@indigoai-us/hq-cli 5.345.1 → 5.345.2

package/dist/lib/daemon/run.js

@@ -10,10 +10,11 @@ import * as fs from "node:fs";
 import { createRequire } from "node:module";
 import * as os from "node:os";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { CLI_VERSION } from "../../cli-version.js";
 import { anywhereRuntimeEnabled } from "../../commands/anywhere-runtime-flag.js";
-import { currentPackageUseUpdateRequested } from "../../utils/package-use-lease.js";
+import { currentPackageUseLeaseInstall, currentPackageUseUpdateRequested } from "../../utils/package-use-lease.js";
 import { isLocalDependencyInstall, resolveRunningInstall } from "../../utils/version-gate.js";
 import { agentKitPaths } from "../agent-kit/paths.js";
 import { readBotConfig } from "../bot/config.js";
@@ -36,7 +37,9 @@ import { startHqdServer } from "./server.js";
 import { heartbeatFile, startHeartbeat } from "./heartbeat.js";
 import { createProtocolTail, ensureProtocolFifo, openProtocolWriter } from "./protocol-tail.js";
 import { takeControlRequests } from "./requests.js";
-import { currentHqCloud, hqCloudRunners } from "./hq-cloud.js";
+import { currentHqCloud, currentHqCloudAfterLeaseRelease, hqCloudRunners } from "./hq-cloud.js";
+import { stageSyncRunnerBundle } from "./sync-runner-bundle.js";
+import { stageHqChildBootstrap } from "./hq-child-bootstrap-stage.js";
 import { runnerSessionName } from "./remote-control.js";
 import { adoptChild, createChildTracker, finishSuccession, handoffEligible, readProcStart, stopOrphans, successionPaths, systemdKillMode, takeSuccession, writeHandoff, } from "./succession.js";
 import { listSyncRunnerProcesses, readWatchRunnerOwnerStatus, syncHeartbeatTimeoutMs, syncRunnerNodeOptions, watchRunnerOwnerStatusPath, } from "./sync-runner.js";
@@ -73,6 +76,48 @@ export function handoffForPackageUpdateRequest(requested, restartDaemon) {
 const LEGACY_PROBE_TTL_MS = 60_000;
 /** A flag read that has not answered by then counts as off. */
 const HANDOFF_FLAG_TIMEOUT_MS = 10_000;
+export function syncRunnerSourceForPlan(stagedRunnerPath, hqCloud, legacyBundledRunnerPath = null) {
+    if (stagedRunnerPath)
+        return { kind: "staged-sync", runnerPath: stagedRunnerPath };
+    if (!hqCloud) {
+        return legacyBundledRunnerPath
+            ? { kind: "bundled-full-package", runnerPath: legacyBundledRunnerPath }
+            : { kind: "unavailable", runnerPath: null };
+    }
+    // The caller has already selected a usable full package; preserve the
+    // conventional path here, including in tests with virtual package roots.
+    const runnerPath = path.join(hqCloud.root, "dist", "bin", "sync-runner.js");
+    return hqCloud.source === "managed"
+        ? { kind: "managed-full-package", runnerPath }
+        : { kind: "bundled-full-package", runnerPath };
+}
+function isPathWithin(root, candidate) {
+    if (!root || !path.isAbsolute(candidate))
+        return false;
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+}
+/** Whether every executable in the first service plan remains usable after the CLI package is replaced. */
+export function daemonPlanCanReleasePackageUseLease(plans, replaceablePackageRoots, stagingFailed, hqBootstrapReady = false) {
+    if (stagingFailed)
+        return false;
+    return plans.every((unit) => {
+        const command = unit.command;
+        if (!command)
+            return true;
+        if (command.type === "hq")
+            return hqBootstrapReady;
+        if (command.type === "internal")
+            return true;
+        const executablePaths = command.type === "node" ? [command.script, ...command.args] : [command.file, ...command.args];
+        return executablePaths.every((candidate) => replaceablePackageRoots.every((root) => !isPathWithin(root, candidate)));
+    });
+}
+export function daemonHqChildCommand(nodeBinary, hqBinary, args, bootstrapPath, packagePrefix) {
+    return bootstrapPath && packagePrefix
+        ? [nodeBinary, [bootstrapPath, packagePrefix, CLI_VERSION, ...args]]
+        : [nodeBinary, [hqBinary, ...args]];
+}
 export function resolveSyncRunnerPath() {
     try {
         const require = createRequire(import.meta.url);
@@ -304,6 +349,60 @@ export async function runDaemon(opts) {
     const platform = process.platform;
     const paths = daemonPaths(home, env);
     const log = makeLogger(paths, opts.foreground === true);
+    const syncRunnerBundleDirectory = opts.syncRunnerBundleDirectory ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../hq-cloud-sync-runner");
+    const cliPackageRoot = opts.cliPackageRoot === undefined ? resolveRunningInstall().packageRoot : opts.cliPackageRoot;
+    const cliPackagePrefix = opts.cliPackagePrefix === undefined
+        ? currentPackageUseLeaseInstall()?.prefix ?? null
+        : opts.cliPackagePrefix;
+    let stagedSyncBundle = null;
+    let bundleStageChecked = false;
+    let bundleStageFailed = false;
+    let stagedHqChildBootstrap = null;
+    let hqChildBootstrapStageChecked = false;
+    let hqChildBootstrapStageFailed = false;
+    let legacySyncRunnerPathChecked = false;
+    let legacySyncRunnerPath = null;
+    let packageUseLeaseReleased = false;
+    let hqCloudVersionBeforeRelease = null;
+    let startupPlanOpen = true;
+    const startupPlans = [];
+    const getStagedSyncBundle = () => {
+        if (bundleStageChecked)
+            return stagedSyncBundle;
+        bundleStageChecked = true;
+        // Older and development installs have no publish-time payload; keep their
+        // existing hq-cloud selection path without treating absence as an error.
+        if (!fs.existsSync(syncRunnerBundleDirectory))
+            return null;
+        try {
+            stagedSyncBundle = stageSyncRunnerBundle({ payloadDirectory: syncRunnerBundleDirectory, daemonRoot: paths.root });
+            return stagedSyncBundle;
+        }
+        catch {
+            bundleStageFailed = true;
+            log("warn", "could not stage the packaged sync runner; keeping the package-use lease");
+            return null;
+        }
+    };
+    const getStagedHqChildBootstrap = () => {
+        if (hqChildBootstrapStageChecked)
+            return stagedHqChildBootstrap;
+        hqChildBootstrapStageChecked = true;
+        if (!cliPackagePrefix)
+            return null;
+        try {
+            stagedHqChildBootstrap = stageHqChildBootstrap({
+                sourcePath: opts.hqChildBootstrapSourcePath,
+                daemonRoot: paths.root,
+            });
+            return stagedHqChildBootstrap;
+        }
+        catch {
+            hqChildBootstrapStageFailed = true;
+            log("warn", "could not stage the daemon hq bootstrap; keeping the package-use lease");
+            return null;
+        }
+    };
     const lock = acquireDaemonLock(paths.lockPath);
     const lockConflict = daemonLockConflictOutcome(lock, !lock.ok && lock.owner ? anywhereRuntimeEnabled(env) : false);
     if (lockConflict) {
@@ -374,8 +473,6 @@ export async function runDaemon(opts) {
         finishSuccession(succession, tracker.records(), log);
     /** Service processes this daemon spawned, so a handoff can let go of them. */
     const spawned = new Set();
-    if (!resolveSyncRunnerPath())
-        log("warn", "the hq-cloud sync runner was not found in this CLI install; sync is unavailable");
     const updatable = cliSelfUpdatable();
     const hostName = os.hostname().split(".")[0] || "hq-host";
     let legacyCache = null;
@@ -435,14 +532,22 @@ export async function runDaemon(opts) {
         return `mesh daemon already running (pid ${owner.pid}); waiting for it to exit`;
     };
     let warnedMissingPin = null;
+    let warnedMissingSyncRunner = false;
     const daemonSyncRunnerPids = new Set();
     const plan = () => {
         const config = readDaemonConfig(paths.configPath);
         const legacy = legacyUnits();
         const configured = config.hqRoot ?? (env.HQ_ROOT?.trim() || undefined);
         const hqRoot = configured && fs.existsSync(configured) ? configured : undefined;
-        // Re-picked every reconcile, so a newer hq-cloud from the updater is used as soon as it lands.
-        const hqCloud = currentHqCloud(paths.root);
+        getStagedHqChildBootstrap();
+        const staged = getStagedSyncBundle();
+        // Before release, preserve today's selection. Later plans can only use the
+        // daemon-owned full package; the CLI-bundled tree may have been replaced.
+        const hqCloud = packageUseLeaseReleased
+            ? currentHqCloudAfterLeaseRelease(paths.root, hqCloudVersionBeforeRelease)
+            : currentHqCloud(paths.root);
+        if (!packageUseLeaseReleased)
+            hqCloudVersionBeforeRelease = hqCloud?.version ?? staged?.metadata.version ?? null;
         const missingPin = hqCloud?.pinnedVersionMissing ?? null;
         if (missingPin !== warnedMissingPin) {
             warnedMissingPin = missingPin;
@@ -450,7 +555,17 @@ export async function runDaemon(opts) {
                 log("warn", `hq-cloud is pinned to ${missingPin}, which is not installed; running ${hqCloud.version} (${hqCloud.source}) until the updater installs it`);
             }
         }
-        const runners = hqCloud ? hqCloudRunners(hqCloud.root) : { syncRunner: null, heartbeat: null, sessionHost: null };
+        if (!packageUseLeaseReleased && !legacySyncRunnerPathChecked) {
+            legacySyncRunnerPath = resolveSyncRunnerPath();
+            legacySyncRunnerPathChecked = true;
+        }
+        const syncSource = syncRunnerSourceForPlan(staged?.runnerPath ?? null, hqCloud, packageUseLeaseReleased ? null : legacySyncRunnerPath);
+        if (!syncSource.runnerPath && !warnedMissingSyncRunner) {
+            warnedMissingSyncRunner = true;
+            log("warn", "the hq-cloud sync runner was not found in this CLI install; sync is unavailable");
+        }
+        const packageRunners = hqCloud ? hqCloudRunners(hqCloud.root) : { syncRunner: null, heartbeat: null, sessionHost: null };
+        const runners = { ...packageRunners, syncRunner: syncSource.runnerPath };
         const services = enabledServices(machineType, config);
         const isSignedIn = signedIn(env, home, log);
         const syncOwner = effectiveSyncOwner(config, machineType);
@@ -477,7 +592,7 @@ export async function runDaemon(opts) {
                 }
             }
         }
-        return planUnits(services, {
+        const plans = planUnits(services, {
             machineType,
             platform,
             home,
@@ -512,13 +627,23 @@ export async function runDaemon(opts) {
             tmuxPath: findOnPath("tmux", env),
             hostName,
         });
+        if (startupPlanOpen) {
+            const replaceablePackageRoots = cliPackageRoot ? [cliPackageRoot] : [];
+            if (hqCloud?.source === "bundled")
+                replaceablePackageRoots.push(hqCloud.root);
+            else if (!hqCloud && legacySyncRunnerPath) {
+                replaceablePackageRoots.push(path.dirname(path.dirname(path.dirname(legacySyncRunnerPath))));
+            }
+            startupPlans.push({ plans, replaceablePackageRoots });
+        }
+        return plans;
     };
     const spawnUnit = (unit) => {
         const command = unit.command;
         if (!command || command.type === "internal")
             throw new Error(`${unit.id} has no process to start`);
         const [file, args] = command.type === "hq"
-            ? [opts.nodeBinary, [opts.hqBinary, ...command.args]]
+            ? daemonHqChildCommand(opts.nodeBinary, opts.hqBinary, command.args, stagedHqChildBootstrap?.bootstrapPath ?? null, cliPackagePrefix)
             : command.type === "node"
                 ? [opts.nodeBinary, [command.script, ...command.args]]
                 : [command.file, command.args];
@@ -831,7 +956,11 @@ export async function runDaemon(opts) {
             resolve(1);
         }
         finally {
-            opts.onStartupReadsComplete?.();
+            startupPlanOpen = false;
+            const startupPlanIsStable = startupPlans.length > 0 && startupPlans.every(({ plans, replaceablePackageRoots }) => daemonPlanCanReleasePackageUseLease(plans, replaceablePackageRoots, bundleStageFailed || hqChildBootstrapStageFailed, Boolean(stagedHqChildBootstrap && cliPackagePrefix)));
+            if (startupPlanIsStable) {
+                packageUseLeaseReleased = opts.onStartupReadsComplete?.() === true;
+            }
         }
     });
 }

package/dist/lib/daemon/sync-runner-bundle.d.ts

@@ -0,0 +1,40 @@
+/** Atomic staging for the sync-runner bundle shipped with hq-cli. */
+import * as fs from "node:fs";
+export declare const SYNC_RUNNER_BUNDLE_RUNNER_FILE = "bin/sync-runner.js";
+export declare const SYNC_RUNNER_BUNDLE_METADATA_FILE = "package.json";
+export declare const SYNC_RUNNER_BUNDLE_DIRECTORY = "hq-cloud-sync-runner";
+export declare const SYNC_RUNNER_BUNDLE_FORMAT_VERSION = 1;
+/** package.json contract that the hq-cli build step emits beside the bundled bin directory. */
+export interface SyncRunnerBundleMetadata {
+    name: "hq-cli-daemon-sync-runner";
+    type: "module";
+    version: string;
+    bundleSha256: string;
+    formatVersion: typeof SYNC_RUNNER_BUNDLE_FORMAT_VERSION;
+}
+export type SyncRunnerBundleStageErrorCode = "PAYLOAD_MISSING" | "MISSING_SIDECAR" | "INVALID_METADATA" | "VERSION_OUT_OF_RANGE" | "HASH_MISMATCH" | "STAGE_EXISTS_INVALID" | "COPY_FAILED" | "FSYNC_FAILED" | "RENAME_FAILED";
+export declare class SyncRunnerBundleStageError extends Error {
+    readonly code: SyncRunnerBundleStageErrorCode;
+    constructor(code: SyncRunnerBundleStageErrorCode, message: string, options?: ErrorOptions);
+}
+export interface StagedSyncRunnerBundle {
+    directory: string;
+    runnerPath: string;
+    metadataPath: string;
+    metadata: SyncRunnerBundleMetadata;
+}
+export interface StageSyncRunnerBundleOptions {
+    /** Directory in the installed hq-cli dist containing both contract files. */
+    payloadDirectory: string;
+    /** Daemon-owned state root, normally daemonPaths().root. */
+    daemonRoot: string;
+    /** Test seams for the file copy and atomic directory rename. */
+    copyFile?: typeof fs.copyFileSync;
+    renameDirectory?: (from: string, to: string) => void;
+}
+/**
+ * Stage one validated runner bundle into an immutable daemon-owned directory.
+ * Only a completed, fsynced directory is returned; temp siblings are ignored.
+ */
+export declare function stageSyncRunnerBundle(options: StageSyncRunnerBundleOptions): StagedSyncRunnerBundle;
+//# sourceMappingURL=sync-runner-bundle.d.ts.map

package/dist/lib/daemon/sync-runner-bundle.js

@@ -0,0 +1,199 @@
+/** Atomic staging for the sync-runner bundle shipped with hq-cli. */
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import semver from "semver";
+import { ensurePrivateDir } from "./paths.js";
+export const SYNC_RUNNER_BUNDLE_RUNNER_FILE = "bin/sync-runner.js";
+export const SYNC_RUNNER_BUNDLE_METADATA_FILE = "package.json";
+export const SYNC_RUNNER_BUNDLE_DIRECTORY = "hq-cloud-sync-runner";
+export const SYNC_RUNNER_BUNDLE_FORMAT_VERSION = 1;
+export class SyncRunnerBundleStageError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+        this.name = "SyncRunnerBundleStageError";
+    }
+}
+function fail(code, message, cause) {
+    if (cause instanceof SyncRunnerBundleStageError)
+        throw cause;
+    throw new SyncRunnerBundleStageError(code, message, cause === undefined ? undefined : { cause });
+}
+function readMetadata(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            fail("MISSING_SIDECAR", "The sync-runner bundle metadata sidecar is missing", error);
+        }
+        fail("PAYLOAD_MISSING", "Unable to read the sync-runner bundle metadata", error);
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch (error) {
+        fail("INVALID_METADATA", "The sync-runner bundle metadata is invalid JSON", error);
+    }
+    if (!value || typeof value !== "object") {
+        fail("INVALID_METADATA", "The sync-runner bundle metadata has an invalid shape");
+    }
+    const metadata = value;
+    if (metadata.name !== "hq-cli-daemon-sync-runner"
+        || metadata.type !== "module"
+        || metadata.formatVersion !== SYNC_RUNNER_BUNDLE_FORMAT_VERSION
+        || typeof metadata.version !== "string"
+        || !semver.valid(metadata.version)
+        || typeof metadata.bundleSha256 !== "string"
+        || !/^[a-f0-9]{64}$/.test(metadata.bundleSha256)) {
+        fail("INVALID_METADATA", "The sync-runner bundle metadata has an invalid shape");
+    }
+    return metadata;
+}
+function hqCloudRange() {
+    const cliPackagePath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../package.json");
+    try {
+        const pkg = JSON.parse(fs.readFileSync(cliPackagePath, "utf8"));
+        const range = pkg.dependencies?.["@indigoai-us/hq-cloud"];
+        if (typeof range !== "string" || !semver.validRange(range))
+            throw new Error("invalid declared range");
+        return range;
+    }
+    catch (error) {
+        fail("INVALID_METADATA", "Unable to read the declared hq-cloud version range", error);
+    }
+}
+function sha256(file) {
+    return createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
+function syncFile(file) {
+    const fd = fs.openSync(file, "r");
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function syncDirectory(directory) {
+    const fd = fs.openSync(directory, fs.constants.O_RDONLY);
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function readStaged(directory, expected, range) {
+    if (!fs.existsSync(directory))
+        return null;
+    const runnerPath = path.join(directory, SYNC_RUNNER_BUNDLE_RUNNER_FILE);
+    const metadataPath = path.join(directory, SYNC_RUNNER_BUNDLE_METADATA_FILE);
+    let metadata;
+    try {
+        metadata = readMetadata(metadataPath);
+        if (metadata.formatVersion !== expected.formatVersion
+            || metadata.version !== expected.version
+            || metadata.bundleSha256 !== expected.bundleSha256
+            || metadata.type !== "module"
+            || !semver.satisfies(metadata.version, range)
+            || sha256(runnerPath) !== metadata.bundleSha256)
+            fail("STAGE_EXISTS_INVALID", "An existing sync-runner stage is invalid; preserving it");
+    }
+    catch (error) {
+        if (error instanceof SyncRunnerBundleStageError && error.code === "STAGE_EXISTS_INVALID")
+            throw error;
+        fail("STAGE_EXISTS_INVALID", "An existing sync-runner stage is invalid; preserving it", error);
+    }
+    return { directory, runnerPath, metadataPath, metadata };
+}
+function stagedLeaf(metadata) {
+    const version = metadata.version.replace(/[^A-Za-z0-9.-]/g, "_");
+    return `${version}-${metadata.bundleSha256}`;
+}
+/**
+ * Stage one validated runner bundle into an immutable daemon-owned directory.
+ * Only a completed, fsynced directory is returned; temp siblings are ignored.
+ */
+export function stageSyncRunnerBundle(options) {
+    const sourceRunner = path.join(options.payloadDirectory, SYNC_RUNNER_BUNDLE_RUNNER_FILE);
+    const sourceMetadata = path.join(options.payloadDirectory, SYNC_RUNNER_BUNDLE_METADATA_FILE);
+    const metadata = readMetadata(sourceMetadata);
+    const range = hqCloudRange();
+    if (!semver.satisfies(metadata.version, range)) {
+        fail("VERSION_OUT_OF_RANGE", "The sync-runner bundle version is outside the declared hq-cloud range");
+    }
+    try {
+        if (!fs.statSync(sourceRunner).isFile())
+            fail("PAYLOAD_MISSING", "The sync-runner bundle file is missing");
+    }
+    catch (error) {
+        fail("PAYLOAD_MISSING", "Unable to access the sync-runner bundle file", error);
+    }
+    if (sha256(sourceRunner) !== metadata.bundleSha256) {
+        fail("HASH_MISMATCH", "The sync-runner bundle sha256 does not match its sidecar");
+    }
+    const stageRoot = path.join(options.daemonRoot, "bundles", "sync-runner");
+    const selectedDirectory = path.join(stageRoot, stagedLeaf(metadata));
+    const existing = readStaged(selectedDirectory, metadata, range);
+    if (existing)
+        return existing;
+    let tempDirectory;
+    let failureCode = "COPY_FAILED";
+    try {
+        ensurePrivateDir(stageRoot);
+        tempDirectory = path.join(stageRoot, `.tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
+        fs.mkdirSync(tempDirectory, { mode: 0o700 });
+        fs.mkdirSync(path.join(tempDirectory, "bin"), { mode: 0o700 });
+        (options.copyFile ?? fs.copyFileSync)(sourceRunner, path.join(tempDirectory, SYNC_RUNNER_BUNDLE_RUNNER_FILE));
+        (options.copyFile ?? fs.copyFileSync)(sourceMetadata, path.join(tempDirectory, SYNC_RUNNER_BUNDLE_METADATA_FILE));
+        if (sha256(path.join(tempDirectory, SYNC_RUNNER_BUNDLE_RUNNER_FILE)) !== metadata.bundleSha256) {
+            fail("HASH_MISMATCH", "The staged sync-runner bundle sha256 does not match its sidecar");
+        }
+        failureCode = "FSYNC_FAILED";
+        syncFile(path.join(tempDirectory, SYNC_RUNNER_BUNDLE_RUNNER_FILE));
+        syncFile(path.join(tempDirectory, SYNC_RUNNER_BUNDLE_METADATA_FILE));
+        syncDirectory(path.join(tempDirectory, "bin"));
+        syncDirectory(tempDirectory);
+        failureCode = "RENAME_FAILED";
+        try {
+            (options.renameDirectory ?? fs.renameSync)(tempDirectory, selectedDirectory);
+        }
+        catch (error) {
+            if (error.code === "EEXIST" || error.code === "ENOTEMPTY") {
+                const raced = readStaged(selectedDirectory, metadata, range);
+                if (raced) {
+                    fs.rmSync(tempDirectory, { recursive: true, force: true });
+                    return raced;
+                }
+            }
+            fail("RENAME_FAILED", "Unable to atomically select the staged sync-runner bundle", error);
+        }
+        tempDirectory = undefined;
+        failureCode = "FSYNC_FAILED";
+        syncDirectory(stageRoot);
+    }
+    catch (error) {
+        if (tempDirectory) {
+            try {
+                fs.rmSync(tempDirectory, { recursive: true, force: true });
+            }
+            catch (cleanupError) {
+                fail("COPY_FAILED", "Unable to remove the temporary sync-runner stage", new AggregateError([error, cleanupError]));
+            }
+        }
+        if (error instanceof SyncRunnerBundleStageError)
+            throw error;
+        fail(failureCode, "Unable to stage the sync-runner bundle", error);
+    }
+    const staged = readStaged(selectedDirectory, metadata, range);
+    if (!staged)
+        fail("FSYNC_FAILED", "The completed sync-runner stage failed validation");
+    return staged;
+}
+//# sourceMappingURL=sync-runner-bundle.js.map

package/dist/utils/package-use-lease.d.ts

@@ -34,7 +34,13 @@ export declare function createPackageUseLeaseHandoff(lease: PackageUseLease, tim
 export declare function createCurrentPackageUseLeaseHandoff(timeoutMs?: number): PackageUseLeaseHandoff | null;
 /** Publish this process's lease identity to a parent waiting in the same prefix. */
 export declare function publishPackageUseLeaseHandoff(lease: PackageUseLease, env?: NodeJS.ProcessEnv): boolean;
+export declare function currentPackageUseLeaseInstall(): {
+    prefix: string;
+    version: string;
+} | null;
 export declare function acquireCurrentPackageUseLease(argv?: readonly string[]): PackageUseLease | null;
+/** Let a daemon bootstrap drop its temporary lease after this process published its own. */
+export declare function signalPackageUseLeaseBootstrapHandoff(lease?: PackageUseLease | null): void;
 /** Release this process's package-use lease after a long-running command has loaded its package modules. */
 export declare function releaseCurrentPackageUseLease(): void;
 /** The lease remains held through command execution and is released on process exit. */

package/dist/utils/package-use-lease.js

@@ -50,6 +50,7 @@ export function packageUseLeasePurposeForArgv(argv) {
     return "command";
 }
 let currentPackageUseLease = null;
+const BOOTSTRAP_HANDOFF_ENV = "HQ_CLI_PACKAGE_USE_HANDOFF_TOKEN";
 function errorLabel(error) {
     if (error && typeof error === "object") {
         const value = error;
@@ -308,7 +309,7 @@ function exists(file) {
         throw error;
     }
 }
-export function acquireCurrentPackageUseLease(argv = process.argv) {
+export function currentPackageUseLeaseInstall() {
     const pkg = findCliPackage(path.dirname(fileURLToPath(import.meta.url)));
     if (!pkg || isPnpmGlobal(pkg.root) || isBunGlobal(pkg.root))
         return null;
@@ -321,11 +322,33 @@ export function acquireCurrentPackageUseLease(argv = process.argv) {
         if (nodeModules > 0 && parts[nodeModules - 1] !== "lib")
             return null;
     }
-    const lease = acquirePackageUseLease(prefix, pkg.version, undefined, packageUseLeasePurposeForArgv(argv));
+    return { prefix, version: pkg.version };
+}
+export function acquireCurrentPackageUseLease(argv = process.argv) {
+    const install = currentPackageUseLeaseInstall();
+    if (!install)
+        return null;
+    const lease = acquirePackageUseLease(install.prefix, install.version, undefined, packageUseLeasePurposeForArgv(argv));
     currentPackageUseLease = lease;
     publishPackageUseLeaseHandoff(lease);
     return lease;
 }
+/** Let a daemon bootstrap drop its temporary lease after this process published its own. */
+export function signalPackageUseLeaseBootstrapHandoff(lease = currentPackageUseLease) {
+    const token = process.env[BOOTSTRAP_HANDOFF_ENV];
+    if (token === undefined)
+        return;
+    delete process.env[BOOTSTRAP_HANDOFF_ENV];
+    if (!lease || !/^[a-f0-9]{32}$/.test(token))
+        return;
+    const markerPath = path.join(path.dirname(lease.leasePath), `handoff-${process.pid}-${token}.handoff`);
+    try {
+        writeFileSync(markerPath, `${process.pid}\n`, { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        process.stderr.write(`hq-cli package-use lease handoff signal failed (${errorLabel(error)})\n`);
+    }
+}
 /** Release this process's package-use lease after a long-running command has loaded its package modules. */
 export function releaseCurrentPackageUseLease() {
     currentPackageUseLease?.release();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.1",
+  "version": "5.345.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -24,7 +24,7 @@
     "scripts/mesh-daemon-if-stale.mjs"
   ],
   "scripts": {
-    "build": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs",
+    "build": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs && node scripts/bundle-sync-runner.mjs",
     "prepublishOnly": "npm run build",
     "pretypecheck": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.typetest.json",