@indigoai-us/hq-cli 5.345.197 → 5.345.199

package/dist/lib/bot/claude-login.js

@@ -0,0 +1,160 @@
+/**
+ * Can a Claude bot on the HQ Fleet Runtime read a Claude Code login here?
+ *
+ * The runtime never runs the `claude` binary; it calls Anthropic with the
+ * owner's Claude Code OAuth token, read in this order (its
+ * `resolve_anthropic_token`): ANTHROPIC_TOKEN, CLAUDE_CODE_OAUTH_TOKEN and
+ * ANTHROPIC_API_KEY from the environment, the HQ Fleet login file,
+ * ~/.claude/.credentials.json, then the macOS Keychain item
+ * "Claude Code-credentials". This mirrors that order so `hq doctor` and
+ * `hq bot create` can say which sources were checked and why each failed,
+ * without printing a token.
+ */
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fleetHome } from "./fleet-local.js";
+export const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+export const CLAUDE_LOGIN_ENV_VARS = ["ANTHROPIC_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+function readKeychainWithSecurity() {
+    try {
+        const stdout = execFileSync("security", ["find-generic-password", "-s", CLAUDE_KEYCHAIN_SERVICE, "-w"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 5000,
+        });
+        return { code: 0, stdout, stderr: "" };
+    }
+    catch (error) {
+        const failure = error;
+        const stderr = failure.stderr ? String(failure.stderr) : (failure.message ?? "");
+        return { code: typeof failure.status === "number" ? failure.status : -1, stdout: "", stderr };
+    }
+}
+function oauthRecord(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const record = value;
+    const accessToken = typeof record.accessToken === "string" ? record.accessToken.trim() : "";
+    if (!accessToken)
+        return null;
+    return {
+        accessToken,
+        refreshToken: typeof record.refreshToken === "string" ? record.refreshToken : "",
+        expiresAt: typeof record.expiresAt === "number" ? record.expiresAt : 0,
+    };
+}
+function describeRecord(record, now) {
+    if (!record.expiresAt || now < record.expiresAt - 60_000) {
+        return { status: "ok", reason: "access token present and not expired", usable: true };
+    }
+    if (record.refreshToken) {
+        return { status: "expired", reason: "access token expired; the bot refreshes it with the refresh token", usable: true };
+    }
+    return { status: "expired", reason: "access token expired and no refresh token", usable: false };
+}
+function readJsonFile(file) {
+    if (!fs.existsSync(file))
+        return { parsed: null, problem: `${file} does not exist` };
+    try {
+        return { parsed: JSON.parse(fs.readFileSync(file, "utf8")), problem: null };
+    }
+    catch (error) {
+        return { parsed: null, problem: `${file} could not be read (${error.message})` };
+    }
+}
+export function checkClaudeCodeLogin(deps = {}) {
+    const env = deps.env ?? process.env;
+    const home = deps.home ?? os.homedir();
+    const platform = deps.platform ?? process.platform;
+    const now = (deps.now ?? Date.now)();
+    const sources = [];
+    let via = null;
+    const found = (source) => {
+        if (via === null)
+            via = source;
+    };
+    for (const name of CLAUDE_LOGIN_ENV_VARS) {
+        const set = !!env[name]?.trim();
+        sources.push({ source: `env:${name}`, status: set ? "ok" : "missing", reason: set ? "set" : "not set in this environment" });
+        if (set)
+            found(`env:${name}`);
+    }
+    const fleetLogin = path.join(fleetHome(home, env), ".anthropic_oauth.json");
+    const fleetFile = readJsonFile(fleetLogin);
+    const fleetRecord = fleetFile.parsed ? oauthRecord(fleetFile.parsed) : null;
+    if (fleetRecord) {
+        const described = describeRecord(fleetRecord, now);
+        sources.push({ source: "hq_fleet_oauth_file", status: described.status, reason: described.reason });
+        if (described.usable)
+            found("hq_fleet_oauth_file");
+    }
+    else {
+        sources.push({ source: "hq_fleet_oauth_file", status: "missing", reason: fleetFile.problem ?? `${fleetLogin} holds no access token` });
+    }
+    const credentialsFile = path.join(home, ".claude", ".credentials.json");
+    const claudeFile = readJsonFile(credentialsFile);
+    const claudeRecord = claudeFile.parsed ? oauthRecord(claudeFile.parsed.claudeAiOauth) : null;
+    if (claudeRecord) {
+        const described = describeRecord(claudeRecord, now);
+        sources.push({ source: "claude_code_credentials_file", status: described.status, reason: described.reason });
+        if (described.usable)
+            found("claude_code_credentials_file");
+    }
+    else {
+        sources.push({
+            source: "claude_code_credentials_file",
+            status: "missing",
+            reason: claudeFile.problem ?? `${credentialsFile} holds no claudeAiOauth access token`,
+        });
+    }
+    if (platform !== "darwin") {
+        sources.push({ source: "macos_keychain", status: "skipped", reason: "not macOS" });
+    }
+    else {
+        const read = (deps.readKeychain ?? readKeychainWithSecurity)();
+        if (read.code !== 0) {
+            const detail = read.stderr.replace(/\s+/g, " ").trim().slice(0, 200) || `exit ${read.code}`;
+            sources.push({ source: "macos_keychain", status: "missing", reason: `no readable '${CLAUDE_KEYCHAIN_SERVICE}' item (${detail})` });
+        }
+        else {
+            let payload;
+            try {
+                payload = JSON.parse(read.stdout.trim());
+            }
+            catch {
+                payload = null;
+            }
+            const record = payload && typeof payload === "object" ? oauthRecord(payload.claudeAiOauth) : null;
+            if (record) {
+                const described = describeRecord(record, now);
+                sources.push({ source: "macos_keychain", status: described.status, reason: described.reason });
+                if (described.usable)
+                    found("macos_keychain");
+            }
+            else {
+                sources.push({ source: "macos_keychain", status: "missing", reason: "keychain item has no claudeAiOauth access token" });
+            }
+        }
+    }
+    return { signedIn: via !== null, via, sources };
+}
+const SOURCE_LABELS = {
+    hq_fleet_oauth_file: "the HQ Fleet login file",
+    claude_code_credentials_file: "~/.claude/.credentials.json",
+    macos_keychain: "the macOS Keychain",
+};
+/** One sentence listing every source that did not yield a login. */
+export function describeClaudeLoginSources(check) {
+    const parts = check.sources
+        .filter((entry) => entry.status !== "ok" && entry.status !== "skipped")
+        .map((entry) => `${SOURCE_LABELS[entry.source] ?? entry.source.replace("env:", "")}: ${entry.reason}`);
+    return parts.length ? `Checked ${parts.join("; ")}.` : "";
+}
+export function claudeLoginFix(botName) {
+    return botName
+        ? `Run \`claude /login\` in a terminal on this computer, then \`hq bot restart ${botName}\`.`
+        : "Run `claude /login` in a terminal on this computer, then retry.";
+}
+//# sourceMappingURL=claude-login.js.map

package/dist/lib/bot/company-bind.d.ts

@@ -11,6 +11,7 @@
  * Coverage note: Claude bots get the full company hook set (their session id
  * is in the hook payload). Codex/Grok bots only see HQ_SESSION_ID in the env.
  */
+import { type BotConfig, type BotKind } from "./config.js";
 export interface CompanyBindFs {
     existsSync: (p: string) => boolean;
     readFileSync: (p: string) => string;
@@ -24,4 +25,37 @@ export declare function ensureBotSessionMeta(hqRoot: string, sessionId: string,
     created: boolean;
     changed: boolean;
 };
+/** The company a bot's sessions are locked to, and where that company came from. */
+export interface BotCompanyBinding {
+    slug?: string;
+    /** True when the slug was read from the HQ's company list rather than bot.json. */
+    inferred: boolean;
+}
+/**
+ * Every entry in <hqRoot>/companies/manifest.yaml except `personal` and
+ * `_template`; [] when unreadable. Entries are not filtered by slug shape: an
+ * uppercase id such as `cmp_01K...` is still a company, and dropping it would
+ * make a two-company HQ look like a one-company HQ.
+ */
+export declare function readManifestCompanies(hqRoot: string): string[];
+/**
+ * The company a bot's turns are locked to. An explicit `companySlug` wins. A
+ * company bot with exactly one membership binds it. A personal bot (a legacy
+ * bot.json without `kind` is personal) binds the HQ's only company when its
+ * manifest lists exactly one; with two or more it stays unbound and never
+ * guesses. The setup bot is always unbound: it creates companies. Without a
+ * lock the scope guard blocks the turn and the model asks "which company?" in
+ * every channel, scheduled jobs included.
+ */
+export declare function resolveBotCompanyBinding(config: Pick<BotConfig, "kind" | "companies" | "workerId" | "companySlug" | "hqRoot">, readCompanies?: (hqRoot: string) => string[]): BotCompanyBinding;
+/** The fingerprint ensureBotCompanyScope records for a bot's explicit company scope. */
+export declare function botCompanyScopeKey(kind: BotKind, companies: readonly string[], companySlug: string | undefined): string;
+/**
+ * The scope key a CLI before "personal" stopped counting as a membership wrote
+ * for a company bot whose bot.json lists "personal" (the restore path writes
+ * that list as is), or undefined for any other bot. Same memberships, same
+ * scope: the caller passes it as an equivalent key so the upgrade neither
+ * archives the bot's conversations nor refuses to start with pending work.
+ */
+export declare function legacyPersonalEntryScopeKey(config: Pick<BotConfig, "kind" | "companies" | "workerId" | "companySlug">): string | undefined;
 //# sourceMappingURL=company-bind.d.ts.map

package/dist/lib/bot/company-bind.js

@@ -13,6 +13,8 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { parseManifestSlugs } from "../core-utils/manifest-slugs.js";
+import { effectiveBotCompanies, effectiveBotKind, SETUP_BOT_WORKER_ID } from "./config.js";
 export const defaultCompanyBindFs = {
     existsSync: (p) => fs.existsSync(p),
     readFileSync: (p) => fs.readFileSync(p, "utf8"),
@@ -59,4 +61,114 @@ export function ensureBotSessionMeta(hqRoot, sessionId, companySlug, io = defaul
     io.writeFileSync(file, body);
     return { path: file, created: false, changed: true };
 }
+/**
+ * True when every company-level key line in the manifest is one parseManifestSlugs
+ * recognises. Company-level means two-space keys under `companies:`, or top-level
+ * keys when the manifest has no `companies:` map. Anything else there (quoted or
+ * digit-leading keys, tabs, other indentation, list items) returns false.
+ */
+function manifestKeysFullyParsed(text) {
+    const lines = text.split("\n").map((l) => (l.endsWith("\r") ? l.slice(0, -1) : l));
+    const meaningful = (l) => l.trim() !== "" && !/^\s*#/.test(l) && !/^(---|\.\.\.)\s*$/.test(l);
+    const header = lines.findIndex((l) => /^companies:[ \t]*$/.test(l));
+    if (header === -1) {
+        return lines.every((l) => !meaningful(l) || /^[A-Za-z][A-Za-z0-9_-]*:/.test(l) || /^[ ]/.test(l));
+    }
+    // With a `companies:` map, parseManifestSlugs still counts any other top-level
+    // key (`version:`, `deployments:`) as a company, so one would be bound. Only
+    // `unaffiliated_repos` and its list items may sit beside the map.
+    const topLevelOk = lines.every((l, i) => i === header || !meaningful(l) || /^[ \t]/.test(l) ||
+        /^unaffiliated_repos:/.test(l) || /^-(?:[ \t]|$)/.test(l));
+    if (!topLevelOk)
+        return false;
+    let level;
+    for (const l of lines.slice(header + 1)) {
+        if (!meaningful(l))
+            continue;
+        const indent = /^[ \t]*/.exec(l)[0];
+        if (indent === "")
+            break;
+        if (indent.includes("\t"))
+            return false;
+        level ??= indent.length;
+        if (level !== 2 || indent.length < level)
+            return false;
+        if (indent.length === 1 || indent.length === 3)
+            return false;
+        if (indent.length === level && !/^ {2}(?:[A-Za-z][A-Za-z0-9_-]*|_template):/.test(l))
+            return false;
+    }
+    return true;
+}
+/**
+ * Every entry in <hqRoot>/companies/manifest.yaml except `personal` and
+ * `_template`; [] when unreadable. Entries are not filtered by slug shape: an
+ * uppercase id such as `cmp_01K...` is still a company, and dropping it would
+ * make a two-company HQ look like a one-company HQ.
+ */
+export function readManifestCompanies(hqRoot) {
+    try {
+        // A byte order mark (Notepad's UTF-8) would hide the `companies:` header.
+        const text = fs.readFileSync(path.join(hqRoot, "companies", "manifest.yaml"), "utf8").replace(/^\uFEFF/, "");
+        // A company-level key the parser skips (quoted, digit-leading, odd indent) would
+        // be missed by the count and could make a multi-company HQ look single-company.
+        if (!manifestKeysFullyParsed(text))
+            return [];
+        return parseManifestSlugs(text).filter((slug) => slug !== "personal" && slug !== "_template");
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The company a bot's turns are locked to. An explicit `companySlug` wins. A
+ * company bot with exactly one membership binds it. A personal bot (a legacy
+ * bot.json without `kind` is personal) binds the HQ's only company when its
+ * manifest lists exactly one; with two or more it stays unbound and never
+ * guesses. The setup bot is always unbound: it creates companies. Without a
+ * lock the scope guard blocks the turn and the model asks "which company?" in
+ * every channel, scheduled jobs included.
+ */
+export function resolveBotCompanyBinding(config, readCompanies = readManifestCompanies) {
+    if (config.companySlug)
+        return { slug: config.companySlug, inferred: false };
+    const kind = effectiveBotKind(config);
+    if (kind === "company") {
+        const companies = effectiveBotCompanies(config);
+        return companies.length === 1 ? { slug: companies[0], inferred: false } : { inferred: false };
+    }
+    if (config.workerId === SETUP_BOT_WORKER_ID)
+        return { inferred: false };
+    const hq = readCompanies(config.hqRoot);
+    // Bind only when the one entry is also a valid slug; the count above is unfiltered.
+    return hq.length === 1 && COMPANY_SLUG_RE.test(hq[0]) ? { slug: hq[0], inferred: true } : { inferred: false };
+}
+/** The fingerprint ensureBotCompanyScope records for a bot's explicit company scope. */
+export function botCompanyScopeKey(kind, companies, companySlug) {
+    return JSON.stringify({ kind, companies: [...companies].sort(), companySlug: companySlug ?? null });
+}
+/**
+ * The scope key a CLI before "personal" stopped counting as a membership wrote
+ * for a company bot whose bot.json lists "personal" (the restore path writes
+ * that list as is), or undefined for any other bot. Same memberships, same
+ * scope: the caller passes it as an equivalent key so the upgrade neither
+ * archives the bot's conversations nor refuses to start with pending work.
+ */
+export function legacyPersonalEntryScopeKey(config) {
+    const kind = effectiveBotKind(config);
+    if (kind !== "company")
+        return undefined;
+    const raw = (config.companies ?? []).map((entry) => (typeof entry === "string" ? entry.trim() : ""));
+    if (!raw.includes("personal"))
+        return undefined;
+    const members = effectiveBotCompanies(config);
+    const listed = [];
+    for (const slug of raw) {
+        if ((slug === "personal" || members.includes(slug)) && !listed.includes(slug))
+            listed.push(slug);
+    }
+    // The old rule: an explicit companySlug, else the single listed entry.
+    const slug = config.companySlug ?? (listed.length === 1 ? listed[0] : undefined);
+    return botCompanyScopeKey(kind, listed, slug);
+}
 //# sourceMappingURL=company-bind.js.map

package/dist/lib/bot/config.js

@@ -73,7 +73,9 @@ export function effectiveBotCompanies(config) {
     const listed = [];
     for (const raw of config.companies ?? []) {
         const slug = typeof raw === "string" ? raw.trim() : "";
-        if (slug && COMPANY_SLUG_RE.test(slug) && !listed.includes(slug))
+        // "personal" is the reserved no-company scope, never a membership: counting it
+        // made a one-company bot look multi-company and left its sessions unbound.
+        if (slug && slug !== "personal" && COMPANY_SLUG_RE.test(slug) && !listed.includes(slug))
             listed.push(slug);
     }
     return listed;

package/dist/lib/bot/events.d.ts

@@ -0,0 +1,18 @@
+import type { InboxItem } from "./api.js";
+import { type LocalJob } from "./local-jobs.js";
+/** Rotate journals at five MiB without discarding unread records. */
+export declare const EVENT_ROTATE_BYTES: number;
+export declare const EVENT_PAYLOAD_BYTES: number;
+export interface BotEvent {
+    event: string;
+    at: string;
+    payload: Record<string, unknown>;
+}
+export declare function validateEventPayload(payload: unknown): asserts payload is Record<string, unknown>;
+export declare function emitBotEvent(dir: string, event: string, payload: unknown, now?: Date, alreadyEmitted?: (record: BotEvent) => boolean): BotEvent;
+export declare function eventMatches(job: LocalJob, record: BotEvent): boolean;
+/** Pending items survive a crash between queueing and the next poll. */
+export declare function drainBotEvents(dir: string): InboxItem[];
+export declare function ackBotEvent(dir: string, messageId: string): void;
+export declare function tailBotEvents(dir: string, predicate?: (event: BotEvent) => boolean): BotEvent[];
+//# sourceMappingURL=events.d.ts.map

package/dist/lib/bot/events.js

@@ -0,0 +1,160 @@
+/** Local event journal and durable inbox. Cursor and queued deliveries commit together. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { randomUUID } from "node:crypto";
+import { readLocalJobsStrict, withJobsLock } from "./local-jobs.js";
+/** Rotate journals at five MiB without discarding unread records. */
+export const EVENT_ROTATE_BYTES = 5 * 1024 * 1024;
+export const EVENT_PAYLOAD_BYTES = 16 * 1024;
+const journal = "events.jsonl";
+const stateFile = "events-state.json";
+export function validateEventPayload(payload) {
+    if (!payload || typeof payload !== "object" || Array.isArray(payload))
+        throw new Error("Event payload must be a JSON object.");
+    if (Buffer.byteLength(JSON.stringify(payload), "utf8") >= EVENT_PAYLOAD_BYTES)
+        throw new Error("Event payload must be under 16 KB.");
+}
+function readState(dir) {
+    try {
+        const state = JSON.parse(fs.readFileSync(path.join(dir, stateFile), "utf8"));
+        if (state.v !== 1 || !state.cursors || !Array.isArray(state.pending))
+            throw new Error("Invalid event state");
+        return state;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { v: 1, cursors: {}, pending: [] };
+        throw err; // Never reset a corrupt cursor and replay the journal.
+    }
+}
+function writeState(dir, state) {
+    const file = path.join(dir, stateFile);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(state), { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+function files(dir) {
+    return fs.readdirSync(dir).filter((f) => /^events\.\d+-[a-f0-9-]+\.jsonl$/.test(f)).sort().concat(journal);
+}
+/** A persisted intent makes both sides of the journal rename recoverable. */
+function recoverRotation(dir, state) {
+    if (!state.rotating)
+        return;
+    const archived = state.rotating;
+    if (!fs.existsSync(path.join(dir, archived))) {
+        fs.renameSync(path.join(dir, journal), path.join(dir, archived));
+    }
+    state.cursors[archived] = state.cursors[journal] ?? 0;
+    delete state.cursors[journal];
+    delete state.rotating;
+    writeState(dir, state);
+}
+export function emitBotEvent(dir, event, payload, now = new Date(), alreadyEmitted) {
+    if (!event.trim() || event.length > 256 || /[\r\n]/.test(event))
+        throw new Error("Event name must be 1–256 characters without newlines.");
+    validateEventPayload(payload);
+    const record = { event, at: now.toISOString(), payload };
+    return withJobsLock(dir, () => {
+        const state = readState(dir);
+        recoverRotation(dir, state);
+        // Optional producer idempotency: scan and append under the same lock as
+        // rotation, including archived journals and only fully written lines.
+        if (alreadyEmitted) {
+            for (const name of files(dir)) {
+                const candidate = path.join(dir, name);
+                if (!fs.existsSync(candidate))
+                    continue;
+                const lines = fs.readFileSync(candidate, "utf8").split("\n").slice(0, -1);
+                for (const line of lines.filter(Boolean)) {
+                    const prior = JSON.parse(line);
+                    if (alreadyEmitted(prior))
+                        return prior;
+                }
+            }
+        }
+        const file = path.join(dir, journal);
+        const bytes = fs.existsSync(file) ? fs.readFileSync(file) : Buffer.alloc(0);
+        // A process killed during append may leave an incomplete final line.
+        // It was never accepted as an event: discard it before the next append,
+        // otherwise that next valid record would join it and poison the drain.
+        const size = bytes.length && bytes.at(-1) !== 10 ? bytes.lastIndexOf(10) + 1 : bytes.length;
+        if (size !== bytes.length)
+            fs.truncateSync(file, size);
+        if (size >= EVENT_ROTATE_BYTES) {
+            state.rotating = `events.${Date.now()}-${randomUUID()}.jsonl`;
+            writeState(dir, state);
+            recoverRotation(dir, state);
+        }
+        fs.appendFileSync(file, `${JSON.stringify(record)}\n`, { mode: 0o600 });
+        return record;
+    });
+}
+export function eventMatches(job, record) {
+    return job.trigger?.kind === "event" && job.trigger.event === record.event &&
+        Object.entries(job.trigger.filter ?? {}).every(([key, value]) => {
+            if (!Object.hasOwn(record.payload, key))
+                return false;
+            // JSON objects can shadow toString/valueOf with non-callable fields.
+            // Such a value cannot match a string filter and must not poison the drain.
+            try {
+                return String(record.payload[key]) === value;
+            }
+            catch {
+                return false;
+            }
+        });
+}
+/** Pending items survive a crash between queueing and the next poll. */
+export function drainBotEvents(dir) {
+    return withJobsLock(dir, () => {
+        const state = readState(dir);
+        recoverRotation(dir, state);
+        const jobs = readLocalJobsStrict(dir);
+        for (const name of files(dir)) {
+            const file = path.join(dir, name);
+            if (!fs.existsSync(file))
+                continue;
+            let offset = state.cursors[name] ?? 0;
+            // Consumed archives need only a stat, not a full read on every poll.
+            if (offset === fs.statSync(file).size)
+                continue;
+            const bytes = fs.readFileSync(file);
+            if (offset > bytes.length)
+                throw new Error(`Event journal was truncated: ${name}`);
+            while (offset < bytes.length) {
+                const end = bytes.indexOf(10, offset);
+                if (end < 0)
+                    break; // An interrupted append is never treated as a full event.
+                const record = JSON.parse(bytes.subarray(offset, end).toString("utf8"));
+                validateEventPayload(record.payload);
+                for (const job of jobs.filter((j) => eventMatches(j, record))) {
+                    state.pending.push({
+                        messageId: `localjob-event-${randomUUID()}`, channel: "job", jobId: job.jobId,
+                        prompt: job.prompt, firedAt: record.at, receivedAt: record.at,
+                        context: { ...job.context, payload: record.payload, event: record },
+                    });
+                }
+                offset = end + 1;
+            }
+            state.cursors[name] = offset;
+        }
+        writeState(dir, state);
+        return state.pending;
+    });
+}
+export function ackBotEvent(dir, messageId) {
+    withJobsLock(dir, () => {
+        const state = readState(dir);
+        state.pending = state.pending.filter((item) => item.messageId !== messageId);
+        writeState(dir, state);
+    });
+}
+export function tailBotEvents(dir, predicate = () => true) {
+    return withJobsLock(dir, () => files(dir).flatMap((name) => {
+        const file = path.join(dir, name);
+        if (!fs.existsSync(file))
+            return [];
+        return fs.readFileSync(file, "utf8").split("\n").slice(0, -1).filter(Boolean).map((line) => JSON.parse(line));
+    }).filter(predicate).slice(-50));
+}
+//# sourceMappingURL=events.js.map

package/dist/lib/bot/executive-settings.d.ts

@@ -0,0 +1,10 @@
+import { type BotConfig } from "./config.js";
+export declare function executiveRiderEnabled(home?: string): boolean;
+export declare function isExecutiveBot(config: Pick<BotConfig, "name" | "kind" | "workerId">, home?: string): boolean;
+export declare function executiveStatus(config: Pick<BotConfig, "name" | "kind" | "workerId">, dir: string, home?: string): {
+    is_executive: boolean;
+    rider_enabled: boolean;
+    detect_source_last: string | null;
+    last_detected_at: string | null;
+};
+//# sourceMappingURL=executive-settings.d.ts.map

package/dist/lib/bot/executive-settings.js

@@ -0,0 +1,43 @@
+/** Shared Executive identity and the desktop's default-on rider preference. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { effectiveBotKind } from "./config.js";
+import { tailBotEvents } from "./events.js";
+export function executiveRiderEnabled(home = os.homedir()) {
+    try {
+        const settings = JSON.parse(fs.readFileSync(path.join(home, ".hq/menubar.json"), "utf8"));
+        return settings?.executiveMeetingRider?.enabled !== false;
+    }
+    catch (err) {
+        return err.code === "ENOENT";
+    }
+}
+export function isExecutiveBot(config, home = os.homedir()) {
+    if (effectiveBotKind(config) !== "personal")
+        return false;
+    let name = "setup";
+    try {
+        const value = JSON.parse(fs.readFileSync(path.join(home, ".hq/executive.json"), "utf8"));
+        if (value?.bot != null) {
+            if (typeof value.bot !== "string" || !value.bot.trim())
+                return false;
+            name = value.bot;
+        }
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            return false;
+    }
+    return config.name === name;
+}
+export function executiveStatus(config, dir, home = os.homedir()) {
+    const last = tailBotEvents(dir, (event) => event.event === "meeting.detected").at(-1);
+    return {
+        is_executive: isExecutiveBot(config, home), rider_enabled: executiveRiderEnabled(home),
+        // The first desktop producer did not set source.
+        detect_source_last: last ? (last.payload.source === "poll" ? "poll" : "desktop") : null,
+        last_detected_at: last?.at ?? null,
+    };
+}
+//# sourceMappingURL=executive-settings.js.map

package/dist/lib/bot/fleet-cron.js

@@ -169,6 +169,10 @@ export function migrateLegacyJobsToFleet(dir, config, ops, now = new Date()) {
         const skipped = [];
         const moved = new Set();
         for (const job of legacy) {
+            if (job.trigger || !job.cron) {
+                skipped.push(job.jobId);
+                continue;
+            }
             let schedule;
             try {
                 schedule = /^(cron|rate)\(/i.test(job.cron.trim()) ? fleetScheduleFromLegacy(job.cron) : job.cron.trim();

package/dist/lib/bot/fleet-local.d.ts

@@ -60,6 +60,8 @@ export interface FleetLocalInstallDeps {
     fetch?: typeof fetch;
     token?: () => string;
     hqReleaseLinks?: (release: FleetLocalReleasePin) => Promise<Map<string, string> | null>;
+    /** Like `hqReleaseLinks`, but also says why HQ had no links. */
+    hqReleaseLookup?: (release: FleetLocalReleasePin) => Promise<HqFleetReleaseLinkLookup>;
     now?: () => Date;
     release?: FleetLocalReleasePin;
     publicKey?: string | readonly string[];
@@ -205,6 +207,16 @@ export declare function fleetLocalCliCompatibilityWarning(manifest: Buffer, rele
 /** `gh auth token` fallback for the release download token. */
 export declare const FLEET_RELEASE_TOKEN_TIMEOUT_MS = 15000;
 export declare function resolveFleetReleaseToken(env?: NodeJS.ProcessEnv, run?: FleetLocalExec): string;
+/** Why HQ gave no download links: no usable person sign-in, or no copy of the release. */
+export type HqFleetReleaseLinkMissing = "signed_out" | "not_published";
+export interface HqFleetReleaseLinkLookup {
+    links: Map<string, string> | null;
+    reason: HqFleetReleaseLinkMissing | null;
+}
+export declare function lookupHqFleetReleaseLinks(release: FleetLocalReleasePin, deps?: {
+    token?: () => Promise<string>;
+    fetchApi?: typeof vaultApiFetch;
+}): Promise<HqFleetReleaseLinkLookup>;
 export declare function fetchHqFleetReleaseLinks(release: FleetLocalReleasePin): Promise<Map<string, string> | null>;
 export declare const FLEET_LOCAL_LATEST_TIMEOUT_MS = 5000;
 export declare const FLEET_LOCAL_LATEST_CACHE_MS: number;