@indigoai-us/hq-cli 5.345.175 → 5.345.177

package/dist/lib/bot/runtime/codex.d.ts

@@ -90,5 +90,10 @@ export declare function bundledCodexBin(homeDir?: string, isExecutable?: IsExecu
  * usual "codex is not installed or not on PATH" error.
  */
 export declare function resolveCodexBinary(env: NodeJS.ProcessEnv, homeDir?: string, platform?: NodeJS.Platform, cwd?: string, isExecutable?: IsExecutableFile): string;
+/**
+ * `codex login status` prints "Logged in using ChatGPT" (exit 0) or "Not
+ * logged in" (exit 1). Null when it said neither.
+ */
+export declare function parseCodexLoginStatus(result: SpawnResult): boolean | null;
 export declare function createCodexRuntime(): BotRuntime;
 //# sourceMappingURL=codex.d.ts.map

package/dist/lib/bot/runtime/codex.js

@@ -270,11 +270,24 @@ export function resolveCodexBinary(env, homeDir, platform = process.platform, cw
     // `||`, not `??`: an empty HOME must not turn ~/Applications into a relative path.
     return bundledCodexBin(homeDir || env.HOME || os.homedir(), isExecutable) ?? "codex";
 }
+/**
+ * `codex login status` prints "Logged in using ChatGPT" (exit 0) or "Not
+ * logged in" (exit 1). Null when it said neither.
+ */
+export function parseCodexLoginStatus(result) {
+    const text = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+    if (/\bnot logged in\b/i.test(text))
+        return false;
+    if (/\blogged in\b/i.test(text))
+        return true;
+    return null;
+}
 export function createCodexRuntime() {
     return {
         id: "codex",
         binary: "codex",
         resolveBinary: (env, cwd, platform) => resolveCodexBinary(env, undefined, platform ?? process.platform, cwd),
+        signInStatus: { args: ["login", "status"], parse: parseCodexLoginStatus },
         buildArgs(input, scratch) {
             const promptArg = input.platform === "win32" ? "-" : codexPrompt(input);
             const common = ["--json", "--skip-git-repo-check", "-o", scratch.outputFile];

package/dist/lib/bot/runtime/types.d.ts

@@ -202,6 +202,16 @@ export interface BotRuntime {
         requestedModel: string | undefined;
         run: (args: string[]) => Promise<SpawnResult>;
     }): Promise<string[]>;
+    /**
+     * Optional: the tool's own "am I signed in?" command (`claude auth status
+     * --json`, `codex login status`), run in the bot's environment before a turn
+     * and at start. `parse` reads its answer: true/false, or null when the
+     * output does not say. Pure; needs no network.
+     */
+    signInStatus?: {
+        args: string[];
+        parse(result: SpawnResult): boolean | null;
+    };
 }
 /**
  * Turns have no time limit: a turn runs until the model process exits (the

package/dist/lib/bot/runtime-sign-in-check.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The bot's own look at its coding tool's sign-in, in the bot's environment.
+ *
+ * The owner's terminal and the bot are different processes with different
+ * environments: a bot started by launchd has none of the shell's variables,
+ * so Claude Code can be signed in for the terminal and signed out for the
+ * bot. The HQ app's own preflight runs with the app's environment and cannot
+ * see this either. Only the bot can, so it asks the tool itself (`claude auth
+ * status --json`, `codex login status`) with the exact environment its turns
+ * use, at start and before each turn, and reports the answer in status.json.
+ * The app reads it through `hq bot status --json` / `hq bot list --json`
+ * before it sends a brief job.
+ */
+import type { BotRuntime, SpawnLike } from "./runtime/types.js";
+import { type RuntimeSignInCheck } from "./runtime-sign-in.js";
+export interface SignInCheckOptions {
+    runtime: BotRuntime;
+    /** The environment the bot's turns spawn the tool with. */
+    env: NodeJS.ProcessEnv;
+    cwd: string;
+    spawn?: SpawnLike;
+    timeoutMs?: number;
+    now?: () => Date;
+    platform?: NodeJS.Platform;
+}
+/**
+ * Ask the tool whether it is signed in. Never throws: a tool that cannot be
+ * asked (not installed, hung, no status command) answers `signedIn: null`,
+ * and the turn then runs as before and reports its own failure.
+ */
+export declare function checkRuntimeSignIn(opts: SignInCheckOptions): Promise<RuntimeSignInCheck>;
+//# sourceMappingURL=runtime-sign-in-check.d.ts.map

package/dist/lib/bot/runtime-sign-in-check.js

@@ -0,0 +1,53 @@
+/**
+ * The bot's own look at its coding tool's sign-in, in the bot's environment.
+ *
+ * The owner's terminal and the bot are different processes with different
+ * environments: a bot started by launchd has none of the shell's variables,
+ * so Claude Code can be signed in for the terminal and signed out for the
+ * bot. The HQ app's own preflight runs with the app's environment and cannot
+ * see this either. Only the bot can, so it asks the tool itself (`claude auth
+ * status --json`, `codex login status`) with the exact environment its turns
+ * use, at start and before each turn, and reports the answer in status.json.
+ * The app reads it through `hq bot status --json` / `hq bot list --json`
+ * before it sends a brief job.
+ */
+import { defaultSpawn } from "./runtime/index.js";
+import { SIGN_IN_CHECK_TIMEOUT_MS } from "./runtime-sign-in.js";
+/**
+ * Ask the tool whether it is signed in. Never throws: a tool that cannot be
+ * asked (not installed, hung, no status command) answers `signedIn: null`,
+ * and the turn then runs as before and reports its own failure.
+ */
+export async function checkRuntimeSignIn(opts) {
+    const checkedAt = (opts.now ?? (() => new Date()))().toISOString();
+    const status = opts.runtime.signInStatus;
+    if (!status)
+        return { signedIn: null, checkedAt, detail: `${opts.runtime.id} has no sign-in status command` };
+    const spawn = opts.spawn ?? defaultSpawn;
+    const env = { ...(opts.runtime.runtimeEnv?.(opts.env) ?? opts.env), HQ_NO_ENSURE_HQ_DESKTOP: "1" };
+    let binary;
+    try {
+        binary = opts.runtime.resolveBinary?.(env, opts.cwd, opts.platform ?? process.platform) ?? opts.runtime.binary;
+    }
+    catch {
+        binary = opts.runtime.binary;
+    }
+    try {
+        const result = await spawn(binary, status.args, { cwd: opts.cwd, env, timeoutMs: opts.timeoutMs ?? SIGN_IN_CHECK_TIMEOUT_MS });
+        const signedIn = status.parse(result);
+        if (signedIn === null) {
+            const tail = `${result.stderr ?? ""}`.trim().split("\n").filter(Boolean).slice(-2).join(" | ").slice(0, 200);
+            return {
+                signedIn: null,
+                checkedAt,
+                detail: `${opts.runtime.id} ${status.args.join(" ")} did not say (exit ${result.code ?? "?"}${tail ? `: ${tail}` : ""})`,
+            };
+        }
+        return { signedIn, checkedAt };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { signedIn: null, checkedAt, detail: `${opts.runtime.id} ${status.args.join(" ")} could not run: ${message.slice(0, 200)}` };
+    }
+}
+//# sourceMappingURL=runtime-sign-in-check.js.map

package/dist/lib/bot/runtime-sign-in.d.ts

@@ -13,12 +13,41 @@ import type { BotRuntimeId } from "./config.js";
 export declare const SIGN_IN_RETRY_MS = 60000;
 export declare function isRuntimeSignInFailure(text: string | undefined | null): boolean;
 export declare function runtimeDisplayName(runtime: BotRuntimeId | string): string;
-/** Reported in status.json and `hq bot list --json` while the sign-in is broken. */
+/**
+ * Reported in status.json and `hq bot list --json` while the sign-in is broken.
+ *
+ *   expired     a turn failed because the tool's login no longer works.
+ *   signed-out  the bot's own check (`claude auth status` in the bot's
+ *               environment, before a turn) found no login at all. A bot
+ *               started by launchd has a bare environment, so it can be
+ *               signed out while the owner's terminal is signed in.
+ */
 export interface RuntimeSignInIssue {
-    state: "expired";
+    state: "expired" | "signed-out";
     runtime: BotRuntimeId;
     since: string;
 }
+/**
+ * What the bot's own sign-in check last said, in the bot's environment.
+ * `signedIn` is null when the tool could not be asked (not installed, timed
+ * out, a runtime with no status command).
+ */
+export interface RuntimeSignInCheck {
+    signedIn: boolean | null;
+    checkedAt: string;
+    /** Why the check could not tell, for the log and the JSON output. */
+    detail?: string;
+}
+/** How long a passed check stands in for another before a turn. */
+export declare const SIGN_IN_CHECK_FRESH_MS = 30000;
+/** How often the bot asks the tool again while it is signed out. */
+export declare const SIGN_IN_CHECK_MS = 15000;
+/** The tool's status command may not hang a turn. */
+export declare const SIGN_IN_CHECK_TIMEOUT_MS = 15000;
+/** The terminal command that signs the tool in on this computer. */
+export declare function signInCommand(runtime: BotRuntimeId | string): string;
+/** The excerpt a turn held by the pre-turn check records (classifies as signed-out). */
+export declare function signedOutExcerpt(runtime: BotRuntimeId | string): string;
 /** The one message a conversation gets when the bot cannot work until its tool signs in again. */
-export declare function signInNeededText(runtime: BotRuntimeId | string, kickoff?: boolean): string;
+export declare function signInNeededText(runtime: BotRuntimeId | string, kickoff?: boolean, state?: RuntimeSignInIssue["state"]): string;
 //# sourceMappingURL=runtime-sign-in.d.ts.map

package/dist/lib/bot/runtime-sign-in.js

@@ -22,10 +22,25 @@ export function isRuntimeSignInFailure(text) {
 export function runtimeDisplayName(runtime) {
     return runtime === "claude" ? "Claude Code" : runtime === "codex" ? "Codex" : runtime === "grok" ? "Grok" : runtime;
 }
+/** How long a passed check stands in for another before a turn. */
+export const SIGN_IN_CHECK_FRESH_MS = 30_000;
+/** How often the bot asks the tool again while it is signed out. */
+export const SIGN_IN_CHECK_MS = 15_000;
+/** The tool's status command may not hang a turn. */
+export const SIGN_IN_CHECK_TIMEOUT_MS = 15_000;
+/** The terminal command that signs the tool in on this computer. */
+export function signInCommand(runtime) {
+    return runtime === "claude" ? "claude auth login" : runtime === "codex" ? "codex login" : runtime === "grok" ? "grok login" : `${runtime} login`;
+}
+/** The excerpt a turn held by the pre-turn check records (classifies as signed-out). */
+export function signedOutExcerpt(runtime) {
+    return `${runtimeDisplayName(runtime)} is not logged in on this computer (checked before the turn)`;
+}
 /** The one message a conversation gets when the bot cannot work until its tool signs in again. */
-export function signInNeededText(runtime, kickoff = false) {
+export function signInNeededText(runtime, kickoff = false, state = "expired") {
     const tool = runtimeDisplayName(runtime);
-    return (`I can't work right now: ${tool} needs you to sign in again on this computer. ` +
+    const why = state === "signed-out" ? `${tool} isn't signed in on this computer` : `${tool} needs you to sign in again on this computer`;
+    return (`I can't work right now: ${why}. ` +
         `Use "Sign in to ${tool}" in HQ, and I'll ${kickoff ? "get started" : "answer this"} as soon as it works again. No need to send it twice.`);
 }
 //# sourceMappingURL=runtime-sign-in.js.map

package/dist/lib/bot/status.d.ts

@@ -2,7 +2,7 @@
  * status.json — atomic, metadata-only runtime status (local-bots US-003).
  */
 import type { BotRuntimeId } from "./config.js";
-import type { RuntimeSignInIssue } from "./runtime-sign-in.js";
+import type { RuntimeSignInCheck, RuntimeSignInIssue } from "./runtime-sign-in.js";
 export type BotState = "starting" | "running" | "stopped" | "failed";
 export interface BotStatusFile {
     v: 1;
@@ -44,6 +44,12 @@ export interface BotStatusFile {
      * reason); cleared by the next turn that works. `null` = known to work.
      */
     runtimeSignIn?: RuntimeSignInIssue | null;
+    /**
+     * The bot's own last look at its coding tool's sign-in, in the bot's
+     * environment (at start, before a turn, and while signed out). What
+     * `hq bot status --json` reports as `runtimeSignedIn`.
+     */
+    runtimeSignInCheck?: RuntimeSignInCheck | null;
     /**
      * Set when the installed coding tool is too old for the model it was asked
      * to use and the last turn ran on `to` instead (`from` is "" when the model
@@ -65,6 +71,8 @@ export interface BotStatusFile {
         durationMs?: number;
         stderr: string;
     };
+    /** When the last model turn that worked had STARTED (ISO); a later crash is not cleared by it. */
+    lastTurnOkAt?: string;
     /**
      * Set while the bot holds its model turns after FAILURE_LIMIT failures in a
      * window (it used to exit instead, and a bot that exited could neither load
@@ -83,6 +91,22 @@ export declare function defaultBotStatus(pid: number, runtime: BotRuntimeId, now
 export declare function readBotStatus(dir: string): BotStatusFile | null;
 export declare function writeBotStatus(dir: string, status: BotStatusFile): void;
 export declare function patchBotStatus(dir: string, patch: Partial<BotStatusFile>, fallback: () => BotStatusFile, now?: () => Date): BotStatusFile;
+/** A coding-tool crash the bot has not recovered from yet (see `runtimeCrashSinceStart`). */
+export interface RuntimeCrash {
+    at: string;
+    code: number | null;
+    durationMs?: number;
+    /** First line of the tool's stderr, at most 200 characters. */
+    message: string;
+}
+/**
+ * The coding tool crashed before its turn started, in this bot process, and
+ * no turn has worked since. Null when there is no such crash: none recorded,
+ * one from before the bot last started (a restart is the fix people reach
+ * for, so it clears this), or one followed by a good turn. Surfaces read it
+ * to warn before sending the bot work it would fail.
+ */
+export declare function runtimeCrashSinceStart(status: BotStatusFile | null | undefined): RuntimeCrash | null;
 /** Live process check for a status file's pid. */
 export declare function isPidAlive(pid: number): boolean;
 //# sourceMappingURL=status.d.ts.map

package/dist/lib/bot/status.js

@@ -51,6 +51,34 @@ export function patchBotStatus(dir, patch, fallback, now = () => new Date()) {
     writeBotStatus(dir, next);
     return next;
 }
+/**
+ * The coding tool crashed before its turn started, in this bot process, and
+ * no turn has worked since. Null when there is no such crash: none recorded,
+ * one from before the bot last started (a restart is the fix people reach
+ * for, so it clears this), or one followed by a good turn. Surfaces read it
+ * to warn before sending the bot work it would fail.
+ */
+export function runtimeCrashSinceStart(status) {
+    const crash = status?.lastCrash;
+    if (!crash)
+        return null;
+    const at = Date.parse(crash.at);
+    if (!Number.isFinite(at))
+        return null;
+    const started = Date.parse(status.startedAt);
+    if (Number.isFinite(started) && at < started)
+        return null;
+    const ok = status.lastTurnOkAt ? Date.parse(status.lastTurnOkAt) : Number.NaN;
+    if (Number.isFinite(ok) && ok >= at)
+        return null;
+    const message = (crash.stderr ?? "").split("\n").map((l) => l.trim()).find(Boolean)?.slice(0, 200) ?? "";
+    return {
+        at: crash.at,
+        code: crash.code,
+        ...(crash.durationMs !== undefined ? { durationMs: crash.durationMs } : {}),
+        message,
+    };
+}
 /** Live process check for a status file's pid. */
 export function isPidAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0)

package/dist/lib/daemon/catalog.d.ts

@@ -92,6 +92,8 @@ export interface SyncCoreRunning {
 }
 export declare const SYNC_CORE_RECONCILE_UNIT = "sync-core";
 export declare const SYNC_CORE_RECONCILE_INTERVAL_SEC = 600;
+export declare const SYNC_CORE_MANIFEST_UNIT = "sync-core-manifest";
+export declare const SYNC_CORE_MANIFEST_INTERVAL_SEC: number;
 export declare const SYNC_CORE_LEGACY_SETTLE_MS: number;
 export interface PlanContext {
     machineType: MachineType;
@@ -126,6 +128,8 @@ export interface PlanContext {
     now?: number;
     /** A legacy desktop app or sync unit is still managing sync. */
     desktopAppManagesSync: boolean;
+    /** A legacy sync unit (not the desktop app) that the daemon cannot migrate is installed. */
+    legacySyncUnitManagesSync?: boolean;
     /** Full process list, or null when the daemon could not read it. */
     syncRunnerProcesses: readonly SyncRunnerProcess[] | null;
     /** PID recorded in the watch-owner status, when it is readable. */

package/dist/lib/daemon/catalog.js

@@ -11,6 +11,7 @@
  */
 import * as path from "node:path";
 import { syncCoreUnitId } from "../sync-core/engine-home.js";
+import { engineOwnedManifestScopes } from "../sync-core/manifest-scopes.js";
 import { SYNC_RUNNER_OWNER, syncRunnerUnleasedBlockReason } from "./sync-runner.js";
 import { vaultSkipEnv } from "../vault-sync-switches.js";
 export const SERVICE_NAMES = [
@@ -82,10 +83,14 @@ export const DEFAULT_SERVICES = {
 /** Defaults plus this host's overrides, in catalog order. Unknown names are ignored. */
 export function enabledServices(machineType, overrides) {
     const defaults = DEFAULT_SERVICES[machineType];
-    return SERVICE_NAMES.filter((s) => (defaults.includes(s) || overrides.enable.includes(s)) && !overrides.disable.includes(s));
+    const wanted = (s) => (defaults.includes(s) || overrides.enable.includes(s)) && !overrides.disable.includes(s);
+    const wakeSubscriber = wanted("sync-core") && !overrides.disable.includes("mesh");
+    return SERVICE_NAMES.filter((s) => wanted(s) || (s === "mesh" && wakeSubscriber));
 }
 export const SYNC_CORE_RECONCILE_UNIT = "sync-core";
 export const SYNC_CORE_RECONCILE_INTERVAL_SEC = 600;
+export const SYNC_CORE_MANIFEST_UNIT = "sync-core-manifest";
+export const SYNC_CORE_MANIFEST_INTERVAL_SEC = 24 * 3600;
 export const SYNC_CORE_LEGACY_SETTLE_MS = 10 * 60 * 1000;
 function base(service, over = {}) {
     return {
@@ -127,6 +132,20 @@ export const CLAUDE_RUNNER_SCRIPT = "/usr/local/bin/outpost-runner.sh";
 const NO_HQ_ROOT = "no HQ folder configured (run `hq daemon install --hq-root <path>`)";
 const NOT_SIGNED_IN = "not signed in (run `hq login`)";
 const KIT_NOT_SET_UP = "the agent kit is not set up on this machine (run `hq agent kit install`)";
+function syncOwnerBlock(ctx) {
+    if (ctx.machineType === "desktop" && ctx.syncOwner === "desktop-app" && ctx.desktopAppManagesSync) {
+        return "the desktop app is still managing sync (run `hq daemon sync take-ownership` after it stops its runner)";
+    }
+    if (ctx.machineType === "desktop" && ctx.syncOwner === "daemon" && !ctx.syncPaused && ctx.hqRoot && ctx.signedIn) {
+        return ctx.syncRunnerProcesses === null
+            ? "could not check for an existing sync runner; waiting to avoid starting a duplicate"
+            : syncRunnerUnleasedBlockReason(ctx.hqRoot, ctx.syncRunnerProcesses, ctx.syncRunnerOwnerPid, ctx.platform, ctx.daemonSyncRunnerPids);
+    }
+    return undefined;
+}
+function daemonAloneRunsLegacySync(ctx) {
+    return ctx.syncOwner === "daemon" && ctx.legacySyncUnitManagesSync !== true && syncOwnerBlock(ctx) === undefined;
+}
 function planService(service, ctx) {
     const agentMachine = ctx.machineType === "agent-kit" || ctx.machineType === "agent-box";
     switch (service) {
@@ -139,19 +158,7 @@ function planService(service, ctx) {
                     offCompanies: new Set([...(ctx.vaultSync?.offCompanies ?? []), ...running.companies]),
                 }
                 : ctx.vaultSync;
-            let ownerBlock;
-            if (ctx.machineType === "desktop" && ctx.syncOwner === "desktop-app" && ctx.desktopAppManagesSync) {
-                ownerBlock = "the desktop app is still managing sync (run `hq daemon sync take-ownership` after it stops its runner)";
-            }
-            else if (ctx.machineType === "desktop" &&
-                ctx.syncOwner === "daemon" &&
-                !ctx.syncPaused &&
-                ctx.hqRoot &&
-                ctx.signedIn) {
-                ownerBlock = ctx.syncRunnerProcesses === null
-                    ? "could not check for an existing sync runner; waiting to avoid starting a duplicate"
-                    : syncRunnerUnleasedBlockReason(ctx.hqRoot, ctx.syncRunnerProcesses, ctx.syncRunnerOwnerPid, ctx.platform, ctx.daemonSyncRunnerPids);
-            }
+            const ownerBlock = syncOwnerBlock(ctx);
             const commonBlock = firstBlock([
                 [ctx.syncPaused, "sync is paused (run `hq daemon sync resume`)"],
                 [
@@ -219,7 +226,8 @@ function planService(service, ctx) {
                     : ctx.vaultSync?.offCompanies.has(vault.slug ?? "") === true;
                 const offSince = vault.legacyOffSince ? Date.parse(vault.legacyOffSince) : Number.NaN;
                 const settled = Number.isFinite(offSince) && now - offSince >= SYNC_CORE_LEGACY_SETTLE_MS;
-                const legacyReady = ctx.legacySyncReadyForCore === true && (!ctx.desktopAppManagesSync || settled);
+                const settleNeeded = ctx.desktopAppManagesSync && !daemonAloneRunsLegacySync(ctx);
+                const legacyReady = ctx.legacySyncReadyForCore === true && (!settleNeeded || settled);
                 const what = vault.kind === "personal" ? "the personal vault" : `the ${vault.slug} vault`;
                 return base(service, {
                     id: syncCoreUnitId(vault.uid),
@@ -232,11 +240,10 @@ function planService(service, ctx) {
                         HQ_STATE_DIR: path.join(ctx.home, ".hq"),
                         HQ_SYNC_ENGINE: "rust-test",
                         HQ_SYNC_MODE: full ? "full" : "readonly",
-                        ...(full ? { HQ_SYNC_FULL_VAULT: "1" } : {}),
-                        HQ_SYNC_PROTOCOL: "1",
+                        ...(full ? { HQ_SYNC_FULL_VAULT: "1", HQ_SYNC_PROTOCOL: "1" } : {}),
                         HQ_SYNC_CORE_RELEASE: vault.release,
                     },
-                    heartbeatTimeoutMs: 180_000,
+                    ...(full ? { heartbeatTimeoutMs: 180_000 } : {}),
                     blocked: firstBlock([
                         [ctx.syncPaused, "sync is paused (run `hq daemon sync resume`)"],
                         [ctx.vaultSync?.allOff === true, "cloud sync is off for every vault on this computer (turn it back on in HQ Settings > Sync)"],
@@ -250,7 +257,28 @@ function planService(service, ctx) {
                     ]),
                 });
             });
-            return [reconcile, ...engines];
+            const manifestScopes = engineOwnedManifestScopes(ctx.vaultSync, ctx.syncCoreVaults);
+            if (manifestScopes.length === 0)
+                return [reconcile, ...engines];
+            const manifest = base(service, {
+                id: SYNC_CORE_MANIFEST_UNIT,
+                description: `uploads a daily sync-audit manifest for ${manifestScopes.map((scope) => scope.kind === "personal" ? "the personal vault" : `the ${scope.slug} vault`).join(", ")}`,
+                kind: "scheduled",
+                intervalSec: SYNC_CORE_MANIFEST_INTERVAL_SEC,
+                initialDelaySec: 300,
+                command: {
+                    type: "hq",
+                    args: ["daemon", "service", "sync-core-manifest", ...(ctx.hqRoot ? ["--hq-root", ctx.hqRoot] : [])],
+                },
+                env: { HQ_NO_UPDATE_CHECK: "1" },
+                backgroundQos: true,
+                blocked: firstBlock([
+                    [ctx.syncPaused, "sync is paused (run `hq daemon sync resume`)"],
+                    [!ctx.hqRoot, NO_HQ_ROOT],
+                    [!ctx.signedIn, NOT_SIGNED_IN],
+                ]),
+            });
+            return [reconcile, ...engines, manifest];
         }
         case "mesh": {
             const args = ["mesh", "daemon", "run", ...(ctx.hqRoot ? ["--hq-root", ctx.hqRoot] : [])];

package/dist/lib/daemon/run.js

@@ -1021,6 +1021,7 @@ export async function runDaemon(opts) {
             syncOwner,
             syncCoreVaults: syncCoreVaultPlans(home, hqRoot, platform),
             desktopAppManagesSync: appManagesSync,
+            legacySyncUnitManagesSync: legacy.some((u) => u.service === "sync" && !u.migratable),
             syncRunnerProcesses,
             syncRunnerOwnerPid,
             daemonSyncRunnerPids,