@indigoai-us/hq-cli 5.345.198 → 5.345.200

package/dist/commands/lanes.js

@@ -75,6 +75,7 @@ import { resolveActiveMembershipCompany } from "../lib/mesh/api.js";
 import { openMeshTransport, requireToken } from "../lib/mesh/client.js";
 import { CompanySelectionError } from "../utils/company-selection-error.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
+import { createSignalLane } from "../lib/lanes/signal-lane.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { applyLoopDisposition, loopDispositionSnapshot } from "../lib/lanes/loop-disposition.js";
@@ -285,7 +286,7 @@ function failJson(err) {
             process.stderr.write(`hq lanes: ${commandError.message}\n`);
         }
         printJson({ ...commandError.toJSON(), message: commandError.message });
-        process.exit(1);
+        process.exit(["signal_not_found", "no_conductor_link"].includes(commandError.error) ? 2 : 1);
     }
     const message = commandError instanceof Error ? commandError.message : String(commandError);
     process.stderr.write(`hq lanes: ${message}${commandError instanceof Error && commandError.stack ? `\n${commandError.stack}` : ""}\n`);
@@ -1935,6 +1936,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
                 before.envelope_summary !== envelopeSummary ||
                 (mirroredReportAt !== undefined && before.last_host_report_at !== mirroredReportAt) ||
                 (isTerminalLaneState(owner.state) && (JSON.stringify(before.last_envelope) !== JSON.stringify(owner.last_envelope) ||
+                    JSON.stringify(before.outcome) !== JSON.stringify(owner.outcome) ||
                     before.story_complete !== owner.story_complete ||
                     before.story_complete_reason !== owner.story_complete_reason ||
                     before.story_status !== owner.story_status ||
@@ -1964,6 +1966,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
                     ...(mirroredReportAt !== undefined ? { last_host_report_at: mirroredReportAt } : {}),
                     ...(isTerminalLaneState(owner.state) ? {
                         last_envelope: owner.last_envelope,
+                        outcome: owner.outcome,
                         story_complete: owner.story_complete,
                         story_complete_reason: owner.story_complete_reason,
                         story_status: owner.story_status,
@@ -3465,7 +3468,34 @@ export function cancelPendingQuestionsForLane(hqRoot, laneId, nowIso, operatorRe
 function mintMessageId() {
     return `msg_${Date.now().toString(36)}_${randomBytes(3).toString("hex")}`;
 }
+/** In-process signal entry point sharing CLI admission, dedupe and conductor rules. */
+export async function createLaneFromSignal(input, deps = {}) {
+    const ctx = resolveDeps({ ...deps, hqRoot: () => input.hqRoot });
+    const company = await ctx.resolveCompany(input.company);
+    const result = await createSignalLane(input.hqRoot, {
+        company: company.slug, signal: input.signal_id, env: ctx.env,
+    }, options => runCreate(ctx, { ...options, company: company.slug, project: "executive-bot",
+        noStory: `signal:${input.signal_id}`, freshThread: true, quiet: true }));
+    return { lane_id: result.lane.lane_id, existing: result.existing };
+}
 async function runCreate(ctx, opts) {
+    if (opts.signal !== undefined) {
+        if (!opts.company?.trim())
+            throw new LanesError("missing_company", "--signal requires --company");
+        if (opts.story || opts.additionalStory?.length || opts.briefFile || (opts.project && opts.project !== "executive-bot")) {
+            throw new LanesError("signal_option_conflict", "Signal lanes use project executive-bot and a generated brief without a story");
+        }
+        const company = await ctx.resolveCompany(opts.company);
+        const result = await createSignalLane(ctx.hqRoot(), {
+            company: company.slug, signal: opts.signal, rulesFile: opts.rulesFile ? resolveCallerPath(ctx.callerCwd(), opts.rulesFile) : undefined,
+            anyType: opts.anyType, senior: opts.senior, link: opts.link, env: ctx.env,
+        }, input => runCreate(ctx, { ...opts, ...input, company: company.slug, signal: undefined, project: "executive-bot", noStory: `signal:${opts.signal}`, freshThread: opts.runner === "subagent" ? undefined : true, quiet: true }));
+        if (!opts.quiet)
+            printJson({ lane_id: result.lane.lane_id, signal_id: result.lane.signal.signal_id,
+                source_ref: result.lane.signal.source_ref, senior: result.lane.senior, link: result.lane.signal_link ?? null,
+                existing: result.existing, brief_path: result.brief_path });
+        return result.lane;
+    }
     if (opts.runner !== undefined && parseLaneRunner(opts.runner) === "subagent") {
         return runCreateSubagent(ctx, opts);
     }
@@ -4304,6 +4334,7 @@ async function runCreate(ctx, opts) {
         const admissionReservedAt = admission.action === "start" ? ctx.now().toISOString() : undefined;
         const laneInit = {
             company,
+            ...(opts.signalMetadata ? { signal: opts.signalMetadata, signal_link: opts.signalLink } : {}),
             ...(company === null && meshCompany
                 ? { mesh_company: meshCompany }
                 : {}),
@@ -6182,7 +6213,54 @@ function formatLaneListHuman(lanes) {
         rows.push("No lanes.");
     return rows.join("\n");
 }
-async function runStatus(ctx, opts) {
+async function runLaneStatus(ctx, laneId, opts) {
+    const lane = (await resolveMessageLaneTarget(ctx, laneId)).lane;
+    const status = {
+        schema_version: "hq-lanes-lane-status.v1",
+        lane_id: lane.lane_id,
+        company: lane.company?.slug ?? null,
+        state: lane.state,
+        decision: lane.last_envelope?.decision ?? null,
+        envelope_ref: lane.last_envelope?.ref ?? null,
+        story_status: lane.story_status ?? null,
+        story_complete: lane.story_complete ?? null,
+        outcome: lane.outcome ?? null,
+    };
+    if (opts.json) {
+        printJson(status);
+        return;
+    }
+    const lines = [
+        `lane ${status.lane_id}: ${status.state}` +
+            (status.decision ? ` (decision ${status.decision})` : ""),
+    ];
+    if (status.outcome) {
+        lines.push(`outcome ${status.outcome.state}: ${status.outcome.outcome}`);
+        for (const item of status.outcome.gathered) {
+            lines.push(`  gathered ${item.label}: ${item.text}${item.ref ? ` (${item.ref})` : ""}`);
+        }
+        for (const step of status.outcome.next_steps)
+            lines.push(`  next: ${step}`);
+        if (status.outcome.decision_id)
+            lines.push(`  decision_id: ${status.outcome.decision_id}`);
+    }
+    else {
+        lines.push("outcome: none");
+    }
+    console.log(lines.join("\n"));
+}
+async function runStatus(ctx, opts, laneId) {
+    if (laneId !== undefined) {
+        if (opts.project !== undefined || opts.company !== undefined) {
+            throw new LanesError("invalid_args", "hq lanes status <lane-id> reports one lane; drop --project and --company", { lane_id: laneId });
+        }
+        await runLaneStatus(ctx, laneId, opts);
+        return;
+    }
+    if (opts.project === undefined) {
+        throw new LanesError("invalid_args", "hq lanes status requires --project <slug>, or a lane id for one lane", {});
+    }
+    const projectId = opts.project;
     if (!ctx.storyLedgerEnabled()) {
         throw new LanesError("story_ledger_disabled", "hq lanes status requires the lanes.story-ledger flag", {
             flag: "lanes.story-ledger",
@@ -6216,7 +6294,7 @@ async function runStatus(ctx, opts) {
     }
     const snapshot = buildLaneStatusSnapshot({
         hqRoot,
-        projectId: opts.project,
+        projectId,
         ...(company ? { companySlug: company.slug } : {}),
         ...(company ? { companyUid: company.uid } : {}),
         lanes,
@@ -6500,6 +6578,7 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane, resolveLaneTarget
         fingerprint: lane.fingerprint ?? null,
         envelope_repair_mode: lane.envelope_repair?.mode ?? null,
         envelope_validation_errors: lane.envelope_validation_errors ?? [],
+        outcome: lane.outcome ?? null,
         last_resume: lane.last_resume ?? null,
         // Public JSON key for the bounded start audit; `last_resume` remains unchanged.
         resume_history: lane.resume_history ?? [],
@@ -9162,6 +9241,7 @@ async function runCreateSubagent(ctx, opts) {
     const createdAt = ctx.now().toISOString();
     const lane = createLane(hqRoot, {
         company,
+        ...(opts.signalMetadata ? { signal: opts.signalMetadata, signal_link: opts.signalLink } : {}),
         ...(company === null && meshCompany ? { mesh_company: meshCompany } : {}),
         project_id: project,
         story_id: story ?? "",
@@ -10402,6 +10482,7 @@ export function registerLanesCommand(parent, deps = {}) {
     });
     registerLaneReportCommands(lanes, {
         hqRoot: ctx.hqRoot,
+        laneRunsHere: (lane) => laneRunsHere(lane, reconcileHostFromCtx(ctx)),
         resolveCompany: ctx.resolveCompany,
         now: ctx.now,
         focusDashboardEnabled: (company) => readLanesRegistryFlagFailOff(LANE_FOCUS_DASHBOARD_FLAG, {
@@ -10446,12 +10527,16 @@ export function registerLanesCommand(parent, deps = {}) {
         .description("Register a lane, run admission, and return immediately")
         .option("--company <slug|uid>", "Company slug or cloud uid; omit for a core/personal lane")
         .option("--mesh-company <slug|uid>", "Explicit Work Mesh company for a personal lane; membership is verified")
-        .requiredOption("--project <slug>", "HQ project slug")
+        .option("--project <slug>", "HQ project slug (executive-bot for --signal)")
+        .option("--signal <id>", "Create one lane for a company signal")
+        .option("--rules-file <path>", "Standing rules for a signal lane")
+        .option("--any-type", "Allow signal types other than action_item")
+        .option("--link <id>", "Conductor link for a signal lane")
         .option("--story <id>", "Story id from the project's prd.json")
         .option("--focus-override <reason>", "Human-approved reason to override the lane focus guard")
         .addOption(noStoryOption)
         .option("--additional-story <id>", "Additional story carried by this lane; repeatable and discouraged when active", collectRepeatable)
-        .requiredOption("--brief-file <path>", "Path to the lane brief")
+        .option("--brief-file <path>", "Path to the lane brief (generated for --signal)")
         .option("--worker <name>", "HQ worker or reusable profile id")
         .option("--fresh-thread", "Skip worker continuity and start a cold provider session")
         .option("--loop", "Keep one worker lane registered to process queued phase envelopes")
@@ -10697,12 +10782,13 @@ export function registerLanesCommand(parent, deps = {}) {
     }));
     lanes
         .command("status")
-        .description("Summarize project stories, lanes, PRs, blockers, and pending questions")
-        .requiredOption("--project <slug>", "HQ project slug")
+        .description("Summarize project stories, lanes, PRs, blockers, and pending questions; with a lane id, report that lane's outcome")
+        .argument("[lane-id]", "Report one lane's state and outcome block instead of a project")
+        .option("--project <slug>", "HQ project slug (required without a lane id)")
         .option("--company <slug|uid>", "Company project scope; omit for a personal project")
         .option("--json", "Emit JSON on stdout")
-        .action(wrap(async (opts) => {
-        await runStatus(ctx, opts);
+        .action(wrap(async (laneId, opts) => {
+        await runStatus(ctx, opts, laneId);
     }));
     lanes
         .command("capacity")

package/dist/commands/library-remove.js

@@ -44,6 +44,7 @@ import * as readline from "node:readline";
 import chalk from "chalk";
 import { isCloudPlaceholderName, parseCloudPlaceholder } from "@indigoai-us/hq-cloud";
 import { OFFLOAD_PREFIX, PLACEHOLDER_SUFFIX, digestFile, resolvePlaceholder } from "./storage-offload.js";
+import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
 /** A company library blob key: `.hq-offload/blobs/<64 lowercase hex>`. */
 const BLOB_KEY_PATTERN = /^\.hq-offload\/blobs\/([0-9a-f]{64})$/;
 /** hq-pro caps an asset search at 50 hits. */
@@ -637,7 +638,7 @@ export function registerLibraryRemoveCommand(library) {
                 import("../utils/manifest.js"),
             ]);
             const credential = await resolveVaultCredentialForCapability("files:write", "library rm", {
-                interactive: true,
+                interactive: gatedInteractiveLogin(),
             });
             const { token } = credential;
             const apiKey = credential.kind === "api-key";

package/dist/commands/library.js

@@ -41,6 +41,7 @@ import { defaultLibraryIo, resolveLibrarySyncScope, runLibraryAdd, runLibraryTag
 import { captionAddedAsset, extractCaptionFrames, runLibraryDescribe, runLocalClaude } from "./library-caption.js";
 import { LIBRARY_LINK_DEFAULT_MINUTES, LIBRARY_LINK_MAX_MINUTES, runLibraryLink } from "./library-link.js";
 import { registerLibraryRemoveCommand } from "./library-remove.js";
+import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
 /** Mirrors hq-pro's MAX_ASSET_SEARCH_TAGS / tag length bound. */
 export const MAX_LIBRARY_SEARCH_TAGS = 20;
 const MAX_TAG_LENGTH = 100;
@@ -445,7 +446,7 @@ export function registerLibraryCommand(program) {
             };
             const result = await runLibrarySearch(queryParts.join(" "), searchOptions, {
                 getToken: async () => (await resolveVaultCredentialForCapability("search:query", "library search", {
-                    interactive: true,
+                    interactive: gatedInteractiveLogin(),
                 })).token,
                 post: (token, body) => vaultApiFetch({ token, path: "/v1/search", method: "POST", body }),
                 searchLocal: (query, opts) => searchLocalAssets(query, opts, defaultLocalEnv()),
@@ -476,7 +477,7 @@ export function registerLibraryCommand(program) {
         .action(async (sources, options) => {
         try {
             const credential = await resolveVaultCredentialForCapability("files:write", "library add", {
-                interactive: true,
+                interactive: gatedInteractiveLogin(),
             });
             const { token } = credential;
             const hqRoot = findHqRoot();
@@ -561,7 +562,7 @@ export function registerLibraryCommand(program) {
         .action(async (target, options) => {
         try {
             const credential = await resolveVaultCredentialForCapability("files:read", "library describe", {
-                interactive: true,
+                interactive: gatedInteractiveLogin(),
             });
             const { token } = credential;
             const hqRoot = findHqRoot();
@@ -618,7 +619,7 @@ export function registerLibraryCommand(program) {
         .action(async (target, options) => {
         try {
             const credential = await resolveVaultCredentialForCapability("files:read", "library link", {
-                interactive: true,
+                interactive: gatedInteractiveLogin(),
             });
             const { token } = credential;
             const result = await runLibraryLink(target, { company: options.company, expiresMinutes: options.expires }, {

package/dist/commands/meetings.js

@@ -6,6 +6,7 @@ import { sessionIdFromEnv } from "../lib/core-utils/session-id.js";
 import { vaultApiFetch, getCompanyUid, resolveCallerPersonUid, } from "../utils/vault-api.js";
 import { isPlanGateError, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
 import { mapWithConcurrency } from "./sync-manifest.js";
+import { fetchAttendedLiveBots } from "../lib/live-meetings.js";
 import { isUsageOnly, pricingPlanFromBody, resolveCompanyPricingPlan, usageOnlyCardRequiredLines, usagePauseFromBody, } from "../lib/billing/usage-only.js";
 const LIVE_SNAPSHOT_STATUSES = new Set([
     "joining",
@@ -110,27 +111,6 @@ function liveBotTime(bot) {
         .filter(Number.isFinite);
     return times.length > 0 ? Math.max(...times) : Number.NEGATIVE_INFINITY;
 }
-/**
- * Live meetings in this company the caller may read but did not record.
- *
- * `/v1/bot/list` returns only the caller's own notetakers, so a meeting a
- * coworker recorded never appears there. The meetings API lists the live
- * meetings the caller is an attendee of. An older server ignores `view=live`
- * and answers with the ordinary meeting list, which has no `bots`, and any
- * failure here leaves the caller's own list unchanged.
- */
-async function fetchAttendedLiveBots(token, companyId) {
-    try {
-        const res = await vaultApiFetch({ token, path: "/v1/meetings", query: { companyId, view: "live" } });
-        if (!res.ok)
-            return [];
-        const data = (await res.json());
-        return Array.isArray(data.bots) ? data.bots : [];
-    }
-    catch {
-        return [];
-    }
-}
 /** The caller's own bots first; attended meetings they did not record added after. */
 function mergeLiveMeetingBots(own, attended) {
     const seen = new Set(own.map(liveBotId).filter((id) => Boolean(id)));

package/dist/commands/mesh.d.ts

@@ -1,10 +1,3 @@
-/**
- * `hq mesh` — work-mesh verbs for agents and local sessions.
- *
- * Native hq-cli: Cognito + hq-pro REST + ~/.hq/work-mesh/cache. Does not
- * require hq-pack-work-mesh on disk and does not start MQTT listen.
- * Distinct from `hq doctor` (hook guardrails).
- */
 import { Command } from "commander";
 import { type MeshCompany, type MeshProjectRepo, type MeshProjectStoryInput, type MeshThread } from "../lib/mesh/api.js";
 import { UnknownProjectStoryStateError } from "../lib/mesh/story-status.js";

package/dist/commands/mesh.js

@@ -1,3 +1,4 @@
+import { reportingRuntimeAllowed } from "../lib/mesh/live/reporting-privacy.js";
 /**
  * `hq mesh` — work-mesh verbs for agents and local sessions.
  *
@@ -1123,6 +1124,7 @@ async function runPrdSync(opts) {
     }));
     const poster = createEmitPoster({ token, baseUrl: resolveVaultApiBase(process.env) });
     const emitted = await emitEvents({
+        reportingAllowed: () => reportingRuntimeAllowed(isMachineIdentity()),
         workMeshRoot: meshRoot,
         poster,
         newEvents: events,
@@ -2534,6 +2536,7 @@ async function runSessionEnqueue(cliKind, opts) {
         baseUrl: resolveVaultApiBase(process.env),
     });
     const summary = await emitEvents({
+        reportingAllowed: () => reportingRuntimeAllowed(isMachineIdentity()),
         workMeshRoot: meshRoot,
         poster,
         newEvents: [event],
@@ -2617,7 +2620,7 @@ async function runMeshEmit(opts) {
         skipped = backlog.skipped;
         newEvents = backlog.events;
     }
-    const summary = await emitEvents({ workMeshRoot: meshRoot, poster, newEvents });
+    const summary = await emitEvents({ reportingAllowed: () => reportingRuntimeAllowed(isMachineIdentity()), workMeshRoot: meshRoot, poster, newEvents });
     const out = {
         ok: true,
         action: "emit",
@@ -2643,6 +2646,7 @@ async function runSessionFlush(opts) {
         baseUrl: resolveVaultApiBase(process.env),
     });
     const summary = await flushSessionEvents({
+        reportingAllowed: () => reportingRuntimeAllowed(isMachineIdentity()),
         workMeshRoot: workMeshHomeRoot(),
         workContextRoot: workContextHomeRoot(),
         poster,

package/dist/commands/signals-run.d.ts

@@ -11,6 +11,8 @@ import { Command } from "commander";
 import { type RunSignalsResult, type SignalsStepChoice, type SignalsTrigger } from "../lib/signals/engine.js";
 import type { SignalsRunAlertSenders } from "../lib/signals/failure-alert.js";
 interface RunCliOptions {
+    source?: string;
+    incremental?: boolean;
     company?: string;
     dryRun?: boolean;
     step: SignalsStepChoice;

package/dist/commands/signals-run.js

@@ -109,6 +109,8 @@ export async function runSignalsCli(options, overrides = {}) {
     const result = await runSignals({
         hqRoot: options.hqRoot,
         company: options.company,
+        source: options.source,
+        incremental: options.incremental,
         dryRun: options.dryRun === true,
         step: options.step,
         trigger: options.trigger,
@@ -134,7 +136,8 @@ export async function runSignalsCli(options, overrides = {}) {
         process.stdout.write(`${JSON.stringify({ status, startedAt, trigger })}\n`);
     }
     else if (options.json) {
-        const payload = options.company && result.records.length === 1 ? result.records[0] : result;
+        const record = result.records[0];
+        const payload = options.incremental && record ? { ...record, ...record.steps.find((s) => s.name === "extract")?.detail } : options.company && result.records.length === 1 ? record : result;
         process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
     }
     else {
@@ -150,6 +153,8 @@ export function registerSignalsRunSubcommand(signals) {
     run
         .description("Run the local signals engine (garden, adapters, extract, garden, upload) for companies with capture on")
         .option("--company <slug>", "Run one company (default: every company listed in the companies manifest)")
+        .option("--source <ref>", "Read a growing source: meeting:<id> or <channel>:<file> (needs --incremental and --company)")
+        .option("--incremental", "Extract only new signals from --source, retaining a cursor and prior signal ids")
         .option("--dry-run", "Print what would run; run no mutating step and write nothing")
         .addOption(new Option("--step <step>", "Run one step").choices([...SIGNALS_STEP_CHOICES]).default("all"))
         .addOption(new Option("--trigger <trigger>", "What started the run").choices([...SIGNALS_TRIGGERS]).default("manual"))

package/dist/commands/sync-held.js

@@ -19,6 +19,7 @@ import { VaultClient, PERSONAL_VAULT_JOURNAL_SLUG, getStateDir } from "@indigoai
 import { buildVaultConfig, cognitoSubjectFromToken, ensureCognitoToken } from "../utils/cognito-session.js";
 import { decodeJwtPayload } from "../utils/person-token-cache.js";
 import { resolveCanonicalPersonUid } from "./cloud.js";
+import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
 export const HELD_UNAVAILABLE_MESSAGE = "this HQ build cannot list or release held uploads yet; update HQ and try again";
 export function fenceExports(mod = hqCloud) {
     const list = mod.listPushIdentityFences;
@@ -157,11 +158,10 @@ export async function resolveHeldIdentity(options, io) {
     return { sub, personalUid };
 }
 export function createDefaultSyncHeldDeps() {
-    const tty = process.stdin.isTTY === true && process.stdout.isTTY === true;
     return {
         exports: fenceExports(),
         stateDir: getStateDir(),
-        identity: (options) => resolveHeldIdentity({ needPersonal: options.needPersonal, interactive: options.interactive && tty }, {
+        identity: (options) => resolveHeldIdentity({ needPersonal: options.needPersonal, interactive: gatedInteractiveLogin(options.interactive) }, {
             ensureToken: (interactive) => ensureCognitoToken({ interactive }),
             listPersons: async (token) => (await new VaultClient(buildVaultConfig(token)).entity.listByType("person")),
         }),

package/dist/lanes-drain-hook.js

@@ -187,6 +187,15 @@ async function main() {
     for await (const chunk of process.stdin)
         chunks.push(Buffer.from(chunk));
     const text = Buffer.concat(chunks).toString("utf8");
+    if (process.env.HQ_LANE_SIGNAL_LINK && process.env.HQ_ROOT) {
+        try {
+            const { bindSignalLaneHook } = await import("./lib/lanes/links.js");
+            bindSignalLaneHook(process.env.HQ_ROOT, text, process.env);
+        }
+        catch {
+            process.stderr.write("hq-lanes-drain: signal_link_binding_failed; conductor link remains unavailable\n");
+        }
+    }
     let input = {};
     let inputError = "";
     try {

package/dist/lib/bot/api.d.ts

@@ -62,6 +62,11 @@ export interface JobRunCompletion {
 }
 /** A job record as the cloud returns it (hq-pro-agents jobs/schema.ts `JobRecord`). */
 export interface BotJobRecord {
+    trigger?: {
+        kind: "event";
+        event: string;
+        filter?: Record<string, string>;
+    };
     jobId: string;
     prompt: string;
     status?: string;

package/dist/lib/bot/claude-login.d.ts

@@ -0,0 +1,31 @@
+export declare const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+export declare const CLAUDE_LOGIN_ENV_VARS: readonly ["ANTHROPIC_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+export type ClaudeLoginStatus = "ok" | "missing" | "expired" | "skipped";
+export interface ClaudeLoginSource {
+    source: string;
+    status: ClaudeLoginStatus;
+    reason: string;
+}
+export interface ClaudeLoginCheck {
+    signedIn: boolean;
+    /** The first source the runtime would use, when signed in. */
+    via: string | null;
+    sources: ClaudeLoginSource[];
+}
+export interface KeychainRead {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export interface ClaudeLoginDeps {
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    platform?: NodeJS.Platform;
+    readKeychain?: () => KeychainRead;
+    now?: () => number;
+}
+export declare function checkClaudeCodeLogin(deps?: ClaudeLoginDeps): ClaudeLoginCheck;
+/** One sentence listing every source that did not yield a login. */
+export declare function describeClaudeLoginSources(check: ClaudeLoginCheck): string;
+export declare function claudeLoginFix(botName?: string): string;
+//# sourceMappingURL=claude-login.d.ts.map

package/dist/lib/bot/claude-login.js

@@ -0,0 +1,160 @@
+/**
+ * Can a Claude bot on the HQ Fleet Runtime read a Claude Code login here?
+ *
+ * The runtime never runs the `claude` binary; it calls Anthropic with the
+ * owner's Claude Code OAuth token, read in this order (its
+ * `resolve_anthropic_token`): ANTHROPIC_TOKEN, CLAUDE_CODE_OAUTH_TOKEN and
+ * ANTHROPIC_API_KEY from the environment, the HQ Fleet login file,
+ * ~/.claude/.credentials.json, then the macOS Keychain item
+ * "Claude Code-credentials". This mirrors that order so `hq doctor` and
+ * `hq bot create` can say which sources were checked and why each failed,
+ * without printing a token.
+ */
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fleetHome } from "./fleet-local.js";
+export const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+export const CLAUDE_LOGIN_ENV_VARS = ["ANTHROPIC_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+function readKeychainWithSecurity() {
+    try {
+        const stdout = execFileSync("security", ["find-generic-password", "-s", CLAUDE_KEYCHAIN_SERVICE, "-w"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 5000,
+        });
+        return { code: 0, stdout, stderr: "" };
+    }
+    catch (error) {
+        const failure = error;
+        const stderr = failure.stderr ? String(failure.stderr) : (failure.message ?? "");
+        return { code: typeof failure.status === "number" ? failure.status : -1, stdout: "", stderr };
+    }
+}
+function oauthRecord(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const record = value;
+    const accessToken = typeof record.accessToken === "string" ? record.accessToken.trim() : "";
+    if (!accessToken)
+        return null;
+    return {
+        accessToken,
+        refreshToken: typeof record.refreshToken === "string" ? record.refreshToken : "",
+        expiresAt: typeof record.expiresAt === "number" ? record.expiresAt : 0,
+    };
+}
+function describeRecord(record, now) {
+    if (!record.expiresAt || now < record.expiresAt - 60_000) {
+        return { status: "ok", reason: "access token present and not expired", usable: true };
+    }
+    if (record.refreshToken) {
+        return { status: "expired", reason: "access token expired; the bot refreshes it with the refresh token", usable: true };
+    }
+    return { status: "expired", reason: "access token expired and no refresh token", usable: false };
+}
+function readJsonFile(file) {
+    if (!fs.existsSync(file))
+        return { parsed: null, problem: `${file} does not exist` };
+    try {
+        return { parsed: JSON.parse(fs.readFileSync(file, "utf8")), problem: null };
+    }
+    catch (error) {
+        return { parsed: null, problem: `${file} could not be read (${error.message})` };
+    }
+}
+export function checkClaudeCodeLogin(deps = {}) {
+    const env = deps.env ?? process.env;
+    const home = deps.home ?? os.homedir();
+    const platform = deps.platform ?? process.platform;
+    const now = (deps.now ?? Date.now)();
+    const sources = [];
+    let via = null;
+    const found = (source) => {
+        if (via === null)
+            via = source;
+    };
+    for (const name of CLAUDE_LOGIN_ENV_VARS) {
+        const set = !!env[name]?.trim();
+        sources.push({ source: `env:${name}`, status: set ? "ok" : "missing", reason: set ? "set" : "not set in this environment" });
+        if (set)
+            found(`env:${name}`);
+    }
+    const fleetLogin = path.join(fleetHome(home, env), ".anthropic_oauth.json");
+    const fleetFile = readJsonFile(fleetLogin);
+    const fleetRecord = fleetFile.parsed ? oauthRecord(fleetFile.parsed) : null;
+    if (fleetRecord) {
+        const described = describeRecord(fleetRecord, now);
+        sources.push({ source: "hq_fleet_oauth_file", status: described.status, reason: described.reason });
+        if (described.usable)
+            found("hq_fleet_oauth_file");
+    }
+    else {
+        sources.push({ source: "hq_fleet_oauth_file", status: "missing", reason: fleetFile.problem ?? `${fleetLogin} holds no access token` });
+    }
+    const credentialsFile = path.join(home, ".claude", ".credentials.json");
+    const claudeFile = readJsonFile(credentialsFile);
+    const claudeRecord = claudeFile.parsed ? oauthRecord(claudeFile.parsed.claudeAiOauth) : null;
+    if (claudeRecord) {
+        const described = describeRecord(claudeRecord, now);
+        sources.push({ source: "claude_code_credentials_file", status: described.status, reason: described.reason });
+        if (described.usable)
+            found("claude_code_credentials_file");
+    }
+    else {
+        sources.push({
+            source: "claude_code_credentials_file",
+            status: "missing",
+            reason: claudeFile.problem ?? `${credentialsFile} holds no claudeAiOauth access token`,
+        });
+    }
+    if (platform !== "darwin") {
+        sources.push({ source: "macos_keychain", status: "skipped", reason: "not macOS" });
+    }
+    else {
+        const read = (deps.readKeychain ?? readKeychainWithSecurity)();
+        if (read.code !== 0) {
+            const detail = read.stderr.replace(/\s+/g, " ").trim().slice(0, 200) || `exit ${read.code}`;
+            sources.push({ source: "macos_keychain", status: "missing", reason: `no readable '${CLAUDE_KEYCHAIN_SERVICE}' item (${detail})` });
+        }
+        else {
+            let payload;
+            try {
+                payload = JSON.parse(read.stdout.trim());
+            }
+            catch {
+                payload = null;
+            }
+            const record = payload && typeof payload === "object" ? oauthRecord(payload.claudeAiOauth) : null;
+            if (record) {
+                const described = describeRecord(record, now);
+                sources.push({ source: "macos_keychain", status: described.status, reason: described.reason });
+                if (described.usable)
+                    found("macos_keychain");
+            }
+            else {
+                sources.push({ source: "macos_keychain", status: "missing", reason: "keychain item has no claudeAiOauth access token" });
+            }
+        }
+    }
+    return { signedIn: via !== null, via, sources };
+}
+const SOURCE_LABELS = {
+    hq_fleet_oauth_file: "the HQ Fleet login file",
+    claude_code_credentials_file: "~/.claude/.credentials.json",
+    macos_keychain: "the macOS Keychain",
+};
+/** One sentence listing every source that did not yield a login. */
+export function describeClaudeLoginSources(check) {
+    const parts = check.sources
+        .filter((entry) => entry.status !== "ok" && entry.status !== "skipped")
+        .map((entry) => `${SOURCE_LABELS[entry.source] ?? entry.source.replace("env:", "")}: ${entry.reason}`);
+    return parts.length ? `Checked ${parts.join("; ")}.` : "";
+}
+export function claudeLoginFix(botName) {
+    return botName
+        ? `Run \`claude /login\` in a terminal on this computer, then \`hq bot restart ${botName}\`.`
+        : "Run `claude /login` in a terminal on this computer, then retry.";
+}
+//# sourceMappingURL=claude-login.js.map

package/dist/lib/bot/events.d.ts

@@ -0,0 +1,18 @@
+import type { InboxItem } from "./api.js";
+import { type LocalJob } from "./local-jobs.js";
+/** Rotate journals at five MiB without discarding unread records. */
+export declare const EVENT_ROTATE_BYTES: number;
+export declare const EVENT_PAYLOAD_BYTES: number;
+export interface BotEvent {
+    event: string;
+    at: string;
+    payload: Record<string, unknown>;
+}
+export declare function validateEventPayload(payload: unknown): asserts payload is Record<string, unknown>;
+export declare function emitBotEvent(dir: string, event: string, payload: unknown, now?: Date, alreadyEmitted?: (record: BotEvent) => boolean): BotEvent;
+export declare function eventMatches(job: LocalJob, record: BotEvent): boolean;
+/** Pending items survive a crash between queueing and the next poll. */
+export declare function drainBotEvents(dir: string): InboxItem[];
+export declare function ackBotEvent(dir: string, messageId: string): void;
+export declare function tailBotEvents(dir: string, predicate?: (event: BotEvent) => boolean): BotEvent[];
+//# sourceMappingURL=events.d.ts.map