@indigoai-us/hq-cli 5.275.0 → 5.277.0

package/dist/lib/core-utils/timeout-guard.js

@@ -20,9 +20,6 @@
  *
  * Exit codes: 0 = allow, 2 = block.
  */
-import { loadCachedTokens } from "@indigoai-us/hq-cloud";
-import { peekIdToken } from "../../utils/id-token.js";
-import { resolveFlagGate, resolveProcessFlagGate, } from "../flag-registry.js";
 // Observed Claude Code Bash-tool bounds. The tool `timeout` (ms) raises the
 // deadline up to the max; with none declared the default applies.
 const HARNESS_DEFAULT_MS = 120_000; // 2 min
@@ -153,8 +150,14 @@ supervise yourself.)
 
 Policy: hq-foreground-timeout-killed-by-harness-deadline.
 Bypass for one sanctioned foreground run: prefix HQ_ALLOW_LONG_FOREGROUND=1.`;
-function defaultEmail() {
+async function defaultEmail() {
     try {
+        // The cached identity is needed only for commands that would otherwise
+        // block. Keep hq-cloud and the JWT decoder out of the common allow path.
+        const [{ loadCachedTokens }, { peekIdToken }] = await Promise.all([
+            import("@indigoai-us/hq-cloud"),
+            import("../../utils/id-token.js"),
+        ]);
         const cached = loadCachedTokens();
         if (!cached)
             return undefined;
@@ -166,23 +169,35 @@ function defaultEmail() {
     }
 }
 /** Whether the guard is active for this identity (rollout gate). */
-export function isGatedUser(email, flagReader) {
+export async function isGatedUser(email, flagReader) {
     const legacyFallback = () => typeof email === "string" && email.toLowerCase().endsWith(GATE_DOMAIN);
     const lookup = {
         defaultEmailDomains: ["getindigo.ai"],
         personEmail: email,
         fallback: legacyFallback(),
     };
-    return flagReader
-        ? resolveFlagGate(flagReader, "cli.foreground-timeout-guard", lookup, legacyFallback)
-        : resolveProcessFlagGate("cli.foreground-timeout-guard", lookup, legacyFallback);
+    if (flagReader) {
+        try {
+            return flagReader.isEnabled("cli.foreground-timeout-guard", lookup);
+        }
+        catch {
+            return legacyFallback();
+        }
+    }
+    try {
+        const { resolveProcessFlagGate } = await import("../flag-registry.js");
+        return resolveProcessFlagGate("cli.foreground-timeout-guard", lookup, legacyFallback);
+    }
+    catch {
+        return legacyFallback();
+    }
 }
 /**
  * Command entry: read the PreToolUse JSON, apply the gate + short-circuits, and
  * return the exit code (0 allow / 2 block). Never throws — a parse failure or a
  * missing identity fails OPEN (allow), because a hook must not break tool calls.
  */
-export function timeoutGuardCommand(stdin, deps = {}) {
+export async function timeoutGuardCommand(stdin, deps = {}) {
     const env = deps.env ?? process.env;
     const err = deps.stderr ?? process.stderr;
     let payload;
@@ -201,15 +216,15 @@ export function timeoutGuardCommand(stdin, deps = {}) {
         return 0;
     if (/(^|\s)HQ_ALLOW_LONG_FOREGROUND=1(\s|$)/.test(command))
         return 0;
-    // Rollout gate: only act for @getindigo.ai identities.
-    const getEmail = deps.getEmail ?? defaultEmail;
-    if (!isGatedUser(getEmail(), deps.flagReader))
-        return 0;
     const runInBackground = ti.run_in_background === true;
     const toolTimeoutMs = typeof ti.timeout === "number" ? ti.timeout : undefined;
     const verdict = evaluateTimeoutGuard({ command, toolTimeoutMs, runInBackground });
     if (!verdict.block)
         return 0;
+    // Rollout gate: only act for @getindigo.ai identities.
+    const getEmail = deps.getEmail ?? defaultEmail;
+    if (!await isGatedUser(await getEmail(), deps.flagReader))
+        return 0;
     err.write(`${BLOCK_MESSAGE(verdict.reason ?? "declared timeout exceeds the harness ceiling")}\n`);
     return 2;
 }

package/dist/lib/daemon/catalog.d.ts

@@ -10,6 +10,8 @@
  * them instead of silently dropping them.
  */
 import type { MachineType } from "./machine-type.js";
+import type { SyncOwner } from "./config.js";
+import { type SyncRunnerProcess } from "./sync-runner.js";
 export declare const SERVICE_NAMES: readonly ["sync", "mesh", "heartbeat", "inbox", "bots", "remote-control", "codex-remote-control", "session-host", "lanes-reconcile", "search-index", "jobs-reconcile", "updater", "housekeeping"];
 export type ServiceName = (typeof SERVICE_NAMES)[number];
 export declare function isServiceName(value: unknown): value is ServiceName;
@@ -51,6 +53,8 @@ export interface UnitPlan {
     restart: "always" | "on-failure";
     intervalSec?: number;
     initialDelaySec?: number;
+    /** Kill and restart this child after silence on its liveness stream. */
+    heartbeatTimeoutMs?: number;
     command: UnitCommand | null;
     env: Record<string, string>;
     blocked?: UnitBlock;
@@ -75,11 +79,23 @@ export interface PlanContext {
     sessionHostRunnerPath: string | null;
     /** Environment retained from legacy outpost sync systemd drop-ins. */
     legacySyncEnv: Record<string, string>;
+    /** Keep the local sync runner stopped until the operator resumes it. */
+    syncPaused: boolean;
+    /** Persisted/effective owner selected for this machine. */
+    syncOwner: SyncOwner;
+    /** A legacy desktop app or sync unit is still managing sync. */
+    desktopAppManagesSync: boolean;
+    /** Full process list, or null when the daemon could not read it. */
+    syncRunnerProcesses: readonly SyncRunnerProcess[] | null;
+    /** PID recorded in the watch-owner status, when it is readable. */
+    syncRunnerOwnerPid: number | null;
+    /** Sync runner children already started by this daemon before their lease is written. */
+    daemonSyncRunnerPids?: ReadonlySet<number>;
+    /** The protocol-event heartbeat watchdog timeout for the sync runner. */
+    syncHeartbeatTimeoutMs: number;
     signedIn: boolean;
     /** ~/.hq-agent/kit.json exists. */
     kitConfigured: boolean;
-    /** The HQ desktop app runs its own sync on this machine. */
-    desktopAppManagesSync: boolean;
     bots: readonly string[];
     /** Name of a pre-daemon unit that still runs this unit id, or null. */
     legacyOwner: (unitId: string) => string | null;

package/dist/lib/daemon/catalog.js

@@ -9,6 +9,7 @@
  * with no entrypoint yet stay in the catalog as `unavailable` so status shows
  * them instead of silently dropping them.
  */
+import { SYNC_RUNNER_OWNER, syncRunnerUnleasedBlockReason } from "./sync-runner.js";
 export const SERVICE_NAMES = [
     "sync",
     "mesh",
@@ -127,14 +128,29 @@ function planService(service, ctx) {
                 command: {
                     type: "node",
                     script: ctx.syncRunnerPath,
-                    args: ["--companies", "--direction", "both", "--on-conflict", "keep", "--hq-root", ctx.hqRoot ?? "", "--watch", "--event-push"],
+                    args: ["--companies", "--direction", "both", "--on-conflict", "keep", "--hq-root", ctx.hqRoot ?? "", "--watch", "--event-push", "--owner", SYNC_RUNNER_OWNER],
                 },
                 env: { ...ctx.legacySyncEnv },
+                heartbeatTimeoutMs: ctx.syncHeartbeatTimeoutMs,
             });
+            let ownerBlock;
+            if (ctx.machineType === "desktop" && ctx.syncOwner === "desktop-app" && ctx.desktopAppManagesSync) {
+                ownerBlock = "the desktop app is still managing sync (run `hq daemon sync take-ownership` after it stops its runner)";
+            }
+            else if (ctx.machineType === "desktop" &&
+                ctx.syncOwner === "daemon" &&
+                !ctx.syncPaused &&
+                ctx.hqRoot &&
+                ctx.signedIn) {
+                ownerBlock = ctx.syncRunnerProcesses === null
+                    ? "could not check for an existing sync runner; waiting to avoid starting a duplicate"
+                    : syncRunnerUnleasedBlockReason(ctx.hqRoot, ctx.syncRunnerProcesses, ctx.syncRunnerOwnerPid, ctx.platform, ctx.daemonSyncRunnerPids);
+            }
             unit.blocked = firstBlock([
-                [ctx.desktopAppManagesSync, "the HQ desktop app is handling sync on this machine"],
+                [ctx.syncPaused, "sync is paused (run `hq daemon sync resume`)"],
                 [!ctx.hqRoot, NO_HQ_ROOT],
                 [!ctx.signedIn, NOT_SIGNED_IN],
+                [!!ownerBlock, ownerBlock ?? ""],
             ]);
             return [unit];
         }

package/dist/lib/daemon/config.d.ts

@@ -12,11 +12,17 @@ export interface DaemonConfig {
     hqRoot?: string;
     /** Exact hq-cloud package version preferred by this daemon, including prereleases. */
     hqCloudVersion?: string;
+    /** Persisted machine-local sync pause. */
+    syncPaused?: boolean;
+    /** Explicit desktop handoff; absent values preserve the legacy per-machine owner. */
+    syncOwner?: SyncOwner;
     /** Services turned on here beyond the machine type's defaults. */
     enable: string[];
     /** Default services turned off here. */
     disable: string[];
 }
+export type SyncOwner = "daemon" | "desktop-app";
+export declare function effectiveSyncOwner(config: Pick<DaemonConfig, "syncOwner">, machineType: MachineType): SyncOwner;
 export declare function emptyDaemonConfig(): DaemonConfig;
 export declare function readDaemonConfig(file: string): DaemonConfig;
 export declare function writeDaemonConfig(file: string, config: DaemonConfig): void;

package/dist/lib/daemon/config.js

@@ -10,8 +10,11 @@ import { valid as validSemver } from "semver";
 import { isServiceName } from "./catalog.js";
 import { isMachineType } from "./machine-type.js";
 import { ensurePrivateDir } from "./paths.js";
+export function effectiveSyncOwner(config, machineType) {
+    return config.syncOwner ?? (machineType === "desktop" ? "desktop-app" : "daemon");
+}
 export function emptyDaemonConfig() {
-    return { version: 1, enable: [], disable: [] };
+    return { version: 1, syncPaused: false, enable: [], disable: [] };
 }
 function stringList(value) {
     return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
@@ -36,9 +39,16 @@ export function readDaemonConfig(file) {
     if (!raw || typeof raw !== "object")
         throw new Error(`hq daemon config at ${file} is not a JSON object`);
     const obj = raw;
-    const config = { version: 1, enable: stringList(obj.enable), disable: stringList(obj.disable) };
+    const config = {
+        version: 1,
+        syncPaused: obj.syncPaused === true,
+        enable: stringList(obj.enable),
+        disable: stringList(obj.disable),
+    };
     if (isMachineType(obj.machineType))
         config.machineType = obj.machineType;
+    if (obj.syncOwner === "daemon" || obj.syncOwner === "desktop-app")
+        config.syncOwner = obj.syncOwner;
     if (typeof obj.hqRoot === "string" && obj.hqRoot.trim())
         config.hqRoot = obj.hqRoot;
     if (typeof obj.hqCloudVersion === "string" && validSemver(obj.hqCloudVersion) === obj.hqCloudVersion) {
@@ -56,6 +66,9 @@ export function writeDaemonConfig(file, config) {
         ordered.hqRoot = config.hqRoot;
     if (config.hqCloudVersion)
         ordered.hqCloudVersion = config.hqCloudVersion;
+    ordered.syncPaused = config.syncPaused === true;
+    if (config.syncOwner)
+        ordered.syncOwner = config.syncOwner;
     ordered.enable = config.enable;
     ordered.disable = config.disable;
     fs.writeFileSync(tmp, `${JSON.stringify(ordered, null, 2)}\n`, { mode: 0o600 });

package/dist/lib/daemon/requests.d.ts

@@ -15,6 +15,10 @@ export type ControlRequest = {
     action: "stop";
     unit: string;
 }
+/** Re-read persisted configuration and apply any changed blocks immediately. */
+ | {
+    action: "reconcile";
+}
 /** Restart the whole daemon, for example after the updater installed a new CLI. */
  | {
     action: "restart-daemon";

package/dist/lib/daemon/requests.js

@@ -19,6 +19,8 @@ function isControlRequest(value) {
         return typeof v.unit === "string";
     if (v.action === "restart-daemon")
         return true;
+    if (v.action === "reconcile")
+        return true;
     return false;
 }
 // Orders requests written by one process within the same millisecond; the

package/dist/lib/daemon/run.js

@@ -17,7 +17,7 @@ import { agentKitPaths } from "../agent-kit/paths.js";
 import { readBotConfig } from "../bot/config.js";
 import { botsRoot } from "../bot/paths.js";
 import { CLAUDE_RUNNER_SCRIPT, CODEX_RUNNER_SCRIPT, enabledServices, planUnits } from "./catalog.js";
-import { readDaemonConfig } from "./config.js";
+import { effectiveSyncOwner, readDaemonConfig } from "./config.js";
 import { SUPERVISOR_HANDOFF_FLAG, readDaemonFlag } from "./flag.js";
 import { findLegacyUnits, legacyOwnerLookup } from "./legacy.js";
 import { readLegacySyncEnv } from "./legacy-sync-env.js";
@@ -29,6 +29,7 @@ import { takeControlRequests } from "./requests.js";
 import { currentHqCloud, hqCloudRunners } from "./hq-cloud.js";
 import { runnerSessionName } from "./remote-control.js";
 import { adoptChild, createChildTracker, finishSuccession, handoffEligible, readProcStart, stopOrphans, successionPaths, systemdKillMode, takeSuccession, writeHandoff, } from "./succession.js";
+import { listSyncRunnerProcesses, readWatchRunnerOwnerStatus, syncHeartbeatTimeoutMs, syncRunnerNodeOptions, watchRunnerOwnerStatusPath, } from "./sync-runner.js";
 import { STOP_ESCALATION_MS, createSupervisor, } from "./supervisor.js";
 import { userToolDirs } from "./tools.js";
 export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
@@ -218,7 +219,10 @@ function makeLogger(paths, foreground) {
  * an on-failure unit down. The daemon's updater handles CLI updates.
  */
 export function unitProcessEnv(base, unit) {
-    return { ...base, ...unit.env, HQ_DAEMON_UNIT: unit.id, HQ_NO_UPDATE_CHECK: "1" };
+    const env = { ...base, ...unit.env, HQ_DAEMON_UNIT: unit.id, HQ_NO_UPDATE_CHECK: "1" };
+    if (unit.service === "sync")
+        env.NODE_OPTIONS = syncRunnerNodeOptions(env);
+    return env;
 }
 export async function runDaemon(opts) {
     const env = opts.env ?? process.env;
@@ -289,10 +293,11 @@ export async function runDaemon(opts) {
         return legacyCache.units;
     };
     let warnedMissingPin = null;
+    const daemonSyncRunnerPids = new Set();
     const plan = () => {
         const config = readDaemonConfig(paths.configPath);
         const legacy = legacyUnits();
-        const configured = config.hqRoot ?? env.HQ_ROOT?.trim() ?? undefined;
+        const configured = config.hqRoot ?? (env.HQ_ROOT?.trim() || undefined);
         const hqRoot = configured && fs.existsSync(configured) ? configured : undefined;
         // Re-picked every reconcile, so a newer hq-cloud from the updater is used as soon as it lands.
         const hqCloud = currentHqCloud(paths.root);
@@ -304,7 +309,33 @@ export async function runDaemon(opts) {
             }
         }
         const runners = hqCloud ? hqCloudRunners(hqCloud.root) : { syncRunner: null, heartbeat: null, sessionHost: null };
-        return planUnits(enabledServices(machineType, config), {
+        const services = enabledServices(machineType, config);
+        const isSignedIn = signedIn(env, home, log);
+        const syncOwner = effectiveSyncOwner(config, machineType);
+        let syncRunnerProcesses = [];
+        let syncRunnerOwnerPid = null;
+        if (machineType === "desktop" &&
+            syncOwner === "daemon" &&
+            services.includes("sync") &&
+            !config.syncPaused &&
+            hqRoot &&
+            isSignedIn) {
+            const processList = listSyncRunnerProcesses(platform);
+            if (!processList.ok) {
+                syncRunnerProcesses = null;
+                log("warn", `${processList.error}; sync will wait before taking ownership`);
+            }
+            else {
+                syncRunnerProcesses = processList.processes;
+                try {
+                    syncRunnerOwnerPid = readWatchRunnerOwnerStatus(watchRunnerOwnerStatusPath(hqRoot, home, env))?.pid ?? null;
+                }
+                catch (error) {
+                    log("warn", `could not verify the sync watch-owner status: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        }
+        return planUnits(services, {
             machineType,
             platform,
             home,
@@ -313,14 +344,20 @@ export async function runDaemon(opts) {
             heartbeatRunnerPath: runners.heartbeat,
             sessionHostRunnerPath: runners.sessionHost,
             legacySyncEnv: readLegacySyncEnv(platform),
-            signedIn: signedIn(env, home, log),
+            signedIn: isSignedIn,
             kitConfigured: fs.existsSync(agentKitPaths(home, env).kitConfigPath),
+            syncPaused: config.syncPaused === true,
+            syncOwner,
             desktopAppManagesSync: desktopAppManagesSync({
                 machineType,
                 host: opts.host,
                 legacy,
                 appRunning: () => desktopAppRunning(platform),
             }),
+            syncRunnerProcesses,
+            syncRunnerOwnerPid,
+            daemonSyncRunnerPids,
+            syncHeartbeatTimeoutMs: syncHeartbeatTimeoutMs(env),
             bots: listLocalBots(),
             legacyOwner: legacyOwnerLookup(legacy),
             cliSelfUpdatable: updatable,
@@ -342,9 +379,37 @@ export async function runDaemon(opts) {
             : command.type === "node"
                 ? [opts.nodeBinary, [command.script, ...command.args]]
                 : [command.file, command.args];
-        const fd = openPrivateAppend(paths.unitLogPath(unit.id));
+        const logPath = paths.unitLogPath(unit.id);
+        const cwd = unit.env.HQ_ROOT && fs.existsSync(unit.env.HQ_ROOT) ? unit.env.HQ_ROOT : home;
+        if (unit.heartbeatTimeoutMs) {
+            // The supervisor reads this unit's protocol heartbeats from stdout, so its
+            // output goes through the daemon. A piped child cannot outlive the daemon,
+            // so it is never handed over: a handoff stops it and the next daemon
+            // starts it again.
+            const logFd = openPrivateAppend(logPath);
+            const logStream = fs.createWriteStream(logPath, { fd: logFd, autoClose: true });
+            logStream.on("error", (err) => log("error", `could not write ${unit.id} log ${logPath}: ${err.message}`));
+            const child = spawn(file, args, {
+                cwd,
+                env: unitProcessEnv(env, unit),
+                stdio: ["ignore", "pipe", "pipe"],
+                windowsHide: true,
+            });
+            spawned.add(child);
+            if (unit.service === "sync" && child.pid !== undefined)
+                daemonSyncRunnerPids.add(child.pid);
+            child.stdout?.pipe(logStream, { end: false });
+            child.stderr?.pipe(logStream, { end: false });
+            child.on("close", () => {
+                spawned.delete(child);
+                if (child.pid !== undefined)
+                    daemonSyncRunnerPids.delete(child.pid);
+                logStream.end();
+            });
+            return child;
+        }
+        const fd = openPrivateAppend(logPath);
         try {
-            const cwd = unit.env.HQ_ROOT && fs.existsSync(unit.env.HQ_ROOT) ? unit.env.HQ_ROOT : home;
             const child = spawn(file, args, {
                 cwd,
                 env: unitProcessEnv(env, unit),
@@ -352,7 +417,13 @@ export async function runDaemon(opts) {
                 windowsHide: true,
             });
             spawned.add(child);
-            child.once("exit", () => spawned.delete(child));
+            if (unit.service === "sync" && child.pid !== undefined)
+                daemonSyncRunnerPids.add(child.pid);
+            child.once("exit", () => {
+                spawned.delete(child);
+                if (child.pid !== undefined)
+                    daemonSyncRunnerPids.delete(child.pid);
+            });
             // Only long-running services are handed over; a scheduled run left behind finishes on its own.
             if (unit.kind === "long-running")
                 tracker?.track(unit.id, child);
@@ -382,6 +453,21 @@ export async function runDaemon(opts) {
         restartDaemon: () => restartDaemon(),
         writeState: (state) => writeJsonAtomic(paths.statePath, state),
         log,
+        syncOwnerBlockReason: () => {
+            const config = readDaemonConfig(paths.configPath);
+            const hqRoot = config.hqRoot ?? env.HQ_ROOT?.trim();
+            if (!hqRoot)
+                return undefined;
+            const statusPath = watchRunnerOwnerStatusPath(hqRoot, home, env);
+            try {
+                const owner = readWatchRunnerOwnerStatus(statusPath);
+                return owner ? `sync owned by ${owner.owner} pid ${owner.pid}` : undefined;
+            }
+            catch (err) {
+                log("error", `could not read sync owner status at ${statusPath}: ${err instanceof Error ? err.message : String(err)}`);
+                return undefined;
+            }
+        },
         cliVersion: CLI_VERSION,
         adopt,
     });

package/dist/lib/daemon/supervisor.d.ts

@@ -24,6 +24,7 @@
 import type { UnitPlan } from "./catalog.js";
 import type { MachineType } from "./machine-type.js";
 import type { ControlRequest } from "./requests.js";
+import { syncPassResult } from "./sync-runner.js";
 export declare const BACKOFF_BASE_MS = 1000;
 export declare const BACKOFF_MAX_MS = 60000;
 export declare const HEALTHY_RUN_MS = 60000;
@@ -34,6 +35,9 @@ export declare const HANDOFF_STAGGER_MS = 15000;
 export declare const HANDOFF_DRAIN_MAX_MS: number;
 export interface SupervisedChild {
     pid?: number;
+    stdout?: {
+        on(event: "data" | "end", handler: (chunk?: Buffer | string) => void): unknown;
+    };
     on(event: "exit", handler: (code: number | null, signal: string | null) => void): unknown;
     on(event: "error", handler: (err: Error) => void): unknown;
     kill(signal?: NodeJS.Signals | number): boolean;
@@ -57,6 +61,8 @@ export interface UnitState {
     lastRunAt?: number;
     nextRunAt?: number;
     lastResult?: "ok" | "failed";
+    lastHeartbeatAt?: string;
+    lastPassResult?: ReturnType<typeof syncPassResult>;
 }
 /** An app that runs the daemon as its own child process instead of an OS unit. */
 export type HostApp = "desktop";
@@ -99,6 +105,8 @@ export interface SupervisorDeps {
     clearTimeout?: (handle: unknown) => void;
     reconcileMs?: number;
     requestPollMs?: number;
+    /** Read hq-cloud's lease status after it exits with the lease-conflict code. */
+    syncOwnerBlockReason?: () => string | undefined;
     /** The running CLI's version; part of the key of units that run `hq` commands. */
     cliVersion?: string;
     /** Services to take over from the previous daemon instead of starting them. */

package/dist/lib/daemon/supervisor.js

@@ -21,6 +21,8 @@
  *
  * Processes, time, and state output are injected; `run.ts` wires the real ones.
  */
+import { StringDecoder } from "node:string_decoder";
+import { SYNC_RUNNER_LEASE_CONFLICT_EXIT, SYNC_RUNNER_LEASE_RETRY_MS, parseSyncRunnerProtocolLine, syncPassResult, } from "./sync-runner.js";
 export const BACKOFF_BASE_MS = 1_000;
 export const BACKOFF_MAX_MS = 60_000;
 export const HEALTHY_RUN_MS = 60_000;
@@ -39,7 +41,15 @@ export function backoffMs(attempt) {
  * `keepAcrossCliUpdates` running.
  */
 export function planKey(plan, cliVersion) {
-    const fields = [plan.kind, plan.restart, plan.intervalSec, plan.initialDelaySec, plan.command, plan.env];
+    const fields = [
+        plan.kind,
+        plan.restart,
+        plan.intervalSec,
+        plan.initialDelaySec,
+        plan.heartbeatTimeoutMs,
+        plan.command,
+        plan.env,
+    ];
     if (cliVersion !== undefined && plan.command?.type === "hq" && !plan.keepAcrossCliUpdates)
         fields.push(cliVersion);
     return JSON.stringify(fields);
@@ -89,6 +99,11 @@ export function createSupervisor(deps) {
             clearT(slot.timer);
         slot.timer = undefined;
     };
+    const clearHeartbeatTimer = (slot) => {
+        if (slot.heartbeatTimer !== undefined)
+            clearT(slot.heartbeatTimer);
+        slot.heartbeatTimer = undefined;
+    };
     const setBlocked = (slot) => {
         const block = slot.plan.blocked;
         slot.state.status = block.state;
@@ -111,6 +126,7 @@ export function createSupervisor(deps) {
      */
     const terminate = (slot, then, drain = false) => {
         clearTimer(slot);
+        clearHeartbeatTimer(slot);
         const child = slot.child;
         if (!child) {
             then?.();
@@ -163,6 +179,69 @@ export function createSupervisor(deps) {
     const watch = (slot, child) => {
         live.add(child);
         let ended = false;
+        const timeoutMs = slot.plan.heartbeatTimeoutMs;
+        const decoder = timeoutMs ? new StringDecoder("utf8") : null;
+        let stdoutRemainder = "";
+        let lastHeartbeatPersistedAt = now() - 15_000;
+        const armHeartbeatWatchdog = () => {
+            if (!timeoutMs)
+                return;
+            clearHeartbeatTimer(slot);
+            slot.heartbeatTimer = setT(() => {
+                slot.heartbeatTimer = undefined;
+                if (stopped || slot.child !== child || slot.expectingExit)
+                    return;
+                deps.log("warn", `${slot.plan.id} emitted no sync protocol heartbeat for ${timeoutMs}ms; restarting it`);
+                terminate(slot, () => scheduleRestart(slot));
+                emit();
+            }, timeoutMs);
+        };
+        const acceptProtocolLine = (line) => {
+            let event;
+            try {
+                event = parseSyncRunnerProtocolLine(line);
+            }
+            catch (err) {
+                deps.log("error", `${slot.plan.id} emitted invalid sync protocol output (${Buffer.byteLength(line)} bytes): ${errorMessage(err)}`);
+                return;
+            }
+            if (!event)
+                return;
+            const at = now();
+            slot.state.lastHeartbeatAt = new Date(at).toISOString();
+            const pass = syncPassResult(event, slot.state.lastHeartbeatAt);
+            if (pass)
+                slot.state.lastPassResult = pass;
+            armHeartbeatWatchdog();
+            if (pass || at - lastHeartbeatPersistedAt >= 15_000) {
+                lastHeartbeatPersistedAt = at;
+                emit();
+            }
+        };
+        if (decoder && child.stdout) {
+            child.stdout.on("data", (chunk) => {
+                if (chunk === undefined)
+                    return;
+                stdoutRemainder += decoder.write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                let newline = stdoutRemainder.indexOf("\n");
+                while (newline >= 0) {
+                    acceptProtocolLine(stdoutRemainder.slice(0, newline).trim());
+                    stdoutRemainder = stdoutRemainder.slice(newline + 1);
+                    newline = stdoutRemainder.indexOf("\n");
+                }
+                // A malformed or unexpectedly large line is not a heartbeat. Bound
+                // retained data so a broken child cannot grow daemon memory forever.
+                if (Buffer.byteLength(stdoutRemainder) > 1024 * 1024)
+                    stdoutRemainder = "";
+            });
+            child.stdout.on("end", () => {
+                stdoutRemainder += decoder.end();
+                if (stdoutRemainder)
+                    acceptProtocolLine(stdoutRemainder.trim());
+                stdoutRemainder = "";
+            });
+        }
+        armHeartbeatWatchdog();
         const onEnd = (code, signal) => {
             if (ended)
                 return;
@@ -173,6 +252,7 @@ export function createSupervisor(deps) {
             if (slot.child !== child)
                 return;
             slot.child = undefined;
+            clearHeartbeatTimer(slot);
             if (slot.killTimer !== undefined) {
                 clearT(slot.killTimer);
                 slot.killTimer = undefined;
@@ -200,6 +280,20 @@ export function createSupervisor(deps) {
                 emit();
                 return;
             }
+            if (slot.plan.service === "sync" && code === SYNC_RUNNER_LEASE_CONFLICT_EXIT) {
+                const reason = deps.syncOwnerBlockReason?.() ?? "sync owned by another runner";
+                slot.state.status = "waiting";
+                slot.state.reason = reason;
+                slot.state.nextRunAt = now() + SYNC_RUNNER_LEASE_RETRY_MS;
+                deps.log("info", `${reason}; retrying in ${SYNC_RUNNER_LEASE_RETRY_MS}ms`);
+                slot.timer = setT(() => {
+                    slot.timer = undefined;
+                    startLong(slot);
+                    emit();
+                }, SYNC_RUNNER_LEASE_RETRY_MS);
+                emit();
+                return;
+            }
             deps.log("warn", `${slot.plan.id} exited (code=${code ?? "null"} signal=${signal ?? "none"})`);
             if (ranFor >= HEALTHY_RUN_MS)
                 slot.attempts = 0;
@@ -505,6 +599,11 @@ export function createSupervisor(deps) {
         }
     };
     const handleRequest = (req) => {
+        if (req.action === "reconcile") {
+            deps.log("info", "reconciling daemon configuration (requested)");
+            reconcile();
+            return;
+        }
         if (req.action === "restart-daemon") {
             deps.log("info", "restarting the daemon (requested)");
             if (deps.restartDaemon)
@@ -614,6 +713,7 @@ export function createSupervisor(deps) {
                 clearT(handoffTimer);
             for (const slot of slots.values()) {
                 clearTimer(slot);
+                clearHeartbeatTimer(slot);
                 slot.child = undefined;
                 if (slot.killTimer !== undefined)
                     clearT(slot.killTimer);