@indigoai-us/hq-cli 5.345.199 → 5.345.201

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 ## [Unreleased]
 
+## [5.345.201] — 2026-11-04
+- `hq deploy domains buy` accepts a registrar price in `usd` or `USD`. Search shows that price as US dollars, and renew accepts the same code. A price in another currency is still refused, and the message shows the currency code the server sent.
+- The Executive sends source reports to its owner when a meeting ends and one final threaded report after all source lanes finish. Delivery receipts suppress normal duplicates and retain reports during the ten-minute cooldown. Recovery retries an intent without a sent receipt; a crash after sending but before recording the receipt can resend that report.
+- Re-pin native policy enforcement to the corrected staging gate, including keyed host approvals and consumed fact proofs. Fix CRLF transport in Windows answer rows, receipt names and required fact names. Recognize drive-qualified and MSYS absolute read paths while preserving exact receipt names. The port remains opt-in and requires the matching core script.
+- `hq-hook`: `block-agent-secrets-reveal` has a full native port (US-011). `hq-hook bridge block-agent-secrets-reveal` answers every call of the hq-core-staging guard (sha256 `e1a1b05d`) itself, including denies, and matches the bash guard byte for byte on macOS and Windows. It runs the flag reader with node only when the command is a secret reveal, as the guard does. The flag `hook-engine-port-block-agent-secrets-reveal` stays off, so nothing changes until it is turned on.
+- `hq-hook`: port `lanes-repo-merge-hold` payload validation, merge prefilter, dependency checks and hold-response formatting to native Rust. Preserve the bounded CLI call and its failure notices, including timeouts without a hold record. Convert Git Bash TMPDIR drive paths through the shared MSYS converter. Capture CLI output in private files so inherited child handles cannot extend the timeout wait. The port flag stays off.
+- Older local bots on the Codex or Grok runner now move to the HQ Fleet Runtime at their next start when their provider sign-in is readable on the computer: the Codex CLI login (or the bot's own Codex login) is imported, and a Grok login is copied from another Fleet bot on the same computer. A bot whose sign-in is not readable stays on its legacy runner, records why, files one failure report with HQ per reason (the same route a Fleet bot reports a failed turn through), and DMs its owner once per reason with the `hq bot auth <name> --provider <chatgpt|grok>` fix. A Claude bot with its own Claude account stays and tells the owner that `hq bot auth <name> --provider claude` moves it onto the owner's Claude Code login. `hq bot list --json`, `hq bot status --json` and `hq bot start --json` now carry `brainSignIn` (the provider a bot of any engine must sign in to before it can run, with the command) and, for a legacy bot, `legacy` (whether it moves at its next start, the hold reason, the last failed move, the owner DM and the report id); `hq bot status` and `hq doctor --only bots` say the same in words. `HQ_BOT_KEEP_LEGACY_RUNTIME=1` still keeps any bot legacy.
+- Local bots now install HQ Fleet Local 0.4.26 on HQ Fleet Runtime main d257fdd1
+  (same gzip runtime archive as 0.4.25). A bot whose turn failed no longer counts its
+  own "I'm away for a bit" reply as a worked turn, so `hq bot status` and `hq doctor`
+  keep showing the failure and its fix until the bot really answers. Installed bots
+  move to 0.4.26 at the daemon's next update pass.
+- `hq sync pull` now recovers when the HQ server rejects a sign-in that still looks valid on your machine (`hq auth status` and `hq auth refresh` only check the saved expiry): it refreshes the saved session once and retries, and if the server still rejects it the message tells you to run `hq login` instead of printing a bare "Unauthorized". Waiting on the sign-in service during a sync now stops after 45 seconds with a clear message.
+
+## [5.345.200] — 2026-11-04
+- `hq creators apply`, `hq library` (search, add, describe, link, rm),
+  `hq sync held`, and `hq lanes` no longer open a browser sign-in when no
+  person is at a terminal (a lane worker, daemon, bot, launchd task, or piped
+  child). They print the `hq login` remedy instead. The headless `hq login`
+  URL path now uses a registered callback port, and a stray
+  `HQ_COGNITO_CALLBACK_PORT` warning prints once per process.
+- The stray callback-port warning no longer prints on commands that never
+  sign in; the port is read when a sign-in starts. `hq bot` and `hq secrets`
+  sign-ins now go through the same interactive-caller gate.
+- `hq bot runtime install` downloads and builds the HQ Fleet Runtime once for
+  this computer, with progress, so `hq bot create` afterwards takes seconds.
+  `hq bot runtime status` says which of the three steps (download, Python,
+  environment) are done. `--json` prints one event per line for the desktop app.
+- The runtime download streams to disk, continues where it stopped after a
+  stall or a dropped connection, and no longer has a 20 minute cap. Creates and
+  adopts started at the same time share one download through a machine-wide
+  lock instead of each fetching the same archive. A gzip runtime archive is
+  accepted alongside the plain tar, and a matching archive from any installed
+  release is reused without a download.
+- `hq bot create`, `hq bot adopt` and `hq bot restore` print what the runtime
+  install is doing on stderr (download percentage, then each build step)
+  unless `--json` is given.
+- Personal and unattributed conversations are no longer assigned from a device default company or sent as Work Mesh summaries. Reporting respects the HQ Anywhere off setting.
+- Validate session capability documents before reading company grants.
+
 ## [5.345.199] — 2026-11-04
 - `hq bot status <name>` shows the bot's last reported failure: when, the
   failure class, the plain-language cause and fix the owner was sent, the HQ

package/assets/scaffold/core/scripts/lib/session-scope-capability.sh

@@ -53,8 +53,8 @@ session_scope_read() {
   local root="${1:-}" sid="${2:-}" aid="${3:-}" cap
   cap="$(session_scope_capability_path "$root" "$sid" "$aid")" || return 0
   [ -f "$cap" ] || return 0
-  jq -r --arg sid "$sid" --arg aid "$aid" \
-    'select(.session_id == $sid and (.agent_id // "") == $aid) | .company_slug // empty' \
+  jq -sr --arg sid "$sid" --arg aid "$aid" \
+    'if length == 1 and (.[0] | type) == "object" then .[0] else error("capability must contain one object") end | select(.session_id == $sid and (.agent_id // "") == $aid) | .company_slug // empty' \
     "$cap" 2>/dev/null || true
 }
 
@@ -66,8 +66,10 @@ session_scope_read_companies() {
   local -a slugs
   cap="$(session_scope_capability_path "$root" "$sid" "$aid")" || return 0
   [ -f "$cap" ] || return 0
-  lock_info="$(jq -er --arg sid "$sid" --arg aid "$aid" '
-    select(.session_id == $sid and (.agent_id // "") == $aid)
+  lock_info="$(jq -ser --arg sid "$sid" --arg aid "$aid" '
+    if length == 1 and (.[0] | type) == "object" then .[0]
+    else error("capability must contain one object") end
+    | select(.session_id == $sid and (.agent_id // "") == $aid)
     | if (.company_slug | type) != "string" or (.company_slug | test("^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$") | not) then error("invalid primary")
       elif has("company_slugs") then
         if (.company_slugs | type) == "array" and all(.company_slugs[]; type == "string" and test("^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$"))

package/dist/command-catalog.generated.d.ts

@@ -19810,6 +19810,50 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "runtime";
+        readonly description: "The HQ Fleet Runtime every local bot on this computer shares";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: true;
+        readonly usage: "[options] [command]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "install";
+            readonly description: "Download and build the runtime once for this computer, with progress, so creating a bot takes seconds. Safe to run again: a finished install returns at once, an interrupted download continues where it stopped";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print one JSON object per line: progress events, then { ok, event: \"done\", release, runtimeDir }";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "status";
+            readonly description: "Say whether the runtime is installed on this computer, step by step";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print machine-readable JSON";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "daemon";
         readonly description: "Manage the bot's launchd user agent (macOS)";

package/dist/command-catalog.generated.js

@@ -24159,6 +24159,58 @@ export const COMMAND_CATALOG = [
                 "options": [],
                 "subcommands": []
             },
+            {
+                "name": "runtime",
+                "description": "The HQ Fleet Runtime every local bot on this computer shares",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": true,
+                "usage": "[options] [command]",
+                "helpText": [],
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "install",
+                        "description": "Download and build the runtime once for this computer, with progress, so creating a bot takes seconds. Safe to run again: a finished install returns at once, an interrupted download continues where it stopped",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "Print one JSON object per line: progress events, then { ok, event: \"done\", release, runtimeDir }",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "status",
+                        "description": "Say whether the runtime is installed on this computer, step by step",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "Print machine-readable JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "daemon",
                 "description": "Manage the bot's launchd user agent (macOS)",

package/dist/commands/bot-runtime.d.ts

@@ -0,0 +1,35 @@
+import { type FleetInstallProgress, type FleetInstallProgressListener, type FleetLocalTargetRelease } from "../lib/bot/fleet-local.js";
+export type FleetProgressMode = "text" | "json" | "silent";
+interface ProgressOutput {
+    write(text: string): void;
+    isTTY: boolean;
+}
+/** The sentence for a phase, for people. */
+export declare function describeFleetInstallPhase(event: FleetInstallProgress): string;
+/**
+ * Progress for a terminal (stderr, one line that rewrites itself on a TTY and
+ * prints at each tenth otherwise), for a program (one JSON object per line on
+ * stdout), or nothing.
+ */
+export declare function fleetInstallProgressReporter(mode: FleetProgressMode, output?: ProgressOutput, stdout?: (line: string) => void): FleetInstallProgressListener;
+export interface FleetRuntimeStatus {
+    ready: boolean;
+    release: {
+        version: string;
+        source: FleetLocalTargetRelease["source"];
+    };
+    steps: {
+        distribution: boolean;
+        python: boolean;
+        runtime: boolean;
+    };
+}
+export declare function fleetRuntimeStatus(): Promise<FleetRuntimeStatus>;
+export declare function runBotRuntimeInstall(opts: {
+    json?: boolean;
+}): Promise<void>;
+export declare function runBotRuntimeStatus(opts: {
+    json?: boolean;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=bot-runtime.d.ts.map

package/dist/commands/bot-runtime.js

@@ -0,0 +1,115 @@
+import chalk from "chalk";
+import { ensureFleetRuntimeInstalled, fleetLocalDistributionInstalled, fleetRuntimeReady, installTargetFleetLocalDistribution, resolveFleetLocalTargetRelease, } from "../lib/bot/fleet-local.js";
+import { installedFleetPython } from "../lib/bot/fleet-python.js";
+function megabytes(bytes) {
+    return `${(bytes / 1_048_576).toFixed(1)} MB`;
+}
+/** The sentence for a phase, for people. */
+export function describeFleetInstallPhase(event) {
+    switch (event.phase) {
+        case "download": {
+            const name = event.file.startsWith("hq-fleet-runtime-") ? "the HQ Fleet Runtime" : event.file;
+            if (event.total === null)
+                return `Downloading ${name}: ${megabytes(event.received)}`;
+            const percent = Math.min(100, Math.floor((event.received / Math.max(event.total, 1)) * 100));
+            return `Downloading ${name}: ${megabytes(event.received)} of ${megabytes(event.total)} (${percent}%)`;
+        }
+        case "verify":
+            return "Checking the download against its signed release";
+        case "python":
+            return "Preparing the runtime's private Python";
+        case "extract":
+            return "Unpacking the runtime";
+        case "environment":
+            return "Creating the runtime environment";
+        case "packages":
+            return "Installing the runtime's packages (a minute or two)";
+        case "ready":
+            if (event.step === "download")
+                return event.cached ? "The runtime download is already on this computer" : "The runtime download is complete";
+            return event.cached ? "The runtime is already installed on this computer" : "The runtime is ready";
+    }
+}
+/**
+ * Progress for a terminal (stderr, one line that rewrites itself on a TTY and
+ * prints at each tenth otherwise), for a program (one JSON object per line on
+ * stdout), or nothing.
+ */
+export function fleetInstallProgressReporter(mode, output = { write: (text) => { process.stderr.write(text); }, isTTY: process.stderr.isTTY === true }, stdout = (line) => { process.stdout.write(`${line}\n`); }) {
+    if (mode === "silent")
+        return () => undefined;
+    if (mode === "json") {
+        return (event) => {
+            const percent = event.phase === "download" && event.total !== null
+                ? Math.min(100, Math.floor((event.received / Math.max(event.total, 1)) * 100))
+                : null;
+            stdout(JSON.stringify({ event: "progress", ...event, percent, message: describeFleetInstallPhase(event) }));
+        };
+    }
+    let lastTenth = -1;
+    let lineOpen = false;
+    return (event) => {
+        const text = describeFleetInstallPhase(event);
+        if (event.phase === "download" && event.total !== null) {
+            const tenth = Math.floor((event.received / Math.max(event.total, 1)) * 10);
+            if (output.isTTY) {
+                output.write(`\r${text}${event.received >= event.total ? "\n" : ""}`);
+                lineOpen = event.received < event.total;
+                return;
+            }
+            if (tenth === lastTenth && event.received < event.total)
+                return;
+            lastTenth = tenth;
+            output.write(`${text}\n`);
+            return;
+        }
+        if (lineOpen) {
+            output.write("\n");
+            lineOpen = false;
+        }
+        output.write(`${text}\n`);
+    };
+}
+export async function fleetRuntimeStatus() {
+    const target = await resolveFleetLocalTargetRelease();
+    const distribution = fleetLocalDistributionInstalled(target.release);
+    const python = installedFleetPython();
+    const runtime = distribution && python ? fleetRuntimeReady({ release: target.release }, { python }) : false;
+    return {
+        ready: distribution && python !== null && runtime,
+        release: { version: target.release.version, source: target.source },
+        steps: { distribution, python: python !== null, runtime },
+    };
+}
+export async function runBotRuntimeInstall(opts) {
+    const report = fleetInstallProgressReporter(opts.json ? "json" : "text");
+    const target = await resolveFleetLocalTargetRelease();
+    const installation = await installTargetFleetLocalDistribution({ target, onProgress: report });
+    const result = await ensureFleetRuntimeInstalled(installation, { onProgress: report });
+    if (opts.json) {
+        console.log(JSON.stringify({
+            ok: true,
+            event: "done",
+            release: { version: result.release.version, source: target.source },
+            distributionDir: result.distributionDir,
+            runtimeDir: result.runtimeDir,
+        }));
+        return;
+    }
+    console.log(`${chalk.green("HQ Fleet Runtime " + result.release.version + " is ready on this computer.")} ${chalk.dim(result.runtimeDir)}`);
+}
+export async function runBotRuntimeStatus(opts) {
+    const current = await fleetRuntimeStatus();
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, ...current }, null, 2));
+        return;
+    }
+    const mark = (done) => (done ? chalk.green("ready") : chalk.yellow("missing"));
+    console.log(`HQ Fleet Runtime ${current.release.version}  ${current.ready ? chalk.green("ready") : chalk.yellow("not installed yet")}`);
+    console.log(`  download:     ${mark(current.steps.distribution)}`);
+    console.log(`  python:       ${mark(current.steps.python)}`);
+    console.log(`  environment:  ${mark(current.steps.runtime)}`);
+    if (!current.ready)
+        console.log(chalk.dim("  Run `hq bot runtime install` to get it ready before creating a bot."));
+}
+//# sourceMappingURL=bot-runtime.js.map

package/dist/commands/bot.d.ts

@@ -1,3 +1,4 @@
+import { type LegacyMoveState, type LegacyProviderLoginProbe } from "../lib/bot/legacy-convert.js";
 import { Command } from "commander";
 import { type RuntimeSignInCheck, type RuntimeSignInIssue } from "../lib/bot/runtime-sign-in.js";
 import { type ClaudeLoginCheck } from "../lib/bot/claude-login.js";
@@ -62,6 +63,16 @@ export interface BotRow {
     runtimeSignedIn: boolean | null;
     /** The terminal command that signs the bot's coding tool in on this computer. */
     signInCommand: string;
+    /**
+     * Set when the bot cannot run until its model provider is signed in, on any
+     * engine: a Fleet bot never signed in or whose last turn failed on auth, a
+     * legacy bot held for a sign-in it cannot import, or a legacy runner that
+     * found its tool signed out. `command` signs the bot in (and moves a legacy
+     * bot to the HQ Fleet Runtime); null when no sign-in is needed.
+     */
+    brainSignIn: BrainSignIn | null;
+    /** A bot still on its legacy runner: whether and why it moves at its next start. Absent for a Fleet bot. */
+    legacy?: Record<string, unknown>;
     /**
      * The coding tool crashed before its turn started since the bot last
      * started, and no turn has worked since; null otherwise. A restart clears it.
@@ -101,14 +112,52 @@ export interface BotRow {
 export declare function listBotNames(root: string): string[];
 /** Bot-identity token supplier: per-bot creds + per-bot token cache dir. */
 export declare function botTokenSupplier(dir: string): () => Promise<string>;
+/**
+ * Whether `hq bot` may open a browser sign-in for its owner: a TTY on stdin,
+ * and the shared interactive-caller gate (no lane, daemon, bot runtime, or
+ * HQ_NO_BROWSER_LOGIN child).
+ */
+export declare function ownerSignInAllowed(): boolean;
 /**
  * The bot's word on its coding tool's sign-in. Only a running bot's report
  * counts: a stopped bot's last check may be from before a sign-in or a
  * sign-out, and the next start checks afresh.
  */
 export declare function runtimeSignedIn(status: Pick<BotStatusFile, "runtimeSignIn" | "runtimeSignInCheck"> | null | undefined, processAlive: boolean): boolean | null;
+export interface BrainSignIn {
+    provider: BotRuntimeId;
+    needed: true;
+    reason: string;
+    command: string;
+}
+/**
+ * Whether the bot's model provider must be signed in before it can run, from
+ * what this computer knows: the bot's settings, its last reported failure or
+ * sign-in check, and (legacy) why it has not moved to the HQ Fleet Runtime.
+ */
+export declare function brainSignInFor(name: string, config: BotConfig, status: BotStatusFile | null, legacy: LegacyMoveState | null): BrainSignIn | null;
 /** Spawn `hq bot run <name>` detached (no launchd). */
 export declare function spawnDetachedRun(name: string, dir: string): number;
+/**
+ * Move a legacy bot onto the HQ Fleet Runtime under the same identity.
+ * Returns the bot's new settings, or null when it stays on the legacy runner
+ * (it needs its own sign-in, the move is turned off, or the move failed, in
+ * which case the next start tries again).
+ *
+ * bot.json switches to Fleet only after the Fleet service is installed, so a
+ * failure or a kill at any earlier step leaves a legacy bot that starts as
+ * before. Legacy jobs move and the legacy startup agent goes after that.
+ *
+ * `from: "start"` stops the legacy runner first; a failed move leaves it
+ * stopped and the caller starts it again. `from: "run"` is the legacy runner
+ * itself starting (launchd, hq daemon or a detached run), before it polls:
+ * its own startup agent is booted out last, detached.
+ */
+/** Seams for the legacy move, replaced in tests. */
+export declare const legacyConvertSeams: {
+    /** Whether the provider sign-in a Codex or Grok legacy bot needs is readable here, as HQ Fleet Local imports it. */
+    providerLogin: (dir: string, config: BotConfig) => LegacyProviderLoginProbe;
+};
 /**
  * `output`: "json" | "text" print a result; "silent" prints nothing — used
  * when stop is a step inside rm/restart, whose own JSON must be the only
@@ -182,6 +231,10 @@ export declare function runBotCompanies(nameArg: string, opts: {
 export declare function runBotWorkers(opts: {
     json?: boolean;
 }): Promise<void>;
+/** The `legacy` object in `hq bot status --json` for a bot still on its legacy runner. */
+export declare function legacyStatusJson(state: LegacyMoveState): Record<string, unknown>;
+/** The `fleet move:` lines of `hq bot status` for a bot still on its legacy runner. */
+export declare function legacyStatusLines(name: string, state: LegacyMoveState): string[];
 /**
  * `hq bot set <name> [--model <id|default>] [--effort <level|default>]
  * [--display-name <name>]`: change what the bot thinks with, or the name