@indigoai-us/hq-cli 5.276.0 → 5.278.0

package/dist/lib/checkpoint-ontology/apply.js

@@ -16,7 +16,7 @@ import { checkSyncClient, readSyncClientVersions } from "./sync-client.js";
 import { appendBackRefs, parseEntityFile, patchEntityFile, previewSignalContent, renderNewEntity, validateEntityFrontmatter, } from "./entity-file.js";
 import { canonicalizeName, entityId, isRejectedName, isWritableEntityType, normalizeEntityName, squash, toSlug, } from "./identity.js";
 import { CANDIDATES_FILE, CANDIDATES_SCHEMA, PLAN_FILE, PLAN_SCHEMA, REPORT_FILE, readLedger, writeLedger, } from "./plan.js";
-import { buildEntityIndex, indexAlias, indexEntity, listSignalFiles, readSignal } from "./tree.js";
+import { buildEntityIndex, countInboundLinks, indexAlias, indexEntity, listSignalFiles, readSignal } from "./tree.js";
 export const CAPS = {
     creates: 25,
     updates: 100,
@@ -26,6 +26,14 @@ export const CAPS = {
     nameLength: MAX_NAME_LENGTH,
 };
 export const MIN_CREATE_CONFIDENCE = 0.7;
+/** Inbound links the dominant sibling must have for each one the named entity has. */
+const DOMINANT_SIBLING_RATIO = 3;
+/** Inbound links the dominant sibling must have before a redirect. */
+const DOMINANT_SIBLING_MIN_INBOUND = 5;
+/** checkpoint.ontology.hub-mention-floor: other entity files that must link here before the floor applies. */
+const HUB_MIN_INBOUND = 50;
+/** checkpoint.ontology.hub-mention-floor: whole-word canonical-name mentions required to keep the link. */
+const HUB_MIN_MENTIONS = 2;
 export class ApplyError extends Error {
     constructor(message) {
         super(message);
@@ -63,6 +71,16 @@ export function parseCandidate(raw) {
         evidence: typeof c.evidence === "string" ? c.evidence : "",
     };
 }
+function escapeRegExp(name) {
+    return name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Whole-word, any-case matches of `name` in `text`, with Unicode letters and digits as word characters. Empty or whitespace-only names match nothing. */
+function countMentions(text, name) {
+    if (name.trim() === "")
+        return 0;
+    const pattern = new RegExp(`(?<![\\p{L}\\p{N}])${escapeRegExp(name)}(?![\\p{L}\\p{N}])`, "giu");
+    return text.match(pattern)?.length ?? 0;
+}
 /**
  * checkpoint.ontology.named-evidence: true when `evidence` holds one of
  * `names` as a word, matching case. A name inside a path, domain, handle, tag
@@ -211,6 +229,7 @@ export function applyOntologyRun(options) {
         matched: 0,
         session_links: [],
         links: [],
+        ...(plan.dominant_sibling_link === true ? { dominant_sibling_redirects: [] } : {}),
         rejected: [],
         deferred: [],
         suspect_duplicates: [],
@@ -300,10 +319,77 @@ export function applyOntologyRun(options) {
             if (types.size > 1)
                 crossTypeNames.add(name);
     }
+    // checkpoint.ontology.dominant-sibling-link and checkpoint.ontology.hub-mention-floor:
+    // how many other entity files link to each entity.
+    const inbound = plan.dominant_sibling_link === true || plan.hub_mention_floor === true
+        ? countInboundLinks(company.dir, index)
+        : new Map();
+    const siblings = new Map();
+    if (plan.dominant_sibling_link === true) {
+        const grouped = new Map();
+        for (const entity of index.byRel.values()) {
+            const key = crossTypeKey(entity.canonical_name);
+            if (key === "")
+                continue;
+            const members = grouped.get(key) ?? [];
+            members.push({ rel: entity.rel, type: entity.type });
+            grouped.set(key, members);
+        }
+        for (const [key, members] of grouped) {
+            if (new Set(members.map((member) => member.type)).size < 2)
+                continue;
+            siblings.set(key, members.map((member) => member.rel));
+        }
+    }
+    const dominantSibling = (rel) => {
+        const group = siblings.get(crossTypeKey(index.byRel.get(rel).canonical_name));
+        if (!group)
+            return null;
+        let best = group[0];
+        for (const member of group) {
+            const count = inbound.get(member) ?? 0;
+            const bestCount = inbound.get(best) ?? 0;
+            if (count > bestCount || (count === bestCount && member.localeCompare(best) < 0))
+                best = member;
+        }
+        const relCount = inbound.get(rel) ?? 0;
+        const bestCount = inbound.get(best) ?? 0;
+        if (relCount >= bestCount)
+            return null;
+        if (bestCount >= DOMINANT_SIBLING_RATIO * relCount && bestCount >= DOMINANT_SIBLING_MIN_INBOUND)
+            return best;
+        return null;
+    };
     // checkpoint.ontology.named-evidence: the company's own company entity.
     const ownCompanyRel = `ontology/entities/company/${company.slug}.md`;
     const isOwnCompany = (entity, rel) => entity.type === "company" && (rel === ownCompanyRel || crossTypeKey(entity.canonical_name) === crossTypeKey(company.slug));
     const inputs = liveInputs(options.hqRoot, company, plan);
+    const inputTexts = new Map();
+    // The text the model was given for this input: the annotation-stripped copy
+    // when there is one, cut to the chunk's line range.
+    const inputText = (input) => {
+        const cached = inputTexts.get(input.id);
+        if (cached !== undefined)
+            return cached;
+        if (input.read_path !== undefined && input.read_path.split("/").includes("..")) {
+            throw new ApplyError("ontology plan read_path leaves the run directory");
+        }
+        const file = input.read_path !== undefined
+            ? path.join(options.runDir, input.read_path)
+            : path.join(company.dir, input.path);
+        let text = fs.readFileSync(file, "utf8");
+        if (input.lines !== null)
+            text = text.split("\n").slice(input.lines[0] - 1, input.lines[1]).join("\n");
+        inputTexts.set(input.id, text);
+        return text;
+    };
+    // checkpoint.ontology.hub-mention-floor: the final target of a knowledge link is a
+    // non-person entity many files link to, and the input names it fewer than twice.
+    const underMentionedHub = (input, rel, entity) => plan.hub_mention_floor === true &&
+        input.kind === "knowledge" &&
+        entity.type !== "person" &&
+        (inbound.get(rel) ?? 0) >= HUB_MIN_INBOUND &&
+        countMentions(inputText(input), entity.canonical_name) < HUB_MIN_MENTIONS;
     const blocked = new Set();
     const updates = new Map();
     const update = (rel) => {
@@ -361,19 +447,37 @@ export function applyOntologyRun(options) {
                 note(report.rejected, "ambiguous_type");
                 continue;
             }
+            const redirect = input.kind === "knowledge" && plan.dominant_sibling_link === true ? dominantSibling(resolved.target) : null;
+            const targetRel = redirect ?? resolved.target;
+            const targetEntity = redirect ? index.byRel.get(targetRel) : linked;
             if (plan.named_evidence === true &&
                 input.kind === "knowledge" &&
-                isOwnCompany(linked, resolved.target) &&
+                isOwnCompany(targetEntity, targetRel) &&
                 !evidenceNames(candidate.evidence, [candidate.name, ...candidate.aliases])) {
                 note(report.rejected, "unnamed_in_evidence");
                 continue;
             }
+            if (underMentionedHub(input, targetRel, targetEntity)) {
+                note(report.rejected, "hub_under_mentioned");
+                continue;
+            }
             report.matched += 1;
-            report.links.push({ input: candidate.input, action: "link", type: linked.type, canonical_name: linked.canonical_name, path: resolved.target });
+            report.links.push({
+                input: candidate.input,
+                action: "link",
+                type: targetEntity.type,
+                canonical_name: targetEntity.canonical_name,
+                path: targetRel,
+            });
             if (resolved.tier === 1 && resolved.duplicates.length > 0) {
                 report.suspect_duplicates.push({ name: canonical, type: candidate.type, paths: [resolved.target, ...resolved.duplicates] });
+            }
+            if (redirect) {
+                report.dominant_sibling_redirects?.push({ input: candidate.input, from: resolved.target, to: targetRel });
                 continue;
             }
+            if (resolved.tier === 1 && resolved.duplicates.length > 0)
+                continue;
             // checkpoint.ontology.no-link-aliases: the link is reported and the entity file is left as it is.
             if (plan.link_aliases === false)
                 continue;
@@ -413,6 +517,10 @@ export function applyOntologyRun(options) {
                     continue;
                 }
                 const linked = index.byRel.get(projects[0]);
+                if (underMentionedHub(input, projects[0], linked)) {
+                    note(report.rejected, "hub_under_mentioned");
+                    continue;
+                }
                 report.matched += 1;
                 report.links.push({ input: candidate.input, action: "link", type: linked.type, canonical_name: linked.canonical_name, path: projects[0] });
                 continue;

package/dist/lib/checkpoint-ontology/plan.d.ts

@@ -70,6 +70,25 @@ export declare const FIRST_NAME_PEOPLE_FLAG = "checkpoint.ontology.first-name-pe
  * to 0.803 and cost recall 0.023 on a replay of six runs.
  */
 export declare const SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG = "checkpoint.ontology.skip-ambiguous-concept-links";
+/**
+ * A knowledge link to the weaker of two entities that share a canonical name
+ * across types is redirected to the sibling other entity files link to
+ * (`project/build-your-own-agi` beside `concept/build-your-own-agi`, or
+ * `project/hq-core 2` beside `project/hq-core` when a concept also holds the
+ * name). The plan carries `dominant_sibling_link: true`, and apply reports
+ * the move in `dominant_sibling_redirects` without writing the entity files.
+ * CO-60: a replay of six runs raised knowledge precision from 0.725 to 0.754
+ * and recall from 0.784 to 0.816, and never changed a create.
+ */
+export declare const DOMINANT_SIBLING_LINK_FLAG = "checkpoint.ontology.dominant-sibling-link";
+/**
+ * A knowledge link to a non-person entity that 50 or more
+ * other entity files link to is rejected as `hub_under_mentioned` when the
+ * input names it fewer than 2 times (whole word, any case, canonical name
+ * only). The plan carries `hub_mention_floor: true`. CO-62: a replay of six
+ * runs raised knowledge precision from 0.753 to 0.781 at the same recall.
+ */
+export declare const HUB_MENTION_FLOOR_FLAG = "checkpoint.ontology.hub-mention-floor";
 /**
  * A knowledge concept candidate whose name is an alias of more than one
  * entity, and which apply would defer as `ambiguous_alias`, links instead to
@@ -173,6 +192,10 @@ export interface OntologyPlan {
     first_name_people?: true;
     /** Set by checkpoint.ontology.skip-ambiguous-concept-links: apply rejects a knowledge link to a concept whose name another type also holds. */
     skip_ambiguous_concept_links?: true;
+    /** Set by checkpoint.ontology.dominant-sibling-link: apply redirects a knowledge link from a weak cross-type sibling to the one other files link to. */
+    dominant_sibling_link?: true;
+    /** Set by checkpoint.ontology.hub-mention-floor: apply rejects a knowledge link to an under-mentioned non-person hub. */
+    hub_mention_floor?: true;
     /** Set by checkpoint.ontology.concept-project-link: apply links a knowledge concept with an ambiguous alias to the one project of that canonical name. */
     concept_project_link?: true;
     /** Set by checkpoint.ontology.named-evidence: apply rejects a knowledge link to the company's own entity, or a concept-project-link redirect, whose evidence does not name it as a word. */

package/dist/lib/checkpoint-ontology/plan.js

@@ -75,6 +75,25 @@ export const FIRST_NAME_PEOPLE_FLAG = "checkpoint.ontology.first-name-people";
  * to 0.803 and cost recall 0.023 on a replay of six runs.
  */
 export const SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG = "checkpoint.ontology.skip-ambiguous-concept-links";
+/**
+ * A knowledge link to the weaker of two entities that share a canonical name
+ * across types is redirected to the sibling other entity files link to
+ * (`project/build-your-own-agi` beside `concept/build-your-own-agi`, or
+ * `project/hq-core 2` beside `project/hq-core` when a concept also holds the
+ * name). The plan carries `dominant_sibling_link: true`, and apply reports
+ * the move in `dominant_sibling_redirects` without writing the entity files.
+ * CO-60: a replay of six runs raised knowledge precision from 0.725 to 0.754
+ * and recall from 0.784 to 0.816, and never changed a create.
+ */
+export const DOMINANT_SIBLING_LINK_FLAG = "checkpoint.ontology.dominant-sibling-link";
+/**
+ * A knowledge link to a non-person entity that 50 or more
+ * other entity files link to is rejected as `hub_under_mentioned` when the
+ * input names it fewer than 2 times (whole word, any case, canonical name
+ * only). The plan carries `hub_mention_floor: true`. CO-62: a replay of six
+ * runs raised knowledge precision from 0.753 to 0.781 at the same recall.
+ */
+export const HUB_MENTION_FLOOR_FLAG = "checkpoint.ontology.hub-mention-floor";
 /**
  * A knowledge concept candidate whose name is an alias of more than one
  * entity, and which apply would defer as `ambiguous_alias`, links instead to
@@ -305,6 +324,8 @@ export async function planOntologyRun(options) {
     const noLinkAliases = await options.readFlag(NO_LINK_ALIASES_FLAG, company);
     const firstNamePeople = await options.readFlag(FIRST_NAME_PEOPLE_FLAG, company);
     const skipAmbiguousConceptLinks = await options.readFlag(SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG, company);
+    const dominantSiblingLink = await options.readFlag(DOMINANT_SIBLING_LINK_FLAG, company);
+    const hubMentionFloor = await options.readFlag(HUB_MENTION_FLOOR_FLAG, company);
     const conceptProjectLink = await options.readFlag(CONCEPT_PROJECT_LINK_FLAG, company);
     const namedEvidence = await options.readFlag(NAMED_EVIDENCE_FLAG, company);
     const queuedTouchesOn = borrowed || (await options.readFlag(QUEUED_TOUCHES_FLAG, company));
@@ -428,6 +449,8 @@ export async function planOntologyRun(options) {
         ...(noLinkAliases ? { link_aliases: false } : {}),
         ...(firstNamePeople ? { first_name_people: true } : {}),
         ...(skipAmbiguousConceptLinks ? { skip_ambiguous_concept_links: true } : {}),
+        ...(dominantSiblingLink ? { dominant_sibling_link: true } : {}),
+        ...(hubMentionFloor ? { hub_mention_floor: true } : {}),
         ...(conceptProjectLink ? { concept_project_link: true } : {}),
         ...(namedEvidence ? { named_evidence: true } : {}),
         inputs,

package/dist/lib/checkpoint-ontology/tree.d.ts

@@ -36,6 +36,8 @@ export declare function indexAlias(index: EntityIndex, type: string, rel: string
  * type conflict, but they are never written.
  */
 export declare function buildEntityIndex(companyDir: string): EntityIndex;
+/** Entity path → number of other entity files whose body links to it. */
+export declare function countInboundLinks(companyDir: string, index: EntityIndex): Map<string, number>;
 export interface SignalRecord {
     /** Company-relative path, `signals/<type>/<file>.md`. */
     rel: string;

package/dist/lib/checkpoint-ontology/tree.js

@@ -90,6 +90,40 @@ export function buildEntityIndex(companyDir) {
     }
     return index;
 }
+// Spaces are allowed in the target, as merge-copies writes `../person/jane-doe 2.md`.
+const INBOUND_LINK = /\]\(([^)\n]+?\.md)(?:#[^)\n]*)?\)/g;
+/** Entity path → number of other entity files whose body links to it. */
+export function countInboundLinks(companyDir, index) {
+    const counts = new Map();
+    for (const rel of index.byRel.keys())
+        counts.set(rel, 0);
+    for (const rel of index.byRel.keys()) {
+        const parsed = parseEntityFile(fs.readFileSync(path.join(companyDir, rel), "utf8"));
+        if (!parsed)
+            continue;
+        const seen = new Set();
+        for (const match of parsed.body.matchAll(INBOUND_LINK)) {
+            const target = match[1];
+            if (target.startsWith("http:") || target.startsWith("https:") || target.startsWith("mailto:"))
+                continue;
+            let decoded = target;
+            try {
+                decoded = decodeURI(target);
+            }
+            catch (error) {
+                if (!(error instanceof URIError))
+                    throw error;
+            }
+            const resolved = path.posix.normalize(path.posix.join(path.posix.dirname(rel), decoded));
+            if (resolved === rel || !index.byRel.has(resolved))
+                continue;
+            seen.add(resolved);
+        }
+        for (const targetRel of seen)
+            counts.set(targetRel, (counts.get(targetRel) ?? 0) + 1);
+    }
+    return counts;
+}
 /** Parse the frontmatter of one company-audience signal file. */
 export function readSignal(companyDir, rel) {
     let content;

package/dist/lib/core-utils/jq-json-serializer.d.ts

@@ -0,0 +1,5 @@
+/** JSON output formats used by the scaffold scripts that previously called jq. */
+export type JqJsonOutput = "compact" | "raw" | "pretty";
+/** Serialize one jq result, including jq's output newline. */
+export declare function serializeJqJson(value: unknown, output?: JqJsonOutput): string;
+//# sourceMappingURL=jq-json-serializer.d.ts.map

package/dist/lib/core-utils/jq-json-serializer.js

@@ -0,0 +1,10 @@
+/** Serialize one jq result, including jq's output newline. */
+export function serializeJqJson(value, output = "pretty") {
+    if (output === "raw" && typeof value === "string")
+        return `${value}\n`;
+    const serialized = output === "compact"
+        ? JSON.stringify(value)
+        : JSON.stringify(value, null, 2);
+    return serialized === undefined ? "" : `${serialized.replace(/\u007f/g, "\\u007f")}\n`;
+}
+//# sourceMappingURL=jq-json-serializer.js.map

package/dist/lib/core-utils/secret-patterns.d.ts

@@ -0,0 +1,41 @@
+/** Shared secret detector patterns mirrored from the scaffold shell library. */
+export declare const SECRET_PATTERN_BOUNDARY = "(^|[^a-zA-Z0-9])";
+export declare const SECRET_PATTERNS: readonly [{
+    readonly pattern: "sk-[a-zA-Z0-9._-]{20,}";
+    readonly name: "OpenAI/Stripe key";
+}, {
+    readonly pattern: "ghp_[a-zA-Z0-9]{36,}";
+    readonly name: "GitHub PAT";
+}, {
+    readonly pattern: "AKIA[0-9A-Z]{16}";
+    readonly name: "AWS access key";
+}, {
+    readonly pattern: "xox[bpsa]-[a-zA-Z0-9-]+";
+    readonly name: "Slack token";
+}, {
+    readonly pattern: "Bearer [a-zA-Z0-9._-]{20,}";
+    readonly name: "Bearer token";
+}, {
+    readonly pattern: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----";
+    readonly name: "Private key";
+}, {
+    readonly pattern: "glpat-[a-zA-Z0-9_-]{20,}";
+    readonly name: "GitLab PAT";
+}, {
+    readonly pattern: "gho_[a-zA-Z0-9]{36,}";
+    readonly name: "GitHub OAuth token";
+}, {
+    readonly pattern: "github_pat_[a-zA-Z0-9_]{22,}";
+    readonly name: "Fine-grained GitHub PAT";
+}, {
+    readonly pattern: "eyJ[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{10,}";
+    readonly name: "JWT";
+}];
+/** Return the pattern names that match, in the shell library's declared order. */
+export declare function matchingSecretPatterns(value: string): string[];
+/** Print only pattern names and paths; never include matched file content. */
+export declare function scanSecretFiles(files: readonly string[]): {
+    code: 0 | 1;
+    hits: string[];
+};
+//# sourceMappingURL=secret-patterns.d.ts.map

package/dist/lib/core-utils/secret-patterns.js

@@ -0,0 +1,33 @@
+/** Shared secret detector patterns mirrored from the scaffold shell library. */
+import * as fs from "node:fs";
+export const SECRET_PATTERN_BOUNDARY = "(^|[^a-zA-Z0-9])";
+export const SECRET_PATTERNS = [
+    { pattern: "sk-[a-zA-Z0-9._-]{20,}", name: "OpenAI/Stripe key" },
+    { pattern: "ghp_[a-zA-Z0-9]{36,}", name: "GitHub PAT" },
+    { pattern: "AKIA[0-9A-Z]{16}", name: "AWS access key" },
+    { pattern: "xox[bpsa]-[a-zA-Z0-9-]+", name: "Slack token" },
+    { pattern: "Bearer [a-zA-Z0-9._-]{20,}", name: "Bearer token" },
+    { pattern: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----", name: "Private key" },
+    { pattern: "glpat-[a-zA-Z0-9_-]{20,}", name: "GitLab PAT" },
+    { pattern: "gho_[a-zA-Z0-9]{36,}", name: "GitHub OAuth token" },
+    { pattern: "github_pat_[a-zA-Z0-9_]{22,}", name: "Fine-grained GitHub PAT" },
+    { pattern: "eyJ[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{20,}\\.[a-zA-Z0-9_-]{10,}", name: "JWT" },
+];
+/** Return the pattern names that match, in the shell library's declared order. */
+export function matchingSecretPatterns(value) {
+    return SECRET_PATTERNS.flatMap(({ pattern, name }) => new RegExp(`${SECRET_PATTERN_BOUNDARY}${pattern}`).test(value) ? [name] : []);
+}
+/** Print only pattern names and paths; never include matched file content. */
+export function scanSecretFiles(files) {
+    const hits = [];
+    for (const file of files) {
+        if (!fs.existsSync(file) || !fs.statSync(file).isFile())
+            continue;
+        const contents = fs.readFileSync(file, "utf8");
+        for (const name of matchingSecretPatterns(contents)) {
+            hits.push(`secret-scan: pattern '${name}' matched in ${file}`);
+        }
+    }
+    return { code: hits.length > 0 ? 1 : 0, hits };
+}
+//# sourceMappingURL=secret-patterns.js.map

package/dist/lib/daemon/catalog.d.ts

@@ -10,6 +10,8 @@
  * them instead of silently dropping them.
  */
 import type { MachineType } from "./machine-type.js";
+import type { SyncOwner } from "./config.js";
+import { type SyncRunnerProcess } from "./sync-runner.js";
 export declare const SERVICE_NAMES: readonly ["sync", "mesh", "heartbeat", "inbox", "bots", "remote-control", "codex-remote-control", "session-host", "lanes-reconcile", "search-index", "jobs-reconcile", "updater", "housekeeping"];
 export type ServiceName = (typeof SERVICE_NAMES)[number];
 export declare function isServiceName(value: unknown): value is ServiceName;
@@ -51,6 +53,8 @@ export interface UnitPlan {
     restart: "always" | "on-failure";
     intervalSec?: number;
     initialDelaySec?: number;
+    /** Kill and restart this child after silence on its liveness stream. */
+    heartbeatTimeoutMs?: number;
     command: UnitCommand | null;
     env: Record<string, string>;
     blocked?: UnitBlock;
@@ -75,11 +79,23 @@ export interface PlanContext {
     sessionHostRunnerPath: string | null;
     /** Environment retained from legacy outpost sync systemd drop-ins. */
     legacySyncEnv: Record<string, string>;
+    /** Keep the local sync runner stopped until the operator resumes it. */
+    syncPaused: boolean;
+    /** Persisted/effective owner selected for this machine. */
+    syncOwner: SyncOwner;
+    /** A legacy desktop app or sync unit is still managing sync. */
+    desktopAppManagesSync: boolean;
+    /** Full process list, or null when the daemon could not read it. */
+    syncRunnerProcesses: readonly SyncRunnerProcess[] | null;
+    /** PID recorded in the watch-owner status, when it is readable. */
+    syncRunnerOwnerPid: number | null;
+    /** Sync runner children already started by this daemon before their lease is written. */
+    daemonSyncRunnerPids?: ReadonlySet<number>;
+    /** The protocol-event heartbeat watchdog timeout for the sync runner. */
+    syncHeartbeatTimeoutMs: number;
     signedIn: boolean;
     /** ~/.hq-agent/kit.json exists. */
     kitConfigured: boolean;
-    /** The HQ desktop app runs its own sync on this machine. */
-    desktopAppManagesSync: boolean;
     bots: readonly string[];
     /** Name of a pre-daemon unit that still runs this unit id, or null. */
     legacyOwner: (unitId: string) => string | null;

package/dist/lib/daemon/catalog.js

@@ -9,6 +9,7 @@
  * with no entrypoint yet stay in the catalog as `unavailable` so status shows
  * them instead of silently dropping them.
  */
+import { SYNC_RUNNER_OWNER, syncRunnerUnleasedBlockReason } from "./sync-runner.js";
 export const SERVICE_NAMES = [
     "sync",
     "mesh",
@@ -127,14 +128,29 @@ function planService(service, ctx) {
                 command: {
                     type: "node",
                     script: ctx.syncRunnerPath,
-                    args: ["--companies", "--direction", "both", "--on-conflict", "keep", "--hq-root", ctx.hqRoot ?? "", "--watch", "--event-push"],
+                    args: ["--companies", "--direction", "both", "--on-conflict", "keep", "--hq-root", ctx.hqRoot ?? "", "--watch", "--event-push", "--owner", SYNC_RUNNER_OWNER],
                 },
                 env: { ...ctx.legacySyncEnv },
+                heartbeatTimeoutMs: ctx.syncHeartbeatTimeoutMs,
             });
+            let ownerBlock;
+            if (ctx.machineType === "desktop" && ctx.syncOwner === "desktop-app" && ctx.desktopAppManagesSync) {
+                ownerBlock = "the desktop app is still managing sync (run `hq daemon sync take-ownership` after it stops its runner)";
+            }
+            else if (ctx.machineType === "desktop" &&
+                ctx.syncOwner === "daemon" &&
+                !ctx.syncPaused &&
+                ctx.hqRoot &&
+                ctx.signedIn) {
+                ownerBlock = ctx.syncRunnerProcesses === null
+                    ? "could not check for an existing sync runner; waiting to avoid starting a duplicate"
+                    : syncRunnerUnleasedBlockReason(ctx.hqRoot, ctx.syncRunnerProcesses, ctx.syncRunnerOwnerPid, ctx.platform, ctx.daemonSyncRunnerPids);
+            }
             unit.blocked = firstBlock([
-                [ctx.desktopAppManagesSync, "the HQ desktop app is handling sync on this machine"],
+                [ctx.syncPaused, "sync is paused (run `hq daemon sync resume`)"],
                 [!ctx.hqRoot, NO_HQ_ROOT],
                 [!ctx.signedIn, NOT_SIGNED_IN],
+                [!!ownerBlock, ownerBlock ?? ""],
             ]);
             return [unit];
         }

package/dist/lib/daemon/config.d.ts

@@ -12,11 +12,17 @@ export interface DaemonConfig {
     hqRoot?: string;
     /** Exact hq-cloud package version preferred by this daemon, including prereleases. */
     hqCloudVersion?: string;
+    /** Persisted machine-local sync pause. */
+    syncPaused?: boolean;
+    /** Explicit desktop handoff; absent values preserve the legacy per-machine owner. */
+    syncOwner?: SyncOwner;
     /** Services turned on here beyond the machine type's defaults. */
     enable: string[];
     /** Default services turned off here. */
     disable: string[];
 }
+export type SyncOwner = "daemon" | "desktop-app";
+export declare function effectiveSyncOwner(config: Pick<DaemonConfig, "syncOwner">, machineType: MachineType): SyncOwner;
 export declare function emptyDaemonConfig(): DaemonConfig;
 export declare function readDaemonConfig(file: string): DaemonConfig;
 export declare function writeDaemonConfig(file: string, config: DaemonConfig): void;

package/dist/lib/daemon/config.js

@@ -10,8 +10,11 @@ import { valid as validSemver } from "semver";
 import { isServiceName } from "./catalog.js";
 import { isMachineType } from "./machine-type.js";
 import { ensurePrivateDir } from "./paths.js";
+export function effectiveSyncOwner(config, machineType) {
+    return config.syncOwner ?? (machineType === "desktop" ? "desktop-app" : "daemon");
+}
 export function emptyDaemonConfig() {
-    return { version: 1, enable: [], disable: [] };
+    return { version: 1, syncPaused: false, enable: [], disable: [] };
 }
 function stringList(value) {
     return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
@@ -36,9 +39,16 @@ export function readDaemonConfig(file) {
     if (!raw || typeof raw !== "object")
         throw new Error(`hq daemon config at ${file} is not a JSON object`);
     const obj = raw;
-    const config = { version: 1, enable: stringList(obj.enable), disable: stringList(obj.disable) };
+    const config = {
+        version: 1,
+        syncPaused: obj.syncPaused === true,
+        enable: stringList(obj.enable),
+        disable: stringList(obj.disable),
+    };
     if (isMachineType(obj.machineType))
         config.machineType = obj.machineType;
+    if (obj.syncOwner === "daemon" || obj.syncOwner === "desktop-app")
+        config.syncOwner = obj.syncOwner;
     if (typeof obj.hqRoot === "string" && obj.hqRoot.trim())
         config.hqRoot = obj.hqRoot;
     if (typeof obj.hqCloudVersion === "string" && validSemver(obj.hqCloudVersion) === obj.hqCloudVersion) {
@@ -56,6 +66,9 @@ export function writeDaemonConfig(file, config) {
         ordered.hqRoot = config.hqRoot;
     if (config.hqCloudVersion)
         ordered.hqCloudVersion = config.hqCloudVersion;
+    ordered.syncPaused = config.syncPaused === true;
+    if (config.syncOwner)
+        ordered.syncOwner = config.syncOwner;
     ordered.enable = config.enable;
     ordered.disable = config.disable;
     fs.writeFileSync(tmp, `${JSON.stringify(ordered, null, 2)}\n`, { mode: 0o600 });

package/dist/lib/daemon/requests.d.ts

@@ -15,6 +15,10 @@ export type ControlRequest = {
     action: "stop";
     unit: string;
 }
+/** Re-read persisted configuration and apply any changed blocks immediately. */
+ | {
+    action: "reconcile";
+}
 /** Restart the whole daemon, for example after the updater installed a new CLI. */
  | {
     action: "restart-daemon";

package/dist/lib/daemon/requests.js

@@ -19,6 +19,8 @@ function isControlRequest(value) {
         return typeof v.unit === "string";
     if (v.action === "restart-daemon")
         return true;
+    if (v.action === "reconcile")
+        return true;
     return false;
 }
 // Orders requests written by one process within the same millisecond; the