@indigoai-us/hq-cli 5.345.197 → 5.345.199

package/dist/lib/bot/run.d.ts

@@ -1,52 +1,3 @@
-/**
- * The resident bot process: `hq bot run <name>` (local-bots US-003/US-004).
- *
- * - pid lock in ~/.hq/bots/<name>/pid; status.json is the observable state
- * - refuses to start unless the creds file names this bot's agt_ AND the
- *   server-side record is owned by the configured owner
- * - heartbeat every 30s (POST /v1/agents/{uid}/heartbeat, agent JWT)
- * - inbox poll every 2s: DMs go to ONE headless model turn (resumed by
- *   session id); a new session (restart, or a resume id the runtime no longer
- *   has) is given the recent DM thread as a "Recent messages:" block so a
- *   one-word reply still has the question it answers; the reply is sent as
- *   the bot; the message is acked only after the reply is sent; processed ids
- *   persist so a crash between reply and ack never answers twice
- * - any correspondent can message the bot; each sender has a separate session
- * - first start only: the intro DM, then (when bot.json has `kickoff`) ONE
- *   model turn on that prompt as if the owner sent it, answered in the DM, so
- *   a guided bot starts working without waiting for the owner to type
- * - job items (channel "job"): a scheduled run, fired by the bot's own loop
- *   from its jobs.json (lib/bot/local-jobs.ts) or, for a hosted agent, by
- *   the cloud. No system scheduler is used on this computer. The run is one model turn
- *   in its own session (one per jobId), reported in the owner's DM with a
- *   "scheduled job" header through the same split/recovery path as every other
- *   reply, and reported back to the cloud EXACTLY ONCE — nothing else clears
- *   the job's in-progress flag. A run whose staleAfter has passed still runs,
- *   once, labelled a catch-up; older pending runs of the same job are reported
- *   skipped-precondition instead of piling up.
- * - delivered room items (channels / group chats) are eligible for replies; claimed
- *   first (first-claim-wins), one session per room, reply posted in the room
- * - conversations run side by side: up to MAX_PARALLEL_TURNS turns at once,
- *   one lane per model session (one DM correspondent, or one room). Messages
- *   in the same lane run in order, so a session is never resumed by two turns
- *   at once and a thread's answers never arrive out of sequence.
- * - while a turn runs, each finished assistant message is posted as its own
- *   message (progress.ts); turns have no time limit
- * - every received message gets a reply: a turn that fails after the model
- *   started (error, crash, owner stop, restart) posts one "did not finish"
- *   message and is NOT run again — it may already have done outward things.
- *   inflight.json marks the turn in progress so a restart can say so.
- * - a turn that fails because the coding tool's sign-in no longer works
- *   (runtime-sign-in.ts) is not a failure of the message: the bot says once
- *   per conversation that it needs a sign-in, keeps the message un-acked,
- *   holds new turns, and tries again every SIGN_IN_RETRY_MS (and at once
- *   after a restart). A turn that works clears it.
- * - failures before the model starts (missing binary) retry with backoff;
- *   5 model failures in 10 minutes → state `failed` and a clean exit (launchd
- *   does not respawn a clean exit). Owner stops never count.
- *
- * Everything with a side effect is injectable so the loop is unit-testable.
- */
 import { type OwnerContext } from "./owner-context.js";
 import { type BotApi, type InboxItem } from "./api.js";
 import type { BotConfig, BotKind } from "./config.js";
@@ -57,6 +8,7 @@ import { type BotRuntime, type RuntimeTurnInput, type RuntimeTurnResult } from "
 import { type BotSessionScope } from "./paths.js";
 import { type DecisionDmClient } from "./decisions.js";
 import type { VaultObjectDownloader } from "../agent-kit/attachment-download.js";
+import type { JobRunCompletion } from "./api.js";
 import { type RuntimeSignInCheck } from "./runtime-sign-in.js";
 import { type HeartbeatAgentUidSource, type HeartbeatCredsSource, type HeartbeatIdentityMismatchReporter } from "../heartbeat-identity.js";
 import { type BotState, type BotStatusFile } from "./status.js";
@@ -325,6 +277,12 @@ export declare function inboxLaneKey(item: InboxItem, config: Pick<BotConfig, "o
  */
 export declare function dmTurnSessionScope(item: Pick<InboxItem, "fromPersonUid" | "text">, ownerUid: string): BotSessionScope;
 export declare function preflightCreds(dir: string, config: BotConfig): string | null;
+/** Register source-independent in-process jobs by their context.jobKind. */
+export declare const builtinEventHandlers: Record<string, (input: {
+    dir: string;
+    config: BotConfig;
+    item: InboxItem;
+}) => Promise<JobRunCompletion>>;
 export declare function runBot(deps: BotRunDeps): Promise<BotHandle>;
 /** True for a setup note the desktop app sent, not words the person typed. */
 export declare function isAppSetupNote(text: string): boolean;

package/dist/lib/bot/run.js

@@ -1,3 +1,4 @@
+import { ensureSignalToLaneJobs, runSignalToLane, SIGNAL_TO_LANE_JOB_KIND } from "./jobs/signal-to-lane.js";
 /**
  * The resident bot process: `hq bot run <name>` (local-bots US-003/US-004).
  *
@@ -47,6 +48,9 @@
  *
  * Everything with a side effect is injectable so the loop is unit-testable.
  */
+import { createMeetingRider, defaultMeetingRiderDeps, ensureMeetingRiderJob, MEETING_RIDER_JOB_KIND } from "./jobs/meeting-rider.js";
+import { executiveRiderEnabled, isExecutiveBot } from "./executive-settings.js";
+import { createMeetingDetect, defaultMeetingDetectDeps, resolveDetectedMeeting } from "./jobs/meeting-detect.js";
 import { botAuthEnv, describeBotAuth, formatBotAuth } from "./runtime-auth.js";
 import { ownerContextBlock } from "./owner-context.js";
 import { randomUUID } from "node:crypto";
@@ -58,7 +62,7 @@ import { fullJitterDelayMs } from "../mesh/live/backoff.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock } from "../mesh/live/daemon/pid-lock.js";
 import { BotApiError } from "./api.js";
 import { effectiveBotCompanies, effectiveBotKind, patchBotConfig, readBotConfig, resolveBotMemoryDir, SETUP_BOT_WORKER_ID } from "./config.js";
-import { ensureBotSessionMeta } from "./company-bind.js";
+import { botCompanyScopeKey, ensureBotSessionMeta, legacyPersonalEntryScopeKey, readManifestCompanies, resolveBotCompanyBinding } from "./company-bind.js";
 import { readBotCredsIdentity } from "./creds.js";
 import { isProcessed, markProcessed, readInboxState } from "./inbox-state.js";
 import { clearInflight, patchInflight, readInflight, readInflightTurns, writeInflight } from "./inflight.js";
@@ -86,6 +90,7 @@ import { buildJobTurnPrompt, isCatchUpRun, isJobItem, jobReportHeader, jobRunOut
 import { botJobQuietOptionEnabled } from "./job-quiet-flag.js";
 import { currentHotSignalSyncCompany, hotSignalSyncJobCompany, readActiveCompanySlug, removeStaleHotSignalSyncJobs } from "./jobs/hot-signal-sync.js";
 import { isLocalJobMessage, isLocalJobRetryMessage, localJobRetryMessageId, readLocalJobs } from "./local-jobs.js";
+import { drainBotEvents } from "./events.js";
 import { clearPendingJobCompletion, isCompletionDue, isCompletionExpired, isCompletionForOtherAgent, readPendingJobCompletions, recordPendingJobCompletion } from "./job-completions.js";
 import { SIGN_IN_CHECK_FRESH_MS, SIGN_IN_CHECK_MS, SIGN_IN_RETRY_MS, signInNeededText, signedOutExcerpt, } from "./runtime-sign-in.js";
 import { checkRuntimeSignIn } from "./runtime-sign-in-check.js";
@@ -407,6 +412,8 @@ export function preflightCreds(dir, config) {
     }
     return null;
 }
+/** Register source-independent in-process jobs by their context.jobKind. */
+export const builtinEventHandlers = Object.create(null);
 export async function runBot(deps) {
     const now = deps.now ?? (() => new Date());
     const sleep = deps.sleep ?? defaultSleep;
@@ -414,6 +421,23 @@ export async function runBot(deps) {
     const log = deps.log ?? createBotLogger(deps.dir, now);
     const pid = deps.pid ?? process.pid;
     const { dir, config, api, runtime } = deps;
+    const meetingRider = createMeetingRider(defaultMeetingRiderDeps(config, dir, (message) => log("info", message)));
+    const meetingDetectDeps = defaultMeetingDetectDeps(config, dir, (message) => log("info", message));
+    const meetingDetect = createMeetingDetect(meetingDetectDeps);
+    const eventHandlers = Object.create(builtinEventHandlers);
+    eventHandlers[MEETING_RIDER_JOB_KIND] = async ({ item }) => {
+        if (!isExecutiveBot(config))
+            return { status: "skipped-precondition", output: "Not the Executive" };
+        if (!executiveRiderEnabled())
+            return { status: "skipped-precondition", output: "rider disabled" };
+        meetingRider.start(await resolveDetectedMeeting(config.hqRoot, typeof item.context === "object" ? item.context?.payload : undefined, meetingDetectDeps.list));
+        return { status: "succeeded", output: "Meeting rider accepted" };
+    };
+    eventHandlers[SIGNAL_TO_LANE_JOB_KIND] = async ({ item }) => runSignalToLane({
+        dir, config, payload: typeof item.context === "object" ? item.context?.payload : undefined,
+        company: typeof item.context === "object" ? item.context?.company : undefined,
+        log: message => log("info", message),
+    });
     const runTurn = deps.runTurn ?? ((rt, input) => runRuntimeTurn(rt, input));
     const inboxIntervalMs = deps.inboxIntervalMs ?? INBOX_POLL_INTERVAL_MS;
     const inboxPollBackoffEnabled = deps.inboxPollBackoffEnabled ?? createInboxPollBackoffFlagReader(config);
@@ -531,18 +555,36 @@ export async function runBot(deps) {
     const kind = effectiveBotKind(config);
     const companies = effectiveBotCompanies(config);
     // A single membership is unambiguous; personal and multi-company bots stay unbound.
-    const companySlug = config.companySlug ?? (kind === "company" && companies.length === 1 ? companies[0] : undefined);
-    const companyScopeKey = kind === "company" || companySlug !== undefined
-        ? JSON.stringify({ kind, companies: [...companies].sort(), companySlug: companySlug ?? null })
+    const binding = resolveBotCompanyBinding(config);
+    const companySlug = binding.slug;
+    // What bot.json alone says; a lock inferred from the manifest is not part of it.
+    const startExplicitSlug = resolveBotCompanyBinding(config, () => []).slug;
+    // The explicit scope: bot.json's kind, memberships and company. A lock inferred
+    // from the HQ's company list is not part of it.
+    const companyScopeKey = kind === "company" || (companySlug !== undefined && !binding.inferred)
+        ? botCompanyScopeKey(kind, companies, companySlug)
+        : undefined;
+    // A personal bot with no explicit company records the company it inferred (or
+    // null when unbound) beside that key. When the HQ's company list changes, its
+    // conversations are archived instead of resumed under a lock they were not
+    // created under. The first inferred lock keeps existing history.
+    const inferredScopeSlug = companyScopeKey === undefined && kind === "personal" && config.workerId !== SETUP_BOT_WORKER_ID
+        ? (binding.inferred ? binding.slug ?? null : null)
         : undefined;
+    // The key an older CLI wrote when bot.json lists "personal": the same scope.
+    const legacyScopeKey = legacyPersonalEntryScopeKey(config);
     const lockDeps = defaultPidLockDeps({
         pid,
         ...(deps.isProcessAlive ? { isProcessAlive: deps.isProcessAlive } : {}),
     });
     const finish = async (final, code, reason, beforeExit) => {
-        if (state === "stopped" || state === "failed")
+        if (state === "stopped" || state === "failed") {
+            await done;
             return;
+        }
         state = final;
+        await meetingDetect.stop();
+        await meetingRider.stop();
         closeInboxWakeWatcher();
         setStatus({ state: final, ...(final === "failed" ? { lastError: reason.slice(0, 400) } : {}) });
         log(final === "failed" ? "error" : "info", `bot ${final}: ${reason}`);
@@ -679,7 +721,10 @@ export async function runBot(deps) {
         return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
     try {
-        const scope = ensureBotCompanyScope(dir, companyScopeKey);
+        const scope = ensureBotCompanyScope(dir, companyScopeKey, {
+            ...(inferredScopeSlug !== undefined ? { inferredSlug: inferredScopeSlug } : {}),
+            ...(legacyScopeKey !== undefined && legacyScopeKey !== companyScopeKey ? { equivalentKeys: [legacyScopeKey] } : {}),
+        });
         if (scope.reset)
             log("info", "company scope changed or was unverified; archived prior conversations before starting fresh");
     }
@@ -1014,6 +1059,8 @@ export async function runBot(deps) {
         activeInboxWait?.abort();
     };
     const waitForInbox = async (delayMs, adaptive, useMqttWake = false) => {
+        if (readLocalJobs(dir).some((job) => job.trigger))
+            delayMs = Math.min(delayMs, inboxIntervalMs);
         if (!adaptive) {
             await sleep(delayMs);
             return;
@@ -1023,9 +1070,14 @@ export async function runBot(deps) {
         while (remainingMs > 0 && !stopping && state === "running") {
             const controller = new AbortController();
             activeInboxWait = controller;
-            const chunkMs = useMqttWake ? remainingMs : Math.min(inboxIntervalMs, remainingMs);
+            const chunkMs = Math.min(inboxIntervalMs, remainingMs);
             if (useMqttWake) {
-                await getInboxWakeWatcher().wait(chunkMs, controller.signal);
+                const wake = await getInboxWakeWatcher().wait(chunkMs, controller.signal);
+                if (wake === "wake") {
+                    if (activeInboxWait === controller)
+                        activeInboxWait = null;
+                    return;
+                }
             }
             else {
                 await sleep(chunkMs, controller.signal);
@@ -1036,6 +1088,9 @@ export async function runBot(deps) {
                 break;
             if (hasPromotionHold(dir))
                 break;
+            // The first event job can be added while an otherwise idle bot waits.
+            if (readLocalJobs(dir).some((job) => job.trigger))
+                break;
             if (observedGeneration !== inboxWaitGeneration || controller.signal.aborted) {
                 observedGeneration = inboxWaitGeneration;
                 remainingMs = inboxIntervalMs;
@@ -1102,14 +1157,24 @@ export async function runBot(deps) {
      * prepended so a one-word reply still has the question it answers.
      */
     const bindingNotices = new Set();
+    let bindingNoticeLogged = false;
     const executeTurn = async (prompt, sessionScope, tReceived, stream = {}, historyEventId) => {
         const fresh = readBotConfig(dir);
         if (!fresh)
             throw new CompanyBindingError(`I couldn't read my company settings. Please restart ${config.name} after restoring its configuration; this work is still pending.`);
         const live = fresh;
         const liveCompanies = effectiveBotCompanies(live);
-        const liveCompanySlug = live.companySlug ?? (effectiveBotKind(live) === "company" && liveCompanies.length === 1 ? liveCompanies[0] : undefined);
-        if (liveCompanySlug !== companySlug || effectiveBotKind(live) !== kind ||
+        // Explicit settings only: a lock inferred from the HQ's company list is
+        // fixed at start, so an owner who creates or joins a company never fails a turn.
+        const liveCompanySlug = resolveBotCompanyBinding(live, () => []).slug;
+        if (binding.inferred && !bindingNoticeLogged) {
+            const hqNow = readManifestCompanies(config.hqRoot);
+            if (!(hqNow.length === 1 && hqNow[0] === companySlug)) {
+                bindingNoticeLogged = true;
+                log("warn", `${config.name}: this HQ's company list changed since start; keeping the start-time lock to ${companySlug} until the next restart.`);
+            }
+        }
+        if (liveCompanySlug !== startExplicitSlug || effectiveBotKind(live) !== kind ||
             JSON.stringify([...liveCompanies].sort()) !== JSON.stringify([...companies].sort())) {
             throw new CompanyBindingError(`My company settings changed. Please restart ${config.name} to load them before I continue; this work is still pending.`);
         }
@@ -1171,7 +1236,7 @@ export async function runBot(deps) {
             let bind = { env };
             if (companySlug) {
                 try {
-                    ensureBotSessionMeta(config.hqRoot, sid, liveCompanySlug, undefined, now);
+                    ensureBotSessionMeta(config.hqRoot, sid, companySlug, undefined, now);
                 }
                 catch {
                     throw new CompanyBindingError(`I couldn't bind this session to ${companySlug}. Please check the bot's workspace permissions and retry; this work is still pending.`);
@@ -1990,6 +2055,31 @@ export async function runBot(deps) {
         const id = item.messageId;
         const { job, jobId } = target;
         const peerUid = target.peerUid;
+        const eventHandler = item.messageId.startsWith("localjob-event-") && typeof job.context === "object" && typeof job.context?.jobKind === "string"
+            ? eventHandlers[job.context.jobKind] : undefined;
+        if (eventHandler) {
+            // Recoverable built-ins persist intent before acknowledging the event.
+            // Signal lane creation is idempotent, so a pre-ack crash can replay.
+            const durableEvent = typeof job.context === "object" && (job.context?.jobKind === MEETING_RIDER_JOB_KIND || job.context?.jobKind === SIGNAL_TO_LANE_JOB_KIND);
+            if (!durableEvent)
+                markProcessed(dir, id, now().toISOString());
+            let completion;
+            try {
+                completion = await eventHandler({ dir, config, item });
+                // Durable intent is stored before acknowledging; a pre-effect crash replays.
+                if (durableEvent)
+                    markProcessed(dir, id, now().toISOString());
+            }
+            catch (error) {
+                if (durableEvent)
+                    throw error;
+                completion = { status: "failed", output: error instanceof Error ? error.message : String(error) };
+            }
+            await completeJobRun(jobId, id, completion);
+            await api.ackInbox(config.agentUid, id);
+            log("info", `event job ${jobId} run ${id} ${completion.status}`);
+            return;
+        }
         // An older pending run of this job: a newer one runs instead. Reported so
         // the cloud releases the slot and the history says what happened.
         if (supersededJobRuns.has(id)) {
@@ -2794,6 +2884,21 @@ export async function runBot(deps) {
     // up below: end here, before the kickoff can send a "needs a sign-in" DM.
     if (stopping)
         return await stoppedDuringStartup();
+    try {
+        ensureSignalToLaneJobs(dir, config);
+    }
+    catch {
+        log("warn", "Signal-to-lane registration failed");
+    }
+    if (isExecutiveBot(config)) {
+        try {
+            if (ensureMeetingRiderJob(dir) && executiveRiderEnabled())
+                meetingRider.resume();
+        }
+        catch {
+            log("warn", "Meeting rider registration or recovery failed");
+        }
+    }
     // The kickoff runs alongside the heartbeat, before the first inbox poll, so
     // an owner message sent meanwhile is answered after it in the same session.
     const kickoff = kickoffAfterIntro
@@ -2910,6 +3015,14 @@ export async function runBot(deps) {
             kickCompletionRetries();
             // A failed signals run's automatic retry, once due (no model turn).
             enqueueDueSignalsRetries();
+            if (isExecutiveBot(config)) {
+                try {
+                    meetingDetect.tick();
+                }
+                catch {
+                    log("warn", "meeting detection settings unreadable");
+                }
+            }
             // Holding after repeated model failures: no inbox pulls until the
             // cooldown is over (the update watcher above keeps running meanwhile).
             if (modelHoldUntil > now().getTime()) {
@@ -2918,6 +3031,15 @@ export async function runBot(deps) {
             }
             if (modelHoldUntil)
                 liftModelHold();
+            // Local events are available even when the cloud inbox is unavailable.
+            try {
+                for (const item of drainBotEvents(dir))
+                    enqueue(item);
+                pump();
+            }
+            catch (error) {
+                log("warn", `event drain failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
             // While the tool says it is signed out, ask it again on a timer (cheap,
             // no turn): the moment it is signed in, the held messages run.
             if (signInIssue && busyLanes.size === 0 && now().getTime() >= nextSignInCheckAt) {
@@ -2975,7 +3097,8 @@ export async function runBot(deps) {
                 log("warn", `inbox poll failed: ${message}`);
                 if (stopping || state !== "running")
                     break;
-                await sleep(apiPollDelayMs({ err, attempt: inboxFails - 1, intervalMs: inboxIntervalMs, random }));
+                const retryDelay = apiPollDelayMs({ err, attempt: inboxFails - 1, intervalMs: inboxIntervalMs, random });
+                await sleep(readLocalJobs(dir).some((job) => job.trigger) ? Math.min(retryDelay, inboxIntervalMs) : retryDelay);
                 continue;
             }
             if (stopping || state !== "running")

package/dist/lib/bot/session.d.ts

@@ -18,6 +18,24 @@ export interface BotSessionFile {
 export declare function readBotSession(dir: string, runtime: BotRuntimeId, scope?: BotSessionScope): BotSessionFile | null;
 export declare function writeBotSession(dir: string, session: BotSessionFile, scope?: BotSessionScope): void;
 export declare function clearBotSession(dir: string, scope?: BotSessionScope): void;
+export interface BotCompanyScopeOptions {
+    /**
+     * Keys an earlier CLI wrote for this same scope. A marker holding one is
+     * rewritten to the current key in place: nothing is archived and pending
+     * work is kept. Used for a company bot whose bot.json lists "personal",
+     * which no longer counts as a membership.
+     */
+    equivalentKeys?: readonly string[];
+    /**
+     * A personal bot with no explicit company (companyScopeKey undefined): the
+     * company its sessions are locked to because the HQ lists only that one, or
+     * null when it is unbound. A change from the recorded value archives the
+     * conversations, like an explicit scope change, so a session is never
+     * resumed under a lock it was not created under. Ignored when
+     * companyScopeKey is set.
+     */
+    inferredSlug?: string | null;
+}
 /**
  * Run once at startup, before reading or appending conversation state. A scope
  * change must never resume a prior company's model session or replay its DM
@@ -26,7 +44,7 @@ export declare function clearBotSession(dir: string, scope?: BotSessionScope): v
  * Legacy personal bots retain their existing history; company bots require
  * positive scope evidence and archive legacy, unproven conversations once.
  */
-export declare function ensureBotCompanyScope(dir: string, companyScopeKey: string | undefined): {
+export declare function ensureBotCompanyScope(dir: string, companyScopeKey: string | undefined, options?: BotCompanyScopeOptions): {
     reset: boolean;
     archiveDir?: string;
 };

package/dist/lib/bot/session.js

@@ -38,6 +38,31 @@ export function clearBotSession(dir, scope = "dm") {
         /* already gone */
     }
 }
+const isScopeValue = (value) => typeof value === "string" || value === null;
+function writeCompanyScopeMarker(dir, marker) {
+    const tmp = path.join(dir, `.company-scope.${randomUUID()}.tmp`);
+    try {
+        fs.writeFileSync(tmp, `${JSON.stringify(marker)}\n`, { mode: 0o600 });
+        fs.renameSync(tmp, path.join(dir, "company-scope.json"));
+    }
+    finally {
+        fs.rmSync(tmp, { force: true });
+    }
+}
+/** Move every session and DM history file into a fresh private archive folder. */
+function archiveConversations(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const names = fs.readdirSync(dir).filter((name) => /^(?:session|dm-history)(?:-[A-Za-z0-9_-]+)?\.json$/.test(name));
+    if (!names.length)
+        return { names };
+    const archiveRoot = path.join(dir, "company-scope-archives");
+    fs.mkdirSync(archiveRoot, { recursive: true, mode: 0o700 });
+    const archiveDir = path.join(archiveRoot, randomUUID());
+    fs.mkdirSync(archiveDir, { mode: 0o700 });
+    for (const name of names)
+        fs.renameSync(path.join(dir, name), path.join(archiveDir, name));
+    return { names, archiveDir };
+}
 /**
  * Run once at startup, before reading or appending conversation state. A scope
  * change must never resume a prior company's model session or replay its DM
@@ -46,13 +71,14 @@ export function clearBotSession(dir, scope = "dm") {
  * Legacy personal bots retain their existing history; company bots require
  * positive scope evidence and archive legacy, unproven conversations once.
  */
-export function ensureBotCompanyScope(dir, companyScopeKey) {
+export function ensureBotCompanyScope(dir, companyScopeKey, options = {}) {
     const marker = path.join(dir, "company-scope.json");
     const hasMarker = fs.existsSync(marker);
-    if (!hasMarker && companyScopeKey === undefined)
+    const inferred = companyScopeKey === undefined ? options.inferredSlug : undefined;
+    if (!hasMarker && companyScopeKey === undefined && inferred === undefined)
         return { reset: false };
     const expected = companyScopeKey ?? null;
-    let provenPreviousScope = false;
+    let previous = null;
     if (hasMarker) {
         // Read errors fail closed. Invalid JSON is unproven provenance and resets.
         const body = fs.readFileSync(marker, "utf8");
@@ -63,16 +89,22 @@ export function ensureBotCompanyScope(dir, companyScopeKey) {
         catch {
             parsed = null;
         }
-        provenPreviousScope = Boolean(parsed && typeof parsed === "object" &&
-            parsed.v === 1 &&
-            (typeof parsed.companyScopeKey === "string" ||
-                parsed.companyScopeKey === null));
-        if (parsed && typeof parsed === "object" &&
-            parsed.v === 1 &&
-            parsed.companyScopeKey === expected) {
-            return { reset: false };
+        previous = parsed && typeof parsed === "object" && parsed.v === 1
+            ? parsed
+            : null;
+        if (inferred === undefined && previous !== null) {
+            if (previous.companyScopeKey === expected)
+                return { reset: false };
+            if (typeof previous.companyScopeKey === "string" && options.equivalentKeys?.includes(previous.companyScopeKey)) {
+                // The same scope under an older key: record the current key and keep everything.
+                writeCompanyScopeMarker(dir, { v: 1, companyScopeKey: expected });
+                return { reset: false };
+            }
         }
     }
+    const provenPreviousScope = previous !== null && isScopeValue(previous.companyScopeKey);
+    if (inferred !== undefined)
+        return ensureInferredScope(dir, hasMarker, previous, inferred);
     // A known company switch must settle recovery under its previous scope.
     // Legacy bots have no scope evidence: isolate their model context below,
     // but leave delivery/job markers intact for the existing recovery path.
@@ -84,26 +116,41 @@ export function ensureBotCompanyScope(dir, companyScopeKey) {
     }
     if (!provenPreviousScope)
         omitInflightRecoveryHistory(dir, pending);
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const names = fs.readdirSync(dir).filter((name) => /^(?:session|dm-history)(?:-[A-Za-z0-9_-]+)?\.json$/.test(name));
-    let archiveDir;
-    if (names.length) {
-        const archiveRoot = path.join(dir, "company-scope-archives");
-        fs.mkdirSync(archiveRoot, { recursive: true, mode: 0o700 });
-        archiveDir = path.join(archiveRoot, randomUUID());
-        fs.mkdirSync(archiveDir, { mode: 0o700 });
-        for (const name of names)
-            fs.renameSync(path.join(dir, name), path.join(archiveDir, name));
-    }
+    const { names, archiveDir } = archiveConversations(dir);
     // Commit the new provenance only after every old conversation was isolated.
-    const tmp = path.join(dir, `.company-scope.${randomUUID()}.tmp`);
-    try {
-        fs.writeFileSync(tmp, `${JSON.stringify({ v: 1, companyScopeKey: expected })}\n`, { mode: 0o600 });
-        fs.renameSync(tmp, marker);
+    writeCompanyScopeMarker(dir, { v: 1, companyScopeKey: expected });
+    return { reset: names.length > 0, ...(archiveDir ? { archiveDir } : {}) };
+}
+/**
+ * The personal-bot path of ensureBotCompanyScope: the recorded inferred slug
+ * must match, or the conversations are archived. The explicit companyScopeKey
+ * field is carried over exactly as the explicit rule would leave it (absent,
+ * or null once the bot has had a marker), so a later explicit bind behaves as
+ * it did before inferred locks existed.
+ */
+function ensureInferredScope(dir, hasMarker, previous, inferred) {
+    const previousInferred = previous !== null && isScopeValue(previous.inferredCompanySlug) ? previous.inferredCompanySlug : undefined;
+    const previousExplicit = previous !== null && isScopeValue(previous.companyScopeKey) ? previous.companyScopeKey : undefined;
+    const recordsNull = hasMarker && !(previousExplicit === undefined && previousInferred !== undefined);
+    const next = { v: 1, ...(recordsNull ? { companyScopeKey: null } : {}), inferredCompanySlug: inferred };
+    // No inferred record yet: a legacy personal bot (no marker, or an
+    // explicit-unbound one) keeps its history, as it did before inferred locks.
+    if (!hasMarker || (previousExplicit === null && previousInferred === undefined)) {
+        writeCompanyScopeMarker(dir, next);
+        return { reset: false };
     }
-    finally {
-        fs.rmSync(tmp, { force: true });
+    if (previousInferred === inferred && typeof previousExplicit !== "string")
+        return { reset: false };
+    const pending = readInflightTurns(dir, { strictIo: true });
+    // Leaving an explicit company keeps the explicit rule: settle its work first.
+    // A change in the HQ's company list cannot be undone from bot.json, so it
+    // never blocks the start; saved work is settled without the old history.
+    if (typeof previousExplicit === "string" && pending.length > 0) {
+        throw new Error("Bot company settings changed with pending work. Restore the previous company settings and settle pending work before switching companies.");
     }
+    omitInflightRecoveryHistory(dir, pending);
+    const { names, archiveDir } = archiveConversations(dir);
+    writeCompanyScopeMarker(dir, next);
     return { reset: names.length > 0, ...(archiveDir ? { archiveDir } : {}) };
 }
 //# sourceMappingURL=session.js.map

package/dist/lib/bot/status.d.ts

@@ -85,8 +85,29 @@ export interface BotStatusFile {
     } | null;
     /** hq-cli version this process loaded (a bot keeps it until it restarts). */
     cliVersion?: string;
+    /**
+     * HQ Fleet Runtime bots: the last turn that ended in the canned away line,
+     * as the bot reported it to HQ and to the owner (written by the HQ DM
+     * adapter in hq-fleet-local).
+     */
+    lastFailure?: BotLastFailure;
     updatedAt: string;
 }
+export interface BotLastFailure {
+    at: string;
+    /** auth | billing | rate_limit | outage | runtime_error | generic */
+    class: string;
+    site?: string;
+    provider?: string | null;
+    /** Plain-language cause, as the owner was told. */
+    cause: string;
+    /** Plain-language fix, as the owner was told. */
+    fix: string;
+    /** The HQ failure report id, when the upload succeeded. */
+    reportId?: string | null;
+    uploaded?: boolean;
+    ownerNotified?: boolean;
+}
 export declare function defaultBotStatus(pid: number, runtime: BotRuntimeId, now?: () => Date): BotStatusFile;
 export declare function readBotStatus(dir: string): BotStatusFile | null;
 export declare function writeBotStatus(dir: string, status: BotStatusFile): void;

package/dist/lib/core-utils/manifest-slugs.d.ts

@@ -0,0 +1,2 @@
+export declare function parseManifestSlugs(text: string): string[];
+//# sourceMappingURL=manifest-slugs.d.ts.map

package/dist/lib/core-utils/manifest-slugs.js

@@ -0,0 +1,26 @@
+/** Leaf module: company slugs from companies/manifest.yaml, shared by the resolver and the bot runtime. */
+const keepSlug = (slug) => slug !== "" && slug !== "_template" && slug !== "companies" && slug !== "unaffiliated_repos";
+export function parseManifestSlugs(text) {
+    const slugs = new Set();
+    let wrapped = false;
+    for (const rawLine of text.split("\n")) {
+        const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+        if (/^companies:[ \t]*$/.test(line)) {
+            wrapped = true;
+            continue;
+        }
+        if (wrapped && /^[^ \t][^:]*:[ \t]*$/.test(line))
+            wrapped = false;
+        if (wrapped) {
+            const match = line.match(/^ {2}([A-Za-z][A-Za-z0-9_-]*):/);
+            if (match && keepSlug(match[1]))
+                slugs.add(match[1]);
+            continue;
+        }
+        const match = line.match(/^([A-Za-z][A-Za-z0-9_-]*):/);
+        if (match && keepSlug(match[1]))
+            slugs.add(match[1]);
+    }
+    return [...slugs];
+}
+//# sourceMappingURL=manifest-slugs.js.map

package/dist/lib/doctor/checks/bots.d.ts

@@ -1,3 +1,5 @@
+import { type ClaudeLoginCheck } from "../../bot/claude-login.js";
+import { type BotStatusFile } from "../../bot/status.js";
 import { type NodeBinaryIo } from "../../node-binary.js";
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 export declare const BOTS_FAMILY_ID = "bots";
@@ -7,7 +9,11 @@ export interface BotsDoctorDeps {
     root: (home?: string) => string;
     /** Filesystem view used to judge the startup agent's node path (tests). */
     nodeIo?: NodeBinaryIo;
+    /** The Claude Code login read the way the HQ Fleet Runtime reads it (tests). */
+    claudeLogin?: () => ClaudeLoginCheck;
 }
+/** The last reported failure, unless a later turn worked. */
+export declare function unresolvedLastFailure(status: BotStatusFile | null): BotStatusFile["lastFailure"] | null;
 export declare const botsFamily: CheckFamily;
 export declare function checkBots(_context: CheckContext, deps?: BotsDoctorDeps): CheckResult[];
 //# sourceMappingURL=bots.d.ts.map