@indigoai-us/hq-cli 5.122.2 → 5.123.1

package/dist/lib/mesh/live/daemon/run.js

@@ -11,6 +11,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { CLI_VERSION } from "../../../../cli-version.js";
 import { createWorkSessionDeliverer } from "../../client.js";
 import { meshJson, resolveActiveMembershipCompany } from "../../api.js";
 import { ensureCognitoToken } from "../../../../utils/cognito-session.js";
@@ -31,10 +32,14 @@ import { defaultDaemonState, patchDaemonState, writeDaemonState, } from "./state
 import { workMeshHeldPath } from "../paths.js";
 import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
 import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
+import { hasCliVersionDrift, readInstalledCliVersion } from "./version-drift.js";
+import { readDaemonConfig } from "./config.js";
 export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
+/** Non-zero exit reserved for CLI version drift so legacy Restart=on-failure units restart. */
+export const DAEMON_VERSION_DRIFT_EXIT_CODE = 75;
 /**
  * Only producer appends to spool.jsonl should wake the watcher. Every other
  * file in the work-mesh root (held.jsonl, spool.<ts>.claimed, held.<ts>.claimed,
@@ -76,7 +81,15 @@ export async function runMeshDaemon(deps = {}) {
         ((d, line) => appendDaemonLog(d, daemonLogLine("info", line, now)));
     const processEvents = deps.processEvents ?? process;
     const exit = deps.exit ?? ((code) => process.exit(code));
+    const daemonVersion = deps.daemonVersion ?? CLI_VERSION;
+    const installedCliVersion = deps.readInstalledCliVersion ?? readInstalledCliVersion;
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const configuredRoots = readDaemonConfig(dir).trustedHqRoots;
+    const trustedRoots = [...new Set([
+            ...(deps.hqRoot ? [deps.hqRoot] : []),
+            ...(env.HQ_ROOT?.trim() ? [env.HQ_ROOT.trim()] : []),
+            ...configuredRoots,
+        ])];
     ensureDaemonLog(dir);
     const lockDeps = deps.pidLock ?? defaultPidLockDeps({ isProcessAlive: alive });
     const lock = acquirePidLock(dir, lockDeps);
@@ -132,6 +145,7 @@ export async function runMeshDaemon(deps = {}) {
             return backfillHeldSessions({
                 workMeshRoot: meshRoot,
                 workContextRoot: ctxRoot,
+                hqRoots: trustedRoots,
                 limit: deps.heldBackfillBatchSize ?? HELD_BACKFILL_STARTUP_BATCH_SIZE,
                 env,
                 reconcile: (observation) => reconcileObservation(observation, {
@@ -162,7 +176,7 @@ export async function runMeshDaemon(deps = {}) {
         });
     let presence = null;
     if (deps.enablePresence !== false) {
-        const fetchCredentials = deps.fetchCredentials ??
+        const fetchCredentialsRaw = deps.fetchCredentials ??
             (async () => {
                 const t = await getToken();
                 return createContract3Fetcher({
@@ -171,6 +185,11 @@ export async function runMeshDaemon(deps = {}) {
                     env,
                 })();
             });
+        const fetchCredentials = async () => {
+            const bundle = await fetchCredentialsRaw();
+            patchDaemonState(dir, { presenceDroppedCompanies: bundle.droppedCompanies }, now);
+            return bundle;
+        };
         const presenceOpts = {
             fetchCredentials,
             mqttConnect: deps.mqttConnect,
@@ -218,15 +237,28 @@ export async function runMeshDaemon(deps = {}) {
         }
     }
     let stopped = false;
+    let restartRequested = false;
     let flushInFlight = null;
     let debounceHandle = null;
     let flushIntervalHandle = null;
+    let versionIntervalHandle = null;
     let boardIntervalHandle = null;
     let transcriptIntervalHandle = null;
     let watcher = null;
     /** Shared with transcript watcher: sessionIds seen on the hook/spool path. */
     const lastHookEventAt = new Map();
     let transcriptWatcher = null;
+    const requestRestartForVersionDrift = () => {
+        if (stopped || restartRequested)
+            return restartRequested;
+        const installedVersion = installedCliVersion();
+        if (!hasCliVersionDrift(daemonVersion, installedVersion))
+            return false;
+        restartRequested = true;
+        log(dir, `cli upgraded ${daemonVersion} -> ${installedVersion}, restarting`);
+        exit(DAEMON_VERSION_DRIFT_EXIT_CODE);
+        return true;
+    };
     if (emitPath && deps.enableTranscriptWatch !== false) {
         const hqRoot = deps.hqRoot ?? env.HQ_ROOT?.trim() ?? undefined;
         const getToken = deps.getToken ?? defaultGetToken;
@@ -268,7 +300,12 @@ export async function runMeshDaemon(deps = {}) {
     }
     const doFlushCycle = async (reason, opts = {}) => {
         // Refuse new cycles after stop, except the forced shutdown flush.
-        if (stopped && !opts.force)
+        if ((stopped || restartRequested) && !opts.force)
+            return;
+        // A long-lived daemon retains its loaded JS after a global CLI upgrade.
+        // The service unit resolves the binary again on restart, so exiting lets
+        // launchd/systemd bring up the upgraded implementation.
+        if (!opts.force && requestRestartForVersionDrift())
             return;
         if (flushInFlight) {
             await flushInFlight;
@@ -400,6 +437,14 @@ export async function runMeshDaemon(deps = {}) {
             boardIntervalHandle = timers.setTimeout(boardTick, BOARD_REFRESH_INTERVAL_MS);
         });
     }, BOARD_REFRESH_INTERVAL_MS);
+    // Version drift is independent of the legacy spool flush. Direct-mode
+    // daemons have no flush cycle, so they still need the same periodic restart
+    // check after an in-place CLI upgrade.
+    versionIntervalHandle = timers.setTimeout(function versionTick() {
+        if (stopped || requestRestartForVersionDrift())
+            return;
+        versionIntervalHandle = timers.setTimeout(versionTick, FLUSH_INTERVAL_MS);
+    }, FLUSH_INTERVAL_MS);
     const runTranscriptTick = async () => {
         if (!transcriptWatcher || stopped)
             return;
@@ -442,7 +487,7 @@ export async function runMeshDaemon(deps = {}) {
     }
     // Initial pass. Board refresh runs in both modes; the flush + transcript
     // scan are legacy emit-path only.
-    if (emitPath) {
+    if (!requestRestartForVersionDrift() && emitPath) {
         void doFlushCycle("start");
     }
     void refreshFn().catch(() => undefined);
@@ -458,6 +503,8 @@ export async function runMeshDaemon(deps = {}) {
             timers.clearTimeout(debounceHandle);
         if (flushIntervalHandle !== null)
             timers.clearTimeout(flushIntervalHandle);
+        if (versionIntervalHandle !== null)
+            timers.clearTimeout(versionIntervalHandle);
         if (boardIntervalHandle !== null)
             timers.clearTimeout(boardIntervalHandle);
         if (transcriptIntervalHandle !== null) {

package/dist/lib/mesh/live/daemon/state.d.ts

@@ -3,6 +3,7 @@
  */
 import type { MqttConnectionState } from "./presence.js";
 import type { FlushSummary } from "../flush.js";
+import type { DroppedPresenceCompany } from "./credentials.js";
 export interface PresenceRefusalState {
     code: string;
     status: number;
@@ -14,6 +15,8 @@ export interface DaemonStateFile {
     startedAt: string;
     mqttState: MqttConnectionState;
     companiesOnline: string[];
+    /** Companies omitted from the current presence credential bundle. */
+    presenceDroppedCompanies?: DroppedPresenceCompany[];
     actorUid?: string;
     lastFlushAt?: string;
     lastFlushResult?: FlushSummary & {

package/dist/lib/mesh/live/daemon/version-drift.d.ts

@@ -0,0 +1,5 @@
+/** Version installed behind the entrypoint that launched this daemon. */
+export declare function readInstalledCliVersion(entry?: string): string | null;
+/** A missing/unreadable installed version is not proof of a safe restart. */
+export declare function hasCliVersionDrift(daemonVersion: string, installedVersion: string | null | undefined): installedVersion is string;
+//# sourceMappingURL=version-drift.d.ts.map

package/dist/lib/mesh/live/daemon/version-drift.js

@@ -0,0 +1,47 @@
+/**
+ * Read the version of the CLI package currently selected by the daemon's
+ * launch entrypoint. The daemon keeps the version it was loaded with in
+ * memory; an npm/pnpm upgrade can repoint this entrypoint without restarting
+ * that process.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+function packageVersionAtOrAbove(entry) {
+    let dir;
+    try {
+        dir = path.dirname(fs.realpathSync(entry));
+    }
+    catch {
+        return null;
+    }
+    // A CLI entrypoint is normally <package>/dist/index.js. Keep the walk
+    // bounded so a malformed entrypoint never traverses an entire filesystem.
+    for (let i = 0; i < 8; i += 1) {
+        const pkgPath = path.join(dir, "package.json");
+        try {
+            const parsed = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+            if (parsed.name === "@indigoai-us/hq-cli" &&
+                typeof parsed.version === "string" &&
+                parsed.version.trim()) {
+                return parsed.version.trim();
+            }
+        }
+        catch {
+            // No package manifest at this level; continue walking upward.
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+/** Version installed behind the entrypoint that launched this daemon. */
+export function readInstalledCliVersion(entry = process.argv[1]) {
+    return entry ? packageVersionAtOrAbove(entry) : null;
+}
+/** A missing/unreadable installed version is not proof of a safe restart. */
+export function hasCliVersionDrift(daemonVersion, installedVersion) {
+    return Boolean(installedVersion && installedVersion !== daemonVersion);
+}
+//# sourceMappingURL=version-drift.js.map

package/dist/lib/mesh/live/paths.d.ts

@@ -6,6 +6,8 @@ export declare const WORK_MESH_DIRNAME = "work-mesh";
 export declare function workMeshRoot(home?: string, env?: NodeJS.ProcessEnv): string;
 export declare function workMeshSpoolPath(root?: string): string;
 export declare function workMeshHeldPath(root?: string): string;
+/** Rotating cursor for bounded daemon-start held-event recovery. */
+export declare function workMeshHeldBackfillCursorPath(root?: string): string;
 export declare function workMeshDeadLetterPath(root?: string): string;
 export declare function workMeshDroppedReceiptPath(root?: string): string;
 /** Claim path: spool.<ts>.claimed (never reuse spool.jsonl for claim). */

package/dist/lib/mesh/live/paths.js

@@ -17,6 +17,10 @@ export function workMeshSpoolPath(root) {
 export function workMeshHeldPath(root) {
     return path.join(root ?? workMeshRoot(), "held.jsonl");
 }
+/** Rotating cursor for bounded daemon-start held-event recovery. */
+export function workMeshHeldBackfillCursorPath(root) {
+    return path.join(root ?? workMeshRoot(), "held-backfill-cursor.json");
+}
 export function workMeshDeadLetterPath(root) {
     return path.join(root ?? workMeshRoot(), "dead-letter.jsonl");
 }

package/dist/lib/work-context/reconcile.js

@@ -10,7 +10,7 @@ import { EXIT_INVALID_IDENTITY, EXIT_NOT_TRACKING, EXIT_OK, InvalidDecisionOrigi
 import { decisionFromCandidates, } from "./organize.js";
 import { resolveProjectTask, shouldAskAfter } from "./project.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey } from "./repo-remote.js";
-import { enqueueOutbox, markOutboxAcked, markOutboxQuarantined, markOutboxQueued, replayOutbox, writeAckedRegisterState, } from "./outbox.js";
+import { enqueueOutbox, listOutboxOperations, markOutboxAcked, markOutboxQuarantined, markOutboxQueued, replayOutbox, writeAckedRegisterState, } from "./outbox.js";
 import { mergeLocalSessionFields, readSessionState, writeSessionState, } from "./state.js";
 function resultOf(parts) {
     const out = {
@@ -293,12 +293,10 @@ export async function reconcileObservation(obs, deps) {
             startedAt,
             ...(typeof toolWrites === "number" ? { toolWrites } : {}),
             ...(hasTurn ? { hasTurn: true } : {}),
-            // Preserve prior binding ids for visibility; do not auto-switch.
+            // Preserve prior scope for visibility; its receipt belongs to the
+            // quarantined binding and must not suppress a later retry.
             ...(prior?.projectId ? { projectId: prior.projectId } : {}),
             ...(prior?.taskId ? { taskId: prior.taskId } : {}),
-            ...(prior?.bindingEpisodeId
-                ? { bindingEpisodeId: prior.bindingEpisodeId }
-                : {}),
             ...transcriptFields,
             decision: {
                 decisionId: `conflict_${sessionId}`,
@@ -325,7 +323,7 @@ export async function reconcileObservation(obs, deps) {
                 askAfter: false,
                 ...(correctionPath ? { correctionPath } : {}),
             },
-        }, prior), deps.root);
+        }, prior, { preserveBindingEpisode: false }), deps.root);
         return {
             result: resultOf({
                 kind: "company_conflict",
@@ -491,6 +489,69 @@ export async function reconcileObservation(obs, deps) {
         prior.bindingEpisodeId
         ? "needs_project"
         : registerClassification;
+    // Re-observing an already acknowledged binding is normal for hooks and the
+    // resident daemon. A fresh clientOperationId must not turn that observation
+    // into a second semantic register operation: the prior receipt is the stable
+    // identity for this exact company/project/task binding.
+    const acknowledgedPrior = prior?.bindingEpisodeId &&
+        prior.companyUid === resolvedCompany.uid &&
+        prior.companySlug === resolvedCompany.slug &&
+        prior.projectId === projectId &&
+        prior.taskId === taskId &&
+        listOutboxOperations(deps.root).some((operation) => operation.kind === "register" &&
+            operation.delivery === "acked" &&
+            operation.sessionId === sessionId &&
+            operation.receiptId === prior.bindingEpisodeId &&
+            operation.companyUid === resolvedCompany.uid &&
+            operation.companySlug === resolvedCompany.slug &&
+            operation.projectId === projectId &&
+            operation.taskId === taskId)
+        ? prior
+        : null;
+    if (acknowledgedPrior) {
+        // Activity is local progress, not binding identity. Retain the receipt
+        // without another register while carrying hook counters forward so the
+        // normal clarification threshold still advances.
+        writeSessionState(mergeLocalSessionFields({
+            contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
+            sessionId,
+            companyUid: acknowledgedPrior.companyUid,
+            companySlug: acknowledgedPrior.companySlug,
+            contextStatus: stateClassification,
+            projectId,
+            taskId,
+            bindingEpisodeId: acknowledgedPrior.bindingEpisodeId,
+            updatedAt: nowIso,
+            startedAt,
+            ...(typeof toolWrites === "number" ? { toolWrites } : {}),
+            ...(hasTurn ? { hasTurn: true } : {}),
+            ...(decision ? { decision } : {}),
+            ...transcriptFields,
+        }, prior), deps.root);
+        const kind = registerClassification === "bound"
+            ? "bound"
+            : registerClassification === "needs_task"
+                ? "needs_task"
+                : registerClassification === "needs_project"
+                    ? "needs_project"
+                    : "queued";
+        diagnostics.push(`binding unchanged; retained receipt=${acknowledgedPrior.bindingEpisodeId}`);
+        return {
+            result: resultOf({
+                kind,
+                classification: registerClassification,
+                delivery: "acked",
+                sessionId,
+                clientOperationId: obs.clientOperationId,
+                companyUid: resolvedCompany.uid,
+                projectId,
+                taskId,
+                bindingEpisodeId: acknowledgedPrior.bindingEpisodeId,
+            }),
+            exitCode: EXIT_OK,
+            diagnostics,
+        };
+    }
     let outboxOp;
     try {
         outboxOp = enqueueOutbox({

package/dist/lib/work-context/state.d.ts

@@ -112,10 +112,12 @@ export declare function writeSessionState(state: SessionStateFile, root: string)
 /** Strip any non-allowlisted fields before durable write. */
 export declare function projectSessionState(state: SessionStateFile): SessionStateFile;
 /**
- * Merge prior local-only counters into a new state write so PostToolUse bumps
- * and reconcile updates do not clobber each other.
+ * Merge prior local fields into a new state write so PostToolUse bumps and
+ * reconcile updates do not clobber an acknowledged company binding.
  */
-export declare function mergeLocalSessionFields(next: SessionStateFile, prior: SessionStateFile | null): SessionStateFile;
+export declare function mergeLocalSessionFields(next: SessionStateFile, prior: SessionStateFile | null, options?: {
+    preserveBindingEpisode?: boolean;
+}): SessionStateFile;
 /**
  * Upgrade the local projection after the server acknowledges a register.
  *

package/dist/lib/work-context/state.js

@@ -103,13 +103,30 @@ export function projectSessionState(state) {
     return out;
 }
 /**
- * Merge prior local-only counters into a new state write so PostToolUse bumps
- * and reconcile updates do not clobber each other.
+ * Merge prior local fields into a new state write so PostToolUse bumps and
+ * reconcile updates do not clobber an acknowledged company binding.
  */
-export function mergeLocalSessionFields(next, prior) {
+export function mergeLocalSessionFields(next, prior, options = {}) {
     if (!prior)
         return next;
     const out = { ...next };
+    // Hook observations commonly carry only tool-write/session metadata. Those
+    // writes must not erase a company that an acknowledged register already
+    // projected locally; losing it causes held events and repeat registrations.
+    // A caller that carries either company field is intentionally changing the
+    // binding and remains authoritative.
+    if (!out.companyUid && !out.companySlug && (prior.companyUid || prior.companySlug)) {
+        out.companyUid = prior.companyUid;
+        out.companySlug = prior.companySlug;
+        out.contextStatus = prior.contextStatus;
+        if (!out.projectId && prior.projectId)
+            out.projectId = prior.projectId;
+        if (!out.taskId && prior.taskId)
+            out.taskId = prior.taskId;
+        if (out.version === undefined && prior.version !== undefined) {
+            out.version = prior.version;
+        }
+    }
     if (out.toolWrites === undefined && typeof prior.toolWrites === "number") {
         out.toolWrites = prior.toolWrites;
     }
@@ -131,7 +148,14 @@ export function mergeLocalSessionFields(next, prior) {
     if (!out.transcriptMarker && prior.transcriptMarker) {
         out.transcriptMarker = prior.transcriptMarker;
     }
-    if (!out.bindingEpisodeId && prior.bindingEpisodeId) {
+    const sameBinding = prior.companyUid === out.companyUid &&
+        prior.companySlug === out.companySlug &&
+        prior.projectId === out.projectId &&
+        prior.taskId === out.taskId;
+    if (options.preserveBindingEpisode !== false &&
+        !out.bindingEpisodeId &&
+        prior.bindingEpisodeId &&
+        sameBinding) {
         out.bindingEpisodeId = prior.bindingEpisodeId;
     }
     return out;

package/dist/utils/cli-telemetry.d.ts

@@ -1,4 +1,25 @@
 export declare const TELEMETRY_TIMEOUT_MS = 1200;
+/**
+ * Exact stderr line printed once on the first signed-in TTY run that is not
+ * `--json`. Wording matches the event body: CLI version + timestamp only.
+ */
+export declare const TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when you run a signed-in command (CLI version and a timestamp, never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.";
+/**
+ * `HQ_TELEMETRY=0` (also `false` and `off`, case-insensitive) disables every
+ * CLI POST to `/v1/telemetry/events`. `HQ_TELEMETRY_TIMEOUT_MS` is unchanged.
+ */
+export declare function isCliTelemetryDisabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function telemetryDisclosureMarkerPath(): string;
+/**
+ * Print the one-line disclosure at most once per machine. Returns whether
+ * the notice has been shown (this run or a previous one). `--json` and
+ * non-TTY stdout skip the print and do not record the marker.
+ */
+export declare function maybeDiscloseCliTelemetry(stderr?: {
+    write: (chunk: string) => unknown;
+}, stdout?: {
+    isTTY?: boolean;
+}, argv?: readonly string[]): boolean;
 /**
  * Emit the authenticated CLI session signal using an already-cached token.
  * This deliberately never refreshes a session or opens a browser.

package/dist/utils/cli-telemetry.js

@@ -1,8 +1,80 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
 import { isExpiring, isMachineIdentity, loadCachedTokens, } from "./cognito-session.js";
 import { vaultApiFetch } from "./vault-api.js";
 export const TELEMETRY_TIMEOUT_MS = 1_200;
+/**
+ * Exact stderr line printed once on the first signed-in TTY run that is not
+ * `--json`. Wording matches the event body: CLI version + timestamp only.
+ */
+export const TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when you run a signed-in command (CLI version and a timestamp, never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.";
+const TELEMETRY_DISABLED_VALUES = new Set(["0", "false", "off"]);
+const DISCLOSURE_MARKER = "cli-telemetry-disclosed";
 let cliSessionStartedPromise;
+/**
+ * `HQ_TELEMETRY=0` (also `false` and `off`, case-insensitive) disables every
+ * CLI POST to `/v1/telemetry/events`. `HQ_TELEMETRY_TIMEOUT_MS` is unchanged.
+ */
+export function isCliTelemetryDisabled(env = process.env) {
+    const raw = env.HQ_TELEMETRY?.trim().toLowerCase();
+    if (!raw)
+        return false;
+    return TELEMETRY_DISABLED_VALUES.has(raw);
+}
+function hqConfigDir() {
+    const home = process.env.HOME?.trim() || os.homedir();
+    return path.join(home, ".hq");
+}
+export function telemetryDisclosureMarkerPath() {
+    return path.join(hqConfigDir(), DISCLOSURE_MARKER);
+}
+function wantsJsonOutput(argv = process.argv) {
+    return argv.includes("--json");
+}
+function canPrintDisclosure(stdout = process.stdout, argv = process.argv) {
+    return Boolean(stdout.isTTY) && !wantsJsonOutput(argv);
+}
+function hasShownDisclosure() {
+    try {
+        return fs.existsSync(telemetryDisclosureMarkerPath());
+    }
+    catch {
+        return false;
+    }
+}
+function recordDisclosureShown() {
+    try {
+        const dir = hqConfigDir();
+        // Do not create ~/.hq. Signed-in runs already have it (cached tokens).
+        if (!fs.existsSync(dir))
+            return;
+        fs.writeFileSync(telemetryDisclosureMarkerPath(), `${new Date().toISOString()}\n`);
+    }
+    catch {
+        // Marker write is best effort; a repeat print is better than crashing.
+    }
+}
+/**
+ * Print the one-line disclosure at most once per machine. Returns whether
+ * the notice has been shown (this run or a previous one). `--json` and
+ * non-TTY stdout skip the print and do not record the marker.
+ */
+export function maybeDiscloseCliTelemetry(stderr = process.stderr, stdout = process.stdout, argv = process.argv) {
+    if (hasShownDisclosure())
+        return true;
+    if (!canPrintDisclosure(stdout, argv))
+        return false;
+    try {
+        stderr.write(`${TELEMETRY_DISCLOSURE_LINE}\n`);
+    }
+    catch {
+        return false;
+    }
+    recordDisclosureShown();
+    return true;
+}
 /**
  * Emit the authenticated CLI session signal using an already-cached token.
  * This deliberately never refreshes a session or opens a browser.
@@ -13,12 +85,16 @@ export function emitCliSessionStarted(timeoutMs = TELEMETRY_TIMEOUT_MS) {
 }
 async function emitCachedCliSessionStarted(timeoutMs) {
     try {
+        if (isCliTelemetryDisabled())
+            return;
         const cached = loadCachedTokens();
         if (!cached || isExpiring(cached, 120))
             return;
         const token = isMachineIdentity() ? cached.idToken : cached.accessToken;
         if (!token)
             return;
+        const disclosed = maybeDiscloseCliTelemetry();
+        const consentBasis = disclosed ? "disclosed" : "no-consent";
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), timeoutMs);
         try {
@@ -33,7 +109,7 @@ async function emitCachedCliSessionStarted(timeoutMs) {
                             app: "hq-cli",
                             source: "cli",
                             occurredAt: new Date().toISOString(),
-                            consentBasis: "no-consent",
+                            consentBasis,
                             schemaVersion: 1,
                             properties: { version: CLI_VERSION },
                         },

package/dist/utils/self-update.d.ts

@@ -57,6 +57,7 @@
  * version-check), `hq rescue --no-self-update`, and the re-exec guard env.
  */
 import { type RunningInstall, type UpdateResult } from "./version-gate.js";
+import { type RestartDaemonResult } from "../lib/mesh/live/daemon/install.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
  * One update + one re-exec per user invocation, ever.
@@ -153,6 +154,8 @@ export interface SelfUpdateDeps {
      * underneath themselves: hooks, scripts, agents, cron, CI.
      */
     interactive?: boolean;
+    /** Best-effort daemon kick after the CLI install converges (tests). */
+    restartDaemon?: () => RestartDaemonResult | void;
 }
 /**
  * Startup path: the running CLI is behind npm `latest`, so update in place and

package/dist/utils/self-update.js

@@ -63,6 +63,7 @@ import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
 import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, checkUpdateConvergence, isLocalDependencyInstall, isPrefixWritable, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, } from "./version-gate.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
+import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
  * One update + one re-exec per user invocation, ever.
@@ -278,6 +279,16 @@ async function updateAndReexec(argv, flavor, known, deps) {
         console.error(chalk.dim(`  Continuing the ${flavor.noun} on ${current}.`));
         return { action: "update-ineffective", latest };
     }
+    // A resident mesh daemon keeps the old JS loaded after a global install.
+    // Service restart is best-effort and cannot turn a successful update red.
+    try {
+        const restart = (deps.restartDaemon ?? restartDaemonServiceIfInstalled)();
+        if (restart?.message)
+            console.error(chalk.yellow(`  ${restart.message}`));
+    }
+    catch {
+        // Defensive only; the default helper already absorbs manager failures.
+    }
     const childEnv = { ...env, [REEXEC_GUARD_ENV]: "1" };
     const status = (deps.reexec ?? reexecHq)([...argv.slice(2)], childEnv);
     if (status === null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.122.2",
+  "version": "5.123.1",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -13,7 +13,8 @@
     "assets/scaffold",
     "assets/bot-workers",
     "assets/mesh-daemon",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "README.md"
   ],
   "scripts": {
     "build": "node scripts/generate-dsn.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs",