@indigoai-us/hq-cli 5.276.0 → 5.277.0

package/dist/lib/checkpoint-ontology/apply.js

@@ -16,7 +16,7 @@ import { checkSyncClient, readSyncClientVersions } from "./sync-client.js";
 import { appendBackRefs, parseEntityFile, patchEntityFile, previewSignalContent, renderNewEntity, validateEntityFrontmatter, } from "./entity-file.js";
 import { canonicalizeName, entityId, isRejectedName, isWritableEntityType, normalizeEntityName, squash, toSlug, } from "./identity.js";
 import { CANDIDATES_FILE, CANDIDATES_SCHEMA, PLAN_FILE, PLAN_SCHEMA, REPORT_FILE, readLedger, writeLedger, } from "./plan.js";
-import { buildEntityIndex, indexAlias, indexEntity, listSignalFiles, readSignal } from "./tree.js";
+import { buildEntityIndex, countInboundLinks, indexAlias, indexEntity, listSignalFiles, readSignal } from "./tree.js";
 export const CAPS = {
     creates: 25,
     updates: 100,
@@ -26,6 +26,10 @@ export const CAPS = {
     nameLength: MAX_NAME_LENGTH,
 };
 export const MIN_CREATE_CONFIDENCE = 0.7;
+/** Inbound links the dominant sibling must have for each one the named entity has. */
+const DOMINANT_SIBLING_RATIO = 3;
+/** Inbound links the dominant sibling must have before a redirect. */
+const DOMINANT_SIBLING_MIN_INBOUND = 5;
 export class ApplyError extends Error {
     constructor(message) {
         super(message);
@@ -211,6 +215,7 @@ export function applyOntologyRun(options) {
         matched: 0,
         session_links: [],
         links: [],
+        ...(plan.dominant_sibling_link === true ? { dominant_sibling_redirects: [] } : {}),
         rejected: [],
         deferred: [],
         suspect_duplicates: [],
@@ -300,6 +305,44 @@ export function applyOntologyRun(options) {
             if (types.size > 1)
                 crossTypeNames.add(name);
     }
+    // checkpoint.ontology.dominant-sibling-link: cross-type names, and how many other entity files link to each.
+    const inbound = plan.dominant_sibling_link === true ? countInboundLinks(company.dir, index) : new Map();
+    const siblings = new Map();
+    if (plan.dominant_sibling_link === true) {
+        const grouped = new Map();
+        for (const entity of index.byRel.values()) {
+            const key = crossTypeKey(entity.canonical_name);
+            if (key === "")
+                continue;
+            const members = grouped.get(key) ?? [];
+            members.push({ rel: entity.rel, type: entity.type });
+            grouped.set(key, members);
+        }
+        for (const [key, members] of grouped) {
+            if (new Set(members.map((member) => member.type)).size < 2)
+                continue;
+            siblings.set(key, members.map((member) => member.rel));
+        }
+    }
+    const dominantSibling = (rel) => {
+        const group = siblings.get(crossTypeKey(index.byRel.get(rel).canonical_name));
+        if (!group)
+            return null;
+        let best = group[0];
+        for (const member of group) {
+            const count = inbound.get(member) ?? 0;
+            const bestCount = inbound.get(best) ?? 0;
+            if (count > bestCount || (count === bestCount && member.localeCompare(best) < 0))
+                best = member;
+        }
+        const relCount = inbound.get(rel) ?? 0;
+        const bestCount = inbound.get(best) ?? 0;
+        if (relCount >= bestCount)
+            return null;
+        if (bestCount >= DOMINANT_SIBLING_RATIO * relCount && bestCount >= DOMINANT_SIBLING_MIN_INBOUND)
+            return best;
+        return null;
+    };
     // checkpoint.ontology.named-evidence: the company's own company entity.
     const ownCompanyRel = `ontology/entities/company/${company.slug}.md`;
     const isOwnCompany = (entity, rel) => entity.type === "company" && (rel === ownCompanyRel || crossTypeKey(entity.canonical_name) === crossTypeKey(company.slug));
@@ -361,19 +404,33 @@ export function applyOntologyRun(options) {
                 note(report.rejected, "ambiguous_type");
                 continue;
             }
+            const redirect = input.kind === "knowledge" && plan.dominant_sibling_link === true ? dominantSibling(resolved.target) : null;
+            const targetRel = redirect ?? resolved.target;
+            const targetEntity = redirect ? index.byRel.get(targetRel) : linked;
             if (plan.named_evidence === true &&
                 input.kind === "knowledge" &&
-                isOwnCompany(linked, resolved.target) &&
+                isOwnCompany(targetEntity, targetRel) &&
                 !evidenceNames(candidate.evidence, [candidate.name, ...candidate.aliases])) {
                 note(report.rejected, "unnamed_in_evidence");
                 continue;
             }
             report.matched += 1;
-            report.links.push({ input: candidate.input, action: "link", type: linked.type, canonical_name: linked.canonical_name, path: resolved.target });
+            report.links.push({
+                input: candidate.input,
+                action: "link",
+                type: targetEntity.type,
+                canonical_name: targetEntity.canonical_name,
+                path: targetRel,
+            });
             if (resolved.tier === 1 && resolved.duplicates.length > 0) {
                 report.suspect_duplicates.push({ name: canonical, type: candidate.type, paths: [resolved.target, ...resolved.duplicates] });
+            }
+            if (redirect) {
+                report.dominant_sibling_redirects?.push({ input: candidate.input, from: resolved.target, to: targetRel });
                 continue;
             }
+            if (resolved.tier === 1 && resolved.duplicates.length > 0)
+                continue;
             // checkpoint.ontology.no-link-aliases: the link is reported and the entity file is left as it is.
             if (plan.link_aliases === false)
                 continue;

package/dist/lib/checkpoint-ontology/plan.d.ts

@@ -70,6 +70,17 @@ export declare const FIRST_NAME_PEOPLE_FLAG = "checkpoint.ontology.first-name-pe
  * to 0.803 and cost recall 0.023 on a replay of six runs.
  */
 export declare const SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG = "checkpoint.ontology.skip-ambiguous-concept-links";
+/**
+ * A knowledge link to the weaker of two entities that share a canonical name
+ * across types is redirected to the sibling other entity files link to
+ * (`project/build-your-own-agi` beside `concept/build-your-own-agi`, or
+ * `project/hq-core 2` beside `project/hq-core` when a concept also holds the
+ * name). The plan carries `dominant_sibling_link: true`, and apply reports
+ * the move in `dominant_sibling_redirects` without writing the entity files.
+ * CO-60: a replay of six runs raised knowledge precision from 0.725 to 0.754
+ * and recall from 0.784 to 0.816, and never changed a create.
+ */
+export declare const DOMINANT_SIBLING_LINK_FLAG = "checkpoint.ontology.dominant-sibling-link";
 /**
  * A knowledge concept candidate whose name is an alias of more than one
  * entity, and which apply would defer as `ambiguous_alias`, links instead to
@@ -173,6 +184,8 @@ export interface OntologyPlan {
     first_name_people?: true;
     /** Set by checkpoint.ontology.skip-ambiguous-concept-links: apply rejects a knowledge link to a concept whose name another type also holds. */
     skip_ambiguous_concept_links?: true;
+    /** Set by checkpoint.ontology.dominant-sibling-link: apply redirects a knowledge link from a weak cross-type sibling to the one other files link to. */
+    dominant_sibling_link?: true;
     /** Set by checkpoint.ontology.concept-project-link: apply links a knowledge concept with an ambiguous alias to the one project of that canonical name. */
     concept_project_link?: true;
     /** Set by checkpoint.ontology.named-evidence: apply rejects a knowledge link to the company's own entity, or a concept-project-link redirect, whose evidence does not name it as a word. */

package/dist/lib/checkpoint-ontology/plan.js

@@ -75,6 +75,17 @@ export const FIRST_NAME_PEOPLE_FLAG = "checkpoint.ontology.first-name-people";
  * to 0.803 and cost recall 0.023 on a replay of six runs.
  */
 export const SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG = "checkpoint.ontology.skip-ambiguous-concept-links";
+/**
+ * A knowledge link to the weaker of two entities that share a canonical name
+ * across types is redirected to the sibling other entity files link to
+ * (`project/build-your-own-agi` beside `concept/build-your-own-agi`, or
+ * `project/hq-core 2` beside `project/hq-core` when a concept also holds the
+ * name). The plan carries `dominant_sibling_link: true`, and apply reports
+ * the move in `dominant_sibling_redirects` without writing the entity files.
+ * CO-60: a replay of six runs raised knowledge precision from 0.725 to 0.754
+ * and recall from 0.784 to 0.816, and never changed a create.
+ */
+export const DOMINANT_SIBLING_LINK_FLAG = "checkpoint.ontology.dominant-sibling-link";
 /**
  * A knowledge concept candidate whose name is an alias of more than one
  * entity, and which apply would defer as `ambiguous_alias`, links instead to
@@ -305,6 +316,7 @@ export async function planOntologyRun(options) {
     const noLinkAliases = await options.readFlag(NO_LINK_ALIASES_FLAG, company);
     const firstNamePeople = await options.readFlag(FIRST_NAME_PEOPLE_FLAG, company);
     const skipAmbiguousConceptLinks = await options.readFlag(SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG, company);
+    const dominantSiblingLink = await options.readFlag(DOMINANT_SIBLING_LINK_FLAG, company);
     const conceptProjectLink = await options.readFlag(CONCEPT_PROJECT_LINK_FLAG, company);
     const namedEvidence = await options.readFlag(NAMED_EVIDENCE_FLAG, company);
     const queuedTouchesOn = borrowed || (await options.readFlag(QUEUED_TOUCHES_FLAG, company));
@@ -428,6 +440,7 @@ export async function planOntologyRun(options) {
         ...(noLinkAliases ? { link_aliases: false } : {}),
         ...(firstNamePeople ? { first_name_people: true } : {}),
         ...(skipAmbiguousConceptLinks ? { skip_ambiguous_concept_links: true } : {}),
+        ...(dominantSiblingLink ? { dominant_sibling_link: true } : {}),
         ...(conceptProjectLink ? { concept_project_link: true } : {}),
         ...(namedEvidence ? { named_evidence: true } : {}),
         inputs,

package/dist/lib/checkpoint-ontology/tree.d.ts

@@ -36,6 +36,8 @@ export declare function indexAlias(index: EntityIndex, type: string, rel: string
  * type conflict, but they are never written.
  */
 export declare function buildEntityIndex(companyDir: string): EntityIndex;
+/** Entity path → number of other entity files whose body links to it. */
+export declare function countInboundLinks(companyDir: string, index: EntityIndex): Map<string, number>;
 export interface SignalRecord {
     /** Company-relative path, `signals/<type>/<file>.md`. */
     rel: string;

package/dist/lib/checkpoint-ontology/tree.js

@@ -90,6 +90,40 @@ export function buildEntityIndex(companyDir) {
     }
     return index;
 }
+// Spaces are allowed in the target, as merge-copies writes `../person/jane-doe 2.md`.
+const INBOUND_LINK = /\]\(([^)\n]+?\.md)(?:#[^)\n]*)?\)/g;
+/** Entity path → number of other entity files whose body links to it. */
+export function countInboundLinks(companyDir, index) {
+    const counts = new Map();
+    for (const rel of index.byRel.keys())
+        counts.set(rel, 0);
+    for (const rel of index.byRel.keys()) {
+        const parsed = parseEntityFile(fs.readFileSync(path.join(companyDir, rel), "utf8"));
+        if (!parsed)
+            continue;
+        const seen = new Set();
+        for (const match of parsed.body.matchAll(INBOUND_LINK)) {
+            const target = match[1];
+            if (target.startsWith("http:") || target.startsWith("https:") || target.startsWith("mailto:"))
+                continue;
+            let decoded = target;
+            try {
+                decoded = decodeURI(target);
+            }
+            catch (error) {
+                if (!(error instanceof URIError))
+                    throw error;
+            }
+            const resolved = path.posix.normalize(path.posix.join(path.posix.dirname(rel), decoded));
+            if (resolved === rel || !index.byRel.has(resolved))
+                continue;
+            seen.add(resolved);
+        }
+        for (const targetRel of seen)
+            counts.set(targetRel, (counts.get(targetRel) ?? 0) + 1);
+    }
+    return counts;
+}
 /** Parse the frontmatter of one company-audience signal file. */
 export function readSignal(companyDir, rel) {
     let content;

package/dist/lib/core-utils/jq-json-serializer.d.ts

@@ -0,0 +1,5 @@
+/** JSON output formats used by the scaffold scripts that previously called jq. */
+export type JqJsonOutput = "compact" | "raw" | "pretty";
+/** Serialize one jq result, including jq's output newline. */
+export declare function serializeJqJson(value: unknown, output?: JqJsonOutput): string;
+//# sourceMappingURL=jq-json-serializer.d.ts.map

package/dist/lib/core-utils/jq-json-serializer.js

@@ -0,0 +1,10 @@
+/** Serialize one jq result, including jq's output newline. */
+export function serializeJqJson(value, output = "pretty") {
+    if (output === "raw" && typeof value === "string")
+        return `${value}\n`;
+    const serialized = output === "compact"
+        ? JSON.stringify(value)
+        : JSON.stringify(value, null, 2);
+    return serialized === undefined ? "" : `${serialized.replace(/\u007f/g, "\\u007f")}\n`;
+}
+//# sourceMappingURL=jq-json-serializer.js.map

package/dist/lib/core-utils/secret-patterns.d.ts

@@ -0,0 +1,41 @@
+/** Shared secret detector patterns mirrored from the scaffold shell library. */
+export declare const SECRET_PATTERN_BOUNDARY = "(^|[^a-zA-Z0-9])";
+export declare const SECRET_PATTERNS: readonly [{
+    readonly pattern: "sk-[a-zA-Z0-9._-]{20,}";
+    readonly name: "OpenAI/Stripe key";
+}, {
+    readonly pattern: "ghp_[a-zA-Z0-9]{36,}";
+    readonly name: "GitHub PAT";
+}, {
+    readonly pattern: "AKIA[0-9A-Z]{16}";
+    readonly name: "AWS access key";
+}, {
+    readonly pattern: "xox[bpsa]-[a-zA-Z0-9-]+";
+    readonly name: "Slack token";
+}, {
+    readonly pattern: "Bearer [a-zA-Z0-9._-]{20,}";
+    readonly name: "Bearer token";
+}, {
+    readonly pattern: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----";
+    readonly name: "Private key";
+}, {
+    readonly pattern: "glpat-[a-zA-Z0-9_-]{20,}";
+    readonly name: "GitLab PAT";
+}, {
+    readonly pattern: "gho_[a-zA-Z0-9]{36,}";
+    readonly name: "GitHub OAuth token";
+}, {
+    readonly pattern: "github_pat_[a-zA-Z0-9_]{22,}";
+    readonly name: "Fine-grained GitHub PAT";
+}, {
+    readonly pattern: "eyJ[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{10,}";
+    readonly name: "JWT";
+}];
+/** Return the pattern names that match, in the shell library's declared order. */
+export declare function matchingSecretPatterns(value: string): string[];
+/** Print only pattern names and paths; never include matched file content. */
+export declare function scanSecretFiles(files: readonly string[]): {
+    code: 0 | 1;
+    hits: string[];
+};
+//# sourceMappingURL=secret-patterns.d.ts.map

package/dist/lib/core-utils/secret-patterns.js

@@ -0,0 +1,33 @@
+/** Shared secret detector patterns mirrored from the scaffold shell library. */
+import * as fs from "node:fs";
+export const SECRET_PATTERN_BOUNDARY = "(^|[^a-zA-Z0-9])";
+export const SECRET_PATTERNS = [
+    { pattern: "sk-[a-zA-Z0-9._-]{20,}", name: "OpenAI/Stripe key" },
+    { pattern: "ghp_[a-zA-Z0-9]{36,}", name: "GitHub PAT" },
+    { pattern: "AKIA[0-9A-Z]{16}", name: "AWS access key" },
+    { pattern: "xox[bpsa]-[a-zA-Z0-9-]+", name: "Slack token" },
+    { pattern: "Bearer [a-zA-Z0-9._-]{20,}", name: "Bearer token" },
+    { pattern: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----", name: "Private key" },
+    { pattern: "glpat-[a-zA-Z0-9_-]{20,}", name: "GitLab PAT" },
+    { pattern: "gho_[a-zA-Z0-9]{36,}", name: "GitHub OAuth token" },
+    { pattern: "github_pat_[a-zA-Z0-9_]{22,}", name: "Fine-grained GitHub PAT" },
+    { pattern: "eyJ[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{10,}", name: "JWT" },
+];
+/** Return the pattern names that match, in the shell library's declared order. */
+export function matchingSecretPatterns(value) {
+    return SECRET_PATTERNS.flatMap(({ pattern, name }) => new RegExp(`${SECRET_PATTERN_BOUNDARY}${pattern}`).test(value) ? [name] : []);
+}
+/** Print only pattern names and paths; never include matched file content. */
+export function scanSecretFiles(files) {
+    const hits = [];
+    for (const file of files) {
+        if (!fs.existsSync(file) || !fs.statSync(file).isFile())
+            continue;
+        const contents = fs.readFileSync(file, "utf8");
+        for (const name of matchingSecretPatterns(contents)) {
+            hits.push(`secret-scan: pattern '${name}' matched in ${file}`);
+        }
+    }
+    return { code: hits.length > 0 ? 1 : 0, hits };
+}
+//# sourceMappingURL=secret-patterns.js.map

package/dist/lib/daemon/catalog.d.ts

@@ -10,6 +10,8 @@
  * them instead of silently dropping them.
  */
 import type { MachineType } from "./machine-type.js";
+import type { SyncOwner } from "./config.js";
+import { type SyncRunnerProcess } from "./sync-runner.js";
 export declare const SERVICE_NAMES: readonly ["sync", "mesh", "heartbeat", "inbox", "bots", "remote-control", "codex-remote-control", "session-host", "lanes-reconcile", "search-index", "jobs-reconcile", "updater", "housekeeping"];
 export type ServiceName = (typeof SERVICE_NAMES)[number];
 export declare function isServiceName(value: unknown): value is ServiceName;
@@ -51,6 +53,8 @@ export interface UnitPlan {
     restart: "always" | "on-failure";
     intervalSec?: number;
     initialDelaySec?: number;
+    /** Kill and restart this child after silence on its liveness stream. */
+    heartbeatTimeoutMs?: number;
     command: UnitCommand | null;
     env: Record<string, string>;
     blocked?: UnitBlock;
@@ -75,11 +79,23 @@ export interface PlanContext {
     sessionHostRunnerPath: string | null;
     /** Environment retained from legacy outpost sync systemd drop-ins. */
     legacySyncEnv: Record<string, string>;
+    /** Keep the local sync runner stopped until the operator resumes it. */
+    syncPaused: boolean;
+    /** Persisted/effective owner selected for this machine. */
+    syncOwner: SyncOwner;
+    /** A legacy desktop app or sync unit is still managing sync. */
+    desktopAppManagesSync: boolean;
+    /** Full process list, or null when the daemon could not read it. */
+    syncRunnerProcesses: readonly SyncRunnerProcess[] | null;
+    /** PID recorded in the watch-owner status, when it is readable. */
+    syncRunnerOwnerPid: number | null;
+    /** Sync runner children already started by this daemon before their lease is written. */
+    daemonSyncRunnerPids?: ReadonlySet<number>;
+    /** The protocol-event heartbeat watchdog timeout for the sync runner. */
+    syncHeartbeatTimeoutMs: number;
     signedIn: boolean;
     /** ~/.hq-agent/kit.json exists. */
     kitConfigured: boolean;
-    /** The HQ desktop app runs its own sync on this machine. */
-    desktopAppManagesSync: boolean;
     bots: readonly string[];
     /** Name of a pre-daemon unit that still runs this unit id, or null. */
     legacyOwner: (unitId: string) => string | null;

package/dist/lib/daemon/catalog.js

@@ -9,6 +9,7 @@
  * with no entrypoint yet stay in the catalog as `unavailable` so status shows
  * them instead of silently dropping them.
  */
+import { SYNC_RUNNER_OWNER, syncRunnerUnleasedBlockReason } from "./sync-runner.js";
 export const SERVICE_NAMES = [
     "sync",
     "mesh",
@@ -127,14 +128,29 @@ function planService(service, ctx) {
                 command: {
                     type: "node",
                     script: ctx.syncRunnerPath,
-                    args: ["--companies", "--direction", "both", "--on-conflict", "keep", "--hq-root", ctx.hqRoot ?? "", "--watch", "--event-push"],
+                    args: ["--companies", "--direction", "both", "--on-conflict", "keep", "--hq-root", ctx.hqRoot ?? "", "--watch", "--event-push", "--owner", SYNC_RUNNER_OWNER],
                 },
                 env: { ...ctx.legacySyncEnv },
+                heartbeatTimeoutMs: ctx.syncHeartbeatTimeoutMs,
             });
+            let ownerBlock;
+            if (ctx.machineType === "desktop" && ctx.syncOwner === "desktop-app" && ctx.desktopAppManagesSync) {
+                ownerBlock = "the desktop app is still managing sync (run `hq daemon sync take-ownership` after it stops its runner)";
+            }
+            else if (ctx.machineType === "desktop" &&
+                ctx.syncOwner === "daemon" &&
+                !ctx.syncPaused &&
+                ctx.hqRoot &&
+                ctx.signedIn) {
+                ownerBlock = ctx.syncRunnerProcesses === null
+                    ? "could not check for an existing sync runner; waiting to avoid starting a duplicate"
+                    : syncRunnerUnleasedBlockReason(ctx.hqRoot, ctx.syncRunnerProcesses, ctx.syncRunnerOwnerPid, ctx.platform, ctx.daemonSyncRunnerPids);
+            }
             unit.blocked = firstBlock([
-                [ctx.desktopAppManagesSync, "the HQ desktop app is handling sync on this machine"],
+                [ctx.syncPaused, "sync is paused (run `hq daemon sync resume`)"],
                 [!ctx.hqRoot, NO_HQ_ROOT],
                 [!ctx.signedIn, NOT_SIGNED_IN],
+                [!!ownerBlock, ownerBlock ?? ""],
             ]);
             return [unit];
         }

package/dist/lib/daemon/config.d.ts

@@ -12,11 +12,17 @@ export interface DaemonConfig {
     hqRoot?: string;
     /** Exact hq-cloud package version preferred by this daemon, including prereleases. */
     hqCloudVersion?: string;
+    /** Persisted machine-local sync pause. */
+    syncPaused?: boolean;
+    /** Explicit desktop handoff; absent values preserve the legacy per-machine owner. */
+    syncOwner?: SyncOwner;
     /** Services turned on here beyond the machine type's defaults. */
     enable: string[];
     /** Default services turned off here. */
     disable: string[];
 }
+export type SyncOwner = "daemon" | "desktop-app";
+export declare function effectiveSyncOwner(config: Pick<DaemonConfig, "syncOwner">, machineType: MachineType): SyncOwner;
 export declare function emptyDaemonConfig(): DaemonConfig;
 export declare function readDaemonConfig(file: string): DaemonConfig;
 export declare function writeDaemonConfig(file: string, config: DaemonConfig): void;

package/dist/lib/daemon/config.js

@@ -10,8 +10,11 @@ import { valid as validSemver } from "semver";
 import { isServiceName } from "./catalog.js";
 import { isMachineType } from "./machine-type.js";
 import { ensurePrivateDir } from "./paths.js";
+export function effectiveSyncOwner(config, machineType) {
+    return config.syncOwner ?? (machineType === "desktop" ? "desktop-app" : "daemon");
+}
 export function emptyDaemonConfig() {
-    return { version: 1, enable: [], disable: [] };
+    return { version: 1, syncPaused: false, enable: [], disable: [] };
 }
 function stringList(value) {
     return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
@@ -36,9 +39,16 @@ export function readDaemonConfig(file) {
     if (!raw || typeof raw !== "object")
         throw new Error(`hq daemon config at ${file} is not a JSON object`);
     const obj = raw;
-    const config = { version: 1, enable: stringList(obj.enable), disable: stringList(obj.disable) };
+    const config = {
+        version: 1,
+        syncPaused: obj.syncPaused === true,
+        enable: stringList(obj.enable),
+        disable: stringList(obj.disable),
+    };
     if (isMachineType(obj.machineType))
         config.machineType = obj.machineType;
+    if (obj.syncOwner === "daemon" || obj.syncOwner === "desktop-app")
+        config.syncOwner = obj.syncOwner;
     if (typeof obj.hqRoot === "string" && obj.hqRoot.trim())
         config.hqRoot = obj.hqRoot;
     if (typeof obj.hqCloudVersion === "string" && validSemver(obj.hqCloudVersion) === obj.hqCloudVersion) {
@@ -56,6 +66,9 @@ export function writeDaemonConfig(file, config) {
         ordered.hqRoot = config.hqRoot;
     if (config.hqCloudVersion)
         ordered.hqCloudVersion = config.hqCloudVersion;
+    ordered.syncPaused = config.syncPaused === true;
+    if (config.syncOwner)
+        ordered.syncOwner = config.syncOwner;
     ordered.enable = config.enable;
     ordered.disable = config.disable;
     fs.writeFileSync(tmp, `${JSON.stringify(ordered, null, 2)}\n`, { mode: 0o600 });

package/dist/lib/daemon/requests.d.ts

@@ -15,6 +15,10 @@ export type ControlRequest = {
     action: "stop";
     unit: string;
 }
+/** Re-read persisted configuration and apply any changed blocks immediately. */
+ | {
+    action: "reconcile";
+}
 /** Restart the whole daemon, for example after the updater installed a new CLI. */
  | {
     action: "restart-daemon";

package/dist/lib/daemon/requests.js

@@ -19,6 +19,8 @@ function isControlRequest(value) {
         return typeof v.unit === "string";
     if (v.action === "restart-daemon")
         return true;
+    if (v.action === "reconcile")
+        return true;
     return false;
 }
 // Orders requests written by one process within the same millisecond; the

package/dist/lib/daemon/run.js

@@ -17,7 +17,7 @@ import { agentKitPaths } from "../agent-kit/paths.js";
 import { readBotConfig } from "../bot/config.js";
 import { botsRoot } from "../bot/paths.js";
 import { CLAUDE_RUNNER_SCRIPT, CODEX_RUNNER_SCRIPT, enabledServices, planUnits } from "./catalog.js";
-import { readDaemonConfig } from "./config.js";
+import { effectiveSyncOwner, readDaemonConfig } from "./config.js";
 import { SUPERVISOR_HANDOFF_FLAG, readDaemonFlag } from "./flag.js";
 import { findLegacyUnits, legacyOwnerLookup } from "./legacy.js";
 import { readLegacySyncEnv } from "./legacy-sync-env.js";
@@ -29,6 +29,7 @@ import { takeControlRequests } from "./requests.js";
 import { currentHqCloud, hqCloudRunners } from "./hq-cloud.js";
 import { runnerSessionName } from "./remote-control.js";
 import { adoptChild, createChildTracker, finishSuccession, handoffEligible, readProcStart, stopOrphans, successionPaths, systemdKillMode, takeSuccession, writeHandoff, } from "./succession.js";
+import { listSyncRunnerProcesses, readWatchRunnerOwnerStatus, syncHeartbeatTimeoutMs, syncRunnerNodeOptions, watchRunnerOwnerStatusPath, } from "./sync-runner.js";
 import { STOP_ESCALATION_MS, createSupervisor, } from "./supervisor.js";
 import { userToolDirs } from "./tools.js";
 export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
@@ -218,7 +219,10 @@ function makeLogger(paths, foreground) {
  * an on-failure unit down. The daemon's updater handles CLI updates.
  */
 export function unitProcessEnv(base, unit) {
-    return { ...base, ...unit.env, HQ_DAEMON_UNIT: unit.id, HQ_NO_UPDATE_CHECK: "1" };
+    const env = { ...base, ...unit.env, HQ_DAEMON_UNIT: unit.id, HQ_NO_UPDATE_CHECK: "1" };
+    if (unit.service === "sync")
+        env.NODE_OPTIONS = syncRunnerNodeOptions(env);
+    return env;
 }
 export async function runDaemon(opts) {
     const env = opts.env ?? process.env;
@@ -289,10 +293,11 @@ export async function runDaemon(opts) {
         return legacyCache.units;
     };
     let warnedMissingPin = null;
+    const daemonSyncRunnerPids = new Set();
     const plan = () => {
         const config = readDaemonConfig(paths.configPath);
         const legacy = legacyUnits();
-        const configured = config.hqRoot ?? env.HQ_ROOT?.trim() ?? undefined;
+        const configured = config.hqRoot ?? (env.HQ_ROOT?.trim() || undefined);
         const hqRoot = configured && fs.existsSync(configured) ? configured : undefined;
         // Re-picked every reconcile, so a newer hq-cloud from the updater is used as soon as it lands.
         const hqCloud = currentHqCloud(paths.root);
@@ -304,7 +309,33 @@ export async function runDaemon(opts) {
             }
         }
         const runners = hqCloud ? hqCloudRunners(hqCloud.root) : { syncRunner: null, heartbeat: null, sessionHost: null };
-        return planUnits(enabledServices(machineType, config), {
+        const services = enabledServices(machineType, config);
+        const isSignedIn = signedIn(env, home, log);
+        const syncOwner = effectiveSyncOwner(config, machineType);
+        let syncRunnerProcesses = [];
+        let syncRunnerOwnerPid = null;
+        if (machineType === "desktop" &&
+            syncOwner === "daemon" &&
+            services.includes("sync") &&
+            !config.syncPaused &&
+            hqRoot &&
+            isSignedIn) {
+            const processList = listSyncRunnerProcesses(platform);
+            if (!processList.ok) {
+                syncRunnerProcesses = null;
+                log("warn", `${processList.error}; sync will wait before taking ownership`);
+            }
+            else {
+                syncRunnerProcesses = processList.processes;
+                try {
+                    syncRunnerOwnerPid = readWatchRunnerOwnerStatus(watchRunnerOwnerStatusPath(hqRoot, home, env))?.pid ?? null;
+                }
+                catch (error) {
+                    log("warn", `could not verify the sync watch-owner status: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        }
+        return planUnits(services, {
             machineType,
             platform,
             home,
@@ -313,14 +344,20 @@ export async function runDaemon(opts) {
             heartbeatRunnerPath: runners.heartbeat,
             sessionHostRunnerPath: runners.sessionHost,
             legacySyncEnv: readLegacySyncEnv(platform),
-            signedIn: signedIn(env, home, log),
+            signedIn: isSignedIn,
             kitConfigured: fs.existsSync(agentKitPaths(home, env).kitConfigPath),
+            syncPaused: config.syncPaused === true,
+            syncOwner,
             desktopAppManagesSync: desktopAppManagesSync({
                 machineType,
                 host: opts.host,
                 legacy,
                 appRunning: () => desktopAppRunning(platform),
             }),
+            syncRunnerProcesses,
+            syncRunnerOwnerPid,
+            daemonSyncRunnerPids,
+            syncHeartbeatTimeoutMs: syncHeartbeatTimeoutMs(env),
             bots: listLocalBots(),
             legacyOwner: legacyOwnerLookup(legacy),
             cliSelfUpdatable: updatable,
@@ -342,9 +379,37 @@ export async function runDaemon(opts) {
             : command.type === "node"
                 ? [opts.nodeBinary, [command.script, ...command.args]]
                 : [command.file, command.args];
-        const fd = openPrivateAppend(paths.unitLogPath(unit.id));
+        const logPath = paths.unitLogPath(unit.id);
+        const cwd = unit.env.HQ_ROOT && fs.existsSync(unit.env.HQ_ROOT) ? unit.env.HQ_ROOT : home;
+        if (unit.heartbeatTimeoutMs) {
+            // The supervisor reads this unit's protocol heartbeats from stdout, so its
+            // output goes through the daemon. A piped child cannot outlive the daemon,
+            // so it is never handed over: a handoff stops it and the next daemon
+            // starts it again.
+            const logFd = openPrivateAppend(logPath);
+            const logStream = fs.createWriteStream(logPath, { fd: logFd, autoClose: true });
+            logStream.on("error", (err) => log("error", `could not write ${unit.id} log ${logPath}: ${err.message}`));
+            const child = spawn(file, args, {
+                cwd,
+                env: unitProcessEnv(env, unit),
+                stdio: ["ignore", "pipe", "pipe"],
+                windowsHide: true,
+            });
+            spawned.add(child);
+            if (unit.service === "sync" && child.pid !== undefined)
+                daemonSyncRunnerPids.add(child.pid);
+            child.stdout?.pipe(logStream, { end: false });
+            child.stderr?.pipe(logStream, { end: false });
+            child.on("close", () => {
+                spawned.delete(child);
+                if (child.pid !== undefined)
+                    daemonSyncRunnerPids.delete(child.pid);
+                logStream.end();
+            });
+            return child;
+        }
+        const fd = openPrivateAppend(logPath);
         try {
-            const cwd = unit.env.HQ_ROOT && fs.existsSync(unit.env.HQ_ROOT) ? unit.env.HQ_ROOT : home;
             const child = spawn(file, args, {
                 cwd,
                 env: unitProcessEnv(env, unit),
@@ -352,7 +417,13 @@ export async function runDaemon(opts) {
                 windowsHide: true,
             });
             spawned.add(child);
-            child.once("exit", () => spawned.delete(child));
+            if (unit.service === "sync" && child.pid !== undefined)
+                daemonSyncRunnerPids.add(child.pid);
+            child.once("exit", () => {
+                spawned.delete(child);
+                if (child.pid !== undefined)
+                    daemonSyncRunnerPids.delete(child.pid);
+            });
             // Only long-running services are handed over; a scheduled run left behind finishes on its own.
             if (unit.kind === "long-running")
                 tracker?.track(unit.id, child);
@@ -382,6 +453,21 @@ export async function runDaemon(opts) {
         restartDaemon: () => restartDaemon(),
         writeState: (state) => writeJsonAtomic(paths.statePath, state),
         log,
+        syncOwnerBlockReason: () => {
+            const config = readDaemonConfig(paths.configPath);
+            const hqRoot = config.hqRoot ?? env.HQ_ROOT?.trim();
+            if (!hqRoot)
+                return undefined;
+            const statusPath = watchRunnerOwnerStatusPath(hqRoot, home, env);
+            try {
+                const owner = readWatchRunnerOwnerStatus(statusPath);
+                return owner ? `sync owned by ${owner.owner} pid ${owner.pid}` : undefined;
+            }
+            catch (err) {
+                log("error", `could not read sync owner status at ${statusPath}: ${err instanceof Error ? err.message : String(err)}`);
+                return undefined;
+            }
+        },
         cliVersion: CLI_VERSION,
         adopt,
     });