@indigoai-us/hq-cli 5.345.200 → 5.345.201

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [5.345.201] — 2026-11-04
+- `hq deploy domains buy` accepts a registrar price in `usd` or `USD`. Search shows that price as US dollars, and renew accepts the same code. A price in another currency is still refused, and the message shows the currency code the server sent.
+- The Executive sends source reports to its owner when a meeting ends and one final threaded report after all source lanes finish. Delivery receipts suppress normal duplicates and retain reports during the ten-minute cooldown. Recovery retries an intent without a sent receipt; a crash after sending but before recording the receipt can resend that report.
+- Re-pin native policy enforcement to the corrected staging gate, including keyed host approvals and consumed fact proofs. Fix CRLF transport in Windows answer rows, receipt names and required fact names. Recognize drive-qualified and MSYS absolute read paths while preserving exact receipt names. The port remains opt-in and requires the matching core script.
+- `hq-hook`: `block-agent-secrets-reveal` has a full native port (US-011). `hq-hook bridge block-agent-secrets-reveal` answers every call of the hq-core-staging guard (sha256 `e1a1b05d`) itself, including denies, and matches the bash guard byte for byte on macOS and Windows. It runs the flag reader with node only when the command is a secret reveal, as the guard does. The flag `hook-engine-port-block-agent-secrets-reveal` stays off, so nothing changes until it is turned on.
+- `hq-hook`: port `lanes-repo-merge-hold` payload validation, merge prefilter, dependency checks and hold-response formatting to native Rust. Preserve the bounded CLI call and its failure notices, including timeouts without a hold record. Convert Git Bash TMPDIR drive paths through the shared MSYS converter. Capture CLI output in private files so inherited child handles cannot extend the timeout wait. The port flag stays off.
+- Older local bots on the Codex or Grok runner now move to the HQ Fleet Runtime at their next start when their provider sign-in is readable on the computer: the Codex CLI login (or the bot's own Codex login) is imported, and a Grok login is copied from another Fleet bot on the same computer. A bot whose sign-in is not readable stays on its legacy runner, records why, files one failure report with HQ per reason (the same route a Fleet bot reports a failed turn through), and DMs its owner once per reason with the `hq bot auth <name> --provider <chatgpt|grok>` fix. A Claude bot with its own Claude account stays and tells the owner that `hq bot auth <name> --provider claude` moves it onto the owner's Claude Code login. `hq bot list --json`, `hq bot status --json` and `hq bot start --json` now carry `brainSignIn` (the provider a bot of any engine must sign in to before it can run, with the command) and, for a legacy bot, `legacy` (whether it moves at its next start, the hold reason, the last failed move, the owner DM and the report id); `hq bot status` and `hq doctor --only bots` say the same in words. `HQ_BOT_KEEP_LEGACY_RUNTIME=1` still keeps any bot legacy.
+- Local bots now install HQ Fleet Local 0.4.26 on HQ Fleet Runtime main d257fdd1
+  (same gzip runtime archive as 0.4.25). A bot whose turn failed no longer counts its
+  own "I'm away for a bit" reply as a worked turn, so `hq bot status` and `hq doctor`
+  keep showing the failure and its fix until the bot really answers. Installed bots
+  move to 0.4.26 at the daemon's next update pass.
+- `hq sync pull` now recovers when the HQ server rejects a sign-in that still looks valid on your machine (`hq auth status` and `hq auth refresh` only check the saved expiry): it refreshes the saved session once and retries, and if the server still rejects it the message tells you to run `hq login` instead of printing a bare "Unauthorized". Waiting on the sign-in service during a sync now stops after 45 seconds with a clear message.
+
 ## [5.345.200] — 2026-11-04
 - `hq creators apply`, `hq library` (search, add, describe, link, rm),
   `hq sync held`, and `hq lanes` no longer open a browser sign-in when no

package/dist/commands/bot.d.ts

@@ -1,3 +1,4 @@
+import { type LegacyMoveState, type LegacyProviderLoginProbe } from "../lib/bot/legacy-convert.js";
 import { Command } from "commander";
 import { type RuntimeSignInCheck, type RuntimeSignInIssue } from "../lib/bot/runtime-sign-in.js";
 import { type ClaudeLoginCheck } from "../lib/bot/claude-login.js";
@@ -62,6 +63,16 @@ export interface BotRow {
     runtimeSignedIn: boolean | null;
     /** The terminal command that signs the bot's coding tool in on this computer. */
     signInCommand: string;
+    /**
+     * Set when the bot cannot run until its model provider is signed in, on any
+     * engine: a Fleet bot never signed in or whose last turn failed on auth, a
+     * legacy bot held for a sign-in it cannot import, or a legacy runner that
+     * found its tool signed out. `command` signs the bot in (and moves a legacy
+     * bot to the HQ Fleet Runtime); null when no sign-in is needed.
+     */
+    brainSignIn: BrainSignIn | null;
+    /** A bot still on its legacy runner: whether and why it moves at its next start. Absent for a Fleet bot. */
+    legacy?: Record<string, unknown>;
     /**
      * The coding tool crashed before its turn started since the bot last
      * started, and no turn has worked since; null otherwise. A restart clears it.
@@ -113,8 +124,40 @@ export declare function ownerSignInAllowed(): boolean;
  * sign-out, and the next start checks afresh.
  */
 export declare function runtimeSignedIn(status: Pick<BotStatusFile, "runtimeSignIn" | "runtimeSignInCheck"> | null | undefined, processAlive: boolean): boolean | null;
+export interface BrainSignIn {
+    provider: BotRuntimeId;
+    needed: true;
+    reason: string;
+    command: string;
+}
+/**
+ * Whether the bot's model provider must be signed in before it can run, from
+ * what this computer knows: the bot's settings, its last reported failure or
+ * sign-in check, and (legacy) why it has not moved to the HQ Fleet Runtime.
+ */
+export declare function brainSignInFor(name: string, config: BotConfig, status: BotStatusFile | null, legacy: LegacyMoveState | null): BrainSignIn | null;
 /** Spawn `hq bot run <name>` detached (no launchd). */
 export declare function spawnDetachedRun(name: string, dir: string): number;
+/**
+ * Move a legacy bot onto the HQ Fleet Runtime under the same identity.
+ * Returns the bot's new settings, or null when it stays on the legacy runner
+ * (it needs its own sign-in, the move is turned off, or the move failed, in
+ * which case the next start tries again).
+ *
+ * bot.json switches to Fleet only after the Fleet service is installed, so a
+ * failure or a kill at any earlier step leaves a legacy bot that starts as
+ * before. Legacy jobs move and the legacy startup agent goes after that.
+ *
+ * `from: "start"` stops the legacy runner first; a failed move leaves it
+ * stopped and the caller starts it again. `from: "run"` is the legacy runner
+ * itself starting (launchd, hq daemon or a detached run), before it polls:
+ * its own startup agent is booted out last, detached.
+ */
+/** Seams for the legacy move, replaced in tests. */
+export declare const legacyConvertSeams: {
+    /** Whether the provider sign-in a Codex or Grok legacy bot needs is readable here, as HQ Fleet Local imports it. */
+    providerLogin: (dir: string, config: BotConfig) => LegacyProviderLoginProbe;
+};
 /**
  * `output`: "json" | "text" print a result; "silent" prints nothing — used
  * when stop is a step inside rm/restart, whose own JSON must be the only
@@ -188,6 +231,10 @@ export declare function runBotCompanies(nameArg: string, opts: {
 export declare function runBotWorkers(opts: {
     json?: boolean;
 }): Promise<void>;
+/** The `legacy` object in `hq bot status --json` for a bot still on its legacy runner. */
+export declare function legacyStatusJson(state: LegacyMoveState): Record<string, unknown>;
+/** The `fleet move:` lines of `hq bot status` for a bot still on its legacy runner. */
+export declare function legacyStatusLines(name: string, state: LegacyMoveState): string[];
 /**
  * `hq bot set <name> [--model <id|default>] [--effort <level|default>]
  * [--display-name <name>]`: change what the bot thinks with, or the name

package/dist/commands/bot.js

@@ -1,5 +1,8 @@
 import { withLocalJobs } from "../lib/bot/local-jobs.js";
-import { fleetMoveFailurePath, fleetMoveRecentlyFailed, legacyConversionDecision, writeFleetMoveFailure } from "../lib/bot/legacy-convert.js";
+import { clearFleetMoveRecords, fleetMoveHoldPath, fleetMoveRecentlyFailed, holdReportDue, legacyConversionDecision, legacyHoldFailureReport, legacyHoldNotice, legacyHoldNotifiesOwner, legacyMoveState, ownerHoldNoticeDue, readFleetMoveFailure, readFleetMoveHold, writeFleetMoveFailure, writeFleetMoveHold, } from "../lib/bot/legacy-convert.js";
+import { legacyProviderLoginProbe } from "../lib/bot/legacy-provider-login.js";
+import { randomUUID } from "node:crypto";
+import { CLI_VERSION } from "../cli-version.js";
 import { runSignals } from "../lib/signals/engine.js";
 import { BOT_SIGNALS_ENGINE_JOB_FLAG, signalsEngineForJob } from "../lib/bot/signals-engine-flag.js";
 import { resolveProcessFlagGate } from "../lib/flag-registry.js";
@@ -70,7 +73,7 @@ import { unresolvedLastFailure } from "../lib/doctor/checks/bots.js";
 import { classifyRuntimeFailure, runtimeFailureReason } from "../lib/bot/runtime-failure.js";
 import { PROBE_DEFAULT_TIMEOUT_MS, probeBotRuntime } from "../lib/bot/probe.js";
 import { BOT_LOGIN_RUNTIMES, botAuthEnv, botRuntimeAuth, capacityAccountHome, describeBotAuth, formatBotAuth, isBotLoginRuntime, restoreBotSessions, setAsideBotSessions, signInBotRuntime, signOutBotRuntime, withRuntimeAuth, } from "../lib/bot/runtime-auth.js";
-import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, HQ_FLEET_LOCAL_RELEASE, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, fleetLocalProfileNeedsAdoption, fleetLocalServiceInstalled, fleetProviderForRuntime, importFleetLocalMachineCredential, fleetProviderNeedsSignIn, fleetOwnerCompanies, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, installTargetFleetLocalDistribution, resolveFleetLocalPointerTarget, resolveFleetLocalTargetRelease, fleetLocalProfileDir, fleetProfileOwnerCompanies, fleetLocalChannels, readFleetLocalGatewayState, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
+import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, HQ_FLEET_LOCAL_RELEASE, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, fleetLocalProfileNeedsAdoption, fleetLocalServiceInstalled, fleetProviderForRuntime, importFleetLocalMachineCredential, importFleetLocalProviderLogin, fleetProviderNeedsSignIn, fleetOwnerCompanies, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, installTargetFleetLocalDistribution, resolveFleetLocalPointerTarget, resolveFleetLocalTargetRelease, fleetLocalProfileDir, fleetProfileOwnerCompanies, fleetLocalChannels, readFleetLocalGatewayState, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
 import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
 import { fleetInstallProgressReporter, runBotRuntimeInstall, runBotRuntimeStatus } from "./bot-runtime.js";
 function collectRepeated(value, previous) {
@@ -368,11 +371,39 @@ export function runtimeSignedIn(status, processAlive) {
         return false;
     return status.runtimeSignInCheck?.signedIn ?? null;
 }
+/**
+ * Whether the bot's model provider must be signed in before it can run, from
+ * what this computer knows: the bot's settings, its last reported failure or
+ * sign-in check, and (legacy) why it has not moved to the HQ Fleet Runtime.
+ */
+export function brainSignInFor(name, config, status, legacy) {
+    const provider = config.runtime;
+    const command = fleetAuthCommand(name, config);
+    if (legacy && !legacy.decision.convert && legacyHoldNotifiesOwner(legacy.decision.reason)) {
+        return { provider, needed: true, reason: legacy.notice?.cause ?? legacy.decision.detail, command };
+    }
+    if (config.fleetAuthPending === true)
+        return { provider, needed: true, reason: `${name} has not signed in to ${runtimeDisplayName(provider)} yet.`, command };
+    // A legacy bot that moves at its next start needs no sign-in, whatever its old runner last reported.
+    if (legacy?.decision.convert)
+        return null;
+    const failure = unresolvedLastFailure(status);
+    if (failure?.class === "auth")
+        return { provider, needed: true, reason: failure.cause, command };
+    if (status?.runtimeSignIn)
+        return { provider, needed: true, reason: signedOutReason(name, status.runtimeSignIn), command };
+    return null;
+}
+function signedOutReason(name, issue) {
+    const tool = runtimeDisplayName(issue.runtime);
+    return issue.state === "signed-out" ? `${tool} is not signed in for ${name} on this computer.` : `${tool} needs ${name}'s owner to sign in again on this computer.`;
+}
 function rowFor(name, opts = {}) {
     const dir = botDir(name);
     const config = readBotConfig(dir);
     const fleet = isFleetRuntimeBot(config);
     const status = readBotStatus(dir);
+    const legacy = fleet ? null : opts.legacy ?? legacyMoveState(dir, config, legacyConvertSeams.providerLogin(dir, config));
     const pid = fleet ? fleetLocalGatewayPid(config.agentUid) : (status?.pid ?? null);
     const processAlive = pid !== null && isPidAlive(pid) && (fleet || status?.state === "running");
     // Turns this bot has taken and not finished: what "thinking" means.
@@ -419,6 +450,8 @@ function rowFor(name, opts = {}) {
         ...(fleet && config.fleetAuthPending === true ? { needsSignIn: true, authCommand: fleetAuthCommand(name, config) } : {}),
         ...(fleet && config.fleetServiceInstallPending === true ? { needsSignIn: false, serviceInstallPending: true } : {}),
         signInCommand: fleet ? fleetAuthCommand(name, config) : signInCommand(config.runtime),
+        brainSignIn: brainSignInFor(name, config, status, legacy),
+        ...(legacy ? { legacy: legacyStatusJson(legacy) } : {}),
         runtimeCrash: processAlive ? runtimeCrashSinceStart(status) : null,
         daemonInstalled,
         daemonLoaded,
@@ -525,9 +558,12 @@ async function startBot(name, dir, config, output, extra = {}, opts = {}) {
         throw new Error("This bot is held for cloud promotion. Continue its promotion before changing local settings or lifecycle.");
     if (isFleetRuntimeBot(config))
         return startFleetRuntimeBot(name, dir, config, output, extra);
-    const converted = opts.keepLegacy ? null : await convertLegacyBotToFleet(name, dir, config, "start");
-    if (converted)
-        return reportFleetBotStart(name, dir, converted, output, { ...extra, movedToFleet: true }, true, "started by the HQ Fleet Runtime");
+    const move = opts.keepLegacy ? null : await convertLegacyBotToFleet(name, dir, config, "start");
+    if (move?.fleet)
+        return reportFleetBotStart(name, dir, move.fleet, output, { ...extra, movedToFleet: true }, true, "started by the HQ Fleet Runtime");
+    // The app reads these to say the bot is still legacy and, when a sign-in is all it waits for, to offer it.
+    if (move?.state)
+        extra = { ...extra, movedToFleet: false, legacy: legacyStatusJson(move.state), brainSignIn: brainSignInFor(name, config, readBotStatus(dir), move.state) };
     if (config.enabled === false)
         patchBotConfig(dir, { enabled: true });
     const paths = buildBotDaemonPaths({ name, botDir: dir, hqRoot: config.hqRoot });
@@ -604,21 +640,37 @@ async function startBot(name, dir, config, output, extra = {}, opts = {}) {
  * itself starting (launchd, hq daemon or a detached run), before it polls:
  * its own startup agent is booted out last, detached.
  */
+/** Seams for the legacy move, replaced in tests. */
+export const legacyConvertSeams = {
+    /** Whether the provider sign-in a Codex or Grok legacy bot needs is readable here, as HQ Fleet Local imports it. */
+    providerLogin: (dir, config) => legacyProviderLoginProbe(dir, config),
+};
 async function convertLegacyBotToFleet(name, dir, config, from) {
-    if (!legacyConversionDecision(config).convert || hasPromotionHold(dir))
-        return null;
-    // A launchd or daemon restart loop would otherwise retry a failing install before every start.
+    if (hasPromotionHold(dir))
+        return { fleet: null, state: null };
+    // A launchd or daemon restart loop would otherwise retry a failing install (and probe the sign-in) before every start.
     if (from === "run" && fleetMoveRecentlyFailed(dir))
-        return null;
+        return { fleet: null, state: null };
+    const probe = legacyConvertSeams.providerLogin(dir, config);
+    const decision = legacyConversionDecision(config, process.env, probe);
+    if (!decision.convert) {
+        if (legacyHoldNotifiesOwner(decision.reason))
+            await holdLegacyBot(name, dir, config, decision);
+        return { fleet: null, state: { decision, notice: legacyHoldNotice(name, config.runtime, decision), lastFailure: readFleetMoveFailure(dir), hold: readFleetMoveHold(dir) } };
+    }
+    // The hold is over: whatever stops the move from here is a failure, not a hold.
+    fs.rmSync(fleetMoveHoldPath(dir), { force: true });
+    const ready = () => ({ fleet: null, state: { decision, notice: null, lastFailure: readFleetMoveFailure(dir), hold: null } });
     if (from === "start") {
         const running = readBotStatus(dir);
         if (running && isPidAlive(running.pid) && selfStopProbe(running.pid))
-            return null;
+            return ready();
     }
     const log = createBotLogger(dir);
     const keepLegacy = (step, err) => {
-        writeFleetMoveFailure(dir);
-        log("warn", `could not ${step} ${name} on the HQ Fleet Runtime (${err instanceof Error ? err.message : String(err)}); it runs on ${config.runtime} this time and tries again at its next start`);
+        const error = err instanceof Error ? err.message : String(err);
+        writeFleetMoveFailure(dir, new Date(), { step, error });
+        log("warn", `could not ${step} ${name} on the HQ Fleet Runtime (${error}); it runs on ${config.runtime} this time and tries again at its next start`);
     };
     let engine;
     try {
@@ -628,9 +680,27 @@ async function convertLegacyBotToFleet(name, dir, config, from) {
     }
     catch (err) {
         keepLegacy("install", err);
-        return null;
+        return ready();
+    }
+    if (decision.signIn) {
+        try {
+            importFleetLocalProviderLogin(config.agentUid, decision.signIn.runtime, {}, decision.signIn.env ? { env: decision.signIn.env } : {});
+            log("info", `imported ${name}'s ${config.runtime} sign-in from this computer for the HQ Fleet Runtime`);
+        }
+        catch (err) {
+            keepLegacy("sign in", err);
+            return ready();
+        }
     }
-    const fleet = { ...(readBotConfig(dir) ?? config), engine, enabled: true, fleetServiceInstallPending: false };
+    const current = readBotConfig(dir) ?? config;
+    const fleet = {
+        ...current,
+        engine,
+        enabled: true,
+        fleetServiceInstallPending: false,
+        // The imported login is the bot's Fleet sign-in now; the legacy own-login setting no longer applies.
+        ...(decision.signIn?.env ? { runtimeAuth: withRuntimeAuth(current.runtimeAuth, decision.signIn.runtime, null) } : {}),
+    };
     if (from === "start")
         await stopBot(name, dir, config, "silent");
     let failure = null;
@@ -651,16 +721,77 @@ async function convertLegacyBotToFleet(name, dir, config, from) {
             /* nothing was running */
         }
         keepLegacy("start", failure);
-        return null;
+        return ready();
     }
     writeBotConfig(dir, fleet);
-    fs.rmSync(fleetMoveFailurePath(dir), { force: true });
+    clearFleetMoveRecords(dir);
     // The legacy runner's copy of the machine credentials goes only now: a failed move above still needs it.
     fs.rmSync(botCredsPath(dir), { force: true });
     log("info", `moved ${name} to the HQ Fleet Runtime under the same identity; its ${config.runtime} runner is retired`);
     syncFleetRuntimeJobs(name, dir, fleet);
     retireLegacyBotAgent(name, dir, config, from === "run" ? "detached" : "inline");
-    return fleet;
+    return { fleet, state: null };
+}
+/**
+ * A legacy bot that cannot move yet: record why, and tell the owner once per
+ * reason through the bot's own DM, the way a Fleet bot reports a failed turn.
+ * The record is what `hq bot status` and `hq doctor` show.
+ */
+async function holdLegacyBot(name, dir, config, decision) {
+    const log = createBotLogger(dir);
+    const notice = legacyHoldNotice(name, config.runtime, decision);
+    const previous = readFleetMoveHold(dir);
+    const now = new Date().toISOString();
+    const hold = {
+        reason: decision.reason,
+        detail: decision.detail,
+        at: now,
+        ...(previous?.notifiedAt ? { notifiedAt: previous.notifiedAt } : {}),
+        ...(previous?.notifiedReason ? { notifiedReason: previous.notifiedReason } : {}),
+        ...(previous?.reportId ? { reportId: previous.reportId } : {}),
+        ...(previous?.reportedReason ? { reportedReason: previous.reportedReason } : {}),
+    };
+    writeFleetMoveHold(dir, hold);
+    log("warn", `${name} stays on its ${config.runtime} runner: ${notice.cause} ${notice.fix}`);
+    const reportDue = holdReportDue(previous, decision.reason);
+    const noticeDue = ownerHoldNoticeDue(previous, decision.reason);
+    if (!reportDue && !noticeDue)
+        return;
+    const api = new BotApi({ token: botTokenSupplier(dir) });
+    // One failure report per reason, the same route a Fleet bot files a failed turn through, so stuck legacy bots are visible in HQ.
+    if (reportDue) {
+        try {
+            const report = legacyHoldFailureReport({
+                reportId: randomUUID(),
+                createdAt: now,
+                name,
+                config,
+                decision,
+                notice,
+                machine: os.hostname().trim(),
+                hqCliVersion: CLI_VERSION,
+                os: `${process.platform} ${os.release()}`,
+                logPath: botLogPath(dir),
+            });
+            const { reportId } = await api.reportFailure(config.agentUid, report);
+            Object.assign(hold, { reportedReason: decision.reason, ...(reportId ? { reportId } : {}) });
+            writeFleetMoveHold(dir, hold);
+            log("info", `filed a failure report with HQ for ${name}'s held move (${decision.reason}${reportId ? `, report ${reportId}` : ""})`);
+        }
+        catch (err) {
+            log("warn", `could not file ${name}'s held move with HQ (${err instanceof Error ? err.message : String(err)}); the next start tries again`);
+        }
+    }
+    if (!noticeDue)
+        return;
+    try {
+        await api.sendDm({ toPersonUid: config.ownerUid, body: `${notice.cause} ${notice.fix}` });
+        writeFleetMoveHold(dir, { ...hold, notifiedAt: now, notifiedReason: decision.reason });
+        log("info", `told the owner once that ${name} has not moved to the HQ Fleet Runtime (${decision.reason})`);
+    }
+    catch (err) {
+        log("warn", `could not tell the owner why ${name} has not moved to the HQ Fleet Runtime (${err instanceof Error ? err.message : String(err)}); the next start tries again`);
+    }
 }
 /** Remove a legacy bot's own startup agent once the bot runs on the HQ Fleet Runtime. True when there was one. */
 function retireLegacyBotAgent(name, dir, config, bootout) {
@@ -1576,7 +1707,7 @@ async function runBotResident(nameArg) {
             console.log(orphanBotRunMessage(name, outcome));
         return;
     }
-    if (await convertLegacyBotToFleet(name, dir, config, "run"))
+    if ((await convertLegacyBotToFleet(name, dir, config, "run")).fleet)
         return;
     if (healNodePathFromJob(name, dir, config))
         return;
@@ -1694,18 +1825,28 @@ async function runBotList(opts) {
 async function runBotStatus(nameArg, opts) {
     const { name, dir, config } = requireBot(nameArg);
     const fleet = isFleetRuntimeBot(config);
-    const row = rowFor(name);
+    const legacy = fleet ? null : legacyMoveState(dir, config, legacyConvertSeams.providerLogin(dir, config));
+    const row = rowFor(name, { legacy });
     await decorateOnline([row]);
     const status = readBotStatus(dir);
     const creds = readBotCredsIdentity(dir);
     const channels = fleet ? fleetLocalChannels(readFleetLocalGatewayState(config.agentUid), row.processAlive) : null;
     if (opts.json) {
-        console.log(JSON.stringify({ ...row, executive: executiveStatus(config, dir), ...(fleet ? { engine: config.engine, channels } : {}), credsPresent: fleet || !!creds, login: describeBotAuth(dir, config), status }, null, 2));
+        console.log(JSON.stringify({
+            ...row,
+            executive: executiveStatus(config, dir),
+            ...(fleet ? { engine: config.engine, channels } : {}),
+            credsPresent: fleet || !!creds,
+            login: describeBotAuth(dir, config),
+            status,
+        }, null, 2));
         return;
     }
     console.log(`${chalk.bold(name)}  ${row.agentUid}`);
     if (fleet)
         console.log(`  engine:     HQ Fleet Runtime ${config.engine?.version ?? ""}  ${chalk.dim(`logs ~/.hq-fleet/profiles/${config.agentUid}/logs`)}`);
+    else
+        console.log(`  engine:     ${chalk.yellow(`legacy ${runtimeDisplayName(config.runtime)} runner (not on the HQ Fleet Runtime)`)}`);
     console.log(`  kind:       ${describeKind(row.kind, row.companies)}`);
     const login = describeBotAuth(dir, config);
     console.log(`  runtime:    ${row.runtime}  model ${row.model ?? "default"}  thinking ${row.effort}${row.effortIsDefault ? " (default)" : ""}`);
@@ -1732,6 +1873,10 @@ async function runBotStatus(nameArg, opts) {
     else {
         console.log(`  launchd:    ${row.daemonInstalled ? (row.daemonLoaded ? "installed, loaded" : "installed, not loaded") : "not installed"}`);
     }
+    if (legacy) {
+        for (const line of legacyStatusLines(name, legacy))
+            console.log(`  ${line}`);
+    }
     if (row.daemonNodeMissing) {
         console.log(`  ${chalk.red(`node missing: ${row.daemonNodeMissing}`)} — launchd cannot start ${name}; fix with: hq bot start ${name}`);
     }
@@ -1781,6 +1926,37 @@ async function runBotStatus(nameArg, opts) {
     }
     console.log(chalk.dim(`  state dir:  ${dir}`));
 }
+/** The `legacy` object in `hq bot status --json` for a bot still on its legacy runner. */
+export function legacyStatusJson(state) {
+    const { decision } = state;
+    return {
+        moves: decision.convert,
+        ...(decision.convert ? {} : { reason: decision.reason, detail: decision.detail, cause: state.notice?.cause ?? null, fix: state.notice?.fix ?? null }),
+        lastMoveFailure: state.lastFailure,
+        ownerNotifiedAt: state.hold?.notifiedAt ?? null,
+        reportId: state.hold?.reportId ?? null,
+    };
+}
+/** The `fleet move:` lines of `hq bot status` for a bot still on its legacy runner. */
+export function legacyStatusLines(name, state) {
+    const lines = [];
+    const { decision } = state;
+    if (decision.convert) {
+        lines.push(`fleet move: ready; it moves to the HQ Fleet Runtime at its next start (hq bot start ${name})`);
+    }
+    else {
+        lines.push(`fleet move: ${chalk.yellow(`held (${decision.reason})`)}: ${state.notice?.cause ?? decision.detail}`);
+        if (state.notice?.fix)
+            lines.push(`  fix:      ${state.notice.fix}`);
+        if (legacyHoldNotifiesOwner(decision.reason))
+            lines.push(chalk.dim(`  owner DM: ${state.hold?.notifiedAt ? `sent ${state.hold.notifiedAt}` : "not sent yet"}`));
+    }
+    if (state.lastFailure) {
+        const f = state.lastFailure;
+        lines.push(`last move:  ${chalk.yellow(`failed ${f.at}${f.step ? ` (could not ${f.step})` : ""}${f.error ? `: ${f.error}` : ""}`)}; it tries again at its next start`);
+    }
+    return lines;
+}
 async function runBotLogs(nameArg, opts) {
     const { dir } = requireBot(nameArg);
     const file = botLogPath(dir);
@@ -2503,6 +2679,7 @@ async function runBotAuth(nameArg, opts) {
     if (legacy && engine) {
         const moved = { ...(readBotConfig(b.dir) ?? legacy), engine };
         writeBotConfig(b.dir, moved);
+        clearFleetMoveRecords(b.dir);
         fs.rmSync(botCredsPath(b.dir), { force: true });
         createBotLogger(b.dir)("info", `moved ${b.name} to the HQ Fleet Runtime with its ${opts.provider} sign-in; its ${legacy.runtime} runner is retired`);
         syncFleetRuntimeJobs(b.name, b.dir, moved);
@@ -2510,8 +2687,11 @@ async function runBotAuth(nameArg, opts) {
     }
     const signedInRuntime = result.runtimeProvider === "anthropic" ? "claude" : result.runtimeProvider === "xai-oauth" ? "grok" : result.runtimeProvider === "openai-codex" ? "codex" : null;
     const pending = b.config.fleetAuthPending === true || legacy !== null;
+    // A moved bot answers with the login it just signed in with; its legacy own-login setting no longer applies.
+    const runtimeAuth = legacy && signedInRuntime && legacy.runtimeAuth?.[signedInRuntime] !== undefined ? withRuntimeAuth(legacy.runtimeAuth, signedInRuntime, null) : undefined;
     patchBotConfig(b.dir, {
         ...(signedInRuntime ? { runtime: signedInRuntime } : {}),
+        ...(legacy && signedInRuntime && legacy.runtimeAuth?.[signedInRuntime] !== undefined ? { runtimeAuth } : {}),
         model: result.model,
         ...(pending ? { fleetAuthPending: false, fleetServiceInstallPending: !result.restarted, enabled: result.restarted } : {}),
     });

package/dist/commands/cloud.d.ts

@@ -59,10 +59,49 @@ export declare class SyncSessionExpiredError extends Error {
     readonly reason?: string | undefined;
     constructor(kind: "reauth" | "unavailable", reason?: string | undefined);
 }
+/** Shown when the vault rejected the session even after a forced refresh. */
+export declare const SYNC_SESSION_REJECTED_MESSAGE = "The HQ server rejected your session even after it was refreshed, so the saved sign-in is no longer accepted. `hq auth status` only checks the saved expiry, not the server. Run `hq login`, then rerun the sync.";
+/** Reason text when token acquisition does not settle within the bound. */
+export declare const SYNC_TOKEN_TIMEOUT_REASON = "timed out waiting for the sign-in service";
+/** Longest a single token acquisition or refresh may take before the sync fails. */
+export declare const SYNC_TOKEN_TIMEOUT_MS = 45000;
+/**
+ * The vault rejected the session after a forced refresh had already replaced
+ * the saved token. Retrying again cannot help; the user has to sign in again.
+ */
+export declare class SyncSessionRejectedError extends Error {
+    constructor();
+}
 export interface SyncVaultConfigDeps {
     /** Non-interactive token resolver: returns the cached token or refreshes it. */
     ensureToken?: () => Promise<string>;
+    /** Bound on one token acquisition (default {@link SYNC_TOKEN_TIMEOUT_MS}). */
+    tokenTimeoutMs?: number;
 }
+export interface RejectedSessionRecoveryDeps {
+    /** Refresh the saved session even though it looks valid. */
+    forceRefresh?: () => Promise<{
+        refreshed: boolean;
+        reason?: string;
+    }>;
+    /**
+     * The token-getter failure recorded for the latest attempt, if any. hq-cloud
+     * turns a getter error (network, refresh failure, identity swap) into a plain
+     * 401, so a 401 with a recorded failure is not a server rejection of a token.
+     */
+    recordedFailure?: () => Error | null;
+    /** Runs once, after a recoverable 401 and before the refresh and rerun. */
+    onRetry?: () => void | Promise<void>;
+}
+/**
+ * feedback_3d752910: the vault can reject a token that still looks valid in the
+ * local cache (revoked or replaced server-side). The cached expiry check never
+ * notices, and `hq auth refresh` is a no-op for a valid-looking token, so every
+ * sync kept presenting the same rejected token. On a vault 401, force one real
+ * refresh and rerun the sync once. A second rejection is reported as a rejected
+ * session (sign in again), never retried again.
+ */
+export declare function runWithRejectedSessionRecovery<T>(run: () => Promise<T>, deps?: RejectedSessionRecoveryDeps): Promise<T>;
 /** The last token failure recorded by a {@link buildSyncVaultConfig} config. */
 export declare function syncAuthFailureFor(config: VaultServiceConfig | undefined): Error | null;
 /**