@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/lib/daemon/run.js

@@ -0,0 +1,755 @@
+/**
+ * `hq daemon run` — wires the supervisor to real processes, files and signals.
+ *
+ * Each reconcile re-reads the config and re-probes the host (bots, sign-in,
+ * legacy units, the desktop app), so enabling a service, creating a bot, or
+ * signing in takes effect without restarting the daemon.
+ */
+import { spawn, spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import { createRequire } from "node:module";
+import * as os from "node:os";
+import * as path from "node:path";
+import { loadCachedTokens } from "@indigoai-us/hq-cloud";
+import { CLI_VERSION } from "../../cli-version.js";
+import { isLocalDependencyInstall, resolveRunningInstall } from "../../utils/version-gate.js";
+import { agentKitPaths } from "../agent-kit/paths.js";
+import { readBotConfig } from "../bot/config.js";
+import { botsRoot } from "../bot/paths.js";
+import { CLAUDE_RUNNER_SCRIPT, CODEX_RUNNER_SCRIPT, enabledServices, planUnits } from "./catalog.js";
+import { effectiveSyncOwner, readDaemonConfig } from "./config.js";
+import { SUPERVISOR_HANDOFF_FLAG, readDaemonFlag } from "./flag.js";
+import { findLegacyUnits, legacyMeshUnitsToRetire, legacyOwnerLookup } from "./legacy.js";
+import { readLegacySyncEnv } from "./legacy-sync-env.js";
+import { acquireDaemonLock, isProcessAlive, processCommandLine, releaseDaemonLock } from "./lock.js";
+import { retireLegacyMeshUnits } from "./migrate.js";
+import { daemonDir as meshDaemonDir, daemonPidPath as meshDaemonPidPath } from "../mesh/live/daemon/paths.js";
+import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
+import { daemonRootRefusal } from "./install.js";
+import { detectMachineType } from "./machine-type.js";
+import { appendPrivate, daemonPaths, ensurePrivateDir, openPrivateAppend } from "./paths.js";
+import { createProtocolTail, ensureProtocolFifo, openProtocolWriter } from "./protocol-tail.js";
+import { takeControlRequests } from "./requests.js";
+import { currentHqCloud, hqCloudRunners } from "./hq-cloud.js";
+import { runnerSessionName } from "./remote-control.js";
+import { adoptChild, createChildTracker, finishSuccession, handoffEligible, readProcStart, stopOrphans, successionPaths, systemdKillMode, takeSuccession, writeHandoff, } from "./succession.js";
+import { listSyncRunnerProcesses, readWatchRunnerOwnerStatus, syncHeartbeatTimeoutMs, syncRunnerNodeOptions, watchRunnerOwnerStatusPath, } from "./sync-runner.js";
+import { STOP_ESCALATION_MS, createSupervisor, } from "./supervisor.js";
+import { userToolDirs } from "./tools.js";
+export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
+/** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
+export const RESTART_EXIT_CODE = 75;
+const LEGACY_PROBE_TTL_MS = 60_000;
+/** A flag read that has not answered by then counts as off. */
+const HANDOFF_FLAG_TIMEOUT_MS = 10_000;
+export function resolveSyncRunnerPath() {
+    try {
+        const require = createRequire(import.meta.url);
+        const pkg = require.resolve("@indigoai-us/hq-cloud/package.json");
+        const runner = path.join(path.dirname(pkg), "dist", "bin", "sync-runner.js");
+        return fs.existsSync(runner) ? runner : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The hosted desktop app uses this env value when planning daemon services. */
+export function daemonInstantSyncEnabled(env, configured) {
+    return configured ?? env.HQ_DAEMON_INSTANT_SYNC !== "0";
+}
+export function listLocalBots(root = botsRoot()) {
+    if (!fs.existsSync(root))
+        return [];
+    return fs
+        .readdirSync(root, { withFileTypes: true })
+        .filter((d) => d.isDirectory() && readBotConfig(path.join(root, d.name)) !== null)
+        .map((d) => d.name)
+        .sort();
+}
+export function windowsTaskExists(taskName) {
+    const r = spawnSync("schtasks.exe", ["/Query", "/TN", taskName], { encoding: "utf8", windowsHide: true });
+    return r.status === 0;
+}
+export function probeLegacyUnits(platform, home) {
+    return findLegacyUnits({
+        platform,
+        home,
+        existsSync: fs.existsSync,
+        listDir: (dir) => fs.readdirSync(dir),
+        launchdJobLoaded: (label) => {
+            if (platform !== "darwin")
+                return false;
+            const uid = process.getuid?.() ?? 0;
+            const result = spawnSync("launchctl", ["print", `gui/${uid}/${label}`], {
+                encoding: "utf8",
+                windowsHide: true,
+                timeout: 15_000,
+            });
+            return result.status === 0;
+        },
+        windowsTaskExists,
+    });
+}
+/** Absolute path of `name` on PATH, or null. */
+export function findOnPath(name, env = process.env) {
+    const dirs = (env.PATH ?? "").split(path.delimiter).filter(Boolean);
+    const exts = process.platform === "win32" ? (env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
+    for (const dir of dirs) {
+        for (const ext of exts) {
+            const candidate = path.join(dir, `${name}${ext}`);
+            try {
+                fs.accessSync(candidate, fs.constants.X_OK);
+                if (fs.statSync(candidate).isFile())
+                    return candidate;
+            }
+            catch {
+                // not here
+            }
+        }
+    }
+    return null;
+}
+/**
+ * A tool the login user installed (~/.local/bin, ~/.npm-global/bin,
+ * ~/.grok/bin) before anything on PATH, so a box runs and updates the user's
+ * own copy instead of one root installed under /usr.
+ */
+export function findUserBinary(name, env, home) {
+    if (process.platform !== "win32") {
+        for (const dir of userToolDirs(home)) {
+            const candidate = path.join(dir, name);
+            try {
+                fs.accessSync(candidate, fs.constants.X_OK);
+                if (fs.statSync(candidate).isFile())
+                    return candidate;
+            }
+            catch {
+                // not here
+            }
+        }
+    }
+    return findOnPath(name, env);
+}
+function readIfExists(file) {
+    try {
+        return fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/** This CLI is a global package install the updater can replace (not a dev checkout or a project dependency). */
+export function cliSelfUpdatable() {
+    const install = resolveRunningInstall();
+    if (!install.packageRoot)
+        return false;
+    const inNodeModules = install.packageRoot.split(/[\\/]/).includes("node_modules");
+    return inNodeModules && !isLocalDependencyInstall(install);
+}
+/** The HQ desktop app process is running here (it runs its own sync). */
+export function desktopAppRunning(platform) {
+    if (platform === "win32") {
+        const r = spawnSync("tasklist.exe", ["/FI", "IMAGENAME eq hq-sync-menubar.exe", "/NH"], {
+            encoding: "utf8",
+            windowsHide: true,
+        });
+        return r.status === 0 && /hq-sync-menubar\.exe/i.test(r.stdout);
+    }
+    const r = spawnSync("pgrep", ["-x", "hq-sync-menubar"], { encoding: "utf8" });
+    return r.status === 0;
+}
+/** A parent (the OS unit, or the app hosting the daemon) starts the daemon again after it exits with RESTART_EXIT_CODE. */
+export function restartsForParent(opts) {
+    return opts.managed === true || opts.host !== undefined;
+}
+/**
+ * The desktop app runs sync itself, so the daemon's sync unit waits. When the
+ * app hosts the daemon it has handed sync over, and the daemon runs it.
+ */
+export function desktopAppManagesSync(opts) {
+    if (opts.machineType !== "desktop" || opts.host === "desktop")
+        return false;
+    return opts.legacy.some((u) => u.service === "sync" && !u.migratable) || opts.appRunning();
+}
+function jobsReconcileScript(hqRoot) {
+    if (!hqRoot)
+        return null;
+    const script = path.join(hqRoot, "core", "scripts", "outpost-jobs-reconcile.sh");
+    return fs.existsSync(script) ? script : null;
+}
+function signedIn(env, home, log) {
+    if (fs.existsSync(agentKitPaths(home, env).machineCredsPath))
+        return true;
+    try {
+        return loadCachedTokens() !== null;
+    }
+    catch (err) {
+        log("warn", `could not read the cached HQ sign-in; treating this machine as signed out: ${err.message}`);
+        return false;
+    }
+}
+function writeJsonAtomic(file, value) {
+    ensurePrivateDir(path.dirname(file));
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+/** Copy-and-truncate, so children appending with O_APPEND keep writing to the live file. */
+export function rotateLogs(logsDir, maxBytes = LOG_ROTATE_BYTES) {
+    let rotated = 0;
+    let names;
+    try {
+        names = fs.readdirSync(logsDir);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return 0;
+        throw err;
+    }
+    for (const name of names) {
+        if (!name.endsWith(".log"))
+            continue;
+        const file = path.join(logsDir, name);
+        if (fs.statSync(file).size <= maxBytes)
+            continue;
+        fs.copyFileSync(file, `${file}.1`);
+        fs.truncateSync(file, 0);
+        rotated++;
+    }
+    return rotated;
+}
+function makeLogger(paths, foreground) {
+    ensurePrivateDir(paths.logsDir);
+    return (level, msg) => {
+        const line = `${new Date().toISOString()} ${level.padEnd(5)} ${msg}\n`;
+        try {
+            appendPrivate(paths.supervisorLogPath, line);
+        }
+        catch (err) {
+            process.stderr.write(`hq daemon: could not write log: ${err.message}\n`);
+        }
+        if (foreground)
+            (level === "info" ? process.stdout : process.stderr).write(line);
+    };
+}
+/**
+ * Environment for one service process. The CLI's own update check is off:
+ * a child that updates itself exits 0 and asks to be rerun, which would leave
+ * an on-failure unit down. The daemon's updater handles CLI updates.
+ */
+export function unitProcessEnv(base, unit) {
+    const env = { ...base, ...unit.env, HQ_DAEMON_UNIT: unit.id, HQ_NO_UPDATE_CHECK: "1" };
+    if (unit.service === "sync")
+        env.NODE_OPTIONS = syncRunnerNodeOptions(env);
+    return env;
+}
+function isFifo(file) {
+    try {
+        return fs.lstatSync(file).isFIFO();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * A systemd system unit starts the daemon as the login user without the
+ * variables a login session sets, so `systemctl --user` from its services
+ * cannot find the user bus ("Failed to connect to bus: No medium found").
+ * Point them at the user's runtime dir when it exists and nothing set one.
+ */
+export function withUserRuntimeDir(env, host) {
+    if (host.platform !== "linux" || host.uid === 0 || env.XDG_RUNTIME_DIR)
+        return env;
+    const dir = `/run/user/${host.uid}`;
+    return host.exists(dir) ? { ...env, XDG_RUNTIME_DIR: dir } : env;
+}
+export async function runDaemon(opts) {
+    const env = withUserRuntimeDir(opts.env ?? process.env, {
+        platform: process.platform,
+        uid: process.getuid?.() ?? -1,
+        exists: fs.existsSync,
+    });
+    const home = opts.home ?? os.homedir();
+    const platform = process.platform;
+    const paths = daemonPaths(home, env);
+    const log = makeLogger(paths, opts.foreground === true);
+    const lock = acquireDaemonLock(paths.lockPath);
+    if (!lock.ok) {
+        process.stderr.write(lock.owner ? `hq daemon is already running (pid ${lock.owner.pid}).\n` : "another hq daemon is starting up.\n");
+        return 1;
+    }
+    const initial = readDaemonConfig(paths.configPath);
+    const detected = detectMachineType(undefined, {
+        platform,
+        env,
+        home,
+        savedType: initial.machineType,
+        existsSync: fs.existsSync,
+        readFileSync: (p) => fs.readFileSync(p, "utf8"),
+    });
+    const machineType = detected.type;
+    for (const w of detected.warnings ?? [])
+        log("warn", w);
+    const refusal = daemonRootRefusal(typeof process.getuid === "function" && process.getuid() === 0, machineType);
+    if (refusal) {
+        log("error", refusal);
+        releaseDaemonLock(paths.lockPath);
+        return 1;
+    }
+    const hostNote = opts.host ? `, hosted by the ${opts.host} app` : "";
+    log("info", `starting hq daemon (pid ${process.pid}) as ${machineType} (${detected.detail})${hostNote}`);
+    // On Linux, services can outlive a daemon (KillMode=process). Adopt the ones
+    // the previous daemon handed over and stop any others it left behind before
+    // starting anything, so a service never runs twice.
+    const succession = platform === "linux" && opts.host === undefined ? successionPaths(paths.root) : null;
+    const signalPid = (pid, sig) => {
+        process.kill(pid, sig);
+    };
+    let adopt = [];
+    /** Readers of units' protocol FIFOs; a handoff detaches them so the next daemon reads what is left. */
+    const protocolTails = new Set();
+    if (succession) {
+        const taken = takeSuccession(succession, { now: Date.now, readStart: readProcStart, log });
+        await stopOrphans(taken.orphans, {
+            readStart: readProcStart,
+            signal: signalPid,
+            sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+            log,
+        });
+        adopt = taken.adopt.map((u) => {
+            // A unit that speaks the sync protocol writes it to a FIFO; read what the previous daemon left.
+            const protocolPath = paths.unitProtocolPath(u.id);
+            const stdout = isFifo(protocolPath) ? createProtocolTail(protocolPath) : undefined;
+            const child = adoptChild(u, { readStart: readProcStart, signal: signalPid, ...(stdout ? { stdout } : {}) });
+            if (stdout) {
+                protocolTails.add(stdout);
+                child.on("exit", () => {
+                    protocolTails.delete(stdout);
+                    stdout.close();
+                });
+            }
+            return { id: u.id, key: u.key, child };
+        });
+    }
+    const tracker = succession ? createChildTracker(succession.childrenPath, { readStart: readProcStart, log }) : null;
+    for (const unit of adopt)
+        tracker?.track(unit.id, unit.child);
+    // Until now a crash leaves the previous records for the next daemon; from here the tracker owns them.
+    if (succession && tracker)
+        finishSuccession(succession, tracker.records(), log);
+    /** Service processes this daemon spawned, so a handoff can let go of them. */
+    const spawned = new Set();
+    if (!resolveSyncRunnerPath())
+        log("warn", "the hq-cloud sync runner was not found in this CLI install; sync is unavailable");
+    const updatable = cliSelfUpdatable();
+    const hostName = os.hostname().split(".")[0] || "hq-host";
+    let legacyCache = null;
+    const legacyUnits = () => {
+        if (!legacyCache || Date.now() - legacyCache.at > LEGACY_PROBE_TTL_MS) {
+            legacyCache = { at: Date.now(), units: probeLegacyUnits(platform, home) };
+        }
+        return legacyCache.units;
+    };
+    const legacyMesh = legacyMeshUnitsToRetire(legacyUnits(), {
+        platform,
+        managed: opts.managed === true,
+        hosted: opts.host !== undefined,
+        meshEnabled: enabledServices(machineType, initial).includes("mesh"),
+    });
+    if (legacyMesh.length > 0) {
+        try {
+            const uid = process.getuid?.() ?? 0;
+            retireLegacyMeshUnits(legacyMesh, {
+                platform,
+                managed: opts.managed === true,
+                hosted: opts.host !== undefined,
+                meshEnabled: enabledServices(machineType, initial).includes("mesh"),
+            }, {
+                run: (command, args) => {
+                    const r = spawnSync(command, args, { encoding: "utf8", windowsHide: true, timeout: 15_000 });
+                    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+                },
+                uid,
+                isRoot: uid === 0,
+                adoptedDir: path.join(paths.root, "adopted"),
+                recordPath: path.join(paths.root, "adopted.json"),
+                systemAdoptedDir: "/var/lib/hq/daemon/adopted",
+                systemRecordPath: "/var/lib/hq/daemon/adopted.json",
+                systemUnitDir: "/etc/systemd/system",
+            }, (level, message) => log(level, message));
+        }
+        catch (err) {
+            log("error", `could not retire legacy mesh units: ${err.message}`);
+        }
+        legacyCache = null;
+    }
+    const meshOwnerReason = () => {
+        const lockPath = meshDaemonPidPath(meshDaemonDir(undefined, home, env));
+        const owner = readPidLock(lockPath);
+        if (!owner || owner.pid === process.pid || !isProcessAlive(owner.pid))
+            return undefined;
+        const command = processCommandLine(owner.pid, {
+            platform,
+            run: (file, args) => {
+                const r = spawnSync(file, args, { encoding: "utf8", windowsHide: true, timeout: 15_000 });
+                return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+            },
+        });
+        if (command && !/\bmesh\s+daemon\s+run\b/.test(command))
+            return undefined;
+        return `mesh daemon already running (pid ${owner.pid}); waiting for it to exit`;
+    };
+    let warnedMissingPin = null;
+    const daemonSyncRunnerPids = new Set();
+    const plan = () => {
+        const config = readDaemonConfig(paths.configPath);
+        const legacy = legacyUnits();
+        const configured = config.hqRoot ?? (env.HQ_ROOT?.trim() || undefined);
+        const hqRoot = configured && fs.existsSync(configured) ? configured : undefined;
+        // Re-picked every reconcile, so a newer hq-cloud from the updater is used as soon as it lands.
+        const hqCloud = currentHqCloud(paths.root);
+        const missingPin = hqCloud?.pinnedVersionMissing ?? null;
+        if (missingPin !== warnedMissingPin) {
+            warnedMissingPin = missingPin;
+            if (missingPin && hqCloud) {
+                log("warn", `hq-cloud is pinned to ${missingPin}, which is not installed; running ${hqCloud.version} (${hqCloud.source}) until the updater installs it`);
+            }
+        }
+        const runners = hqCloud ? hqCloudRunners(hqCloud.root) : { syncRunner: null, heartbeat: null, sessionHost: null };
+        const services = enabledServices(machineType, config);
+        const isSignedIn = signedIn(env, home, log);
+        const syncOwner = effectiveSyncOwner(config, machineType);
+        let syncRunnerProcesses = [];
+        let syncRunnerOwnerPid = null;
+        if (machineType === "desktop" &&
+            syncOwner === "daemon" &&
+            services.includes("sync") &&
+            !config.syncPaused &&
+            hqRoot &&
+            isSignedIn) {
+            const processList = listSyncRunnerProcesses(platform);
+            if (!processList.ok) {
+                syncRunnerProcesses = null;
+                log("warn", `${processList.error}; sync will wait before taking ownership`);
+            }
+            else {
+                syncRunnerProcesses = processList.processes;
+                try {
+                    syncRunnerOwnerPid = readWatchRunnerOwnerStatus(watchRunnerOwnerStatusPath(hqRoot, home, env))?.pid ?? null;
+                }
+                catch (error) {
+                    log("warn", `could not verify the sync watch-owner status: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        }
+        return planUnits(services, {
+            machineType,
+            platform,
+            home,
+            hqRoot,
+            syncRunnerPath: runners.syncRunner,
+            heartbeatRunnerPath: runners.heartbeat,
+            sessionHostRunnerPath: runners.sessionHost,
+            legacySyncEnv: readLegacySyncEnv(platform),
+            instantSyncEnabled: daemonInstantSyncEnabled(env, config.instantSyncEnabled),
+            signedIn: isSignedIn,
+            kitConfigured: fs.existsSync(agentKitPaths(home, env).kitConfigPath),
+            syncPaused: config.syncPaused === true,
+            syncOwner,
+            desktopAppManagesSync: desktopAppManagesSync({
+                machineType,
+                host: opts.host,
+                legacy,
+                appRunning: () => desktopAppRunning(platform),
+            }),
+            syncRunnerProcesses,
+            syncRunnerOwnerPid,
+            daemonSyncRunnerPids,
+            syncHeartbeatTimeoutMs: syncHeartbeatTimeoutMs(env),
+            bots: listLocalBots(),
+            legacyOwner: legacyOwnerLookup(legacy),
+            cliSelfUpdatable: updatable,
+            jobsReconcileScript: jobsReconcileScript(hqRoot),
+            claudePath: findUserBinary("claude", env, home),
+            codexPath: findUserBinary("codex", env, home),
+            codexRunnerScript: platform === "linux" && fs.existsSync(CODEX_RUNNER_SCRIPT) ? CODEX_RUNNER_SCRIPT : null,
+            remoteControlName: runnerSessionName(readIfExists(CLAUDE_RUNNER_SCRIPT) ?? ""),
+            tmuxPath: findOnPath("tmux", env),
+            hostName,
+        });
+    };
+    const spawnUnit = (unit) => {
+        const command = unit.command;
+        if (!command || command.type === "internal")
+            throw new Error(`${unit.id} has no process to start`);
+        const [file, args] = command.type === "hq"
+            ? [opts.nodeBinary, [opts.hqBinary, ...command.args]]
+            : command.type === "node"
+                ? [opts.nodeBinary, [command.script, ...command.args]]
+                : [command.file, command.args];
+        const logPath = paths.unitLogPath(unit.id);
+        const cwd = unit.env.HQ_ROOT && fs.existsSync(unit.env.HQ_ROOT) ? unit.env.HQ_ROOT : home;
+        if (unit.heartbeatTimeoutMs && succession) {
+            // The supervisor reads this unit's protocol heartbeats from stdout. Where
+            // services can outlive the daemon, stdout is a FIFO (see protocol-tail.ts)
+            // rather than a pipe, so the unit can be handed to the next daemon.
+            const protocolPath = paths.unitProtocolPath(unit.id);
+            ensureProtocolFifo(protocolPath);
+            const stdout = createProtocolTail(protocolPath);
+            const outFd = openProtocolWriter(protocolPath);
+            const errFd = openPrivateAppend(logPath);
+            try {
+                const child = spawn(file, args, {
+                    cwd,
+                    env: unitProcessEnv(env, unit),
+                    stdio: ["ignore", outFd, errFd],
+                    windowsHide: true,
+                });
+                spawned.add(child);
+                if (unit.service === "sync" && child.pid !== undefined)
+                    daemonSyncRunnerPids.add(child.pid);
+                protocolTails.add(stdout);
+                const finish = () => {
+                    protocolTails.delete(stdout);
+                    stdout.close();
+                };
+                child.once("exit", () => {
+                    spawned.delete(child);
+                    if (child.pid !== undefined)
+                        daemonSyncRunnerPids.delete(child.pid);
+                    finish();
+                });
+                child.once("error", finish);
+                const supervised = {
+                    pid: child.pid,
+                    stdout,
+                    on(event, handler) {
+                        child.on(event, handler);
+                        return supervised;
+                    },
+                    kill: (signal) => child.kill(signal),
+                };
+                if (unit.kind === "long-running")
+                    tracker?.track(unit.id, supervised);
+                return supervised;
+            }
+            finally {
+                fs.closeSync(outFd);
+                fs.closeSync(errFd);
+            }
+        }
+        if (unit.heartbeatTimeoutMs) {
+            // Elsewhere the service stops with the daemon, so its output can go through a pipe.
+            const logFd = openPrivateAppend(logPath);
+            const logStream = fs.createWriteStream(logPath, { fd: logFd, autoClose: true });
+            logStream.on("error", (err) => log("error", `could not write ${unit.id} log ${logPath}: ${err.message}`));
+            const child = spawn(file, args, {
+                cwd,
+                env: unitProcessEnv(env, unit),
+                stdio: ["ignore", "pipe", "pipe"],
+                windowsHide: true,
+            });
+            spawned.add(child);
+            if (unit.service === "sync" && child.pid !== undefined)
+                daemonSyncRunnerPids.add(child.pid);
+            child.stdout?.pipe(logStream, { end: false });
+            child.stderr?.pipe(logStream, { end: false });
+            child.on("close", () => {
+                spawned.delete(child);
+                if (child.pid !== undefined)
+                    daemonSyncRunnerPids.delete(child.pid);
+                logStream.end();
+            });
+            return child;
+        }
+        const fd = openPrivateAppend(logPath);
+        try {
+            const child = spawn(file, args, {
+                cwd,
+                env: unitProcessEnv(env, unit),
+                stdio: ["ignore", fd, fd],
+                windowsHide: true,
+            });
+            spawned.add(child);
+            if (unit.service === "sync" && child.pid !== undefined)
+                daemonSyncRunnerPids.add(child.pid);
+            child.once("exit", () => {
+                spawned.delete(child);
+                if (child.pid !== undefined)
+                    daemonSyncRunnerPids.delete(child.pid);
+            });
+            // Only long-running services are handed over; a scheduled run left behind finishes on its own.
+            if (unit.kind === "long-running")
+                tracker?.track(unit.id, child);
+            return child;
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    };
+    // Set once the shutdown path exists below; a restart request before then is dropped.
+    let restartDaemon = () => { };
+    const supervisor = createSupervisor({
+        machineType,
+        host: opts.host,
+        pid: process.pid,
+        plan,
+        spawn: spawnUnit,
+        runInternal: async (task) => {
+            if (task !== "rotate-logs")
+                throw new Error(`unknown internal task ${task}`);
+            const n = rotateLogs(paths.logsDir);
+            if (n > 0)
+                log("info", `rotated ${n} log file(s)`);
+            return true;
+        },
+        takeRequests: () => takeControlRequests(paths.requestsDir),
+        restartDaemon: () => restartDaemon(),
+        writeState: (state) => writeJsonAtomic(paths.statePath, state),
+        log,
+        syncOwnerBlockReason: () => {
+            const config = readDaemonConfig(paths.configPath);
+            const hqRoot = config.hqRoot ?? env.HQ_ROOT?.trim();
+            if (!hqRoot)
+                return undefined;
+            const statusPath = watchRunnerOwnerStatusPath(hqRoot, home, env);
+            try {
+                const owner = readWatchRunnerOwnerStatus(statusPath);
+                return owner ? `sync owned by ${owner.owner} pid ${owner.pid}` : undefined;
+            }
+            catch (err) {
+                log("error", `could not read sync owner status at ${statusPath}: ${err instanceof Error ? err.message : String(err)}`);
+                return undefined;
+            }
+        },
+        meshOwnerReason,
+        cliVersion: CLI_VERSION,
+        adopt,
+    });
+    /** Hand services over on this restart: the unit leaves them running and the flag is on. */
+    const handoffWanted = async () => {
+        const killMode = platform === "linux"
+            ? systemdKillMode((file, args) => {
+                const r = spawnSync(file, args, { encoding: "utf8" });
+                return { status: r.status, stdout: r.stdout ?? "" };
+            })
+            : null;
+        if (!handoffEligible({ platform, managed: opts.managed === true, host: opts.host, killMode }))
+            return false;
+        let timer;
+        const timeout = new Promise((r) => {
+            timer = setTimeout(() => r(false), HANDOFF_FLAG_TIMEOUT_MS);
+        });
+        const on = await Promise.race([
+            readDaemonFlag(SUPERVISOR_HANDOFF_FLAG, {
+                env,
+                onError: (err) => log("warn", `could not read ${SUPERVISOR_HANDOFF_FLAG}: ${err.message ?? err}`),
+            }),
+            timeout,
+        ]);
+        clearTimeout(timer);
+        return on;
+    };
+    return await new Promise((resolve) => {
+        let stopping = false;
+        let restartPending = false;
+        const shutdown = (why, exitCode = 0) => {
+            if (stopping)
+                return;
+            stopping = true;
+            log("info", `${why}; stopping services`);
+            // The supervisor escalates to SIGKILL after STOP_ESCALATION_MS; the extra
+            // margin only covers a child that survives even that.
+            let capTimer;
+            const cap = new Promise((r) => {
+                capTimer = setTimeout(() => r("timeout"), STOP_ESCALATION_MS + 5_000);
+            });
+            void Promise.race([supervisor.stop(), cap]).then((result) => {
+                clearTimeout(capTimer);
+                if (result === "timeout")
+                    log("error", "some services did not exit after SIGKILL; releasing the lock anyway");
+                else
+                    log("info", "all services stopped");
+                releaseDaemonLock(paths.lockPath);
+                resolve(exitCode);
+                // Pipes, sockets and unrelated timers can outlive a clean shutdown.
+                // Keep restart and signal exits bounded just like the handoff path.
+                setTimeout(() => process.exit(exitCode), 5_000).unref();
+            });
+        };
+        /** Exit for a restart but leave the services running for the next daemon to adopt. */
+        const handOver = () => {
+            if (stopping)
+                return;
+            stopping = true;
+            const released = supervisor.release();
+            // What these readers have not read stays in the FIFO for the next daemon.
+            for (const tail of protocolTails)
+                tail.detach();
+            protocolTails.clear();
+            const starts = new Map((tracker?.records() ?? []).map((r) => [r.pid, r.start]));
+            const units = released.flatMap((u) => {
+                const start = starts.get(u.pid);
+                if (start !== undefined)
+                    return [{ ...u, start }];
+                // Unverifiable later, so it cannot be adopted; stop it rather than leave a second copy.
+                log("warn", `stopping ${u.id}: its process could not be recorded for the next daemon`);
+                try {
+                    process.kill(u.pid, "SIGTERM");
+                }
+                catch {
+                    // already gone
+                }
+                return [];
+            });
+            try {
+                writeHandoff(succession.handoffPath, { releasedAt: Date.now(), units });
+                log("info", `restarting onto the updated CLI; handing ${units.length} running service(s) to the next daemon`);
+            }
+            catch (err) {
+                // The children record still lists them, so the next daemon stops and restarts them.
+                log("error", `could not write the handoff; the next daemon will restart the services: ${err.message}`);
+            }
+            // The released processes must not keep this one alive.
+            for (const child of spawned)
+                child.unref();
+            releaseDaemonLock(paths.lockPath);
+            resolve(RESTART_EXIT_CODE);
+            // Anything else still holding the event loop open must not delay the restart.
+            setTimeout(() => process.exit(RESTART_EXIT_CODE), 5_000).unref();
+        };
+        restartDaemon = () => {
+            if (!restartsForParent(opts)) {
+                log("warn", "a restart was requested, but no service manager would start this daemon again; restart it yourself");
+                return;
+            }
+            if (stopping || restartPending)
+                return;
+            restartPending = true;
+            void handoffWanted()
+                .catch((err) => {
+                log("warn", `could not decide on a handoff; restarting every service: ${err.message}`);
+                return false;
+            })
+                .then((handoff) => {
+                if (handoff && succession)
+                    handOver();
+                else
+                    shutdown("restarting onto the updated CLI", RESTART_EXIT_CODE);
+            });
+        };
+        process.on("SIGTERM", () => shutdown("received SIGTERM"));
+        process.on("SIGINT", () => shutdown("received SIGINT"));
+        if (platform !== "win32")
+            process.on("SIGHUP", () => supervisor.reconcile());
+        try {
+            supervisor.start();
+        }
+        catch (err) {
+            log("error", `supervisor failed to start: ${err.message}`);
+            releaseDaemonLock(paths.lockPath);
+            resolve(1);
+        }
+    });
+}
+//# sourceMappingURL=run.js.map