@indigoai-us/hq-cli 5.345.198 → 5.345.200

package/dist/commands/bot-jobs.js

@@ -16,7 +16,7 @@
  * back when it checks what is due.
  */
 import chalk from "chalk";
-import { localJobsClient } from "../lib/bot/local-jobs.js";
+import { addLocalJob, localJobsClient, readLocalJobs, toJobRecord } from "../lib/bot/local-jobs.js";
 import { BotApiError } from "../lib/bot/api.js";
 import { effectiveBotKind, HQ_FLEET_RUNTIME_ENGINE_ID } from "../lib/bot/config.js";
 import { fleetCronOps, fleetOwnerOrigin, fleetScheduleFromLegacy } from "../lib/bot/fleet-cron.js";
@@ -318,6 +318,10 @@ export function fleetJobsClient(config, ops, timezone) {
 // ─── Reading jobs back ───────────────────────────────────────────────────────
 /** A schedule in plain words, falling back to the raw expression. */
 export function describeSchedule(job) {
+    if (job.trigger) {
+        const filters = Object.entries(job.trigger.filter ?? {}).map(([key, value]) => `${key}=${value}`).join(", ");
+        return `on ${job.trigger.event}${filters ? ` (${filters})` : ""}`;
+    }
     const schedule = job.schedule;
     if (!schedule)
         return "on a schedule";
@@ -391,7 +395,7 @@ export function formatJobsList(botName, jobs, showQuietOption = false) {
         lines.push(`    runs ${describeSchedule(job)}`);
         if (showQuietOption && isQuietJobContext(job.context))
             lines.push("    delivery: quiet after successful runs");
-        lines.push(`    next run: ${job.nextRunAt ? `${utcMinute(job.nextRunAt)} UTC` : "not scheduled yet"}`);
+        lines.push(`    next run: ${job.trigger ? "when a matching event arrives" : job.nextRunAt ? `${utcMinute(job.nextRunAt)} UTC` : "not scheduled yet"}`);
         lines.push(`    last run: ${describeLastRun(job)}`);
     }
     return lines.join("\n");
@@ -454,6 +458,11 @@ export async function runBotJobs(nameArg, opts, deps) {
     if (opts.quiet && opts.add === undefined) {
         refuse("Use --quiet with --add to set a scheduled job's delivery option.");
     }
+    if (opts.on !== undefined && (opts.add === undefined || opts.every !== undefined || opts.cron !== undefined || opts.tz !== undefined)) {
+        refuse("Use --on with --add and without --every, --cron, or --tz.");
+    }
+    if (opts.filter?.length && opts.on === undefined)
+        refuse("Use --filter with --on.");
     // Shared by --add and --reschedule: one schedule from --every or --cron, in
     // the stored form, held to the same floor.
     const scheduleFromOptions = () => {
@@ -516,6 +525,36 @@ export async function runBotJobs(nameArg, opts, deps) {
         if (opts.quiet && !(await quietOptionEnabled())) {
             refuse(`--quiet requires the ${BOT_JOB_QUIET_OPTION_FLAG} flag, which is currently disabled.`);
         }
+        if (opts.on !== undefined) {
+            if (fleet)
+                refuse("Event jobs require a local CLI bot; HQ Fleet Runtime does not drain this event journal.");
+            const event = opts.on.trim();
+            if (!event || event.length > 256 || /[\r\n]/.test(event))
+                refuse("Event name must be 1–256 characters without newlines.");
+            const prompt = opts.add.trim();
+            if (!prompt || Buffer.byteLength(prompt, "utf8") > MAX_PROMPT_BYTES)
+                refuse("Job instruction must be non-empty and at most 16 KB.");
+            const filter = Object.create(null);
+            for (const entry of opts.filter ?? []) {
+                const split = entry.indexOf("=");
+                if (split < 1 || !entry.slice(0, split).trim())
+                    refuse("Each --filter must be key=value.");
+                const key = entry.slice(0, split).trim();
+                if (Object.hasOwn(filter, key))
+                    refuse(`Duplicate filter key: ${key}`);
+                filter[key] = entry.slice(split + 1);
+            }
+            if (readLocalJobs(dir).length >= MAX_ACTIVE_JOBS_PER_AGENT)
+                refuse(`${name} already has the maximum of ${MAX_ACTIVE_JOBS_PER_AGENT} jobs. Remove one first.`);
+            const created = toJobRecord(addLocalJob(dir, {
+                prompt,
+                timezone: localZone,
+                trigger: { kind: "event", event, ...(Object.keys(filter).length ? { filter } : {}) },
+                ...(opts.quiet ? { context: { [JOB_RUN_OPTIONS_CONTEXT_KEY]: { quiet: true } } } : {}),
+            }));
+            out(opts.json ? JSON.stringify({ ok: true, job: created }, null, 2) : `Added ${created.jobId}: ${name} runs it ${describeSchedule(created)}.`);
+            return;
+        }
         const schedule = scheduleFromOptions();
         const body = buildCreateJobBody({ prompt: opts.add, cron: schedule.cron, timezone: schedule.timezone, quiet: opts.quiet });
         const api = await jobsApi();
@@ -558,6 +597,8 @@ export function registerBotJobsCommand(bot, deps) {
         .option("--add <what>", "Schedule new work, in plain language")
         .option("--every <when>", 'How often, in plain language (e.g. "every weekday at 9am")')
         .option("--cron <expr>", 'How often, as a cron expression (e.g. "0 9 * * 1-5")')
+        .option("--on <event>", "Run when this event is emitted")
+        .option("--filter <key=value>", "Match an event payload field (repeatable)", (value, values) => [...values, value], [])
         .option("--tz <zone>", "IANA timezone for the schedule (default: this computer's)")
         .option("--quiet", "Skip owner DMs after successful runs (requires rollout flag)")
         .option("--rm <jobId>", "Remove a scheduled job")

package/dist/commands/bot-runtime.d.ts

@@ -0,0 +1,35 @@
+import { type FleetInstallProgress, type FleetInstallProgressListener, type FleetLocalTargetRelease } from "../lib/bot/fleet-local.js";
+export type FleetProgressMode = "text" | "json" | "silent";
+interface ProgressOutput {
+    write(text: string): void;
+    isTTY: boolean;
+}
+/** The sentence for a phase, for people. */
+export declare function describeFleetInstallPhase(event: FleetInstallProgress): string;
+/**
+ * Progress for a terminal (stderr, one line that rewrites itself on a TTY and
+ * prints at each tenth otherwise), for a program (one JSON object per line on
+ * stdout), or nothing.
+ */
+export declare function fleetInstallProgressReporter(mode: FleetProgressMode, output?: ProgressOutput, stdout?: (line: string) => void): FleetInstallProgressListener;
+export interface FleetRuntimeStatus {
+    ready: boolean;
+    release: {
+        version: string;
+        source: FleetLocalTargetRelease["source"];
+    };
+    steps: {
+        distribution: boolean;
+        python: boolean;
+        runtime: boolean;
+    };
+}
+export declare function fleetRuntimeStatus(): Promise<FleetRuntimeStatus>;
+export declare function runBotRuntimeInstall(opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function runBotRuntimeStatus(opts: {
+    json?: boolean;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=bot-runtime.d.ts.map

package/dist/commands/bot-runtime.js

@@ -0,0 +1,115 @@
+import chalk from "chalk";
+import { ensureFleetRuntimeInstalled, fleetLocalDistributionInstalled, fleetRuntimeReady, installTargetFleetLocalDistribution, resolveFleetLocalTargetRelease, } from "../lib/bot/fleet-local.js";
+import { installedFleetPython } from "../lib/bot/fleet-python.js";
+function megabytes(bytes) {
+    return `${(bytes / 1_048_576).toFixed(1)} MB`;
+}
+/** The sentence for a phase, for people. */
+export function describeFleetInstallPhase(event) {
+    switch (event.phase) {
+        case "download": {
+            const name = event.file.startsWith("hq-fleet-runtime-") ? "the HQ Fleet Runtime" : event.file;
+            if (event.total === null)
+                return `Downloading ${name}: ${megabytes(event.received)}`;
+            const percent = Math.min(100, Math.floor((event.received / Math.max(event.total, 1)) * 100));
+            return `Downloading ${name}: ${megabytes(event.received)} of ${megabytes(event.total)} (${percent}%)`;
+        }
+        case "verify":
+            return "Checking the download against its signed release";
+        case "python":
+            return "Preparing the runtime's private Python";
+        case "extract":
+            return "Unpacking the runtime";
+        case "environment":
+            return "Creating the runtime environment";
+        case "packages":
+            return "Installing the runtime's packages (a minute or two)";
+        case "ready":
+            if (event.step === "download")
+                return event.cached ? "The runtime download is already on this computer" : "The runtime download is complete";
+            return event.cached ? "The runtime is already installed on this computer" : "The runtime is ready";
+    }
+}
+/**
+ * Progress for a terminal (stderr, one line that rewrites itself on a TTY and
+ * prints at each tenth otherwise), for a program (one JSON object per line on
+ * stdout), or nothing.
+ */
+export function fleetInstallProgressReporter(mode, output = { write: (text) => { process.stderr.write(text); }, isTTY: process.stderr.isTTY === true }, stdout = (line) => { process.stdout.write(`${line}\n`); }) {
+    if (mode === "silent")
+        return () => undefined;
+    if (mode === "json") {
+        return (event) => {
+            const percent = event.phase === "download" && event.total !== null
+                ? Math.min(100, Math.floor((event.received / Math.max(event.total, 1)) * 100))
+                : null;
+            stdout(JSON.stringify({ event: "progress", ...event, percent, message: describeFleetInstallPhase(event) }));
+        };
+    }
+    let lastTenth = -1;
+    let lineOpen = false;
+    return (event) => {
+        const text = describeFleetInstallPhase(event);
+        if (event.phase === "download" && event.total !== null) {
+            const tenth = Math.floor((event.received / Math.max(event.total, 1)) * 10);
+            if (output.isTTY) {
+                output.write(`\r${text}${event.received >= event.total ? "\n" : ""}`);
+                lineOpen = event.received < event.total;
+                return;
+            }
+            if (tenth === lastTenth && event.received < event.total)
+                return;
+            lastTenth = tenth;
+            output.write(`${text}\n`);
+            return;
+        }
+        if (lineOpen) {
+            output.write("\n");
+            lineOpen = false;
+        }
+        output.write(`${text}\n`);
+    };
+}
+export async function fleetRuntimeStatus() {
+    const target = await resolveFleetLocalTargetRelease();
+    const distribution = fleetLocalDistributionInstalled(target.release);
+    const python = installedFleetPython();
+    const runtime = distribution && python ? fleetRuntimeReady({ release: target.release }, { python }) : false;
+    return {
+        ready: distribution && python !== null && runtime,
+        release: { version: target.release.version, source: target.source },
+        steps: { distribution, python: python !== null, runtime },
+    };
+}
+export async function runBotRuntimeInstall(opts) {
+    const report = fleetInstallProgressReporter(opts.json ? "json" : "text");
+    const target = await resolveFleetLocalTargetRelease();
+    const installation = await installTargetFleetLocalDistribution({ target, onProgress: report });
+    const result = await ensureFleetRuntimeInstalled(installation, { onProgress: report });
+    if (opts.json) {
+        console.log(JSON.stringify({
+            ok: true,
+            event: "done",
+            release: { version: result.release.version, source: target.source },
+            distributionDir: result.distributionDir,
+            runtimeDir: result.runtimeDir,
+        }));
+        return;
+    }
+    console.log(`${chalk.green("HQ Fleet Runtime " + result.release.version + " is ready on this computer.")} ${chalk.dim(result.runtimeDir)}`);
+}
+export async function runBotRuntimeStatus(opts) {
+    const current = await fleetRuntimeStatus();
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, ...current }, null, 2));
+        return;
+    }
+    const mark = (done) => (done ? chalk.green("ready") : chalk.yellow("missing"));
+    console.log(`HQ Fleet Runtime ${current.release.version}  ${current.ready ? chalk.green("ready") : chalk.yellow("not installed yet")}`);
+    console.log(`  download:     ${mark(current.steps.distribution)}`);
+    console.log(`  python:       ${mark(current.steps.python)}`);
+    console.log(`  environment:  ${mark(current.steps.runtime)}`);
+    if (!current.ready)
+        console.log(chalk.dim("  Run `hq bot runtime install` to get it ready before creating a bot."));
+}
+//# sourceMappingURL=bot-runtime.js.map

package/dist/commands/bot.d.ts

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 import { type RuntimeSignInCheck, type RuntimeSignInIssue } from "../lib/bot/runtime-sign-in.js";
+import { type ClaudeLoginCheck } from "../lib/bot/claude-login.js";
 import type { BotStatusFile } from "../lib/bot/status.js";
 import { probeBotRuntime, type RuntimeProbeResult } from "../lib/bot/probe.js";
 import { type SpawnInteractive } from "../lib/bot/runtime-auth.js";
@@ -100,6 +101,12 @@ export interface BotRow {
 export declare function listBotNames(root: string): string[];
 /** Bot-identity token supplier: per-bot creds + per-bot token cache dir. */
 export declare function botTokenSupplier(dir: string): () => Promise<string>;
+/**
+ * Whether `hq bot` may open a browser sign-in for its owner: a TTY on stdin,
+ * and the shared interactive-caller gate (no lane, daemon, bot runtime, or
+ * HQ_NO_BROWSER_LOGIN child).
+ */
+export declare function ownerSignInAllowed(): boolean;
 /**
  * The bot's word on its coding tool's sign-in. Only a running bot's report
  * counts: a stopped bot's last check may be from before a sign-in or a
@@ -115,6 +122,10 @@ export declare function spawnDetachedRun(name: string, dir: string): number;
  * "unreadable output: trailing characters").
  */
 /** Seams for the self-stop path, replaced in tests. */
+export declare const botCreateSeams: {
+    /** The Claude Code login read the way the HQ Fleet Runtime reads it. */
+    claudeLogin: () => ClaudeLoginCheck;
+};
 export declare const botStopSeams: {
     /** True when this process runs inside the bot process `botPid` (one of its turns). */
     isInsideBot: (botPid: number) => boolean;

package/dist/commands/bot.js

@@ -43,6 +43,8 @@ import { createVaultObjectDownloader } from "../lib/agent-kit/attachment-downloa
 import { addBotToCompanies, describeCompanyFailures, removeBotFromCompanies } from "./bot-companies.js";
 import { registerBotContinuityCommand } from "./bot-continuity.js";
 import { registerBotJobsCommand } from "./bot-jobs.js";
+import { registerBotEventsCommand } from "./bot-events.js";
+import { executiveStatus } from "../lib/bot/executive-settings.js";
 import { ensureFleetHotSignalSync, fleetCronOps, migrateLegacyJobsToFleet } from "../lib/bot/fleet-cron.js";
 import { resolvePackSetupPrompt } from "../lib/bot/pack-setup.js";
 import { detectCodingToolActivity } from "../lib/bot/coding-tool-activity.js";
@@ -63,10 +65,14 @@ import { daemonPaths } from "../lib/daemon/paths.js";
 import { launchdLabel } from "../lib/bot/paths.js";
 import { isAncestorProcess } from "../lib/bot/self-process.js";
 import { runtimeDisplayName, signInCommand } from "../lib/bot/runtime-sign-in.js";
+import { checkClaudeCodeLogin, claudeLoginFix, describeClaudeLoginSources } from "../lib/bot/claude-login.js";
+import { unresolvedLastFailure } from "../lib/doctor/checks/bots.js";
 import { classifyRuntimeFailure, runtimeFailureReason } from "../lib/bot/runtime-failure.js";
 import { PROBE_DEFAULT_TIMEOUT_MS, probeBotRuntime } from "../lib/bot/probe.js";
 import { BOT_LOGIN_RUNTIMES, botAuthEnv, botRuntimeAuth, capacityAccountHome, describeBotAuth, formatBotAuth, isBotLoginRuntime, restoreBotSessions, setAsideBotSessions, signInBotRuntime, signOutBotRuntime, withRuntimeAuth, } from "../lib/bot/runtime-auth.js";
 import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, HQ_FLEET_LOCAL_RELEASE, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, fleetLocalProfileNeedsAdoption, fleetLocalServiceInstalled, fleetProviderForRuntime, importFleetLocalMachineCredential, fleetProviderNeedsSignIn, fleetOwnerCompanies, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, installTargetFleetLocalDistribution, resolveFleetLocalPointerTarget, resolveFleetLocalTargetRelease, fleetLocalProfileDir, fleetProfileOwnerCompanies, fleetLocalChannels, readFleetLocalGatewayState, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
+import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
+import { fleetInstallProgressReporter, runBotRuntimeInstall, runBotRuntimeStatus } from "./bot-runtime.js";
 function collectRepeated(value, previous) {
     return [...previous, value];
 }
@@ -328,7 +334,15 @@ export function botTokenSupplier(dir) {
     process.env.HQ_MACHINE_TOKEN_STATE_DIR = botTokenStateDir(dir);
     return () => ensureCognitoToken({ tokenSource: "machine", interactive: false });
 }
-async function ownerToken(interactive = process.stdin.isTTY === true) {
+/**
+ * Whether `hq bot` may open a browser sign-in for its owner: a TTY on stdin,
+ * and the shared interactive-caller gate (no lane, daemon, bot runtime, or
+ * HQ_NO_BROWSER_LOGIN child).
+ */
+export function ownerSignInAllowed() {
+    return gatedInteractiveLogin(process.stdin.isTTY === true);
+}
+async function ownerToken(interactive = ownerSignInAllowed()) {
     if (peekHqApiKey()) {
         throw Object.assign(new Error("hq bot needs your HQ login session (HQ_API_KEY is not supported here). Run `hq login`."), {
             expected: true,
@@ -731,9 +745,10 @@ async function installFleetRuntimeProfile(name, dir, config, opts = {}) {
         return null;
     if (!opts.force && !fleetLocalProfileNeedsAdoption(config.agentUid, { release: target.release }))
         return null;
+    const progress = opts.progress ?? fleetInstallProgressReporter("silent");
     let installation;
     try {
-        installation = await installTargetFleetLocalDistribution({ target });
+        installation = await installTargetFleetLocalDistribution({ target, onProgress: progress });
     }
     catch (err) {
         if (target.source !== "pointer")
@@ -745,8 +760,9 @@ async function installFleetRuntimeProfile(name, dir, config, opts = {}) {
         createBotLogger(dir)("warn", `could not install HQ Fleet Local ${target.release.version} (${err instanceof Error ? err.message : String(err)}); staying on ${HQ_FLEET_LOCAL_RELEASE.version}`);
         if (!opts.force && !fleetLocalProfileNeedsAdoption(config.agentUid, { release: HQ_FLEET_LOCAL_RELEASE }))
             return null;
-        installation = await installPinnedFleetLocalDistribution();
+        installation = await installPinnedFleetLocalDistribution({ onProgress: progress });
     }
+    progress({ phase: "python" });
     const python = await ensureFleetPython();
     const companyScope = effectiveBotKind(config) === "company"
         ? effectiveBotCompanies(config)
@@ -761,7 +777,7 @@ async function installFleetRuntimeProfile(name, dir, config, opts = {}) {
         provider: fleetProviderForRuntime(config.runtime, config.model),
         ownerCompanies: companyScope,
         ...(config.autoApprove === true ? { autoApprove: true } : {}),
-    }, { python, start: false });
+    }, { python, start: false, onProgress: progress });
     const credentials = botCredsPath(dir);
     if (fs.existsSync(credentials))
         importFleetLocalMachineCredential(config.agentUid, credentials, {}, { keepSource: opts.keepCredentials === true });
@@ -774,6 +790,22 @@ async function installFleetRuntimeProfile(name, dir, config, opts = {}) {
  * "unreadable output: trailing characters").
  */
 /** Seams for the self-stop path, replaced in tests. */
+export const botCreateSeams = {
+    /** The Claude Code login read the way the HQ Fleet Runtime reads it. */
+    claudeLogin: () => checkClaudeCodeLogin(),
+};
+/**
+ * A Claude bot on the HQ Fleet Runtime answers with the owner's Claude Code
+ * login. Creating one on a computer with no readable login provisions an
+ * identity that can only ever answer "I'm away for a bit", so refuse first
+ * and say which sources were checked.
+ */
+function requireClaudeCodeLoginForCreate(name) {
+    const check = botCreateSeams.claudeLogin();
+    if (check.signedIn)
+        return;
+    throw Object.assign(new Error(`Claude Code is not signed in on this computer, so ${name} could not answer. ${describeClaudeLoginSources(check)} ${claudeLoginFix()}`.replace(/\s+/g, " ").trim()), { expected: true });
+}
 export const botStopSeams = {
     /** True when this process runs inside the bot process `botPid` (one of its turns). */
     isInsideBot: (botPid) => isAncestorProcess(botPid),
@@ -1114,6 +1146,8 @@ async function runBotCreateLocked(name, opts) {
     }
     const fleetProvider = fleetProviderForRuntime(runtime, model);
     const fleetAuthPending = fleetProviderNeedsSignIn(fleetProvider);
+    if (fleetProvider.id === "anthropic")
+        requireClaudeCodeLoginForCreate(name);
     const token = await ownerToken();
     const owner = await resolveCallerPersonUid(token, undefined, { command: "hq bot create" });
     if (!owner)
@@ -1206,7 +1240,9 @@ async function runBotCreateLocked(name, opts) {
     // of sending another create that the entity store will reject.
     if (isSetupBot && (await adoptOwnedSetupBot(true)))
         return;
-    const fleetInstallation = await installTargetFleetLocalDistribution();
+    const progress = fleetInstallProgressReporter(opts.json ? "silent" : "text");
+    const fleetInstallation = await installTargetFleetLocalDistribution({ onProgress: progress });
+    progress({ phase: "python" });
     const fleetPython = await ensureFleetPython();
     const ownerCompanies = kind === "personal" ? await fleetOwnerCompanies() : companies;
     // A company bot's companies are resolved first (a typo must not cost an
@@ -1366,7 +1402,7 @@ async function runBotCreateLocked(name, opts) {
         firstStart: toolOffer
             ? { intro: setupToolOfferText(toolOffer, setupWelcomeOpening(intro)) }
             : { intro: introText, ...(kickoff ? { kickoff } : {}) },
-    }, { start: opts.start !== false && !fleetAuthPending, python: fleetPython });
+    }, { start: opts.start !== false && !fleetAuthPending, python: fleetPython, onProgress: progress });
     syncFleetRuntimeJobs(name, dir, config);
     const fleetProfile = fleetBootstrap.profile;
     const runtimeLabel = HQ_FLEET_RUNTIME_ENGINE_ID;
@@ -1664,7 +1700,7 @@ async function runBotStatus(nameArg, opts) {
     const creds = readBotCredsIdentity(dir);
     const channels = fleet ? fleetLocalChannels(readFleetLocalGatewayState(config.agentUid), row.processAlive) : null;
     if (opts.json) {
-        console.log(JSON.stringify({ ...row, ...(fleet ? { engine: config.engine, channels } : {}), credsPresent: fleet || !!creds, login: describeBotAuth(dir, config), status }, null, 2));
+        console.log(JSON.stringify({ ...row, executive: executiveStatus(config, dir), ...(fleet ? { engine: config.engine, channels } : {}), credsPresent: fleet || !!creds, login: describeBotAuth(dir, config), status }, null, 2));
         return;
     }
     console.log(`${chalk.bold(name)}  ${row.agentUid}`);
@@ -1733,6 +1769,15 @@ async function runBotStatus(nameArg, opts) {
             const cls = classifyRuntimeFailure(status.lastError);
             console.log(`  last problem: ${chalk.yellow(`${cls}: ${runtimeFailureReason(cls, row.runtime)}`)}  ${chalk.dim(`(details: hq bot logs ${name})`)}`);
         }
+        if (status.lastFailure) {
+            const failure = status.lastFailure;
+            const resolved = unresolvedLastFailure(status) === null;
+            const paint = resolved ? chalk.dim : chalk.yellow;
+            console.log(`  last failure: ${paint(`${failure.at} (${failure.class}${resolved ? ", answered since" : ""})`)}`);
+            console.log(`    cause:    ${paint(failure.cause)}`);
+            console.log(`    fix:      ${paint(failure.fix)}`);
+            console.log(`    report:   ${failure.uploaded && failure.reportId ? `${failure.reportId} (in HQ, with the bot's last log lines)` : chalk.red("not uploaded to HQ")}  ${chalk.dim(`owner DM ${failure.ownerNotified ? "sent" : "not sent"}`)}`);
+        }
     }
     console.log(chalk.dim(`  state dir:  ${dir}`));
 }
@@ -2745,7 +2790,10 @@ async function adoptRemoteBotLocked(input) {
         ...(input.preserveFirstStart ? { preserveFirstStart: true } : {}),
     });
     // A bot made on the HQ Fleet Runtime comes back on it, on the release this CLI pins.
-    const fleetInstallation = fleetEngine ? await installPinnedFleetLocalDistribution() : null;
+    const progress = input.progress ?? fleetInstallProgressReporter("silent");
+    const fleetInstallation = fleetEngine ? await installPinnedFleetLocalDistribution({ onProgress: progress }) : null;
+    if (fleetInstallation)
+        progress({ phase: "python" });
     const fleetPython = fleetInstallation ? await ensureFleetPython() : null;
     if (fleetInstallation)
         config.engine = fleetInstallation.engine;
@@ -2774,7 +2822,7 @@ async function adoptRemoteBotLocked(input) {
                     },
                 }
                 : {}),
-        }, { python: fleetPython, start: false });
+        }, { python: fleetPython, start: false, onProgress: progress });
     }
     createBotLogger(dir)("info", `adopted ${name} (${bot.agentUid}) on ${localMachineId()} kind=${config.kind}${local ? "" : " (no saved settings; defaults)"} runtime=${config.runtime}`);
     let daemonMessage = null;
@@ -2839,6 +2887,7 @@ export async function runBotAdopt(nameArg, opts) {
             name,
             api,
             hqRoot,
+            progress: fleetInstallProgressReporter(opts.json ? "silent" : "text"),
             overrides: {
                 ...(isBotRuntimeId(opts.runtime) ? { runtime: opts.runtime } : {}),
                 ...(model ? { model } : {}),
@@ -2952,7 +3001,7 @@ export async function runBotRestore(opts) {
             if (here) {
                 return { name, agentUid: bot.agentUid, action: "repaired", detail: await repairLocalBot(name, api, bot, opts.daemon !== false), ...shown };
             }
-            const { result, config } = await adoptRemoteBot({ bot, name, api, hqRoot, daemon: opts.daemon !== false });
+            const { result, config } = await adoptRemoteBot({ bot, name, api, hqRoot, daemon: opts.daemon !== false, progress: fleetInstallProgressReporter(opts.json ? "silent" : "text") });
             // Silent: this command's own JSON has to be the only document on stdout.
             const started = opts.start === false ? null : await startBot(name, result.dir, config, "silent").catch(() => null);
             return {
@@ -3052,6 +3101,7 @@ export function registerBotCommand(program) {
         .description("Personal local bots that run on this computer with your own model login");
     registerBotContinuityCommand(bot);
     registerBotJobsCommand(bot, { requireBot, botTokenSupplier });
+    registerBotEventsCommand(bot, { requireBot });
     bot.command("promote <name>")
         .description("Move this local bot to cloud compute, preserving its identity and private context")
         .requiredOption("--company <uid>", "Destination company identity")
@@ -3141,7 +3191,7 @@ export function registerBotCommand(program) {
         const b = requireBot(name);
         if (isFleetRuntimeBot(b.config)) {
             refuseHeldFleetBot(b.dir);
-            const adopted = await adoptFleetRuntimeProfile(b.name, b.dir, b.config);
+            const adopted = await adoptFleetRuntimeProfile(b.name, b.dir, b.config, { progress: fleetInstallProgressReporter(opts.json ? "silent" : "text") });
             runFleetRuntimeControl(b.name, b.config, adopted ? "install" : "start", opts.json === true);
             return;
         }
@@ -3239,6 +3289,17 @@ export function registerBotCommand(program) {
         .command("intro <name>")
         .description("Have the bot re-send its introduction DM to you")
         .action((name) => wrap(() => runBotIntro(name))());
+    const runtime = bot.command("runtime").description("The HQ Fleet Runtime every local bot on this computer shares");
+    runtime
+        .command("install")
+        .description("Download and build the runtime once for this computer, with progress, so creating a bot takes seconds. Safe to run again: a finished install returns at once, an interrupted download continues where it stopped")
+        .option("--json", "Print one JSON object per line: progress events, then { ok, event: \"done\", release, runtimeDir }")
+        .action((opts) => wrap(() => runBotRuntimeInstall(opts))());
+    runtime
+        .command("status")
+        .description("Say whether the runtime is installed on this computer, step by step")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runBotRuntimeStatus(opts))());
     const daemon = bot.command("daemon").description("Manage the bot's launchd user agent (macOS)");
     daemon
         .command("install <name>")

package/dist/commands/creators.js

@@ -1,6 +1,7 @@
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
+import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
 /**
  * Testable core. Submits the application and maps the server response to a
  * single human-readable message. Throws on hard failures.
@@ -46,7 +47,7 @@ export function registerCreatorsCommand(program) {
         .action(async (options) => {
         try {
             const result = await runCreatorApply({ reason: options.reason, handle: options.handle }, {
-                getAccessToken: () => ensureCognitoToken({ interactive: true }),
+                getAccessToken: () => ensureCognitoToken({ interactive: gatedInteractiveLogin() }),
                 post: (token, body) => vaultApiFetch({
                     token,
                     path: "/v1/creators/request-access",

package/dist/commands/lanes-report.d.ts

@@ -1,9 +1,10 @@
 import type { Command } from "commander";
 import { type QuestionBody } from "../lib/lanes/questions.js";
-import type { LaneCompanyRef, QuestionRecord } from "../lib/lanes/types.js";
+import type { LaneCompanyRef, LaneRecord, QuestionRecord } from "../lib/lanes/types.js";
 import { type LaneChecksDeps } from "./lanes-checks.js";
 type WrapHandler = <Args extends unknown[]>(action: (...args: Args) => Promise<void>) => (...args: Args) => Promise<void>;
 export interface LaneReportsDeps extends LaneChecksDeps {
+    laneRunsHere: (lane: LaneRecord) => boolean;
     readQuestionBody: (root: string, question: QuestionRecord) => QuestionBody;
     focusDashboardEnabled: (company: LaneCompanyRef) => Promise<boolean>;
 }

package/dist/commands/lanes-report.js

@@ -1,12 +1,15 @@
+import * as fs from "node:fs";
 import * as path from "node:path";
 import { LanesError } from "../lib/lanes/errors.js";
 import { assertQuestionBodySecretSafe } from "../lib/lanes/questions.js";
-import { questionRecordPath } from "../lib/lanes/store.js";
+import { listLanesBySource, questionRecordPath } from "../lib/lanes/store.js";
 import { normalizeIsoTimestamp } from "../lib/lanes/timestamp.js";
 import { mapSourceStoryStatus } from "../lib/mesh/story-status.js";
 import { buildTrackerOwnerReport, buildTrackerTeamPage, renderTrackerOwnerReportText, renderTrackerTeamPageText, } from "../lib/lanes/tracker-report.js";
 import { FIRST_TRACKER_REPORT_SINCE, readTrackerReportState, writeTrackerReportState, } from "../lib/lanes/tracker-report-state.js";
 import { listTrackerRecordsTolerant, loadCompanyQuestionRecords, loadProjectMappings, mappingIncludesStory, pathForTrackerRecord, readProject, resolveTrackerCompany, } from "./lanes-checks.js";
+import { buildSourceReport, renderSourceReportText } from "../lib/lanes/source-report.js";
+import { readLaneStatusRowFields } from "../lib/lanes/status-fields.js";
 function fail(error, message, details = {}) {
     throw new LanesError(error, message, details);
 }
@@ -331,10 +334,50 @@ export function registerLaneReportCommands(parent, deps, wrap) {
     parent.command("report")
         .description("Generate the owner report for tracker teams")
         .option("--company <slug>", "Select the company by slug")
+        .option("--source <ref>", "Report lanes for a source (requires --company; excludes --since)")
         .option("--since <iso>", "Report activity from this ISO timestamp")
         .option("--json", "Emit JSON instead of the owner report text")
         .action(wrap(async (options) => {
+        if (options.source !== undefined && (!options.company?.trim() || options.since !== undefined || !options.source.trim())) {
+            fail("source_report_options_invalid", "--source requires --company and a non-empty ref, and cannot be combined with --since");
+        }
         const company = await resolveTrackerCompany(deps, options.company);
+        if (options.source !== undefined) {
+            const root = deps.hqRoot();
+            const lanes = listLanesBySource(company.slug, options.source, root)
+                .filter(lane => lane.company?.uid === company.uid);
+            const ids = new Set(lanes.map(lane => lane.lane_id));
+            const questions = new Map();
+            if (lanes.length) {
+                const pending = loadCompanyQuestionRecords(root, company)
+                    .filter(question => ids.has(question.lane_id) && question.status === "pending")
+                    .sort((a, b) => a.asked_at.localeCompare(b.asked_at) || a.question_id.localeCompare(b.question_id));
+                for (const question of pending) {
+                    if (questions.has(question.lane_id))
+                        continue;
+                    const body = deps.readQuestionBody(root, question);
+                    assertQuestionBodySecretSafe(body);
+                    questions.set(question.lane_id, { question_id: question.question_id, question: body.question });
+                }
+            }
+            const progress = new Map(lanes.filter(lane => lane.state === "running" || lane.state === "queued")
+                .map(lane => [lane.lane_id, readLaneStatusRowFields(root, lane, deps.now().getTime(), deps.laneRunsHere(lane)).last_line ?? "No progress recorded yet."]));
+            const report = buildSourceReport(company.slug, options.source, lanes, { questions, progress });
+            if (options.json)
+                console.log(JSON.stringify(report, null, 2));
+            else {
+                let template;
+                try {
+                    template = fs.readFileSync(path.join(root, "personal/settings/executive/report.md"), "utf8");
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                }
+                console.log(renderSourceReportText(report, template));
+            }
+            return;
+        }
         const root = deps.hqRoot();
         const generatedAt = deps.now().toISOString();
         const focusDashboardEnabled = await deps.focusDashboardEnabled(company);

package/dist/commands/lanes.d.ts

@@ -165,6 +165,15 @@ export declare function pickupFailureUpdater(reasonRaw: string, details: Record<
  */
 export declare function applyOutpostAccountPickup(hqRoot: string, laneId: string, modelDeps?: KnownModelsDeps): LaneRecord;
 export declare function cancelPendingQuestionsForLane(hqRoot: string, laneId: string, nowIso: string, operatorReason?: string): QuestionRecord[];
+/** In-process signal entry point sharing CLI admission, dedupe and conductor rules. */
+export declare function createLaneFromSignal(input: {
+    hqRoot: string;
+    company: string;
+    signal_id: string;
+}, deps?: LanesCommandDeps): Promise<{
+    lane_id: string;
+    existing: boolean;
+}>;
 /** @internal Exported for regression tests of the profile-refresh company check. */
 export declare function applyResumeProfileAndEffort(hqRoot: string, current: LaneRecord, next: LaneRecord, input: {
     profile?: ResolvedResumeProfile;