@indigoai-us/hq-cli 5.345.197 → 5.345.198

package/dist/commands/integrations-connect.js

@@ -365,6 +365,39 @@ function withDocumentedRemoteMcp(target, domainHint) {
         },
     };
 }
+/**
+ * Google Workspace is a built-in OAuth connector (provider `google-workspace`,
+ * its own `/v1/integrations/google-workspace/connect` flow), not a remote MCP
+ * catalog entry. The CLI has no way to start that flow, so a bare `google` fell
+ * through to an install by free-text query, which hq-pro answers with
+ * "mcpUrl is required" because no catalog entry or domain resolves. The console
+ * is the surface that runs the built-in sign-in, so route there.
+ */
+const BUILT_IN_CONSOLE_APPS = {
+    google: "Google Workspace",
+    "google-workspace": "Google Workspace",
+    "google workspace": "Google Workspace",
+    google_workspace: "Google Workspace",
+};
+function builtInConsoleApp(app) {
+    return BUILT_IN_CONSOLE_APPS[app?.trim().toLowerCase() ?? ""];
+}
+/**
+ * hq-pro rejects an install/sign-in that names neither an endpoint nor a
+ * resolvable catalog entry or domain with a bare "mcpUrl is required". That is
+ * the caller's name not matching anything, so say so and name the way forward.
+ */
+function explainUnresolvableApp(target, err) {
+    if (!(err instanceof IntegrationsCliError) ||
+        err.code !== "DIRECT_MCP_INVALID_INPUT" ||
+        target.ref.mcpUrl ||
+        target.ref.discoveryReceiptId ||
+        target.ref.catalogEntryId) {
+        return err;
+    }
+    return new IntegrationsCliError(`${target.label} was not found in the app catalog, so HQ has no MCP server address for it. ` +
+        "Search with `hq integrations catalog <name>`, or re-run with --mcp-url <endpoint>.", { expected: true, status: err.status, code: err.code });
+}
 function unsupportedCatalogSurfaceError(label, cause) {
     return new IntegrationsCliError(`${label} cannot be connected because the app catalog has no MCP server URL. ` +
         "Re-run with --mcp-url <endpoint> (find it with `hq integrations inspect`).", { expected: true, status: cause.status, code: cause.code });
@@ -1100,6 +1133,11 @@ function reportInstall(result, opts, expectedRevivedConnectionId) {
  * URL: hq-pro recognizes the domain and revives the revoked row in place.
  */
 async function connectApp(token, companyUid, app, opts, expectedRevivedConnectionId) {
+    const builtIn = opts.mcpUrl || opts.docsUrl || opts.entryId ? undefined : builtInConsoleApp(app);
+    if (builtIn) {
+        await consoleHandoff({ ref: {}, label: builtIn }, opts);
+        return;
+    }
     const resolved = await resolveTarget(token, companyUid, app, opts, expectedRevivedConnectionId !== undefined);
     const scope = connectScopeFromOptions(opts);
     const target = scope ? { ...resolved, ref: { ...resolved.ref, scope } } : resolved;
@@ -1130,7 +1168,7 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
                 await finishWithAccessKey();
                 return;
             }
-            throw err;
+            throw explainUnresolvableApp(target, err);
         }
         return;
     }
@@ -1174,7 +1212,7 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
                     await finishWithAccessKey(bearerToken);
                     return;
                 }
-                throw oauthErr;
+                throw explainUnresolvableApp(target, oauthErr);
             }
             return;
         }
@@ -1182,7 +1220,7 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
             err.code === "INTEGRATION_FACTORY_UNSUPPORTED_SURFACE") {
             throw unsupportedCatalogSurfaceError(target.label, err);
         }
-        throw err;
+        throw explainUnresolvableApp(target, err);
     }
 }
 /**

package/dist/commands/secrets.js

@@ -2,7 +2,7 @@ import { assertScriptUnchanged, planScriptBinding, selectChildLaunch } from "../
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
-import { assertApiKeyCompany, buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
+import { assertApiKeyCompany, assertDelegatedMachineSessionUsable, buildSecretUsage, callerIsCompanyOutpost, companyOutpostIdentityFromToken, companyOutpostReadDenialMessage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, resolveSecretsReadCompanyUid, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
 import { readSessionCompanyLock } from "../lib/session-company-lock.js";
 import { sessionIdFromEnv } from "../lib/core-utils/session-id.js";
 import { appendPersonalSecretsAudit, isEntityScopeRef, PERSONAL_SCOPE_READ_ONLY_MESSAGE, } from "../lib/personal-secrets-audit.js";
@@ -797,6 +797,7 @@ export function registerSecretsCommand(program) {
         .option("--reveal", "Include the decrypted secret value")
         .action(async (name, opts) => {
         try {
+            assertDelegatedMachineSessionUsable();
             const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets get", secretsCredentialOptions());
             if (cred.kind === "api-key") {
                 if (!opts.reveal) {
@@ -848,7 +849,7 @@ export function registerSecretsCommand(program) {
                 return;
             }
             const token = cred.token;
-            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
+            const companyUid = await resolveSecretsReadCompanyUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: buildSecretNamePath(companyUid, name),
@@ -862,6 +863,16 @@ export function registerSecretsCommand(program) {
                     console.error(chalk.red(highSecuritySandboxOnlyMessage(name)));
                     process.exit(1);
                 }
+                // A company Outpost gets a code-less 403 both for an unshared secret
+                // and for an inactive binding; say both, as the reveal path does.
+                const outpost = companyOutpostIdentityFromToken(token);
+                const outpostDenial = outpost
+                    ? companyOutpostReadDenialMessage(name, res.status, body, companyUid, outpost)
+                    : null;
+                if (outpostDenial) {
+                    console.error(chalk.red(outpostDenial));
+                    process.exit(1);
+                }
                 console.error(chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
@@ -1384,9 +1395,17 @@ export function registerSecretsCommand(program) {
             // interactive session last ran a hook, and the job would read that
             // session's company's same-named secret. Without a session id the caller
             // must name its scope. HQ_API_KEY is exempt: the key is bound to one
-            // company and never reads the session lock below.
+            // company and never reads the session lock below. A company Outpost job
+            // is exempt too: its machine identity names its one bound company.
+            // An unusable HQ_MACHINE_SESSION_FILE fails here, naming the file,
+            // before the scope check below can report a generic error.
+            assertDelegatedMachineSessionUsable();
             const hasCallerSession = Boolean(sessionIdFromEnv(process.env));
-            if (!hasCallerSession && !requestedCompany && !parentScope.personal && peekHqApiKey() === undefined) {
+            if (!hasCallerSession &&
+                !requestedCompany &&
+                !parentScope.personal &&
+                peekHqApiKey() === undefined &&
+                !callerIsCompanyOutpost()) {
                 console.error(chalk.red("Error:"), SECRETS_EXEC_UNATTENDED_NO_COMPANY_MESSAGE);
                 process.exit(SECRETS_EXEC_UNATTENDED_NO_COMPANY_EXIT);
             }
@@ -1454,7 +1473,7 @@ export function registerSecretsCommand(program) {
                     ?? (unlockedApiKeyCompanyRef
                         ? await assertApiKeyCompany(cred.token, unlockedApiKeyCompanyRef, "secrets exec")
                         : "__api_key__"))
-                : await getEntityUid(cred.token, secretScope, { allowOfflineScopeFallback: true });
+                : await resolveSecretsReadCompanyUid(cred.token, secretScope, { allowOfflineScopeFallback: true });
             if (entityScopeRef && companyUid !== entityScopeRef) {
                 throw new Error("Another person's personal vault is outside this session's scope; refusing.");
             }
@@ -1482,8 +1501,10 @@ export function registerSecretsCommand(program) {
             const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, execUsage, { allowOfflineFallback: true, lockModes });
             // API-key auth has no signed-in person identity for the CLI telemetry
             // endpoint. Do not attribute that read to an unrelated cached session.
+            // hq-pro refuses every route but the secret read to a company Outpost,
+            // telemetry included, so an Outpost read sends no telemetry event.
             let revealed;
-            if (cred.kind === "cognito") {
+            if (cred.kind === "cognito" && !companyOutpostIdentityFromToken(cred.token)) {
                 const { withCliFeatureUsed } = await import("../utils/cli-telemetry.js");
                 revealed = await withCliFeatureUsed("secret_read", readSecrets, companyUid);
             }

package/dist/lib/bot/company-bind.d.ts

@@ -11,6 +11,7 @@
  * Coverage note: Claude bots get the full company hook set (their session id
  * is in the hook payload). Codex/Grok bots only see HQ_SESSION_ID in the env.
  */
+import { type BotConfig, type BotKind } from "./config.js";
 export interface CompanyBindFs {
     existsSync: (p: string) => boolean;
     readFileSync: (p: string) => string;
@@ -24,4 +25,37 @@ export declare function ensureBotSessionMeta(hqRoot: string, sessionId: string,
     created: boolean;
     changed: boolean;
 };
+/** The company a bot's sessions are locked to, and where that company came from. */
+export interface BotCompanyBinding {
+    slug?: string;
+    /** True when the slug was read from the HQ's company list rather than bot.json. */
+    inferred: boolean;
+}
+/**
+ * Every entry in <hqRoot>/companies/manifest.yaml except `personal` and
+ * `_template`; [] when unreadable. Entries are not filtered by slug shape: an
+ * uppercase id such as `cmp_01K...` is still a company, and dropping it would
+ * make a two-company HQ look like a one-company HQ.
+ */
+export declare function readManifestCompanies(hqRoot: string): string[];
+/**
+ * The company a bot's turns are locked to. An explicit `companySlug` wins. A
+ * company bot with exactly one membership binds it. A personal bot (a legacy
+ * bot.json without `kind` is personal) binds the HQ's only company when its
+ * manifest lists exactly one; with two or more it stays unbound and never
+ * guesses. The setup bot is always unbound: it creates companies. Without a
+ * lock the scope guard blocks the turn and the model asks "which company?" in
+ * every channel, scheduled jobs included.
+ */
+export declare function resolveBotCompanyBinding(config: Pick<BotConfig, "kind" | "companies" | "workerId" | "companySlug" | "hqRoot">, readCompanies?: (hqRoot: string) => string[]): BotCompanyBinding;
+/** The fingerprint ensureBotCompanyScope records for a bot's explicit company scope. */
+export declare function botCompanyScopeKey(kind: BotKind, companies: readonly string[], companySlug: string | undefined): string;
+/**
+ * The scope key a CLI before "personal" stopped counting as a membership wrote
+ * for a company bot whose bot.json lists "personal" (the restore path writes
+ * that list as is), or undefined for any other bot. Same memberships, same
+ * scope: the caller passes it as an equivalent key so the upgrade neither
+ * archives the bot's conversations nor refuses to start with pending work.
+ */
+export declare function legacyPersonalEntryScopeKey(config: Pick<BotConfig, "kind" | "companies" | "workerId" | "companySlug">): string | undefined;
 //# sourceMappingURL=company-bind.d.ts.map

package/dist/lib/bot/company-bind.js

@@ -13,6 +13,8 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { parseManifestSlugs } from "../core-utils/manifest-slugs.js";
+import { effectiveBotCompanies, effectiveBotKind, SETUP_BOT_WORKER_ID } from "./config.js";
 export const defaultCompanyBindFs = {
     existsSync: (p) => fs.existsSync(p),
     readFileSync: (p) => fs.readFileSync(p, "utf8"),
@@ -59,4 +61,114 @@ export function ensureBotSessionMeta(hqRoot, sessionId, companySlug, io = defaul
     io.writeFileSync(file, body);
     return { path: file, created: false, changed: true };
 }
+/**
+ * True when every company-level key line in the manifest is one parseManifestSlugs
+ * recognises. Company-level means two-space keys under `companies:`, or top-level
+ * keys when the manifest has no `companies:` map. Anything else there (quoted or
+ * digit-leading keys, tabs, other indentation, list items) returns false.
+ */
+function manifestKeysFullyParsed(text) {
+    const lines = text.split("\n").map((l) => (l.endsWith("\r") ? l.slice(0, -1) : l));
+    const meaningful = (l) => l.trim() !== "" && !/^\s*#/.test(l) && !/^(---|\.\.\.)\s*$/.test(l);
+    const header = lines.findIndex((l) => /^companies:[ \t]*$/.test(l));
+    if (header === -1) {
+        return lines.every((l) => !meaningful(l) || /^[A-Za-z][A-Za-z0-9_-]*:/.test(l) || /^[ ]/.test(l));
+    }
+    // With a `companies:` map, parseManifestSlugs still counts any other top-level
+    // key (`version:`, `deployments:`) as a company, so one would be bound. Only
+    // `unaffiliated_repos` and its list items may sit beside the map.
+    const topLevelOk = lines.every((l, i) => i === header || !meaningful(l) || /^[ \t]/.test(l) ||
+        /^unaffiliated_repos:/.test(l) || /^-(?:[ \t]|$)/.test(l));
+    if (!topLevelOk)
+        return false;
+    let level;
+    for (const l of lines.slice(header + 1)) {
+        if (!meaningful(l))
+            continue;
+        const indent = /^[ \t]*/.exec(l)[0];
+        if (indent === "")
+            break;
+        if (indent.includes("\t"))
+            return false;
+        level ??= indent.length;
+        if (level !== 2 || indent.length < level)
+            return false;
+        if (indent.length === 1 || indent.length === 3)
+            return false;
+        if (indent.length === level && !/^ {2}(?:[A-Za-z][A-Za-z0-9_-]*|_template):/.test(l))
+            return false;
+    }
+    return true;
+}
+/**
+ * Every entry in <hqRoot>/companies/manifest.yaml except `personal` and
+ * `_template`; [] when unreadable. Entries are not filtered by slug shape: an
+ * uppercase id such as `cmp_01K...` is still a company, and dropping it would
+ * make a two-company HQ look like a one-company HQ.
+ */
+export function readManifestCompanies(hqRoot) {
+    try {
+        // A byte order mark (Notepad's UTF-8) would hide the `companies:` header.
+        const text = fs.readFileSync(path.join(hqRoot, "companies", "manifest.yaml"), "utf8").replace(/^\uFEFF/, "");
+        // A company-level key the parser skips (quoted, digit-leading, odd indent) would
+        // be missed by the count and could make a multi-company HQ look single-company.
+        if (!manifestKeysFullyParsed(text))
+            return [];
+        return parseManifestSlugs(text).filter((slug) => slug !== "personal" && slug !== "_template");
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The company a bot's turns are locked to. An explicit `companySlug` wins. A
+ * company bot with exactly one membership binds it. A personal bot (a legacy
+ * bot.json without `kind` is personal) binds the HQ's only company when its
+ * manifest lists exactly one; with two or more it stays unbound and never
+ * guesses. The setup bot is always unbound: it creates companies. Without a
+ * lock the scope guard blocks the turn and the model asks "which company?" in
+ * every channel, scheduled jobs included.
+ */
+export function resolveBotCompanyBinding(config, readCompanies = readManifestCompanies) {
+    if (config.companySlug)
+        return { slug: config.companySlug, inferred: false };
+    const kind = effectiveBotKind(config);
+    if (kind === "company") {
+        const companies = effectiveBotCompanies(config);
+        return companies.length === 1 ? { slug: companies[0], inferred: false } : { inferred: false };
+    }
+    if (config.workerId === SETUP_BOT_WORKER_ID)
+        return { inferred: false };
+    const hq = readCompanies(config.hqRoot);
+    // Bind only when the one entry is also a valid slug; the count above is unfiltered.
+    return hq.length === 1 && COMPANY_SLUG_RE.test(hq[0]) ? { slug: hq[0], inferred: true } : { inferred: false };
+}
+/** The fingerprint ensureBotCompanyScope records for a bot's explicit company scope. */
+export function botCompanyScopeKey(kind, companies, companySlug) {
+    return JSON.stringify({ kind, companies: [...companies].sort(), companySlug: companySlug ?? null });
+}
+/**
+ * The scope key a CLI before "personal" stopped counting as a membership wrote
+ * for a company bot whose bot.json lists "personal" (the restore path writes
+ * that list as is), or undefined for any other bot. Same memberships, same
+ * scope: the caller passes it as an equivalent key so the upgrade neither
+ * archives the bot's conversations nor refuses to start with pending work.
+ */
+export function legacyPersonalEntryScopeKey(config) {
+    const kind = effectiveBotKind(config);
+    if (kind !== "company")
+        return undefined;
+    const raw = (config.companies ?? []).map((entry) => (typeof entry === "string" ? entry.trim() : ""));
+    if (!raw.includes("personal"))
+        return undefined;
+    const members = effectiveBotCompanies(config);
+    const listed = [];
+    for (const slug of raw) {
+        if ((slug === "personal" || members.includes(slug)) && !listed.includes(slug))
+            listed.push(slug);
+    }
+    // The old rule: an explicit companySlug, else the single listed entry.
+    const slug = config.companySlug ?? (listed.length === 1 ? listed[0] : undefined);
+    return botCompanyScopeKey(kind, listed, slug);
+}
 //# sourceMappingURL=company-bind.js.map

package/dist/lib/bot/config.js

@@ -73,7 +73,9 @@ export function effectiveBotCompanies(config) {
     const listed = [];
     for (const raw of config.companies ?? []) {
         const slug = typeof raw === "string" ? raw.trim() : "";
-        if (slug && COMPANY_SLUG_RE.test(slug) && !listed.includes(slug))
+        // "personal" is the reserved no-company scope, never a membership: counting it
+        // made a one-company bot look multi-company and left its sessions unbound.
+        if (slug && slug !== "personal" && COMPANY_SLUG_RE.test(slug) && !listed.includes(slug))
             listed.push(slug);
     }
     return listed;

package/dist/lib/bot/fleet-local.d.ts

@@ -60,6 +60,8 @@ export interface FleetLocalInstallDeps {
     fetch?: typeof fetch;
     token?: () => string;
     hqReleaseLinks?: (release: FleetLocalReleasePin) => Promise<Map<string, string> | null>;
+    /** Like `hqReleaseLinks`, but also says why HQ had no links. */
+    hqReleaseLookup?: (release: FleetLocalReleasePin) => Promise<HqFleetReleaseLinkLookup>;
     now?: () => Date;
     release?: FleetLocalReleasePin;
     publicKey?: string | readonly string[];
@@ -205,6 +207,16 @@ export declare function fleetLocalCliCompatibilityWarning(manifest: Buffer, rele
 /** `gh auth token` fallback for the release download token. */
 export declare const FLEET_RELEASE_TOKEN_TIMEOUT_MS = 15000;
 export declare function resolveFleetReleaseToken(env?: NodeJS.ProcessEnv, run?: FleetLocalExec): string;
+/** Why HQ gave no download links: no usable person sign-in, or no copy of the release. */
+export type HqFleetReleaseLinkMissing = "signed_out" | "not_published";
+export interface HqFleetReleaseLinkLookup {
+    links: Map<string, string> | null;
+    reason: HqFleetReleaseLinkMissing | null;
+}
+export declare function lookupHqFleetReleaseLinks(release: FleetLocalReleasePin, deps?: {
+    token?: () => Promise<string>;
+    fetchApi?: typeof vaultApiFetch;
+}): Promise<HqFleetReleaseLinkLookup>;
 export declare function fetchHqFleetReleaseLinks(release: FleetLocalReleasePin): Promise<Map<string, string> | null>;
 export declare const FLEET_LOCAL_LATEST_TIMEOUT_MS = 5000;
 export declare const FLEET_LOCAL_LATEST_CACHE_MS: number;

package/dist/lib/bot/fleet-local.js

@@ -394,15 +394,15 @@ export function resolveFleetReleaseToken(env = process.env, run = execFileSync)
     }
     throw expectedError("HQ could not provide the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
 }
-export async function fetchHqFleetReleaseLinks(release) {
+export async function lookupHqFleetReleaseLinks(release, deps = {}) {
     let token;
     try {
-        token = await ensureCognitoToken({ tokenSource: "person", interactive: false });
+        token = await (deps.token ?? (() => ensureCognitoToken({ tokenSource: "person", interactive: false })))();
     }
     catch {
-        return null;
+        return { links: null, reason: "signed_out" };
     }
-    const response = await vaultApiFetch({
+    const response = await (deps.fetchApi ?? vaultApiFetch)({
         token,
         path: `/v1/fleet-local/releases/${encodeURIComponent(release.version)}`,
         signal: AbortSignal.timeout(FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
@@ -411,7 +411,7 @@ export async function fetchHqFleetReleaseLinks(release) {
         throw expectedError("HQ refused the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
     }
     if (response.status === 404)
-        return null;
+        return { links: null, reason: "not_published" };
     if (!response.ok) {
         throw expectedError(`Could not get the HQ Fleet Local ${release.tag} download: HQ returned HTTP ${response.status}.`);
     }
@@ -421,7 +421,22 @@ export async function fetchHqFleetReleaseLinks(release) {
         if (typeof asset.name === "string" && typeof asset.url === "string")
             links.set(asset.name, asset.url);
     }
-    return links.size > 0 ? links : null;
+    return links.size > 0 ? { links, reason: null } : { links: null, reason: "not_published" };
+}
+export async function fetchHqFleetReleaseLinks(release) {
+    return (await lookupHqFleetReleaseLinks(release)).links;
+}
+/** The error for a machine that has neither HQ links nor a GitHub token, naming which one HQ lacked. */
+function noReleaseSourceError(release, reason) {
+    if (reason === "not_published") {
+        return expectedError(`HQ has not published HQ Fleet Runtime ${release.version} for download yet. ` +
+            "Retry in a few minutes; if it keeps failing, report it with `hq bug`.");
+    }
+    if (reason === "signed_out") {
+        return expectedError("The HQ sign-in on this machine could not be used to get the HQ Fleet Runtime download. " +
+            "Run `hq login` and retry.");
+    }
+    return null;
 }
 export const FLEET_LOCAL_LATEST_TIMEOUT_MS = 5_000;
 export const FLEET_LOCAL_LATEST_CACHE_MS = 10 * 60_000;
@@ -769,11 +784,26 @@ export async function installPinnedFleetLocalDistribution(deps = {}) {
     }
     else {
         const fetcher = deps.fetch ?? fetch;
-        const links = await (deps.hqReleaseLinks ?? fetchHqFleetReleaseLinks)(release);
+        const lookup = deps.hqReleaseLinks
+            ? { links: await deps.hqReleaseLinks(release), reason: null }
+            : await (deps.hqReleaseLookup ?? lookupHqFleetReleaseLinks)(release);
+        const links = lookup.links;
         const cachedRuntime = cachedRuntimeArchive(root, release);
-        const files = links
-            ? await downloadFleetLocalReleaseFromHq(release, fetcher, links, cachedRuntime)
-            : await downloadFleetLocalRelease(release, fetcher, (deps.token ?? resolveFleetReleaseToken)(), cachedRuntime);
+        let files;
+        if (links) {
+            files = await downloadFleetLocalReleaseFromHq(release, fetcher, links, cachedRuntime);
+        }
+        else {
+            let githubToken;
+            try {
+                githubToken = (deps.token ?? resolveFleetReleaseToken)();
+            }
+            catch (error) {
+                // A customer has no GitHub token; say why HQ had no download instead of asking them to sign in again.
+                throw noReleaseSourceError(release, lookup.reason) ?? error;
+            }
+            files = await downloadFleetLocalRelease(release, fetcher, githubToken, cachedRuntime);
+        }
         verifyFleetLocalRelease(files, release, publicKey);
         warnCompatibility(files.manifest);
         installFiles(dir, files, release, publicKey);

package/dist/lib/bot/run.js

@@ -58,7 +58,7 @@ import { fullJitterDelayMs } from "../mesh/live/backoff.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock } from "../mesh/live/daemon/pid-lock.js";
 import { BotApiError } from "./api.js";
 import { effectiveBotCompanies, effectiveBotKind, patchBotConfig, readBotConfig, resolveBotMemoryDir, SETUP_BOT_WORKER_ID } from "./config.js";
-import { ensureBotSessionMeta } from "./company-bind.js";
+import { botCompanyScopeKey, ensureBotSessionMeta, legacyPersonalEntryScopeKey, readManifestCompanies, resolveBotCompanyBinding } from "./company-bind.js";
 import { readBotCredsIdentity } from "./creds.js";
 import { isProcessed, markProcessed, readInboxState } from "./inbox-state.js";
 import { clearInflight, patchInflight, readInflight, readInflightTurns, writeInflight } from "./inflight.js";
@@ -531,10 +531,24 @@ export async function runBot(deps) {
     const kind = effectiveBotKind(config);
     const companies = effectiveBotCompanies(config);
     // A single membership is unambiguous; personal and multi-company bots stay unbound.
-    const companySlug = config.companySlug ?? (kind === "company" && companies.length === 1 ? companies[0] : undefined);
-    const companyScopeKey = kind === "company" || companySlug !== undefined
-        ? JSON.stringify({ kind, companies: [...companies].sort(), companySlug: companySlug ?? null })
+    const binding = resolveBotCompanyBinding(config);
+    const companySlug = binding.slug;
+    // What bot.json alone says; a lock inferred from the manifest is not part of it.
+    const startExplicitSlug = resolveBotCompanyBinding(config, () => []).slug;
+    // The explicit scope: bot.json's kind, memberships and company. A lock inferred
+    // from the HQ's company list is not part of it.
+    const companyScopeKey = kind === "company" || (companySlug !== undefined && !binding.inferred)
+        ? botCompanyScopeKey(kind, companies, companySlug)
         : undefined;
+    // A personal bot with no explicit company records the company it inferred (or
+    // null when unbound) beside that key. When the HQ's company list changes, its
+    // conversations are archived instead of resumed under a lock they were not
+    // created under. The first inferred lock keeps existing history.
+    const inferredScopeSlug = companyScopeKey === undefined && kind === "personal" && config.workerId !== SETUP_BOT_WORKER_ID
+        ? (binding.inferred ? binding.slug ?? null : null)
+        : undefined;
+    // The key an older CLI wrote when bot.json lists "personal": the same scope.
+    const legacyScopeKey = legacyPersonalEntryScopeKey(config);
     const lockDeps = defaultPidLockDeps({
         pid,
         ...(deps.isProcessAlive ? { isProcessAlive: deps.isProcessAlive } : {}),
@@ -679,7 +693,10 @@ export async function runBot(deps) {
         return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     try {
-        const scope = ensureBotCompanyScope(dir, companyScopeKey);
+        const scope = ensureBotCompanyScope(dir, companyScopeKey, {
+            ...(inferredScopeSlug !== undefined ? { inferredSlug: inferredScopeSlug } : {}),
+            ...(legacyScopeKey !== undefined && legacyScopeKey !== companyScopeKey ? { equivalentKeys: [legacyScopeKey] } : {}),
+        });
         if (scope.reset)
             log("info", "company scope changed or was unverified; archived prior conversations before starting fresh");
     }
@@ -1102,14 +1119,24 @@ export async function runBot(deps) {
      * prepended so a one-word reply still has the question it answers.
      */
     const bindingNotices = new Set();
+    let bindingNoticeLogged = false;
     const executeTurn = async (prompt, sessionScope, tReceived, stream = {}, historyEventId) => {
         const fresh = readBotConfig(dir);
         if (!fresh)
             throw new CompanyBindingError(`I couldn't read my company settings. Please restart ${config.name} after restoring its configuration; this work is still pending.`);
         const live = fresh;
         const liveCompanies = effectiveBotCompanies(live);
-        const liveCompanySlug = live.companySlug ?? (effectiveBotKind(live) === "company" && liveCompanies.length === 1 ? liveCompanies[0] : undefined);
-        if (liveCompanySlug !== companySlug || effectiveBotKind(live) !== kind ||
+        // Explicit settings only: a lock inferred from the HQ's company list is
+        // fixed at start, so an owner who creates or joins a company never fails a turn.
+        const liveCompanySlug = resolveBotCompanyBinding(live, () => []).slug;
+        if (binding.inferred && !bindingNoticeLogged) {
+            const hqNow = readManifestCompanies(config.hqRoot);
+            if (!(hqNow.length === 1 && hqNow[0] === companySlug)) {
+                bindingNoticeLogged = true;
+                log("warn", `${config.name}: this HQ's company list changed since start; keeping the start-time lock to ${companySlug} until the next restart.`);
+            }
+        }
+        if (liveCompanySlug !== startExplicitSlug || effectiveBotKind(live) !== kind ||
             JSON.stringify([...liveCompanies].sort()) !== JSON.stringify([...companies].sort())) {
             throw new CompanyBindingError(`My company settings changed. Please restart ${config.name} to load them before I continue; this work is still pending.`);
         }
@@ -1171,7 +1198,7 @@ export async function runBot(deps) {
             let bind = { env };
             if (companySlug) {
                 try {
-                    ensureBotSessionMeta(config.hqRoot, sid, liveCompanySlug, undefined, now);
+                    ensureBotSessionMeta(config.hqRoot, sid, companySlug, undefined, now);
                 }
                 catch {
                     throw new CompanyBindingError(`I couldn't bind this session to ${companySlug}. Please check the bot's workspace permissions and retry; this work is still pending.`);

package/dist/lib/bot/session.d.ts

@@ -18,6 +18,24 @@ export interface BotSessionFile {
 export declare function readBotSession(dir: string, runtime: BotRuntimeId, scope?: BotSessionScope): BotSessionFile | null;
 export declare function writeBotSession(dir: string, session: BotSessionFile, scope?: BotSessionScope): void;
 export declare function clearBotSession(dir: string, scope?: BotSessionScope): void;
+export interface BotCompanyScopeOptions {
+    /**
+     * Keys an earlier CLI wrote for this same scope. A marker holding one is
+     * rewritten to the current key in place: nothing is archived and pending
+     * work is kept. Used for a company bot whose bot.json lists "personal",
+     * which no longer counts as a membership.
+     */
+    equivalentKeys?: readonly string[];
+    /**
+     * A personal bot with no explicit company (companyScopeKey undefined): the
+     * company its sessions are locked to because the HQ lists only that one, or
+     * null when it is unbound. A change from the recorded value archives the
+     * conversations, like an explicit scope change, so a session is never
+     * resumed under a lock it was not created under. Ignored when
+     * companyScopeKey is set.
+     */
+    inferredSlug?: string | null;
+}
 /**
  * Run once at startup, before reading or appending conversation state. A scope
  * change must never resume a prior company's model session or replay its DM
@@ -26,7 +44,7 @@ export declare function clearBotSession(dir: string, scope?: BotSessionScope): v
  * Legacy personal bots retain their existing history; company bots require
  * positive scope evidence and archive legacy, unproven conversations once.
  */
-export declare function ensureBotCompanyScope(dir: string, companyScopeKey: string | undefined): {
+export declare function ensureBotCompanyScope(dir: string, companyScopeKey: string | undefined, options?: BotCompanyScopeOptions): {
     reset: boolean;
     archiveDir?: string;
 };