@indigoai-us/hq-cli 5.345.200 → 5.345.201

package/dist/commands/cloud.js

@@ -22,7 +22,7 @@ import * as path from "path";
 import { share, getStateDir, listJournals, createIgnoreFilter, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, readSyncProgress, syncDoctor, } from "@indigoai-us/hq-cloud";
 import { syncLeg } from "../utils/sync-operation-lock.js";
 import { SYNC_WATCHDOG_EXIT_CODE, SYNC_WATCHDOG_REPORT_GRACE_MS, SyncWatchdogTimeoutError, createSnapshotProgressProbe, resolveSyncWatchdogLimits, withSyncWatchdog, } from "../utils/sync-watchdog.js";
-import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, IdentitySwapRefusal, cognitoCachePrincipalUid, isDefinitivePersonAuthRejection, isIdentitySwapRefusal, loadCachedTokens, } from "../utils/cognito-session.js";
+import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, IdentitySwapRefusal, cognitoCachePrincipalUid, isDefinitivePersonAuthRejection, isIdentitySwapRefusal, loadCachedTokens, refreshCachedSession, } from "../utils/cognito-session.js";
 import { resolveUploadAuthor } from "../utils/upload-author.js";
 import { companyFolderExceedsThreshold, emitNarrowHint, isStrictRefusal, resolveBannerLevel, resolveNarrowHintPresentationLevel, resolveNarrowHintMinBytes, } from "../lib/narrow-hint-banner.js";
 import { beginSyncHealthReport, classifySyncFailure, } from "../utils/client-health.js";
@@ -90,6 +90,80 @@ export class SyncSessionExpiredError extends Error {
         this.name = "SyncSessionExpiredError";
     }
 }
+/** Shown when the vault rejected the session even after a forced refresh. */
+export const SYNC_SESSION_REJECTED_MESSAGE = "The HQ server rejected your session even after it was refreshed, so the saved sign-in is no longer accepted. `hq auth status` only checks the saved expiry, not the server. Run `hq login`, then rerun the sync.";
+/** Reason text when token acquisition does not settle within the bound. */
+export const SYNC_TOKEN_TIMEOUT_REASON = "timed out waiting for the sign-in service";
+/** Longest a single token acquisition or refresh may take before the sync fails. */
+export const SYNC_TOKEN_TIMEOUT_MS = 45_000;
+/**
+ * The vault rejected the session after a forced refresh had already replaced
+ * the saved token. Retrying again cannot help; the user has to sign in again.
+ */
+export class SyncSessionRejectedError extends Error {
+    constructor() {
+        super(SYNC_SESSION_REJECTED_MESSAGE);
+        this.name = "SyncSessionRejectedError";
+    }
+}
+/** Reject with a named "unavailable" error when `promise` has not settled within `ms`. */
+function withTokenTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new SyncSessionExpiredError("unavailable", SYNC_TOKEN_TIMEOUT_REASON)), ms);
+        timer.unref?.();
+    });
+    return Promise.race([promise, timeout]).finally(() => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    });
+}
+/**
+ * feedback_3d752910: the vault can reject a token that still looks valid in the
+ * local cache (revoked or replaced server-side). The cached expiry check never
+ * notices, and `hq auth refresh` is a no-op for a valid-looking token, so every
+ * sync kept presenting the same rejected token. On a vault 401, force one real
+ * refresh and rerun the sync once. A second rejection is reported as a rejected
+ * session (sign in again), never retried again.
+ */
+export async function runWithRejectedSessionRecovery(run, deps = {}) {
+    const forceRefresh = deps.forceRefresh ?? (() => refreshCachedSession({ force: true }));
+    try {
+        return await run();
+    }
+    catch (err) {
+        if (!isVaultAuthRejection(err))
+            throw err;
+        // The getter already failed to produce a token; a forced refresh would hit
+        // the same failure. Report the real cause.
+        const firstFailure = deps.recordedFailure?.();
+        if (firstFailure)
+            throw firstFailure;
+        await deps.onRetry?.();
+        let refreshed;
+        try {
+            refreshed = await withTokenTimeout(forceRefresh(), SYNC_TOKEN_TIMEOUT_MS);
+        }
+        catch (refreshErr) {
+            throw refreshErr instanceof SyncSessionExpiredError
+                ? refreshErr
+                : classifyRefreshFailure(refreshErr);
+        }
+        if (!refreshed.refreshed) {
+            throw classifyRefreshFailure(new Error(refreshed.reason ?? "refresh failed"));
+        }
+        try {
+            return await run();
+        }
+        catch (retryErr) {
+            if (isVaultAuthRejection(retryErr)) {
+                // A getter failure surfaced as a 401 is not a server rejection.
+                throw deps.recordedFailure?.() ?? new SyncSessionRejectedError();
+            }
+            throw retryErr;
+        }
+    }
+}
 /**
  * Per-config record of the last token-function failure. hq-cloud's one-shot
  * 401 retry swallows getter errors and rethrows the original 401, so
@@ -128,6 +202,7 @@ function classifyRefreshFailure(err) {
  */
 export function buildSyncVaultConfig(initialToken, deps = {}) {
     const ensureToken = deps.ensureToken ?? (() => ensureCognitoToken({ interactive: false }));
+    const tokenTimeoutMs = deps.tokenTimeoutMs ?? SYNC_TOKEN_TIMEOUT_MS;
     const runPrincipal = cognitoCachePrincipalUid(initialToken);
     // A start token with no sub/entityUid cannot be bound to a principal, and a
     // null binding would accept any later identity-less token. Refuse up front.
@@ -142,7 +217,7 @@ export function buildSyncVaultConfig(initialToken, deps = {}) {
             throw refused;
         let token;
         try {
-            token = await ensureToken();
+            token = await withTokenTimeout(ensureToken(), tokenTimeoutMs);
         }
         catch (err) {
             const failure = isIdentitySwapRefusal(err) ? err : classifyRefreshFailure(err);
@@ -177,7 +252,9 @@ function isVaultAuthRejection(err) {
  * CLI are released independently.
  */
 export function formatSyncFailure(err, ctx = {}) {
-    if (err instanceof SyncSessionExpiredError || isIdentitySwapRefusal(err)) {
+    if (err instanceof SyncSessionExpiredError ||
+        err instanceof SyncSessionRejectedError ||
+        isIdentitySwapRefusal(err)) {
         return err.message;
     }
     if (isVaultAuthRejection(err)) {
@@ -1622,87 +1699,101 @@ export function registerCloudCommands(program) {
             console.log(chalk.bold("\nHQ Sync — Pull"));
             console.log(`  HQ root:  ${options.hqRoot}`);
             console.log(`  Company:  ${options.company ?? "(from .hq/config.json)"}\n`);
-            const accessToken = await ensureSyncCognitoToken();
-            const vaultConfig = buildSyncVaultConfig(accessToken);
-            runVaultConfig = vaultConfig;
-            // US-011 (2026-05-21 fix): resolve the caller's sync-config for
-            // the targeted membership BEFORE the pull, so we can (a) emit the
-            // narrow-hint banner after success if still on all-mode and
-            // (b) respect strict-mode refusal mirror of the --all + sync-now
-            // paths. Failure to resolve degrades silently — pull still works,
-            // banner just stays quiet (same as the catch in runPullAll).
-            const narrowHintLevel = resolveBannerLevel();
-            const pullClient = new VaultClient(vaultConfig);
-            const { resolvedCompanyUid, resolvedMode } = await resolvePerCompanyPullPlan(pullClient, options.company);
-            // DEV-1768: resolve the REAL effective scope (mode + prefixSet) and
-            // thread it into the pull below — not just the banner. Best-effort;
-            // degrades to "all" inside the resolver on any failure.
-            const pullScope = await resolveCliPullScope(pullClient, options.company, options.hqRoot);
-            // Size gate: only a large local folder is nudged / strict-refused.
-            const nudgeExceedsSize = resolvedMode === "all" &&
-                resolvedCompanyUid !== undefined &&
-                narrowNudgeExceedsSize(options.hqRoot, options.company);
-            const strictRefusal = resolvedMode === "all" &&
-                nudgeExceedsSize &&
-                isStrictRefusal(resolvedMode, narrowHintLevel) &&
-                options.modeAll !== true;
-            const bannerLevel = resolveNarrowHintPresentationLevel(narrowHintLevel, strictRefusal);
-            // Strict-mode refusal: matches runPullAll + runNowSingle behavior.
-            // Default banner level is 'hint' which never triggers refusal —
-            // wired now so a future release can flip the default to 'strict'
-            // (still size-gated) without re-touching this command.
-            if (strictRefusal &&
-                resolvedMode === "all" &&
-                resolvedCompanyUid) {
-                emitNarrowHint({
-                    companyUid: resolvedCompanyUid,
-                    syncMode: resolvedMode,
-                    level: bannerLevel,
+            // feedback_3d752910: one forced refresh and rerun when the vault
+            // rejects a token that still looks valid in the local cache.
+            await runWithRejectedSessionRecovery(async () => {
+                runVaultConfig = undefined;
+                const accessToken = await withTokenTimeout(ensureSyncCognitoToken(), SYNC_TOKEN_TIMEOUT_MS);
+                const vaultConfig = buildSyncVaultConfig(accessToken);
+                runVaultConfig = vaultConfig;
+                // US-011 (2026-05-21 fix): resolve the caller's sync-config for
+                // the targeted membership BEFORE the pull, so we can (a) emit the
+                // narrow-hint banner after success if still on all-mode and
+                // (b) respect strict-mode refusal mirror of the --all + sync-now
+                // paths. Failure to resolve degrades silently — pull still works,
+                // banner just stays quiet (same as the catch in runPullAll).
+                const narrowHintLevel = resolveBannerLevel();
+                const pullClient = new VaultClient(vaultConfig);
+                const { resolvedCompanyUid, resolvedMode } = await resolvePerCompanyPullPlan(pullClient, options.company);
+                // DEV-1768: resolve the REAL effective scope (mode + prefixSet) and
+                // thread it into the pull below — not just the banner. Best-effort;
+                // degrades to "all" inside the resolver on any failure.
+                const pullScope = await resolveCliPullScope(pullClient, options.company, options.hqRoot);
+                // Size gate: only a large local folder is nudged / strict-refused.
+                const nudgeExceedsSize = resolvedMode === "all" &&
+                    resolvedCompanyUid !== undefined &&
+                    narrowNudgeExceedsSize(options.hqRoot, options.company);
+                const strictRefusal = resolvedMode === "all" &&
+                    nudgeExceedsSize &&
+                    isStrictRefusal(resolvedMode, narrowHintLevel) &&
+                    options.modeAll !== true;
+                const bannerLevel = resolveNarrowHintPresentationLevel(narrowHintLevel, strictRefusal);
+                // Strict-mode refusal: matches runPullAll + runNowSingle behavior.
+                // Default banner level is 'hint' which never triggers refusal —
+                // wired now so a future release can flip the default to 'strict'
+                // (still size-gated) without re-touching this command.
+                if (strictRefusal &&
+                    resolvedMode === "all" &&
+                    resolvedCompanyUid) {
+                    emitNarrowHint({
+                        companyUid: resolvedCompanyUid,
+                        syncMode: resolvedMode,
+                        level: bannerLevel,
+                    });
+                    console.error(chalk.red("\n✗ Pull refused: strict narrow-hint mode is on and this " +
+                        "company's local folder has grown large. Run `hq sync narrow --apply` " +
+                        "to migrate, or re-run with --mode-all."));
+                    process.exit(1);
+                }
+                const excludePrefixes = readScopeExcludePrefixes(pullScope);
+                syncHealth = beginSyncHealthReport();
+                const result = await syncLeg({
+                    company: options.company,
+                    onConflict: options.onConflict,
+                    vaultConfig,
+                    hqRoot: options.hqRoot,
+                    ...(pullScope?.syncMode !== undefined
+                        ? { syncMode: pullScope.syncMode }
+                        : {}),
+                    ...(pullScope?.prefixSet !== undefined
+                        ? { prefixSet: pullScope.prefixSet }
+                        : {}),
+                    // Sessions-exclusion: never materialize excluded prefixes even for
+                    // a wide-STS owner.
+                    ...(excludePrefixes ? { excludePrefixes } : {}),
+                    ...(options.forceScopeShrink ? { forceScopeShrink: true } : {}),
                 });
-                console.error(chalk.red("\n✗ Pull refused: strict narrow-hint mode is on and this " +
-                    "company's local folder has grown large. Run `hq sync narrow --apply` " +
-                    "to migrate, or re-run with --mode-all."));
-                process.exit(1);
-            }
-            const excludePrefixes = readScopeExcludePrefixes(pullScope);
-            syncHealth = beginSyncHealthReport();
-            const result = await syncLeg({
-                company: options.company,
-                onConflict: options.onConflict,
-                vaultConfig,
-                hqRoot: options.hqRoot,
-                ...(pullScope?.syncMode !== undefined
-                    ? { syncMode: pullScope.syncMode }
-                    : {}),
-                ...(pullScope?.prefixSet !== undefined
-                    ? { prefixSet: pullScope.prefixSet }
-                    : {}),
-                // Sessions-exclusion: never materialize excluded prefixes even for
-                // a wide-STS owner.
-                ...(excludePrefixes ? { excludePrefixes } : {}),
-                ...(options.forceScopeShrink ? { forceScopeShrink: true } : {}),
-            });
-            if (result.aborted) {
-                console.log(chalk.yellow(`\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
-                await syncHealth.failed();
-                process.exit(1);
-            }
-            recordFirstWorkBearingSync({
-                filesDownloaded: result.filesDownloaded,
-                aborted: result.aborted,
-            });
-            console.log(chalk.green(`\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
-            // Emit the hint banner after success so it appears alongside the
-            // summary line. Mirrors the wiring in runPullAll and runNowSingle.
-            // Size-gated: only a large local folder is nudged.
-            if (resolvedMode === "all" && nudgeExceedsSize && resolvedCompanyUid) {
-                emitNarrowHint({
-                    companyUid: resolvedCompanyUid,
-                    syncMode: resolvedMode,
-                    level: bannerLevel,
+                if (result.aborted) {
+                    console.log(chalk.yellow(`\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
+                    await syncHealth.failed();
+                    process.exit(1);
+                }
+                recordFirstWorkBearingSync({
+                    filesDownloaded: result.filesDownloaded,
+                    aborted: result.aborted,
                 });
-            }
-            await syncHealth.succeeded();
+                console.log(chalk.green(`\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
+                // Emit the hint banner after success so it appears alongside the
+                // summary line. Mirrors the wiring in runPullAll and runNowSingle.
+                // Size-gated: only a large local folder is nudged.
+                if (resolvedMode === "all" && nudgeExceedsSize && resolvedCompanyUid) {
+                    emitNarrowHint({
+                        companyUid: resolvedCompanyUid,
+                        syncMode: resolvedMode,
+                        level: bannerLevel,
+                    });
+                }
+                await syncHealth.succeeded();
+            }, {
+                recordedFailure: () => syncAuthFailureFor(runVaultConfig),
+                onRetry: async () => {
+                    console.error(chalk.yellow("HQ rejected the session; refreshing once and retrying."));
+                    // Close the first attempt's health report; the rerun opens its own.
+                    const first = syncHealth;
+                    syncHealth = undefined;
+                    await first?.failed("AUTH_EXPIRED");
+                },
+            });
         }
         catch (err) {
             if (syncHealth)

package/dist/commands/deploy-domains.js

@@ -907,12 +907,16 @@ function availabilityLabel(kind) {
 function isOfferable(kind) {
     return kind === "available" || kind === "premium";
 }
+/** hq-pro sends the registrar currency as lowercase "usd". Either case is US dollars. */
+function isUsdCurrency(currency) {
+    return typeof currency === "string" && currency.toUpperCase() === "USD";
+}
 function moneyFromCents(cents, currency) {
     if (typeof cents !== "number" || !Number.isFinite(cents) || cents < 0 || !Number.isInteger(cents))
         return undefined;
     const amount = cents / 100;
     const text = Number.isInteger(amount) ? `$${amount}` : `$${amount.toFixed(2)}`;
-    if (typeof currency === "string" && currency !== "" && currency !== "USD")
+    if (typeof currency === "string" && currency !== "" && !isUsdCurrency(currency))
         return `${text} ${currency}`;
     return text;
 }
@@ -1053,7 +1057,7 @@ function registrarCurrency(result) {
 /** First-year amount comparable to --price. A quote in another currency is not one. */
 function usdFirstYearAmount(result) {
     const currency = registrarCurrency(result);
-    if (currency !== undefined && currency !== "USD")
+    if (currency !== undefined && !isUsdCurrency(currency))
         return undefined;
     const registrar = result.registrarPrice;
     const block = registrar && typeof registrar === "object" ? registrar : undefined;
@@ -1067,7 +1071,7 @@ function usdFirstYearAmount(result) {
 }
 function assertMatchingUsdPrice(match, quote, expectedPriceUsd) {
     const currency = registrarCurrency(match);
-    if (currency !== undefined && currency !== "USD") {
+    if (currency !== undefined && !isUsdCurrency(currency)) {
         const shown = quote.firstYear
             ? `The registrar's first-year price is ${quote.firstYear}, not US dollars.`
             : "The registrar's first-year price is not in US dollars.";
@@ -1362,7 +1366,7 @@ async function renewAction(domainArg, autoRenew, options) {
     const cents = detail.renewalPriceCents;
     const currency = detail.currency;
     const amount = moneyFromCents(cents, currency);
-    if (typeof cents !== "number" || !Number.isSafeInteger(cents) || cents < 0 || currency !== "USD" || !amount || !terms) {
+    if (typeof cents !== "number" || !Number.isSafeInteger(cents) || cents < 0 || !isUsdCurrency(currency) || !amount || !terms) {
         throw new DeployDomainsError("Could not load complete USD renewal terms. Nothing was changed. Try again later.", "RENEWAL_TERMS_UNAVAILABLE");
     }
     const nextRenewal = detail.nextRenewalAt ?? detail.expiresAt;

package/dist/lib/bot/api.d.ts

@@ -243,6 +243,14 @@ export declare class BotApi {
         createdAt?: string;
         state?: string;
     }>;
+    /**
+     * POST /v1/agents/{agentUid}/failure-reports, as the bot. The same route
+     * the HQ Fleet Runtime's HQ DM adapter files a failed turn through; the
+     * payload mirrors its `build_upload`. Returns the id HQ stored it under.
+     */
+    reportFailure(agentUid: string, report: Record<string, unknown>): Promise<{
+        reportId: string | null;
+    }>;
     /** POST|DELETE /v1/notify/reactions on a DM message (best-effort thinking status). */
     setReaction(input: {
         peerUid: string;

package/dist/lib/bot/api.js

@@ -163,6 +163,15 @@ export class BotApi {
         const { body } = await this.call("/v1/notify/dm", { method: "POST", body: payload });
         return body;
     }
+    /**
+     * POST /v1/agents/{agentUid}/failure-reports, as the bot. The same route
+     * the HQ Fleet Runtime's HQ DM adapter files a failed turn through; the
+     * payload mirrors its `build_upload`. Returns the id HQ stored it under.
+     */
+    async reportFailure(agentUid, report) {
+        const { body } = await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/failure-reports`, { method: "POST", body: report });
+        return { reportId: typeof body?.reportId === "string" && body.reportId.trim() ? body.reportId.trim() : null };
+    }
     /** POST|DELETE /v1/notify/reactions on a DM message (best-effort thinking status). */
     async setReaction(input, present) {
         try {

package/dist/lib/bot/fleet-local.d.ts

@@ -369,6 +369,34 @@ export declare function windowsExtractionPathProblem(destination: string, longes
 export declare function importFleetLocalMachineCredential(agentUid: string, machineCredentials: string, deps?: FleetLocalControlDeps, opts?: {
     keepSource?: boolean;
 }): void;
+/** The bots with an HQ Fleet profile on this computer, by the id their profile.json names. */
+export declare function listFleetLocalProfiles(deps?: Pick<FleetLocalControlDeps, "fleetHome">): Array<{
+    agentUid: string;
+    profileDir: string;
+}>;
+export interface FleetLocalProviderAuthStatus {
+    authenticated: boolean;
+    /** `oauth` or `api_key`, when authenticated. */
+    authType?: string;
+}
+/**
+ * The helper's word on a provider credential a bot holds here (never the
+ * credential itself). Null when the helper cannot be asked: the profile is
+ * not installed, or the helper failed.
+ */
+export declare function fleetLocalProviderAuthStatus(agentUid: string, provider: string, deps?: FleetLocalControlDeps): FleetLocalProviderAuthStatus | null;
+/**
+ * Sign a bot in from a login already on this computer, without a browser:
+ * the helper imports the Codex CLI login (CODEX_HOME, else ~/.codex) or
+ * copies another Fleet bot's Grok login. `env` is added to the helper's
+ * environment (a bot's own Codex home). The profile's provider is already
+ * the runtime's preset from the bootstrap; this re-renders and checks it.
+ */
+export declare function importFleetLocalProviderLogin(agentUid: string, runtime: "codex" | "grok", deps?: FleetLocalControlDeps, opts?: {
+    env?: Record<string, string>;
+}): {
+    runtimeProvider: string;
+};
 export interface FleetRuntimeInstallResult {
     release: FleetLocalReleasePin;
     distributionDir: string;

package/dist/lib/bot/fleet-local.js

@@ -80,14 +80,14 @@ export function sharedRuntimeLayout(root, id, platform) {
 }
 export const HQ_FLEET_LOCAL_RELEASE = {
     repository: "indigoai-us/hq-fleet-local",
-    tag: "v0.4.25",
-    version: "0.4.25",
-    artifact: "hq-fleet-local-0.4.25.zip",
-    artifactSha256: "4d32e04f992600ab0f1656de3536358dfdba77bfccdc23e1b01ba7a0de4ea38d",
+    tag: "v0.4.26",
+    version: "0.4.26",
+    artifact: "hq-fleet-local-0.4.26.zip",
+    artifactSha256: "a738704bf3ea7109ecc133c091b97a2d602d54d83df74a44a25fed508ed8ce27",
     runtimeArtifact: "hq-fleet-runtime-d257fdd1171f.tar.gz",
     runtimeArtifactSha256: "4d26d250eb100efff280bcd254e06e3a2993875c1fff4eec1733eaf99e52cd70",
-    manifestSha256: "d7e3a3309bf60e6366b192c9131d44166edf63cb5a60ca7923fe30145fc890f0",
-    signatureSha256: "1b018c39e69aefa26a0b1f95ed5d97388fd4747851643c8a53cae3069c670c0a",
+    manifestSha256: "07d4ee6e34dc63c5f42df009fa9c70d3ef6a93527143956373a9d3cef6f5c3cc",
+    signatureSha256: "34793d91b60acdcc7e508d4ddb98311ef0d34b8a60c57930cef08e649288297a",
     runtimeCommit: "d257fdd1171f1edd5e381b3bad7baacab0cb00d3",
 };
 /** hq-fleet-local trust/release-public.pem (rotated 2026-10-30; signed v0.4.17). */
@@ -1695,6 +1695,75 @@ export function importFleetLocalMachineCredential(agentUid, machineCredentials,
     if (!opts.keepSource)
         fs.rmSync(machineCredentials, { force: true });
 }
+/** The bots with an HQ Fleet profile on this computer, by the id their profile.json names. */
+export function listFleetLocalProfiles(deps = {}) {
+    const profiles = path.join(deps.fleetHome ?? fleetHome(), "profiles");
+    let entries;
+    try {
+        entries = fs.readdirSync(profiles, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const found = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const profileDir = path.join(profiles, entry.name);
+        try {
+            const metadata = JSON.parse(fs.readFileSync(path.join(profileDir, "profile.json"), "utf8"));
+            if (typeof metadata.botId === "string" && /^agt_[A-Za-z0-9_-]+$/.test(metadata.botId))
+                found.push({ agentUid: metadata.botId, profileDir });
+        }
+        catch {
+            /* not a bot profile */
+        }
+    }
+    return found.sort((a, b) => a.profileDir.localeCompare(b.profileDir));
+}
+/**
+ * The helper's word on a provider credential a bot holds here (never the
+ * credential itself). Null when the helper cannot be asked: the profile is
+ * not installed, or the helper failed.
+ */
+export function fleetLocalProviderAuthStatus(agentUid, provider, deps = {}) {
+    let files;
+    try {
+        files = fleetLocalExecutables(agentUid, deps);
+    }
+    catch {
+        return null;
+    }
+    const run = deps.run ?? execFileSync;
+    try {
+        const status = runJson(run, files.helper, ["auth", "status", "--profile", files.profileDir, "--bot-id", agentUid, "--provider", provider], { stdio: ["ignore", "pipe", "pipe"], timeout: 15_000 }, `${provider} sign-in status`);
+        return { authenticated: status.authenticated === true, ...(typeof status.authType === "string" ? { authType: status.authType } : {}) };
+    }
+    catch {
+        return null;
+    }
+}
+/** The helper waits this long for a sign-in import before the move counts as failed. */
+const FLEET_PROVIDER_IMPORT_TIMEOUT_MS = 60_000;
+/**
+ * Sign a bot in from a login already on this computer, without a browser:
+ * the helper imports the Codex CLI login (CODEX_HOME, else ~/.codex) or
+ * copies another Fleet bot's Grok login. `env` is added to the helper's
+ * environment (a bot's own Codex home). The profile's provider is already
+ * the runtime's preset from the bootstrap; this re-renders and checks it.
+ */
+export function importFleetLocalProviderLogin(agentUid, runtime, deps = {}, opts = {}) {
+    const provider = runtime === "grok" ? "xai-oauth" : "openai-codex";
+    const run = deps.run ?? execFileSync;
+    const files = fleetLocalExecutables(agentUid, deps);
+    const env = opts.env ? { ...process.env, ...opts.env } : undefined;
+    const auth = runJson(run, files.helper, ["auth", "login", "--profile", files.profileDir, "--bot-id", agentUid, "--provider", provider, "--no-browser"], { stdio: ["ignore", "pipe", "pipe"], timeout: FLEET_PROVIDER_IMPORT_TIMEOUT_MS, ...(env ? { env } : {}) }, `${provider} sign-in import`);
+    if (auth.authenticated !== true)
+        throw expectedError(`HQ Fleet Local could not import a ${provider} sign-in from this computer.`);
+    runJson(run, files.helper, ["render-profile", "--spec", files.profile, "--mode", "update"], { stdio: ["ignore", "pipe", "pipe"] }, "profile update");
+    runJson(run, files.helper, ["doctor-profile", "--profile", files.profileDir, "--runtime", files.runtime], { stdio: ["ignore", "pipe", "pipe"] }, "profile validation");
+    return { runtimeProvider: provider };
+}
 async function installSharedFleetRuntime(installation, root, python, platform, run, spawn, onProgress) {
     const identity = digest(Buffer.from(JSON.stringify({
         version: installation.release.version,

package/dist/lib/bot/jobs/source-report.d.ts

@@ -0,0 +1,31 @@
+import type { BotApi, JobRunCompletion } from "../api.js";
+import { type BotConfig } from "../config.js";
+import { type LocalJob } from "../local-jobs.js";
+import { type LaneRecord } from "../../lanes/types.js";
+export declare const SOURCE_REPORT_JOB_KIND = "source-report";
+export declare const REPORT_COOLDOWN_MS: number;
+export declare const sourceLaneTerminal: (lane: LaneRecord) => boolean;
+export declare function ensureSourceReportJobs(dir: string, config: BotConfig, companies?: string[], home?: string): LocalJob[];
+/** Local append only; duplicate watcher observations are harmless. */
+export declare function emitExecutiveLaneFinished(hqRoot: string, lane: LaneRecord, root?: string, home?: string): boolean;
+/** Replay terminal commits whose watcher never durably published its event. */
+export declare function flushExecutiveLaneFinished(hqRoot: string, root?: string, home?: string): void;
+export declare function sourceReportReceiptPath(hqRoot: string, company: string, sourceRef: string): string;
+export interface SourceReporterDeps {
+    config: BotConfig;
+    api: Pick<BotApi, "sendDm">;
+    home?: string;
+    botsDir?: string;
+    companies?: () => string[];
+    now?: () => Date;
+    lanes?: (company: string, sourceRef: string) => LaneRecord[];
+    /** Fault injection at the two durable boundaries, without changing delivery. */
+    afterIntent?: () => void;
+    afterSend?: () => void;
+}
+export declare function createSourceReporter(deps: SourceReporterDeps): {
+    handle(event: unknown, payload: unknown, company: unknown): Promise<JobRunCompletion>;
+    /** Poll from the resident bot loop, so a last lane inside cooldown is not lost. */
+    recover(): Promise<void>;
+};
+//# sourceMappingURL=source-report.d.ts.map