@indigoai-us/hq-cli 5.285.0 → 5.286.0

package/CHANGELOG.md

@@ -2,8 +2,21 @@
 
 ## [Unreleased]
 
+## [5.286.0] — 2026-09-29
+
+### Changed
+
+- On Linux the daemon's sync runner writes its protocol output to a named
+  pipe, `~/.hq/daemon/protocol/sync.fifo`, instead of an anonymous pipe. With
+  `daemon.supervisor-handoff` on, an outpost daemon restart now hands sync to
+  the next daemon like the other services instead of stopping and restarting
+  it, and output the old daemon had not read reaches the new one. Other
+  platforms keep the anonymous pipe.
+
 ## [5.285.0] — 2026-09-29
 
+- Route eligible Linux CI jobs onto ARM runners while retaining existing test and platform gates.
+
 ## [5.284.0] — 2026-09-29
 - The existing Work Mesh MQTT subscriber can signal agent inbox wakes through a private local marker without persisting MQTT message contents.
 - Add `hq agents jobs resume <uid> <jobId>` to re-enable paused agent job schedules.
@@ -14,6 +27,7 @@
   capacity probes, or mirror snapshots to other Outposts. Two Outposts that
   each held a lane placed on the other ran `hq lanes list --json` on each other
   without end, which filled both boxes with SSM commands.
+- `hq doctor` labels the detected agent runtime value as `Agent platform` in human output. The JSON platform field and schema are unchanged.
 
 ### Fixed
 

package/dist/lib/daemon/paths.d.ts

@@ -12,6 +12,8 @@ export interface DaemonPaths {
     requestsDir: string;
     supervisorLogPath: string;
     unitLogPath: (unitId: string) => string;
+    /** The FIFO a unit that speaks the sync protocol writes its stdout to (see protocol-tail.ts); kept out of logs/ so nothing reading logs drains it. */
+    unitProtocolPath: (unitId: string) => string;
 }
 export declare function daemonPaths(home?: string, env?: NodeJS.ProcessEnv): DaemonPaths;
 /** Create `dir` (and any missing parents) readable only by its owner, and tighten it if it already exists. */

package/dist/lib/daemon/paths.js

@@ -18,6 +18,7 @@ export function daemonPaths(home = os.homedir(), env = process.env) {
         requestsDir: path.join(root, "requests"),
         supervisorLogPath: path.join(logsDir, "daemon.log"),
         unitLogPath: (unitId) => path.join(logsDir, `${unitId.replace(/[^A-Za-z0-9_.-]/g, "-")}.log`),
+        unitProtocolPath: (unitId) => path.join(root, "protocol", `${unitId.replace(/[^A-Za-z0-9_.-]/g, "-")}.fifo`),
     };
 }
 /** Create `dir` (and any missing parents) readable only by its owner, and tighten it if it already exists. */

package/dist/lib/daemon/protocol-tail.d.ts

@@ -0,0 +1,33 @@
+/**
+ * A service's protocol output read from a named pipe instead of an anonymous
+ * one.
+ *
+ * An anonymous pipe loses its reader when the daemon exits, so a service
+ * writing to one cannot be handed to the next daemon. Here the service's
+ * stdout is a FIFO it holds open for reading and writing, so it always has a
+ * reader and never gets EPIPE. Each daemon polls the FIFO without blocking and
+ * feeds what it reads to the supervisor as the child's stdout. On a handoff
+ * the daemon stops reading without draining, so output it has not read stays
+ * in the kernel buffer for the next daemon, and nothing accumulates on disk.
+ */
+export interface ProtocolTail {
+    /** "data" carries each chunk read; "end" fires once, after close(). */
+    on(event: "data" | "end", handler: (chunk?: Buffer | string) => void): ProtocolTail;
+    /** The service exited: read what is left, emit "end" and stop polling. */
+    close(): void;
+    /** Handing over: stop polling without reading, leaving the rest for the next daemon. */
+    detach(): void;
+}
+/** Make `file` a FIFO, replacing anything else found there. */
+export declare function ensureProtocolFifo(file: string): void;
+/**
+ * The service's stdout. Opened for reading and writing, so the FIFO keeps a
+ * reader while no daemon has it open and the service's writes never fail.
+ */
+export declare function openProtocolWriter(file: string): number;
+export declare function createProtocolTail(file: string, opts?: {
+    pollMs?: number;
+    setInterval?: (fn: () => void, ms: number) => unknown;
+    clearInterval?: (handle: unknown) => void;
+}): ProtocolTail;
+//# sourceMappingURL=protocol-tail.d.ts.map

package/dist/lib/daemon/protocol-tail.js

@@ -0,0 +1,131 @@
+/**
+ * A service's protocol output read from a named pipe instead of an anonymous
+ * one.
+ *
+ * An anonymous pipe loses its reader when the daemon exits, so a service
+ * writing to one cannot be handed to the next daemon. Here the service's
+ * stdout is a FIFO it holds open for reading and writing, so it always has a
+ * reader and never gets EPIPE. Each daemon polls the FIFO without blocking and
+ * feeds what it reads to the supervisor as the child's stdout. On a handoff
+ * the daemon stops reading without draining, so output it has not read stays
+ * in the kernel buffer for the next daemon, and nothing accumulates on disk.
+ */
+import { spawnSync } from "node:child_process";
+import { EventEmitter } from "node:events";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { ensurePrivateDir } from "./paths.js";
+const POLL_MS = 1_000;
+const READ_CHUNK_BYTES = 64 * 1024;
+/** Make `file` a FIFO, replacing anything else found there. */
+export function ensureProtocolFifo(file) {
+    ensurePrivateDir(path.dirname(file));
+    try {
+        if (fs.lstatSync(file).isFIFO())
+            return;
+        fs.rmSync(file, { force: true });
+    }
+    catch {
+        // Missing: created below.
+    }
+    const r = spawnSync("mkfifo", ["-m", "600", file], { encoding: "utf8" });
+    if (r.error)
+        throw r.error;
+    if (r.status !== 0)
+        throw new Error(`mkfifo ${file} failed: ${(r.stderr ?? "").trim() || `exit ${r.status}`}`);
+}
+/**
+ * The service's stdout. Opened for reading and writing, so the FIFO keeps a
+ * reader while no daemon has it open and the service's writes never fail.
+ */
+export function openProtocolWriter(file) {
+    return fs.openSync(file, fs.constants.O_RDWR);
+}
+export function createProtocolTail(file, opts = {}) {
+    const events = new EventEmitter();
+    const setI = opts.setInterval ?? ((fn, ms) => setInterval(fn, ms));
+    const clearI = opts.clearInterval ?? ((h) => clearInterval(h));
+    let fd = null;
+    let done = false;
+    const open = () => {
+        if (fd !== null)
+            return fd;
+        try {
+            fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+        }
+        catch {
+            fd = null;
+        }
+        return fd;
+    };
+    const read = () => {
+        const handle = open();
+        if (handle === null)
+            return;
+        const buf = Buffer.alloc(READ_CHUNK_BYTES);
+        for (;;) {
+            let n;
+            try {
+                n = fs.readSync(handle, buf, 0, buf.length, null);
+            }
+            catch (err) {
+                // EAGAIN: nothing written since the last read.
+                if (err.code === "EAGAIN")
+                    return;
+                throw err;
+            }
+            if (n <= 0)
+                return;
+            events.emit("data", Buffer.from(buf.subarray(0, n)));
+        }
+    };
+    const stop = () => {
+        done = true;
+        clearI(timer);
+        if (fd !== null) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                // already closed
+            }
+            fd = null;
+        }
+    };
+    const timer = setI(() => {
+        try {
+            read();
+        }
+        catch {
+            // An unreadable FIFO reads as silence; the heartbeat watchdog restarts the service.
+        }
+    }, opts.pollMs ?? POLL_MS);
+    timer.unref?.();
+    // Open now, so the FIFO has a reader before the service starts writing.
+    open();
+    const tail = {
+        on(event, handler) {
+            events.on(event, handler);
+            return tail;
+        },
+        close() {
+            if (done)
+                return;
+            try {
+                read();
+            }
+            catch {
+                // nothing more to read
+            }
+            stop();
+            events.emit("end");
+        },
+        detach() {
+            if (done)
+                return;
+            stop();
+        },
+    };
+    return tail;
+}
+//# sourceMappingURL=protocol-tail.js.map

package/dist/lib/daemon/run.js

@@ -25,6 +25,7 @@ import { acquireDaemonLock, releaseDaemonLock } from "./lock.js";
 import { daemonRootRefusal } from "./install.js";
 import { detectMachineType } from "./machine-type.js";
 import { appendPrivate, daemonPaths, ensurePrivateDir, openPrivateAppend } from "./paths.js";
+import { createProtocolTail, ensureProtocolFifo, openProtocolWriter } from "./protocol-tail.js";
 import { takeControlRequests } from "./requests.js";
 import { currentHqCloud, hqCloudRunners } from "./hq-cloud.js";
 import { runnerSessionName } from "./remote-control.js";
@@ -224,6 +225,14 @@ export function unitProcessEnv(base, unit) {
         env.NODE_OPTIONS = syncRunnerNodeOptions(env);
     return env;
 }
+function isFifo(file) {
+    try {
+        return fs.lstatSync(file).isFIFO();
+    }
+    catch {
+        return false;
+    }
+}
 export async function runDaemon(opts) {
     const env = opts.env ?? process.env;
     const home = opts.home ?? os.homedir();
@@ -263,6 +272,8 @@ export async function runDaemon(opts) {
         process.kill(pid, sig);
     };
     let adopt = [];
+    /** Readers of units' protocol FIFOs; a handoff detaches them so the next daemon reads what is left. */
+    const protocolTails = new Set();
     if (succession) {
         const taken = takeSuccession(succession, { now: Date.now, readStart: readProcStart, log });
         await stopOrphans(taken.orphans, {
@@ -271,7 +282,20 @@ export async function runDaemon(opts) {
             sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
             log,
         });
-        adopt = taken.adopt.map((u) => ({ id: u.id, key: u.key, child: adoptChild(u, { readStart: readProcStart, signal: signalPid }) }));
+        adopt = taken.adopt.map((u) => {
+            // A unit that speaks the sync protocol writes it to a FIFO; read what the previous daemon left.
+            const protocolPath = paths.unitProtocolPath(u.id);
+            const stdout = isFifo(protocolPath) ? createProtocolTail(protocolPath) : undefined;
+            const child = adoptChild(u, { readStart: readProcStart, signal: signalPid, ...(stdout ? { stdout } : {}) });
+            if (stdout) {
+                protocolTails.add(stdout);
+                child.on("exit", () => {
+                    protocolTails.delete(stdout);
+                    stdout.close();
+                });
+            }
+            return { id: u.id, key: u.key, child };
+        });
     }
     const tracker = succession ? createChildTracker(succession.childrenPath, { readStart: readProcStart, log }) : null;
     for (const unit of adopt)
@@ -381,11 +405,57 @@ export async function runDaemon(opts) {
                 : [command.file, command.args];
         const logPath = paths.unitLogPath(unit.id);
         const cwd = unit.env.HQ_ROOT && fs.existsSync(unit.env.HQ_ROOT) ? unit.env.HQ_ROOT : home;
+        if (unit.heartbeatTimeoutMs && succession) {
+            // The supervisor reads this unit's protocol heartbeats from stdout. Where
+            // services can outlive the daemon, stdout is a FIFO (see protocol-tail.ts)
+            // rather than a pipe, so the unit can be handed to the next daemon.
+            const protocolPath = paths.unitProtocolPath(unit.id);
+            ensureProtocolFifo(protocolPath);
+            const stdout = createProtocolTail(protocolPath);
+            const outFd = openProtocolWriter(protocolPath);
+            const errFd = openPrivateAppend(logPath);
+            try {
+                const child = spawn(file, args, {
+                    cwd,
+                    env: unitProcessEnv(env, unit),
+                    stdio: ["ignore", outFd, errFd],
+                    windowsHide: true,
+                });
+                spawned.add(child);
+                if (unit.service === "sync" && child.pid !== undefined)
+                    daemonSyncRunnerPids.add(child.pid);
+                protocolTails.add(stdout);
+                const finish = () => {
+                    protocolTails.delete(stdout);
+                    stdout.close();
+                };
+                child.once("exit", () => {
+                    spawned.delete(child);
+                    if (child.pid !== undefined)
+                        daemonSyncRunnerPids.delete(child.pid);
+                    finish();
+                });
+                child.once("error", finish);
+                const supervised = {
+                    pid: child.pid,
+                    stdout,
+                    on(event, handler) {
+                        child.on(event, handler);
+                        return supervised;
+                    },
+                    kill: (signal) => child.kill(signal),
+                };
+                if (unit.kind === "long-running")
+                    tracker?.track(unit.id, supervised);
+                return supervised;
+            }
+            finally {
+                fs.closeSync(outFd);
+                fs.closeSync(errFd);
+            }
+        }
         if (unit.heartbeatTimeoutMs) {
-            // The supervisor reads this unit's protocol heartbeats from stdout, so its
-            // output goes through the daemon. A piped child cannot outlive the daemon,
-            // so it is never handed over: a handoff stops it and the next daemon
-            // starts it again.
+            // Elsewhere the service stops with the daemon, so its output can go through a pipe.
             const logFd = openPrivateAppend(logPath);
             const logStream = fs.createWriteStream(logPath, { fd: logFd, autoClose: true });
             logStream.on("error", (err) => log("error", `could not write ${unit.id} log ${logPath}: ${err.message}`));
@@ -525,6 +595,10 @@ export async function runDaemon(opts) {
                 return;
             stopping = true;
             const released = supervisor.release();
+            // What these readers have not read stays in the FIFO for the next daemon.
+            for (const tail of protocolTails)
+                tail.detach();
+            protocolTails.clear();
             const starts = new Map((tracker?.records() ?? []).map((r) => [r.pid, r.start]));
             const units = released.flatMap((u) => {
                 const start = starts.get(u.pid);

package/dist/lib/daemon/succession.d.ts

@@ -95,6 +95,8 @@ export declare function adoptChild(record: ChildRecord, deps: {
     setInterval?: (fn: () => void, ms: number) => unknown;
     clearInterval?: (handle: unknown) => void;
     pollMs?: number;
+    /** Its protocol output, read from the file it writes to (see protocol-tail.ts). */
+    stdout?: SupervisedChild["stdout"];
 }): SupervisedChild;
 /** The loaded daemon unit's KillMode, or null when systemctl cannot tell. */
 export declare function systemdKillMode(run: (file: string, args: string[]) => {

package/dist/lib/daemon/succession.js

@@ -226,6 +226,7 @@ export function adoptChild(record, deps) {
     poll.unref?.();
     const child = {
         pid: record.pid,
+        ...(deps.stdout ? { stdout: deps.stdout } : {}),
         on(event, handler) {
             events.on(event, handler);
             return child;

package/dist/lib/doctor/report.js

@@ -103,7 +103,7 @@ export function renderText(options) {
     const pad = " ".repeat(STATUS_LABEL_WIDTH);
     const lines = [];
     lines.push(`hq doctor — HQ root: ${hqRoot}`);
-    lines.push(`Platform: ${platform.id}`);
+    lines.push(`Agent platform: ${platform.id}`);
     for (const run of families) {
         lines.push("");
         lines.push(`${run.family.title} (${run.family.id})`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.285.0",
+  "version": "5.286.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {