@indigoai-us/hq-cli 5.274.1 → 5.276.0

package/dist/lib/checkpoint-ontology/plan.js

@@ -13,6 +13,7 @@ import * as path from "node:path";
 import { writeCompanyBrief } from "./company-brief.js";
 import { resolveOntologyCompany, safeWriteFile, stateRoot } from "./company.js";
 import { startMultiWriterRun } from "./multi-writer.js";
+import { claimQueuedTouches, recordQueuedTouches } from "./queued-touches.js";
 import { checkSyncClient, readSyncClientVersions } from "./sync-client.js";
 import { buildEntityIndex, listKnowledgeFiles, listSignalFiles, readSignal } from "./tree.js";
 export const ONTOLOGY_FLAG = "checkpoint.ontology";
@@ -98,6 +99,15 @@ export const CONCEPT_PROJECT_LINK_FLAG = "checkpoint.ontology.concept-project-li
  * and lost no gold link.
  */
 export const NAMED_EVIDENCE_FLAG = "checkpoint.ontology.named-evidence";
+/**
+ * CO-59: consume the files touched by company checkpoints that were queued
+ * behind a busy sibling (see queued-touches.ts). On, the plan adds the
+ * company's queued touches to this run's session-touched set, and a run whose
+ * own payload names no company plans the company the parent picked for it
+ * (`ontology_company`), without that run's session text. Off, queued touches
+ * wait on disk and a company-less run skips the ontology step as before.
+ */
+export const QUEUED_TOUCHES_FLAG = "checkpoint.ontology.queued-touches";
 export const PLAN_FILE = "ontology-plan.json";
 export const CANDIDATES_FILE = "ontology-candidates.json";
 export const REPORT_FILE = "ontology-report.json";
@@ -255,13 +265,32 @@ export function refreshLedger(company, existing, touched) {
     }
     return { ledger: { schema: LEDGER_SCHEMA, company: company.slug, boundary, entries }, firstRun };
 }
+/**
+ * The company this run's ontology step works on: the payload's own company,
+ * or else the `ontology_company` the checkpoint parent picked for queued
+ * touches (`borrowed`).
+ */
+export function payloadOntologyCompany(payload) {
+    if (typeof payload.company === "string" && payload.company)
+        return { slug: payload.company, borrowed: false };
+    if (typeof payload.ontology_company === "string" && payload.ontology_company) {
+        return { slug: payload.ontology_company, borrowed: true };
+    }
+    return { slug: null, borrowed: false };
+}
 /** Plan this run. Never throws for a skip; returns the reason instead. */
 export async function planOntologyRun(options) {
     const { hqRoot, runDir, payload } = options;
-    const resolution = resolveOntologyCompany(hqRoot, typeof payload.company === "string" ? payload.company : null);
+    const { slug, borrowed } = payloadOntologyCompany(payload);
+    const resolution = resolveOntologyCompany(hqRoot, slug);
     if (!resolution.ok)
         return { status: "skipped", reason: resolution.reason };
     const company = resolution.company;
+    // A borrowed company exists only for queued touches, so its run needs the
+    // queued-touches flag before anything else is read or written.
+    if (borrowed && !(await options.readFlag(QUEUED_TOUCHES_FLAG, company))) {
+        return { status: "skipped", reason: "flag off" };
+    }
     const ontologyOn = (await options.readFlag(ONTOLOGY_FLAG, company)) || (await options.readFlag(ONTOLOGY_SYNC_GATED_FLAG, company));
     const syncClient = ontologyOn ? checkSyncClient((options.syncClientVersions ?? readSyncClientVersions)()) : null;
     if (!ontologyOn || !syncClient?.ok) {
@@ -278,7 +307,14 @@ export async function planOntologyRun(options) {
     const skipAmbiguousConceptLinks = await options.readFlag(SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG, company);
     const conceptProjectLink = await options.readFlag(CONCEPT_PROJECT_LINK_FLAG, company);
     const namedEvidence = await options.readFlag(NAMED_EVIDENCE_FLAG, company);
-    const touched = sessionTouched(hqRoot, company, payload.files);
+    const queuedTouchesOn = borrowed || (await options.readFlag(QUEUED_TOUCHES_FLAG, company));
+    // A borrowed company's run belongs to another session: its own files and
+    // session text are not this company's input.
+    const touched = sessionTouched(hqRoot, company, borrowed ? [] : payload.files);
+    if (queuedTouchesOn) {
+        for (const rel of sessionTouched(hqRoot, company, claimQueuedTouches(hqRoot, company, runDir)))
+            touched.add(rel);
+    }
     // A first run takes its boundary from the entity tree, so the ledger is
     // refreshed before merge-back moves any `last_updated` forward.
     const { ledger, firstRun } = refreshLedger(company, readLedger(hqRoot, company), touched);
@@ -293,9 +329,11 @@ export async function planOntologyRun(options) {
     const inputs = [];
     let tokens = 0;
     let remaining = 0;
+    const leftover = [];
     for (const [rel, entry] of pending) {
         if (inputs.length >= BUDGET.maxInputs || tokens >= BUDGET.maxTokens) {
             remaining += 1;
+            leftover.push(rel);
             continue;
         }
         const text = fs.readFileSync(path.join(company.dir, rel), "utf8");
@@ -329,10 +367,21 @@ export async function planOntologyRun(options) {
             });
             tokens += cost;
         }
-        if (index < chunks.length)
+        if (index < chunks.length) {
             remaining += 1;
+            leftover.push(rel);
+        }
     }
     writeLedger(hqRoot, company, ledger);
+    // The leftover files stay queued so a later company-less run can borrow this company again.
+    if (queuedTouchesOn && leftover.length > 0) {
+        try {
+            recordQueuedTouches(hqRoot, company.slug, leftover.map((rel) => path.relative(hqRoot, path.join(company.dir, rel))), options.now ?? new Date());
+        }
+        catch {
+            // Re-queueing leftovers must not fail the plan.
+        }
+    }
     if (inputs.length === 0) {
         const reason = pending.length > 0 ? "over budget" : "nothing changed";
         return {
@@ -345,7 +394,7 @@ export async function planOntologyRun(options) {
     // Session content is scoped to the session's user (design section 6, D2).
     // v1 records the existing entities it names as links in the report and
     // writes nothing from it, so it rides along only when files changed.
-    const sessionText = sessionContent(payload);
+    const sessionText = borrowed ? null : sessionContent(payload);
     if (sessionText) {
         const cost = estTokens(Buffer.byteLength(sessionText, "utf8"));
         inputs.unshift({

package/dist/lib/checkpoint-ontology/queued-touches.d.ts

@@ -0,0 +1,32 @@
+import { type OntologyCompany } from "./company.js";
+export declare const QUEUED_TOUCHES_FILE = "queued-touches.jsonl";
+export declare const QUEUED_TOUCHES_CLAIM_FILE = "queued-touches-claimed.jsonl";
+export declare const QUEUED_TOUCHES_BORROWED_FILE = "queued-touches-borrowed-at";
+export declare const MAX_QUEUED_TOUCHES = 200;
+export declare function queuedTouchesPath(hqRoot: string, slug: string): string;
+/**
+ * Record the files a queued checkpoint touched inside its company. Files
+ * outside `companies/<slug>/` are dropped. Returns the number of files
+ * recorded; 0 when the company is not a manifest company or nothing is inside
+ * it. The queue keeps its newest {@link MAX_QUEUED_TOUCHES} lines.
+ */
+export declare function recordQueuedTouches(hqRoot: string, slug: string | null, files: string[], now: Date): number;
+/**
+ * Record that a company-less run borrowed `slug`, so the next such run prefers
+ * a company that has waited longer.
+ */
+export declare function markBorrowed(hqRoot: string, slug: string, now: Date): void;
+/**
+ * The manifest company whose queued touches have waited longest, or null.
+ * The order key is the later of the first queued record and the last borrow,
+ * so a company a company-less run just borrowed goes to the back. A run whose
+ * own payload names no company uses it for its ontology step.
+ */
+export declare function oldestQueuedCompany(hqRoot: string): string | null;
+/**
+ * Take the company's queued touches by renaming the file into the run
+ * directory, then return the HQ-relative paths it lists. Renaming is atomic,
+ * so a touch recorded during the claim lands in a fresh file for a later run.
+ */
+export declare function claimQueuedTouches(hqRoot: string, company: OntologyCompany, runDir: string): string[];
+//# sourceMappingURL=queued-touches.d.ts.map

package/dist/lib/checkpoint-ontology/queued-touches.js

@@ -0,0 +1,193 @@
+/**
+ * Company files touched by checkpoints that were queued behind a busy sibling.
+ *
+ * `hq core checkpoint` queues its payload when a sibling is already running,
+ * and the next run claims the queue. That run renders the ontology step only
+ * for its own payload's company, and the ontology plan records any changed
+ * file the run's own payload did not touch as seen. Without this file, the
+ * files a queued company checkpoint touched never reach the ontology (CO-59).
+ *
+ * The checkpoint parent performs no network I/O, so it cannot read the
+ * `checkpoint.ontology.queued-touches` flag. It always records the touches in
+ * the company's local, unsynced state directory; the ontology plan consumes
+ * them only while the flag is on. The file is capped so it stays small while
+ * the flag is off.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { assertSafeTarget, resolveOntologyCompany, safeWriteFile, WriteBoundsError, } from "./company.js";
+export const QUEUED_TOUCHES_FILE = "queued-touches.jsonl";
+export const QUEUED_TOUCHES_CLAIM_FILE = "queued-touches-claimed.jsonl";
+export const QUEUED_TOUCHES_BORROWED_FILE = "queued-touches-borrowed-at";
+export const MAX_QUEUED_TOUCHES = 200;
+function ontologyStateBase(hqRoot) {
+    return path.join(hqRoot, "workspace", "checkpoints", "ontology");
+}
+function companyStateDir(hqRoot, slug) {
+    return path.join(ontologyStateBase(hqRoot), slug);
+}
+export function queuedTouchesPath(hqRoot, slug) {
+    return path.join(companyStateDir(hqRoot, slug), QUEUED_TOUCHES_FILE);
+}
+/**
+ * Record the files a queued checkpoint touched inside its company. Files
+ * outside `companies/<slug>/` are dropped. Returns the number of files
+ * recorded; 0 when the company is not a manifest company or nothing is inside
+ * it. The queue keeps its newest {@link MAX_QUEUED_TOUCHES} lines.
+ */
+export function recordQueuedTouches(hqRoot, slug, files, now) {
+    if (!slug)
+        return 0;
+    const resolution = resolveOntologyCompany(hqRoot, slug);
+    if (!resolution.ok)
+        return 0;
+    const inside = files.filter((file) => {
+        if (typeof file !== "string" || !file.trim())
+            return false;
+        const rel = path.relative(resolution.company.dir, path.resolve(hqRoot, file.trim()));
+        return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+    });
+    if (inside.length === 0)
+        return 0;
+    const target = queuedTouchesPath(hqRoot, slug);
+    try {
+        assertSafeTarget(hqRoot, [companyStateDir(hqRoot, slug)], target);
+    }
+    catch (error) {
+        if (error instanceof WriteBoundsError)
+            return 0;
+        throw error;
+    }
+    const fd = fs.openSync(target, fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | fs.constants.O_NOFOLLOW);
+    try {
+        fs.writeSync(fd, `${JSON.stringify({ queued_at: now.toISOString(), files: inside })}\n`);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    const lines = fs.readFileSync(target, "utf8").split("\n").filter((line) => line.trim());
+    if (lines.length > MAX_QUEUED_TOUCHES) {
+        // Best-effort trim, as for the sibling's pending queue: it can race a
+        // concurrent append, but only once the file is already over its cap.
+        safeWriteFile(hqRoot, [companyStateDir(hqRoot, slug)], target, `${lines.slice(-MAX_QUEUED_TOUCHES).join("\n")}\n`);
+    }
+    return inside.length;
+}
+/**
+ * Record that a company-less run borrowed `slug`, so the next such run prefers
+ * a company that has waited longer.
+ */
+export function markBorrowed(hqRoot, slug, now) {
+    const target = path.join(companyStateDir(hqRoot, slug), QUEUED_TOUCHES_BORROWED_FILE);
+    safeWriteFile(hqRoot, [companyStateDir(hqRoot, slug)], target, `${now.toISOString()}\n`);
+}
+/** `queued_at` of the oldest record, or the file mtime when no line has one. */
+function firstQueuedMs(file, mtimeMs) {
+    for (const line of fs.readFileSync(file, "utf8").split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (typeof parsed.queued_at !== "string")
+                continue;
+            const ms = Date.parse(parsed.queued_at);
+            if (!Number.isNaN(ms))
+                return ms;
+        }
+        catch {
+            // A partial line is not a record; a later valid line still counts.
+        }
+    }
+    return mtimeMs;
+}
+/** When this company was last borrowed, or -Infinity when it never was. */
+function borrowedMs(hqRoot, slug) {
+    const file = path.join(companyStateDir(hqRoot, slug), QUEUED_TOUCHES_BORROWED_FILE);
+    let stat;
+    try {
+        stat = fs.lstatSync(file);
+    }
+    catch {
+        return Number.NEGATIVE_INFINITY;
+    }
+    if (!stat.isFile())
+        return Number.NEGATIVE_INFINITY;
+    const ms = Date.parse(fs.readFileSync(file, "utf8").trim());
+    return Number.isNaN(ms) ? Number.NEGATIVE_INFINITY : ms;
+}
+/**
+ * The manifest company whose queued touches have waited longest, or null.
+ * The order key is the later of the first queued record and the last borrow,
+ * so a company a company-less run just borrowed goes to the back. A run whose
+ * own payload names no company uses it for its ontology step.
+ */
+export function oldestQueuedCompany(hqRoot) {
+    let entries;
+    try {
+        entries = fs.readdirSync(ontologyStateBase(hqRoot));
+    }
+    catch {
+        return null;
+    }
+    let oldest = null;
+    for (const slug of entries.sort()) {
+        let stat;
+        try {
+            stat = fs.lstatSync(queuedTouchesPath(hqRoot, slug));
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile() || stat.size === 0)
+            continue;
+        if (!resolveOntologyCompany(hqRoot, slug).ok)
+            continue;
+        const key = Math.max(firstQueuedMs(queuedTouchesPath(hqRoot, slug), stat.mtimeMs), borrowedMs(hqRoot, slug));
+        if (!oldest || key < oldest.key)
+            oldest = { slug, key };
+    }
+    return oldest?.slug ?? null;
+}
+/**
+ * Take the company's queued touches by renaming the file into the run
+ * directory, then return the HQ-relative paths it lists. Renaming is atomic,
+ * so a touch recorded during the claim lands in a fresh file for a later run.
+ */
+export function claimQueuedTouches(hqRoot, company, runDir) {
+    const queuedPath = queuedTouchesPath(hqRoot, company.slug);
+    try {
+        assertSafeTarget(hqRoot, [companyStateDir(hqRoot, company.slug)], queuedPath);
+    }
+    catch (error) {
+        if (error instanceof WriteBoundsError)
+            return [];
+        throw error;
+    }
+    const claimPath = path.join(runDir, QUEUED_TOUCHES_CLAIM_FILE);
+    try {
+        fs.renameSync(queuedPath, claimPath);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const files = [];
+    for (const line of fs.readFileSync(claimPath, "utf8").split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (Array.isArray(parsed.files)) {
+                for (const file of parsed.files)
+                    if (typeof file === "string")
+                        files.push(file);
+            }
+        }
+        catch {
+            // A partial line must not drop the valid lines around it.
+        }
+    }
+    return files;
+}
+//# sourceMappingURL=queued-touches.js.map

package/dist/lib/core-utils/timeout-guard-native.d.ts

@@ -0,0 +1,7 @@
+/** Native fast-route adapter for the shared timeout-guard command. */
+import type { FlagReader } from "../flag-registry.js";
+import { type PersistedFlagSnapshot } from "../flag-snapshot-file.js";
+import { type TimeoutGuardDeps } from "./timeout-guard.js";
+export declare function createNativeSnapshotFlagReader(persistedSnapshot: PersistedFlagSnapshot | null, companyIdentifiers: readonly string[], env: NodeJS.ProcessEnv): FlagReader;
+export declare function runTimeoutGuardFast(_argv: readonly string[], stdin: string, _cwd: string, _hqRoot: string | undefined, dependencies?: TimeoutGuardDeps): Promise<number>;
+//# sourceMappingURL=timeout-guard-native.d.ts.map

package/dist/lib/core-utils/timeout-guard-native.js

@@ -0,0 +1,40 @@
+/** Native fast-route adapter for the shared timeout-guard command. */
+import { readLocalOverride, resolveFlag, } from "@indigoai-us/hq-flags-client";
+import { resolveProcessFlagCompanyContext } from "../process-flag-company-context.js";
+import { readFlagSnapshotFile, } from "../flag-snapshot-file.js";
+import { timeoutGuardCommand } from "./timeout-guard.js";
+export function createNativeSnapshotFlagReader(persistedSnapshot, companyIdentifiers, env) {
+    const snapshot = persistedSnapshot
+        ? { version: 0, flags: persistedSnapshot.flags }
+        : null;
+    return {
+        isEnabled(flagKey, lookup = {}) {
+            if (snapshot) {
+                return resolveFlag({
+                    flagKey,
+                    env,
+                    snapshot,
+                    companyIdentifiers,
+                    lookup,
+                }).value;
+            }
+            return readLocalOverride(flagKey, env) ?? (lookup.fallback ?? false);
+        },
+    };
+}
+function snapshotFlagReader(companyUid, companySlug, env) {
+    const persistedSnapshot = companyUid ? readFlagSnapshotFile(companyUid, { env }) : null;
+    const companyIdentifiers = [companyUid, companySlug].filter((value) => Boolean(value));
+    return createNativeSnapshotFlagReader(persistedSnapshot, companyIdentifiers, env);
+}
+export async function runTimeoutGuardFast(_argv, stdin, _cwd, _hqRoot, dependencies = {}) {
+    const env = dependencies.env ?? process.env;
+    const company = resolveProcessFlagCompanyContext(env);
+    const flagReader = dependencies.flagReader ?? snapshotFlagReader(company.companyUid, company.companySlug, env);
+    return timeoutGuardCommand(stdin, {
+        ...dependencies,
+        env,
+        flagReader,
+    });
+}
+//# sourceMappingURL=timeout-guard-native.js.map

package/dist/lib/core-utils/timeout-guard.d.ts

@@ -20,7 +20,7 @@
  *
  * Exit codes: 0 = allow, 2 = block.
  */
-import { type FlagReader } from "../flag-registry.js";
+import type { FlagReader } from "../flag-registry.js";
 /**
  * Worst-case inner deadline (seconds) declared in a command: a `timeout` /
  * `gtimeout` prefix (matched by executable BASENAME, so `/usr/bin/timeout`
@@ -55,11 +55,11 @@ export interface TimeoutGuardDeps {
     flagReader?: FlagReader;
 }
 /** Whether the guard is active for this identity (rollout gate). */
-export declare function isGatedUser(email: string | undefined, flagReader?: FlagReader): boolean;
+export declare function isGatedUser(email: string | undefined, flagReader?: FlagReader): Promise<boolean>;
 /**
  * Command entry: read the PreToolUse JSON, apply the gate + short-circuits, and
  * return the exit code (0 allow / 2 block). Never throws — a parse failure or a
  * missing identity fails OPEN (allow), because a hook must not break tool calls.
  */
-export declare function timeoutGuardCommand(stdin: string, deps?: TimeoutGuardDeps): number;
+export declare function timeoutGuardCommand(stdin: string, deps?: TimeoutGuardDeps): Promise<number>;
 //# sourceMappingURL=timeout-guard.d.ts.map

package/dist/lib/core-utils/timeout-guard.js

@@ -20,9 +20,6 @@
  *
  * Exit codes: 0 = allow, 2 = block.
  */
-import { loadCachedTokens } from "@indigoai-us/hq-cloud";
-import { peekIdToken } from "../../utils/id-token.js";
-import { resolveFlagGate, resolveProcessFlagGate, } from "../flag-registry.js";
 // Observed Claude Code Bash-tool bounds. The tool `timeout` (ms) raises the
 // deadline up to the max; with none declared the default applies.
 const HARNESS_DEFAULT_MS = 120_000; // 2 min
@@ -153,8 +150,14 @@ supervise yourself.)
 
 Policy: hq-foreground-timeout-killed-by-harness-deadline.
 Bypass for one sanctioned foreground run: prefix HQ_ALLOW_LONG_FOREGROUND=1.`;
-function defaultEmail() {
+async function defaultEmail() {
     try {
+        // The cached identity is needed only for commands that would otherwise
+        // block. Keep hq-cloud and the JWT decoder out of the common allow path.
+        const [{ loadCachedTokens }, { peekIdToken }] = await Promise.all([
+            import("@indigoai-us/hq-cloud"),
+            import("../../utils/id-token.js"),
+        ]);
         const cached = loadCachedTokens();
         if (!cached)
             return undefined;
@@ -166,23 +169,35 @@ function defaultEmail() {
     }
 }
 /** Whether the guard is active for this identity (rollout gate). */
-export function isGatedUser(email, flagReader) {
+export async function isGatedUser(email, flagReader) {
     const legacyFallback = () => typeof email === "string" && email.toLowerCase().endsWith(GATE_DOMAIN);
     const lookup = {
         defaultEmailDomains: ["getindigo.ai"],
         personEmail: email,
         fallback: legacyFallback(),
     };
-    return flagReader
-        ? resolveFlagGate(flagReader, "cli.foreground-timeout-guard", lookup, legacyFallback)
-        : resolveProcessFlagGate("cli.foreground-timeout-guard", lookup, legacyFallback);
+    if (flagReader) {
+        try {
+            return flagReader.isEnabled("cli.foreground-timeout-guard", lookup);
+        }
+        catch {
+            return legacyFallback();
+        }
+    }
+    try {
+        const { resolveProcessFlagGate } = await import("../flag-registry.js");
+        return resolveProcessFlagGate("cli.foreground-timeout-guard", lookup, legacyFallback);
+    }
+    catch {
+        return legacyFallback();
+    }
 }
 /**
  * Command entry: read the PreToolUse JSON, apply the gate + short-circuits, and
  * return the exit code (0 allow / 2 block). Never throws — a parse failure or a
  * missing identity fails OPEN (allow), because a hook must not break tool calls.
  */
-export function timeoutGuardCommand(stdin, deps = {}) {
+export async function timeoutGuardCommand(stdin, deps = {}) {
     const env = deps.env ?? process.env;
     const err = deps.stderr ?? process.stderr;
     let payload;
@@ -201,15 +216,15 @@ export function timeoutGuardCommand(stdin, deps = {}) {
         return 0;
     if (/(^|\s)HQ_ALLOW_LONG_FOREGROUND=1(\s|$)/.test(command))
         return 0;
-    // Rollout gate: only act for @getindigo.ai identities.
-    const getEmail = deps.getEmail ?? defaultEmail;
-    if (!isGatedUser(getEmail(), deps.flagReader))
-        return 0;
     const runInBackground = ti.run_in_background === true;
     const toolTimeoutMs = typeof ti.timeout === "number" ? ti.timeout : undefined;
     const verdict = evaluateTimeoutGuard({ command, toolTimeoutMs, runInBackground });
     if (!verdict.block)
         return 0;
+    // Rollout gate: only act for @getindigo.ai identities.
+    const getEmail = deps.getEmail ?? defaultEmail;
+    if (!await isGatedUser(await getEmail(), deps.flagReader))
+        return 0;
     err.write(`${BLOCK_MESSAGE(verdict.reason ?? "declared timeout exceeds the harness ceiling")}\n`);
     return 2;
 }

package/dist/lib/daemon/catalog.d.ts

@@ -54,6 +54,13 @@ export interface UnitPlan {
     command: UnitCommand | null;
     env: Record<string, string>;
     blocked?: UnitBlock;
+    /**
+     * Signal that asks the unit to finish its current work and exit, used when a
+     * new daemon replaces it after a CLI update. Without one it gets SIGTERM.
+     */
+    drainSignal?: "SIGUSR2";
+    /** A new CLI version alone does not restart this unit; it restarts itself when idle. */
+    keepAcrossCliUpdates?: true;
 }
 export interface PlanContext {
     machineType: MachineType;

package/dist/lib/daemon/catalog.js

@@ -183,6 +183,8 @@ function planService(service, ctx) {
                 description: `runs the local bot ${name}`,
                 restart: "on-failure",
                 command: { type: "hq", args: ["bot", "run", name] },
+                // A bot drains on SIGUSR2: running turns finish, then it exits.
+                drainSignal: "SIGUSR2",
             }));
         }
         case "session-host":
@@ -267,6 +269,8 @@ function planService(service, ctx) {
                         type: "hq",
                         args: ["daemon", "service", "codex-remote-control", "--script", script ?? "", "--codex", ctx.codexPath ?? ""],
                     },
+                    // Restarting the host ends the tmux session people are using.
+                    keepAcrossCliUpdates: true,
                     env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},
                     blocked: firstBlock([
                         [!script, `this machine has no Codex remote-control runner (${CODEX_RUNNER_SCRIPT})`],
@@ -290,6 +294,8 @@ function planService(service, ctx) {
                 base(service, {
                     command: { type: "hq", args },
                     env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},
+                    // Restarting the host ends the tmux session people are using.
+                    keepAcrossCliUpdates: true,
                     blocked: firstBlock([
                         [!ctx.claudePath, "the claude CLI is not installed"],
                         [!ctx.tmuxPath, "tmux is not installed (remote control runs Claude inside tmux)"],

package/dist/lib/daemon/flag.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Feature flags read by the daemon. The daemon runs for weeks, so each read
+ * asks the registry again instead of holding a per-process answer, and it
+ * reads as off unless the registry itself says on (or a local override does).
+ */
+import { type FlagClientOptions, type FlagResolution } from "@indigoai-us/hq-flags-client";
+/** Outposts hand running services to the next daemon on a CLI update instead of restarting them all. */
+export declare const SUPERVISOR_HANDOFF_FLAG = "daemon.supervisor-handoff";
+export interface DaemonFlagClient {
+    ready(): Promise<void>;
+    explain(flagKey: string, options?: {
+        fallback?: boolean;
+    }): FlagResolution;
+    close(): void;
+}
+export interface ReadDaemonFlagOptions {
+    env?: NodeJS.ProcessEnv;
+    createClient?: (options: FlagClientOptions) => DaemonFlagClient;
+    getToken?: () => Promise<string>;
+    onError?: (error: unknown) => void;
+}
+export declare function readDaemonFlag(flagKey: string, options?: ReadDaemonFlagOptions): Promise<boolean>;
+//# sourceMappingURL=flag.d.ts.map

package/dist/lib/daemon/flag.js

@@ -0,0 +1,57 @@
+/**
+ * Feature flags read by the daemon. The daemon runs for weeks, so each read
+ * asks the registry again instead of holding a per-process answer, and it
+ * reads as off unless the registry itself says on (or a local override does).
+ */
+import { createFlagClient, readLocalOverride, } from "@indigoai-us/hq-flags-client";
+import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
+import { resolveFlagRegistryEndpoint } from "../flag-registry-endpoint.js";
+import { resolveProcessFlagCompanyContext } from "../flag-registry.js";
+/** Outposts hand running services to the next daemon on a CLI update instead of restarting them all. */
+export const SUPERVISOR_HANDOFF_FLAG = "daemon.supervisor-handoff";
+const READ_TIMEOUT_MS = 5_000;
+export async function readDaemonFlag(flagKey, options = {}) {
+    const env = options.env ?? process.env;
+    const override = readLocalOverride(flagKey, env);
+    if (override !== null)
+        return override;
+    let failed = false;
+    const onError = (error) => {
+        failed = true;
+        options.onError?.(error);
+    };
+    let client;
+    try {
+        const company = resolveProcessFlagCompanyContext(env);
+        // Signed out reads as off without reaching the registry.
+        const token = await (options.getToken ?? (() => ensureCognitoIdToken({ interactive: false })))();
+        if (typeof token !== "string" || token.trim() === "")
+            return false;
+        client = (options.createClient ?? createFlagClient)({
+            endpoint: resolveFlagRegistryEndpoint(undefined, env),
+            getToken: () => token,
+            env: {},
+            refreshIntervalMs: 0,
+            requestTimeoutMs: READ_TIMEOUT_MS,
+            ...(company.companyUid ? { companyUid: company.companyUid } : {}),
+            ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
+            onError,
+        });
+        await client.ready();
+        const resolution = client.explain(flagKey, { fallback: false });
+        return !failed && resolution.source === "snapshot" && resolution.value === true;
+    }
+    catch (error) {
+        onError(error);
+        return false;
+    }
+    finally {
+        try {
+            client?.close();
+        }
+        catch {
+            // closing a one-shot client cannot change the answer
+        }
+    }
+}
+//# sourceMappingURL=flag.js.map

package/dist/lib/daemon/install.js

@@ -61,6 +61,11 @@ function serviceHost(host) {
  * Output goes to the journal: an `append:` log file would be created by
  * systemd as root inside the user's home, and the daemon (running as the user)
  * writes its own logs under ~/.hq/daemon/logs.
+ *
+ * `KillMode=process`: systemd signals only the daemon. The daemon stops its
+ * services itself on SIGTERM, and after a CLI update it can leave them running
+ * for the next daemon to adopt (see succession.ts). A daemon that starts and
+ * finds services it did not adopt stops them first.
  */
 function renderSystemdSystemUnit(host, user, userHome) {
     const exec = [host.nodeBinary, host.hqBinary, "daemon", "run", "--managed"].map(shellQuote).join(" ");
@@ -87,7 +92,7 @@ ExecStart=${exec}
 WorkingDirectory=${userHome}
 Restart=always
 RestartSec=10
-KillMode=control-group
+KillMode=process
 TimeoutStopSec=20
 ${envLines}
 

package/dist/lib/daemon/remote-control.d.ts

@@ -31,6 +31,12 @@ export declare function remoteControlArgs(opts: {
  * (`--name outpost-1-2`), so taking the runner over keeps the name people see.
  */
 export declare function runnerSessionName(script: string): string | null;
+/**
+ * Fingerprint of what a host runs: the tool first, then other installs it
+ * depends on (the hq-cli package). Null while the tool cannot be read; an
+ * unreadable extra install is left out rather than hiding a tool update.
+ */
+export declare function installFingerprint(paths: readonly string[], fingerprint: (file: string) => string | null): string | null;
 /** A tool updated on disk restarts its session once quiet this long... */
 export declare const IDLE_BEFORE_RESTART_MS: number;
 /** ...or after this long, however busy the session is. */