@indigoai-us/hq-cli 5.345.197 → 5.345.199

package/dist/lib/bot/fleet-local.js

@@ -79,15 +79,15 @@ export function sharedRuntimeLayout(root, id, platform) {
 }
 export const HQ_FLEET_LOCAL_RELEASE = {
     repository: "indigoai-us/hq-fleet-local",
-    tag: "v0.4.22",
-    version: "0.4.22",
-    artifact: "hq-fleet-local-0.4.22.zip",
-    artifactSha256: "b12c01d48c8add7609de557f02987eaa7570223751446915835f52dc9b69d1db",
-    runtimeArtifact: "hq-fleet-runtime-f17ab10aa598.tar",
-    runtimeArtifactSha256: "a2296305a82af7f834804f4240705d791f0c08fa52257955dae3dce091d39ee8",
-    manifestSha256: "f3c62e4e64f91e0aeab32d0999a106c89122144c83757874c81781fb417c0392",
-    signatureSha256: "f07502b61b35431292c9d656f9e602f5230f8fb8ca093993ec92d4353077b4ba",
-    runtimeCommit: "f17ab10aa598d5915f47bf0b83d332a5cc243f98",
+    tag: "v0.4.24",
+    version: "0.4.24",
+    artifact: "hq-fleet-local-0.4.24.zip",
+    artifactSha256: "daa74b7aaf7f26d8c069f33aa94a453369fb2d7ae8c122e7fbe48a5b38e73f31",
+    runtimeArtifact: "hq-fleet-runtime-d257fdd1171f.tar",
+    runtimeArtifactSha256: "8262c5f28773d35c04f7f9ce6f61ed19a88e601847f9d12d5ab11fb5d8e87fb0",
+    manifestSha256: "302d2206957b815a846db583a49e7862948fd8a8a36aaff8e0e8a6e0aa7a1b9c",
+    signatureSha256: "efee90b00c6eb1d0f53a76e93a756435975c9da6c70c9c0b505aafcce79a586a",
+    runtimeCommit: "d257fdd1171f1edd5e381b3bad7baacab0cb00d3",
 };
 /** hq-fleet-local trust/release-public.pem (rotated 2026-10-30; signed v0.4.17). */
 export const HQ_FLEET_LOCAL_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
@@ -394,15 +394,15 @@ export function resolveFleetReleaseToken(env = process.env, run = execFileSync)
     }
     throw expectedError("HQ could not provide the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
 }
-export async function fetchHqFleetReleaseLinks(release) {
+export async function lookupHqFleetReleaseLinks(release, deps = {}) {
     let token;
     try {
-        token = await ensureCognitoToken({ tokenSource: "person", interactive: false });
+        token = await (deps.token ?? (() => ensureCognitoToken({ tokenSource: "person", interactive: false })))();
     }
     catch {
-        return null;
+        return { links: null, reason: "signed_out" };
     }
-    const response = await vaultApiFetch({
+    const response = await (deps.fetchApi ?? vaultApiFetch)({
         token,
         path: `/v1/fleet-local/releases/${encodeURIComponent(release.version)}`,
         signal: AbortSignal.timeout(FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
@@ -411,7 +411,7 @@ export async function fetchHqFleetReleaseLinks(release) {
         throw expectedError("HQ refused the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
     }
     if (response.status === 404)
-        return null;
+        return { links: null, reason: "not_published" };
     if (!response.ok) {
         throw expectedError(`Could not get the HQ Fleet Local ${release.tag} download: HQ returned HTTP ${response.status}.`);
     }
@@ -421,7 +421,22 @@ export async function fetchHqFleetReleaseLinks(release) {
         if (typeof asset.name === "string" && typeof asset.url === "string")
             links.set(asset.name, asset.url);
     }
-    return links.size > 0 ? links : null;
+    return links.size > 0 ? { links, reason: null } : { links: null, reason: "not_published" };
+}
+export async function fetchHqFleetReleaseLinks(release) {
+    return (await lookupHqFleetReleaseLinks(release)).links;
+}
+/** The error for a machine that has neither HQ links nor a GitHub token, naming which one HQ lacked. */
+function noReleaseSourceError(release, reason) {
+    if (reason === "not_published") {
+        return expectedError(`HQ has not published HQ Fleet Runtime ${release.version} for download yet. ` +
+            "Retry in a few minutes; if it keeps failing, report it with `hq bug`.");
+    }
+    if (reason === "signed_out") {
+        return expectedError("The HQ sign-in on this machine could not be used to get the HQ Fleet Runtime download. " +
+            "Run `hq login` and retry.");
+    }
+    return null;
 }
 export const FLEET_LOCAL_LATEST_TIMEOUT_MS = 5_000;
 export const FLEET_LOCAL_LATEST_CACHE_MS = 10 * 60_000;
@@ -769,11 +784,26 @@ export async function installPinnedFleetLocalDistribution(deps = {}) {
     }
     else {
         const fetcher = deps.fetch ?? fetch;
-        const links = await (deps.hqReleaseLinks ?? fetchHqFleetReleaseLinks)(release);
+        const lookup = deps.hqReleaseLinks
+            ? { links: await deps.hqReleaseLinks(release), reason: null }
+            : await (deps.hqReleaseLookup ?? lookupHqFleetReleaseLinks)(release);
+        const links = lookup.links;
         const cachedRuntime = cachedRuntimeArchive(root, release);
-        const files = links
-            ? await downloadFleetLocalReleaseFromHq(release, fetcher, links, cachedRuntime)
-            : await downloadFleetLocalRelease(release, fetcher, (deps.token ?? resolveFleetReleaseToken)(), cachedRuntime);
+        let files;
+        if (links) {
+            files = await downloadFleetLocalReleaseFromHq(release, fetcher, links, cachedRuntime);
+        }
+        else {
+            let githubToken;
+            try {
+                githubToken = (deps.token ?? resolveFleetReleaseToken)();
+            }
+            catch (error) {
+                // A customer has no GitHub token; say why HQ had no download instead of asking them to sign in again.
+                throw noReleaseSourceError(release, lookup.reason) ?? error;
+            }
+            files = await downloadFleetLocalRelease(release, fetcher, githubToken, cachedRuntime);
+        }
         verifyFleetLocalRelease(files, release, publicKey);
         warnCompatibility(files.manifest);
         installFiles(dir, files, release, publicKey);
@@ -1687,7 +1717,7 @@ async function installSharedFleetRuntime(installation, root, python, platform, r
 function writeNativeProfileMarker(profileDir, shared, engine) {
     const marker = path.join(profileDir, "bootstrap.json");
     const temporary = `${marker}.${process.pid}.${crypto.randomUUID()}`;
-    fs.writeFileSync(temporary, `${JSON.stringify({ schemaVersion: 2, runtimeId: shared.id, engine }, null, 2)}\n`, { mode: 0o600 });
+    fs.writeFileSync(temporary, `${JSON.stringify({ schemaVersion: 2, runtimeId: shared.id, engine, cliVersion: CLI_VERSION }, null, 2)}\n`, { mode: 0o600 });
     fs.renameSync(temporary, marker);
 }
 function removeEmbeddedRuntime(profileDir, platform = process.platform) {

package/dist/lib/bot/job-run.js

@@ -215,7 +215,7 @@ export function planJobRuns(items, handled) {
     const byJob = new Map();
     for (const item of items) {
         const job = readJobRun(item);
-        if (!job)
+        if (!job || item.messageId.startsWith("localjob-event-"))
             continue;
         const list = byJob.get(job.jobId);
         if (list)

package/dist/lib/bot/jobs/hot-signal-sync.d.ts

@@ -48,6 +48,12 @@ export declare const HOT_SIGNAL_SYNC_JOB_KIND = "hot-signal-sync";
  * own schedule in `jobs.json` is the one that runs.
  */
 export declare const HOT_SIGNAL_SYNC_DEFAULT_CRON = "cron(30 6 * * ? *)";
+interface BuiltinJobsMarker {
+    v: 1;
+    registered: Record<string, string>;
+}
+declare function readMarker(dir: string): BuiltinJobsMarker;
+declare function writeMarker(dir: string, marker: BuiltinJobsMarker): void;
 export declare function hotSignalSyncRegistered(dir: string, company: string): boolean;
 export declare function fleetHotSignalSyncRegistered(dir: string, company: string): boolean;
 export declare function markFleetHotSignalSyncRegistered(dir: string, company: string, now?: Date): void;
@@ -210,4 +216,6 @@ export interface HotSignalSyncRunOutcome {
 /** Run the scheduled sync once and describe it in plain words. Never throws. */
 export declare function runHotSignalSyncJob(input: HotSignalSyncRunInput): Promise<HotSignalSyncRunOutcome>;
 export declare function describeSyncReport(company: string, report: OnDemandSyncReport): string;
+/** Shared registration marker for additive built-in event jobs. */
+export { readMarker as readBuiltinJobsMarker, writeMarker as writeBuiltinJobsMarker };
 //# sourceMappingURL=hot-signal-sync.d.ts.map

package/dist/lib/bot/jobs/hot-signal-sync.js

@@ -430,4 +430,6 @@ export function describeSyncReport(company, report) {
         lines.push(notice);
     return lines.join("\n");
 }
+/** Shared registration marker for additive built-in event jobs. */
+export { readMarker as readBuiltinJobsMarker, writeMarker as writeBuiltinJobsMarker };
 //# sourceMappingURL=hot-signal-sync.js.map

package/dist/lib/bot/jobs/meeting-detect.d.ts

@@ -0,0 +1,28 @@
+import { type LiveMeetingBot } from "../../live-meetings.js";
+import type { BotConfig } from "../config.js";
+export declare function detectIntervalSeconds(hqRoot: string): number;
+/** Desktop events carry company UIDs; local rider files use manifest slugs. */
+export declare function normalizeDetectedCompany(hqRoot: string, payload: unknown): unknown;
+export interface MeetingDetectDeps {
+    hqRoot: string;
+    dir: string;
+    enabled: () => boolean;
+    companies: () => string[];
+    list: (company: string, signal: AbortSignal) => Promise<{
+        companyId: string;
+        bots: LiveMeetingBot[];
+    }>;
+    intervalSeconds?: () => number;
+    now?: () => Date;
+    log: (message: string) => void;
+}
+/** Live reads are keyed by Recall ID; the desktop may emit a saved meeting ID or SDK window ID. */
+export declare function resolveDetectedMeeting(hqRoot: string, payload: unknown, list: MeetingDetectDeps["list"]): Promise<unknown>;
+export declare function createMeetingDetect(deps: MeetingDetectDeps): {
+    /** Called by the inbox loop; network work never holds up inbox delivery. */
+    tick(): void;
+    settled(): Promise<void>;
+    stop(): Promise<void>;
+};
+export declare function defaultMeetingDetectDeps(config: BotConfig, dir: string, log: (message: string) => void): MeetingDetectDeps;
+//# sourceMappingURL=meeting-detect.d.ts.map

package/dist/lib/bot/jobs/meeting-detect.js

@@ -0,0 +1,176 @@
+/** No-model producer of the same event the desktop emits. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { randomUUID } from "node:crypto";
+import yaml from "js-yaml";
+import { fetchAttendedLiveBots } from "../../live-meetings.js";
+import { ensureCognitoToken } from "../../../utils/cognito-session.js";
+import { getCompanyUid } from "../../../utils/vault-api.js";
+import { assertSafeSegment } from "../../hot-channels/landing.js";
+import { readManifestCompanies } from "../company-bind.js";
+import { emitBotEvent } from "../events.js";
+import { executiveRiderEnabled, isExecutiveBot } from "../executive-settings.js";
+const RETENTION_MS = 24 * 60 * 60 * 1000;
+const ACTIVE = new Set(["joining", "recording", "in_call"]);
+export function detectIntervalSeconds(hqRoot) {
+    try {
+        const settings = yaml.load(fs.readFileSync(path.join(hqRoot, "core/settings/signals.yaml"), "utf8"));
+        const value = settings?.rider?.detect_interval_seconds;
+        return typeof value === "number" && Number.isFinite(value) ? Math.max(5, value) : 60;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+        return 60;
+    }
+}
+/** Desktop events carry company UIDs; local rider files use manifest slugs. */
+export function normalizeDetectedCompany(hqRoot, payload) {
+    if (!payload || typeof payload !== "object" || !("company" in payload) || typeof payload.company !== "string")
+        return payload;
+    const company = payload.company;
+    if (!company.startsWith("cmp_"))
+        return payload;
+    const manifest = yaml.load(fs.readFileSync(path.join(hqRoot, "companies/manifest.yaml"), "utf8"));
+    const slug = Object.entries(manifest?.companies ?? {}).find(([, value]) => value?.cloud_uid === company)?.[0];
+    return slug ? { ...payload, company: slug } : payload;
+}
+/** Live reads are keyed by Recall ID; the desktop may emit a saved meeting ID or SDK window ID. */
+export async function resolveDetectedMeeting(hqRoot, payload, list) {
+    const normalized = normalizeDetectedCompany(hqRoot, payload);
+    if (!normalized || typeof normalized !== "object")
+        return normalized;
+    const event = normalized;
+    if (event.source === "poll" || typeof event.company !== "string" || typeof event.meeting_url !== "string")
+        return normalized;
+    assertSafeSegment(event.company, "company");
+    const { companyId, bots } = await list(event.company, AbortSignal.timeout(15_000));
+    const row = bots.find((bot) => bot && (bot.companyId === undefined || bot.companyId === companyId) &&
+        typeof bot.status === "string" && ACTIVE.has(bot.status.toLowerCase().replaceAll("-", "_")) &&
+        ([bot.recallBotId, bot.botId, bot.meetingId].includes(String(event.meeting_id)) || bot.meetingUrl === event.meeting_url));
+    const id = row?.recallBotId || row?.botId || row?.meetingId;
+    return id ? { ...event, meeting_id: id } : normalized;
+}
+export function createMeetingDetect(deps) {
+    const now = deps.now ?? (() => new Date());
+    const controller = new AbortController();
+    let next = 0;
+    let disabledLogged = false;
+    let pending;
+    const poll = async () => {
+        // One slow or denied company must not delay detection in another company.
+        await Promise.all([...new Set(deps.companies())].map(async (company) => {
+            if (controller.signal.aborted || !deps.enabled())
+                return;
+            try {
+                assertSafeSegment(company, "company");
+                const root = path.join(deps.hqRoot, "workspace/executive/meetings", company);
+                const file = path.join(root, ".detected.json");
+                let stored = {};
+                try {
+                    stored = JSON.parse(fs.readFileSync(file, "utf8"));
+                }
+                catch (err) {
+                    if (err.code !== "ENOENT")
+                        throw err;
+                }
+                if (!stored || typeof stored !== "object" || Array.isArray(stored))
+                    throw new Error("Invalid detected ledger");
+                const time = now();
+                const seen = Object.fromEntries(Object.entries(stored).filter((entry) => typeof entry[1] === "string" && Date.parse(entry[1]) > time.getTime() - RETENTION_MS));
+                const { companyId, bots } = await deps.list(company, controller.signal);
+                if (controller.signal.aborted || !deps.enabled())
+                    return;
+                fs.mkdirSync(root, { recursive: true });
+                for (const bot of bots) {
+                    if (!bot || (bot.companyId !== undefined && bot.companyId !== companyId) || typeof bot.status !== "string" || !ACTIVE.has(bot.status.toLowerCase().replaceAll("-", "_")))
+                        continue;
+                    const id = bot.recallBotId || bot.botId || bot.meetingId;
+                    if (typeof id !== "string" || !id)
+                        continue;
+                    assertSafeSegment(id, "meeting id");
+                    if (Object.hasOwn(seen, id))
+                        continue;
+                    // Check aliases too: an older rider may have started with a Recall ID.
+                    const ids = [id, bot.recallBotId, bot.botId, bot.meetingId].filter((value) => typeof value === "string" && value.length > 0);
+                    for (const alias of ids)
+                        assertSafeSegment(alias, "meeting id");
+                    if (ids.some((alias) => [company, companyId].some((co) => {
+                        assertSafeSegment(co, "company");
+                        const base = path.join(deps.hqRoot, "workspace/executive/meetings", co, alias);
+                        return fs.existsSync(`${base}.rider.lock`) || fs.existsSync(`${base}.rider.json`);
+                    }))) {
+                        seen[id] = time.toISOString();
+                        continue;
+                    }
+                    const event = emitBotEvent(deps.dir, "meeting.detected", { meeting_id: id, company, source: "poll" }, time, (prior) => prior.event === "meeting.detected" && [company, companyId].includes(String(prior.payload.company)) && ids.includes(String(prior.payload.meeting_id)));
+                    seen[id] = event.at;
+                }
+                const tmp = `${file}.${randomUUID()}.tmp`;
+                try {
+                    fs.writeFileSync(tmp, JSON.stringify(seen), { mode: 0o600 });
+                    fs.renameSync(tmp, file);
+                }
+                finally {
+                    fs.rmSync(tmp, { force: true });
+                }
+            }
+            catch {
+                if (!controller.signal.aborted)
+                    deps.log(`meeting detection failed for ${company}`);
+            }
+        }));
+    };
+    return {
+        /** Called by the inbox loop; network work never holds up inbox delivery. */
+        tick() {
+            if (controller.signal.aborted || pending)
+                return;
+            if (!deps.enabled()) {
+                if (!disabledLogged) {
+                    deps.log("rider disabled");
+                    disabledLogged = true;
+                }
+                return;
+            }
+            if (now().getTime() < next)
+                return;
+            const seconds = deps.intervalSeconds?.() ?? 60;
+            next = now().getTime() + (Number.isFinite(seconds) ? Math.max(5, seconds) : 60) * 1000;
+            pending = poll().catch(() => deps.log("meeting detection failed")).finally(() => { pending = undefined; });
+        },
+        async settled() { await pending; },
+        async stop() { controller.abort(); await pending; },
+    };
+}
+/** Bound waiting even for shared auth/scope helpers that cannot cancel every internal call. */
+async function untilAborted(signal, work) {
+    signal.throwIfAborted();
+    let abort;
+    const cancelled = new Promise((_resolve, reject) => {
+        abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+    });
+    try {
+        return await Promise.race([work(), cancelled]);
+    }
+    finally {
+        signal.removeEventListener("abort", abort);
+    }
+}
+export function defaultMeetingDetectDeps(config, dir, log) {
+    return {
+        hqRoot: config.hqRoot, dir, log,
+        enabled: () => isExecutiveBot(config) && executiveRiderEnabled(),
+        companies: () => config.companySlug ? [config.companySlug] : readManifestCompanies(config.hqRoot),
+        intervalSeconds: () => detectIntervalSeconds(config.hqRoot),
+        list: async (company, signal) => {
+            const bounded = AbortSignal.any([signal, AbortSignal.timeout(15_000)]);
+            const token = await untilAborted(bounded, () => ensureCognitoToken({ interactive: false, signal: bounded }));
+            const companyId = company.startsWith("cmp_") ? company : await untilAborted(bounded, () => getCompanyUid(token, company));
+            const bots = await untilAborted(bounded, () => fetchAttendedLiveBots(token, companyId, true, bounded));
+            return { companyId, bots };
+        },
+    };
+}
+//# sourceMappingURL=meeting-detect.js.map

package/dist/lib/bot/jobs/meeting-rider.d.ts

@@ -0,0 +1,53 @@
+import { type BotConfig } from "../config.js";
+export { isExecutiveBot } from "../executive-settings.js";
+import { type LocalJob } from "../local-jobs.js";
+export declare const MEETING_RIDER_JOB_KIND = "meeting-rider";
+export declare const END_POLLS = 3;
+export interface MeetingIdentity {
+    meeting_id: string;
+    company: string;
+}
+export interface RiderRecord {
+    started_at: string;
+    ended_at?: string;
+    passes: number;
+    signals_written: string[];
+    lanes: string[];
+}
+export interface RiderDeps {
+    hqRoot: string;
+    dir: string;
+    bot: string;
+    /** Must check the authenticated owner's attended list in the requested company. */
+    live: (meeting: MeetingIdentity) => Promise<{
+        attended: boolean;
+        status: string;
+    }>;
+    runIncremental: (meeting: MeetingIdentity) => Promise<{
+        signal_ids: string[];
+        lanes?: string[];
+        skipped?: boolean;
+    }>;
+    enabled: () => boolean;
+    intervalSeconds?: () => number;
+    now?: () => Date;
+    sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+    isAlive?: (pid: number) => boolean;
+    log: (message: string) => void;
+    emit?: (meeting: MeetingIdentity, record: RiderRecord) => void;
+}
+export declare function ensureMeetingRiderJob(dir: string): LocalJob | null;
+export declare function meetingRiderSettings(hqRoot: string, home?: string): {
+    enabled: boolean;
+    interval: number;
+};
+export declare function createMeetingRider(deps: RiderDeps): {
+    /** Synchronously persists intent before the event handler may acknowledge delivery. */
+    start(payload: unknown): void;
+    resume(): void;
+    settled(): Promise<void>;
+    stop(): Promise<void>;
+};
+/** Production dependencies use the same attended endpoint as `meetings live`. */
+export declare function defaultMeetingRiderDeps(config: BotConfig, dir: string, log: (message: string) => void): RiderDeps;
+//# sourceMappingURL=meeting-rider.d.ts.map