@indigoai-us/hq-cli 5.147.0 → 5.149.1

package/dist/lib/mesh/live/daemon/install.d.ts

@@ -12,6 +12,7 @@
  * Tests must not actually install services — use a temp HOME/prefix.
  */
 import * as fs from "node:fs";
+import { type RunCommand } from "../../../service-manager/launchd.js";
 export type DaemonInstallPlatform = "darwin" | "linux" | "win32" | "other";
 /** Result of one schtasks.exe invocation (tests inject; never the real binary). */
 export interface SchtasksResult {
@@ -121,8 +122,47 @@ export declare function detectPlatform(platform?: NodeJS.Platform): DaemonInstal
  * binary when both exist.
  */
 export declare function preferStableHqBinary(entry: string): string;
+/**
+ * Absolute path of the CLI entry that is executing this process.
+ * realpath of argv[1] only — never a PATH lookup of `hq`.
+ */
+export declare function resolveRunningCliEntry(argv?: string[]): string;
+/** Absolute node binary (realpath of process.execPath). No PATH lookup. */
+export declare function resolveAbsoluteNodeBinary(execPath?: string): string;
 /** Resolve the hq binary the current shell uses (argv[1] or PATH). */
 export declare function resolveHqBinary(argv?: string[], env?: NodeJS.ProcessEnv): string;
+/** True when this CLI is newer than the version the daemon recorded, or nothing was recorded. */
+export declare function isNewerCliVersion(current: string, recorded: string | null | undefined): boolean;
+export interface InstallIfStaleResult {
+    reinstalled: boolean;
+    message: string;
+}
+/**
+ * Reinstall and restart the user daemon only when `currentVersion` is newer
+ * than daemon/state.json `cliVersion`. A missing record counts as stale.
+ * `run` is the launchctl/systemctl seam — tests pass a stub.
+ */
+export declare function installDaemonIfStale(opts: {
+    currentVersion: string;
+    platform?: DaemonInstallPlatform;
+    paths: InstallPaths;
+    systemUser?: string;
+    run?: RunCommand;
+    uid?: number;
+    writeFileSync?: typeof fs.writeFileSync;
+    mkdirSync?: typeof fs.mkdirSync;
+    reloadSystemd?: () => {
+        status: number | null;
+    };
+    schtasks?: SchtasksRunner;
+    kill?: (pid: number) => void;
+    runCommand?: (cmd: string, args: string[]) => {
+        status: number | null;
+        stdout: string;
+        stderr: string;
+    };
+    windowsLegacyTaskPresent?: boolean;
+}): InstallIfStaleResult;
 export declare function resolveNodeBinary(execPath?: string, env?: NodeJS.ProcessEnv): string;
 export declare function buildInstallPaths(opts: {
     home?: string;

package/dist/lib/mesh/live/daemon/install.js

@@ -15,11 +15,15 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
+import semver from "semver";
 import { resolveDaemonAssetDir } from "./log.js";
 import { LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, WINDOWS_TASK_NAME, daemonDir, daemonLogPath, daemonPidPath, } from "./paths.js";
 import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqRoot } from "./config.js";
 import { defaultPidLockDeps, pidLockStatus, readPidLock } from "./pid-lock.js";
 import { retireLegacyListen } from "./legacy-listen.js";
+import { readDaemonState } from "./state.js";
+import { activateLaunchd } from "../../../service-manager/launchd.js";
+import { activateSystemd } from "../../../service-manager/systemd.js";
 /**
  * `schtasks /End` terminates the task's root process only. The daemon is
  * launched through `conhost.exe --headless`, so ending the task kills conhost
@@ -212,6 +216,35 @@ export function preferStableHqBinary(entry) {
         return path.resolve(candidate);
     return entry;
 }
+/**
+ * Absolute path of the CLI entry that is executing this process.
+ * realpath of argv[1] only — never a PATH lookup of `hq`.
+ */
+export function resolveRunningCliEntry(argv = process.argv) {
+    const entry = argv[1];
+    if (!entry) {
+        throw new Error("Cannot resolve hq binary: process.argv[1] is empty");
+    }
+    try {
+        return fs.realpathSync(entry);
+    }
+    catch {
+        throw new Error(`Cannot resolve hq binary: ${entry} is not a real path`);
+    }
+}
+/** Absolute node binary (realpath of process.execPath). No PATH lookup. */
+export function resolveAbsoluteNodeBinary(execPath = process.execPath) {
+    if (!execPath)
+        throw new Error("Cannot resolve node binary: execPath is empty");
+    try {
+        return fs.realpathSync(execPath);
+    }
+    catch {
+        if (path.isAbsolute(execPath))
+            return execPath;
+        throw new Error(`Cannot resolve node binary: ${execPath} is not a real path`);
+    }
+}
 /** Resolve the hq binary the current shell uses (argv[1] or PATH). */
 export function resolveHqBinary(argv = process.argv, env = process.env) {
     const entry = argv[1];
@@ -230,6 +263,61 @@ export function resolveHqBinary(argv = process.argv, env = process.env) {
     }
     throw new Error("Cannot resolve hq binary for daemon install");
 }
+/** True when this CLI is newer than the version the daemon recorded, or nothing was recorded. */
+export function isNewerCliVersion(current, recorded) {
+    const recordedVersion = recorded?.trim() ?? "";
+    if (!recordedVersion)
+        return true;
+    if (semver.valid(current) && semver.valid(recordedVersion)) {
+        return semver.gt(current, recordedVersion);
+    }
+    return current !== recordedVersion;
+}
+/**
+ * Reinstall and restart the user daemon only when `currentVersion` is newer
+ * than daemon/state.json `cliVersion`. A missing record counts as stale.
+ * `run` is the launchctl/systemctl seam — tests pass a stub.
+ */
+export function installDaemonIfStale(opts) {
+    const recorded = readDaemonState(opts.paths.daemonDir)?.cliVersion;
+    if (!isNewerCliVersion(opts.currentVersion, recorded)) {
+        return {
+            reinstalled: false,
+            message: `daemon already records hq ${recorded}; not reinstalling`,
+        };
+    }
+    const run = opts.run ?? ((command, args) => {
+        const result = spawnSync(command, args, { encoding: "utf8" });
+        return {
+            status: result.status,
+            stdout: typeof result.stdout === "string" ? result.stdout : "",
+            stderr: typeof result.stderr === "string" ? result.stderr : "",
+        };
+    });
+    const platform = opts.platform ?? detectPlatform();
+    const installed = installDaemonService({
+        platform,
+        paths: opts.paths,
+        systemUser: opts.systemUser,
+        writeFileSync: opts.writeFileSync,
+        mkdirSync: opts.mkdirSync,
+        reloadSystemd: opts.reloadSystemd,
+        schtasks: opts.schtasks,
+        kill: opts.kill,
+        runCommand: opts.runCommand,
+        windowsLegacyTaskPresent: opts.windowsLegacyTaskPresent,
+    });
+    if (platform === "darwin") {
+        activateLaunchd(opts.paths.plistPath, run, opts.uid);
+    }
+    else if (platform === "linux" && !opts.systemUser && !opts.paths.systemUser) {
+        activateSystemd(SYSTEMD_UNIT_NAME, run);
+    }
+    return {
+        reinstalled: true,
+        message: `${installed.message} Restarted with ${opts.paths.nodeBinary} ${opts.paths.hqBinary}.`,
+    };
+}
 export function resolveNodeBinary(execPath = process.execPath, env = process.env) {
     if (execPath && fs.existsSync(execPath))
         return execPath;

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -103,6 +103,8 @@ export interface DaemonRunDeps {
     runForMs?: number;
     /** CLI version loaded by this daemon. Defaults to this package's version. */
     daemonVersion?: string;
+    /** realpath of the CLI entry. Defaults to process.argv[1]. */
+    cliEntry?: string;
     /**
      * Subscribe to the personal work topic and write live-cache.json.
      * The `hq mesh daemon run` command turns this on. Tests leave it off

package/dist/lib/mesh/live/daemon/run.js

@@ -36,6 +36,7 @@ import { workMeshHeldPath } from "../paths.js";
 import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
 import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
 import { hasCliVersionDrift, readInstalledCliVersion } from "./version-drift.js";
+import { resolveRunningCliEntry } from "./install.js";
 import { readDaemonConfig } from "./config.js";
 import { retireLegacyListen } from "./legacy-listen.js";
 import { startWorkCacheSubscriber } from "./work-subscribe.js";
@@ -140,7 +141,17 @@ export async function runMeshDaemon(deps = {}) {
     }
     writeDaemonState(dir, defaultDaemonState(lockDeps.pid, now));
     log(dir, `daemon started pid=${lockDeps.pid} mode=${mode}`);
-    patchDaemonState(dir, { emitMode: mode }, now);
+    let cliEntry = deps.cliEntry ?? "";
+    if (!cliEntry) {
+        try {
+            cliEntry = resolveRunningCliEntry();
+        }
+        catch {
+            cliEntry = process.argv[1] ?? "";
+        }
+    }
+    log(dir, `daemon version=${daemonVersion} entry=${cliEntry}`);
+    patchDaemonState(dir, { emitMode: mode, cliVersion: daemonVersion, cliEntry }, now);
     // Opt into machine-credential minting when the box has creds (systemd exports
     // HQ_MACHINE_CREDS_FILE). On a person laptop with no machine creds this falls
     // through to the person login cache inside ensureCognitoToken.

package/dist/lib/mesh/live/daemon/state.d.ts

@@ -31,6 +31,10 @@ export interface DaemonStateFile {
     deviceDefaultAuthorizationDenials?: number;
     /** Transient device-default membership refresh failures; the next cycle retries. */
     deviceDefaultMembershipLookupFailures?: number;
+    /** CLI version this daemon process was started with. */
+    cliVersion?: string;
+    /** realpath of the CLI entry this daemon process was started with. */
+    cliEntry?: string;
     updatedAt: string;
 }
 export declare function defaultDaemonState(pid: number, now?: () => Date): DaemonStateFile;

package/dist/lib/mesh/project-board.d.ts

@@ -1,4 +1,19 @@
 import { type MeshCompany, type MeshProjectRegistration, type MeshProjectRepo, type MeshProjectStoryInput, type MeshProjectView } from "./api.js";
+/**
+ * Add Board stories that a prd-sync emit is about to name, when they are missing.
+ * A missing view uses ensureProjectBoard. An existing view is merged so live
+ * status stays. Callers that must not block the emit should catch failures.
+ */
+export declare function ensureMissingBoardStories(input: {
+    token: string;
+    company: MeshCompany;
+    projectId: string;
+    name: string;
+    description?: string;
+    stories: MeshProjectStoryInput[];
+    repos?: MeshProjectRepo[];
+    requiredIds: readonly string[];
+}): Promise<void>;
 /**
  * POST /v1/work-mesh/projects/{id}/register always binds the server-derived
  * proj- thread (projectGenesisThreadId). It does not accept a client threadId.

package/dist/lib/mesh/project-board.js

@@ -1,4 +1,88 @@
 import { appendThreadEvent, ensureProjectThread, getProjectView, putProjectView, registerMeshProject, } from "./api.js";
+function httpStatus(err) {
+    if (err && typeof err === "object" && "status" in err && typeof err.status === "number") {
+        return err.status;
+    }
+    return undefined;
+}
+/** Same merge as `hq mesh project ensure`: add missing stories, keep live status. */
+function mergeProjectStories(current, planned) {
+    const currentById = new Map(current.map((story) => [story.id, story]));
+    const plannedIds = new Set(planned.map((story) => story.id));
+    const merged = planned.map((story) => {
+        const live = currentById.get(story.id);
+        if (!live)
+            return story;
+        const status = live.status || story.status;
+        return {
+            ...story,
+            ...(status ? { status } : {}),
+            passes: status === "done" ? true : typeof live.passes === "boolean" ? live.passes : story.passes,
+            ...(live.assigneeUid ? { assigneeUid: live.assigneeUid } : {}),
+        };
+    });
+    return [...merged, ...current.filter((story) => !plannedIds.has(story.id))];
+}
+function mergeProjectRepos(current, planned) {
+    const plannedPaths = new Set(planned.map((repo) => repo.path));
+    return [...planned, ...current.filter((repo) => !plannedPaths.has(repo.path))];
+}
+/**
+ * Add Board stories that a prd-sync emit is about to name, when they are missing.
+ * A missing view uses ensureProjectBoard. An existing view is merged so live
+ * status stays. Callers that must not block the emit should catch failures.
+ */
+export async function ensureMissingBoardStories(input) {
+    const required = new Set(input.requiredIds);
+    if (required.size === 0)
+        return;
+    let current;
+    try {
+        current = await getProjectView(input.token, input.company.companyUid, input.projectId);
+    }
+    catch (err) {
+        if (httpStatus(err) !== 404)
+            throw err;
+    }
+    if (!current) {
+        await ensureProjectBoard({
+            token: input.token,
+            company: input.company,
+            projectId: input.projectId,
+            name: input.name || input.projectId,
+            description: input.description ?? "",
+            stories: input.stories,
+            repos: input.repos ?? [],
+        });
+        return;
+    }
+    if ([...required].every((id) => current.stories.some((story) => story.id === id)))
+        return;
+    const genesis = await ensureProjectThread(input.token, input.company, input.projectId, {
+        summary: input.name || input.projectId,
+    });
+    if (!genesis.threadId)
+        throw new Error("Work mesh did not return a threadId.");
+    const stories = mergeProjectStories(current.stories, input.stories);
+    const repos = mergeProjectRepos(current.repos, input.repos ?? []);
+    const name = input.name || current.name;
+    const description = input.description !== undefined ? input.description : current.description;
+    await putProjectView(input.token, input.company.companyUid, input.projectId, {
+        name,
+        description,
+        stories,
+        repos,
+        ...(current.version !== undefined ? { expectedVersion: current.version } : {}),
+    });
+    const registration = await registerMeshProject(input.token, input.company.companyUid, input.projectId);
+    await closeSupersededProjectThread({
+        token: input.token,
+        companyUid: input.company.companyUid,
+        openedThreadId: genesis.threadId,
+        canonicalThreadId: registration.threadId,
+        created: genesis.created,
+    });
+}
 /**
  * POST /v1/work-mesh/projects/{id}/register always binds the server-derived
  * proj- thread (projectGenesisThreadId). It does not accept a client threadId.

package/dist/lib/work-context/prd-sync.d.ts

@@ -24,7 +24,11 @@ export interface PrdSyncPlan {
     /** Story most recently moved to in_progress, if any. */
     taskId?: string;
     seqStart: number;
-    commit: () => void;
+    /**
+     * Write the snapshot. With no argument, every planned story is recorded.
+     * With ids, only those stories advance; the rest stay changed for a retry.
+     */
+    commit: (acceptedTaskIds?: readonly string[]) => void;
 }
 export declare function planPrdSync(input: {
     sessionId: string;

package/dist/lib/work-context/prd-sync.js

@@ -114,7 +114,28 @@ export function planPrdSync(input) {
         events,
         ...(taskId ? { taskId } : {}),
         seqStart: previous?.seq ?? 0,
-        commit: () => writeSnapshot(input.sessionId, input.root, snapshot),
+        commit: (acceptedTaskIds) => {
+            if (!acceptedTaskIds) {
+                writeSnapshot(input.sessionId, input.root, snapshot);
+                return;
+            }
+            const accepted = new Set(acceptedTaskIds);
+            const stories = { ...(previous?.stories ?? {}) };
+            let advanced = 0;
+            for (const event of events) {
+                if (!accepted.has(event.taskId))
+                    continue;
+                const next = nextStories[event.taskId];
+                if (!next)
+                    continue;
+                stories[event.taskId] = next;
+                advanced += 1;
+            }
+            writeSnapshot(input.sessionId, input.root, {
+                stories,
+                seq: (previous?.seq ?? 0) + advanced,
+            });
+        },
     };
 }
 //# sourceMappingURL=prd-sync.js.map

package/dist/sentry.js

@@ -7,7 +7,7 @@ import { getCachedSentryUser } from "./utils/sentry-identity.js";
 import { isEpipe } from "./utils/epipe.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { incompleteInstallCaptureContext, incompleteInstallMessage, } from "./utils/incomplete-install-error.js";
-import { sentryFingerprintFor } from "./utils/sentry-fingerprint.js";
+import { sentryFingerprintFor, sentryMcpCollisionContextFor, } from "./utils/sentry-fingerprint.js";
 /**
  * Drop broken-pipe (EPIPE) crashes before scrubbing/send. A closed downstream
  * reader (`hq … | head`, `source <(hq …)`, a parent that exited) is normal
@@ -70,12 +70,20 @@ export function epipeAwareBeforeSend(event, hint) {
     // before the fleet scrubber — so it covers EVERY capture route (the top-level
     // boundary, the command-level captureException sites, bin/hq-auth-refresh,
     // any uncaughtException), mirroring the EPIPE and environmental-fs drops
-    // above. The classifier reads only a closed allowlist (never message/argv),
-    // and returns null for anything it cannot bound, in which case Sentry's
-    // default grouping is left untouched.
-    const fingerprint = sentryFingerprintFor(hint?.originalException);
-    if (fingerprint)
-        event.fingerprint = fingerprint;
+    // above. The typed error classifiers use closed allowlists. The Codex
+    // collision branch uses one fixed bucket and adds the validated server name
+    // only as a tag; it sends no config values or paths. Unclassifiable
+    // events retain Sentry's default grouping.
+    const mcpCollision = sentryMcpCollisionContextFor(hint?.originalException);
+    if (mcpCollision) {
+        event.tags = { ...event.tags, ...mcpCollision.tags };
+        event.fingerprint = mcpCollision.fingerprint;
+    }
+    else {
+        const fingerprint = sentryFingerprintFor(hint?.originalException);
+        if (fingerprint)
+            event.fingerprint = fingerprint;
+    }
     return beforeSend(event, hint);
 }
 /**

package/dist/utils/sentry-fingerprint.d.ts

@@ -1,3 +1,14 @@
+export interface SentryMcpCollisionContext {
+    tags: {
+        mcp_client: "codex";
+        server_name: string;
+        existing_entry_owner: "hq" | "foreign" | "unknown";
+        diff_fields: string;
+    };
+    fingerprint: string[];
+}
+/** Return bounded, value-free Sentry context for an instrumented Codex name collision. */
+export declare function sentryMcpCollisionContextFor(err: unknown): SentryMcpCollisionContext | null;
 /**
  * Return a bounded `event.fingerprint` array for `err`, or `null` when `err`
  * carries no discriminator from the closed allowlist (in which case the caller

package/dist/utils/sentry-fingerprint.js

@@ -1,8 +1,8 @@
 // src/utils/sentry-fingerprint.ts
 //
-// Compute a BOUNDED Sentry grouping fingerprint from an error, using only a
-// CLOSED allowlist of enumerable discriminators — never any upstream- or
-// user-minted text. Sibling in spirit to qmd-collection-missing-error.ts
+// Compute a BOUNDED Sentry grouping fingerprint from an error, using only
+// closed discriminators and a fixed Codex collision bucket, never arbitrary
+// upstream- or user-minted text. Sibling in spirit to qmd-collection-missing-error.ts
 // (HQ-CLI-S): the same unbounded-fingerprint discipline, applied to grouping
 // instead of to a printed line.
 //
@@ -45,14 +45,14 @@
 // grouping untouched.
 //
 // Two hard rules, mirroring HQ-CLI-S:
-//   1. CLOSED ALLOWLIST. The discriminator is one of a finite set of known
-//      JSON-RPC codes / HTTP statuses, or the literal `rpc:other` / `http:other`
-//      bucket. Total cardinality is therefore bounded — an over-wide key that
-//      minted a brand-new permanent issue per invocation is impossible.
-//   2. NO FREE TEXT. Only the error's `name` (a class identifier), a numeric
-//      `rpcCode`, and a numeric HTTP `status` are read. `message`, argv, URLs,
-//      connection ids, company slugs and any other upstream/user text can NEVER
-//      reach the fingerprint, so the key cannot be inflated by input.
+//   1. BOUNDED DISCRIMINATORS. RPC/HTTP values use closed allowlists and
+//      fallback buckets. Codex collisions use one fixed client bucket. The
+//      server-name tag is restricted to 64 lowercase letters, digits,
+//      underscores or hyphens; other names share one fallback value. Owner and
+//      field tags also use closed sets.
+//   2. NO FREE TEXT. Error messages, argv, URLs, connection ids, company slugs,
+//      config values and paths never reach a fingerprint or tags. The Codex
+//      branch uses a fixed fingerprint and bounded diagnostic tags.
 //
 // An error that carries no bounded discriminator returns `null`: the caller
 // leaves `event.fingerprint` unset and Sentry keeps its DEFAULT grouping, so the
@@ -79,6 +79,48 @@ const KNOWN_HTTP_STATUSES = new Set([
 ]);
 /** Sentry's placeholder for "keep the normal, stack-based grouping too". */
 const DEFAULT_GROUPING = "{{ default }}";
+const CODEX_COLLISION_NAME_RE = /^[a-z0-9_-]{1,64}$/;
+const CODEX_COLLISION_OWNERS = new Set(["hq", "foreign", "unknown"]);
+const CODEX_COLLISION_FIELDS = new Set(["command", "args", "env", "url", "other"]);
+function isCodexCollisionOwner(value) {
+    return typeof value === "string" && CODEX_COLLISION_OWNERS.has(value);
+}
+/** Return bounded, value-free Sentry context for an instrumented Codex name collision. */
+export function sentryMcpCollisionContextFor(err) {
+    if (err === null || typeof err !== "object")
+        return null;
+    const record = err;
+    if (record.name !== "McpNameCollisionError" || record.code !== "McpNameCollisionError") {
+        return null;
+    }
+    const diagnostics = record.codexDiagnostics;
+    if (diagnostics === null || typeof diagnostics !== "object")
+        return null;
+    const context = diagnostics;
+    const owner = context.existingEntryOwner;
+    if (context.client !== "codex" ||
+        typeof context.serverName !== "string" ||
+        !isCodexCollisionOwner(owner) ||
+        !Array.isArray(context.diffFields) ||
+        context.diffFields.length === 0 ||
+        context.diffFields.length > CODEX_COLLISION_FIELDS.size ||
+        !context.diffFields.every((field) => typeof field === "string" && CODEX_COLLISION_FIELDS.has(field))) {
+        return null;
+    }
+    const fields = [...new Set(context.diffFields)].sort();
+    const serverName = CODEX_COLLISION_NAME_RE.test(context.serverName)
+        ? context.serverName
+        : "other";
+    return {
+        tags: {
+            mcp_client: "codex",
+            server_name: serverName,
+            existing_entry_owner: owner,
+            diff_fields: fields.join(","),
+        },
+        fingerprint: ["mcp-name-collision", "codex"],
+    };
+}
 /**
  * The CLOSED set of error class names allowed to appear VERBATIM in a
  * fingerprint. This hook runs on every capture route and accepts `unknown`, so
@@ -216,6 +258,9 @@ export function sentryFingerprintFor(err) {
     const rawName = typeof record.name === "string" && record.name.length > 0 ? record.name : null;
     if (rawName === null)
         return null;
+    const mcpCollision = sentryMcpCollisionContextFor(record);
+    if (mcpCollision)
+        return mcpCollision.fingerprint;
     // qmd process failures carry a PROCESS EXIT CODE in `status` (never an HTTP
     // status) plus a subcommand in args[0]. Fingerprint them on a dedicated,
     // fully-bounded key BEFORE the HTTP-status branch so an exit code is never read

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.147.0",
-  "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
+  "version": "5.149.1",
+  "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
     "hq": "dist/index.js",
@@ -18,7 +18,8 @@
     "templates",
     "CHANGELOG.md",
     "README.md",
-    "contracts"
+    "contracts",
+    "scripts/mesh-daemon-if-stale.mjs"
   ],
   "scripts": {
     "build": "node scripts/generate-dsn.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs",
@@ -33,6 +34,7 @@
     "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
     "vitest": "vitest",
     "clean": "rm -rf dist",
+    "postinstall": "node scripts/mesh-daemon-if-stale.mjs || true",
     "prepare": "husky || true",
     "check:no-hermes": "bash scripts/check-no-hermes.sh"
   },

package/scripts/mesh-daemon-if-stale.mjs

@@ -0,0 +1,16 @@
+/**
+ * postinstall: point the mesh daemon at this install when it is newer.
+ * Best-effort. Never fails the package install. Tests do not run this.
+ */
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const cli = path.join(root, "dist", "index.js");
+if (!fs.existsSync(cli)) process.exit(0);
+spawnSync(process.execPath, [cli, "mesh", "daemon", "install", "--if-stale"], {
+  stdio: "inherit",
+});
+process.exit(0);