@indigoai-us/hq-cli 5.297.0 → 5.299.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.299.0] — 2026-09-30
+- Add `hq lanes accounts clear-quota` and clear future quota marks after successful lane turns.
+- On macOS, `hq daemon` retires a loaded legacy mesh LaunchAgent even when its plist is missing, and daemon uninstall boots the job out before deleting its plist. Mesh-owner wait logs now repeat at most every ten minutes.
+- Restore npm command links after a failed hq-cli self-update and repair or report missing links after successful installs.
+
+## [5.298.0] — 2026-09-30
+- [feedback_d4a080e9-de79-4290-81c3-06ba26990a38] Preserve raw substring matches while normalizing company path searches.
+- `hq agents` now prints the Slack app settings link and the console paste link whenever an agent is waiting on its Slack app-level token, and follows the pending actions and paste URL the server returns.
+- When an app install is already running, `hq integrations connect` tells you to wait instead of showing a generic conflict error.
+- Validate policy trigger expressions when loading worker policies (feedback_3982db47-ceb8-4148-8ee0-4dd533f5138b).
+
 ## [5.297.0] — 2026-09-30
 - When enabled by hq-flags, show the quarantined work-context outbox count and latest reason in hq doctor and mesh daemon status.
 - `hq daemon` now exits after shutdown when handles remain open, and its mesh service waits when another live mesh daemon owns the process lock.

package/dist/command-catalog.generated.d.ts

@@ -8990,6 +8990,29 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "JSON on stdout (always)";
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "clear-quota";
+            readonly description: "Clear quota reset marks for a provider account";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <provider> <account-id>";
+            readonly arguments: readonly [{
+                readonly name: "provider";
+                readonly required: true;
+                readonly variadic: false;
+            }, {
+                readonly name: "account-id";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--model <model>";
+                readonly description: "Clear only this model's reset";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "enable";
             readonly description: "Enable an account without touching credentials";

package/dist/command-catalog.generated.js

@@ -11601,6 +11601,36 @@ export const COMMAND_CATALOG = [
                         ],
                         "subcommands": []
                     },
+                    {
+                        "name": "clear-quota",
+                        "description": "Clear quota reset marks for a provider account",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <provider> <account-id>",
+                        "arguments": [
+                            {
+                                "name": "provider",
+                                "required": true,
+                                "variadic": false
+                            },
+                            {
+                                "name": "account-id",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--model <model>",
+                                "description": "Clear only this model's reset"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
                     {
                         "name": "enable",
                         "description": "Enable an account without touching credentials",

package/dist/commands/agents.js

@@ -549,13 +549,59 @@ function currentDeviceSignInAction(status) {
         code,
     };
 }
+const SLACK_APP_TOKEN_INSTRUCTION = "Create an app-level token with the connections:write scope, then paste it into HQ. HQ verifies the token and resumes setup; if Slack asks you to install the app, follow the install link shown there.";
+function consolePasteUrl(companyKey, agentUid) {
+    const base = process.env.HQ_CONSOLE_URL?.trim().replace(/\/+$/, "") || "https://hq.computer";
+    return `${base}/companies/${encodeURIComponent(companyKey)}/agents?setup=${encodeURIComponent(agentUid)}`;
+}
+function slackAppIdFromSetupState(status) {
+    const steps = recordValue(status.setupState)?.steps;
+    if (!Array.isArray(steps))
+        return null;
+    for (const step of steps) {
+        const item = recordValue(step);
+        if (item?.name !== "channels" || item.status === "done")
+            continue;
+        const match = /https:\/\/api\.slack\.com\/apps\/(A[A-Z0-9]+)/.exec(JSON.stringify(item));
+        if (match)
+            return match[1];
+    }
+    return null;
+}
+function serverPendingActions(status) {
+    if (!Array.isArray(status.pendingActions))
+        return [];
+    const actions = [];
+    for (const raw of status.pendingActions) {
+        const item = recordValue(raw);
+        const type = nonEmptyString(item?.type);
+        const title = nonEmptyString(item?.title);
+        if (!item || !type || !title)
+            continue;
+        const url = safeActionUrl(item.url) ?? undefined;
+        const pasteUrl = safeActionUrl(item.pasteUrl) ?? undefined;
+        const rawCode = nonEmptyString(item.code);
+        actions.push({
+            type,
+            title,
+            summary: title.charAt(0).toLowerCase() + title.slice(1),
+            instruction: nonEmptyString(item.instruction) ?? "Open this page and follow the instructions.",
+            ...(url ? { url, urlLabel: type === "slack-app-token" ? "Get token" : "Open" } : {}),
+            ...(pasteUrl ? { pasteUrl } : {}),
+            ...(rawCode && /^[A-Z0-9]{4,8}-[A-Z0-9]{4,8}$/i.test(rawCode) ? { code: rawCode } : {}),
+        });
+    }
+    return actions;
+}
 function pendingSlackAction(status, companySlug) {
     const agent = recordValue(status.agent);
     const configuredSlack = recordValue(recordValue(agent?.channels)?.slack);
-    const appId = nonEmptyString(configuredSlack?.appId);
+    const stepAppId = slackAppIdFromSetupState(status);
+    const appId = nonEmptyString(configuredSlack?.appId) ?? stepAppId;
     const agentUid = nonEmptyString(agent?.uid);
     const companyUid = nonEmptyString(agent?.companyUid);
-    const tokenPage = safeActionUrl(configuredSlack?.appTokenPendingUrl);
+    const tokenPage = safeActionUrl(configuredSlack?.appTokenPendingUrl) ??
+        (stepAppId ? `https://api.slack.com/apps/${stepAppId}/general` : null);
     if (tokenPage &&
         appId && /^A[A-Z0-9]+$/.test(appId) &&
         new URL(tokenPage).hostname === "api.slack.com" &&
@@ -568,10 +614,10 @@ function pendingSlackAction(status, companySlug) {
             type: "slack-app-token",
             title: `Finish ${nonEmptyString(agent?.name) ?? "the agent"}'s Slack connection`,
             summary: "connect it to Slack",
-            instruction: "Create an app-level token with the connections:write scope, then paste it into HQ. HQ verifies the token and resumes setup; if Slack asks you to install the app, follow the install link shown there.",
+            instruction: SLACK_APP_TOKEN_INSTRUCTION,
             url: `https://api.slack.com/apps/${appId}/general`,
             urlLabel: "Get token",
-            pasteUrl: `https://hq.computer/companies/${encodeURIComponent(companyUrlKey)}/agents?setup=${encodeURIComponent(agentUid)}`,
+            pasteUrl: consolePasteUrl(companyUrlKey, agentUid),
         };
     }
     const diagnostics = recordValue(agent?.channelDiagnostics);
@@ -587,6 +633,11 @@ function pendingSlackAction(status, companySlug) {
             instruction: "Open this page, create the app-level token, then provide it in the agent's Slack setup.",
             url,
             urlLabel: "Open",
+            ...(agentUid && AGENT_UID_PATTERN.test(agentUid) && companyUid && /^cmp_[A-Za-z0-9_-]+$/.test(companyUid)
+                ? {
+                    pasteUrl: consolePasteUrl(companySlug && /^[a-z0-9][a-z0-9-]*$/.test(companySlug) ? companySlug : companyUid, agentUid),
+                }
+                : {}),
         };
     }
     if (slack?.inboundCapability !== "pending-install")
@@ -606,6 +657,9 @@ function pendingSlackAction(status, companySlug) {
  * changing the renderers or command control flow.
  */
 function pendingOperatorActions(status, companySlug) {
+    const fromServer = serverPendingActions(status);
+    if (fromServer.length > 0)
+        return fromServer;
     return [
         currentDeviceSignInAction(status),
         pendingSlackAction(status, companySlug),
@@ -616,7 +670,7 @@ async function consoleCompanySlug(token, status, companyRef) {
         return companyRef;
     const agent = recordValue(status.agent);
     const slack = recordValue(recordValue(agent?.channels)?.slack);
-    if (!slack?.appTokenPendingUrl)
+    if (!slack?.appTokenPendingUrl && !slackAppIdFromSetupState(status))
         return undefined;
     const companyUid = nonEmptyString(agent?.companyUid);
     if (!companyUid)

package/dist/commands/daemon.js

@@ -91,6 +91,7 @@ async function loadDefaults(over) {
                 home: dir ?? home,
                 existsSync: fs.existsSync,
                 listDir: (dir) => fs.readdirSync(dir),
+                launchdJobLoaded: (label) => run("launchctl", ["print", `gui/${process.getuid?.() ?? 0}/${label}`]).status === 0,
                 windowsTaskExists: (task) => run("schtasks.exe", ["/Query", "/TN", task]).status === 0,
             })),
         resolveHqRoot: over.resolveHqRoot ?? ((flag) => resolveDaemonHqRoot(flag, { env, cwd: process.cwd(), home })),

package/dist/commands/files-browse.d.ts

@@ -502,6 +502,8 @@ export declare function resolveBrowseSession(): Promise<{
  * and registers `share`/`unshare`/`acl`; this function appends the two
  * new browse-vs-sync subcommands so they share the `--company` switch.
  */
-export declare function registerFilesBrowseCommands(filesCmd: Command): void;
+export declare function registerFilesBrowseCommands(filesCmd: Command, deps?: {
+    personalS3Factory?: S3ClientFactory;
+}): void;
 export {};
 //# sourceMappingURL=files-browse.d.ts.map

package/dist/commands/files-browse.js

@@ -192,6 +192,18 @@ export function formatBrowseTable(rows) {
         lines.push(renderRow(row));
     return lines.join("\n");
 }
+function formatSearchResults(rows, query) {
+    if (rows.length === 0) {
+        return `No files found for search ${JSON.stringify(query)}.`;
+    }
+    return formatBrowseTable(rows);
+}
+function normalizeCompanySearchPath(value) {
+    return value
+        .split("/")
+        .map((segment) => (segment === "company" ? "companies" : segment))
+        .join("/");
+}
 /** Guard: the personal path needs an S3 factory. */
 function requirePersonalS3Factory(f) {
     if (!f) {
@@ -530,7 +542,17 @@ export async function runSearch(input) {
         region: input.region,
     });
     const q = input.query.toLowerCase();
-    return rows.filter((r) => r.key.toLowerCase().includes(q));
+    // Only a leading `company/<slug>...` path form is an alias for the
+    // `companies/` anchor. A bare `company` stays a plain substring, since every
+    // company-mode key starts with `companies/<slug>/`.
+    const normalizedQuery = /^company\/[^/]+/.test(q)
+        ? normalizeCompanySearchPath(q)
+        : q;
+    return rows.filter((r) => {
+        const key = r.key.toLowerCase();
+        return (key.includes(q) ||
+            normalizeCompanySearchPath(key).includes(normalizedQuery));
+    });
 }
 /** Per-machine pin set path: `<hqRoot>/.hq/pins.json`. */
 export function pinFilePath(hqRoot) {
@@ -927,7 +949,8 @@ export async function resolveBrowseSession() {
  * and registers `share`/`unshare`/`acl`; this function appends the two
  * new browse-vs-sync subcommands so they share the `--company` switch.
  */
-export function registerFilesBrowseCommands(filesCmd) {
+export function registerFilesBrowseCommands(filesCmd, deps = {}) {
+    const personalS3Factory = deps.personalS3Factory ?? defaultS3Factory;
     filesCmd
         .command("browse [path]")
         .description("List vault objects under [path] without syncing them locally. Private-folder rows (foo/) are labelled and do not imply child access; their children are creator-only. Uses the browse-vend path (role-bypass allowed). Pass --personal to browse the caller's personal vault; otherwise [path] must start with companies/<slug>/.")
@@ -961,7 +984,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                     personalMode: true,
                     personalUid,
                     vaultClient: cognito,
-                    s3Factory: defaultS3Factory,
+                    s3Factory: personalS3Factory,
                     region: DEFAULT_COGNITO.region,
                 });
                 console.log(formatBrowseTable(result.rows));
@@ -1053,7 +1076,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                     personalMode: true,
                     personalUid,
                     vaultClient: cognito,
-                    s3Factory: defaultS3Factory,
+                    s3Factory: personalS3Factory,
                     region: DEFAULT_COGNITO.region,
                 });
                 if (result.destination.kind === "file") {
@@ -1170,10 +1193,10 @@ export function registerFilesBrowseCommands(filesCmd) {
                     personalMode: true,
                     personalUid,
                     vaultClient: cognito,
-                    s3Factory: defaultS3Factory,
+                    s3Factory: personalS3Factory,
                     region: DEFAULT_COGNITO.region,
                 });
-                console.log(formatBrowseTable(rows));
+                console.log(formatSearchResults(rows, query));
                 return;
             }
             if (!company) {
@@ -1187,7 +1210,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                 companyClient: makeCompanyPresignFactory(accessToken, company),
                 region: DEFAULT_COGNITO.region,
             });
-            console.log(formatBrowseTable(rows));
+            console.log(formatSearchResults(rows, query));
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);

package/dist/commands/integrations-api.js

@@ -8,7 +8,7 @@
  * is optional and read defensively.
  */
 import { vaultApiFetch } from "../utils/vault-api.js";
-import { raiseForResponse, } from "./integrations-core.js";
+import { IntegrationsCliError, raiseForResponse, } from "./integrations-core.js";
 export async function listCatalog(token, companyUid, opts = {}) {
     const query = {
         companyUid,
@@ -59,8 +59,19 @@ export async function installIntegration(token, companyUid, input) {
         method: "POST",
         body: { companyUid, ...input },
     });
-    if (!res.ok)
-        await raiseForResponse(res, "Failed to connect the app");
+    if (!res.ok) {
+        try {
+            await raiseForResponse(res, "Failed to connect the app");
+        }
+        catch (error) {
+            if (error instanceof IntegrationsCliError &&
+                error.status === 409 &&
+                error.code === "INTEGRATION_FACTORY_INSTALL_IN_PROGRESS") {
+                throw new IntegrationsCliError("An install for this app is already running. Wait for it to finish before trying again.", { expected: true, status: 409, code: error.code });
+            }
+            throw error;
+        }
+    }
     return (await res.json());
 }
 export async function uninstallIntegration(token, companyUid, installationId) {

package/dist/commands/lanes-accounts.d.ts

@@ -17,6 +17,9 @@ export declare function createLaneAccountsHandlers(deps: LaneAccountsHandlerDeps
         host?: string;
         company?: string;
     }) => Promise<void>;
+    runAccountsClearQuota: (ctx: Ctx, providerRaw: string, accountIdRaw: string, opts: {
+        model?: string;
+    }) => Promise<void>;
     runAccountsEnable: (ctx: Ctx, providerRaw: string, accountId: string) => Promise<void>;
     runAccountsDisable: (ctx: Ctx, providerRaw: string, accountId: string, opts: {
         reason?: string;

package/dist/commands/lanes-accounts.js

@@ -8,7 +8,7 @@ import { AccountResolutionError, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, PROVIDER
 import { assertUniqueAccountHomes, providerCompactAfterMs } from "../lib/lanes/config.js";
 import { resolveLaneEffort } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
-import { accountQuotaView, loadQuotaState } from "../lib/lanes/quota.js";
+import { accountQuotaView, clearAccountQuota, loadQuotaState } from "../lib/lanes/quota.js";
 import { resolveLaneModel } from "../lib/lanes/spawn.js";
 export function createLaneAccountsHandlers(deps) {
     const { automaticBalanceMoveHistoryReason, ensureDir, laneWithRecoveredProviderSession, loadClaudeBalanceHostSnapshots, parseRemoteJson, prepareAccountMove, printJson, reconcileHostFromCtx, resolveCallerPath } = deps;
@@ -489,6 +489,29 @@ export function createLaneAccountsHandlers(deps) {
             home_source: home === account.home ? "default" : "host",
         });
     }
+    async function runAccountsClearQuota(ctx, providerRaw, accountIdRaw, opts) {
+        const provider = parseLaneProvider(providerRaw);
+        const account = accountIdRaw.trim();
+        if (!account) {
+            throw new AccountResolutionError("unknown_account", "account-id must be non-empty", { provider, account: accountIdRaw, enabled: [] });
+        }
+        const model = opts.model?.trim();
+        if (opts.model !== undefined && !model) {
+            throw new LanesError("invalid_model", "--model must be non-empty", {
+                provider,
+                account,
+            });
+        }
+        const cleared = clearAccountQuota(ctx.hqRoot(), provider, account, model === undefined ? {} : { model });
+        printJson({
+            ok: true,
+            action: "accounts.clear-quota",
+            provider,
+            account,
+            all_models_quota_reset_at: cleared.all_models_quota_reset_at,
+            model_quota_resets: cleared.model_quota_resets,
+        });
+    }
     async function runAccountsEnable(ctx, providerRaw, accountId) {
         const hqRoot = ctx.hqRoot();
         const provider = parseLaneProvider(providerRaw);
@@ -562,6 +585,7 @@ export function createLaneAccountsHandlers(deps) {
         runAccountsBalance,
         runAccountsLogin,
         runAccountsSetHome,
+        runAccountsClearQuota,
         runAccountsEnable,
         runAccountsDisable
     };

package/dist/commands/lanes.js

@@ -8453,6 +8453,16 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (provider, accountId, opts) => {
         await accountHandlers.runAccountsLogin(ctx, provider, accountId, opts);
     }));
+    accounts
+        .command("clear-quota")
+        .description("Clear quota reset marks for a provider account")
+        .argument("<provider>", "claude | codex | grok")
+        .argument("<account-id>", "Account id")
+        .option("--model <model>", "Clear only this model's reset")
+        .option("--json", "JSON on stdout (always)")
+        .action(wrap(async (provider, accountId, opts) => {
+        await accountHandlers.runAccountsClearQuota(ctx, provider, accountId, opts);
+    }));
     accounts
         .command("enable")
         .description("Enable an account without touching credentials")

package/dist/lib/bot/prompt.d.ts

@@ -47,6 +47,8 @@ export interface WorkerPromptSource {
     contextPaths: string[];
     /** companies/<co>/policies/*.md, hqRoot-relative. */
     policyPaths: string[];
+    /** Invalid policy files excluded from policyPaths, with a safe diagnostic. */
+    policyDiagnostics?: string[];
 }
 export interface PromptSources {
     workerYaml?: string;

package/dist/lib/bot/prompt.js

@@ -20,6 +20,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
 import { packageRoot } from "../../utils/hq-roots.js";
+import { policyLoadDiagnostic } from "../policy-validator.js";
 export const MEMORY_FILE_BUDGET_BYTES = 64 * 1024;
 export const MEMORY_TOTAL_BUDGET_BYTES = 192 * 1024;
 export const CONTEXT_FILE_BUDGET_BYTES = 32 * 1024;
@@ -117,7 +118,7 @@ function resolveSkillFile(hqRoot, workerDir, name, doc, io) {
     return undefined;
 }
 function readWorkerSource(hqRoot, workerDir, workerYaml, io, companyOverride) {
-    const out = { skills: [], contextFiles: [], contextPaths: [], policyPaths: [] };
+    const out = { skills: [], contextFiles: [], contextPaths: [], policyPaths: [], policyDiagnostics: [] };
     let doc = {};
     if (workerYaml) {
         try {
@@ -197,9 +198,28 @@ function readWorkerSource(hqRoot, workerDir, workerYaml, io, companyOverride) {
             catch {
                 names = [];
             }
-            out.policyPaths = names
-                .filter((n) => n.endsWith(".md") && !n.startsWith(".") && !n.includes(".conflict-"))
-                .map((n) => path.join(policiesRel, n));
+            for (const name of names) {
+                if (!name.endsWith(".md") || name.startsWith(".") || name.includes(".conflict-"))
+                    continue;
+                const relative = path.join(policiesRel, name);
+                const absolute = insideHqRoot(hqRoot, relative);
+                if (!absolute)
+                    continue;
+                let content;
+                try {
+                    content = io.readFileSync(absolute);
+                }
+                catch {
+                    out.policyPaths.push(relative);
+                    continue;
+                }
+                const diagnostic = policyLoadDiagnostic(content, absolute);
+                if (diagnostic) {
+                    out.policyDiagnostics.push(`${relative}: ${diagnostic.split("\n", 1)[0]}`);
+                    continue;
+                }
+                out.policyPaths.push(relative);
+            }
         }
     }
     return out;
@@ -331,6 +351,11 @@ export function buildSystemPrompt(input) {
                 `Hard rules for \`${company}\`. Read the relevant ones before acting; they override anything else in this prompt.\n\n` +
                 worker.policyPaths.map((p) => `- ${p}`).join("\n"));
         }
+        if (worker.policyDiagnostics && worker.policyDiagnostics.length > 0) {
+            parts.push(`## Policy load diagnostics\n\n` +
+                `These company policy files were not loaded because their frontmatter is invalid. Correct each file before relying on its rules.\n\n` +
+                worker.policyDiagnostics.map((diagnostic) => `- ${diagnostic}`).join("\n"));
+        }
         if (worker.contextFiles.length > 0 || worker.contextPaths.length > 0) {
             const blocks = worker.contextFiles.map((c) => `### ${c.path}\n\n${c.body.trim()}`);
             const more = worker.contextPaths.length > 0

package/dist/lib/daemon/legacy.d.ts

@@ -3,8 +3,9 @@
  * still runs a service, the daemon leaves that service alone instead of
  * starting a second copy, and `hq daemon migrate` lists it.
  *
- * Detection only reads the filesystem (and asks schtasks on Windows). Nothing
- * here stops or removes a unit.
+ * Detection reads unit files and checks for an orphaned loaded macOS mesh job
+ * whose plist was removed. Windows scheduled tasks are probed through
+ * schtasks. Nothing here stops or removes a unit.
  */
 import type { ServiceName } from "./catalog.js";
 export interface LegacyUnit {
@@ -22,6 +23,8 @@ export interface LegacyProbeDeps {
     home: string;
     existsSync: (p: string) => boolean;
     listDir: (dir: string) => string[];
+    /** True when launchctl can print the GUI-domain job despite a missing plist. */
+    launchdJobLoaded: (label: string) => boolean;
     windowsTaskExists: (taskName: string) => boolean;
 }
 export declare function describeLegacyUnit(unit: LegacyUnit): string;

package/dist/lib/daemon/legacy.js

@@ -3,8 +3,9 @@
  * still runs a service, the daemon leaves that service alone instead of
  * starting a second copy, and `hq daemon migrate` lists it.
  *
- * Detection only reads the filesystem (and asks schtasks on Windows). Nothing
- * here stops or removes a unit.
+ * Detection reads unit files and checks for an orphaned loaded macOS mesh job
+ * whose plist was removed. Windows scheduled tasks are probed through
+ * schtasks. Nothing here stops or removes a unit.
  */
 import * as path from "node:path";
 const KIT_SERVICES = ["sync", "inbox", "heartbeat"];
@@ -52,8 +53,9 @@ function darwinUnits(deps) {
     const units = [];
     const at = (label) => path.join(dir, `${label}.plist`);
     const add = (unitId, service, label, migratable = true) => units.push({ unitId, service, kind: "launchd", name: label, path: at(label), migratable });
-    if (deps.existsSync(at("ai.getindigo.hq-mesh-daemon")))
-        add("mesh", "mesh", "ai.getindigo.hq-mesh-daemon");
+    const meshLabel = "ai.getindigo.hq-mesh-daemon";
+    if (deps.existsSync(at(meshLabel)) || deps.launchdJobLoaded(meshLabel))
+        add("mesh", "mesh", meshLabel);
     for (const file of safeList(deps, dir).sort()) {
         const m = /^ai\.getindigo\.hq-bot\.(.+)\.plist$/.exec(file);
         if (m)

package/dist/lib/daemon/migrate.d.ts

@@ -17,11 +17,13 @@
  * folder, so nobody but root decides what gets installed there.
  */
 import type { RunCommand } from "../service-manager/launchd.js";
-import type { LegacyUnit } from "./legacy.js";
+import { type LegacyUnit } from "./legacy.js";
 export interface AdoptedUnit extends LegacyUnit {
     /** Where the unit's definition (plist, unit file, task XML) was moved. */
     movedTo: string;
     adoptedAt: number;
+    /** Launchd job was loaded, but its source plist no longer existed. */
+    definitionMissing?: true;
 }
 export interface MigrateDeps {
     run: RunCommand;
@@ -64,5 +66,12 @@ export interface RestoreResult {
 }
 export declare function readAdoptedUnits(recordPath: string): AdoptedUnit[];
 export declare function adoptLegacyUnits(units: readonly LegacyUnit[], deps: MigrateDeps): AdoptResult;
+/** Retire the migratable legacy mesh job and emit the daemon's operator-facing result lines. */
+export declare function retireLegacyMeshUnits(units: readonly LegacyUnit[], options: {
+    platform: NodeJS.Platform;
+    managed: boolean;
+    hosted: boolean;
+    meshEnabled: boolean;
+}, deps: MigrateDeps, log: (level: "info" | "warn", message: string) => void): AdoptResult;
 export declare function restoreLegacyUnits(deps: MigrateDeps): RestoreResult;
 //# sourceMappingURL=migrate.d.ts.map

package/dist/lib/daemon/migrate.js

@@ -18,6 +18,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { legacyMeshUnitsToRetire } from "./legacy.js";
 import { ensurePrivateDir } from "./paths.js";
 export function readAdoptedUnits(recordPath) {
     let text;
@@ -99,8 +100,10 @@ function adoptOne(unit, deps) {
             if (bootout.status !== 0 && deps.run("launchctl", ["print", target]).status === 0) {
                 must(deps.run, "launchctl", ["bootout", target]);
             }
+            if (!fs.existsSync(unit.path))
+                return { movedTo: unit.path, definitionMissing: true };
             moveFile(unit.path, to);
-            return to;
+            return { movedTo: to };
         }
         case "systemd-user":
         case "systemd-system": {
@@ -109,7 +112,7 @@ function adoptOne(unit, deps) {
             must(deps.run, ...systemctl(unit, deps, ["disable", "--now", unit.name]));
             moveFile(unit.path, to);
             deps.run(...systemctl(unit, deps, ["daemon-reload"]));
-            return to;
+            return { movedTo: to };
         }
         case "schtasks": {
             const xml = must(deps.run, "schtasks.exe", ["/Query", "/TN", unit.name, "/XML"]);
@@ -117,7 +120,7 @@ function adoptOne(unit, deps) {
             fs.writeFileSync(to, encodeTaskXml(xml), { mode: 0o600 });
             deps.run("schtasks.exe", ["/End", "/TN", unit.name]);
             must(deps.run, "schtasks.exe", ["/Delete", "/TN", unit.name, "/F"]);
-            return to;
+            return { movedTo: to };
         }
     }
 }
@@ -141,15 +144,15 @@ export function adoptLegacyUnits(units, deps) {
             continue;
         }
         const store = storeFor(unit.kind, deps);
-        let movedTo;
+        let adoptedFields;
         try {
-            movedTo = adoptOne(unit, deps);
+            adoptedFields = adoptOne(unit, deps);
         }
         catch (err) {
             result.failed.push({ unit, error: err.message });
             continue;
         }
-        const adopted = { ...unit, movedTo, adoptedAt: now() };
+        const adopted = { ...unit, ...adoptedFields, adoptedAt: now() };
         const next = [...recordOf(store), adopted];
         try {
             // Record each unit as soon as it is moved, so a failure later in the
@@ -165,7 +168,7 @@ export function adoptLegacyUnits(units, deps) {
                 restoreOne(adopted, deps);
             }
             catch (restoreErr) {
-                rollback = `; putting it back also failed (${restoreErr.message}), its definition is at ${movedTo}`;
+                rollback = `; putting it back also failed (${restoreErr.message}), its definition is at ${adopted.movedTo}`;
             }
             result.failed.push({ unit, error: `could not record the takeover: ${err.message}${rollback}` });
         }
@@ -192,6 +195,8 @@ function restoreOne(unit, deps) {
         case "launchd": {
             if (!unit.path)
                 throw new Error(`no plist path recorded for ${unit.name}`);
+            if (unit.definitionMissing)
+                throw new Error("the original LaunchAgent plist is missing; this unit cannot be restored");
             moveBack(unit, unit.path);
             must(deps.run, "launchctl", ["bootstrap", `gui/${deps.uid}`, unit.path]);
             return;
@@ -216,6 +221,16 @@ function restoreOne(unit, deps) {
             return;
     }
 }
+/** Retire the migratable legacy mesh job and emit the daemon's operator-facing result lines. */
+export function retireLegacyMeshUnits(units, options, deps, log) {
+    const selected = legacyMeshUnitsToRetire(units, options);
+    const result = adoptLegacyUnits(selected, deps);
+    for (const unit of result.adopted)
+        log("info", `retired legacy ${unit.unitId} unit ${unit.name}; hq daemon now owns mesh`);
+    for (const failure of result.failed)
+        log("warn", `could not retire legacy ${failure.unit.unitId} unit ${failure.unit.name}: ${failure.error}`);
+    return result;
+}
 function restoreFrom(record, deps, check, result) {
     const units = readAdoptedUnits(record);
     if (units.length === 0)