@indigoai-us/hq-cli 5.162.0 → 5.164.0

package/dist/commands/daemon.js

@@ -0,0 +1,554 @@
+/**
+ * `hq daemon` — one supervisor for every HQ background service on a machine.
+ *
+ *   hq daemon                     status (same as `hq daemon status`)
+ *   hq daemon install             detect the machine type, install the one OS unit
+ *   hq daemon run                 what the OS unit runs; starts the default services
+ *   hq daemon status [--json]
+ *   hq daemon logs [unit] [--follow] [--lines N]
+ *   hq daemon restart [unit] | trigger <unit>
+ *   hq daemon enable|disable <service...>   per-machine overrides
+ *   hq daemon migrate             list the older units it would take over (read-only)
+ *   hq daemon uninstall [--purge]
+ *
+ * Hidden from `hq --help` while it rolls out.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { DEFAULT_SERVICES, SERVICE_DESCRIPTIONS, enabledServices } from "../lib/daemon/catalog.js";
+import { applyServiceToggle, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
+import { daemonUnitInstalled } from "../lib/daemon/handoff.js";
+import { adoptLegacyUnits, readAdoptedUnits, restoreLegacyUnits } from "../lib/daemon/migrate.js";
+import { SYSTEM_UNIT_DIR, installDaemonUnit, installScopeFor, uninstallDaemonUnit, } from "../lib/daemon/install.js";
+import { describeLegacyUnit, findLegacyUnits } from "../lib/daemon/legacy.js";
+import { isDaemonProcess, runningDaemonPid } from "../lib/daemon/lock.js";
+import { detectMachineType, homeFromPasswd } from "../lib/daemon/machine-type.js";
+import { daemonPaths } from "../lib/daemon/paths.js";
+import { writeControlRequest } from "../lib/daemon/requests.js";
+import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
+class DaemonCommandError extends Error {
+}
+/**
+ * The HQ folder install records: --hq-root, else the CLI's shared resolution
+ * (HQ_ROOT, the tree around the current folder, the folder the installer or
+ * menubar recorded, the well-known locations). Undefined when none resolves.
+ */
+export function resolveDaemonHqRoot(flag, where) {
+    if (flag)
+        return path.resolve(flag);
+    try {
+        return resolveDefaultHqRoot({ onMissing: "throw", env: where.env, cwd: where.cwd, home: where.home });
+    }
+    catch {
+        // resolveDefaultHqRoot throws only when nothing resolves; install then
+        // says the folder is not set.
+        return undefined;
+    }
+}
+async function loadDefaults(over) {
+    const env = over.env ?? process.env;
+    const home = over.home ?? os.homedir();
+    const platform = over.platform ?? process.platform;
+    const needsBinaries = over.nodeBinary === undefined || over.hqBinary === undefined;
+    const mesh = needsBinaries || over.windowsUser === undefined ? await import("../lib/mesh/live/daemon/install.js") : null;
+    const serviceManager = over.run ? null : await import("../lib/service-manager/index.js");
+    const run = over.run ?? serviceManager.defaultRunCommand;
+    return {
+        env,
+        home,
+        platform,
+        out: over.out ?? ((l) => console.log(l)),
+        err: over.err ?? ((l) => console.error(l)),
+        run,
+        nodeBinary: over.nodeBinary ?? mesh.resolveAbsoluteNodeBinary(),
+        hqBinary: over.hqBinary ?? mesh.resolveHqBinary(),
+        uid: over.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0),
+        isRoot: over.isRoot ?? (typeof process.getuid === "function" && process.getuid() === 0),
+        fileExists: over.fileExists ?? fs.existsSync,
+        readFile: over.readFile ?? ((p) => fs.readFileSync(p, "utf8")),
+        legacyUnits: over.legacyUnits ??
+            (() => findLegacyUnits({
+                platform,
+                home,
+                existsSync: fs.existsSync,
+                listDir: (dir) => fs.readdirSync(dir),
+                windowsTaskExists: (task) => run("schtasks.exe", ["/Query", "/TN", task]).status === 0,
+            })),
+        resolveHqRoot: over.resolveHqRoot ?? ((flag) => resolveDaemonHqRoot(flag, { env, cwd: process.cwd(), home })),
+        userHome: over.userHome ?? ((user) => loginHome(user, run)),
+        daemonAlive: over.daemonAlive ?? ((pid) => isDaemonProcess(pid)),
+        windowsUser: over.windowsUser ?? (platform === "win32" ? mesh.resolveWindowsUser(env) : ""),
+        windowsHeadlessLauncher: over.windowsHeadlessLauncher ?? (platform === "win32" ? mesh.resolveWindowsHeadlessLauncher(env) : undefined),
+        systemUnitDir: over.systemUnitDir ?? SYSTEM_UNIT_DIR,
+    };
+}
+function detect(d, flag, config) {
+    return detectMachineType(flag, {
+        platform: d.platform,
+        env: d.env,
+        home: d.home,
+        savedType: config.machineType,
+        existsSync: d.fileExists,
+        readFileSync: d.readFile,
+    });
+}
+function describeServices(machineType, config) {
+    return enabledServices(machineType, config).map((s) => `  ${s.padEnd(16)} ${SERVICE_DESCRIPTIONS[s]}`);
+}
+function hostFor(d, paths, pathEnv) {
+    const env = {};
+    if (pathEnv && d.env.PATH)
+        env.PATH = d.env.PATH;
+    if (d.env.HQ_DAEMON_DIR)
+        env.HQ_DAEMON_DIR = d.env.HQ_DAEMON_DIR;
+    return {
+        platform: d.platform,
+        home: d.home,
+        nodeBinary: d.nodeBinary,
+        hqBinary: d.hqBinary,
+        daemonDir: paths.root,
+        uid: d.uid,
+        isRoot: d.isRoot,
+        windowsUser: d.windowsUser ?? "",
+        windowsHeadlessLauncher: d.windowsHeadlessLauncher,
+        systemUnitDir: d.systemUnitDir ?? SYSTEM_UNIT_DIR,
+        env,
+    };
+}
+/**
+ * The login user's home from the account database: `getent` covers LDAP and
+ * other NSS sources, /etc/passwd covers hosts without it. Accounts are not
+ * required to live under /home (root, service accounts under /var/lib).
+ */
+function loginHome(user, run) {
+    const entry = run("getent", ["passwd", user]);
+    const fromGetent = entry.status === 0 ? homeFromPasswd(entry.stdout, user) : null;
+    if (fromGetent)
+        return fromGetent;
+    let passwd;
+    try {
+        passwd = fs.readFileSync("/etc/passwd", "utf8");
+    }
+    catch (err) {
+        throw new DaemonCommandError(`Could not look up the home directory of ${user}: ${err.message}`);
+    }
+    const fromFile = homeFromPasswd(passwd, user);
+    if (!fromFile)
+        throw new DaemonCommandError(`The login user ${user} from /etc/hq/machine-type does not exist on this machine.`);
+    return fromFile;
+}
+/**
+ * Where the daemon's files are for this machine. On boxes the system unit runs
+ * as the login user, so its files live in that user's home, not root's.
+ */
+function hostPaths(d, flag) {
+    const own = daemonPaths(d.home, d.env);
+    const detected = detect(d, flag, readDaemonConfig(own.configPath));
+    if (installScopeFor(detected.type) !== "system")
+        return { paths: own, detected };
+    const runAsUser = detected.runAsUser;
+    if (!runAsUser) {
+        throw new DaemonCommandError("A box install needs the login user the daemon runs as. Provisioning writes it to /etc/hq/machine-type (user=<name>).");
+    }
+    const paths = daemonPaths(d.userHome(runAsUser), d.env);
+    if (flag !== undefined)
+        return { paths, detected, runAsUser };
+    // Root normally has no saved config; the login user's saved type is the real one.
+    const saved = readDaemonConfig(paths.configPath);
+    const again = saved.machineType ? detect(d, undefined, saved) : detected;
+    return { paths, detected: again, runAsUser: again.runAsUser ?? runAsUser };
+}
+/** hostPaths for the everyday verbs: a box without a known login user falls back to this user's own files. */
+function currentHost(d) {
+    try {
+        return hostPaths(d, undefined);
+    }
+    catch (err) {
+        if (!(err instanceof DaemonCommandError))
+            throw err;
+        const paths = daemonPaths(d.home, d.env);
+        return { paths, detected: detect(d, undefined, readDaemonConfig(paths.configPath)) };
+    }
+}
+/** Files root writes for a box's daemon must stay readable by the login user it runs as. */
+function handOver(d, host) {
+    if (host.runAsUser && d.isRoot)
+        d.run("chown", ["-R", `${host.runAsUser}:`, host.paths.root]);
+}
+async function runInstall(d, opts) {
+    const { paths, detected, runAsUser } = hostPaths(d, opts.machineType);
+    const scope = installScopeFor(detected.type);
+    const config = {
+        ...readDaemonConfig(paths.configPath),
+        machineType: detected.type,
+    };
+    const hqRoot = d.resolveHqRoot(opts.hqRoot) ?? config.hqRoot;
+    if (hqRoot)
+        config.hqRoot = hqRoot;
+    writeDaemonConfig(paths.configPath, config);
+    for (const w of detected.warnings ?? [])
+        d.err(`warning: ${w}`);
+    d.out(`Machine type: ${detected.type} (${detected.detail})`);
+    d.out(hqRoot ? `HQ folder: ${hqRoot}` : "HQ folder: not set (sync, lanes and search wait until `hq daemon install --hq-root <path>`)");
+    d.out("Services that start automatically:");
+    for (const line of describeServices(detected.type, config))
+        d.out(line);
+    const migratable = d.legacyUnits().filter((u) => u.migratable);
+    for (const u of migratable) {
+        d.out(`Note: ${describeLegacyUnit(u)} still runs ${u.unitId}. The daemon leaves it alone until \`hq daemon migrate\` takes it over.`);
+    }
+    const runAsHome = runAsUser ? d.userHome(runAsUser) : undefined;
+    const result = installDaemonUnit(hostFor(d, paths, scope === "user"), { scope, runAsUser, runAsHome }, { run: d.run });
+    handOver(d, { paths, detected, runAsUser });
+    if (result.kind === "manual") {
+        d.out(`This platform has no supported service manager. Start the daemon yourself with:\n  ${result.manualCommand}`);
+        return;
+    }
+    if (!result.running) {
+        throw new DaemonCommandError(`Installed ${result.unitPath}, but it did not start: ${result.error ?? "unknown error"}`);
+    }
+    d.out(`Installed and started: ${result.unitPath}`);
+}
+function migrateDeps(d, paths) {
+    return {
+        run: d.run,
+        uid: d.uid,
+        isRoot: d.isRoot,
+        adoptedDir: path.join(paths.root, "adopted"),
+        recordPath: path.join(paths.root, "adopted.json"),
+        // Box system units: root-owned, outside the login user's daemon folder (which handOver chowns to that user).
+        systemAdoptedDir: path.join(SYSTEM_ADOPTED_ROOT, "adopted"),
+        systemRecordPath: path.join(SYSTEM_ADOPTED_ROOT, "adopted.json"),
+        systemUnitDir: d.systemUnitDir ?? SYSTEM_UNIT_DIR,
+    };
+}
+const SYSTEM_ADOPTED_ROOT = "/var/lib/hq/daemon";
+/** Every unit the daemon took over that has not been given back (the system store only when root can read it). */
+function unrestoredUnits(d, migrate) {
+    const own = readAdoptedUnits(migrate.recordPath);
+    return d.isRoot ? [...own, ...readAdoptedUnits(migrate.systemRecordPath)] : own;
+}
+async function runUninstall(d, opts) {
+    const host = currentHost(d);
+    const { paths, detected } = host;
+    const migrate = migrateDeps(d, paths);
+    const adopted = unrestoredUnits(d, migrate);
+    if (opts.purge && !opts.restoreLegacy && adopted.length > 0) {
+        throw new DaemonCommandError(`hq daemon took over ${adopted.map((u) => u.unitId).join(", ")}, and their original units are kept in ${migrate.adoptedDir}. ` +
+            "Run `hq daemon uninstall --restore-legacy --purge` to give them back first, so --purge does not delete them.");
+    }
+    const result = uninstallDaemonUnit(hostFor(d, paths, false), { scope: installScopeFor(detected.type) }, { run: d.run });
+    d.out(result.removed ? `Removed ${result.unitPath}` : "hq daemon was not installed.");
+    if (opts.restoreLegacy) {
+        const restored = restoreLegacyUnits(migrate);
+        for (const u of restored.restored)
+            d.out(`Gave ${u.unitId} back to ${describeLegacyUnit(u)}`);
+        for (const f of restored.failed)
+            d.err(`Could not give ${f.unit.unitId} back to ${describeLegacyUnit(f.unit)}: ${f.error}`);
+        if (restored.restored.length === 0 && restored.failed.length === 0)
+            d.out("hq daemon had not taken over any older units.");
+        if (restored.failed.length > 0) {
+            handOver(d, host);
+            throw new DaemonCommandError(`Some units were not restored; they are still listed in ${migrate.recordPath}.`);
+        }
+    }
+    if (opts.purge) {
+        fs.rmSync(paths.root, { recursive: true, force: true });
+        d.out(`Deleted ${paths.root}`);
+    }
+    else {
+        d.out(`Kept settings in ${paths.configPath}`);
+    }
+}
+function readState(paths) {
+    try {
+        return JSON.parse(fs.readFileSync(paths.statePath, "utf8"));
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw new DaemonCommandError(`could not read ${paths.statePath}: ${err.message}`);
+    }
+}
+function formatUnit(u) {
+    const detail = u.status === "running" && u.pid
+        ? `pid ${u.pid}`
+        : u.status === "idle" && u.lastResult
+            ? `last run ${u.lastResult}`
+            : (u.reason ?? "");
+    const restarts = u.restarts > 0 ? ` (restarted ${u.restarts}x)` : "";
+    return `  ${u.id.padEnd(22)} ${u.status.padEnd(12)} ${detail}${restarts}`;
+}
+async function runStatus(d, opts) {
+    const host = currentHost(d);
+    const { paths } = host;
+    const pid = runningDaemonPid(paths.lockPath, d.daemonAlive);
+    const state = pid ? readState(paths) : null;
+    const config = readDaemonConfig(paths.configPath);
+    if (opts.json) {
+        d.out(JSON.stringify({ running: pid !== null, pid, machineType: state?.machineType ?? config.machineType ?? null, units: state?.units ?? [] }, null, 2));
+        return;
+    }
+    if (!pid || !state) {
+        const { detected } = host;
+        d.out(`hq daemon is not running. Machine type: ${detected.type} (${detected.detail}).`);
+        d.out("Default services for this machine:");
+        for (const line of describeServices(detected.type, config))
+            d.out(line);
+        return;
+    }
+    d.out(`hq daemon is running (pid ${pid}) on a ${state.machineType} machine.`);
+    for (const u of state.units)
+        d.out(formatUnit(u));
+}
+function tailLines(file, lines) {
+    const text = fs.readFileSync(file, "utf8");
+    return text.split("\n").filter((l, i, all) => i < all.length - 1 || l !== "").slice(-lines);
+}
+async function runLogs(d, unit, opts) {
+    const { paths } = currentHost(d);
+    const file = unit ? paths.unitLogPath(unit) : paths.supervisorLogPath;
+    if (!fs.existsSync(file))
+        throw new DaemonCommandError(`No log yet at ${file}`);
+    const n = Number(opts.lines ?? 50);
+    for (const line of tailLines(file, Number.isFinite(n) && n > 0 ? n : 50))
+        d.out(line);
+    if (!opts.follow)
+        return;
+    let offset = fs.statSync(file).size;
+    await new Promise(() => {
+        setInterval(() => {
+            const size = fs.statSync(file).size;
+            if (size < offset)
+                offset = 0;
+            if (size === offset)
+                return;
+            const fd = fs.openSync(file, "r");
+            const buf = Buffer.alloc(size - offset);
+            fs.readSync(fd, buf, 0, buf.length, offset);
+            fs.closeSync(fd);
+            offset = size;
+            process.stdout.write(buf.toString("utf8"));
+        }, 500);
+    });
+}
+function queueRequest(d, request, what) {
+    const host = currentHost(d);
+    const { paths } = host;
+    writeControlRequest(paths.requestsDir, request);
+    handOver(d, host);
+    const running = runningDaemonPid(paths.lockPath, d.daemonAlive) !== null;
+    d.out(running ? `Asked the daemon to ${what}.` : `Queued "${what}"; the daemon is not running, so it applies when it starts.`);
+}
+async function runToggle(d, action, services) {
+    const host = currentHost(d);
+    const { paths } = host;
+    const config = readDaemonConfig(paths.configPath);
+    const machineType = host.detected.type;
+    const next = applyServiceToggle(config, action, services, DEFAULT_SERVICES[machineType]);
+    writeDaemonConfig(paths.configPath, next);
+    handOver(d, host);
+    d.out(`Services for this ${machineType} machine:`);
+    for (const line of describeServices(machineType, next))
+        d.out(line);
+    d.out("A running daemon picks this up within 15 seconds.");
+}
+async function runMigrate(d, opts) {
+    const units = d.legacyUnits();
+    if (units.length === 0) {
+        d.out("No older HQ background units found. Nothing to migrate.");
+        return;
+    }
+    if (opts.apply) {
+        const host = currentHost(d);
+        // Stopping the older units with nothing installed to replace them would
+        // leave their services off.
+        const installed = daemonUnitInstalled({
+            platform: d.platform,
+            home: d.home,
+            systemUnitDir: d.systemUnitDir,
+            windowsTaskExists: (task) => d.run("schtasks.exe", ["/Query", "/TN", task]).status === 0,
+        });
+        if (!installed) {
+            throw new DaemonCommandError("hq daemon is not installed here yet. Run `hq daemon install` first, then `hq daemon migrate --apply`.");
+        }
+        const result = adoptLegacyUnits(units, migrateDeps(d, host.paths));
+        handOver(d, host);
+        for (const a of result.adopted)
+            d.out(`Took over ${a.unitId} from ${describeLegacyUnit(a)}`);
+        for (const s of result.skipped)
+            d.out(`Left ${s.unit.unitId} to ${describeLegacyUnit(s.unit)}: ${s.reason}`);
+        for (const f of result.failed)
+            d.err(`Could not take over ${f.unit.unitId} from ${describeLegacyUnit(f.unit)}: ${f.error}`);
+        if (result.adopted.length > 0) {
+            d.out("The daemon starts these services within a minute. `hq daemon uninstall --restore-legacy` puts the old units back.");
+        }
+        if (result.failed.length > 0)
+            throw new DaemonCommandError("Some units could not be taken over; they are still running as before.");
+        return;
+    }
+    for (const u of units) {
+        if (u.migratable)
+            d.out(`Would take over ${u.unitId} from ${describeLegacyUnit(u)}${u.path ? ` (${u.path})` : ""}`);
+        else
+            d.out(`Leaving ${u.unitId} to ${describeLegacyUnit(u)} (owned by the HQ desktop app)`);
+    }
+    d.out("Nothing was changed. `hq daemon migrate --apply` takes them over.");
+}
+async function runServiceSelfUpdate(d) {
+    const [{ daemonSelfUpdate }, { npmCodexUpdater, runDaemonUpdater, updaterEnv }, { cliSelfUpdatable }] = await Promise.all([
+        import("../utils/self-update.js"),
+        import("../lib/daemon/updater.js"),
+        import("../lib/daemon/run.js"),
+    ]);
+    // Same guard as the plan: never replace a dev checkout or a project's copy with a global install.
+    if (!cliSelfUpdatable()) {
+        d.out("This hq CLI is not a global install; nothing to update here.");
+        return;
+    }
+    const { paths } = currentHost(d);
+    const result = await runDaemonUpdater({
+        updateCli: () => daemonSelfUpdate({ env: updaterEnv(d.env) }),
+        codex: npmCodexUpdater(),
+        requestDaemonRestart: () => writeControlRequest(paths.requestsDir, { action: "restart-daemon" }),
+        log: d.out,
+    });
+    if (!result.ok)
+        process.exitCode = 1;
+}
+async function runServiceRemoteControl(d, opts) {
+    const { runRemoteControlHost } = await import("../lib/daemon/remote-control.js");
+    const { findOnPath } = await import("../lib/daemon/run.js");
+    const hqRoot = d.env.HQ_ROOT?.trim();
+    if (!hqRoot)
+        throw new DaemonCommandError("remote-control needs HQ_ROOT (the daemon sets it from the saved HQ folder)");
+    const tmux = findOnPath("tmux", d.env);
+    if (!tmux)
+        throw new DaemonCommandError("tmux is not installed");
+    const controller = new AbortController();
+    const stop = () => controller.abort();
+    process.once("SIGTERM", stop);
+    process.once("SIGINT", stop);
+    try {
+        process.exitCode = await runRemoteControlHost({
+            tmux,
+            claude: opts.claude,
+            hqRoot,
+            name: opts.name,
+            permissionMode: opts.permissionMode,
+            run: d.run,
+            pollMs: 5_000,
+            signal: controller.signal,
+            sleep: (ms) => new Promise((resolve) => {
+                const timer = setTimeout(resolve, ms);
+                controller.signal.addEventListener("abort", () => {
+                    clearTimeout(timer);
+                    resolve();
+                }, { once: true });
+            }),
+            log: d.out,
+        });
+    }
+    finally {
+        process.off("SIGTERM", stop);
+        process.off("SIGINT", stop);
+    }
+}
+export function registerDaemonCommand(program, over = {}) {
+    let resolved = null;
+    const deps = () => (resolved ??= loadDefaults(over));
+    const wrap = (fn) => async (...args) => {
+        const d = await deps();
+        try {
+            await fn(d, ...args);
+        }
+        catch (err) {
+            d.err(err instanceof Error ? err.message : String(err));
+            process.exitCode = 1;
+        }
+    };
+    const daemon = program
+        .command("daemon", { hidden: true })
+        .description("Run all of this machine's HQ background services under one supervisor")
+        .action(wrap((d) => runStatus(d, {})));
+    daemon
+        .command("install")
+        .description("Detect this machine's type, install the daemon, and start its default services")
+        .option("--machine-type <type>", "desktop | self-hosted | outpost | agent-box | agent-kit (skips detection)")
+        .option("--hq-root <path>", "HQ folder the services work against")
+        .action(wrap((d, opts) => runInstall(d, opts)));
+    daemon
+        .command("uninstall")
+        .description("Stop the daemon and remove its OS unit")
+        .option("--purge", "Also delete ~/.hq/daemon (settings, state and logs)")
+        .option("--restore-legacy", "Give the services `hq daemon migrate --apply` took over back to their original units")
+        .action(wrap((d, opts) => runUninstall(d, opts)));
+    daemon
+        .command("run")
+        .description("Run the supervisor (this is what the OS unit starts)")
+        .option("--foreground", "Also print the supervisor log to the terminal")
+        .option("--daemon-dir <path>", "Use this folder instead of ~/.hq/daemon (how the Windows task passes HQ_DAEMON_DIR)")
+        .option("--managed", "Started by the OS unit, which starts the daemon again whenever it exits")
+        .action(wrap(async (d, opts) => {
+        const { runDaemon } = await import("../lib/daemon/run.js");
+        // Services inherit this environment, so they see the same folder.
+        const env = opts.daemonDir ? { ...d.env, HQ_DAEMON_DIR: opts.daemonDir } : d.env;
+        process.exitCode = await runDaemon({
+            foreground: opts.foreground,
+            managed: opts.managed,
+            home: d.home,
+            env,
+            nodeBinary: d.nodeBinary,
+            hqBinary: d.hqBinary,
+        });
+    }));
+    daemon
+        .command("status")
+        .description("Show the machine type and each service's state")
+        .option("--json", "Print machine-readable JSON")
+        .action(wrap((d, opts) => runStatus(d, opts)));
+    daemon
+        .command("logs [unit]")
+        .description("Print the supervisor log, or one service's log")
+        .option("-f, --follow", "Keep printing new lines")
+        .option("-n, --lines <n>", "How many lines to print first", "50")
+        .action(wrap((d, unit, opts) => runLogs(d, unit, opts)));
+    daemon
+        .command("restart [unit]")
+        .description("Restart one service, or every running service")
+        .action(wrap(async (d, unit) => queueRequest(d, unit ? { action: "restart", unit } : { action: "restart" }, unit ? `restart ${unit}` : "restart all services")));
+    daemon
+        .command("trigger <unit>")
+        .description("Run a scheduled service now (for example search-index)")
+        .action(wrap(async (d, unit) => queueRequest(d, { action: "trigger", unit }, `run ${unit} now`)));
+    daemon
+        .command("enable <services...>")
+        .description("Turn services on for this machine, beyond its defaults")
+        .action(wrap((d, services) => runToggle(d, "enable", services)));
+    daemon
+        .command("disable <services...>")
+        .description("Turn default services off for this machine")
+        .action(wrap((d, services) => runToggle(d, "disable", services)));
+    daemon
+        .command("migrate")
+        .description("List the older HQ background units the daemon would take over; --apply takes them over")
+        .option("--apply", "Stop the older units and let the daemon run their services")
+        .action(wrap((d, opts) => runMigrate(d, opts)));
+    const service = daemon
+        .command("service", { hidden: true })
+        .description("Entry points the daemon runs for services that have no command of their own");
+    service
+        .command("self-update")
+        .description("Update the hq CLI (and Codex), then restart the daemon onto the new version")
+        .action(wrap((d) => runServiceSelfUpdate(d)));
+    service
+        .command("remote-control")
+        .description("Keep `claude remote-control` running in a tmux session in the HQ folder")
+        .requiredOption("--claude <path>", "claude binary")
+        .requiredOption("--name <name>", "remote-control session name")
+        .option("--permission-mode <mode>", "claude --permission-mode")
+        .action(wrap((d, opts) => runServiceRemoteControl(d, opts)));
+    return daemon;
+}
+//# sourceMappingURL=daemon.js.map

package/dist/commands/lanes.js

@@ -35,6 +35,7 @@ import { SESSION_MOVE_REASON } from "../lib/lanes/move-account.js";
 import { ensureSessionHome } from "../lib/lanes/session-relink.js";
 import { defaultProbe, validateProfileLaneModel, validateLaneModel, } from "../lib/lanes/models.js";
 import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ONLY_RULE, STANDING_AUTHORIZATION, spawnLaneWorker, laneRunDir, readSpawnManifest, stopLaneProcesses, } from "../lib/lanes/spawn.js";
+import { handOffInstallHere } from "../lib/daemon/handoff.js";
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
 export { MAX_LANE_DEPTH };
@@ -5082,6 +5083,12 @@ async function runReconcile(ctx, opts) {
     }
 }
 async function runReconcileInstall(ctx, opts) {
+    // `hq daemon` runs lanes-reconcile on this machine; a separate timer would run it twice.
+    const handedOff = opts.systemdRoot ? null : handOffInstallHere(["lanes-reconcile"]);
+    if (handedOff) {
+        printJson({ ok: true, action: "hq-daemon", message: handedOff });
+        return;
+    }
     const callerCwd = ctx.callerCwd();
     const systemdRootRaw = opts.systemdRoot ?? ctx.systemdRoot ?? defaultSystemdUserDir(ctx.homedir());
     const systemdRoot = opts.systemdRoot !== undefined

package/dist/commands/meetings.js

@@ -2,6 +2,7 @@ import chalk from "chalk";
 import { readFile } from "node:fs/promises";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid, resolveCallerPersonUid, } from "../utils/vault-api.js";
+import { isPlanGateError, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
 function formatDuration(seconds) {
     const h = Math.floor(seconds / 3600);
     const m = Math.floor((seconds % 3600) / 60);
@@ -98,6 +99,9 @@ async function resolveShortId(token, prefix, query) {
 }
 async function handleApiError(res, json = false) {
     const body = (await res.json().catch(() => ({})));
+    const planGate = planGateErrorFromPayload(res.status, body);
+    if (planGate)
+        throw planGate;
     if (json) {
         console.log(JSON.stringify(body, null, 2));
     }
@@ -119,6 +123,12 @@ async function handleApiError(res, json = false) {
     }
     process.exit(1);
 }
+function handleMeetingsCommandError(err) {
+    if (isPlanGateError(err))
+        throw err;
+    console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+    process.exit(1);
+}
 function printMeetingTable(meetings) {
     if (meetings.length === 0) {
         console.log(chalk.dim("  No meetings found."));
@@ -212,8 +222,7 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            handleMeetingsCommandError(err);
         }
     });
     // ── hq meetings invite <meeting-url> ──────────────────────────────
@@ -266,8 +275,7 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            handleMeetingsCommandError(err);
         }
     });
     meetings
@@ -302,8 +310,7 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            handleMeetingsCommandError(err);
         }
     });
     // ── hq meetings get <id> ──────────────────────────────────────────
@@ -374,8 +381,7 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            handleMeetingsCommandError(err);
         }
     });
     // ── hq meetings set-company <id> ──────────────────────────────────
@@ -429,8 +435,7 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            handleMeetingsCommandError(err);
         }
     });
     // ── hq meetings search <query> ─────────────────────────────────────
@@ -461,8 +466,7 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            handleMeetingsCommandError(err);
         }
     });
     // ── hq meetings transcript <id> ────────────────────────────────────
@@ -531,8 +535,7 @@ export function registerMeetingsCommand(program) {
             }
         }
         catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            handleMeetingsCommandError(err);
         }
     });
     // ── hq meetings notes <id> ─────────────────────────────────────────
@@ -640,8 +643,7 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            handleMeetingsCommandError(err);
         }
     });
 }