@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/lib/daemon/catalog.d.ts

@@ -0,0 +1,134 @@
+/**
+ * The `hq daemon` service catalog: every background service HQ runs, the
+ * default list for each machine type, and the concrete unit each service
+ * becomes on this host.
+ *
+ * Services run today's existing entrypoints (`hq mesh daemon run`,
+ * `hq bot run <name>`, `hq-sync-runner --watch`, ...) as child processes, so
+ * moving a service under the daemon does not change what it does. Services
+ * with no entrypoint yet stay in the catalog as `unavailable` so status shows
+ * them instead of silently dropping them.
+ */
+import type { MachineType } from "./machine-type.js";
+import type { SyncOwner } from "./config.js";
+import { type SyncRunnerProcess } from "./sync-runner.js";
+export declare const SERVICE_NAMES: readonly ["sync", "mesh", "heartbeat", "inbox", "bots", "remote-control", "codex-remote-control", "session-host", "lanes-reconcile", "search-index", "jobs-reconcile", "updater", "housekeeping"];
+export type ServiceName = (typeof SERVICE_NAMES)[number];
+export declare function isServiceName(value: unknown): value is ServiceName;
+export declare const SERVICE_DESCRIPTIONS: Record<ServiceName, string>;
+/** The services each machine type runs without being asked. */
+export declare const DEFAULT_SERVICES: Record<MachineType, readonly ServiceName[]>;
+/** Defaults plus this host's overrides, in catalog order. Unknown names are ignored. */
+export declare function enabledServices(machineType: MachineType, overrides: {
+    enable: readonly string[];
+    disable: readonly string[];
+}): ServiceName[];
+type UnitCommand = {
+    type: "hq";
+    args: string[];
+} | {
+    type: "node";
+    script: string;
+    args: string[];
+} | {
+    type: "exec";
+    file: string;
+    args: string[];
+} | {
+    type: "internal";
+    task: "rotate-logs";
+};
+interface UnitBlock {
+    /** `waiting` clears on its own once the requirement appears; `unavailable` needs a newer CLI. */
+    state: "waiting" | "unavailable";
+    reason: string;
+}
+export interface UnitPlan {
+    /** Service name, or `<service>:<instance>` for per-instance services (bots). */
+    id: string;
+    service: ServiceName;
+    description: string;
+    kind: "long-running" | "scheduled";
+    /** Long-running units: restart after any exit, or only after a failure. */
+    restart: "always" | "on-failure";
+    intervalSec?: number;
+    initialDelaySec?: number;
+    /** Kill and restart this child after silence on its liveness stream. */
+    heartbeatTimeoutMs?: number;
+    command: UnitCommand | null;
+    env: Record<string, string>;
+    blocked?: UnitBlock;
+    /**
+     * Signal that asks the unit to finish its current work and exit, used when a
+     * new daemon replaces it after a CLI update. Without one it gets SIGTERM.
+     */
+    drainSignal?: "SIGUSR2";
+    /** A new CLI version alone does not restart this unit; it restarts itself when idle. */
+    keepAcrossCliUpdates?: true;
+}
+export interface PlanContext {
+    machineType: MachineType;
+    platform: NodeJS.Platform;
+    home: string;
+    hqRoot: string | undefined;
+    /** hq-cloud's sync-runner.js, or null when it cannot be found. */
+    syncRunnerPath: string | null;
+    /** hq-cloud's `hq-outpost-heartbeat` bin, when the hq-cloud in use has one. */
+    heartbeatRunnerPath: string | null;
+    /** hq-cloud's `hq-outpost-session-host` bin, when the hq-cloud in use has one. */
+    sessionHostRunnerPath: string | null;
+    /** Environment retained from legacy outpost sync systemd drop-ins. */
+    legacySyncEnv: Record<string, string>;
+    /** Keep the sync runner's event-driven instant-sync watcher enabled. */
+    instantSyncEnabled?: boolean;
+    /** Keep the local sync runner stopped until the operator resumes it. */
+    syncPaused: boolean;
+    /** Persisted/effective owner selected for this machine. */
+    syncOwner: SyncOwner;
+    /** A legacy desktop app or sync unit is still managing sync. */
+    desktopAppManagesSync: boolean;
+    /** Full process list, or null when the daemon could not read it. */
+    syncRunnerProcesses: readonly SyncRunnerProcess[] | null;
+    /** PID recorded in the watch-owner status, when it is readable. */
+    syncRunnerOwnerPid: number | null;
+    /** Sync runner children already started by this daemon before their lease is written. */
+    daemonSyncRunnerPids?: ReadonlySet<number>;
+    /** The protocol-event heartbeat watchdog timeout for the sync runner. */
+    syncHeartbeatTimeoutMs: number;
+    signedIn: boolean;
+    /** ~/.hq-agent/kit.json exists. */
+    kitConfigured: boolean;
+    bots: readonly string[];
+    /** Name of a pre-daemon unit that still runs this unit id, or null. */
+    legacyOwner: (unitId: string) => string | null;
+    /** This CLI is a global install the updater can replace (not a project dependency). */
+    cliSelfUpdatable: boolean;
+    /** `<hqRoot>/core/scripts/outpost-jobs-reconcile.sh` when it exists. */
+    jobsReconcileScript: string | null;
+    /** Absolute paths of the claude and tmux binaries, or null when not installed. */
+    claudePath: string | null;
+    tmuxPath: string | null;
+    /** Short host name, used to name this machine's remote-control session. */
+    hostName: string;
+    /** The session name the box's own runner used (`--name` in its script), kept when the daemon takes over. */
+    remoteControlName: string | null;
+    /** Absolute path of the login user's codex binary, or null. */
+    codexPath: string | null;
+    /** The box's Codex remote-control runner script, when it has one. */
+    codexRunnerScript: string | null;
+}
+/**
+ * The units that run hq-cloud's code on this host, restarted after the updater
+ * installs a new hq-cloud. Only outposts and self-hosted machines run the
+ * outpost heartbeat (agent machines run the agent kit's own); the session host
+ * is included wherever it is enabled.
+ */
+export declare function hqCloudUnits(machineType: MachineType, enabled: readonly ServiceName[]): ServiceName[];
+/** Written by outpost provisioning; the daemon runs it rather than re-implementing Codex login and relay setup. */
+export declare const CODEX_RUNNER_SCRIPT = "/usr/local/bin/outpost-codex-runner.sh";
+/** The outpost's Claude runner script, read for the session name it uses. */
+export declare const CLAUDE_RUNNER_SCRIPT = "/usr/local/bin/outpost-runner.sh";
+/** Turn enabled services into concrete units for this host. */
+export declare function planUnits(services: readonly ServiceName[], ctx: PlanContext): UnitPlan[];
+export {};
+//# sourceMappingURL=catalog.d.ts.map

package/dist/lib/daemon/catalog.js

@@ -0,0 +1,358 @@
+/**
+ * The `hq daemon` service catalog: every background service HQ runs, the
+ * default list for each machine type, and the concrete unit each service
+ * becomes on this host.
+ *
+ * Services run today's existing entrypoints (`hq mesh daemon run`,
+ * `hq bot run <name>`, `hq-sync-runner --watch`, ...) as child processes, so
+ * moving a service under the daemon does not change what it does. Services
+ * with no entrypoint yet stay in the catalog as `unavailable` so status shows
+ * them instead of silently dropping them.
+ */
+import { SYNC_RUNNER_OWNER, syncRunnerUnleasedBlockReason } from "./sync-runner.js";
+export const SERVICE_NAMES = [
+    "sync",
+    "mesh",
+    "heartbeat",
+    "inbox",
+    "bots",
+    "remote-control",
+    "codex-remote-control",
+    "session-host",
+    "lanes-reconcile",
+    "search-index",
+    "jobs-reconcile",
+    "updater",
+    "housekeeping",
+];
+export function isServiceName(value) {
+    return typeof value === "string" && SERVICE_NAMES.includes(value);
+}
+export const SERVICE_DESCRIPTIONS = {
+    sync: "keeps company vaults in sync with the cloud",
+    mesh: "Work Mesh Live presence",
+    heartbeat: "reports this machine's status to HQ",
+    inbox: "picks up the agent's incoming messages and tasks",
+    bots: "runs local bots",
+    "remote-control": "keeps Claude remote control running",
+    "codex-remote-control": "keeps Codex remote control running",
+    "session-host": "lets the desktop app open this machine's Claude sessions",
+    "lanes-reconcile": "cleans up stalled background lanes",
+    "search-index": "keeps local search up to date",
+    "jobs-reconcile": "keeps scheduled jobs matched to the cloud",
+    updater: "keeps the hq CLI, Claude, Codex and Grok up to date",
+    housekeeping: "rotates daemon logs",
+};
+/** The services each machine type runs without being asked. */
+export const DEFAULT_SERVICES = {
+    desktop: ["sync", "mesh", "heartbeat", "bots", "lanes-reconcile", "search-index", "updater", "housekeeping"],
+    "self-hosted": [
+        "sync",
+        "mesh",
+        "heartbeat",
+        "bots",
+        "session-host",
+        "lanes-reconcile",
+        "search-index",
+        "updater",
+        "housekeeping",
+    ],
+    outpost: [
+        "sync",
+        "mesh",
+        "heartbeat",
+        "remote-control",
+        "codex-remote-control",
+        "session-host",
+        "lanes-reconcile",
+        "search-index",
+        "jobs-reconcile",
+        "updater",
+        "housekeeping",
+    ],
+    "agent-box": ["mesh", "heartbeat", "inbox", "search-index", "updater", "housekeeping"],
+    "agent-kit": ["heartbeat", "inbox", "updater", "housekeeping"],
+};
+/** Defaults plus this host's overrides, in catalog order. Unknown names are ignored. */
+export function enabledServices(machineType, overrides) {
+    const defaults = DEFAULT_SERVICES[machineType];
+    return SERVICE_NAMES.filter((s) => (defaults.includes(s) || overrides.enable.includes(s)) && !overrides.disable.includes(s));
+}
+function base(service, over = {}) {
+    return {
+        id: service,
+        service,
+        description: SERVICE_DESCRIPTIONS[service],
+        kind: "long-running",
+        restart: "always",
+        command: null,
+        env: {},
+        ...over,
+    };
+}
+function unavailable(service, reason, over = {}) {
+    return base(service, { ...over, command: null, blocked: { state: "unavailable", reason } });
+}
+function firstBlock(checks) {
+    const hit = checks.find(([blocked]) => blocked);
+    return hit ? { state: "waiting", reason: hit[1] } : undefined;
+}
+/**
+ * The units that run hq-cloud's code on this host, restarted after the updater
+ * installs a new hq-cloud. Only outposts and self-hosted machines run the
+ * outpost heartbeat (agent machines run the agent kit's own); the session host
+ * is included wherever it is enabled.
+ */
+export function hqCloudUnits(machineType, enabled) {
+    const units = ["sync"];
+    if (machineType === "outpost" || machineType === "self-hosted")
+        units.push("heartbeat");
+    if (enabled.includes("session-host"))
+        units.push("session-host");
+    return units;
+}
+/** Written by outpost provisioning; the daemon runs it rather than re-implementing Codex login and relay setup. */
+export const CODEX_RUNNER_SCRIPT = "/usr/local/bin/outpost-codex-runner.sh";
+/** The outpost's Claude runner script, read for the session name it uses. */
+export const CLAUDE_RUNNER_SCRIPT = "/usr/local/bin/outpost-runner.sh";
+const NO_HQ_ROOT = "no HQ folder configured (run `hq daemon install --hq-root <path>`)";
+const NOT_SIGNED_IN = "not signed in (run `hq login`)";
+const KIT_NOT_SET_UP = "the agent kit is not set up on this machine (run `hq agent kit install`)";
+function planService(service, ctx) {
+    const agentMachine = ctx.machineType === "agent-kit" || ctx.machineType === "agent-box";
+    switch (service) {
+        case "sync": {
+            if (!ctx.syncRunnerPath)
+                return [unavailable(service, "the hq-cloud sync runner is missing from this CLI install")];
+            const unit = base(service, {
+                command: {
+                    type: "node",
+                    script: ctx.syncRunnerPath,
+                    args: [
+                        "--companies",
+                        "--direction",
+                        "both",
+                        "--on-conflict",
+                        "keep",
+                        "--hq-root",
+                        ctx.hqRoot ?? "",
+                        "--watch",
+                        ...(ctx.instantSyncEnabled === false ? [] : ["--event-push"]),
+                        "--owner",
+                        SYNC_RUNNER_OWNER,
+                    ],
+                },
+                env: { ...ctx.legacySyncEnv },
+                heartbeatTimeoutMs: ctx.syncHeartbeatTimeoutMs,
+            });
+            let ownerBlock;
+            if (ctx.machineType === "desktop" && ctx.syncOwner === "desktop-app" && ctx.desktopAppManagesSync) {
+                ownerBlock = "the desktop app is still managing sync (run `hq daemon sync take-ownership` after it stops its runner)";
+            }
+            else if (ctx.machineType === "desktop" &&
+                ctx.syncOwner === "daemon" &&
+                !ctx.syncPaused &&
+                ctx.hqRoot &&
+                ctx.signedIn) {
+                ownerBlock = ctx.syncRunnerProcesses === null
+                    ? "could not check for an existing sync runner; waiting to avoid starting a duplicate"
+                    : syncRunnerUnleasedBlockReason(ctx.hqRoot, ctx.syncRunnerProcesses, ctx.syncRunnerOwnerPid, ctx.platform, ctx.daemonSyncRunnerPids);
+            }
+            unit.blocked = firstBlock([
+                [ctx.syncPaused, "sync is paused (run `hq daemon sync resume`)"],
+                [!ctx.hqRoot, NO_HQ_ROOT],
+                [!ctx.signedIn, NOT_SIGNED_IN],
+                [!!ownerBlock, ownerBlock ?? ""],
+            ]);
+            return [unit];
+        }
+        case "mesh": {
+            const args = ["mesh", "daemon", "run", ...(ctx.hqRoot ? ["--hq-root", ctx.hqRoot] : [])];
+            return [base(service, { command: { type: "hq", args }, blocked: firstBlock([[!ctx.signedIn, NOT_SIGNED_IN]]) })];
+        }
+        case "heartbeat": {
+            if (agentMachine) {
+                return [
+                    base(service, {
+                        command: { type: "hq", args: ["agent", "kit", "run", "heartbeat"] },
+                        blocked: firstBlock([[!ctx.kitConfigured, KIT_NOT_SET_UP]]),
+                    }),
+                ];
+            }
+            if (ctx.machineType === "desktop") {
+                return [unavailable(service, "not available on desktop machines yet")];
+            }
+            return [
+                base(service, {
+                    // hq-cloud's own heartbeat picks up hq-cloud updates without a CLI release.
+                    command: ctx.heartbeatRunnerPath
+                        ? { type: "node", script: ctx.heartbeatRunnerPath, args: ["--home", ctx.home] }
+                        : { type: "hq", args: ["outposts", "heartbeat", "--home", ctx.home] },
+                    blocked: firstBlock([[!ctx.signedIn, NOT_SIGNED_IN]]),
+                }),
+            ];
+        }
+        case "inbox": {
+            if (!agentMachine)
+                return [unavailable(service, "only runs on agent machines")];
+            return [
+                base(service, {
+                    command: { type: "hq", args: ["agent", "kit", "run", "inbox"] },
+                    blocked: firstBlock([[!ctx.kitConfigured, KIT_NOT_SET_UP]]),
+                }),
+            ];
+        }
+        case "bots": {
+            if (ctx.bots.length === 0) {
+                return [base(service, { blocked: { state: "waiting", reason: "no local bots" } })];
+            }
+            return ctx.bots.map((name) => base(service, {
+                id: `bots:${name}`,
+                description: `runs the local bot ${name}`,
+                restart: "on-failure",
+                command: { type: "hq", args: ["bot", "run", name] },
+                // A bot drains on SIGUSR2: running turns finish, then it exits.
+                drainSignal: "SIGUSR2",
+            }));
+        }
+        case "session-host":
+            return [
+                base(service, {
+                    // hq-cloud's own session host picks up hq-cloud updates without a CLI release.
+                    command: ctx.sessionHostRunnerPath
+                        ? { type: "node", script: ctx.sessionHostRunnerPath, args: [] }
+                        : { type: "hq", args: ["outposts", "session-host"] },
+                    env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},
+                    blocked: firstBlock([[!ctx.signedIn, NOT_SIGNED_IN]]),
+                }),
+            ];
+        case "lanes-reconcile":
+            return [
+                base(service, {
+                    kind: "scheduled",
+                    intervalSec: 60,
+                    initialDelaySec: 30,
+                    command: { type: "hq", args: ["lanes", "reconcile"] },
+                    env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},
+                    blocked: firstBlock([[!ctx.hqRoot, NO_HQ_ROOT]]),
+                }),
+            ];
+        case "search-index":
+            return [
+                base(service, {
+                    kind: "scheduled",
+                    intervalSec: 900,
+                    initialDelaySec: 120,
+                    command: { type: "hq", args: ["index", "sync", "--hq-root", ctx.hqRoot ?? ""] },
+                    blocked: firstBlock([[!ctx.hqRoot, NO_HQ_ROOT]]),
+                }),
+            ];
+        case "housekeeping":
+            return [
+                base(service, {
+                    kind: "scheduled",
+                    intervalSec: 3600,
+                    initialDelaySec: 60,
+                    command: { type: "internal", task: "rotate-logs" },
+                }),
+            ];
+        case "updater":
+            return [
+                base(service, {
+                    kind: "scheduled",
+                    intervalSec: 6 * 3600,
+                    initialDelaySec: 900,
+                    command: { type: "hq", args: ["daemon", "service", "self-update"] },
+                }),
+            ];
+        case "jobs-reconcile": {
+            if (ctx.platform === "win32")
+                return [unavailable(service, "needs bash; not supported on Windows")];
+            const script = ctx.jobsReconcileScript;
+            return [
+                base(service, {
+                    kind: "scheduled",
+                    intervalSec: 600,
+                    initialDelaySec: 600,
+                    command: {
+                        type: "exec",
+                        file: "bash",
+                        args: [script ?? "", "--hq-root", ctx.hqRoot ?? "", "--ensure-hook", "--after-sync"],
+                    },
+                    env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},
+                    blocked: firstBlock([
+                        [!ctx.hqRoot, NO_HQ_ROOT],
+                        [!script, "this HQ folder has no core/scripts/outpost-jobs-reconcile.sh"],
+                    ]),
+                }),
+            ];
+        }
+        case "codex-remote-control": {
+            if (ctx.platform === "win32")
+                return [unavailable(service, "not supported on Windows")];
+            const script = ctx.codexRunnerScript;
+            return [
+                base(service, {
+                    command: {
+                        type: "hq",
+                        // No codex path: the host finds codex itself, so a reinstall that
+                        // briefly moves the link cannot change the plan and restart it.
+                        args: ["daemon", "service", "codex-remote-control", "--script", script ?? ""],
+                    },
+                    // Restarting the host ends the tmux session people are using.
+                    keepAcrossCliUpdates: true,
+                    env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},
+                    blocked: firstBlock([
+                        [!script, `this machine has no Codex remote-control runner (${CODEX_RUNNER_SCRIPT})`],
+                        [!ctx.codexPath, "the codex CLI is not installed"],
+                        [!ctx.tmuxPath, "tmux is not installed (Codex remote control runs inside tmux)"],
+                        [!ctx.hqRoot, NO_HQ_ROOT],
+                    ]),
+                }),
+            ];
+        }
+        case "remote-control": {
+            if (ctx.platform === "win32")
+                return [unavailable(service, "not supported on Windows yet")];
+            // Outposts keep the runner's session name and permission mode.
+            const outpost = ctx.machineType === "outpost";
+            const name = ctx.remoteControlName ?? (outpost ? "outpost-1" : ctx.hostName);
+            // No claude path: the host finds claude itself, so a reinstall that
+            // briefly moves the link cannot change the plan and restart the session.
+            const args = ["daemon", "service", "remote-control", "--name", name];
+            if (outpost)
+                args.push("--permission-mode", "bypassPermissions");
+            return [
+                base(service, {
+                    command: { type: "hq", args },
+                    env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},
+                    // Restarting the host ends the tmux session people are using.
+                    keepAcrossCliUpdates: true,
+                    blocked: firstBlock([
+                        [!ctx.claudePath, "the claude CLI is not installed"],
+                        [!ctx.tmuxPath, "tmux is not installed (remote control runs Claude inside tmux)"],
+                        [!ctx.hqRoot, NO_HQ_ROOT],
+                    ]),
+                }),
+            ];
+        }
+    }
+}
+/** Turn enabled services into concrete units for this host. */
+export function planUnits(services, ctx) {
+    const units = [];
+    for (const service of services) {
+        for (const unit of planService(service, ctx)) {
+            const owner = unit.command ? ctx.legacyOwner(unit.id) : null;
+            if (owner && unit.blocked?.state !== "unavailable") {
+                unit.blocked = {
+                    state: "waiting",
+                    reason: `already run by ${owner}; \`hq daemon migrate\` will take it over`,
+                };
+            }
+            units.push(unit);
+        }
+    }
+    return units;
+}
+//# sourceMappingURL=catalog.js.map

package/dist/lib/daemon/config.d.ts

@@ -0,0 +1,35 @@
+/**
+ * ~/.hq/daemon/config.json — the machine type saved at install, the HQ folder
+ * the services work against, and per-host overrides. The default service list
+ * is NOT stored here: it lives in the catalog, so a release that adds a
+ * default service reaches every host of that machine type.
+ */
+import { type ServiceName } from "./catalog.js";
+import { type MachineType } from "./machine-type.js";
+export interface DaemonConfig {
+    version: 1;
+    machineType?: MachineType;
+    hqRoot?: string;
+    /** Exact hq-cloud package version preferred by this daemon, including prereleases. */
+    hqCloudVersion?: string;
+    /** Persisted machine-local sync pause. */
+    syncPaused?: boolean;
+    /** Desktop Instant Sync preference, applied when the sync unit is planned. */
+    instantSyncEnabled?: boolean;
+    /** Explicit desktop handoff; absent values preserve the legacy per-machine owner. */
+    syncOwner?: SyncOwner;
+    /** Services turned on here beyond the machine type's defaults. */
+    enable: string[];
+    /** Default services turned off here. */
+    disable: string[];
+}
+export type SyncOwner = "daemon" | "desktop-app";
+export declare function effectiveSyncOwner(config: Pick<DaemonConfig, "syncOwner">, machineType: MachineType): SyncOwner;
+export declare function readDaemonConfig(file: string): DaemonConfig;
+export declare function writeDaemonConfig(file: string, config: DaemonConfig): void;
+/**
+ * Turn services on or off for this host, relative to the machine type's
+ * defaults: only differences from the defaults are stored.
+ */
+export declare function applyServiceToggle(config: DaemonConfig, action: "enable" | "disable", services: readonly string[], defaults: readonly ServiceName[]): DaemonConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/lib/daemon/config.js

@@ -0,0 +1,108 @@
+/**
+ * ~/.hq/daemon/config.json — the machine type saved at install, the HQ folder
+ * the services work against, and per-host overrides. The default service list
+ * is NOT stored here: it lives in the catalog, so a release that adds a
+ * default service reaches every host of that machine type.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { valid as validSemver } from "semver";
+import { isServiceName } from "./catalog.js";
+import { isMachineType } from "./machine-type.js";
+import { ensurePrivateDir } from "./paths.js";
+export function effectiveSyncOwner(config, machineType) {
+    return config.syncOwner ?? (machineType === "desktop" ? "desktop-app" : "daemon");
+}
+function emptyDaemonConfig() {
+    return { version: 1, syncPaused: false, enable: [], disable: [] };
+}
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+export function readDaemonConfig(file) {
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return emptyDaemonConfig();
+        throw err;
+    }
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        throw new Error(`hq daemon config at ${file} is not valid JSON: ${err.message}`);
+    }
+    if (!raw || typeof raw !== "object")
+        throw new Error(`hq daemon config at ${file} is not a JSON object`);
+    const obj = raw;
+    const config = {
+        version: 1,
+        syncPaused: obj.syncPaused === true,
+        enable: stringList(obj.enable),
+        disable: stringList(obj.disable),
+    };
+    if (typeof obj.instantSyncEnabled === "boolean")
+        config.instantSyncEnabled = obj.instantSyncEnabled;
+    if (isMachineType(obj.machineType))
+        config.machineType = obj.machineType;
+    if (obj.syncOwner === "daemon" || obj.syncOwner === "desktop-app")
+        config.syncOwner = obj.syncOwner;
+    if (typeof obj.hqRoot === "string" && obj.hqRoot.trim())
+        config.hqRoot = obj.hqRoot;
+    if (typeof obj.hqCloudVersion === "string" && validSemver(obj.hqCloudVersion) === obj.hqCloudVersion) {
+        config.hqCloudVersion = obj.hqCloudVersion;
+    }
+    return config;
+}
+export function writeDaemonConfig(file, config) {
+    ensurePrivateDir(path.dirname(file));
+    const tmp = `${file}.${process.pid}.tmp`;
+    const ordered = { version: 1 };
+    if (config.machineType)
+        ordered.machineType = config.machineType;
+    if (config.hqRoot)
+        ordered.hqRoot = config.hqRoot;
+    if (config.hqCloudVersion)
+        ordered.hqCloudVersion = config.hqCloudVersion;
+    ordered.syncPaused = config.syncPaused === true;
+    if (typeof config.instantSyncEnabled === "boolean")
+        ordered.instantSyncEnabled = config.instantSyncEnabled;
+    if (config.syncOwner)
+        ordered.syncOwner = config.syncOwner;
+    ordered.enable = config.enable;
+    ordered.disable = config.disable;
+    fs.writeFileSync(tmp, `${JSON.stringify(ordered, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+    fs.chmodSync(file, 0o600);
+}
+/**
+ * Turn services on or off for this host, relative to the machine type's
+ * defaults: only differences from the defaults are stored.
+ */
+export function applyServiceToggle(config, action, services, defaults) {
+    for (const s of services) {
+        if (!isServiceName(s))
+            throw new Error(`Unknown service "${s}".`);
+    }
+    const enable = new Set(config.enable);
+    const disable = new Set(config.disable);
+    for (const s of services) {
+        const isDefault = defaults.includes(s);
+        if (action === "enable") {
+            disable.delete(s);
+            if (!isDefault)
+                enable.add(s);
+        }
+        else {
+            enable.delete(s);
+            if (isDefault)
+                disable.add(s);
+        }
+    }
+    return { ...config, enable: [...enable], disable: [...disable] };
+}
+//# sourceMappingURL=config.js.map

package/dist/lib/daemon/flag.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Feature flags read by the daemon. The daemon runs for weeks, so each read
+ * asks the registry again instead of holding a per-process answer, and it
+ * reads as off unless the registry itself says on (or a local override does).
+ */
+import { type FlagClientOptions, type FlagResolution } from "@indigoai-us/hq-flags-client";
+/** Outposts hand running services to the next daemon on a CLI update instead of restarting them all. */
+export declare const SUPERVISOR_HANDOFF_FLAG = "daemon.supervisor-handoff";
+/** Self-updates build the new CLI beside the running one and swap it in, so `hq` never disappears mid-update. */
+export declare const STAGED_SELF_UPDATE_FLAG = "cli.staged-self-update";
+export interface DaemonFlagClient {
+    ready(): Promise<void>;
+    explain(flagKey: string, options?: {
+        fallback?: boolean;
+    }): FlagResolution;
+    close(): void;
+}
+export interface ReadDaemonFlagOptions {
+    env?: NodeJS.ProcessEnv;
+    createClient?: (options: FlagClientOptions) => DaemonFlagClient;
+    getToken?: () => Promise<string>;
+    onError?: (error: unknown) => void;
+}
+export declare function readDaemonFlag(flagKey: string, options?: ReadDaemonFlagOptions): Promise<boolean>;
+//# sourceMappingURL=flag.d.ts.map