@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/lib/daemon/install.js

@@ -0,0 +1,320 @@
+/**
+ * Install / uninstall the ONE OS unit that runs `node <hq> daemon run --managed`.
+ * `--managed` tells the daemon a service manager relaunches it when it exits,
+ * which is how it restarts itself onto a new CLI version after an update.
+ *
+ * - macOS: LaunchAgent ai.getindigo.hq-daemon (RunAtLoad + KeepAlive)
+ * - Linux, per-user: systemd user unit hq-daemon.service
+ * - Linux, system (outposts and agent boxes): /etc/systemd/system/hq-daemon.service
+ *   running as the box's login user; needs root
+ * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon
+ * - anything else: no unit; the caller prints the command to run
+ *
+ * The unit never names services. `hq daemon run` reads the machine type and
+ * overrides from ~/.hq/daemon/config.json, so the unit does not change when
+ * services are added. Every service-manager call goes through `run`, so tests
+ * never touch launchctl, systemctl or schtasks.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { activateLaunchd, deactivateLaunchd, launchdPlistPath, renderLaunchdPlist, } from "../service-manager/launchd.js";
+import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdUnitPath, } from "../service-manager/systemd.js";
+import { escapeXml, shellQuote } from "../service-manager/types.js";
+import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
+import { userToolDirs } from "./tools.js";
+export const DAEMON_LAUNCHD_LABEL = "ai.getindigo.hq-daemon";
+export const DAEMON_SYSTEMD_UNIT = "hq-daemon.service";
+export const DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
+export const SYSTEM_UNIT_DIR = "/etc/systemd/system";
+export const ROOT_REFUSAL = "hq daemon runs its services as the machine's login user, never as root.";
+/**
+ * Why the daemon must not run here as root, or null when it may. Agent kits
+ * are the one exception: they run in containers where root is often the only
+ * account.
+ */
+export function daemonRootRefusal(isRoot, machineType) {
+    if (!isRoot || machineType === "agent-kit")
+        return null;
+    return `${ROOT_REFUSAL} Run it as that user instead of root.`;
+}
+/** Boxes run the daemon as a system unit; everything else per user. */
+export function installScopeFor(machineType) {
+    return machineType === "outpost" || machineType === "agent-box" ? "system" : "user";
+}
+function daemonSpec(host) {
+    return {
+        name: "daemon",
+        label: DAEMON_LAUNCHD_LABEL,
+        description: "HQ daemon: runs this machine's HQ background services",
+        args: ["daemon", "run", "--managed"],
+        logPath: path.join(host.daemonDir, "logs", "daemon.stdout.log"),
+        workingDir: host.daemonDir,
+        env: host.env ?? {},
+        restartSec: 10,
+        unitName: DAEMON_SYSTEMD_UNIT,
+    };
+}
+function serviceHost(host) {
+    return { home: host.home, nodeBinary: host.nodeBinary, hqBinary: host.hqBinary };
+}
+/**
+ * Output goes to the journal: an `append:` log file would be created by
+ * systemd as root inside the user's home, and the daemon (running as the user)
+ * writes its own logs under ~/.hq/daemon/logs.
+ *
+ * `KillMode=process`: systemd signals only the daemon. The daemon stops its
+ * services itself on SIGTERM, and after a CLI update it can leave them running
+ * for the next daemon to adopt (see succession.ts). A daemon that starts and
+ * finds services it did not adopt stops them first.
+ */
+function renderSystemdSystemUnit(host, user, userHome) {
+    const exec = [host.nodeBinary, host.hqBinary, "daemon", "run", "--managed"].map(shellQuote).join(" ");
+    const env = {
+        ...host.env,
+        HOME: userHome,
+        // The login user's own tools come first, so the daemon runs (and can
+        // update) their Claude, Codex and Grok rather than root's copies in /usr.
+        PATH: [...userToolDirs(userHome), host.env?.PATH ?? "/usr/local/bin:/usr/bin:/bin"].join(":"),
+    };
+    const envLines = Object.entries(env)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([k, v]) => `Environment=${shellQuote(`${k}=${v}`)}`)
+        .join("\n");
+    return `[Unit]
+Description=HQ daemon: runs this machine's HQ background services (user=${user})
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=${user}
+ExecStart=${exec}
+WorkingDirectory=${userHome}
+Restart=always
+RestartSec=10
+KillMode=process
+TimeoutStopSec=20
+${envLines}
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function windowsArgQuote(value) {
+    if (/^[A-Za-z0-9_.:\\/-]+$/.test(value))
+        return value;
+    return `"${value.replace(/"/g, '\\"')}"`;
+}
+/**
+ * Logon-triggered task for the installing user. InteractiveToken is what an
+ * unprivileged install can register, so the task runs while the user is
+ * logged on. `conhost.exe --headless` keeps a console window from opening.
+ */
+function renderWindowsTaskXml(host) {
+    const user = escapeXml(host.windowsUser);
+    const nodeArg = windowsArgQuote(host.nodeBinary);
+    const hqArg = windowsArgQuote(host.hqBinary);
+    const command = host.windowsHeadlessLauncher ?? host.nodeBinary;
+    // A task cannot set environment variables, so an HQ_DAEMON_DIR override
+    // travels as an argument.
+    const dirOverride = host.env?.HQ_DAEMON_DIR;
+    const runArgs = dirOverride ? `daemon run --managed --daemon-dir ${windowsArgQuote(dirOverride)}` : "daemon run --managed";
+    const args = host.windowsHeadlessLauncher ? `--headless ${nodeArg} ${hqArg} ${runArgs}` : `${hqArg} ${runArgs}`;
+    return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <URI>\\${DAEMON_WINDOWS_TASK}</URI>
+    <Description>HQ daemon: runs this machine's HQ background services</Description>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${user}</UserId>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${user}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <Hidden>true</Hidden>
+    <RunOnlyIfIdle>false</RunOnlyIfIdle>
+    <DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
+    <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
+    <WakeToRun>false</WakeToRun>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Priority>7</Priority>
+    <RestartOnFailure>
+      <Interval>PT1M</Interval>
+      <Count>999</Count>
+    </RestartOnFailure>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${escapeXml(command)}</Command>
+      <Arguments>${escapeXml(args)}</Arguments>
+      <WorkingDirectory>${escapeXml(host.daemonDir)}</WorkingDirectory>
+    </Exec>
+  </Actions>
+</Task>
+`;
+}
+/** schtasks reads task XML as UTF-16 LE with a BOM. */
+function encodeWindowsTaskXml(rendered) {
+    return Buffer.from(`\uFEFF${rendered}`, "utf16le");
+}
+export function planDaemonUnit(host, options) {
+    const spec = daemonSpec(host);
+    if (host.platform === "darwin") {
+        return { kind: "launchd", unitPath: launchdPlistPath(host.home, spec), rendered: renderLaunchdPlist(spec, serviceHost(host)) };
+    }
+    if (host.platform === "linux") {
+        if (options.scope === "system") {
+            if (!options.runAsUser) {
+                throw new Error("A system install needs the box's login user: pass --user <name>, or provisioning writes it to /etc/hq/machine-type (user=<name>).");
+            }
+            if (options.runAsUser === "root")
+                throw new Error(ROOT_REFUSAL);
+            if (!options.runAsHome)
+                throw new Error(`Could not find the home directory of ${options.runAsUser}.`);
+            return {
+                kind: "systemd-system",
+                unitPath: path.join(host.systemUnitDir, DAEMON_SYSTEMD_UNIT),
+                rendered: renderSystemdSystemUnit(host, options.runAsUser, options.runAsHome),
+            };
+        }
+        return { kind: "systemd-user", unitPath: systemdUnitPath(host.home, spec), rendered: renderSystemdUserUnit(spec, serviceHost(host)) };
+    }
+    if (host.platform === "win32") {
+        return {
+            kind: "schtasks",
+            unitPath: path.join(host.daemonDir, `${DAEMON_WINDOWS_TASK}.xml`),
+            rendered: renderWindowsTaskXml(host),
+        };
+    }
+    const manualCommand = [host.nodeBinary, host.hqBinary, "daemon", "run"].map(shellQuote).join(" ");
+    return { kind: "manual", unitPath: "", rendered: "", manualCommand };
+}
+function commandError(what, r) {
+    return new Error(`${what} failed: ${r.stderr.trim() || r.stdout.trim() || `exit ${r.status}`}`);
+}
+function activate(plan, host, run, sleep) {
+    switch (plan.kind) {
+        case "launchd":
+            activateLaunchd(plan.unitPath, run, host.uid, { sleep });
+            return;
+        case "systemd-user":
+            activateSystemd(DAEMON_SYSTEMD_UNIT, run);
+            return;
+        case "systemd-system": {
+            const reload = run("systemctl", ["daemon-reload"]);
+            if (reload.status !== 0)
+                throw commandError("systemctl daemon-reload", reload);
+            const enable = run("systemctl", ["enable", "--now", DAEMON_SYSTEMD_UNIT]);
+            if (enable.status !== 0)
+                throw commandError(`systemctl enable --now ${DAEMON_SYSTEMD_UNIT}`, enable);
+            run("systemctl", ["restart", DAEMON_SYSTEMD_UNIT]);
+            return;
+        }
+        case "schtasks": {
+            const create = run("schtasks.exe", ["/Create", "/TN", DAEMON_WINDOWS_TASK, "/XML", plan.unitPath, "/F"]);
+            if (create.status !== 0)
+                throw commandError("schtasks /Create", create);
+            const start = run("schtasks.exe", ["/Run", "/TN", DAEMON_WINDOWS_TASK]);
+            if (start.status !== 0)
+                throw commandError("schtasks /Run", start);
+            return;
+        }
+        case "manual":
+            return;
+    }
+}
+export function installDaemonUnit(host, options, deps) {
+    const plan = planDaemonUnit(host, options);
+    if (plan.kind === "manual") {
+        return { kind: plan.kind, unitPath: "", installed: false, running: false, manualCommand: plan.manualCommand };
+    }
+    if (plan.kind === "systemd-system" && !host.isRoot) {
+        throw new Error("Installing the daemon on a box writes a system unit, which needs root. Run: sudo hq daemon install");
+    }
+    fs.mkdirSync(path.dirname(plan.unitPath), { recursive: true });
+    if (plan.kind !== "systemd-system")
+        fs.mkdirSync(path.join(host.daemonDir, "logs"), { recursive: true });
+    if (plan.kind === "schtasks")
+        fs.writeFileSync(plan.unitPath, encodeWindowsTaskXml(plan.rendered));
+    else
+        fs.writeFileSync(plan.unitPath, plan.rendered, { mode: plan.kind === "systemd-system" ? 0o644 : 0o600 });
+    try {
+        activate(plan, host, deps.run, deps.sleep);
+        return { kind: plan.kind, unitPath: plan.unitPath, installed: true, running: true };
+    }
+    catch (err) {
+        return {
+            kind: plan.kind,
+            unitPath: plan.unitPath,
+            installed: true,
+            running: false,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+export function uninstallDaemonUnit(host, options, deps) {
+    // A system uninstall does not need the login user; only the unit path matters.
+    const plan = host.platform === "linux" && options.scope === "system"
+        ? { kind: "systemd-system", unitPath: path.join(host.systemUnitDir, DAEMON_SYSTEMD_UNIT), rendered: "" }
+        : planDaemonUnit(host, options);
+    if (plan.kind === "manual")
+        return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
+    // A registered task is removed even when its XML file has gone missing.
+    const present = fs.existsSync(plan.unitPath) ||
+        (plan.kind === "schtasks" && deps.run("schtasks.exe", ["/Query", "/TN", DAEMON_WINDOWS_TASK]).status === 0);
+    if (!present)
+        return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
+    switch (plan.kind) {
+        case "launchd":
+            deactivateLaunchd(plan.unitPath, deps.run, host.uid);
+            break;
+        case "systemd-user":
+            deactivateSystemd(DAEMON_SYSTEMD_UNIT, deps.run);
+            break;
+        case "systemd-system": {
+            if (!host.isRoot)
+                throw new Error("Removing the box's system unit needs root. Run: sudo hq daemon uninstall");
+            const disable = deps.run("systemctl", ["disable", "--now", DAEMON_SYSTEMD_UNIT]);
+            // Keep the unit file so a later uninstall still finds it.
+            if (disable.status !== 0)
+                throw commandError(`systemctl disable --now ${DAEMON_SYSTEMD_UNIT}`, disable);
+            deps.run("systemctl", ["daemon-reload"]);
+            break;
+        }
+        case "schtasks": {
+            deps.run("schtasks.exe", ["/End", "/TN", DAEMON_WINDOWS_TASK]);
+            // Ending the task stops only its root process (conhost when --headless is
+            // used); node and the services it runs keep going. End the recorded
+            // daemon's whole process tree.
+            const owner = readPidLock(path.join(host.daemonDir, "daemon.pid"));
+            if (owner && owner.pid !== process.pid) {
+                deps.run("taskkill.exe", ["/PID", String(owner.pid), "/T", "/F"]);
+            }
+            const del = deps.run("schtasks.exe", ["/Delete", "/TN", DAEMON_WINDOWS_TASK, "/F"]);
+            // Keep the XML so a later uninstall still finds the task.
+            if (del.status !== 0)
+                throw commandError(`schtasks /Delete /TN ${DAEMON_WINDOWS_TASK}`, del);
+            break;
+        }
+    }
+    fs.rmSync(plan.unitPath, { force: true });
+    return { kind: plan.kind, unitPath: plan.unitPath, removed: true };
+}
+//# sourceMappingURL=install.js.map

package/dist/lib/daemon/legacy-sync-env.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Environment assignments kept in the legacy outpost sync service drop-ins.
+ * The daemon reads these so taking over outpost-sync.service keeps its tuned
+ * sync limits. This module is deliberately tolerant: a bad or missing drop-in
+ * must never stop daemon planning.
+ */
+export declare const LEGACY_SYNC_DROPIN_DIR = "/etc/systemd/system/outpost-sync.service.d";
+/** Read simple KEY=VALUE and quoted "KEY=VALUE" Environment directives. */
+export declare function readLegacySyncEnv(platform: NodeJS.Platform, directory?: string): Record<string, string>;
+//# sourceMappingURL=legacy-sync-env.d.ts.map

package/dist/lib/daemon/legacy-sync-env.js

@@ -0,0 +1,58 @@
+/**
+ * Environment assignments kept in the legacy outpost sync service drop-ins.
+ * The daemon reads these so taking over outpost-sync.service keeps its tuned
+ * sync limits. This module is deliberately tolerant: a bad or missing drop-in
+ * must never stop daemon planning.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const LEGACY_SYNC_DROPIN_DIR = "/etc/systemd/system/outpost-sync.service.d";
+function assignments(text, into) {
+    let inService = false;
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const section = /^\[([^\]]+)\]$/.exec(line);
+        if (section) {
+            inService = section[1] === "Service";
+            continue;
+        }
+        if (!inService)
+            continue;
+        const match = /^Environment=(?:"([^"]*)"|([A-Za-z_][A-Za-z0-9_]*=[^\s"]*))$/.exec(line);
+        const assignment = match?.[1] ?? match?.[2];
+        if (assignment === undefined)
+            continue;
+        const equals = assignment.indexOf("=");
+        if (equals <= 0)
+            continue;
+        const key = assignment.slice(0, equals);
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            continue;
+        into[key] = assignment.slice(equals + 1);
+    }
+}
+/** Read simple KEY=VALUE and quoted "KEY=VALUE" Environment directives. */
+export function readLegacySyncEnv(platform, directory = LEGACY_SYNC_DROPIN_DIR) {
+    if (platform !== "linux")
+        return {};
+    let files;
+    try {
+        files = fs.readdirSync(directory).filter((name) => name.endsWith(".conf")).sort();
+    }
+    catch {
+        return {};
+    }
+    const env = {};
+    for (const file of files) {
+        try {
+            assignments(fs.readFileSync(path.join(directory, file), "utf8"), env);
+        }
+        catch {
+            // A single unreadable drop-in cannot make daemon planning fail.
+        }
+    }
+    return env;
+}
+//# sourceMappingURL=legacy-sync-env.js.map

package/dist/lib/daemon/legacy.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Units HQ installed before `hq daemon`, one per service. While one of these
+ * still runs a service, the daemon leaves that service alone instead of
+ * starting a second copy, and `hq daemon migrate` lists it.
+ *
+ * Detection reads unit files and checks for an orphaned loaded macOS mesh job
+ * whose plist was removed. Windows scheduled tasks are probed through
+ * schtasks. Nothing here stops or removes a unit.
+ */
+import type { ServiceName } from "./catalog.js";
+export interface LegacyUnit {
+    /** Daemon unit id it overlaps with (`mesh`, `bots:<name>`, ...). */
+    unitId: string;
+    service: ServiceName;
+    kind: "launchd" | "systemd-user" | "systemd-system" | "schtasks";
+    name: string;
+    path?: string;
+    /** False for units owned by another product (the desktop app's own agent). */
+    migratable: boolean;
+}
+export interface LegacyProbeDeps {
+    platform: NodeJS.Platform;
+    home: string;
+    existsSync: (p: string) => boolean;
+    listDir: (dir: string) => string[];
+    /** True when launchctl can print the GUI-domain job despite a missing plist. */
+    launchdJobLoaded: (label: string) => boolean;
+    windowsTaskExists: (taskName: string) => boolean;
+}
+export declare function describeLegacyUnit(unit: LegacyUnit): string;
+export declare function findLegacyUnits(deps: LegacyProbeDeps): LegacyUnit[];
+/**
+ * unit id → description of the migratable legacy unit that still runs it.
+ * Units owned by another product (the desktop app) are handled by the plan's
+ * own checks, because `hq daemon migrate` will never take them over.
+ */
+export declare function legacyOwnerLookup(units: readonly LegacyUnit[]): (unitId: string) => string | null;
+/** A daemon-managed macOS mesh service takes over the old LaunchAgent on startup. */
+export declare function legacyMeshUnitsToRetire(units: readonly LegacyUnit[], opts: {
+    platform: NodeJS.Platform;
+    managed: boolean;
+    hosted: boolean;
+    meshEnabled: boolean;
+}): LegacyUnit[];
+//# sourceMappingURL=legacy.d.ts.map

package/dist/lib/daemon/legacy.js

@@ -0,0 +1,133 @@
+/**
+ * Units HQ installed before `hq daemon`, one per service. While one of these
+ * still runs a service, the daemon leaves that service alone instead of
+ * starting a second copy, and `hq daemon migrate` lists it.
+ *
+ * Detection reads unit files and checks for an orphaned loaded macOS mesh job
+ * whose plist was removed. Windows scheduled tasks are probed through
+ * schtasks. Nothing here stops or removes a unit.
+ */
+import * as path from "node:path";
+const KIT_SERVICES = ["sync", "inbox", "heartbeat"];
+/** Box units rendered by hq-pro-agents / `outposts self-deploy`, mapped to the service they overlap. */
+const SYSTEM_UNITS = [
+    ["hq-mesh-daemon.service", "mesh"],
+    ["outpost-sync.service", "sync"],
+    ["outpost-full-sync.timer", "sync"],
+    ["hq-agent-sync.service", "sync"],
+    ["outpost-session-heartbeat.service", "heartbeat"],
+    ["hq-agent-heartbeat.timer", "heartbeat"],
+    ["hq-agent-inbox.service", "inbox"],
+    ["hq-agent-qmd-index.timer", "search-index"],
+    ["outpost-jobs-reconcile.timer", "jobs-reconcile"],
+    // The runners' watchdogs restart the old runners, so they are taken over with them.
+    ["outpost-runner.service", "remote-control"],
+    ["outpost-runner-watchdog.timer", "remote-control"],
+    ["outpost-rc-watchdog.timer", "remote-control"],
+    ["outpost-codex-runner.service", "codex-remote-control"],
+    ["outpost-codex-watchdog.timer", "codex-remote-control"],
+    ["hq-cli-update.timer", "updater"],
+    ["outpost-codex-update.timer", "updater"],
+];
+const KIND_LABEL = {
+    launchd: "LaunchAgent",
+    "systemd-user": "systemd user unit",
+    "systemd-system": "systemd unit",
+    schtasks: "scheduled task",
+};
+export function describeLegacyUnit(unit) {
+    return `${KIND_LABEL[unit.kind]} ${unit.name}`;
+}
+function safeList(deps, dir) {
+    try {
+        return deps.listDir(dir);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+}
+function darwinUnits(deps) {
+    const dir = path.join(deps.home, "Library", "LaunchAgents");
+    const units = [];
+    const at = (label) => path.join(dir, `${label}.plist`);
+    const add = (unitId, service, label, migratable = true) => units.push({ unitId, service, kind: "launchd", name: label, path: at(label), migratable });
+    const meshLabel = "ai.getindigo.hq-mesh-daemon";
+    if (deps.existsSync(at(meshLabel)) || deps.launchdJobLoaded(meshLabel))
+        add("mesh", "mesh", meshLabel);
+    for (const file of safeList(deps, dir).sort()) {
+        const m = /^ai\.getindigo\.hq-bot\.(.+)\.plist$/.exec(file);
+        if (m)
+            add(`bots:${m[1]}`, "bots", `ai.getindigo.hq-bot.${m[1]}`);
+    }
+    for (const s of KIT_SERVICES) {
+        const label = `ai.getindigo.hq-agent.${s}`;
+        if (deps.existsSync(at(label)))
+            add(s, s, label);
+    }
+    if (deps.existsSync(at("ai.indigo.hq-sync-menubar")))
+        add("sync", "sync", "ai.indigo.hq-sync-menubar", false);
+    return units;
+}
+function linuxUnits(deps) {
+    const userDir = path.join(deps.home, ".config", "systemd", "user");
+    const units = [];
+    const user = (unitId, service, name) => units.push({ unitId, service, kind: "systemd-user", name, path: path.join(userDir, name), migratable: true });
+    if (deps.existsSync(path.join(userDir, "hq-mesh-daemon.service")))
+        user("mesh", "mesh", "hq-mesh-daemon.service");
+    for (const file of safeList(deps, userDir).sort()) {
+        const m = /^hq-bot-(.+)\.service$/.exec(file);
+        if (m)
+            user(`bots:${m[1]}`, "bots", file);
+    }
+    for (const s of KIT_SERVICES) {
+        const name = `hq-agent-${s}.service`;
+        if (deps.existsSync(path.join(userDir, name)))
+            user(s, s, name);
+    }
+    if (deps.existsSync(path.join(userDir, "hq-lanes-reconcile.timer"))) {
+        user("lanes-reconcile", "lanes-reconcile", "hq-lanes-reconcile.timer");
+    }
+    const systemDir = "/etc/systemd/system";
+    for (const [name, service] of SYSTEM_UNITS) {
+        const file = path.posix.join(systemDir, name);
+        if (deps.existsSync(file)) {
+            units.push({ unitId: service, service, kind: "systemd-system", name, path: file, migratable: true });
+        }
+    }
+    return units;
+}
+function windowsUnits(deps) {
+    const task = "ai.getindigo.hq-mesh-daemon";
+    return deps.windowsTaskExists(task)
+        ? [{ unitId: "mesh", service: "mesh", kind: "schtasks", name: task, migratable: true }]
+        : [];
+}
+export function findLegacyUnits(deps) {
+    if (deps.platform === "darwin")
+        return darwinUnits(deps);
+    if (deps.platform === "linux")
+        return linuxUnits(deps);
+    if (deps.platform === "win32")
+        return windowsUnits(deps);
+    return [];
+}
+/**
+ * unit id → description of the migratable legacy unit that still runs it.
+ * Units owned by another product (the desktop app) are handled by the plan's
+ * own checks, because `hq daemon migrate` will never take them over.
+ */
+export function legacyOwnerLookup(units) {
+    return (unitId) => {
+        const hit = units.find((u) => u.unitId === unitId && u.migratable);
+        return hit ? describeLegacyUnit(hit) : null;
+    };
+}
+/** A daemon-managed macOS mesh service takes over the old LaunchAgent on startup. */
+export function legacyMeshUnitsToRetire(units, opts) {
+    if (opts.platform !== "darwin" || (!opts.managed && !opts.hosted) || !opts.meshEnabled)
+        return [];
+    return units.filter((unit) => unit.service === "mesh" && unit.kind === "launchd" && unit.migratable);
+}
+//# sourceMappingURL=legacy.js.map

package/dist/lib/daemon/lock.d.ts

@@ -0,0 +1,47 @@
+/**
+ * One `hq daemon run` per user per machine: a pid file created with `wx`,
+ * taken over only when the recorded process is gone. Same file format as the
+ * mesh daemon's lock (`pid=<n>\nts=<unix seconds>`).
+ *
+ * Replacing a stale lock is guarded by a short-lived `<lock>.takeover` claim,
+ * so two starters that both saw the same stale owner cannot both win. A claim
+ * left behind by a starter that died mid-takeover expires after
+ * TAKEOVER_TTL_MS.
+ */
+import { type PidLockRecord } from "../mesh/live/daemon/pid-lock.js";
+import type { RunCommand } from "../service-manager/launchd.js";
+export declare const TAKEOVER_TTL_MS = 30000;
+type Kill = (pid: number, signal: 0) => unknown;
+/**
+ * The process exists and this user can signal it. EPERM means it belongs to
+ * another user, so it cannot be this user's daemon.
+ */
+export declare function isProcessAlive(pid: number, kill?: Kill): boolean;
+export interface CommandLineDeps {
+    platform: NodeJS.Platform;
+    run: RunCommand;
+}
+/** The process's command line, or null when it cannot be read. */
+export declare function processCommandLine(pid: number, deps?: CommandLineDeps): string | null;
+export interface DaemonProcessDeps {
+    alive: (pid: number) => boolean;
+    commandLine: (pid: number) => string | null;
+}
+/**
+ * The pid is alive and is an `hq daemon run`. After a reboot the pid in an old
+ * lock file often belongs to an unrelated program; that must not keep the
+ * daemon from starting.
+ */
+export declare function isDaemonProcess(pid: number, deps?: DaemonProcessDeps): boolean;
+export type DaemonLockResult = {
+    ok: true;
+} | {
+    ok: false;
+    owner: PidLockRecord | null;
+};
+export declare function acquireDaemonLock(lockPath: string, pid?: number, alive?: (pid: number) => boolean, now?: () => number): DaemonLockResult;
+export declare function releaseDaemonLock(lockPath: string, pid?: number): void;
+/** The live supervisor's pid, or null when none is running. */
+export declare function runningDaemonPid(lockPath: string, alive?: (pid: number) => boolean): number | null;
+export {};
+//# sourceMappingURL=lock.d.ts.map