@indigoai-us/hq-cli 5.162.0 → 5.163.0

package/dist/lib/daemon/lock.d.ts

@@ -0,0 +1,47 @@
+/**
+ * One `hq daemon run` per user per machine: a pid file created with `wx`,
+ * taken over only when the recorded process is gone. Same file format as the
+ * mesh daemon's lock (`pid=<n>\nts=<unix seconds>`).
+ *
+ * Replacing a stale lock is guarded by a short-lived `<lock>.takeover` claim,
+ * so two starters that both saw the same stale owner cannot both win. A claim
+ * left behind by a starter that died mid-takeover expires after
+ * TAKEOVER_TTL_MS.
+ */
+import { type PidLockRecord } from "../mesh/live/daemon/pid-lock.js";
+import type { RunCommand } from "../service-manager/launchd.js";
+export declare const TAKEOVER_TTL_MS = 30000;
+type Kill = (pid: number, signal: 0) => unknown;
+/**
+ * The process exists and this user can signal it. EPERM means it belongs to
+ * another user, so it cannot be this user's daemon.
+ */
+export declare function isProcessAlive(pid: number, kill?: Kill): boolean;
+export interface CommandLineDeps {
+    platform: NodeJS.Platform;
+    run: RunCommand;
+}
+/** The process's command line, or null when it cannot be read. */
+export declare function processCommandLine(pid: number, deps?: CommandLineDeps): string | null;
+export interface DaemonProcessDeps {
+    alive: (pid: number) => boolean;
+    commandLine: (pid: number) => string | null;
+}
+/**
+ * The pid is alive and is an `hq daemon run`. After a reboot the pid in an old
+ * lock file often belongs to an unrelated program; that must not keep the
+ * daemon from starting.
+ */
+export declare function isDaemonProcess(pid: number, deps?: DaemonProcessDeps): boolean;
+export type DaemonLockResult = {
+    ok: true;
+} | {
+    ok: false;
+    owner: PidLockRecord | null;
+};
+export declare function acquireDaemonLock(lockPath: string, pid?: number, alive?: (pid: number) => boolean, now?: () => number): DaemonLockResult;
+export declare function releaseDaemonLock(lockPath: string, pid?: number): void;
+/** The live supervisor's pid, or null when none is running. */
+export declare function runningDaemonPid(lockPath: string, alive?: (pid: number) => boolean): number | null;
+export {};
+//# sourceMappingURL=lock.d.ts.map

package/dist/lib/daemon/lock.js

@@ -0,0 +1,138 @@
+/**
+ * One `hq daemon run` per user per machine: a pid file created with `wx`,
+ * taken over only when the recorded process is gone. Same file format as the
+ * mesh daemon's lock (`pid=<n>\nts=<unix seconds>`).
+ *
+ * Replacing a stale lock is guarded by a short-lived `<lock>.takeover` claim,
+ * so two starters that both saw the same stale owner cannot both win. A claim
+ * left behind by a starter that died mid-takeover expires after
+ * TAKEOVER_TTL_MS.
+ */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
+import { ensurePrivateDir } from "./paths.js";
+export const TAKEOVER_TTL_MS = 30_000;
+/**
+ * The process exists and this user can signal it. EPERM means it belongs to
+ * another user, so it cannot be this user's daemon.
+ */
+export function isProcessAlive(pid, kill = (p, s) => process.kill(p, s)) {
+    try {
+        kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const defaultCommandLineDeps = () => ({
+    platform: process.platform,
+    run: (cmd, args) => {
+        const r = spawnSync(cmd, args, { encoding: "utf8", windowsHide: true, timeout: 15_000 });
+        return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+    },
+});
+/** The process's command line, or null when it cannot be read. */
+export function processCommandLine(pid, deps = defaultCommandLineDeps()) {
+    const r = deps.platform === "win32"
+        ? deps.run("powershell.exe", [
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            `(Get-CimInstance Win32_Process -Filter "ProcessId=${Math.trunc(pid)}").CommandLine`,
+        ])
+        : deps.run("ps", ["-o", "command=", "-p", String(pid)]);
+    if (r.status !== 0)
+        return null;
+    const line = r.stdout.trim();
+    return line || null;
+}
+/**
+ * The pid is alive and is an `hq daemon run`. After a reboot the pid in an old
+ * lock file often belongs to an unrelated program; that must not keep the
+ * daemon from starting.
+ */
+export function isDaemonProcess(pid, deps = { alive: (p) => isProcessAlive(p), commandLine: (p) => processCommandLine(p) }) {
+    if (!deps.alive(pid))
+        return false;
+    const cmd = deps.commandLine(pid);
+    return cmd === null || /\bdaemon\s+run\b/.test(cmd);
+}
+function claimTakeover(claim, pid, now) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            fs.writeFileSync(claim, `pid=${pid}\n`, { flag: "wx", mode: 0o600 });
+            return true;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            let age;
+            try {
+                age = now() - fs.statSync(claim).mtimeMs;
+            }
+            catch (statErr) {
+                if (statErr.code === "ENOENT")
+                    continue;
+                throw statErr;
+            }
+            if (age <= TAKEOVER_TTL_MS)
+                return false;
+            fs.rmSync(claim, { force: true });
+        }
+    }
+    return false;
+}
+export function acquireDaemonLock(lockPath, pid = process.pid, alive = isDaemonProcess, now = Date.now) {
+    ensurePrivateDir(path.dirname(lockPath));
+    const body = `pid=${pid}\nts=${Math.floor(now() / 1000)}\n`;
+    const claim = `${lockPath}.takeover`;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+            fs.writeFileSync(lockPath, body, { flag: "wx", mode: 0o600 });
+            return { ok: true };
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+        }
+        const owner = readPidLock(lockPath);
+        if (owner && owner.pid !== pid && alive(owner.pid))
+            return { ok: false, owner };
+        // Another starter is replacing the same stale lock; let it.
+        if (!claimTakeover(claim, pid, now))
+            return { ok: false, owner: null };
+        try {
+            // Re-check under the claim: the lock may have been replaced since the read above.
+            const current = readPidLock(lockPath);
+            if (current && current.pid !== pid && alive(current.pid))
+                return { ok: false, owner: current };
+            fs.rmSync(lockPath, { force: true });
+            try {
+                fs.writeFileSync(lockPath, body, { flag: "wx", mode: 0o600 });
+                return { ok: true };
+            }
+            catch (err) {
+                if (err.code !== "EEXIST")
+                    throw err;
+            }
+        }
+        finally {
+            fs.rmSync(claim, { force: true });
+        }
+    }
+    throw new Error(`could not take the daemon lock at ${lockPath}`);
+}
+export function releaseDaemonLock(lockPath, pid = process.pid) {
+    const owner = readPidLock(lockPath);
+    if (owner?.pid === pid)
+        fs.rmSync(lockPath, { force: true });
+}
+/** The live supervisor's pid, or null when none is running. */
+export function runningDaemonPid(lockPath, alive = isDaemonProcess) {
+    const owner = readPidLock(lockPath);
+    return owner && alive(owner.pid) ? owner.pid : null;
+}
+//# sourceMappingURL=lock.js.map

package/dist/lib/daemon/machine-type.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Which kind of machine `hq daemon` is running on. The machine type picks the
+ * default service list, so nobody has to name services for a normal setup.
+ *
+ * Resolution order (first match wins):
+ *   1. `--machine-type` flag
+ *   2. the type saved in ~/.hq/daemon/config.json by an earlier install
+ *   3. /etc/hq/machine-type, written by box provisioning (may name a login user)
+ *   4. agent-kit machine credentials present → agent-kit
+ *   5. running in a container → agent-kit
+ *   6. macOS or Windows → desktop
+ *   7. any other host → self-hosted
+ */
+export declare const MACHINE_TYPES: readonly ["desktop", "self-hosted", "outpost", "agent-box", "agent-kit"];
+export type MachineType = (typeof MACHINE_TYPES)[number];
+export declare const MACHINE_TYPE_MARKER_PATH = "/etc/hq/machine-type";
+export type MachineTypeSource = "flag" | "config" | "marker" | "agent-kit-creds" | "container" | "platform";
+export interface MachineTypeResult {
+    type: MachineType;
+    source: MachineTypeSource;
+    /** Plain-language reason, printed by `hq daemon status` and install. */
+    detail: string;
+    /** Login user the system unit runs as (from the marker file). */
+    runAsUser?: string;
+    /** Problems found on the way (for example an unreadable marker file). */
+    warnings?: string[];
+}
+export interface DetectMachineTypeDeps {
+    platform: NodeJS.Platform;
+    env: NodeJS.ProcessEnv;
+    home: string;
+    savedType: string | undefined;
+    existsSync: (p: string) => boolean;
+    readFileSync: (p: string) => string;
+}
+export declare function isMachineType(value: unknown): value is MachineType;
+/**
+ * Marker format: either a bare type on the first line, or `type=<type>` with an
+ * optional `user=<login>` line. `#` comments and blank lines are ignored.
+ */
+export declare function parseMachineTypeMarker(text: string): {
+    type: MachineType;
+    user?: string;
+} | null;
+export declare function detectMachineType(flag: string | undefined, deps: DetectMachineTypeDeps): MachineTypeResult;
+/** The home directory of `user` in passwd-format text, or null when the account is not listed. */
+export declare function homeFromPasswd(passwd: string, user: string): string | null;
+//# sourceMappingURL=machine-type.d.ts.map

package/dist/lib/daemon/machine-type.js

@@ -0,0 +1,139 @@
+/**
+ * Which kind of machine `hq daemon` is running on. The machine type picks the
+ * default service list, so nobody has to name services for a normal setup.
+ *
+ * Resolution order (first match wins):
+ *   1. `--machine-type` flag
+ *   2. the type saved in ~/.hq/daemon/config.json by an earlier install
+ *   3. /etc/hq/machine-type, written by box provisioning (may name a login user)
+ *   4. agent-kit machine credentials present → agent-kit
+ *   5. running in a container → agent-kit
+ *   6. macOS or Windows → desktop
+ *   7. any other host → self-hosted
+ */
+import * as path from "node:path";
+import { AGENT_DIR_ENV, MACHINE_CREDS_NAME, agentRootDir } from "../agent-kit/paths.js";
+export const MACHINE_TYPES = ["desktop", "self-hosted", "outpost", "agent-box", "agent-kit"];
+export const MACHINE_TYPE_MARKER_PATH = "/etc/hq/machine-type";
+export function isMachineType(value) {
+    return typeof value === "string" && MACHINE_TYPES.includes(value);
+}
+const ACCOUNT_NAME = /^[a-z_][a-z0-9_-]{0,31}$/i;
+/**
+ * Marker format: either a bare type on the first line, or `type=<type>` with an
+ * optional `user=<login>` line. `#` comments and blank lines are ignored.
+ */
+export function parseMachineTypeMarker(text) {
+    let type;
+    let user;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq === -1) {
+            type ??= line;
+            continue;
+        }
+        const key = line.slice(0, eq).trim();
+        const value = line.slice(eq + 1).trim();
+        if (key === "type")
+            type = value;
+        else if (key === "user")
+            user = value;
+    }
+    if (!isMachineType(type))
+        return null;
+    if (user !== undefined && !ACCOUNT_NAME.test(user))
+        return null;
+    return user ? { type, user } : { type };
+}
+function platformName(platform) {
+    if (platform === "darwin")
+        return "macOS";
+    if (platform === "win32")
+        return "Windows";
+    return platform;
+}
+function withWarnings(result, warnings) {
+    return warnings.length > 0 ? { ...result, warnings } : result;
+}
+function readMarker(deps, warnings) {
+    if (!deps.existsSync(MACHINE_TYPE_MARKER_PATH))
+        return null;
+    try {
+        const marker = parseMachineTypeMarker(deps.readFileSync(MACHINE_TYPE_MARKER_PATH));
+        if (!marker)
+            warnings.push(`${MACHINE_TYPE_MARKER_PATH} does not name a known machine type; ignored it`);
+        return marker;
+    }
+    catch (err) {
+        warnings.push(`could not read ${MACHINE_TYPE_MARKER_PATH}: ${err.message}`);
+        return null;
+    }
+}
+/** Box types run as the login user the provisioning marker names, however the type itself was chosen. */
+function withMarkerUser(result, deps) {
+    if (result.type !== "outpost" && result.type !== "agent-box")
+        return result;
+    const warnings = [];
+    const user = readMarker(deps, warnings)?.user;
+    return withWarnings(user ? { ...result, runAsUser: user } : result, warnings);
+}
+/**
+ * Where a dedicated agent-kit host keeps its identity: an explicit
+ * HQ_MACHINE_CREDS_FILE or HQ_AGENT_DIR, else ~/.hq-agent itself. A local
+ * bot's identity under ~/.hq-agent/<name> sits beside a person's desktop and
+ * does not make the machine an agent kit.
+ */
+function hostAgentCredsPath(home, env) {
+    const credsFile = env.HQ_MACHINE_CREDS_FILE?.trim();
+    if (credsFile)
+        return credsFile;
+    const dir = env[AGENT_DIR_ENV]?.trim() || agentRootDir(home);
+    return path.join(dir, MACHINE_CREDS_NAME);
+}
+export function detectMachineType(flag, deps) {
+    if (flag !== undefined) {
+        if (!isMachineType(flag)) {
+            throw new Error(`Unknown machine type "${flag}". Use one of: ${MACHINE_TYPES.join(", ")}.`);
+        }
+        return withMarkerUser({ type: flag, source: "flag", detail: "set with --machine-type" }, deps);
+    }
+    if (isMachineType(deps.savedType)) {
+        return withMarkerUser({ type: deps.savedType, source: "config", detail: "saved by an earlier install" }, deps);
+    }
+    const warnings = [];
+    const marker = readMarker(deps, warnings);
+    if (marker) {
+        return {
+            type: marker.type,
+            source: "marker",
+            detail: `from ${MACHINE_TYPE_MARKER_PATH}`,
+            ...(marker.user ? { runAsUser: marker.user } : {}),
+        };
+    }
+    const kitCreds = hostAgentCredsPath(deps.home, deps.env);
+    if (deps.existsSync(kitCreds)) {
+        return withWarnings({ type: "agent-kit", source: "agent-kit-creds", detail: `agent kit credentials at ${kitCreds}` }, warnings);
+    }
+    if (deps.env.HQ_CONTAINER === "1" || deps.existsSync("/.dockerenv")) {
+        return withWarnings({ type: "agent-kit", source: "container", detail: "running in a container" }, warnings);
+    }
+    if (deps.platform === "darwin" || deps.platform === "win32") {
+        return withWarnings({ type: "desktop", source: "platform", detail: platformName(deps.platform) }, warnings);
+    }
+    return withWarnings({ type: "self-hosted", source: "platform", detail: `${platformName(deps.platform)} host` }, warnings);
+}
+/** The home directory of `user` in passwd-format text, or null when the account is not listed. */
+export function homeFromPasswd(passwd, user) {
+    for (const line of passwd.split(/\r?\n/)) {
+        if (!line || line.startsWith("#"))
+            continue;
+        const fields = line.split(":");
+        if (fields[0] === user && fields.length >= 7)
+            return fields[5] || null;
+    }
+    return null;
+}
+//# sourceMappingURL=machine-type.js.map

package/dist/lib/daemon/migrate.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Taking over the units HQ installed before `hq daemon` (`hq daemon migrate
+ * --apply`) and giving them back (`hq daemon uninstall --restore-legacy`).
+ *
+ * Adopting a unit stops it and moves its definition into ~/.hq/daemon/adopted,
+ * so legacy detection no longer finds it and the daemon starts the service
+ * itself on its next plan. Each adopted unit is recorded in adopted.json with
+ * where its definition went, which is exactly what restore needs to put it
+ * back. A unit whose stop fails is left where it was and not recorded.
+ *
+ * Units owned by another product (the desktop app's sync agent) are never
+ * touched, and box system units need root. System units are recorded and
+ * saved in root-owned storage (not the login user's daemon folder, which the
+ * user can edit), and a restore checks each one lands in the system unit
+ * folder, so nobody but root decides what gets installed there.
+ */
+import type { RunCommand } from "../service-manager/launchd.js";
+import type { LegacyUnit } from "./legacy.js";
+export interface AdoptedUnit extends LegacyUnit {
+    /** Where the unit's definition (plist, unit file, task XML) was moved. */
+    movedTo: string;
+    adoptedAt: number;
+}
+export interface MigrateDeps {
+    run: RunCommand;
+    uid: number;
+    isRoot: boolean;
+    /** The login user's store: ~/.hq/daemon/adopted and adopted.json. */
+    adoptedDir: string;
+    recordPath: string;
+    /** Root-owned store for box system units. */
+    systemAdoptedDir: string;
+    systemRecordPath: string;
+    /** Where box system units live (/etc/systemd/system); restores must land here. */
+    systemUnitDir: string;
+    now?: () => number;
+    /** Tests inject a failing writer. */
+    writeRecord?: (recordPath: string, units: AdoptedUnit[]) => void;
+}
+export interface AdoptResult {
+    adopted: AdoptedUnit[];
+    skipped: {
+        unit: LegacyUnit;
+        reason: string;
+    }[];
+    failed: {
+        unit: LegacyUnit;
+        error: string;
+    }[];
+}
+export interface RestoreResult {
+    restored: AdoptedUnit[];
+    failed: {
+        unit: AdoptedUnit;
+        error: string;
+    }[];
+}
+export declare function readAdoptedUnits(recordPath: string): AdoptedUnit[];
+export declare function adoptLegacyUnits(units: readonly LegacyUnit[], deps: MigrateDeps): AdoptResult;
+export declare function restoreLegacyUnits(deps: MigrateDeps): RestoreResult;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/lib/daemon/migrate.js

@@ -0,0 +1,238 @@
+/**
+ * Taking over the units HQ installed before `hq daemon` (`hq daemon migrate
+ * --apply`) and giving them back (`hq daemon uninstall --restore-legacy`).
+ *
+ * Adopting a unit stops it and moves its definition into ~/.hq/daemon/adopted,
+ * so legacy detection no longer finds it and the daemon starts the service
+ * itself on its next plan. Each adopted unit is recorded in adopted.json with
+ * where its definition went, which is exactly what restore needs to put it
+ * back. A unit whose stop fails is left where it was and not recorded.
+ *
+ * Units owned by another product (the desktop app's sync agent) are never
+ * touched, and box system units need root. System units are recorded and
+ * saved in root-owned storage (not the login user's daemon folder, which the
+ * user can edit), and a restore checks each one lands in the system unit
+ * folder, so nobody but root decides what gets installed there.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { ensurePrivateDir } from "./paths.js";
+export function readAdoptedUnits(recordPath) {
+    let text;
+    try {
+        text = fs.readFileSync(recordPath, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+    const parsed = JSON.parse(text);
+    if (!Array.isArray(parsed))
+        throw new Error(`${recordPath} is not a list of adopted units`);
+    return parsed;
+}
+function writeAdoptedUnits(recordPath, units) {
+    ensurePrivateDir(path.dirname(recordPath));
+    const tmp = `${recordPath}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify(units, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, recordPath);
+}
+function storeFor(kind, deps) {
+    return kind === "systemd-system"
+        ? { dir: deps.systemAdoptedDir, record: deps.systemRecordPath }
+        : { dir: deps.adoptedDir, record: deps.recordPath };
+}
+/** The saved definition's file name, prefixed with the unit kind so a user and a system unit of the same name never collide. */
+function savedName(unit) {
+    return unit.kind === "schtasks" ? `schtasks-${unit.name}.xml` : `${unit.kind}-${path.basename(unit.path ?? unit.name)}`;
+}
+/** Run a service-manager command; throw with its stderr when it fails. */
+function must(run, cmd, args) {
+    const r = run(cmd, args);
+    if (r.status !== 0) {
+        const detail = r.stderr.trim().split("\n").slice(-2).join(" ").slice(0, 300);
+        throw new Error(`${cmd} ${args.join(" ")} failed${detail ? `: ${detail}` : ` (exit ${r.status})`}`);
+    }
+    return r.stdout;
+}
+function moveFile(from, to) {
+    ensurePrivateDir(path.dirname(to));
+    try {
+        fs.renameSync(from, to);
+    }
+    catch (err) {
+        if (err.code !== "EXDEV")
+            throw err;
+        fs.copyFileSync(from, to);
+        fs.rmSync(from);
+    }
+}
+/** schtasks /Create /XML reads UTF-16LE with a BOM, the format /Query /XML declares. */
+function encodeTaskXml(xml) {
+    return Buffer.from(`\uFEFF${xml.replace(/^\uFEFF/, "")}`, "utf16le");
+}
+function adoptOne(unit, deps) {
+    const to = path.join(storeFor(unit.kind, deps).dir, savedName(unit));
+    switch (unit.kind) {
+        case "launchd": {
+            if (!unit.path)
+                throw new Error(`no plist path for ${unit.name}`);
+            const target = `gui/${deps.uid}/${unit.name}`;
+            const bootout = deps.run("launchctl", ["bootout", target]);
+            // bootout also fails when the agent is not loaded, which is fine; any
+            // other failure leaves it running, so do not take it over.
+            if (bootout.status !== 0 && deps.run("launchctl", ["print", target]).status === 0) {
+                must(deps.run, "launchctl", ["bootout", target]);
+            }
+            moveFile(unit.path, to);
+            return to;
+        }
+        case "systemd-user":
+        case "systemd-system": {
+            if (!unit.path)
+                throw new Error(`no unit file path for ${unit.name}`);
+            const scope = unit.kind === "systemd-user" ? ["--user"] : [];
+            must(deps.run, "systemctl", [...scope, "disable", "--now", unit.name]);
+            moveFile(unit.path, to);
+            deps.run("systemctl", [...scope, "daemon-reload"]);
+            return to;
+        }
+        case "schtasks": {
+            const xml = must(deps.run, "schtasks.exe", ["/Query", "/TN", unit.name, "/XML"]);
+            ensurePrivateDir(path.dirname(to));
+            fs.writeFileSync(to, encodeTaskXml(xml), { mode: 0o600 });
+            deps.run("schtasks.exe", ["/End", "/TN", unit.name]);
+            must(deps.run, "schtasks.exe", ["/Delete", "/TN", unit.name, "/F"]);
+            return to;
+        }
+    }
+}
+export function adoptLegacyUnits(units, deps) {
+    const now = deps.now ?? Date.now;
+    const write = deps.writeRecord ?? writeAdoptedUnits;
+    const result = { adopted: [], skipped: [], failed: [] };
+    const records = new Map();
+    const recordOf = (store) => {
+        if (!records.has(store.record))
+            records.set(store.record, readAdoptedUnits(store.record));
+        return records.get(store.record);
+    };
+    for (const unit of units) {
+        if (!unit.migratable) {
+            result.skipped.push({ unit, reason: "owned by the HQ desktop app" });
+            continue;
+        }
+        if (unit.kind === "systemd-system" && !deps.isRoot) {
+            result.skipped.push({ unit, reason: "a system unit; run `sudo hq daemon migrate --apply`" });
+            continue;
+        }
+        const store = storeFor(unit.kind, deps);
+        let movedTo;
+        try {
+            movedTo = adoptOne(unit, deps);
+        }
+        catch (err) {
+            result.failed.push({ unit, error: err.message });
+            continue;
+        }
+        const adopted = { ...unit, movedTo, adoptedAt: now() };
+        const next = [...recordOf(store), adopted];
+        try {
+            // Record each unit as soon as it is moved, so a failure later in the
+            // list never loses track of one already taken over.
+            write(store.record, next);
+            records.set(store.record, next);
+            result.adopted.push(adopted);
+        }
+        catch (err) {
+            // Without a record nothing could restore it, so put it back now.
+            let rollback = "";
+            try {
+                restoreOne(adopted, deps);
+            }
+            catch (restoreErr) {
+                rollback = `; putting it back also failed (${restoreErr.message}), its definition is at ${movedTo}`;
+            }
+            result.failed.push({ unit, error: `could not record the takeover: ${err.message}${rollback}` });
+        }
+    }
+    return result;
+}
+/** Move the definition back, unless an earlier restore that failed later already did. */
+function moveBack(unit, to) {
+    if (!fs.existsSync(unit.movedTo) && fs.existsSync(to))
+        return;
+    moveFile(unit.movedTo, to);
+}
+const SYSTEM_UNIT_NAME = /^[A-Za-z0-9@._-]+\.service$/;
+/** A system record entry may only put a .service file back into the system unit folder, from the root-owned store. */
+function checkSystemEntry(unit, deps) {
+    const expectedPath = path.join(deps.systemUnitDir, unit.name);
+    const expectedSaved = path.join(deps.systemAdoptedDir, savedName(unit));
+    if (!SYSTEM_UNIT_NAME.test(unit.name) || unit.path !== expectedPath || unit.movedTo !== expectedSaved) {
+        throw new Error(`the recorded unit ${unit.name} does not go back into the system unit folder ${deps.systemUnitDir}; not restoring it`);
+    }
+}
+function restoreOne(unit, deps) {
+    switch (unit.kind) {
+        case "launchd": {
+            if (!unit.path)
+                throw new Error(`no plist path recorded for ${unit.name}`);
+            moveBack(unit, unit.path);
+            must(deps.run, "launchctl", ["bootstrap", `gui/${deps.uid}`, unit.path]);
+            return;
+        }
+        case "systemd-user":
+        case "systemd-system": {
+            if (!unit.path)
+                throw new Error(`no unit file path recorded for ${unit.name}`);
+            if (unit.kind === "systemd-system" && !deps.isRoot) {
+                throw new Error("a system unit; run `sudo hq daemon uninstall --restore-legacy`");
+            }
+            const scope = unit.kind === "systemd-user" ? ["--user"] : [];
+            moveBack(unit, unit.path);
+            deps.run("systemctl", [...scope, "daemon-reload"]);
+            must(deps.run, "systemctl", [...scope, "enable", "--now", unit.name]);
+            return;
+        }
+        case "schtasks":
+            must(deps.run, "schtasks.exe", ["/Create", "/TN", unit.name, "/XML", unit.movedTo, "/F"]);
+            // Keep the saved XML until the task has started, so a failed start can be retried.
+            must(deps.run, "schtasks.exe", ["/Run", "/TN", unit.name]);
+            fs.rmSync(unit.movedTo, { force: true });
+            return;
+    }
+}
+function restoreFrom(record, deps, check, result) {
+    const units = readAdoptedUnits(record);
+    if (units.length === 0)
+        return;
+    const remaining = [];
+    for (const unit of units) {
+        try {
+            check(unit);
+            restoreOne(unit, deps);
+            result.restored.push(unit);
+        }
+        catch (err) {
+            result.failed.push({ unit, error: err.message });
+            remaining.push(unit);
+        }
+    }
+    writeAdoptedUnits(record, remaining);
+}
+export function restoreLegacyUnits(deps) {
+    const result = { restored: [], failed: [] };
+    restoreFrom(deps.recordPath, deps, (unit) => {
+        // The login user can edit this record; a system unit is only ever restored from root-owned storage.
+        if (unit.kind === "systemd-system") {
+            throw new Error("system units are only restored from the root-owned record; this entry was not written by hq daemon migrate");
+        }
+    }, result);
+    // Only root can read (or act on) the system store.
+    if (deps.isRoot)
+        restoreFrom(deps.systemRecordPath, deps, (unit) => checkSystemEntry(unit, deps), result);
+    return result;
+}
+//# sourceMappingURL=migrate.js.map