@indigoai-us/hq-cli 5.131.0 → 5.133.0

package/dist/lib/mesh/live/backfill-held.js

@@ -163,9 +163,11 @@ function localCompanyCandidates(ref, state, canonicalHqRoot, canonicalHqRoots =
     return candidates;
 }
 /**
- * Keep only event evidence that belongs to the current session instance. A
- * current state is a durable instance marker; metadata from a held event that
- * predates it could belong to a prior use of the same session id.
+ * Keep only event evidence for the current session instance. When the state
+ * file has a binding episode, that id is the instance. A timestamp, including
+ * one later than startedAt, does not make another episode current.
+ * Sessions that predate episodes still use startedAt so an older event is
+ * not treated as this instance.
  */
 function currentInstanceEventEvidence(ref, state) {
     const evidence = ref.eventEvidence ?? [
@@ -176,6 +178,9 @@ function currentInstanceEventEvidence(ref, state) {
         },
         ...(ref.hqRoots ?? []).filter((hqRoot) => hqRoot !== ref.hqRoot).map((hqRoot) => ({ hqRoot })),
     ];
+    if (state?.bindingEpisodeId) {
+        return evidence.filter((entry) => Boolean(entry.hqRoot) && entry.bindingEpisodeId === state.bindingEpisodeId);
+    }
     if (!state?.startedAt)
         return evidence;
     const startedAt = Date.parse(state.startedAt);
@@ -188,8 +193,19 @@ function currentInstanceEventEvidence(ref, state) {
         return Number.isFinite(eventAt) && eventAt >= startedAt;
     });
 }
+/** Plain reason when every rooted held event belongs to another episode. */
+function episodeMismatchReason(ref, state) {
+    if (!state?.bindingEpisodeId)
+        return null;
+    const rooted = (ref.eventEvidence ?? []).filter((entry) => entry.hqRoot);
+    if (rooted.length === 0)
+        return null;
+    if (rooted.some((entry) => entry.bindingEpisodeId === state.bindingEpisodeId))
+        return null;
+    return "episode does not match the current instance";
+}
 function hasOnlyStaleEventEvidence(ref, state) {
-    return Boolean(state?.startedAt &&
+    return Boolean((state?.bindingEpisodeId || state?.startedAt) &&
         ref.eventEvidence?.some((entry) => entry.hqRoot) &&
         !currentInstanceEventEvidence(ref, state).some((entry) => entry.hqRoot));
 }
@@ -310,12 +326,18 @@ function latestAcknowledgedRegistration(sessionId, operations) {
 function acknowledgedRegistrationMatches(operation, ref, evidence, state) {
     if (!operation.companyUid || !operation.receiptId)
         return false;
-    if (!state?.startedAt)
-        return false;
-    const startedAt = Date.parse(state.startedAt);
-    const registeredAt = Date.parse(operation.createdAt);
-    if (!Number.isFinite(startedAt) || !Number.isFinite(registeredAt) || registeredAt < startedAt) {
-        return false;
+    if (state?.bindingEpisodeId) {
+        if (state.bindingEpisodeId !== operation.receiptId)
+            return false;
+    }
+    else {
+        if (!state?.startedAt)
+            return false;
+        const startedAt = Date.parse(state.startedAt);
+        const registeredAt = Date.parse(operation.createdAt);
+        if (!Number.isFinite(startedAt) || !Number.isFinite(registeredAt) || registeredAt < startedAt) {
+            return false;
+        }
     }
     if (evidence &&
         !candidatesAgree(evidence, {
@@ -325,8 +347,6 @@ function acknowledgedRegistrationMatches(operation, ref, evidence, state) {
         return false;
     if (ref.harness && operation.harness && ref.harness !== operation.harness)
         return false;
-    if (state?.bindingEpisodeId && state.bindingEpisodeId !== operation.receiptId)
-        return false;
     return true;
 }
 /** Shared doctor/backfill gate for a receipt that is safe to treat as current evidence. */
@@ -407,8 +427,9 @@ export function readHeldSessions(workMeshRoot) {
         if (task && !ref.task)
             ref.task = task;
         const at = str(event.at) ?? (envelope ? str(envelope.heldAt) : undefined);
+        const bindingEpisodeId = str(event.bindingEpisodeId);
         if (hqRoot || cwd) {
-            ref.eventEvidence = [...(ref.eventEvidence ?? []), { hqRoot, cwd, harness, at }];
+            ref.eventEvidence = [...(ref.eventEvidence ?? []), { hqRoot, cwd, harness, at, bindingEpisodeId }];
         }
         seen.set(sessionId, ref);
     }
@@ -481,7 +502,9 @@ export async function backfillHeldSessions(deps) {
         if (!evidence.candidate?.slug && deps.useDeviceDefault !== true) {
             result.unresolved += 1;
             result.noEvidence += 1;
-            deps.log?.(`would stay unresolved ${sessionId} (${hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence"})`);
+            const staleReason = episodeMismatchReason(ref, state)
+                ?? (hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence");
+            deps.log?.(`would stay unresolved ${sessionId} (${staleReason})`);
             continue;
         }
         const evidenceRef = {

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -5,6 +5,7 @@
 import { type CognitoActorKind, type CognitoTokenSource } from "../../../../utils/cognito-session.js";
 import { type UnattributedEventCounts } from "../spool.js";
 import { type DaemonStateFile } from "./state.js";
+import { type LegacyListenPlatform } from "./legacy-listen.js";
 export declare const UNHEALTHY_SPOOL_AGE_MS = 60000;
 export interface DaemonDoctorReport {
     running: boolean;
@@ -54,6 +55,8 @@ export interface DaemonDoctorReport {
     };
     /** Work held or quarantined after default-derived membership was denied. */
     deviceDefaultAuthorizationDenials: number;
+    /** True when the pack-era listen unit is still on disk. */
+    legacyListenerInstalled: boolean;
 }
 export interface DaemonDoctorDeps {
     home?: string;
@@ -64,6 +67,9 @@ export interface DaemonDoctorDeps {
     env?: NodeJS.ProcessEnv;
     isProcessAlive?: (pid: number) => boolean;
     now?: () => number;
+    /** Override the legacy-listen probe (tests). */
+    legacyListenerInstalled?: boolean;
+    platform?: LegacyListenPlatform;
 }
 export declare function collectDaemonDoctor(deps?: DaemonDoctorDeps): DaemonDoctorReport;
 export declare function formatDaemonDoctor(report: DaemonDoctorReport): string[];

package/dist/lib/mesh/live/daemon/doctor.js

@@ -18,6 +18,7 @@ import { hasCurrentAcknowledgedRegistration, readHeldSessions, refWithLocalCompa
 import { readDaemonConfig } from "./config.js";
 import { pidLockStatus, readPidLock } from "./pid-lock.js";
 import { readDaemonState } from "./state.js";
+import { LEGACY_LISTENER_DOCTOR_LINE, legacyListenInstalled, } from "./legacy-listen.js";
 export const UNHEALTHY_SPOOL_AGE_MS = 60_000;
 function oldestJsonlAgeMs(filePath, nowMs) {
     if (!fs.existsSync(filePath))
@@ -126,7 +127,7 @@ export function collectDaemonDoctor(deps = {}) {
     if (deadLetterCount > 0) {
         unhealthyReasons.push(`dead-letter count=${deadLetterCount}`);
     }
-    if (emitMode === "legacy" && heldCount > 0) {
+    if (heldCount > 0) {
         unhealthyReasons.push(`held events awaiting company attribution=${heldCount}`);
     }
     if (heldWithNoLocalEvidence > 0) {
@@ -144,6 +145,14 @@ export function collectDaemonDoctor(deps = {}) {
     if (presenceRefusal) {
         unhealthyReasons.push(`presence credential refused (${presenceRefusal.code}); next retry ${presenceRefusal.nextRetryAt}`);
     }
+    const platform = deps.platform ?? process.platform;
+    const legacyListener = deps.legacyListenerInstalled ??
+        (platform === "darwin" || platform === "linux"
+            ? legacyListenInstalled({ home, platform })
+            : false);
+    if (legacyListener) {
+        unhealthyReasons.push(LEGACY_LISTENER_DOCTOR_LINE);
+    }
     const auth = describeCognitoTokenSource({ home, env });
     const whoamiTokens = readPersonTokenFile(home, env);
     const daemonTokens = auth.tokenSource === "machine"
@@ -192,6 +201,7 @@ export function collectDaemonDoctor(deps = {}) {
             }
             : undefined,
         deviceDefaultAuthorizationDenials,
+        legacyListenerInstalled: legacyListener,
     };
 }
 export function formatDaemonDoctor(report) {
@@ -200,12 +210,16 @@ export function formatDaemonDoctor(report) {
         `mode: ${report.emitMode}`,
         `mqtt: ${report.mqttState}`,
         `subscription: ${report.subscribed ? "connected" : "disconnected"}`,
+        ...(report.legacyListenerInstalled ? [LEGACY_LISTENER_DOCTOR_LINE] : []),
         `companies online: ${report.companiesOnline.length ? report.companiesOnline.join(", ") : "(none)"}`,
     ];
     if (report.emitMode === "legacy") {
         // Legacy emit path only: the spool/held/outbox queues do not exist in
         // receive-only (direct) mode.
-        lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
+        lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}${report.heldCount > 0 ? " (needs_company; not sent as NONE)" : ""}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
+    }
+    if (report.emitMode !== "legacy" && report.heldCount > 0) {
+        lines.push(`held: ${report.heldCount} (needs_company; not sent as NONE)`);
     }
     lines.push(`attributed by device default: ${report.attributedByDeviceDefault}`, `device-default authorization denials: ${report.deviceDefaultAuthorizationDenials}`, `dead-letter: ${report.deadLetterCount}`, `unattributed events: ${report.unattributedEvents.total} ` +
         `(spool=${report.unattributedEvents.spool} held=${report.unattributedEvents.held} dead-letter=${report.unattributedEvents.deadLetter})`, `token source: ${report.tokenSource}`, `actor kind: ${report.actorKind}`, `identity whoami: ${report.whoamiSubject}`, `identity daemon: ${report.daemonSubject}`);

package/dist/lib/mesh/live/daemon/install.d.ts

@@ -101,7 +101,12 @@ export declare function restartDaemonServiceIfInstalled(opts?: {
     platform?: DaemonInstallPlatform;
     home?: string;
     uid?: number;
+    /** HQ root the daemon was serving, or the root this update was run from. */
+    hqRoot?: string;
+    env?: NodeJS.ProcessEnv;
     existsSync?: typeof fs.existsSync;
+    readFileSync?: typeof fs.readFileSync;
+    writeFileSync?: typeof fs.writeFileSync;
     run?: (command: string, args: string[]) => {
         status: number | null;
     };
@@ -230,6 +235,13 @@ export declare function installDaemonService(opts: {
     schtasks?: SchtasksRunner;
     /** Windows: terminate the recorded daemon pid when replacing a task (tests inject). */
     kill?: (pid: number) => void;
+    /** Service-manager runner for retiring the legacy listen unit (tests inject). */
+    runCommand?: (cmd: string, args: string[]) => {
+        status: number | null;
+        stdout: string;
+        stderr: string;
+    };
+    windowsLegacyTaskPresent?: boolean;
 }): InstallResult;
 export declare function uninstallDaemonService(opts: {
     platform?: DaemonInstallPlatform;

package/dist/lib/mesh/live/daemon/install.js

@@ -17,8 +17,9 @@ import * as path from "node:path";
 import { spawnSync } from "node:child_process";
 import { resolveDaemonAssetDir } from "./log.js";
 import { LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, WINDOWS_TASK_NAME, daemonDir, daemonLogPath, daemonPidPath, } from "./paths.js";
-import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot } from "./config.js";
+import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqRoot } from "./config.js";
 import { defaultPidLockDeps, pidLockStatus, readPidLock } from "./pid-lock.js";
+import { retireLegacyListen } from "./legacy-listen.js";
 /**
  * `schtasks /End` terminates the task's root process only. The daemon is
  * launched through `conhost.exe --headless`, so ending the task kills conhost
@@ -49,6 +50,86 @@ export const defaultSchtasks = (args) => {
         stderr: r.error ? r.error.message : (r.stderr ?? ""),
     };
 };
+function readServiceText(file, existsSync, readFileSync) {
+    if (!existsSync(file))
+        return "";
+    const raw = readFileSync(file);
+    const buf = Buffer.isBuffer(raw) ? raw : Buffer.from(String(raw));
+    if ((buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe) || buf.includes(0)) {
+        return buf.toString("utf16le").replace(/^\uFEFF/, "");
+    }
+    return buf.toString("utf8");
+}
+function hqRootFromUnitText(platform, text) {
+    if (platform === "win32")
+        return parseWindowsTaskHqRoot(text);
+    if (platform === "darwin") {
+        const match = /<key>HQ_ROOT<\/key>\s*<string>([^<]*)<\/string>/.exec(text);
+        return match?.[1] ?? null;
+    }
+    const match = /^Environment=HQ_ROOT=(.*)$/m.exec(text);
+    if (!match)
+        return null;
+    const value = match[1].trim();
+    return value.startsWith("'") && value.endsWith("'") ? value.slice(1, -1) : value;
+}
+/**
+ * Record the HQ root the daemon was serving and replace a pre-allowlist unit
+ * before the process is restarted. A unit with no HQ_ROOT (or Restart=on-failure)
+ * comes back with an empty root allowlist unless this runs first.
+ */
+function migrateLegacyDaemonUnit(opts) {
+    const { platform, home } = opts;
+    if (platform !== "darwin" && platform !== "linux" && platform !== "win32")
+        return;
+    const unitPath = platform === "darwin"
+        ? path.join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`)
+        : platform === "linux"
+            ? path.join(home, ".config", "systemd", "user", SYSTEMD_UNIT_NAME)
+            : path.join(daemonDir(undefined, home, opts.env), `${WINDOWS_TASK_NAME}.xml`);
+    if (!opts.existsSync(unitPath))
+        return;
+    const text = readServiceText(unitPath, opts.existsSync, opts.readFileSync);
+    const fromUnit = hqRootFromUnitText(platform, text);
+    const verified = verifyHqRoot(fromUnit ?? undefined)
+        ?? verifyHqRoot(opts.hqRoot)
+        ?? verifyHqRoot(opts.env?.HQ_ROOT);
+    if (!verified)
+        return;
+    registerTrustedHqRoot(daemonDir(undefined, home, opts.env), verified);
+    const legacy = platform === "linux"
+        ? !text.includes("Environment=HQ_ROOT=") || /Restart=on-failure/.test(text)
+        : platform === "darwin"
+            ? !/<key>HQ_ROOT<\/key>/.test(text)
+            : !fromUnit;
+    if (!legacy)
+        return;
+    const paths = buildInstallPaths({
+        home,
+        env: opts.env,
+        hqRoot: verified,
+        hqBinary: "/usr/bin/hq",
+        nodeBinary: process.execPath || "/usr/bin/node",
+    });
+    try {
+        paths.hqBinary = resolveHqBinary(process.argv, opts.env ?? process.env);
+    }
+    catch {
+        // The rendered command only has to name a binary; install already resolved one.
+    }
+    if (platform === "darwin") {
+        opts.writeFileSync(unitPath, renderLaunchdPlist(paths), { mode: 0o600 });
+        return;
+    }
+    if (platform === "linux") {
+        opts.writeFileSync(unitPath, renderSystemdUserUnit(paths), { mode: 0o600 });
+        opts.run("systemctl", ["--user", "daemon-reload"]);
+        return;
+    }
+    const rendered = renderWindowsTaskXml(paths);
+    opts.writeFileSync(unitPath, encodeWindowsTaskXml(rendered));
+    opts.run("schtasks.exe", ["/Create", "/TN", WINDOWS_TASK_NAME, "/XML", unitPath, "/F"]);
+}
 /**
  * Restart the installed user daemon after a CLI upgrade. This is deliberately
  * best-effort: an update must remain successful if a user has no service,
@@ -58,8 +139,11 @@ export function restartDaemonServiceIfInstalled(opts = {}) {
     const platform = opts.platform ?? detectPlatform();
     const home = opts.home ?? os.homedir();
     const existsSync = opts.existsSync ?? fs.existsSync;
+    const readFileSync = opts.readFileSync ?? fs.readFileSync;
+    const writeFileSync = opts.writeFileSync ?? fs.writeFileSync;
     const run = opts.run ?? ((command, args) => spawnSync(command, args, { stdio: "ignore" }));
     try {
+        migrateLegacyDaemonUnit({ platform, home, hqRoot: opts.hqRoot, env: opts.env, existsSync, readFileSync, writeFileSync, run });
         if (platform === "darwin") {
             const plist = path.join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
             if (!existsSync(plist))
@@ -568,6 +652,15 @@ export function installDaemonService(opts) {
     const mkdirSync = opts.mkdirSync ?? fs.mkdirSync;
     mkdirSync(paths.daemonDir, { recursive: true, mode: 0o700 });
     registerTrustedHqRoot(paths.daemonDir, paths.hqRoot);
+    const retired = retireLegacyListen({
+        home: paths.home,
+        platform,
+        run: opts.runCommand,
+        windowsTaskPresent: opts.windowsLegacyTaskPresent,
+    });
+    const legacyNote = retired.removed
+        ? " Retired legacy listener ai.getindigo.hq-work-mesh-listen."
+        : "";
     if (platform === "darwin") {
         const rendered = renderLaunchdPlist(paths);
         mkdirSync(paths.launchAgentsDir, { recursive: true });
@@ -579,7 +672,7 @@ export function installDaemonService(opts) {
             paths,
             rendered,
             dest: paths.plistPath,
-            message: `Installed LaunchAgent ${LAUNCHD_LABEL} → ${paths.plistPath}`,
+            message: `Installed LaunchAgent ${LAUNCHD_LABEL} → ${paths.plistPath}${legacyNote}`,
         };
     }
     if (platform === "linux") {
@@ -599,7 +692,7 @@ export function installDaemonService(opts) {
                 dest,
                 message: `Wrote system unit template for user ${opts.systemUser ?? paths.systemUser} at ${dest}. ` +
                     `Install with: sudo cp ${dest} /etc/systemd/system/${SYSTEMD_UNIT_NAME} && ` +
-                    `sudo systemctl daemon-reload && sudo systemctl enable --now ${SYSTEMD_UNIT_NAME}`,
+                    `sudo systemctl daemon-reload && sudo systemctl enable --now ${SYSTEMD_UNIT_NAME}${legacyNote}`,
             };
         }
         const rendered = renderSystemdUserUnit(paths);
@@ -613,7 +706,7 @@ export function installDaemonService(opts) {
             paths,
             rendered,
             dest: paths.systemdUnitPath,
-            message: `Installed systemd user unit ${SYSTEMD_UNIT_NAME} → ${paths.systemdUnitPath}`,
+            message: `Installed systemd user unit ${SYSTEMD_UNIT_NAME} → ${paths.systemdUnitPath}${legacyNote}`,
         };
     }
     if (platform === "win32") {
@@ -645,9 +738,9 @@ export function installDaemonService(opts) {
             dest: paths.windowsTaskXmlPath,
             running,
             message: running
-                ? `${rootLine}Installed Scheduled Task ${WINDOWS_TASK_NAME} → ${paths.windowsTaskXmlPath} (started; ${mode})`
+                ? `${rootLine}Installed Scheduled Task ${WINDOWS_TASK_NAME} → ${paths.windowsTaskXmlPath} (started; ${mode})${legacyNote}`
                 : `${rootLine}Installed Scheduled Task ${WINDOWS_TASK_NAME} → ${paths.windowsTaskXmlPath} (${mode}); ` +
-                    `start failed: ${(started.stderr || started.stdout).trim()}. It starts at next logon.`,
+                    `start failed: ${(started.stderr || started.stdout).trim()}. It starts at next logon.${legacyNote}`,
             notice: windowsLogonNotice(paths),
         };
     }
@@ -655,7 +748,7 @@ export function installDaemonService(opts) {
         platform,
         action: "install",
         paths,
-        message: `Unsupported platform for service install; run: ${paths.nodeBinary} ${paths.hqBinary} mesh daemon run`,
+        message: `Unsupported platform for service install; run: ${paths.nodeBinary} ${paths.hqBinary} mesh daemon run${legacyNote}`,
     };
 }
 export function uninstallDaemonService(opts) {

package/dist/lib/mesh/live/daemon/legacy-listen.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Retire the pack-era work-mesh listen unit so only `hq mesh daemon` subscribes.
+ *
+ * macOS: ~/Library/LaunchAgents/ai.getindigo.hq-work-mesh-listen.plist
+ * Linux: ~/.config/systemd/user/hq-work-mesh-listen.service
+ * Windows: Scheduled Task ai.getindigo.hq-work-mesh-listen
+ */
+export type LegacyListenPlatform = "darwin" | "linux" | "win32" | "other";
+export declare const LEGACY_LISTEN_LABEL = "ai.getindigo.hq-work-mesh-listen";
+export declare const LEGACY_LISTEN_SYSTEMD_UNIT = "hq-work-mesh-listen.service";
+export declare const LEGACY_LISTEN_TASK = "ai.getindigo.hq-work-mesh-listen";
+export declare const LEGACY_LISTENER_DOCTOR_LINE = "legacy listener still installed";
+export interface CommandResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+export type CommandRunner = (cmd: string, args: string[]) => CommandResult;
+export declare function legacyListenPlistPath(home: string): string;
+export declare function legacyListenSystemdPath(home: string): string;
+export declare function legacyListenInstalled(opts: {
+    home: string;
+    platform: LegacyListenPlatform;
+    existsSync?: (p: string) => boolean;
+}): boolean;
+/**
+ * Unload and delete the legacy listen unit when it is present.
+ * On-disk unit files are removed on every host. launchctl, systemctl, and
+ * schtasks run only for the matching platform, and only through `run` when
+ * the caller injected one (tests never hit a real service manager).
+ * Missing unit is a no-op.
+ */
+export declare function retireLegacyListen(opts: {
+    home: string;
+    platform: LegacyListenPlatform;
+    run?: CommandRunner;
+    uid?: number;
+    /** Windows task probe: true when the scheduled task is registered. */
+    windowsTaskPresent?: boolean;
+}): {
+    removed: boolean;
+};
+//# sourceMappingURL=legacy-listen.d.ts.map

package/dist/lib/mesh/live/daemon/legacy-listen.js

@@ -0,0 +1,89 @@
+/**
+ * Retire the pack-era work-mesh listen unit so only `hq mesh daemon` subscribes.
+ *
+ * macOS: ~/Library/LaunchAgents/ai.getindigo.hq-work-mesh-listen.plist
+ * Linux: ~/.config/systemd/user/hq-work-mesh-listen.service
+ * Windows: Scheduled Task ai.getindigo.hq-work-mesh-listen
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+export const LEGACY_LISTEN_LABEL = "ai.getindigo.hq-work-mesh-listen";
+export const LEGACY_LISTEN_SYSTEMD_UNIT = "hq-work-mesh-listen.service";
+export const LEGACY_LISTEN_TASK = LEGACY_LISTEN_LABEL;
+export const LEGACY_LISTENER_DOCTOR_LINE = "legacy listener still installed";
+export function legacyListenPlistPath(home) {
+    return path.join(home, "Library", "LaunchAgents", `${LEGACY_LISTEN_LABEL}.plist`);
+}
+export function legacyListenSystemdPath(home) {
+    return path.join(home, ".config", "systemd", "user", LEGACY_LISTEN_SYSTEMD_UNIT);
+}
+const defaultRunner = (cmd, args) => {
+    const r = spawnSync(cmd, args, { encoding: "utf8" });
+    return {
+        status: r.status,
+        stdout: r.stdout ?? "",
+        stderr: r.error ? r.error.message : (r.stderr ?? ""),
+    };
+};
+export function legacyListenInstalled(opts) {
+    const exists = opts.existsSync ?? fs.existsSync;
+    if (opts.platform === "darwin")
+        return exists(legacyListenPlistPath(opts.home));
+    if (opts.platform === "linux")
+        return exists(legacyListenSystemdPath(opts.home));
+    if (opts.platform === "win32")
+        return false;
+    return false;
+}
+/**
+ * Unload and delete the legacy listen unit when it is present.
+ * On-disk unit files are removed on every host. launchctl, systemctl, and
+ * schtasks run only for the matching platform, and only through `run` when
+ * the caller injected one (tests never hit a real service manager).
+ * Missing unit is a no-op.
+ */
+export function retireLegacyListen(opts) {
+    const run = opts.run ?? (opts.platform === "other" ? undefined : defaultRunner);
+    let removed = false;
+    const plist = legacyListenPlistPath(opts.home);
+    if (fs.existsSync(plist)) {
+        if (opts.platform === "darwin" && run) {
+            const uid = opts.uid ?? (typeof process.getuid === "function" ? process.getuid() : undefined);
+            if (uid !== undefined) {
+                run("launchctl", ["bootout", `gui/${uid}/${LEGACY_LISTEN_LABEL}`]);
+            }
+            run("launchctl", ["unload", plist]);
+        }
+        try {
+            fs.unlinkSync(plist);
+            removed = true;
+        }
+        catch {
+            // leave removed false for this file
+        }
+    }
+    const unitPath = legacyListenSystemdPath(opts.home);
+    if (fs.existsSync(unitPath)) {
+        if (opts.platform === "linux" && run) {
+            run("systemctl", ["--user", "disable", "--now", LEGACY_LISTEN_SYSTEMD_UNIT]);
+        }
+        try {
+            fs.unlinkSync(unitPath);
+            removed = true;
+            if (opts.platform === "linux" && run) {
+                run("systemctl", ["--user", "daemon-reload"]);
+            }
+        }
+        catch {
+            // leave prior removed state
+        }
+    }
+    if (opts.platform === "win32" && opts.windowsTaskPresent && run) {
+        const result = run("schtasks.exe", ["/Delete", "/TN", LEGACY_LISTEN_TASK, "/F"]);
+        if (result.status === 0)
+            removed = true;
+    }
+    return { removed };
+}
+//# sourceMappingURL=legacy-listen.js.map

package/dist/lib/mesh/live/daemon/live-cache.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Daemon-owned work-mesh live cache.
+ *
+ * ~/.hq/work-mesh/live-cache.json plus live-cache.json.cursor-v2.json.
+ * A project-view push updates the project row and bumps the cursor once.
+ * The same company/project/boardVersion (or eventId) does not bump again.
+ */
+export declare function liveCacheFile(meshRoot: string): string;
+export declare function liveCacheCursorFile(meshRoot: string): string;
+export interface ProjectViewPush {
+    companyUid: string;
+    projectId: string;
+    boardVersion?: string;
+    eventId?: string;
+}
+/** Parse a board wake. Returns null for every other payload. */
+export declare function parseProjectViewPush(payload: unknown): ProjectViewPush | null;
+/**
+ * Apply one project-view push. Cursor increases by exactly one on first sight
+ * of the key, and is left unchanged when the same push is applied again.
+ */
+export declare function applyProjectViewPush(meshRoot: string, push: ProjectViewPush, nowIso?: string): {
+    applied: boolean;
+    cursor: number;
+};
+//# sourceMappingURL=live-cache.d.ts.map

package/dist/lib/mesh/live/daemon/live-cache.js

@@ -0,0 +1,116 @@
+/**
+ * Daemon-owned work-mesh live cache.
+ *
+ * ~/.hq/work-mesh/live-cache.json plus live-cache.json.cursor-v2.json.
+ * A project-view push updates the project row and bumps the cursor once.
+ * The same company/project/boardVersion (or eventId) does not bump again.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export function liveCacheFile(meshRoot) {
+    return path.join(meshRoot, "live-cache.json");
+}
+export function liveCacheCursorFile(meshRoot) {
+    return path.join(meshRoot, "live-cache.json.cursor-v2.json");
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writeJson(file, value) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+function pushKey(push) {
+    if (push.eventId && push.eventId.trim())
+        return `id:${push.eventId.trim()}`;
+    return `pv:${push.companyUid}:${push.projectId}:${push.boardVersion ?? ""}`;
+}
+/** Parse a board wake. Returns null for every other payload. */
+export function parseProjectViewPush(payload) {
+    let value = payload;
+    if (Buffer.isBuffer(value))
+        value = value.toString("utf8");
+    if (typeof value === "string") {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const rec = value;
+    if (rec.kind !== "board" || rec.mutation !== "project-view")
+        return null;
+    if (typeof rec.companyUid !== "string" || typeof rec.projectId !== "string")
+        return null;
+    if (!rec.companyUid || !rec.projectId)
+        return null;
+    return {
+        companyUid: rec.companyUid,
+        projectId: rec.projectId,
+        boardVersion: typeof rec.boardVersion === "string" ? rec.boardVersion : undefined,
+        eventId: typeof rec.eventId === "string" ? rec.eventId : undefined,
+    };
+}
+/**
+ * Apply one project-view push. Cursor increases by exactly one on first sight
+ * of the key, and is left unchanged when the same push is applied again.
+ */
+export function applyProjectViewPush(meshRoot, push, nowIso = new Date().toISOString()) {
+    const key = pushKey(push);
+    const stored = readJson(liveCacheCursorFile(meshRoot));
+    const previous = stored &&
+        typeof stored === "object" &&
+        !Array.isArray(stored) &&
+        stored.version === 1 &&
+        typeof stored.cursor === "number"
+        ? {
+            version: 1,
+            cursor: stored.cursor,
+            seen: Array.isArray(stored.seen)
+                ? stored.seen.filter((s) => typeof s === "string").slice(-200)
+                : [],
+        }
+        : { version: 1, cursor: 0, seen: [] };
+    if (previous.seen.includes(key)) {
+        return { applied: false, cursor: previous.cursor };
+    }
+    const cursor = previous.cursor + 1;
+    const cacheRaw = readJson(liveCacheFile(meshRoot));
+    const cache = cacheRaw && typeof cacheRaw === "object" && !Array.isArray(cacheRaw)
+        ? cacheRaw
+        : {};
+    const projects = cache.projects && typeof cache.projects === "object" && !Array.isArray(cache.projects)
+        ? { ...cache.projects }
+        : {};
+    const rowKey = `${push.companyUid}/${push.projectId}`;
+    projects[rowKey] = {
+        companyUid: push.companyUid,
+        projectId: push.projectId,
+        mutation: "project-view",
+        boardVersion: push.boardVersion,
+        updatedAt: nowIso,
+    };
+    writeJson(liveCacheFile(meshRoot), {
+        ...cache,
+        updatedAt: nowIso,
+        cursor,
+        projects,
+    });
+    writeJson(liveCacheCursorFile(meshRoot), {
+        version: 1,
+        cursor,
+        seen: [...previous.seen, key].slice(-200),
+    });
+    return { applied: true, cursor };
+}
+//# sourceMappingURL=live-cache.js.map