@indigoai-us/hq-cli 5.345.193 → 5.345.195

package/dist/commands/sources.js

@@ -23,6 +23,7 @@
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { InvalidArgumentError } from "commander";
 import chalk from "chalk";
 import { SOURCE_CHANNELS, assertSourceChannel, resolveEntity, listAvailableEntities, listSources, getSource, VaultClient, } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken, ensureCognitoIdToken, buildVaultConfig, DEFAULT_COGNITO, DEFAULT_HQ_ROOT, } from "../utils/cognito-session.js";
@@ -34,7 +35,8 @@ import { resolveUploadAuthor } from "../utils/upload-author.js";
 import { createSignalsAlertChannelPoster, raiseSignalsFailureAlerts } from "../lib/hot-channels/alert.js";
 import { audienceKey } from "../lib/hot-channels/audience.js";
 import { appendRunLedgerEntry, ledgerDay, readRunLedger, summarizeRunLedger, } from "../lib/hot-channels/ledger.js";
-import { createClaudeSignalsPass } from "../lib/hot-channels/signals-pass.js";
+import { createClaudeSignalsPass, DEFAULT_MAX_SIGNAL_DOCS, readPendingSignals, SignalsPassError, } from "../lib/hot-channels/signals-pass.js";
+import { backlogRunResult, parseSince, queueSignalsRedo, selectSignalsRedo, SignalsRedoUsageError, } from "../lib/hot-channels/signals-redo.js";
 import { assertSafeSegment } from "../lib/hot-channels/landing.js";
 import { acquireSyncLock, SYNC_LOCK_BUSY_REASON } from "../lib/hot-channels/sync-lock.js";
 import { createBuiltinHotChannelRegistry } from "../lib/hot-channels/adapters/index.js";
@@ -642,6 +644,139 @@ function renderSyncTable(company, report) {
     }
     return lines.join("\n");
 }
+/**
+ * `hq sources signals`: queue landed documents for the signals pass and run
+ * the pass now, under the same per-person lock as `hq sources sync`. The pass
+ * keeps its cap (`--max-docs`, default 20); what the cap leaves stays queued
+ * and the next run (this command or the daily sync) picks it up.
+ */
+export async function runSignalsRedo(options, overrides = {}) {
+    const company = options.company ?? readActiveCompanySlug(options.hqRoot);
+    const fail = (message, exitCode) => {
+        process.stderr.write(chalk.red(`✗ ${message}\n`));
+        process.exitCode = exitCode;
+        throw new SignalsRedoExit(message, exitCode);
+    };
+    if (!company)
+        return fail("No company specified. Pass --company <slug> or set activeCompany in .hq/config.json.", 2);
+    assertSafeSegment(company, "company");
+    if (options.since === undefined && (options.key ?? []).length === 0)
+        return fail("Pass --since <date> or --key <sources/channel/id.md>.", 2);
+    const vaultRoot = path.join(options.hqRoot, "companies", company);
+    if (!fs.existsSync(vaultRoot))
+        return fail(`No company directory: companies/${company}`, 2);
+    const maxDocs = options.maxDocs ?? DEFAULT_MAX_SIGNAL_DOCS;
+    let selection;
+    try {
+        selection = await selectSignalsRedo({
+            vaultRoot,
+            ...(options.key ? { keys: options.key } : {}),
+            ...(options.since !== undefined ? { since: parseSince(options.since) } : {}),
+            ...(options.channel !== undefined ? { channel: options.channel } : {}),
+        });
+    }
+    catch (err) {
+        if (err instanceof SignalsRedoUsageError)
+            return fail(err.message, 2);
+        throw err;
+    }
+    const report = {
+        company,
+        dryRun: options.dryRun === true,
+        queued: { pending: Object.fromEntries(selection.pending), worklist: Object.fromEntries(selection.worklist) },
+        signalsWritten: 0,
+        pendingLeft: {},
+        notices: [...selection.notices],
+        error: null,
+        exitCode: 0,
+    };
+    const channels = [...new Set([...selection.pending.keys(), ...selection.worklist.keys()])];
+    if (!report.dryRun && channels.length > 0) {
+        const author = overrides.author !== undefined ? overrides.author : resolveUploadAuthor();
+        if (!author)
+            return fail(`${SIGN_IN_PROMPT} (the run takes your hot-channel sync lock)`, 1);
+        const lock = await acquireSyncLock(vaultRoot, audienceKey([author.email]), overrides.now ? { now: overrides.now } : {});
+        if (!lock)
+            return fail(`Another hot-channel sync for ${company} is running. Try again when it finishes.`, 1);
+        try {
+            await queueSignalsRedo({
+                hqRoot: options.hqRoot,
+                company,
+                selection,
+                beforeWrite: lock.assertHeld,
+                ...(overrides.worklistScript ? { worklistScript: overrides.worklistScript } : {}),
+            });
+            const pass = overrides.createPass
+                ? overrides.createPass(maxDocs)
+                : createClaudeSignalsPass({ hqRoot: options.hqRoot, company, maxDocs });
+            for (const channel of channels) {
+                report.signalsWritten += await pass(backlogRunResult(channel), { beforeWrite: lock.assertHeld });
+            }
+        }
+        catch (err) {
+            report.error = err instanceof SignalsPassError ? err.code : err instanceof Error ? err.message : String(err);
+            report.exitCode = 1;
+        }
+        finally {
+            await lock.release();
+        }
+    }
+    for (const channel of selection.pending.keys()) {
+        report.pendingLeft[channel] = (await readPendingSignals(vaultRoot, channel)).length;
+    }
+    if (options.json) {
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${renderSignalsRedo(report)}\n`);
+    }
+    if (report.exitCode !== 0)
+        process.exitCode = report.exitCode;
+    return report;
+}
+/** A usage or setup failure `runSignalsRedo` already printed; the exit code is set. */
+export class SignalsRedoExit extends Error {
+    exitCode;
+    constructor(message, exitCode) {
+        super(message);
+        this.name = "SignalsRedoExit";
+        this.exitCode = exitCode;
+    }
+}
+function renderSignalsRedo(report) {
+    const lines = [`${report.dryRun ? "Would queue" : "Queued"} for signals in ${report.company}:`];
+    const groups = [
+        ...Object.entries(report.queued.pending).map(([channel, keys]) => ({ channel, keys, how: "pending" })),
+        ...Object.entries(report.queued.worklist).map(([channel, keys]) => ({ channel, keys, how: "worklist --redo" })),
+    ];
+    if (groups.length === 0)
+        lines.push("  nothing (no matching landed document without signals)");
+    for (const group of groups) {
+        lines.push(`  sources/${group.channel}: ${group.keys.length} (${group.how})`);
+        for (const key of group.keys)
+            lines.push(`    ${key}`);
+    }
+    lines.push(...report.notices);
+    if (!report.dryRun && groups.length > 0) {
+        lines.push("", `${report.signalsWritten} signal(s) written.`);
+        for (const [channel, left] of Object.entries(report.pendingLeft)) {
+            if (left > 0)
+                lines.push(`${left} document(s) still queued in sources/${channel}; the next run picks them up.`);
+        }
+        if (report.error)
+            lines.push(chalk.red(`The signals pass stopped: ${report.error}. Queued documents stay queued.`));
+    }
+    return lines.join("\n");
+}
+function collectKey(value, previous = []) {
+    return [...previous, value];
+}
+function parseMaxDocs(value) {
+    const n = Number(value);
+    if (!Number.isInteger(n) || n <= 0)
+        throw new InvalidArgumentError("must be a positive integer");
+    return n;
+}
 function fleetBotsIn(root) {
     let names;
     try {
@@ -842,6 +977,27 @@ export function registerSourcesCommand(program) {
         .action(withErrorHandling(async (options) => {
         await runSchedule(options);
     }));
+    sources
+        .command("signals")
+        .description("Process landed sources for signals again: queue them for the signals pass and run it now (the pass's document cap still applies)")
+        .option("--company <slug>", "Company slug (defaults to .hq/config.json activeCompany)")
+        .option("--since <date>", "Landed documents from this date on (YYYY-MM-DD is local midnight) that have no signals yet")
+        .option("--key <key>", "A landed document to process again, signals or not (sources/<channel>/<id>.md; repeatable)", collectKey)
+        .option("--channel <channel>", "Limit --since to one channel")
+        .option("--max-docs <n>", `Documents sent to claude in this run (default ${DEFAULT_MAX_SIGNAL_DOCS})`, parseMaxDocs)
+        .option("--dry-run", "Print what would be queued; queue nothing and call no model")
+        .option("--json", "Print the report as JSON")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(withErrorHandling(async (options) => {
+        try {
+            await runSignalsRedo(options);
+        }
+        catch (err) {
+            // Usage and setup failures are already printed with their exit code.
+            if (!(err instanceof SignalsRedoExit))
+                throw err;
+        }
+    }));
     sources
         .command("sync")
         .description("Run every hot channel now: each adapter once per connection you can use")

package/dist/commands/whoami.d.ts

@@ -21,6 +21,13 @@ export interface WhoamiDisplayIdentity {
  * email with the token subject of the delegating machine.
  */
 export declare function resolveWhoamiIdentity(identity: WhoamiTokenIdentity): WhoamiDisplayIdentity;
+/**
+ * Bound on the person-uid lookup, so `--json` callers with short timeouts still
+ * get an answer. Kept at 1s: with every endpoint stalled, a whole `whoami
+ * --json` must still finish inside the foreground network budget plus startup
+ * (foreground-network-budget.test.ts); 3s overran it.
+ */
+export declare const PERSON_UID_LOOKUP_TIMEOUT_MS = 1000;
 export declare function renderWhoamiPlanBlock(status: PlanLimitStatus, opts?: {
     inviteTeammateEnabled?: boolean;
 }): string | null;

package/dist/commands/whoami.js

@@ -8,6 +8,7 @@ import { ensureCognitoToken, loadMachineCachedTokens, resolveCognitoTokenSource,
 import { colorizePlanLimitNotice, fetchPlanLimitStatus, renderPlanLine, renderPlanLimitNotice, } from "../lib/billing/plan-lock.js";
 import { resolveCompanyFlagGate, } from "../lib/flag-registry.js";
 import { queuePlanLimitInviteTeammateExposure } from "../utils/cli-telemetry.js";
+import { resolveCallerPersonUid } from "../utils/vault-api.js";
 export const CLI_LIMIT_INVITE_TEAMMATE_FLAG = "cli.limit-invite-teammate-v1";
 /**
  * Resolves the person represented by an ID token without pairing a delegated
@@ -44,6 +45,36 @@ function peekIdToken(idToken) {
             : undefined,
     };
 }
+/**
+ * Bound on the person-uid lookup, so `--json` callers with short timeouts still
+ * get an answer. Kept at 1s: with every endpoint stalled, a whole `whoami
+ * --json` must still finish inside the foreground network budget plus startup
+ * (foreground-network-budget.test.ts); 3s overran it.
+ */
+export const PERSON_UID_LOOKUP_TIMEOUT_MS = 1_000;
+/**
+ * The signed-in person's canonical `prs_*` uid for `whoami --json`. Person ID
+ * tokens carry no `custom:entityType`/`custom:entityUid` claims, so the token
+ * alone almost never has it; the vault's person-entity lookup does (the same
+ * rule `hq secrets --personal` uses). Best-effort: no session, a timeout or a
+ * network failure resolve to null and the rest of the identity still prints.
+ */
+async function readPersonUid(identity) {
+    if (identity.entityType === 'person' && identity.entityUid)
+        return identity.entityUid;
+    try {
+        const token = await ensureCognitoToken({ interactive: false });
+        if (!token)
+            return null;
+        return await resolveCallerPersonUid(token, undefined, {
+            command: 'hq whoami',
+            signal: AbortSignal.timeout(PERSON_UID_LOOKUP_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * starter-plan-hard-limits / US-011 — read the workspace plan-limit nag for
  * `--company <slug>` (the bind notice).
@@ -148,9 +179,11 @@ export function registerWhoamiCommand(program) {
                     : boundLegacyAgent;
                 // planLimits is additive: absent-or-null means UNKNOWN.
                 const planLimits = await readPlanLimits(opts.company);
+                const authenticated = machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0));
+                const personUid = !machine && authenticated ? await readPersonUid(identity) : null;
                 console.log(JSON.stringify({
                     schemaVersion: 1,
-                    authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
+                    authenticated,
                     tokenSource: machine ? 'machine' : 'person',
                     email: machine ? null : displayedIdentity.email ?? null,
                     // Cognito subject of the person shown in `email` (null for machine
@@ -162,7 +195,7 @@ export function registerWhoamiCommand(program) {
                         ? identity.delegatedEmail : null,
                     delegatedSub: identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined
                         ? identity.delegatedSub : null,
-                    personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
+                    personUid,
                     agentUid,
                     username: machineCreds?.username ?? null,
                     planLimits,

package/dist/lib/bot/fleet-local.d.ts

@@ -324,7 +324,9 @@ export declare function pipeInheritedStdio(stdio: unknown): {
  */
 export declare function windowsExtractionPathProblem(destination: string, longest: number, longPathsEnabled: number | null): string | null;
 /** Moves a fresh machine credential into the bot's secure store and deletes the file. */
-export declare function importFleetLocalMachineCredential(agentUid: string, machineCredentials: string, deps?: FleetLocalControlDeps): void;
+export declare function importFleetLocalMachineCredential(agentUid: string, machineCredentials: string, deps?: FleetLocalControlDeps, opts?: {
+    keepSource?: boolean;
+}): void;
 export declare function bootstrapFleetLocalBot(input: FleetLocalProfileInput & {
     machineCredentials?: string;
 }, deps?: FleetLocalBootstrapDeps): Promise<FleetLocalBootstrapResult>;

package/dist/lib/bot/fleet-local.js

@@ -79,15 +79,15 @@ export function sharedRuntimeLayout(root, id, platform) {
 }
 export const HQ_FLEET_LOCAL_RELEASE = {
     repository: "indigoai-us/hq-fleet-local",
-    tag: "v0.4.20",
-    version: "0.4.20",
-    artifact: "hq-fleet-local-0.4.20.zip",
-    artifactSha256: "5c49402f17408f3eaf99d27b3c2d4d0f59a24f33946aa8dfc3098a3d09e13798",
-    runtimeArtifact: "hq-fleet-runtime-abccac13bd9e.tar",
-    runtimeArtifactSha256: "29bcfe718ad7fbd3636afd00623772f2a25bc84c4f6f10d8d57f38e549d528d5",
-    manifestSha256: "3cec47eb7f47af13e66d4ad29669d3c103e1ca452661f5eaad760243118ce214",
-    signatureSha256: "5504c3a956f36d148f3cdf2212a9b171d852098c82eb199c7c415ad3545e3b05",
-    runtimeCommit: "abccac13bd9ea593b24c8cd9c0ba28d5c6050cc9",
+    tag: "v0.4.21",
+    version: "0.4.21",
+    artifact: "hq-fleet-local-0.4.21.zip",
+    artifactSha256: "24162dcc733fdc4a8e7a3482f5b2c445f5b6af96acf1695dd7dc5c7803272e3f",
+    runtimeArtifact: "hq-fleet-runtime-24211b85a414.tar",
+    runtimeArtifactSha256: "9084d88147bc9d70052aa00cc963eec2f80525bf61539d22abf45497712bd8b2",
+    manifestSha256: "5b52bd4f071470941ab1cd9a4f6baf614179f70073f60bfdf63f8a7ba38aa7ad",
+    signatureSha256: "85c35d5b2ca365503c408cd83a6d19758382f2e3049840fa055860e6f2d21746",
+    runtimeCommit: "24211b85a414441bac6405d862b1c872b44a78a1",
 };
 /** hq-fleet-local trust/release-public.pem (rotated 2026-10-30; signed v0.4.17). */
 export const HQ_FLEET_LOCAL_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
@@ -1585,7 +1585,7 @@ function assertWindowsExtractionFits(run, python, archive, destination) {
         throw expectedError(problem);
 }
 /** Moves a fresh machine credential into the bot's secure store and deletes the file. */
-export function importFleetLocalMachineCredential(agentUid, machineCredentials, deps = {}) {
+export function importFleetLocalMachineCredential(agentUid, machineCredentials, deps = {}, opts = {}) {
     const run = deps.run ?? execFileSync;
     const files = fleetLocalExecutables(agentUid, deps);
     const machineValue = fs.readFileSync(machineCredentials, "utf8").trim();
@@ -1600,7 +1600,8 @@ export function importFleetLocalMachineCredential(agentUid, machineCredentials,
         "--bot-id",
         agentUid,
     ], { input: machineValue, stdio: ["pipe", "ignore", "pipe"] }, "machine credential import");
-    fs.rmSync(machineCredentials, { force: true });
+    if (!opts.keepSource)
+        fs.rmSync(machineCredentials, { force: true });
 }
 async function installSharedFleetRuntime(installation, root, python, platform, run, spawn) {
     const identity = digest(Buffer.from(JSON.stringify({

package/dist/lib/bot/legacy-convert.d.ts

@@ -0,0 +1,15 @@
+import { type BotConfig } from "./config.js";
+export declare const KEEP_LEGACY_RUNTIME_ENV = "HQ_BOT_KEEP_LEGACY_RUNTIME";
+export type LegacyConversionDecision = {
+    convert: true;
+} | {
+    convert: false;
+    reason: "already-fleet" | "kept-by-env" | "needs-sign-in" | "own-claude-account";
+};
+export declare function legacyConversionDecision(config: Pick<BotConfig, "engine" | "runtime" | "runtimeAuth">, env?: NodeJS.ProcessEnv): LegacyConversionDecision;
+/** How long a legacy runner's own start skips the move after one failed. */
+export declare const FLEET_MOVE_RETRY_MS: number;
+export declare function fleetMoveFailurePath(dir: string): string;
+export declare function writeFleetMoveFailure(dir: string, now?: Date): void;
+export declare function fleetMoveRecentlyFailed(dir: string, now?: number): boolean;
+//# sourceMappingURL=legacy-convert.d.ts.map

package/dist/lib/bot/legacy-convert.js

@@ -0,0 +1,38 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { HQ_FLEET_RUNTIME_ENGINE_ID } from "./config.js";
+export const KEEP_LEGACY_RUNTIME_ENV = "HQ_BOT_KEEP_LEGACY_RUNTIME";
+export function legacyConversionDecision(config, env = process.env) {
+    if (config.engine?.id === HQ_FLEET_RUNTIME_ENGINE_ID)
+        return { convert: false, reason: "already-fleet" };
+    if (env[KEEP_LEGACY_RUNTIME_ENV] === "1")
+        return { convert: false, reason: "kept-by-env" };
+    if (config.runtime !== "claude")
+        return { convert: false, reason: "needs-sign-in" };
+    if (config.runtimeAuth?.claude)
+        return { convert: false, reason: "own-claude-account" };
+    return { convert: true };
+}
+/** How long a legacy runner's own start skips the move after one failed. */
+export const FLEET_MOVE_RETRY_MS = 60 * 60 * 1000;
+export function fleetMoveFailurePath(dir) {
+    return path.join(dir, "fleet-move-failed.json");
+}
+export function writeFleetMoveFailure(dir, now = new Date()) {
+    try {
+        fs.writeFileSync(fleetMoveFailurePath(dir), JSON.stringify({ at: now.toISOString() }) + "\n", { mode: 0o600 });
+    }
+    catch {
+        /* the next start just tries again */
+    }
+}
+export function fleetMoveRecentlyFailed(dir, now = Date.now()) {
+    try {
+        const at = Date.parse(JSON.parse(fs.readFileSync(fleetMoveFailurePath(dir), "utf8")).at ?? "");
+        return Number.isFinite(at) && now - at < FLEET_MOVE_RETRY_MS;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=legacy-convert.js.map

package/dist/lib/hot-channels/loop.d.ts

@@ -12,6 +12,12 @@ export interface HotChannelRunResult {
     /** Adapter id, or the catalog provider when it did not resolve. */
     adapterId: string;
     provider: string;
+    /**
+     * The adapter's channel (`sources/{channel}/`). Set once the adapter
+     * resolves, so the signals pass can drain that channel's worklist even
+     * when the run landed nothing.
+     */
+    channel?: string;
     /** The connection this run used; null for a channel with no connection. */
     connectionId: string | null;
     transport: HotTransport | null;

package/dist/lib/hot-channels/loop.js

@@ -209,6 +209,7 @@ export async function runHotChannelLoop(input) {
         try {
             const adapter = input.registry.resolve(entry);
             result.adapterId = adapter.id;
+            result.channel = adapter.channel;
             result.transport = adapter.transport;
             if (adapter.transport === "push") {
                 await drainPush(ctx, adapter, result);

package/dist/lib/hot-channels/signals-pass.d.ts

@@ -1,9 +1,22 @@
 /**
- * The local signals pass (US-011). After a hot-channel run lands sources, the
- * pass takes the run's landed documents through the ontology worklist, asks
+ * The local signals pass (US-011). After each hot-channel adapter run, the
+ * pass takes the adapter's channel through the ontology worklist, asks
  * `claude -p` for signals one document at a time, and writes those signals to
  * `companies/{co}/signals/`. It returns the count for the run ledger.
  *
+ * Work comes from the worklist, not only from this run's landings: when the
+ * worklist script exits 0, the pass takes the channel's unprocessed items in
+ * the worklist's order (newest first) up to the run's document cap. Items the
+ * cap leaves over stay unmarked, and a later run picks them up, including a
+ * run that landed nothing (a bounded backlog drain: at most
+ * DEFAULT_MAX_SIGNAL_DOCS claude calls per run, and no claude call at all when
+ * the backlog is empty). A channel with no source.yaml (worklist exit 2, the
+ * usual case for a hot channel such as `meeting-events`) has no worklist, so
+ * the pass keeps its own backlog: landed documents it has not processed yet
+ * are listed in `sources/_signals-pending/{channel}.json` and drained, newest
+ * first by `when` (else `created_at`), on later runs under the same cap. A
+ * cloud-run source (exit 4) is skipped.
+ *
  * A landed document with both `payload_ref` and `raw_ref` is a pointer (the
  * meetings, Slack and Attio adapters land these). For it, claude gets the
  * pointer followed by the document `payload_ref` names, capped at
@@ -118,6 +131,24 @@ interface ParsedSignal {
 }
 export declare function defaultPromptFile(): string;
 export declare const CLAUDE_LOGGED_OUT_RE: RegExp;
+export declare function channelOf(key: string): string | null;
+/**
+ * Vault-relative file that lists a channel's landed documents the pass has not
+ * processed yet. Only channels with no worklist (no source.yaml) use it.
+ */
+export declare function pendingSignalsKey(channel: string): string;
+/** The channel's pending landed keys; a missing or unreadable file is an empty backlog. */
+export declare function readPendingSignals(vaultRoot: string, channel: string): Promise<string[]>;
+/** Replace the channel's pending list; an empty list removes the file. */
+export declare function writePendingSignals(vaultRoot: string, channel: string, keys: readonly string[], beforeWrite?: () => Promise<void>): Promise<void>;
+/** Add landed keys to the channel's pending list (kept once each). */
+export declare function queuePendingSignals(vaultRoot: string, channel: string, keys: readonly string[], beforeWrite?: () => Promise<void>): Promise<void>;
+/** When a landed document happened: `when`, else `created_at`; unknown sorts last. */
+export declare function landedDocTime(frontmatter: Record<string, unknown>): number;
+export declare function splitFrontmatter(text: string): {
+    frontmatter: Record<string, unknown>;
+    body: string;
+};
 /**
  * The text claude gets for one landed document. A pointer (both `payload_ref`
  * and `raw_ref` set) gets its payload appended after a separator line. Any