@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/daemon/install.js

@@ -1,320 +0,0 @@
-/**
- * Install / uninstall the ONE OS unit that runs `node <hq> daemon run --managed`.
- * `--managed` tells the daemon a service manager relaunches it when it exits,
- * which is how it restarts itself onto a new CLI version after an update.
- *
- * - macOS: LaunchAgent ai.getindigo.hq-daemon (RunAtLoad + KeepAlive)
- * - Linux, per-user: systemd user unit hq-daemon.service
- * - Linux, system (outposts and agent boxes): /etc/systemd/system/hq-daemon.service
- *   running as the box's login user; needs root
- * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon
- * - anything else: no unit; the caller prints the command to run
- *
- * The unit never names services. `hq daemon run` reads the machine type and
- * overrides from ~/.hq/daemon/config.json, so the unit does not change when
- * services are added. Every service-manager call goes through `run`, so tests
- * never touch launchctl, systemctl or schtasks.
- */
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { activateLaunchd, deactivateLaunchd, launchdPlistPath, renderLaunchdPlist, } from "../service-manager/launchd.js";
-import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdUnitPath, } from "../service-manager/systemd.js";
-import { escapeXml, shellQuote } from "../service-manager/types.js";
-import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
-import { userToolDirs } from "./tools.js";
-export const DAEMON_LAUNCHD_LABEL = "ai.getindigo.hq-daemon";
-export const DAEMON_SYSTEMD_UNIT = "hq-daemon.service";
-export const DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
-export const SYSTEM_UNIT_DIR = "/etc/systemd/system";
-export const ROOT_REFUSAL = "hq daemon runs its services as the machine's login user, never as root.";
-/**
- * Why the daemon must not run here as root, or null when it may. Agent kits
- * are the one exception: they run in containers where root is often the only
- * account.
- */
-export function daemonRootRefusal(isRoot, machineType) {
-    if (!isRoot || machineType === "agent-kit")
-        return null;
-    return `${ROOT_REFUSAL} Run it as that user instead of root.`;
-}
-/** Boxes run the daemon as a system unit; everything else per user. */
-export function installScopeFor(machineType) {
-    return machineType === "outpost" || machineType === "agent-box" ? "system" : "user";
-}
-function daemonSpec(host) {
-    return {
-        name: "daemon",
-        label: DAEMON_LAUNCHD_LABEL,
-        description: "HQ daemon: runs this machine's HQ background services",
-        args: ["daemon", "run", "--managed"],
-        logPath: path.join(host.daemonDir, "logs", "daemon.stdout.log"),
-        workingDir: host.daemonDir,
-        env: host.env ?? {},
-        restartSec: 10,
-        unitName: DAEMON_SYSTEMD_UNIT,
-    };
-}
-function serviceHost(host) {
-    return { home: host.home, nodeBinary: host.nodeBinary, hqBinary: host.hqBinary };
-}
-/**
- * Output goes to the journal: an `append:` log file would be created by
- * systemd as root inside the user's home, and the daemon (running as the user)
- * writes its own logs under ~/.hq/daemon/logs.
- *
- * `KillMode=process`: systemd signals only the daemon. The daemon stops its
- * services itself on SIGTERM, and after a CLI update it can leave them running
- * for the next daemon to adopt (see succession.ts). A daemon that starts and
- * finds services it did not adopt stops them first.
- */
-function renderSystemdSystemUnit(host, user, userHome) {
-    const exec = [host.nodeBinary, host.hqBinary, "daemon", "run", "--managed"].map(shellQuote).join(" ");
-    const env = {
-        ...host.env,
-        HOME: userHome,
-        // The login user's own tools come first, so the daemon runs (and can
-        // update) their Claude, Codex and Grok rather than root's copies in /usr.
-        PATH: [...userToolDirs(userHome), host.env?.PATH ?? "/usr/local/bin:/usr/bin:/bin"].join(":"),
-    };
-    const envLines = Object.entries(env)
-        .sort(([a], [b]) => a.localeCompare(b))
-        .map(([k, v]) => `Environment=${shellQuote(`${k}=${v}`)}`)
-        .join("\n");
-    return `[Unit]
-Description=HQ daemon: runs this machine's HQ background services (user=${user})
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=${user}
-ExecStart=${exec}
-WorkingDirectory=${userHome}
-Restart=always
-RestartSec=10
-KillMode=process
-TimeoutStopSec=20
-${envLines}
-
-[Install]
-WantedBy=multi-user.target
-`;
-}
-function windowsArgQuote(value) {
-    if (/^[A-Za-z0-9_.:\\/-]+$/.test(value))
-        return value;
-    return `"${value.replace(/"/g, '\\"')}"`;
-}
-/**
- * Logon-triggered task for the installing user. InteractiveToken is what an
- * unprivileged install can register, so the task runs while the user is
- * logged on. `conhost.exe --headless` keeps a console window from opening.
- */
-function renderWindowsTaskXml(host) {
-    const user = escapeXml(host.windowsUser);
-    const nodeArg = windowsArgQuote(host.nodeBinary);
-    const hqArg = windowsArgQuote(host.hqBinary);
-    const command = host.windowsHeadlessLauncher ?? host.nodeBinary;
-    // A task cannot set environment variables, so an HQ_DAEMON_DIR override
-    // travels as an argument.
-    const dirOverride = host.env?.HQ_DAEMON_DIR;
-    const runArgs = dirOverride ? `daemon run --managed --daemon-dir ${windowsArgQuote(dirOverride)}` : "daemon run --managed";
-    const args = host.windowsHeadlessLauncher ? `--headless ${nodeArg} ${hqArg} ${runArgs}` : `${hqArg} ${runArgs}`;
-    return `<?xml version="1.0" encoding="UTF-16"?>
-<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
-  <RegistrationInfo>
-    <URI>\\${DAEMON_WINDOWS_TASK}</URI>
-    <Description>HQ daemon: runs this machine's HQ background services</Description>
-  </RegistrationInfo>
-  <Triggers>
-    <LogonTrigger>
-      <Enabled>true</Enabled>
-      <UserId>${user}</UserId>
-    </LogonTrigger>
-  </Triggers>
-  <Principals>
-    <Principal id="Author">
-      <UserId>${user}</UserId>
-      <LogonType>InteractiveToken</LogonType>
-      <RunLevel>LeastPrivilege</RunLevel>
-    </Principal>
-  </Principals>
-  <Settings>
-    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
-    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
-    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
-    <AllowHardTerminate>true</AllowHardTerminate>
-    <StartWhenAvailable>true</StartWhenAvailable>
-    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
-    <AllowStartOnDemand>true</AllowStartOnDemand>
-    <Enabled>true</Enabled>
-    <Hidden>true</Hidden>
-    <RunOnlyIfIdle>false</RunOnlyIfIdle>
-    <DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
-    <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
-    <WakeToRun>false</WakeToRun>
-    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
-    <Priority>7</Priority>
-    <RestartOnFailure>
-      <Interval>PT1M</Interval>
-      <Count>999</Count>
-    </RestartOnFailure>
-  </Settings>
-  <Actions Context="Author">
-    <Exec>
-      <Command>${escapeXml(command)}</Command>
-      <Arguments>${escapeXml(args)}</Arguments>
-      <WorkingDirectory>${escapeXml(host.daemonDir)}</WorkingDirectory>
-    </Exec>
-  </Actions>
-</Task>
-`;
-}
-/** schtasks reads task XML as UTF-16 LE with a BOM. */
-function encodeWindowsTaskXml(rendered) {
-    return Buffer.from(`\uFEFF${rendered}`, "utf16le");
-}
-export function planDaemonUnit(host, options) {
-    const spec = daemonSpec(host);
-    if (host.platform === "darwin") {
-        return { kind: "launchd", unitPath: launchdPlistPath(host.home, spec), rendered: renderLaunchdPlist(spec, serviceHost(host)) };
-    }
-    if (host.platform === "linux") {
-        if (options.scope === "system") {
-            if (!options.runAsUser) {
-                throw new Error("A system install needs the box's login user: pass --user <name>, or provisioning writes it to /etc/hq/machine-type (user=<name>).");
-            }
-            if (options.runAsUser === "root")
-                throw new Error(ROOT_REFUSAL);
-            if (!options.runAsHome)
-                throw new Error(`Could not find the home directory of ${options.runAsUser}.`);
-            return {
-                kind: "systemd-system",
-                unitPath: path.join(host.systemUnitDir, DAEMON_SYSTEMD_UNIT),
-                rendered: renderSystemdSystemUnit(host, options.runAsUser, options.runAsHome),
-            };
-        }
-        return { kind: "systemd-user", unitPath: systemdUnitPath(host.home, spec), rendered: renderSystemdUserUnit(spec, serviceHost(host)) };
-    }
-    if (host.platform === "win32") {
-        return {
-            kind: "schtasks",
-            unitPath: path.join(host.daemonDir, `${DAEMON_WINDOWS_TASK}.xml`),
-            rendered: renderWindowsTaskXml(host),
-        };
-    }
-    const manualCommand = [host.nodeBinary, host.hqBinary, "daemon", "run"].map(shellQuote).join(" ");
-    return { kind: "manual", unitPath: "", rendered: "", manualCommand };
-}
-function commandError(what, r) {
-    return new Error(`${what} failed: ${r.stderr.trim() || r.stdout.trim() || `exit ${r.status}`}`);
-}
-function activate(plan, host, run, sleep) {
-    switch (plan.kind) {
-        case "launchd":
-            activateLaunchd(plan.unitPath, run, host.uid, { sleep });
-            return;
-        case "systemd-user":
-            activateSystemd(DAEMON_SYSTEMD_UNIT, run);
-            return;
-        case "systemd-system": {
-            const reload = run("systemctl", ["daemon-reload"]);
-            if (reload.status !== 0)
-                throw commandError("systemctl daemon-reload", reload);
-            const enable = run("systemctl", ["enable", "--now", DAEMON_SYSTEMD_UNIT]);
-            if (enable.status !== 0)
-                throw commandError(`systemctl enable --now ${DAEMON_SYSTEMD_UNIT}`, enable);
-            run("systemctl", ["restart", DAEMON_SYSTEMD_UNIT]);
-            return;
-        }
-        case "schtasks": {
-            const create = run("schtasks.exe", ["/Create", "/TN", DAEMON_WINDOWS_TASK, "/XML", plan.unitPath, "/F"]);
-            if (create.status !== 0)
-                throw commandError("schtasks /Create", create);
-            const start = run("schtasks.exe", ["/Run", "/TN", DAEMON_WINDOWS_TASK]);
-            if (start.status !== 0)
-                throw commandError("schtasks /Run", start);
-            return;
-        }
-        case "manual":
-            return;
-    }
-}
-export function installDaemonUnit(host, options, deps) {
-    const plan = planDaemonUnit(host, options);
-    if (plan.kind === "manual") {
-        return { kind: plan.kind, unitPath: "", installed: false, running: false, manualCommand: plan.manualCommand };
-    }
-    if (plan.kind === "systemd-system" && !host.isRoot) {
-        throw new Error("Installing the daemon on a box writes a system unit, which needs root. Run: sudo hq daemon install");
-    }
-    fs.mkdirSync(path.dirname(plan.unitPath), { recursive: true });
-    if (plan.kind !== "systemd-system")
-        fs.mkdirSync(path.join(host.daemonDir, "logs"), { recursive: true });
-    if (plan.kind === "schtasks")
-        fs.writeFileSync(plan.unitPath, encodeWindowsTaskXml(plan.rendered));
-    else
-        fs.writeFileSync(plan.unitPath, plan.rendered, { mode: plan.kind === "systemd-system" ? 0o644 : 0o600 });
-    try {
-        activate(plan, host, deps.run, deps.sleep);
-        return { kind: plan.kind, unitPath: plan.unitPath, installed: true, running: true };
-    }
-    catch (err) {
-        return {
-            kind: plan.kind,
-            unitPath: plan.unitPath,
-            installed: true,
-            running: false,
-            error: err instanceof Error ? err.message : String(err),
-        };
-    }
-}
-export function uninstallDaemonUnit(host, options, deps) {
-    // A system uninstall does not need the login user; only the unit path matters.
-    const plan = host.platform === "linux" && options.scope === "system"
-        ? { kind: "systemd-system", unitPath: path.join(host.systemUnitDir, DAEMON_SYSTEMD_UNIT), rendered: "" }
-        : planDaemonUnit(host, options);
-    if (plan.kind === "manual")
-        return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
-    // A registered task is removed even when its XML file has gone missing.
-    const present = fs.existsSync(plan.unitPath) ||
-        (plan.kind === "schtasks" && deps.run("schtasks.exe", ["/Query", "/TN", DAEMON_WINDOWS_TASK]).status === 0);
-    if (!present)
-        return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
-    switch (plan.kind) {
-        case "launchd":
-            deactivateLaunchd(plan.unitPath, deps.run, host.uid);
-            break;
-        case "systemd-user":
-            deactivateSystemd(DAEMON_SYSTEMD_UNIT, deps.run);
-            break;
-        case "systemd-system": {
-            if (!host.isRoot)
-                throw new Error("Removing the box's system unit needs root. Run: sudo hq daemon uninstall");
-            const disable = deps.run("systemctl", ["disable", "--now", DAEMON_SYSTEMD_UNIT]);
-            // Keep the unit file so a later uninstall still finds it.
-            if (disable.status !== 0)
-                throw commandError(`systemctl disable --now ${DAEMON_SYSTEMD_UNIT}`, disable);
-            deps.run("systemctl", ["daemon-reload"]);
-            break;
-        }
-        case "schtasks": {
-            deps.run("schtasks.exe", ["/End", "/TN", DAEMON_WINDOWS_TASK]);
-            // Ending the task stops only its root process (conhost when --headless is
-            // used); node and the services it runs keep going. End the recorded
-            // daemon's whole process tree.
-            const owner = readPidLock(path.join(host.daemonDir, "daemon.pid"));
-            if (owner && owner.pid !== process.pid) {
-                deps.run("taskkill.exe", ["/PID", String(owner.pid), "/T", "/F"]);
-            }
-            const del = deps.run("schtasks.exe", ["/Delete", "/TN", DAEMON_WINDOWS_TASK, "/F"]);
-            // Keep the XML so a later uninstall still finds the task.
-            if (del.status !== 0)
-                throw commandError(`schtasks /Delete /TN ${DAEMON_WINDOWS_TASK}`, del);
-            break;
-        }
-    }
-    fs.rmSync(plan.unitPath, { force: true });
-    return { kind: plan.kind, unitPath: plan.unitPath, removed: true };
-}
-//# sourceMappingURL=install.js.map

package/dist/lib/daemon/legacy-sync-env.d.ts

@@ -1,10 +0,0 @@
-/**
- * Environment assignments kept in the legacy outpost sync service drop-ins.
- * The daemon reads these so taking over outpost-sync.service keeps its tuned
- * sync limits. This module is deliberately tolerant: a bad or missing drop-in
- * must never stop daemon planning.
- */
-export declare const LEGACY_SYNC_DROPIN_DIR = "/etc/systemd/system/outpost-sync.service.d";
-/** Read simple KEY=VALUE and quoted "KEY=VALUE" Environment directives. */
-export declare function readLegacySyncEnv(platform: NodeJS.Platform, directory?: string): Record<string, string>;
-//# sourceMappingURL=legacy-sync-env.d.ts.map

package/dist/lib/daemon/legacy-sync-env.js

@@ -1,58 +0,0 @@
-/**
- * Environment assignments kept in the legacy outpost sync service drop-ins.
- * The daemon reads these so taking over outpost-sync.service keeps its tuned
- * sync limits. This module is deliberately tolerant: a bad or missing drop-in
- * must never stop daemon planning.
- */
-import * as fs from "node:fs";
-import * as path from "node:path";
-export const LEGACY_SYNC_DROPIN_DIR = "/etc/systemd/system/outpost-sync.service.d";
-function assignments(text, into) {
-    let inService = false;
-    for (const rawLine of text.split(/\r?\n/)) {
-        const line = rawLine.trim();
-        if (!line || line.startsWith("#"))
-            continue;
-        const section = /^\[([^\]]+)\]$/.exec(line);
-        if (section) {
-            inService = section[1] === "Service";
-            continue;
-        }
-        if (!inService)
-            continue;
-        const match = /^Environment=(?:"([^"]*)"|([A-Za-z_][A-Za-z0-9_]*=[^\s"]*))$/.exec(line);
-        const assignment = match?.[1] ?? match?.[2];
-        if (assignment === undefined)
-            continue;
-        const equals = assignment.indexOf("=");
-        if (equals <= 0)
-            continue;
-        const key = assignment.slice(0, equals);
-        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
-            continue;
-        into[key] = assignment.slice(equals + 1);
-    }
-}
-/** Read simple KEY=VALUE and quoted "KEY=VALUE" Environment directives. */
-export function readLegacySyncEnv(platform, directory = LEGACY_SYNC_DROPIN_DIR) {
-    if (platform !== "linux")
-        return {};
-    let files;
-    try {
-        files = fs.readdirSync(directory).filter((name) => name.endsWith(".conf")).sort();
-    }
-    catch {
-        return {};
-    }
-    const env = {};
-    for (const file of files) {
-        try {
-            assignments(fs.readFileSync(path.join(directory, file), "utf8"), env);
-        }
-        catch {
-            // A single unreadable drop-in cannot make daemon planning fail.
-        }
-    }
-    return env;
-}
-//# sourceMappingURL=legacy-sync-env.js.map

package/dist/lib/daemon/legacy.d.ts

@@ -1,45 +0,0 @@
-/**
- * Units HQ installed before `hq daemon`, one per service. While one of these
- * still runs a service, the daemon leaves that service alone instead of
- * starting a second copy, and `hq daemon migrate` lists it.
- *
- * Detection reads unit files and checks for an orphaned loaded macOS mesh job
- * whose plist was removed. Windows scheduled tasks are probed through
- * schtasks. Nothing here stops or removes a unit.
- */
-import type { ServiceName } from "./catalog.js";
-export interface LegacyUnit {
-    /** Daemon unit id it overlaps with (`mesh`, `bots:<name>`, ...). */
-    unitId: string;
-    service: ServiceName;
-    kind: "launchd" | "systemd-user" | "systemd-system" | "schtasks";
-    name: string;
-    path?: string;
-    /** False for units owned by another product (the desktop app's own agent). */
-    migratable: boolean;
-}
-export interface LegacyProbeDeps {
-    platform: NodeJS.Platform;
-    home: string;
-    existsSync: (p: string) => boolean;
-    listDir: (dir: string) => string[];
-    /** True when launchctl can print the GUI-domain job despite a missing plist. */
-    launchdJobLoaded: (label: string) => boolean;
-    windowsTaskExists: (taskName: string) => boolean;
-}
-export declare function describeLegacyUnit(unit: LegacyUnit): string;
-export declare function findLegacyUnits(deps: LegacyProbeDeps): LegacyUnit[];
-/**
- * unit id → description of the migratable legacy unit that still runs it.
- * Units owned by another product (the desktop app) are handled by the plan's
- * own checks, because `hq daemon migrate` will never take them over.
- */
-export declare function legacyOwnerLookup(units: readonly LegacyUnit[]): (unitId: string) => string | null;
-/** A daemon-managed macOS mesh service takes over the old LaunchAgent on startup. */
-export declare function legacyMeshUnitsToRetire(units: readonly LegacyUnit[], opts: {
-    platform: NodeJS.Platform;
-    managed: boolean;
-    hosted: boolean;
-    meshEnabled: boolean;
-}): LegacyUnit[];
-//# sourceMappingURL=legacy.d.ts.map

package/dist/lib/daemon/legacy.js

@@ -1,133 +0,0 @@
-/**
- * Units HQ installed before `hq daemon`, one per service. While one of these
- * still runs a service, the daemon leaves that service alone instead of
- * starting a second copy, and `hq daemon migrate` lists it.
- *
- * Detection reads unit files and checks for an orphaned loaded macOS mesh job
- * whose plist was removed. Windows scheduled tasks are probed through
- * schtasks. Nothing here stops or removes a unit.
- */
-import * as path from "node:path";
-const KIT_SERVICES = ["sync", "inbox", "heartbeat"];
-/** Box units rendered by hq-pro-agents / `outposts self-deploy`, mapped to the service they overlap. */
-const SYSTEM_UNITS = [
-    ["hq-mesh-daemon.service", "mesh"],
-    ["outpost-sync.service", "sync"],
-    ["outpost-full-sync.timer", "sync"],
-    ["hq-agent-sync.service", "sync"],
-    ["outpost-session-heartbeat.service", "heartbeat"],
-    ["hq-agent-heartbeat.timer", "heartbeat"],
-    ["hq-agent-inbox.service", "inbox"],
-    ["hq-agent-qmd-index.timer", "search-index"],
-    ["outpost-jobs-reconcile.timer", "jobs-reconcile"],
-    // The runners' watchdogs restart the old runners, so they are taken over with them.
-    ["outpost-runner.service", "remote-control"],
-    ["outpost-runner-watchdog.timer", "remote-control"],
-    ["outpost-rc-watchdog.timer", "remote-control"],
-    ["outpost-codex-runner.service", "codex-remote-control"],
-    ["outpost-codex-watchdog.timer", "codex-remote-control"],
-    ["hq-cli-update.timer", "updater"],
-    ["outpost-codex-update.timer", "updater"],
-];
-const KIND_LABEL = {
-    launchd: "LaunchAgent",
-    "systemd-user": "systemd user unit",
-    "systemd-system": "systemd unit",
-    schtasks: "scheduled task",
-};
-export function describeLegacyUnit(unit) {
-    return `${KIND_LABEL[unit.kind]} ${unit.name}`;
-}
-function safeList(deps, dir) {
-    try {
-        return deps.listDir(dir);
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return [];
-        throw err;
-    }
-}
-function darwinUnits(deps) {
-    const dir = path.join(deps.home, "Library", "LaunchAgents");
-    const units = [];
-    const at = (label) => path.join(dir, `${label}.plist`);
-    const add = (unitId, service, label, migratable = true) => units.push({ unitId, service, kind: "launchd", name: label, path: at(label), migratable });
-    const meshLabel = "ai.getindigo.hq-mesh-daemon";
-    if (deps.existsSync(at(meshLabel)) || deps.launchdJobLoaded(meshLabel))
-        add("mesh", "mesh", meshLabel);
-    for (const file of safeList(deps, dir).sort()) {
-        const m = /^ai\.getindigo\.hq-bot\.(.+)\.plist$/.exec(file);
-        if (m)
-            add(`bots:${m[1]}`, "bots", `ai.getindigo.hq-bot.${m[1]}`);
-    }
-    for (const s of KIT_SERVICES) {
-        const label = `ai.getindigo.hq-agent.${s}`;
-        if (deps.existsSync(at(label)))
-            add(s, s, label);
-    }
-    if (deps.existsSync(at("ai.indigo.hq-sync-menubar")))
-        add("sync", "sync", "ai.indigo.hq-sync-menubar", false);
-    return units;
-}
-function linuxUnits(deps) {
-    const userDir = path.join(deps.home, ".config", "systemd", "user");
-    const units = [];
-    const user = (unitId, service, name) => units.push({ unitId, service, kind: "systemd-user", name, path: path.join(userDir, name), migratable: true });
-    if (deps.existsSync(path.join(userDir, "hq-mesh-daemon.service")))
-        user("mesh", "mesh", "hq-mesh-daemon.service");
-    for (const file of safeList(deps, userDir).sort()) {
-        const m = /^hq-bot-(.+)\.service$/.exec(file);
-        if (m)
-            user(`bots:${m[1]}`, "bots", file);
-    }
-    for (const s of KIT_SERVICES) {
-        const name = `hq-agent-${s}.service`;
-        if (deps.existsSync(path.join(userDir, name)))
-            user(s, s, name);
-    }
-    if (deps.existsSync(path.join(userDir, "hq-lanes-reconcile.timer"))) {
-        user("lanes-reconcile", "lanes-reconcile", "hq-lanes-reconcile.timer");
-    }
-    const systemDir = "/etc/systemd/system";
-    for (const [name, service] of SYSTEM_UNITS) {
-        const file = path.posix.join(systemDir, name);
-        if (deps.existsSync(file)) {
-            units.push({ unitId: service, service, kind: "systemd-system", name, path: file, migratable: true });
-        }
-    }
-    return units;
-}
-function windowsUnits(deps) {
-    const task = "ai.getindigo.hq-mesh-daemon";
-    return deps.windowsTaskExists(task)
-        ? [{ unitId: "mesh", service: "mesh", kind: "schtasks", name: task, migratable: true }]
-        : [];
-}
-export function findLegacyUnits(deps) {
-    if (deps.platform === "darwin")
-        return darwinUnits(deps);
-    if (deps.platform === "linux")
-        return linuxUnits(deps);
-    if (deps.platform === "win32")
-        return windowsUnits(deps);
-    return [];
-}
-/**
- * unit id → description of the migratable legacy unit that still runs it.
- * Units owned by another product (the desktop app) are handled by the plan's
- * own checks, because `hq daemon migrate` will never take them over.
- */
-export function legacyOwnerLookup(units) {
-    return (unitId) => {
-        const hit = units.find((u) => u.unitId === unitId && u.migratable);
-        return hit ? describeLegacyUnit(hit) : null;
-    };
-}
-/** A daemon-managed macOS mesh service takes over the old LaunchAgent on startup. */
-export function legacyMeshUnitsToRetire(units, opts) {
-    if (opts.platform !== "darwin" || (!opts.managed && !opts.hosted) || !opts.meshEnabled)
-        return [];
-    return units.filter((unit) => unit.service === "mesh" && unit.kind === "launchd" && unit.migratable);
-}
-//# sourceMappingURL=legacy.js.map

package/dist/lib/daemon/lock.d.ts

@@ -1,47 +0,0 @@
-/**
- * One `hq daemon run` per user per machine: a pid file created with `wx`,
- * taken over only when the recorded process is gone. Same file format as the
- * mesh daemon's lock (`pid=<n>\nts=<unix seconds>`).
- *
- * Replacing a stale lock is guarded by a short-lived `<lock>.takeover` claim,
- * so two starters that both saw the same stale owner cannot both win. A claim
- * left behind by a starter that died mid-takeover expires after
- * TAKEOVER_TTL_MS.
- */
-import { type PidLockRecord } from "../mesh/live/daemon/pid-lock.js";
-import type { RunCommand } from "../service-manager/launchd.js";
-export declare const TAKEOVER_TTL_MS = 30000;
-type Kill = (pid: number, signal: 0) => unknown;
-/**
- * The process exists and this user can signal it. EPERM means it belongs to
- * another user, so it cannot be this user's daemon.
- */
-export declare function isProcessAlive(pid: number, kill?: Kill): boolean;
-export interface CommandLineDeps {
-    platform: NodeJS.Platform;
-    run: RunCommand;
-}
-/** The process's command line, or null when it cannot be read. */
-export declare function processCommandLine(pid: number, deps?: CommandLineDeps): string | null;
-export interface DaemonProcessDeps {
-    alive: (pid: number) => boolean;
-    commandLine: (pid: number) => string | null;
-}
-/**
- * The pid is alive and is an `hq daemon run`. After a reboot the pid in an old
- * lock file often belongs to an unrelated program; that must not keep the
- * daemon from starting.
- */
-export declare function isDaemonProcess(pid: number, deps?: DaemonProcessDeps): boolean;
-export type DaemonLockResult = {
-    ok: true;
-} | {
-    ok: false;
-    owner: PidLockRecord | null;
-};
-export declare function acquireDaemonLock(lockPath: string, pid?: number, alive?: (pid: number) => boolean, now?: () => number): DaemonLockResult;
-export declare function releaseDaemonLock(lockPath: string, pid?: number): void;
-/** The live supervisor's pid, or null when none is running. */
-export declare function runningDaemonPid(lockPath: string, alive?: (pid: number) => boolean): number | null;
-export {};
-//# sourceMappingURL=lock.d.ts.map