@indigoai-us/hq-cli 5.200.1 → 5.201.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.201.0] — 2026-09-25
+
+### Added
+
+- `hq daemon pin-hq-cloud <version>` pins the daemon-managed hq-cloud version to an exact semver within the bundled major, including prereleases; `--clear` removes the pin.
+
+### Fixed
+
+- The daemon carries `Environment=` assignments from Linux `outpost-sync.service` drop-ins into its sync unit.
+
 ## [5.200.1] — 2026-09-25
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -8444,6 +8444,22 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "pin-hq-cloud";
+        readonly description: "Pin hq-cloud to an exact version, or clear the pin";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [version]";
+        readonly arguments: readonly [{
+            readonly name: "version";
+            readonly required: false;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--clear";
+            readonly description: "Clear the saved hq-cloud version pin";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "migrate";
         readonly description: "List the older HQ background units the daemon would take over; --apply takes them over";

package/dist/command-catalog.generated.js

@@ -10918,6 +10918,27 @@ export const COMMAND_CATALOG = [
                 "options": [],
                 "subcommands": []
             },
+            {
+                "name": "pin-hq-cloud",
+                "description": "Pin hq-cloud to an exact version, or clear the pin",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [version]",
+                "arguments": [
+                    {
+                        "name": "version",
+                        "required": false,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--clear",
+                        "description": "Clear the saved hq-cloud version pin"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "migrate",
                 "description": "List the older HQ background units the daemon would take over; --apply takes them over",

package/dist/commands/daemon.js

@@ -16,6 +16,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { major as semverMajor, valid as validSemver } from "semver";
 import { DEFAULT_SERVICES, SERVICE_DESCRIPTIONS, enabledServices, hqCloudUnits } from "../lib/daemon/catalog.js";
 import { applyServiceToggle, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
 import { daemonUnitInstalled } from "../lib/daemon/handoff.js";
@@ -23,6 +24,7 @@ import { adoptLegacyUnits, readAdoptedUnits, restoreLegacyUnits } from "../lib/d
 import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, daemonRootRefusal, installDaemonUnit, installScopeFor, uninstallDaemonUnit, } from "../lib/daemon/install.js";
 import { describeLegacyUnit, findLegacyUnits } from "../lib/daemon/legacy.js";
 import { isDaemonProcess, runningDaemonPid } from "../lib/daemon/lock.js";
+import { bundledHqCloud } from "../lib/daemon/hq-cloud.js";
 import { MACHINE_TYPE_MARKER_PATH, detectMachineType, homeFromPasswd, } from "../lib/daemon/machine-type.js";
 import { daemonPaths } from "../lib/daemon/paths.js";
 import { writeControlRequest } from "../lib/daemon/requests.js";
@@ -375,6 +377,33 @@ async function runToggle(d, action, services) {
         d.out(line);
     d.out("A running daemon picks this up within 15 seconds.");
 }
+async function runPinHqCloud(d, version, opts) {
+    if (opts.clear === Boolean(version)) {
+        throw new DaemonCommandError("Pass one exact semver version, or use --clear.");
+    }
+    const host = currentHost(d);
+    const { paths } = host;
+    const config = readDaemonConfig(paths.configPath);
+    if (opts.clear) {
+        delete config.hqCloudVersion;
+        writeDaemonConfig(paths.configPath, config);
+        handOver(d, host);
+        d.out("Cleared the hq-cloud version pin.");
+    }
+    else {
+        if (!version || validSemver(version) !== version) {
+            throw new DaemonCommandError(`Invalid hq-cloud version "${version ?? ""}". Pass an exact semver version, including prereleases if needed.`);
+        }
+        const bundled = bundledHqCloud();
+        if (!bundled || semverMajor(bundled.version) !== semverMajor(version)) {
+            throw new DaemonCommandError(`The hq-cloud pin must use the same major version as the bundled hq-cloud${bundled ? ` (${semverMajor(bundled.version)})` : ""}.`);
+        }
+        writeDaemonConfig(paths.configPath, { ...config, hqCloudVersion: version });
+        handOver(d, host);
+        d.out(`Pinned hq-cloud to ${version}.`);
+    }
+    d.out("Run `hq daemon trigger updater`; wait for the hq-cloud update or current-version message in `hq daemon logs updater`, then restart `hq daemon restart sync`, `hq daemon restart heartbeat`, and `hq daemon restart session-host`.");
+}
 async function runMigrate(d, opts) {
     const units = d.legacyUnits();
     if (units.length === 0) {
@@ -585,6 +614,11 @@ export function registerDaemonCommand(program, over = {}) {
         .command("disable <services...>")
         .description("Turn default services off for this machine")
         .action(wrap((d, services) => runToggle(d, "disable", services)));
+    daemon
+        .command("pin-hq-cloud [version]")
+        .description("Pin hq-cloud to an exact version, or clear the pin")
+        .option("--clear", "Clear the saved hq-cloud version pin")
+        .action(wrap((d, version, opts) => runPinHqCloud(d, version, opts)));
     daemon
         .command("migrate")
         .description("List the older HQ background units the daemon would take over; --apply takes them over")

package/dist/lib/daemon/catalog.d.ts

@@ -66,6 +66,8 @@ export interface PlanContext {
     heartbeatRunnerPath: string | null;
     /** hq-cloud's `hq-outpost-session-host` bin, when the hq-cloud in use has one. */
     sessionHostRunnerPath: string | null;
+    /** Environment retained from legacy outpost sync systemd drop-ins. */
+    legacySyncEnv: Record<string, string>;
     signedIn: boolean;
     /** ~/.hq-agent/kit.json exists. */
     kitConfigured: boolean;

package/dist/lib/daemon/catalog.js

@@ -129,6 +129,7 @@ function planService(service, ctx) {
                     script: ctx.syncRunnerPath,
                     args: ["--companies", "--direction", "both", "--on-conflict", "keep", "--hq-root", ctx.hqRoot ?? "", "--watch", "--event-push"],
                 },
+                env: { ...ctx.legacySyncEnv },
             });
             unit.blocked = firstBlock([
                 [ctx.desktopAppManagesSync, "the HQ desktop app is handling sync on this machine"],

package/dist/lib/daemon/config.d.ts

@@ -10,6 +10,8 @@ export interface DaemonConfig {
     version: 1;
     machineType?: MachineType;
     hqRoot?: string;
+    /** Exact hq-cloud package version preferred by this daemon, including prereleases. */
+    hqCloudVersion?: string;
     /** Services turned on here beyond the machine type's defaults. */
     enable: string[];
     /** Default services turned off here. */

package/dist/lib/daemon/config.js

@@ -6,6 +6,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { valid as validSemver } from "semver";
 import { isServiceName } from "./catalog.js";
 import { isMachineType } from "./machine-type.js";
 import { ensurePrivateDir } from "./paths.js";
@@ -40,6 +41,9 @@ export function readDaemonConfig(file) {
         config.machineType = obj.machineType;
     if (typeof obj.hqRoot === "string" && obj.hqRoot.trim())
         config.hqRoot = obj.hqRoot;
+    if (typeof obj.hqCloudVersion === "string" && validSemver(obj.hqCloudVersion) === obj.hqCloudVersion) {
+        config.hqCloudVersion = obj.hqCloudVersion;
+    }
     return config;
 }
 export function writeDaemonConfig(file, config) {
@@ -50,6 +54,8 @@ export function writeDaemonConfig(file, config) {
         ordered.machineType = config.machineType;
     if (config.hqRoot)
         ordered.hqRoot = config.hqRoot;
+    if (config.hqCloudVersion)
+        ordered.hqCloudVersion = config.hqCloudVersion;
     ordered.enable = config.enable;
     ordered.disable = config.disable;
     fs.writeFileSync(tmp, `${JSON.stringify(ordered, null, 2)}\n`, { mode: 0o600 });

package/dist/lib/daemon/hq-cloud.d.ts

@@ -22,7 +22,7 @@ export declare function managedHqCloudRoot(daemonRoot: string): string;
  * `usable` says whether a copy has what the daemon runs; a newer managed copy
  * that fails it (an interrupted or damaged install) is passed over.
  */
-export declare function pickHqCloud(bundled: HqCloudCopy | null, managed: HqCloudCopy | null, usable?: (copy: HqCloudCopy) => boolean): PickedHqCloud | null;
+export declare function pickHqCloud(bundled: HqCloudCopy | null, managed: HqCloudCopy | null, usable?: (copy: HqCloudCopy) => boolean, pinnedVersion?: string): PickedHqCloud | null;
 export interface HqCloudRunners {
     syncRunner: string | null;
     /** `hq-outpost-heartbeat`, which older hq-cloud releases do not have. */
@@ -32,7 +32,7 @@ export interface HqCloudRunners {
 }
 export declare function hqCloudRunners(root: string, exists?: (p: string) => boolean): HqCloudRunners;
 /** Install the newest release of the bundled major version, never older than the bundled copy. */
-export declare function hqCloudInstallCommand(prefix: string, bundledVersion: string, platform?: NodeJS.Platform): {
+export declare function hqCloudInstallCommand(prefix: string, bundledVersion: string, platform?: NodeJS.Platform, pinnedVersion?: string): {
     file: string;
     args: string[];
     shell: boolean;

package/dist/lib/daemon/hq-cloud.js

@@ -10,6 +10,7 @@ import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import { createRequire } from "node:module";
 import * as path from "node:path";
+import { readDaemonConfig } from "./config.js";
 import { buildSpawnPlan } from "../../utils/windows-spawn.js";
 export const HQ_CLOUD_PACKAGE = "@indigoai-us/hq-cloud";
 export function managedHqCloudDir(daemonRoot) {
@@ -34,11 +35,17 @@ function newer(a, b) {
  * `usable` says whether a copy has what the daemon runs; a newer managed copy
  * that fails it (an interrupted or damaged install) is passed over.
  */
-export function pickHqCloud(bundled, managed, usable = () => true) {
+export function pickHqCloud(bundled, managed, usable = () => true, pinnedVersion) {
     if (!bundled)
         return null;
     const b = parseVersion(bundled.version);
     const m = managed ? parseVersion(managed.version) : null;
+    if (pinnedVersion) {
+        if (managed && managed.version === pinnedVersion && b && m && m[0] === b[0] && usable(managed)) {
+            return { ...managed, source: "managed" };
+        }
+        return { ...bundled, source: "bundled" };
+    }
     if (managed && b && m && m[0] === b[0] && newer(m, b) && usable(managed))
         return { ...managed, source: "managed" };
     return { ...bundled, source: "bundled" };
@@ -55,9 +62,17 @@ export function hqCloudRunners(root, exists = fs.existsSync) {
     };
 }
 /** Install the newest release of the bundled major version, never older than the bundled copy. */
-export function hqCloudInstallCommand(prefix, bundledVersion, platform = process.platform) {
+export function hqCloudInstallCommand(prefix, bundledVersion, platform = process.platform, pinnedVersion) {
     // npm is a .cmd on Windows and needs the shell, so every argument is quoted for it.
-    const plan = buildSpawnPlan("npm", ["install", "--prefix", prefix, "--no-audit", "--no-fund", "--omit=dev", `${HQ_CLOUD_PACKAGE}@^${bundledVersion}`], platform);
+    const plan = buildSpawnPlan("npm", [
+        "install",
+        "--prefix",
+        prefix,
+        "--no-audit",
+        "--no-fund",
+        "--omit=dev",
+        `${HQ_CLOUD_PACKAGE}@${pinnedVersion ?? `^${bundledVersion}`}`,
+    ], platform);
     return { file: plan.cmd, args: plan.args, shell: plan.shell };
 }
 export function readHqCloudCopy(root) {
@@ -81,10 +96,12 @@ export function bundledHqCloud() {
 }
 /** The hq-cloud the daemon should run right now. */
 export function currentHqCloud(daemonRoot) {
-    return pickHqCloud(bundledHqCloud(), readHqCloudCopy(managedHqCloudRoot(daemonRoot)), (copy) => hqCloudRunners(copy.root).syncRunner !== null);
+    const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
+    return pickHqCloud(bundledHqCloud(), readHqCloudCopy(managedHqCloudRoot(daemonRoot)), (copy) => hqCloudRunners(copy.root).syncRunner !== null, pinnedVersion);
 }
 /** Install or update the updater's copy, as this (the login) user. */
 export function updateManagedHqCloud(daemonRoot, env) {
+    const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
     const bundled = bundledHqCloud();
     const from = currentHqCloud(daemonRoot)?.version ?? null;
     if (!bundled)
@@ -96,7 +113,7 @@ export function updateManagedHqCloud(daemonRoot, env) {
     catch (err) {
         return { ok: false, from, to: null, detail: `could not create ${prefix}: ${err instanceof Error ? err.message : String(err)}` };
     }
-    const cmd = hqCloudInstallCommand(prefix, bundled.version);
+    const cmd = hqCloudInstallCommand(prefix, bundled.version, process.platform, pinnedVersion);
     const r = spawnSync(cmd.file, cmd.args, {
         encoding: "utf8",
         env,

package/dist/lib/daemon/legacy-sync-env.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Environment assignments kept in the legacy outpost sync service drop-ins.
+ * The daemon reads these so taking over outpost-sync.service keeps its tuned
+ * sync limits. This module is deliberately tolerant: a bad or missing drop-in
+ * must never stop daemon planning.
+ */
+export declare const LEGACY_SYNC_DROPIN_DIR = "/etc/systemd/system/outpost-sync.service.d";
+/** Read simple KEY=VALUE and quoted "KEY=VALUE" Environment directives. */
+export declare function readLegacySyncEnv(platform: NodeJS.Platform, directory?: string): Record<string, string>;
+//# sourceMappingURL=legacy-sync-env.d.ts.map

package/dist/lib/daemon/legacy-sync-env.js

@@ -0,0 +1,58 @@
+/**
+ * Environment assignments kept in the legacy outpost sync service drop-ins.
+ * The daemon reads these so taking over outpost-sync.service keeps its tuned
+ * sync limits. This module is deliberately tolerant: a bad or missing drop-in
+ * must never stop daemon planning.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const LEGACY_SYNC_DROPIN_DIR = "/etc/systemd/system/outpost-sync.service.d";
+function assignments(text, into) {
+    let inService = false;
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const section = /^\[([^\]]+)\]$/.exec(line);
+        if (section) {
+            inService = section[1] === "Service";
+            continue;
+        }
+        if (!inService)
+            continue;
+        const match = /^Environment=(?:"([^"]*)"|([A-Za-z_][A-Za-z0-9_]*=[^\s"]*))$/.exec(line);
+        const assignment = match?.[1] ?? match?.[2];
+        if (assignment === undefined)
+            continue;
+        const equals = assignment.indexOf("=");
+        if (equals <= 0)
+            continue;
+        const key = assignment.slice(0, equals);
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            continue;
+        into[key] = assignment.slice(equals + 1);
+    }
+}
+/** Read simple KEY=VALUE and quoted "KEY=VALUE" Environment directives. */
+export function readLegacySyncEnv(platform, directory = LEGACY_SYNC_DROPIN_DIR) {
+    if (platform !== "linux")
+        return {};
+    let files;
+    try {
+        files = fs.readdirSync(directory).filter((name) => name.endsWith(".conf")).sort();
+    }
+    catch {
+        return {};
+    }
+    const env = {};
+    for (const file of files) {
+        try {
+            assignments(fs.readFileSync(path.join(directory, file), "utf8"), env);
+        }
+        catch {
+            // A single unreadable drop-in cannot make daemon planning fail.
+        }
+    }
+    return env;
+}
+//# sourceMappingURL=legacy-sync-env.js.map

package/dist/lib/daemon/run.js

@@ -18,6 +18,7 @@ import { botsRoot } from "../bot/paths.js";
 import { CLAUDE_RUNNER_SCRIPT, CODEX_RUNNER_SCRIPT, enabledServices, planUnits } from "./catalog.js";
 import { readDaemonConfig } from "./config.js";
 import { findLegacyUnits, legacyOwnerLookup } from "./legacy.js";
+import { readLegacySyncEnv } from "./legacy-sync-env.js";
 import { acquireDaemonLock, releaseDaemonLock } from "./lock.js";
 import { daemonRootRefusal } from "./install.js";
 import { detectMachineType } from "./machine-type.js";
@@ -258,6 +259,7 @@ export async function runDaemon(opts) {
             syncRunnerPath: runners.syncRunner,
             heartbeatRunnerPath: runners.heartbeat,
             sessionHostRunnerPath: runners.sessionHost,
+            legacySyncEnv: readLegacySyncEnv(platform),
             signedIn: signedIn(env, home, log),
             kitConfigured: fs.existsSync(agentKitPaths(home, env).kitConfigPath),
             desktopAppManagesSync: machineType === "desktop" &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.200.1",
+  "version": "5.201.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {