@indigoai-us/hq-cli 5.148.0 → 5.149.1

package/dist/lib/lanes/watcher.js

@@ -36,6 +36,7 @@ import * as path from "node:path";
 import { LanesError } from "./errors.js";
 import { raiseEnvelopeQuestions } from "./questions.js";
 import { isTerminalLaneState, parseLaneEnvelope, } from "./types.js";
+import { laneStories, storyStatusForEnvelope } from "./stories.js";
 import { readLane, retryUpdateLane } from "./store.js";
 import { readWorkerRunResult } from "./delivery.js";
 import { applyDefaultQuotaHold, quotaSignalFromFields, readQuotaSignal, recordAccountQuota, } from "./quota.js";
@@ -243,8 +244,15 @@ function runResultFields(hqRoot, lane) {
         fields.provider_session_id_absent = undefined;
     }
     else {
-        fields.provider_session_id = undefined;
-        fields.provider_session_id_absent = result.session_id_absent ?? "no_result_json";
+        // A resumed provider may exit before it emits a new result object. Keep
+        // the prior session id so the lane remains resumable; only describe an
+        // absent id when no earlier run recorded one.
+        if (lane.provider_session_id || lane.last_resume?.session_id) {
+            fields.provider_session_id_absent = undefined;
+        }
+        else {
+            fields.provider_session_id_absent = result.session_id_absent ?? "no_result_json";
+        }
     }
     return fields;
 }
@@ -337,17 +345,36 @@ export function applyTerminalToLaneWithResult(hqRoot, laneId, classification, op
         if (opts.providerRejection) {
             next.terminal_details = providerRejectionDetails(opts.providerRejection, current);
         }
-        if (opts.envelope && opts.envelopeRef) {
+        const envelope = opts.envelope;
+        if (envelope && opts.envelopeRef) {
             next.last_envelope = {
                 ref: opts.envelopeRef,
-                decision: opts.envelope.decision,
+                decision: envelope.decision,
                 at,
             };
-            next.story_status = opts.envelope.story_status;
-            if (opts.envelope.story_complete !== undefined) {
-                next.story_complete = opts.envelope.story_complete;
-                next.story_complete_reason = opts.envelope.story_complete_reason;
+            next.story_status = envelope.story_status;
+            if (envelope.story_complete !== undefined) {
+                next.story_complete = envelope.story_complete;
+                next.story_complete_reason = envelope.story_complete_reason;
             }
+            const currentProject = current.project_id;
+            const currentStory = current.story_id;
+            const storyStatus = envelope.decision === "blocked"
+                ? "blocked"
+                : envelope.decision === "done"
+                    ? "review"
+                    : storyStatusForEnvelope(envelope.story_status);
+            const updatedStories = laneStories(current).map((story) => story.project_id === currentProject && story.story_id === currentStory
+                ? {
+                    ...story,
+                    status: storyStatus,
+                    updated_at: at,
+                    ...(envelope.decision === "blocked"
+                        ? { blocked_reason: envelope.blocked_reason ?? "" }
+                        : { blocked_reason: undefined }),
+                }
+                : story);
+            next.stories = updatedStories;
         }
         return next;
     });
@@ -550,9 +577,42 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
     const progressFiles = [...logFiles, ...activityFiles];
     // Mesh seam (spec §8). Non-interactive: nobody is at this process's tty.
     const mesh = deps.mesh === undefined ? createLaneMesh({ interactive: false }) : deps.mesh;
+    const meshRequestTimeoutMs = deps.meshRequestTimeoutMs ?? 10_000;
+    const initialLane = readLaneSoft(hqRoot, laneId);
+    if (mesh && initialLane) {
+        // Explicit mesh attribution is the repair signal. Ordinary company lanes
+        // already receive their thread during create; legacy records without one
+        // stay quiet until an operator or the owning flow repairs them.
+        const company = initialLane.mesh_company;
+        if (company && !initialLane.thread_id) {
+            let timer;
+            try {
+                const threadId = await Promise.race([
+                    mesh.ensureProjectThread(company, initialLane.project_id),
+                    new Promise((_resolve, reject) => {
+                        timer = setTimeout(() => reject(new Error(`mesh thread ensure timed out after ${meshRequestTimeoutMs}ms`)), meshRequestTimeoutMs);
+                    }),
+                ]);
+                retryUpdateLane(hqRoot, laneId, "spawn", (current) => current.thread_id ? current : { ...current, thread_id: threadId });
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                process.stderr.write(`hq lanes watcher: mesh thread ensure failed for ${laneId}: ${message}\n`);
+                writeWatcherDecision(outPath, {
+                    event: "mesh_event_failed",
+                    at: new Date(now()).toISOString(),
+                    mesh_event: "ensure_project_thread",
+                    error: message,
+                }, outMax);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        }
+    }
     const progressIntervalMs = deps.progressEventMinIntervalMs ?? readProgressIntervalMs(hqRoot, readLaneSoft(hqRoot, laneId));
     const spawnRepair = deps.spawnRepair ?? spawnEnvelopeRepair;
-    const meshRequestTimeoutMs = deps.meshRequestTimeoutMs ?? 10_000;
     let lastSignalMs = now();
     let lastSeenMtime = 0;
     let lastAlive = null;

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -57,6 +57,15 @@ export interface DaemonDoctorReport {
     deviceDefaultAuthorizationDenials: number;
     /** True when the pack-era listen unit is still on disk. */
     legacyListenerInstalled: boolean;
+    /** One line when the running daemon's recorded CLI is not this CLI. */
+    cliMismatchLine?: string;
+    /** Every `hq` executable found on PATH, with the package version behind it. */
+    hqOnPath: Array<{
+        path: string;
+        version: string | null;
+    }>;
+    /** True when PATH lists more than one hq. */
+    multipleHqOnPath: boolean;
 }
 export interface DaemonDoctorDeps {
     home?: string;
@@ -70,7 +79,25 @@ export interface DaemonDoctorDeps {
     /** Override the legacy-listen probe (tests). */
     legacyListenerInstalled?: boolean;
     platform?: LegacyListenPlatform;
+    /** This process's CLI version. Defaults to the package version. */
+    cliVersion?: string;
+    /** This process's CLI entry. Defaults to realpath of argv[1]. */
+    cliEntry?: string;
+    /** PATH used to list hq binaries. Defaults to the process PATH. */
+    pathEnv?: string;
 }
+/** Every hq named on PATH. Does not pick one; the caller prints all of them. */
+export declare function listHqBinariesOnPath(env?: NodeJS.ProcessEnv): Array<{
+    path: string;
+    version: string | null;
+}>;
+export declare function formatCliMismatchLine(input: {
+    recordedVersion?: string | null;
+    recordedEntry?: string | null;
+    currentVersion: string;
+    currentEntry: string;
+}): string | undefined;
+export declare function formatCliIdentityLines(report: Pick<DaemonDoctorReport, "cliMismatchLine" | "hqOnPath" | "multipleHqOnPath">): string[];
 export declare function collectDaemonDoctor(deps?: DaemonDoctorDeps): DaemonDoctorReport;
 export declare function formatDaemonDoctor(report: DaemonDoctorReport): string[];
 //# sourceMappingURL=doctor.d.ts.map

package/dist/lib/mesh/live/daemon/doctor.js

@@ -19,6 +19,9 @@ import { hasCurrentAcknowledgedRegistration, readHeldSessions, refWithLocalCompa
 import { readDaemonConfig } from "./config.js";
 import { pidLockStatus, readPidLock } from "./pid-lock.js";
 import { readDaemonState } from "./state.js";
+import { CLI_VERSION } from "../../../../cli-version.js";
+import { resolveRunningCliEntry } from "./install.js";
+import { readInstalledCliVersion } from "./version-drift.js";
 import { LEGACY_LISTENER_DOCTOR_LINE, legacyListenInstalled, } from "./legacy-listen.js";
 export const UNHEALTHY_SPOOL_AGE_MS = 60_000;
 function oldestJsonlAgeMs(filePath, nowMs) {
@@ -55,6 +58,65 @@ function oldestJsonlAgeMs(filePath, nowMs) {
         return undefined;
     }
 }
+function samePath(a, b) {
+    const left = tryRealpath(a);
+    const right = tryRealpath(b);
+    return left === right;
+}
+function tryRealpath(value) {
+    try {
+        return fs.realpathSync(value);
+    }
+    catch {
+        return path.resolve(value);
+    }
+}
+/** Every hq named on PATH. Does not pick one; the caller prints all of them. */
+export function listHqBinariesOnPath(env = process.env) {
+    const found = [];
+    const pathEnv = env.PATH ?? "";
+    const names = process.platform === "win32" ? ["hq.cmd", "hq.exe", "hq"] : ["hq"];
+    for (const dir of pathEnv.split(path.delimiter)) {
+        if (!dir)
+            continue;
+        for (const name of names) {
+            const candidate = path.join(dir, name);
+            if (!fs.existsSync(candidate))
+                continue;
+            found.push({
+                path: tryRealpath(candidate),
+                version: readInstalledCliVersion(candidate),
+            });
+        }
+    }
+    return found;
+}
+export function formatCliMismatchLine(input) {
+    const recordedVersion = input.recordedVersion?.trim() || "";
+    const recordedEntry = input.recordedEntry?.trim() || "";
+    const versionMatches = recordedVersion !== "" && recordedVersion === input.currentVersion;
+    const entryMatches = recordedEntry !== "" &&
+        input.currentEntry !== "" &&
+        samePath(recordedEntry, input.currentEntry);
+    if (versionMatches && entryMatches)
+        return undefined;
+    const recordedLabel = recordedVersion || "(none)";
+    const recordedAt = recordedEntry || "(none)";
+    const currentAt = input.currentEntry || "(none)";
+    return (`daemon hq ${recordedLabel} at ${recordedAt} does not match this CLI ` +
+        `${input.currentVersion} at ${currentAt}. Run hq mesh daemon install to repoint it.`);
+}
+export function formatCliIdentityLines(report) {
+    const lines = [];
+    if (report.cliMismatchLine)
+        lines.push(report.cliMismatchLine);
+    for (const hit of report.hqOnPath) {
+        lines.push(`hq on PATH: ${hit.path} (${hit.version ?? "unknown"})`);
+    }
+    if (report.multipleHqOnPath)
+        lines.push("more than one hq is on PATH");
+    return lines;
+}
 function countDeviceDefaultAttribution(root) {
     try {
         return fs.readdirSync(path.join(root, "sessions")).filter((entry) => {
@@ -93,6 +155,24 @@ export function collectDaemonDoctor(deps = {}) {
     const record = readPidLock(lockPath);
     const running = lock === "held";
     const state = readDaemonState(dir);
+    let currentEntry = deps.cliEntry ?? "";
+    if (!deps.cliEntry) {
+        try {
+            currentEntry = resolveRunningCliEntry();
+        }
+        catch {
+            currentEntry = "";
+        }
+    }
+    const currentVersion = deps.cliVersion ?? CLI_VERSION;
+    const pathEnv = deps.pathEnv ?? env.PATH ?? "";
+    const hqOnPath = listHqBinariesOnPath({ ...env, PATH: pathEnv });
+    const cliMismatchLine = formatCliMismatchLine({
+        recordedVersion: state?.cliVersion,
+        recordedEntry: state?.cliEntry,
+        currentVersion,
+        currentEntry,
+    });
     const spoolPath = workMeshSpoolPath(meshRoot);
     const heldPath = workMeshHeldPath(meshRoot);
     const deadPath = workMeshDeadLetterPath(meshRoot);
@@ -203,6 +283,9 @@ export function collectDaemonDoctor(deps = {}) {
             : undefined,
         deviceDefaultAuthorizationDenials,
         legacyListenerInstalled: legacyListener,
+        cliMismatchLine,
+        hqOnPath,
+        multipleHqOnPath: hqOnPath.length > 1,
     };
 }
 export function formatDaemonDoctor(report) {
@@ -253,6 +336,7 @@ export function formatDaemonDoctor(report) {
     else {
         lines.push(`health: ok`);
     }
+    lines.push(...formatCliIdentityLines(report));
     return lines;
 }
 //# sourceMappingURL=doctor.js.map

package/dist/lib/mesh/live/daemon/index.d.ts

@@ -12,12 +12,12 @@ export type { DaemonStateFile, PresenceRefusalState } from "./state.js";
 export { appendDaemonLog, daemonLogLine, ensureDaemonLog, resolveDaemonAssetDir, rotateDaemonLogIfNeeded, } from "./log.js";
 export { BOARD_REFRESH_INTERVAL_MS, createVaultBoardReader, formatBoardMarkdown, refreshBoundSessionBoards, writeBoardMarkdown, } from "./board-refresh.js";
 export type { BoardReader, BoardRefreshDeps, BoardStorySnapshot } from "./board-refresh.js";
-export { buildInstallPaths, daemonServiceStatus, detectPlatform, installDaemonService, readAssetTemplate, restartDaemonServiceIfInstalled, renderLaunchdPlist, renderSystemdSystemUnit, renderSystemdUserUnit, resolveHqBinary, resolveNodeBinary, parseSchtasksLastResult, parseWindowsTaskHqRoot, readRecordedWindowsHqRoot, schtasksLastResultFailed, uninstallDaemonService, windowsLaunchMode, windowsLogonNotice, } from "./install.js";
-export type { DaemonInstallPlatform, InstallPaths, InstallResult, } from "./install.js";
+export { buildInstallPaths, daemonServiceStatus, detectPlatform, installDaemonIfStale, installDaemonService, isNewerCliVersion, readAssetTemplate, restartDaemonServiceIfInstalled, renderLaunchdPlist, renderSystemdSystemUnit, renderSystemdUserUnit, resolveAbsoluteNodeBinary, resolveHqBinary, resolveNodeBinary, resolveRunningCliEntry, parseSchtasksLastResult, parseWindowsTaskHqRoot, readRecordedWindowsHqRoot, schtasksLastResultFailed, uninstallDaemonService, windowsLaunchMode, windowsLogonNotice, } from "./install.js";
+export type { DaemonInstallPlatform, InstallIfStaleResult, InstallPaths, InstallResult, } from "./install.js";
 export { daemonConfigPath, findAncestorHqRoot, isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, resolveInstallHqRoot, verifyHqRoot, } from "./config.js";
 export type { InstallHqRootResolution } from "./config.js";
 export type { DaemonConfig } from "./config.js";
-export { UNHEALTHY_SPOOL_AGE_MS, collectDaemonDoctor, formatDaemonDoctor, } from "./doctor.js";
+export { UNHEALTHY_SPOOL_AGE_MS, collectDaemonDoctor, formatCliIdentityLines, formatCliMismatchLine, formatDaemonDoctor, listHqBinariesOnPath, } from "./doctor.js";
 export type { DaemonDoctorDeps, DaemonDoctorReport } from "./doctor.js";
 export { scopeBundleToAgentIdentity, } from "./credentials.js";
 export { FLUSH_INTERVAL_MS, DAEMON_VERSION_DRIFT_EXIT_CODE, SPOOL_DEBOUNCE_MS, runMeshDaemon, } from "./run.js";

package/dist/lib/mesh/live/daemon/index.js

@@ -6,9 +6,9 @@ export { CLOSE_LOG_ALWAYS_COUNT, CLOSE_LOG_INTERVAL_MS, CONNECT_STABLE_GRACE_MS,
 export { defaultDaemonState, patchDaemonState, readDaemonState, writeDaemonState, } from "./state.js";
 export { appendDaemonLog, daemonLogLine, ensureDaemonLog, resolveDaemonAssetDir, rotateDaemonLogIfNeeded, } from "./log.js";
 export { BOARD_REFRESH_INTERVAL_MS, createVaultBoardReader, formatBoardMarkdown, refreshBoundSessionBoards, writeBoardMarkdown, } from "./board-refresh.js";
-export { buildInstallPaths, daemonServiceStatus, detectPlatform, installDaemonService, readAssetTemplate, restartDaemonServiceIfInstalled, renderLaunchdPlist, renderSystemdSystemUnit, renderSystemdUserUnit, resolveHqBinary, resolveNodeBinary, parseSchtasksLastResult, parseWindowsTaskHqRoot, readRecordedWindowsHqRoot, schtasksLastResultFailed, uninstallDaemonService, windowsLaunchMode, windowsLogonNotice, } from "./install.js";
+export { buildInstallPaths, daemonServiceStatus, detectPlatform, installDaemonIfStale, installDaemonService, isNewerCliVersion, readAssetTemplate, restartDaemonServiceIfInstalled, renderLaunchdPlist, renderSystemdSystemUnit, renderSystemdUserUnit, resolveAbsoluteNodeBinary, resolveHqBinary, resolveNodeBinary, resolveRunningCliEntry, parseSchtasksLastResult, parseWindowsTaskHqRoot, readRecordedWindowsHqRoot, schtasksLastResultFailed, uninstallDaemonService, windowsLaunchMode, windowsLogonNotice, } from "./install.js";
 export { daemonConfigPath, findAncestorHqRoot, isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, resolveInstallHqRoot, verifyHqRoot, } from "./config.js";
-export { UNHEALTHY_SPOOL_AGE_MS, collectDaemonDoctor, formatDaemonDoctor, } from "./doctor.js";
+export { UNHEALTHY_SPOOL_AGE_MS, collectDaemonDoctor, formatCliIdentityLines, formatCliMismatchLine, formatDaemonDoctor, listHqBinariesOnPath, } from "./doctor.js";
 export { scopeBundleToAgentIdentity, } from "./credentials.js";
 export { FLUSH_INTERVAL_MS, DAEMON_VERSION_DRIFT_EXIT_CODE, SPOOL_DEBOUNCE_MS, runMeshDaemon, } from "./run.js";
 export { TRANSCRIPT_ADAPTER_VERSION, TRANSCRIPT_EVENT_SOURCE, TRANSCRIPT_FRESH_MS, TRANSCRIPT_HOOK_COVER_MS, TRANSCRIPT_MARKER, TRANSCRIPT_SESSION_END_MS, TRANSCRIPT_TURN_QUIET_MS, TRANSCRIPT_WATCH_BACKOFF_DURATION_MS, TRANSCRIPT_WATCH_BACKOFF_ENTRIES, TRANSCRIPT_WATCH_ENTRY_CAP, TRANSCRIPT_WATCH_INTERVAL_MAX_MS, TRANSCRIPT_WATCH_INTERVAL_MS, TRANSCRIPT_WATCH_REVALIDATE_MS, TranscriptWatcher, createTranscriptDiscoverCache, decodeClaudeProjectDirName, defaultTranscriptFs, discoverTranscripts, discoverTranscriptsWithMeta, isTranscriptHookCovered, nextTranscriptWatchIntervalMs, noteHookSessionsFromSpoolFile, resolveTranscriptRegistration, sessionIdFromClaudeTranscriptPath, sessionIdFromCodexTranscriptPath, sortDiscoveries, } from "./transcript-watch.js";

package/dist/lib/mesh/live/daemon/install.d.ts

@@ -12,6 +12,7 @@
  * Tests must not actually install services — use a temp HOME/prefix.
  */
 import * as fs from "node:fs";
+import { type RunCommand } from "../../../service-manager/launchd.js";
 export type DaemonInstallPlatform = "darwin" | "linux" | "win32" | "other";
 /** Result of one schtasks.exe invocation (tests inject; never the real binary). */
 export interface SchtasksResult {
@@ -121,8 +122,47 @@ export declare function detectPlatform(platform?: NodeJS.Platform): DaemonInstal
  * binary when both exist.
  */
 export declare function preferStableHqBinary(entry: string): string;
+/**
+ * Absolute path of the CLI entry that is executing this process.
+ * realpath of argv[1] only — never a PATH lookup of `hq`.
+ */
+export declare function resolveRunningCliEntry(argv?: string[]): string;
+/** Absolute node binary (realpath of process.execPath). No PATH lookup. */
+export declare function resolveAbsoluteNodeBinary(execPath?: string): string;
 /** Resolve the hq binary the current shell uses (argv[1] or PATH). */
 export declare function resolveHqBinary(argv?: string[], env?: NodeJS.ProcessEnv): string;
+/** True when this CLI is newer than the version the daemon recorded, or nothing was recorded. */
+export declare function isNewerCliVersion(current: string, recorded: string | null | undefined): boolean;
+export interface InstallIfStaleResult {
+    reinstalled: boolean;
+    message: string;
+}
+/**
+ * Reinstall and restart the user daemon only when `currentVersion` is newer
+ * than daemon/state.json `cliVersion`. A missing record counts as stale.
+ * `run` is the launchctl/systemctl seam — tests pass a stub.
+ */
+export declare function installDaemonIfStale(opts: {
+    currentVersion: string;
+    platform?: DaemonInstallPlatform;
+    paths: InstallPaths;
+    systemUser?: string;
+    run?: RunCommand;
+    uid?: number;
+    writeFileSync?: typeof fs.writeFileSync;
+    mkdirSync?: typeof fs.mkdirSync;
+    reloadSystemd?: () => {
+        status: number | null;
+    };
+    schtasks?: SchtasksRunner;
+    kill?: (pid: number) => void;
+    runCommand?: (cmd: string, args: string[]) => {
+        status: number | null;
+        stdout: string;
+        stderr: string;
+    };
+    windowsLegacyTaskPresent?: boolean;
+}): InstallIfStaleResult;
 export declare function resolveNodeBinary(execPath?: string, env?: NodeJS.ProcessEnv): string;
 export declare function buildInstallPaths(opts: {
     home?: string;

package/dist/lib/mesh/live/daemon/install.js

@@ -15,11 +15,15 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
+import semver from "semver";
 import { resolveDaemonAssetDir } from "./log.js";
 import { LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, WINDOWS_TASK_NAME, daemonDir, daemonLogPath, daemonPidPath, } from "./paths.js";
 import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqRoot } from "./config.js";
 import { defaultPidLockDeps, pidLockStatus, readPidLock } from "./pid-lock.js";
 import { retireLegacyListen } from "./legacy-listen.js";
+import { readDaemonState } from "./state.js";
+import { activateLaunchd } from "../../../service-manager/launchd.js";
+import { activateSystemd } from "../../../service-manager/systemd.js";
 /**
  * `schtasks /End` terminates the task's root process only. The daemon is
  * launched through `conhost.exe --headless`, so ending the task kills conhost
@@ -212,6 +216,35 @@ export function preferStableHqBinary(entry) {
         return path.resolve(candidate);
     return entry;
 }
+/**
+ * Absolute path of the CLI entry that is executing this process.
+ * realpath of argv[1] only — never a PATH lookup of `hq`.
+ */
+export function resolveRunningCliEntry(argv = process.argv) {
+    const entry = argv[1];
+    if (!entry) {
+        throw new Error("Cannot resolve hq binary: process.argv[1] is empty");
+    }
+    try {
+        return fs.realpathSync(entry);
+    }
+    catch {
+        throw new Error(`Cannot resolve hq binary: ${entry} is not a real path`);
+    }
+}
+/** Absolute node binary (realpath of process.execPath). No PATH lookup. */
+export function resolveAbsoluteNodeBinary(execPath = process.execPath) {
+    if (!execPath)
+        throw new Error("Cannot resolve node binary: execPath is empty");
+    try {
+        return fs.realpathSync(execPath);
+    }
+    catch {
+        if (path.isAbsolute(execPath))
+            return execPath;
+        throw new Error(`Cannot resolve node binary: ${execPath} is not a real path`);
+    }
+}
 /** Resolve the hq binary the current shell uses (argv[1] or PATH). */
 export function resolveHqBinary(argv = process.argv, env = process.env) {
     const entry = argv[1];
@@ -230,6 +263,61 @@ export function resolveHqBinary(argv = process.argv, env = process.env) {
     }
     throw new Error("Cannot resolve hq binary for daemon install");
 }
+/** True when this CLI is newer than the version the daemon recorded, or nothing was recorded. */
+export function isNewerCliVersion(current, recorded) {
+    const recordedVersion = recorded?.trim() ?? "";
+    if (!recordedVersion)
+        return true;
+    if (semver.valid(current) && semver.valid(recordedVersion)) {
+        return semver.gt(current, recordedVersion);
+    }
+    return current !== recordedVersion;
+}
+/**
+ * Reinstall and restart the user daemon only when `currentVersion` is newer
+ * than daemon/state.json `cliVersion`. A missing record counts as stale.
+ * `run` is the launchctl/systemctl seam — tests pass a stub.
+ */
+export function installDaemonIfStale(opts) {
+    const recorded = readDaemonState(opts.paths.daemonDir)?.cliVersion;
+    if (!isNewerCliVersion(opts.currentVersion, recorded)) {
+        return {
+            reinstalled: false,
+            message: `daemon already records hq ${recorded}; not reinstalling`,
+        };
+    }
+    const run = opts.run ?? ((command, args) => {
+        const result = spawnSync(command, args, { encoding: "utf8" });
+        return {
+            status: result.status,
+            stdout: typeof result.stdout === "string" ? result.stdout : "",
+            stderr: typeof result.stderr === "string" ? result.stderr : "",
+        };
+    });
+    const platform = opts.platform ?? detectPlatform();
+    const installed = installDaemonService({
+        platform,
+        paths: opts.paths,
+        systemUser: opts.systemUser,
+        writeFileSync: opts.writeFileSync,
+        mkdirSync: opts.mkdirSync,
+        reloadSystemd: opts.reloadSystemd,
+        schtasks: opts.schtasks,
+        kill: opts.kill,
+        runCommand: opts.runCommand,
+        windowsLegacyTaskPresent: opts.windowsLegacyTaskPresent,
+    });
+    if (platform === "darwin") {
+        activateLaunchd(opts.paths.plistPath, run, opts.uid);
+    }
+    else if (platform === "linux" && !opts.systemUser && !opts.paths.systemUser) {
+        activateSystemd(SYSTEMD_UNIT_NAME, run);
+    }
+    return {
+        reinstalled: true,
+        message: `${installed.message} Restarted with ${opts.paths.nodeBinary} ${opts.paths.hqBinary}.`,
+    };
+}
 export function resolveNodeBinary(execPath = process.execPath, env = process.env) {
     if (execPath && fs.existsSync(execPath))
         return execPath;

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -103,6 +103,8 @@ export interface DaemonRunDeps {
     runForMs?: number;
     /** CLI version loaded by this daemon. Defaults to this package's version. */
     daemonVersion?: string;
+    /** realpath of the CLI entry. Defaults to process.argv[1]. */
+    cliEntry?: string;
     /**
      * Subscribe to the personal work topic and write live-cache.json.
      * The `hq mesh daemon run` command turns this on. Tests leave it off

package/dist/lib/mesh/live/daemon/run.js

@@ -36,6 +36,7 @@ import { workMeshHeldPath } from "../paths.js";
 import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
 import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
 import { hasCliVersionDrift, readInstalledCliVersion } from "./version-drift.js";
+import { resolveRunningCliEntry } from "./install.js";
 import { readDaemonConfig } from "./config.js";
 import { retireLegacyListen } from "./legacy-listen.js";
 import { startWorkCacheSubscriber } from "./work-subscribe.js";
@@ -140,7 +141,17 @@ export async function runMeshDaemon(deps = {}) {
     }
     writeDaemonState(dir, defaultDaemonState(lockDeps.pid, now));
     log(dir, `daemon started pid=${lockDeps.pid} mode=${mode}`);
-    patchDaemonState(dir, { emitMode: mode }, now);
+    let cliEntry = deps.cliEntry ?? "";
+    if (!cliEntry) {
+        try {
+            cliEntry = resolveRunningCliEntry();
+        }
+        catch {
+            cliEntry = process.argv[1] ?? "";
+        }
+    }
+    log(dir, `daemon version=${daemonVersion} entry=${cliEntry}`);
+    patchDaemonState(dir, { emitMode: mode, cliVersion: daemonVersion, cliEntry }, now);
     // Opt into machine-credential minting when the box has creds (systemd exports
     // HQ_MACHINE_CREDS_FILE). On a person laptop with no machine creds this falls
     // through to the person login cache inside ensureCognitoToken.

package/dist/lib/mesh/live/daemon/state.d.ts

@@ -31,6 +31,10 @@ export interface DaemonStateFile {
     deviceDefaultAuthorizationDenials?: number;
     /** Transient device-default membership refresh failures; the next cycle retries. */
     deviceDefaultMembershipLookupFailures?: number;
+    /** CLI version this daemon process was started with. */
+    cliVersion?: string;
+    /** realpath of the CLI entry this daemon process was started with. */
+    cliEntry?: string;
     updatedAt: string;
 }
 export declare function defaultDaemonState(pid: number, now?: () => Date): DaemonStateFile;

package/dist/lib/mesh/project-board.d.ts

@@ -1,4 +1,19 @@
 import { type MeshCompany, type MeshProjectRegistration, type MeshProjectRepo, type MeshProjectStoryInput, type MeshProjectView } from "./api.js";
+/**
+ * Add Board stories that a prd-sync emit is about to name, when they are missing.
+ * A missing view uses ensureProjectBoard. An existing view is merged so live
+ * status stays. Callers that must not block the emit should catch failures.
+ */
+export declare function ensureMissingBoardStories(input: {
+    token: string;
+    company: MeshCompany;
+    projectId: string;
+    name: string;
+    description?: string;
+    stories: MeshProjectStoryInput[];
+    repos?: MeshProjectRepo[];
+    requiredIds: readonly string[];
+}): Promise<void>;
 /**
  * POST /v1/work-mesh/projects/{id}/register always binds the server-derived
  * proj- thread (projectGenesisThreadId). It does not accept a client threadId.

package/dist/lib/mesh/project-board.js

@@ -1,4 +1,88 @@
 import { appendThreadEvent, ensureProjectThread, getProjectView, putProjectView, registerMeshProject, } from "./api.js";
+function httpStatus(err) {
+    if (err && typeof err === "object" && "status" in err && typeof err.status === "number") {
+        return err.status;
+    }
+    return undefined;
+}
+/** Same merge as `hq mesh project ensure`: add missing stories, keep live status. */
+function mergeProjectStories(current, planned) {
+    const currentById = new Map(current.map((story) => [story.id, story]));
+    const plannedIds = new Set(planned.map((story) => story.id));
+    const merged = planned.map((story) => {
+        const live = currentById.get(story.id);
+        if (!live)
+            return story;
+        const status = live.status || story.status;
+        return {
+            ...story,
+            ...(status ? { status } : {}),
+            passes: status === "done" ? true : typeof live.passes === "boolean" ? live.passes : story.passes,
+            ...(live.assigneeUid ? { assigneeUid: live.assigneeUid } : {}),
+        };
+    });
+    return [...merged, ...current.filter((story) => !plannedIds.has(story.id))];
+}
+function mergeProjectRepos(current, planned) {
+    const plannedPaths = new Set(planned.map((repo) => repo.path));
+    return [...planned, ...current.filter((repo) => !plannedPaths.has(repo.path))];
+}
+/**
+ * Add Board stories that a prd-sync emit is about to name, when they are missing.
+ * A missing view uses ensureProjectBoard. An existing view is merged so live
+ * status stays. Callers that must not block the emit should catch failures.
+ */
+export async function ensureMissingBoardStories(input) {
+    const required = new Set(input.requiredIds);
+    if (required.size === 0)
+        return;
+    let current;
+    try {
+        current = await getProjectView(input.token, input.company.companyUid, input.projectId);
+    }
+    catch (err) {
+        if (httpStatus(err) !== 404)
+            throw err;
+    }
+    if (!current) {
+        await ensureProjectBoard({
+            token: input.token,
+            company: input.company,
+            projectId: input.projectId,
+            name: input.name || input.projectId,
+            description: input.description ?? "",
+            stories: input.stories,
+            repos: input.repos ?? [],
+        });
+        return;
+    }
+    if ([...required].every((id) => current.stories.some((story) => story.id === id)))
+        return;
+    const genesis = await ensureProjectThread(input.token, input.company, input.projectId, {
+        summary: input.name || input.projectId,
+    });
+    if (!genesis.threadId)
+        throw new Error("Work mesh did not return a threadId.");
+    const stories = mergeProjectStories(current.stories, input.stories);
+    const repos = mergeProjectRepos(current.repos, input.repos ?? []);
+    const name = input.name || current.name;
+    const description = input.description !== undefined ? input.description : current.description;
+    await putProjectView(input.token, input.company.companyUid, input.projectId, {
+        name,
+        description,
+        stories,
+        repos,
+        ...(current.version !== undefined ? { expectedVersion: current.version } : {}),
+    });
+    const registration = await registerMeshProject(input.token, input.company.companyUid, input.projectId);
+    await closeSupersededProjectThread({
+        token: input.token,
+        companyUid: input.company.companyUid,
+        openedThreadId: genesis.threadId,
+        canonicalThreadId: registration.threadId,
+        created: genesis.created,
+    });
+}
 /**
  * POST /v1/work-mesh/projects/{id}/register always binds the server-derived
  * proj- thread (projectGenesisThreadId). It does not accept a client threadId.

package/dist/lib/work-context/prd-sync.d.ts

@@ -24,7 +24,11 @@ export interface PrdSyncPlan {
     /** Story most recently moved to in_progress, if any. */
     taskId?: string;
     seqStart: number;
-    commit: () => void;
+    /**
+     * Write the snapshot. With no argument, every planned story is recorded.
+     * With ids, only those stories advance; the rest stay changed for a retry.
+     */
+    commit: (acceptedTaskIds?: readonly string[]) => void;
 }
 export declare function planPrdSync(input: {
     sessionId: string;