ENGINE_JOB_FLAG, signalsEngineForJob } from "../lib/bot/signals-engine-flag.js";
 import { resolveProcessFlagGate } from "../lib/flag-registry.js";
@@ -505,11 +506,14 @@ function stopProcess(dir) {
  * restore brings several bots back and its own JSON must be the only document
  * on stdout (the desktop app parses it whole).
  */
-async function startBot(name, dir, config, output, extra = {}) {
+async function startBot(name, dir, config, output, extra = {}, opts = {}) {
     if (hasPromotionHold(dir))
         throw new Error("This bot is held for cloud promotion. Continue its promotion before changing local settings or lifecycle.");
     if (isFleetRuntimeBot(config))
         return startFleetRuntimeBot(name, dir, config, output, extra);
+    const converted = opts.keepLegacy ? null : await convertLegacyBotToFleet(name, dir, config, "start");
+    if (converted)
+        return reportFleetBotStart(name, dir, converted, output, { ...extra, movedToFleet: true }, true, "started by the HQ Fleet Runtime");
     if (config.enabled === false)
         patchBotConfig(dir, { enabled: true });
     const paths = buildBotDaemonPaths({ name, botDir: dir, hqRoot: config.hqRoot });
@@ -571,6 +575,102 @@ async function startBot(name, dir, config, output, extra = {}) {
     }
     return { running, how };
 }
+/**
+ * Move a legacy bot onto the HQ Fleet Runtime under the same identity.
+ * Returns the bot's new settings, or null when it stays on the legacy runner
+ * (it needs its own sign-in, the move is turned off, or the move failed, in
+ * which case the next start tries again).
+ *
+ * bot.json switches to Fleet only after the Fleet service is installed, so a
+ * failure or a kill at any earlier step leaves a legacy bot that starts as
+ * before. Legacy jobs move and the legacy startup agent goes after that.
+ *
+ * `from: "start"` stops the legacy runner first; a failed move leaves it
+ * stopped and the caller starts it again. `from: "run"` is the legacy runner
+ * itself starting (launchd, hq daemon or a detached run), before it polls:
+ * its own startup agent is booted out last, detached.
+ */
+async function convertLegacyBotToFleet(name, dir, config, from) {
+    if (!legacyConversionDecision(config).convert || hasPromotionHold(dir))
+        return null;
+    // A launchd or daemon restart loop would otherwise retry a failing install before every start.
+    if (from === "run" && fleetMoveRecentlyFailed(dir))
+        return null;
+    if (from === "start") {
+        const running = readBotStatus(dir);
+        if (running && isPidAlive(running.pid) && selfStopProbe(running.pid))
+            return null;
+    }
+    const log = createBotLogger(dir);
+    const keepLegacy = (step, err) => {
+        writeFleetMoveFailure(dir);
+        log("warn", `could not ${step} ${name} on the HQ Fleet Runtime (${err instanceof Error ? err.message : String(err)}); it runs on ${config.runtime} this time and tries again at its next start`);
+    };
+    let engine;
+    try {
+        engine = await installFleetRuntimeProfile(name, dir, config, { force: true, keepCredentials: true });
+        if (!engine)
+            throw new Error("no HQ Fleet Local release was available");
+    }
+    catch (err) {
+        keepLegacy("install", err);
+        return null;
+    }
+    const fleet = { ...(readBotConfig(dir) ?? config), engine, enabled: true, fleetServiceInstallPending: false };
+    if (from === "start")
+        await stopBot(name, dir, config, "silent");
+    let failure = null;
+    try {
+        refreshFleetLocalInstructions(config.agentUid, fleetBotSystemPrompt(name, fleet));
+        const result = controlFleetLocalBot(config.agentUid, "install");
+        if (result.ok !== true)
+            failure = new Error(typeof result.summary === "string" ? result.summary : "the service did not install");
+    }
+    catch (err) {
+        failure = err;
+    }
+    if (failure !== null) {
+        try {
+            controlFleetLocalBot(config.agentUid, "stop");
+        }
+        catch {
+            /* nothing was running */
+        }
+        keepLegacy("start", failure);
+        return null;
+    }
+    writeBotConfig(dir, fleet);
+    fs.rmSync(fleetMoveFailurePath(dir), { force: true });
+    // The legacy runner's copy of the machine credentials goes only now: a failed move above still needs it.
+    fs.rmSync(botCredsPath(dir), { force: true });
+    log("info", `moved ${name} to the HQ Fleet Runtime under the same identity; its ${config.runtime} runner is retired`);
+    syncFleetRuntimeJobs(name, dir, fleet);
+    retireLegacyBotAgent(name, dir, config, from === "run" ? "detached" : "inline");
+    return fleet;
+}
+/** Remove a legacy bot's own startup agent once the bot runs on the HQ Fleet Runtime. True when there was one. */
+function retireLegacyBotAgent(name, dir, config, bootout) {
+    const paths = buildBotDaemonPaths({ name, botDir: dir, hqRoot: config.hqRoot });
+    if (!fs.existsSync(paths.plistPath) && !fs.existsSync(paths.systemdUnitPath))
+        return false;
+    const log = createBotLogger(dir);
+    const systemd = process.platform === "linux" && fs.existsSync(paths.systemdUnitPath);
+    if (systemd)
+        systemctlUser(["disable", path.basename(paths.systemdUnitPath)]);
+    uninstallBotDaemon(paths, { ...daemonDeps(), bootout, announce: (r) => log("info", `${r.message}: ${name} runs under the HQ Fleet Runtime service now`) });
+    if (systemd)
+        systemctlUser(["daemon-reload"]);
+    return true;
+}
+/** Best effort: the systemd user unit is an optional extra the owner may never have enabled. */
+function systemctlUser(args) {
+    try {
+        execFileSync("systemctl", ["--user", ...args], { stdio: "ignore", timeout: 10_000 });
+    }
+    catch {
+        /* not enabled, or no user systemd */
+    }
+}
 /** Start (or restart) an HQ Fleet Runtime bot under its own service, with fresh instructions. */
 async function startFleetRuntimeBot(name, dir, config, output, extra) {
     if (config.fleetAuthPending === true) {
@@ -591,7 +691,11 @@ async function startFleetRuntimeBot(name, dir, config, output, extra) {
     if (installService && result.ok)
         patchBotConfig(dir, { fleetServiceInstallPending: false, enabled: true });
     const how = alreadyRunning ? "restarted by the HQ Fleet Runtime" : "started by the HQ Fleet Runtime";
-    const running = result.ok === true && (await waitFor(() => {
+    return reportFleetBotStart(name, dir, config, output, extra, result.ok === true, how);
+}
+/** Wait for a just-started HQ Fleet gateway to report running, and print the outcome. */
+async function reportFleetBotStart(name, dir, config, output, extra, started, how) {
+    const running = started && (await waitFor(() => {
         const s = readBotStatus(dir);
         return !!s && s.state === "running" && isPidAlive(s.pid);
     }, 45_000));
@@ -609,11 +713,24 @@ async function startFleetRuntimeBot(name, dir, config, output, extra) {
     return { running, how };
 }
 async function adoptFleetRuntimeProfile(name, dir, config, opts = {}) {
+    const engine = await installFleetRuntimeProfile(name, dir, config, opts);
+    if (!engine)
+        return false;
+    patchBotConfig(dir, { engine });
+    return true;
+}
+/**
+ * Install or refresh the bot's HQ Fleet profile and return the engine it now
+ * runs, without touching bot.json. Null when nothing was installed. `force`
+ * rebuilds a profile that already matches the release (a legacy bot whose
+ * earlier move did not finish).
+ */
+async function installFleetRuntimeProfile(name, dir, config, opts = {}) {
     const target = opts.pointerOnly ? await resolveFleetLocalPointerTarget() : await resolveFleetLocalTargetRelease();
     if (!target)
-        return false;
-    if (!fleetLocalProfileNeedsAdoption(config.agentUid, { release: target.release }))
-        return false;
+        return null;
+    if (!opts.force && !fleetLocalProfileNeedsAdoption(config.agentUid, { release: target.release }))
+        return null;
     let installation;
     try {
         installation = await installTargetFleetLocalDistribution({ target });
@@ -623,11 +740,11 @@ async function adoptFleetRuntimeProfile(name, dir, config, opts = {}) {
             throw err;
         if (opts.pointerOnly) {
             createBotLogger(dir)("warn", `could not install HQ Fleet Local ${target.release.version} (${err instanceof Error ? err.message : String(err)}); the bot stays on its current release`);
-            return false;
+            return null;
         }
         createBotLogger(dir)("warn", `could not install HQ Fleet Local ${target.release.version} (${err instanceof Error ? err.message : String(err)}); staying on ${HQ_FLEET_LOCAL_RELEASE.version}`);
-        if (!fleetLocalProfileNeedsAdoption(config.agentUid, { release: HQ_FLEET_LOCAL_RELEASE }))
-            return false;
+        if (!opts.force && !fleetLocalProfileNeedsAdoption(config.agentUid, { release: HQ_FLEET_LOCAL_RELEASE }))
+            return null;
         installation = await installPinnedFleetLocalDistribution();
     }
     const python = await ensureFleetPython();
@@ -645,11 +762,10 @@ async function adoptFleetRuntimeProfile(name, dir, config, opts = {}) {
         ownerCompanies: companyScope,
         ...(config.autoApprove === true ? { autoApprove: true } : {}),
     }, { python, start: false });
-    patchBotConfig(dir, { engine: installation.engine });
     const credentials = botCredsPath(dir);
     if (fs.existsSync(credentials))
-        importFleetLocalMachineCredential(config.agentUid, credentials);
-    return true;
+        importFleetLocalMachineCredential(config.agentUid, credentials, {}, { keepSource: opts.keepCredentials === true });
+    return installation.engine;
 }
 /**
  * `output`: "json" | "text" print a result; "silent" prints nothing — used
@@ -1393,6 +1509,10 @@ async function runBotResident(nameArg) {
     const name = validateBotName(nameArg);
     const dir = botDir(name);
     const config = readBotConfig(dir);
+    // A legacy startup agent left behind after the move to Fleet: exiting
+    // non-zero would have launchd relaunch it forever. Remove it and exit 0.
+    if (config && isFleetRuntimeBot(config) && retireLegacyBotAgent(name, dir, config, "detached"))
+        return;
     if (config && isFleetRuntimeBot(config)) {
         throw Object.assign(new Error(`${name} runs on the HQ Fleet Runtime under its own background service. Use hq bot start ${name}, hq bot status ${name} or hq bot logs ${name}.`), { expected: true });
     }
@@ -1420,6 +1540,8 @@ async function runBotResident(nameArg) {
             console.log(orphanBotRunMessage(name, outcome));
         return;
     }
+    if (await convertLegacyBotToFleet(name, dir, config, "run"))
+        return;
     if (healNodePathFromJob(name, dir, config))
         return;
     const token = botTokenSupplier(dir);
@@ -2273,35 +2395,84 @@ export async function runBotRestart(nameArg, opts = {}) {
 }
 async function runBotAuth(nameArg, opts) {
     const b = requireBot(nameArg);
-    if (!isFleetRuntimeBot(b.config)) {
-        throw Object.assign(new Error(`hq bot auth is for bots created with --hq-fleet-runtime. ${b.name} uses ${b.config.runtime}.`), { expected: true });
-    }
     const apiKey = opts.apiKey ? fs.readFileSync(0, "utf8").trim() : undefined;
     if (opts.apiKey && !apiKey) {
         throw Object.assign(new Error("No API key was received on stdin."), { expected: true });
     }
-    const adopted = await adoptFleetRuntimeProfile(b.name, b.dir, b.config);
-    const result = authenticateFleetLocalBot({
-        agentUid: b.config.agentUid,
-        provider: opts.provider,
-        ...(adopted || b.config.fleetAuthPending === true ? { installService: true } : {}),
-        ...(opts.model ? { model: opts.model } : {}),
-        ...(apiKey ? { apiKey } : {}),
-        ...(opts.baseUrl ? { baseUrl: opts.baseUrl } : {}),
-        ...(opts.transport ? { transport: opts.transport } : {}),
-        openBrowser: opts.browser !== false,
-    });
+    // A legacy bot moves to the HQ Fleet Runtime as part of its sign-in. Its
+    // legacy runner stops for the sign-in and comes back if the sign-in fails.
+    const legacy = isFleetRuntimeBot(b.config) ? null : b.config;
+    if (legacy) {
+        refuseHeldFleetBot(b.dir);
+        const running = readBotStatus(b.dir);
+        if (running && isPidAlive(running.pid) && selfStopProbe(running.pid)) {
+            throw Object.assign(new Error(`${b.name} cannot move itself to the HQ Fleet Runtime from inside one of its own turns. Run hq bot auth ${b.name} --provider ${opts.provider} from outside the bot.`), { expected: true });
+        }
+    }
+    // bot.json stays legacy until the sign-in succeeds, so an interrupted sign-in leaves a legacy bot.
+    const engine = legacy ? await installFleetRuntimeProfile(b.name, b.dir, legacy, { force: true, keepCredentials: true }) : null;
+    if (legacy && !engine) {
+        throw Object.assign(new Error(`No HQ Fleet Local release could be installed for ${b.name}; it stays on ${legacy.runtime}.`), { expected: true });
+    }
+    const adopted = legacy ? true : await adoptFleetRuntimeProfile(b.name, b.dir, b.config);
+    if (legacy)
+        await stopBot(b.name, b.dir, legacy, "silent");
+    // Ctrl-C reaches the sign-in helper too; keep this process alive so the rollback below runs.
+    const keepAliveOnInterrupt = () => undefined;
+    if (legacy)
+        process.on("SIGINT", keepAliveOnInterrupt);
+    let result;
+    try {
+        result = authenticateFleetLocalBot({
+            agentUid: b.config.agentUid,
+            provider: opts.provider,
+            ...(adopted || legacy || b.config.fleetAuthPending === true ? { installService: true } : {}),
+            ...(opts.model ? { model: opts.model } : {}),
+            ...(apiKey ? { apiKey } : {}),
+            ...(opts.baseUrl ? { baseUrl: opts.baseUrl } : {}),
+            ...(opts.transport ? { transport: opts.transport } : {}),
+            openBrowser: opts.browser !== false,
+        });
+        if (result.authenticated !== true)
+            throw Object.assign(new Error("The provider has not completed sign-in."), { expected: true });
+        if (legacy && result.restarted !== true) {
+            throw Object.assign(new Error(`${b.name} signed in, but its HQ Fleet service did not start; it stays on ${legacy.runtime}. Run hq bot auth ${b.name} --provider ${opts.provider} again.`), { expected: true });
+        }
+    }
+    catch (err) {
+        if (legacy) {
+            try {
+                controlFleetLocalBot(legacy.agentUid, "stop");
+            }
+            catch {
+                /* nothing was running */
+            }
+            await startBot(b.name, b.dir, legacy, "silent", {}, { keepLegacy: true }).catch(() => undefined);
+        }
+        throw err;
+    }
+    finally {
+        if (legacy)
+            process.off("SIGINT", keepAliveOnInterrupt);
+    }
+    if (legacy && engine) {
+        const moved = { ...(readBotConfig(b.dir) ?? legacy), engine };
+        writeBotConfig(b.dir, moved);
+        fs.rmSync(botCredsPath(b.dir), { force: true });
+        createBotLogger(b.dir)("info", `moved ${b.name} to the HQ Fleet Runtime with its ${opts.provider} sign-in; its ${legacy.runtime} runner is retired`);
+        syncFleetRuntimeJobs(b.name, b.dir, moved);
+        retireLegacyBotAgent(b.name, b.dir, legacy, "inline");
+    }
     const signedInRuntime = result.runtimeProvider === "anthropic" ? "claude" : result.runtimeProvider === "xai-oauth" ? "grok" : result.runtimeProvider === "openai-codex" ? "codex" : null;
-    if (result.authenticated !== true)
-        throw Object.assign(new Error("The provider has not completed sign-in."), { expected: true });
+    const pending = b.config.fleetAuthPending === true || legacy !== null;
     patchBotConfig(b.dir, {
         ...(signedInRuntime ? { runtime: signedInRuntime } : {}),
         model: result.model,
-        ...(b.config.fleetAuthPending === true ? { fleetAuthPending: false, fleetServiceInstallPending: !result.restarted, enabled: result.restarted } : {}),
+        ...(pending ? { fleetAuthPending: false, fleetServiceInstallPending: !result.restarted, enabled: result.restarted } : {}),
     });
     const running = await fleetGatewayComesUp(b.config.agentUid, result.restarted ? fleetStartWaitMs() : 0);
     if (opts.json) {
-        console.log(JSON.stringify({ ok: true, name: b.name, runtime: HQ_FLEET_RUNTIME_ENGINE_ID, ...result, needsSignIn: false, running, serviceInstallPending: b.config.fleetAuthPending === true && !result.restarted }, null, 2));
+        console.log(JSON.stringify({ ok: true, name: b.name, runtime: HQ_FLEET_RUNTIME_ENGINE_ID, ...result, needsSignIn: false, running, serviceInstallPending: pending && !result.restarted, ...(legacy ? { movedToFleet: true } : {}) }, null, 2));
         return;
     }
     console.log(running

package/dist/commands/signals-run.d.ts

@@ -21,6 +21,7 @@ interface RunCliOptions {
     maxBudgetUsd?: number;
     json?: boolean;
     reportFound?: boolean;
+    redo?: string[];
     hqRoot: string;
 }
 export declare function formatRunResult(result: RunSignalsResult, dryRun: boolean): string;

package/dist/commands/signals-run.js

@@ -19,6 +19,9 @@ function parsePositiveInt(v) {
         throw new InvalidArgumentError("must be a positive integer");
     return n;
 }
+function collectRedo(v, prev = []) {
+    return [...prev, v];
+}
 function parseNonNegative(v) {
     const n = Number(v);
     if (!Number.isFinite(n) || n < 0)
@@ -113,6 +116,7 @@ export async function runSignalsCli(options, overrides = {}) {
         catchUp: options.catchUp === true || envCatchUp(),
         maxTurns: options.maxTurns,
         maxBudgetUsd: options.maxBudgetUsd,
+        ...(options.redo?.length ? { redo: options.redo } : {}),
         signalsAlert: overrides.signalsAlert ?? terminalSignalsAlert(),
     });
     const code = signalsExitCode(result);
@@ -155,6 +159,7 @@ export function registerSignalsRunSubcommand(signals) {
         .option("--max-budget-usd <x>", "Spend cap in USD for the extract step (default from core/settings/signals.yaml, else 2.00)", parseNonNegative)
         .option("--json", "Print the run record as JSON")
         .option("--report-found", "Print the owner's run reply only when the run found new signals; print nothing otherwise")
+        .option("--redo <file>", "Process a source item again (sources/<channel>/<file>.md; repeatable; needs --company): the extract step re-queues it in the ontology worklist before listing", collectRedo)
         .option("--hq-root <path>", `HQ root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .action(async (options) => {
         try {

package/dist/commands/sources.d.ts

@@ -128,6 +128,53 @@ export declare function runCompanyHotChannelSync(input: CompanyHotChannelSyncInp
  * line under `companies/{company}/sources/`, and nothing else.
  */
 export declare function runSync(options: SyncOptions, overrides?: SyncOverrides): Promise<OnDemandSyncReport>;
+export interface SignalsRedoOptions {
+    company?: string;
+    since?: string;
+    key?: string[];
+    channel?: string;
+    maxDocs?: number;
+    dryRun?: boolean;
+    json?: boolean;
+    hqRoot: string;
+}
+export interface SignalsRedoOverrides {
+    now?: () => Date;
+    /** The signed-in person; defaults to the local Cognito session. */
+    author?: {
+        email: string;
+    } | null;
+    /** The signals pass; defaults to the local `claude -p` pass with `maxDocs`. */
+    createPass?: (maxDocs: number) => SignalsGeneratedFn;
+    worklistScript?: string;
+}
+export interface SignalsRedoReport {
+    company: string;
+    dryRun: boolean;
+    /** Keys queued per channel, by how they were queued. */
+    queued: {
+        pending: Record<string, string[]>;
+        worklist: Record<string, string[]>;
+    };
+    signalsWritten: number;
+    /** Keys still waiting in each channel's pending file after the run. */
+    pendingLeft: Record<string, number>;
+    notices: string[];
+    error: string | null;
+    exitCode: number;
+}
+/**
+ * `hq sources signals`: queue landed documents for the signals pass and run
+ * the pass now, under the same per-person lock as `hq sources sync`. The pass
+ * keeps its cap (`--max-docs`, default 20); what the cap leaves stays queued
+ * and the next run (this command or the daily sync) picks it up.
+ */
+export declare function runSignalsRedo(options: SignalsRedoOptions, overrides?: SignalsRedoOverrides): Promise<SignalsRedoReport>;
+/** A usage or setup failure `runSignalsRedo` already printed; the exit code is set. */
+export declare class SignalsRedoExit extends Error {
+    readonly exitCode: number;
+    constructor(message: string, exitCode: number);
+}
 export interface ScheduleOptions {
     company?: string;
     at?: string;