@indigoai-us/hq-cli 5.345.178 → 5.345.179

package/dist/lib/bot/jobs/hot-signal-sync.js

@@ -0,0 +1,177 @@
+/**
+ * The bot's built-in hot-signal-sync job.
+ *
+ * A local bot that is bound to a company registers one recurring job in its
+ * own `jobs.json` the first time it starts (`ensureHotSignalSyncJob`). The job
+ * fires from the bot's inbox loop like every other local job
+ * (lib/bot/local-jobs.ts): no crontab, launchd or systemd entry is written.
+ * The default schedule is 06:30 daily in the machine's time zone, ahead of a
+ * morning brief; the owner changes it with
+ * `hq bot jobs <bot> --reschedule <jobId> --every "<when>"`, or removes it with
+ * `--rm`, and a removed job is not added back on the next start.
+ *
+ * When the job fires the bot runs the sync in-process, with no model turn
+ * (`runHotSignalSyncJob`): the same hot-channel sync `hq sources sync` runs,
+ * with `trigger: "scheduled"` and `catchUp` set when the run fired late after
+ * a missed window. Catch-up is bounded by each adapter's `catchUpWindow`, and
+ * per-connection cursors keep a redelivered run from landing anything twice.
+ * The claude signals pass (US-011) runs after each adapter when the bot wires
+ * one in; with none the signals count is 0.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { JOB_RUN_OPTIONS_CONTEXT_KEY } from "../job-run.js";
+import { effectiveBotCompanies } from "../config.js";
+import { ensureLocalJob, readLocalJobs, removeLocalJobsWhere, withJobsLock } from "../local-jobs.js";
+export const HOT_SIGNAL_SYNC_JOB_KIND = "hot-signal-sync";
+/**
+ * 06:30 every day, in the job's time zone (the stored EventBridge form of
+ * "30 6 * * *"). Only the first registration uses it; after that the job's
+ * own schedule in `jobs.json` is the one that runs.
+ */
+export const HOT_SIGNAL_SYNC_DEFAULT_CRON = "cron(30 6 * * ? *)";
+/** Which built-in jobs this bot has registered once, so a removed one stays removed. */
+const BUILTIN_JOBS_FILE = "builtin-jobs.json";
+function markerKey(company) {
+    return `${HOT_SIGNAL_SYNC_JOB_KIND}:${company}`;
+}
+function readMarker(dir) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(dir, BUILTIN_JOBS_FILE), "utf-8"));
+        if (parsed && parsed.v === 1 && parsed.registered && typeof parsed.registered === "object") {
+            return { v: 1, registered: { ...parsed.registered } };
+        }
+    }
+    catch {
+        // Missing or unreadable: nothing registered yet.
+    }
+    return { v: 1, registered: {} };
+}
+function writeMarker(dir, marker) {
+    const file = path.join(dir, BUILTIN_JOBS_FILE);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(marker, null, 2) + "\n", { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+/** The private context that marks a job as this built-in, for one company. */
+export function hotSignalSyncJobContext(company) {
+    return { [JOB_RUN_OPTIONS_CONTEXT_KEY]: { builtin: HOT_SIGNAL_SYNC_JOB_KIND, company } };
+}
+/** The company a job item syncs, when its context marks it as this built-in; else null. */
+export function hotSignalSyncJobCompany(context) {
+    if (!context || typeof context !== "object" || Array.isArray(context))
+        return null;
+    const options = context[JOB_RUN_OPTIONS_CONTEXT_KEY];
+    if (!options || typeof options !== "object" || Array.isArray(options))
+        return null;
+    const { builtin, company } = options;
+    if (builtin !== HOT_SIGNAL_SYNC_JOB_KIND)
+        return null;
+    return typeof company === "string" && company.trim() ? company.trim() : null;
+}
+/**
+ * The company a bot's hot-signal-sync job syncs: the bot's own company, else
+ * the first company it serves. Null = none, and no job is registered. There is
+ * no fallback to the HQ's active company: a personal bot syncs a company only
+ * when it was given one explicitly (`--company`), so the job never writes into
+ * a vault the bot does not belong to. Checked again each time the job fires.
+ */
+export function currentHotSignalSyncCompany(config) {
+    return config.companySlug ?? effectiveBotCompanies(config)[0] ?? null;
+}
+/**
+ * Remove every hot-signal-sync job whose company is not `current` (all of them
+ * when `current` is null), and forget their registration so the company can be
+ * registered again if the bot is given it back. Returns the removed jobs.
+ */
+export function removeStaleHotSignalSyncJobs(dir, current) {
+    const removed = removeLocalJobsWhere(dir, (job) => {
+        const company = hotSignalSyncJobCompany(job.context);
+        return company !== null && company !== current;
+    });
+    const keep = current ? markerKey(current) : null;
+    withJobsLock(dir, () => {
+        const marker = readMarker(dir);
+        let changed = false;
+        for (const key of Object.keys(marker.registered)) {
+            if (key.startsWith(HOT_SIGNAL_SYNC_JOB_KIND + ":") && key !== keep) {
+                delete marker.registered[key];
+                changed = true;
+            }
+        }
+        if (changed)
+            writeMarker(dir, marker);
+    });
+    return removed;
+}
+/**
+ * Register the hot-signal-sync job for `company` once. Safe to call on every
+ * bot start: an existing job is left as it is (including a changed schedule),
+ * and a job the owner removed is not added again.
+ */
+export function ensureHotSignalSyncJob(dir, input, now = new Date()) {
+    const key = markerKey(input.company);
+    const matches = (job) => hotSignalSyncJobCompany(job.context) === input.company;
+    if (readMarker(dir).registered[key]) {
+        return { job: readLocalJobs(dir).find(matches) ?? null, created: false };
+    }
+    const { job, created } = ensureLocalJob(dir, matches, {
+        prompt: `Sync hot channels for ${input.company} and run the signals pass (runs in the bot, no model turn).`,
+        cron: HOT_SIGNAL_SYNC_DEFAULT_CRON,
+        timezone: input.timezone,
+        context: hotSignalSyncJobContext(input.company),
+    }, now);
+    withJobsLock(dir, () => {
+        const marker = readMarker(dir);
+        if (!marker.registered[key]) {
+            marker.registered[key] = now.toISOString();
+            writeMarker(dir, marker);
+        }
+    });
+    return { job, created };
+}
+export const noLocalSignalsPass = async () => 0;
+/** Run the scheduled sync once and describe it in plain words. Never throws. */
+export async function runHotSignalSyncJob(input) {
+    const signalsPass = input.signalsPass ?? noLocalSignalsPass;
+    let report;
+    try {
+        report = await input.sync({
+            company: input.company,
+            trigger: "scheduled",
+            catchUp: input.catchUp,
+            signalsGenerated: signalsPass,
+            now: input.now,
+            ...(input.sendAlert
+                ? { signalsAlert: { sendOwnerDm: input.sendAlert, ...(input.log ? { log: input.log } : {}) } }
+                : {}),
+        });
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return { ok: false, text: `The hot-channel sync for ${input.company} failed: ${reason}`, report: null };
+    }
+    return { ok: report.exitCode === 0 && !report.signInRequired, text: describeSyncReport(input.company, report), report };
+}
+export function describeSyncReport(company, report) {
+    if (report.signInRequired) {
+        return `The hot-channel sync for ${company} did not run: ${report.notices.join(" ")}`;
+    }
+    if (report.skipped)
+        return report.notices.join(" ");
+    const landed = report.outcomes.reduce((sum, o) => sum + o.landed, 0);
+    const signals = report.entries.reduce((sum, e) => sum + e.signalsGenerated, 0);
+    const lines = [
+        `Hot-channel sync for ${company}: ${landed} new source${landed === 1 ? "" : "s"}, ${signals} signal${signals === 1 ? "" : "s"}.`,
+    ];
+    for (const outcome of report.outcomes) {
+        if (outcome.status === "ok")
+            continue;
+        const label = outcome.appName ?? outcome.adapter;
+        lines.push(`- ${label}: ${outcome.reconnect?.prompt ?? outcome.message ?? outcome.status}`);
+    }
+    for (const notice of report.notices)
+        lines.push(notice);
+    return lines.join("\n");
+}
+//# sourceMappingURL=hot-signal-sync.js.map

package/dist/lib/bot/local-jobs.d.ts

@@ -18,7 +18,7 @@
  * - A fire is recorded before it is handed over, so a crash never runs the
  *   same due time twice.
  */
-import { type BotApi, type InboxItem } from "./api.js";
+import { type BotApi, type BotJobRecord, type InboxItem } from "./api.js";
 export interface LocalJob {
     jobId: string;
     prompt: string;
@@ -27,6 +27,12 @@ export interface LocalJob {
     timezone: string;
     context?: Record<string, unknown>;
     createdAt: string;
+    /**
+     * When the schedule was last changed (`hq bot jobs --reschedule`). Fire
+     * times before it are never treated as missed, so a new schedule does not
+     * fire a catch-up for a time that only matches the new expression.
+     */
+    scheduledFrom?: string;
     /** The newest due time already handed to the bot. */
     lastFiredAt?: string;
     /** The run in progress, if any. */
@@ -72,6 +78,29 @@ export declare function addLocalJob(dir: string, input: {
     timezone: string;
     context?: Record<string, unknown>;
 }, now?: Date): LocalJob;
+/**
+ * Add a job unless one already matches, as one locked read-and-write, so two
+ * bot starts racing each other still leave a single job.
+ */
+export declare function ensureLocalJob(dir: string, matches: (job: LocalJob) => boolean, input: {
+    prompt: string;
+    cron: string;
+    timezone: string;
+    context?: Record<string, unknown>;
+}, now?: Date): {
+    job: LocalJob;
+    created: boolean;
+};
+/**
+ * Change a job's schedule in place, keeping its id, instruction, context and
+ * run history. Returns null when the bot has no job with that id.
+ */
+export declare function rescheduleLocalJob(dir: string, jobId: string, schedule: {
+    cron: string;
+    timezone: string;
+}, now?: Date): LocalJob | null;
+/** Remove every job `matches` picks, as one locked read-and-write. Returns the removed jobs. */
+export declare function removeLocalJobsWhere(dir: string, matches: (job: LocalJob) => boolean): LocalJob[];
 /** Forget the once-per-minute check (tests, and a bot restarted in-process). */
 export declare function resetLocalJobChecks(): void;
 export declare function takeDueLocalJobRuns(dir: string, now?: Date): InboxItem[];
@@ -81,9 +110,16 @@ export declare function takeDueLocalJobRuns(dir: string, now?: Date): InboxItem[
  * locally instead of being sent to the cloud.
  */
 export declare function withLocalJobs(api: BotApi, dir: string, clock?: () => Date): BotApi;
+/** What `hq bot jobs` uses: list, add, remove, and (local bots) reschedule. */
+export type LocalJobsApi = Pick<BotApi, "listJobs" | "createJob" | "cancelJob"> & {
+    rescheduleJob?(agentUid: string, jobId: string, schedule: {
+        cron: string;
+        timezone: string;
+    }): Promise<BotJobRecord>;
+};
 /**
- * `hq bot jobs` against the bot's own folder: the same three calls the cloud
- * client offers, answered from `jobs.json`.
+ * `hq bot jobs` against the bot's own folder: the same calls the cloud client
+ * offers, plus reschedule, answered from `jobs.json`.
  */
-export declare function localJobsClient(dir: string, clock?: () => Date): Pick<BotApi, "listJobs" | "createJob" | "cancelJob">;
+export declare function localJobsClient(dir: string, clock?: () => Date): Required<LocalJobsApi>;
 //# sourceMappingURL=local-jobs.d.ts.map

package/dist/lib/bot/local-jobs.js

@@ -237,10 +237,14 @@ function rateIntervalMs(expr) {
 function isRunnableSchedule(expr) {
     return rateIntervalMs(expr) !== null || parseCron(expr) !== null;
 }
+/** Where the current schedule starts counting: its last change, else creation. */
+function scheduleOrigin(job) {
+    return Date.parse(job.scheduledFrom ?? job.createdAt);
+}
 export function latestDueFire(job, now) {
     const interval = rateIntervalMs(job.cron);
     if (interval) {
-        const origin = Date.parse(job.createdAt);
+        const origin = scheduleOrigin(job);
         const steps = Math.floor((now.getTime() - origin) / interval);
         if (steps < 1)
             return null;
@@ -252,7 +256,7 @@ export function latestDueFire(job, now) {
         return null;
     const start = new Date(now);
     start.setUTCSeconds(0, 0);
-    const floor = Math.max(job.lastFiredAt ? Date.parse(job.lastFiredAt) : Date.parse(job.createdAt), start.getTime() - LOOKBACK_MINUTES * 60_000);
+    const floor = Math.max(job.lastFiredAt ? Date.parse(job.lastFiredAt) : Date.parse(job.createdAt), job.scheduledFrom ? Date.parse(job.scheduledFrom) : 0, start.getTime() - LOOKBACK_MINUTES * 60_000);
     for (let t = start.getTime(); t > floor; t -= 60_000) {
         const at = new Date(t);
         if (cronMatches(cron, at, job.timezone))
@@ -264,7 +268,7 @@ export function latestDueFire(job, now) {
 export function nextDueFire(job, now) {
     const interval = rateIntervalMs(job.cron);
     if (interval) {
-        const origin = Date.parse(job.createdAt);
+        const origin = scheduleOrigin(job);
         const steps = Math.max(0, Math.floor((now.getTime() - origin) / interval)) + 1;
         return new Date(origin + steps * interval);
     }
@@ -310,6 +314,53 @@ export function addLocalJob(dir, input, now = new Date()) {
     withJobsLock(dir, () => writeLocalJobs(dir, [...readLocalJobs(dir), job]));
     return job;
 }
+/**
+ * Add a job unless one already matches, as one locked read-and-write, so two
+ * bot starts racing each other still leave a single job.
+ */
+export function ensureLocalJob(dir, matches, input, now = new Date()) {
+    if (!isRunnableSchedule(input.cron))
+        throw new Error(`"${input.cron}" is not a schedule this bot can run.`);
+    return withJobsLock(dir, () => {
+        const jobs = readLocalJobs(dir);
+        const existing = jobs.find(matches);
+        if (existing)
+            return { job: existing, created: false };
+        const job = {
+            jobId: `job_${randomUUID().replace(/-/g, "").slice(0, 20)}`,
+            prompt: input.prompt,
+            cron: input.cron,
+            timezone: input.timezone,
+            ...(input.context ? { context: input.context } : {}),
+            createdAt: now.toISOString(),
+        };
+        writeLocalJobs(dir, [...jobs, job]);
+        return { job, created: true };
+    });
+}
+/**
+ * Change a job's schedule in place, keeping its id, instruction, context and
+ * run history. Returns null when the bot has no job with that id.
+ */
+export function rescheduleLocalJob(dir, jobId, schedule, now = new Date()) {
+    if (!isRunnableSchedule(schedule.cron))
+        throw new Error(`"${schedule.cron}" is not a schedule this bot can run.`);
+    return withJobsLock(dir, () => {
+        const jobs = readLocalJobs(dir);
+        const index = jobs.findIndex((job) => job.jobId === jobId);
+        if (index < 0)
+            return null;
+        const updated = {
+            ...jobs[index],
+            cron: schedule.cron,
+            timezone: schedule.timezone,
+            scheduledFrom: now.toISOString(),
+        };
+        jobs[index] = updated;
+        writeLocalJobs(dir, jobs);
+        return updated;
+    });
+}
 /** Remove a job. Returns false when the bot has no job with that id. */
 function removeLocalJob(dir, jobId) {
     return withJobsLock(dir, () => {
@@ -321,6 +372,16 @@ function removeLocalJob(dir, jobId) {
         return true;
     });
 }
+/** Remove every job `matches` picks, as one locked read-and-write. Returns the removed jobs. */
+export function removeLocalJobsWhere(dir, matches) {
+    return withJobsLock(dir, () => {
+        const jobs = readLocalJobs(dir);
+        const removed = jobs.filter(matches);
+        if (removed.length > 0)
+            writeLocalJobs(dir, jobs.filter((job) => !matches(job)));
+        return removed;
+    });
+}
 // ─── Firing ──────────────────────────────────────────────────────────────────
 /**
  * Hand over every job that is due now. Each fire is recorded (lastFiredAt and
@@ -430,8 +491,8 @@ export function withLocalJobs(api, dir, clock = () => new Date()) {
 /** The most jobs one bot may hold (the same cap the cloud uses). */
 const MAX_LOCAL_JOBS = 25;
 /**
- * `hq bot jobs` against the bot's own folder: the same three calls the cloud
- * client offers, answered from `jobs.json`.
+ * `hq bot jobs` against the bot's own folder: the same calls the cloud client
+ * offers, plus reschedule, answered from `jobs.json`.
  */
 export function localJobsClient(dir, clock = () => new Date()) {
     return {
@@ -454,6 +515,12 @@ export function localJobsClient(dir, clock = () => new Date()) {
                 throw new BotApiError(404, "local jobs", "JOB_NOT_FOUND", `Job '${jobId}' not found`);
             }
         },
+        async rescheduleJob(_agentUid, jobId, schedule) {
+            const job = rescheduleLocalJob(dir, jobId, schedule, clock());
+            if (!job)
+                throw new BotApiError(404, "local jobs", "JOB_NOT_FOUND", `Job '${jobId}' not found`);
+            return toJobRecord(job, clock());
+        },
     };
 }
 //# sourceMappingURL=local-jobs.js.map

package/dist/lib/bot/run.d.ts

@@ -134,6 +134,21 @@ export interface BotRunDeps {
     inboxPollBackoffEnabled?: () => Promise<boolean>;
     /** Default-off gate for the per-job quiet-success option. */
     jobQuietOptionEnabled?: () => boolean | Promise<boolean>;
+    /**
+     * The built-in hot-signal-sync job (jobs/hot-signal-sync.ts), run in-process
+     * with no model turn. Unset = a fired run of that job fails with a plain
+     * report instead of handing the instruction to the model.
+     */
+    hotSignalSync?: (input: {
+        company: string;
+        catchUp: boolean;
+        now: () => Date;
+        /** The signals-failure alert to the owner, sent even when the job is quiet (US-012). */
+        sendAlert: (text: string) => Promise<void>;
+    }) => Promise<{
+        ok: boolean;
+        text: string;
+    }>;
     heartbeatIntervalMs?: number;
     /** Override the rendered system prompt (tests). */
     systemPromptOverride?: string;

package/dist/lib/bot/run.js

@@ -82,6 +82,7 @@ import { isAgentSender, isDmItem, isMetaNonReply, resolveReplyTarget } from "./r
 import { resolveRoomMentionsForBot, roomPostHasMentionTokens, } from "./room-mentions.js";
 import { buildJobTurnPrompt, isCatchUpRun, isJobItem, jobReportHeader, jobRunOutput, machineTimeZone, planJobRuns, stripJobHeader, SUPERSEDED_DISPOSITION } from "./job-run.js";
 import { botJobQuietOptionEnabled } from "./job-quiet-flag.js";
+import { currentHotSignalSyncCompany, hotSignalSyncJobCompany, removeStaleHotSignalSyncJobs } from "./jobs/hot-signal-sync.js";
 import { clearPendingJobCompletion, isCompletionDue, isCompletionExpired, isCompletionForOtherAgent, readPendingJobCompletions, recordPendingJobCompletion } from "./job-completions.js";
 import { SIGN_IN_CHECK_FRESH_MS, SIGN_IN_CHECK_MS, SIGN_IN_RETRY_MS, signInNeededText, signedOutExcerpt, } from "./runtime-sign-in.js";
 import { checkRuntimeSignIn } from "./runtime-sign-in-check.js";
@@ -1932,6 +1933,66 @@ export async function runBot(deps) {
         const markReported = (status) => {
             patchInflight(dir, id, { jobCompleted: status });
         };
+        // The built-in hot-signal-sync job runs here, in the bot, with no model
+        // turn. It is marked processed as soon as the sync finishes, so a report
+        // that fails to post (or a redelivered item) never syncs a second time.
+        const syncCompany = hotSignalSyncJobCompany(job.context);
+        if (syncCompany) {
+            // The job's stored company is checked against the bot's current config
+            // (read fresh from disk) every time it fires. A company the bot no longer
+            // serves is never synced: the run is skipped and the job removed.
+            const currentCompany = currentHotSignalSyncCompany(readBotConfig(dir) ?? config);
+            if (currentCompany !== syncCompany) {
+                let removedNote = "";
+                try {
+                    removeStaleHotSignalSyncJobs(dir, currentCompany);
+                    removedNote = ` Removed job ${jobId}.`;
+                }
+                catch (err) {
+                    removedNote = ` Could not remove job ${jobId}: ${err instanceof Error ? err.message : String(err)}`;
+                }
+                const text = `Skipped the hot-channel sync for ${syncCompany}: this bot no longer syncs that company (current: ${currentCompany ?? "none"}). Nothing was written.${removedNote}`;
+                markProcessed(dir, id, now().toISOString());
+                try {
+                    await sendToPerson(text);
+                }
+                catch (err) {
+                    log("warn", `report for run ${id} of job ${jobId} was not delivered: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                await completeJobRun(jobId, id, { status: "skipped-precondition", output: jobRunOutput(text) });
+                markReported("skipped-precondition");
+                await api.ackInbox(config.agentUid, id);
+                clearInflight(dir, id);
+                attempts.delete(id);
+                setStatus({ lastActivityAt: now().toISOString() });
+                log("info", `hot-signal-sync job ${jobId} run ${id} skipped: company ${syncCompany} no longer served (current: ${currentCompany ?? "none"})`);
+                return;
+            }
+            const result = deps.hotSignalSync
+                ? await deps.hotSignalSync({ company: syncCompany, catchUp, now, sendAlert: (text) => sendToPerson(text) })
+                : { ok: false, text: `This bot cannot run the hot-channel sync for ${syncCompany}.` };
+            markProcessed(dir, id, now().toISOString());
+            const status = result.ok ? "succeeded" : "failed";
+            if (!(quietJob && result.ok)) {
+                try {
+                    await sendToPerson(result.text);
+                }
+                catch (err) {
+                    log("warn", `report for run ${id} of job ${jobId} was not delivered: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            await completeJobRun(jobId, id, { status, output: jobRunOutput(result.text) });
+            markReported(status);
+            await api.ackInbox(config.agentUid, id);
+            clearInflight(dir, id);
+            attempts.delete(id);
+            setStatus({
+                ...(!(quietJob && result.ok) ? { repliesSent: (readStatus()?.repliesSent ?? 0) + 1 } : {}),
+                lastActivityAt: now().toISOString(),
+            });
+            log("info", `hot-signal-sync job ${jobId} run ${id} ${status} for ${syncCompany}${catchUp ? " (catch-up)" : ""}`);
+            return;
+        }
         const { outcome, poster } = await runTurnWithProgress({
             marker: { messageId: id, target: markerTarget, jobId, jobHeader: header, agentUid: config.agentUid },
             prompt: buildJobTurnPrompt(job, { now: now(), timeZone }),

package/dist/lib/daemon/handoff.d.ts

@@ -32,7 +32,11 @@ export interface DaemonUnitHost {
     platform: NodeJS.Platform;
     home: string;
     systemUnitDir?: string;
+    /** This user's own Scheduled Task name (daemonWindowsTaskName); another user's task on the PC does not count. */
+    windowsTaskName: string;
     windowsTaskExists: (task: string) => boolean;
+    /** The shared task an older install registered runs as this user (it still counts until install moves it). */
+    windowsLegacyTaskIsMine?: () => boolean;
 }
 /** The `hq daemon` OS unit is installed on this machine (for this user, or as the box's system unit). */
 export declare function daemonUnitInstalled(host: DaemonUnitHost): boolean;

package/dist/lib/daemon/handoff.js

@@ -10,7 +10,8 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { DEFAULT_SERVICES, enabledServices, isServiceName } from "./catalog.js";
 import { readDaemonConfig, writeDaemonConfig } from "./config.js";
-import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK, SYSTEM_UNIT_DIR } from "./install.js";
+import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, SYSTEM_UNIT_DIR, currentWindowsIdentity, legacyWindowsTask, windowsTaskName } from "./install.js";
+import { defaultRunCommand } from "../service-manager/launchd.js";
 import { isDaemonProcess, runningDaemonPid } from "./lock.js";
 import { detectMachineType } from "./machine-type.js";
 import { daemonPaths } from "./paths.js";
@@ -96,7 +97,7 @@ export function daemonUnitInstalled(host) {
         case "darwin":
             return fs.existsSync(path.join(host.home, "Library", "LaunchAgents", `${DAEMON_LAUNCHD_LABEL}.plist`));
         case "win32":
-            return host.windowsTaskExists(DAEMON_WINDOWS_TASK);
+            return host.windowsTaskExists(host.windowsTaskName) || (host.windowsLegacyTaskIsMine?.() ?? false);
         default:
             return (fs.existsSync(path.join(host.home, ".config", "systemd", "user", DAEMON_SYSTEMD_UNIT)) ||
                 fs.existsSync(path.join(host.systemUnitDir ?? SYSTEM_UNIT_DIR, DAEMON_SYSTEMD_UNIT)));
@@ -142,9 +143,12 @@ export function handOffInstallHere(services, env = process.env, opts = {}) {
     if (opts.ifStale && services.every((service) => config.disable.includes(service))) {
         return `hq daemon has ${services.join(", ")} disabled, so the older service will not be installed.`;
     }
+    const identity = process.platform === "win32" ? currentWindowsIdentity() : undefined;
     const installed = daemonUnitInstalled({
         platform: process.platform,
         home,
+        windowsTaskName: identity ? windowsTaskName(identity) : "",
+        windowsLegacyTaskIsMine: () => identity !== undefined && legacyWindowsTask(defaultRunCommand, identity).state === "mine",
         windowsTaskExists: (task) => spawnSync("schtasks.exe", ["/Query", "/TN", task], { encoding: "utf8", windowsHide: true }).status === 0,
     }) || hostedDaemonRunning(paths);
     if (!installed) {

package/dist/lib/daemon/install.d.ts

@@ -7,7 +7,7 @@
  * - Linux, per-user: systemd user unit hq-daemon.service
  * - Linux, system (outposts and agent boxes): /etc/systemd/system/hq-daemon.service
  *   running as the box's login user; needs root
- * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon
+ * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon-<user SID>
  * - anything else: no unit; the caller prints the command to run
  *
  * The unit never names services. `hq daemon run` reads the machine type and
@@ -20,8 +20,34 @@ import { type PidLockRecord } from "../mesh/live/daemon/pid-lock.js";
 import type { MachineType } from "./machine-type.js";
 export declare const DAEMON_LAUNCHD_LABEL = "ai.getindigo.hq-daemon";
 export declare const DAEMON_SYSTEMD_UNIT = "hq-daemon.service";
-export declare const DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
+/**
+ * The one machine-wide task name older installs registered on Windows. Two
+ * users on one PC overwrote each other's daemon under it, so each user now
+ * gets their own name (daemonWindowsTaskName). Install moves the current
+ * user's task off this name; another user's task under it is left alone.
+ */
+export declare const LEGACY_DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
 export declare const SYSTEM_UNIT_DIR = "/etc/systemd/system";
+/**
+ * The Windows task name for one user: the shared prefix plus the user's SID,
+ * or the `DOMAIN\user` name with characters a task name cannot hold replaced
+ * when the SID could not be read. Never the bare legacy name.
+ */
+export declare function daemonWindowsTaskName(who: {
+    sid?: string;
+    user: string;
+}): string;
+/** The current Windows user's SID from `whoami /user`, or undefined when it cannot be read. */
+export declare function readWindowsSid(run: RunCommand): string | undefined;
+/** The per-user task name for the user running this process. */
+export declare function currentDaemonWindowsTaskName(run: RunCommand, user: string): string;
+/**
+ * `DOMAIN\user` for the current account. Same answer as the mesh installer's
+ * resolveWindowsUser, kept here so lookups do not load the mesh installer.
+ */
+export declare function currentWindowsUser(env?: NodeJS.ProcessEnv): string;
+/** The current user as a DaemonHost names them on Windows. */
+export declare function currentWindowsIdentity(run?: RunCommand, env?: NodeJS.ProcessEnv): Pick<DaemonHost, "windowsSid" | "windowsUser">;
 export type InstallScope = "user" | "system";
 export interface DaemonHost {
     platform: NodeJS.Platform;
@@ -34,6 +60,8 @@ export interface DaemonHost {
     isRoot: boolean;
     /** `DOMAIN\user` the Windows task runs as. */
     windowsUser: string;
+    /** That user's SID, when `whoami /user` could read it. Names the per-user task. */
+    windowsSid?: string;
     /** conhost.exe path when `--headless` is supported, else undefined. */
     windowsHeadlessLauncher: string | undefined;
     /** Where system units are written (tests point this at a temp dir). */
@@ -70,6 +98,8 @@ export interface DaemonUnitResult {
     startPending?: true;
     /** Windows: an older daemon may still be running; HQ could not verify it, so did not stop it. */
     warning?: string;
+    /** Windows: what happened to the shared task from an older install, when there is one. */
+    notice?: string;
 }
 export interface InstallDeps {
     run: RunCommand;
@@ -93,6 +123,43 @@ export declare function daemonRootRefusal(isRoot: boolean, machineType: MachineT
 /** Boxes run the daemon as a system unit; everything else per user. */
 export declare function installScopeFor(machineType: MachineType): InstallScope;
 export declare function planDaemonUnit(host: DaemonHost, options: InstallOptions): DaemonUnitPlan;
+/**
+ * The registered per-user task names for `host`: the current name, and the
+ * user-name form an install used when it could not read the SID. The fallback
+ * name is only returned when its principal is this user.
+ */
+export declare function windowsUserTaskNames(run: RunCommand, host: Pick<DaemonHost, "windowsSid" | "windowsUser">): string[];
+/** The per-user task name for `host`. */
+export declare function windowsTaskName(host: Pick<DaemonHost, "windowsSid" | "windowsUser">): string;
+/**
+ * Whether two Windows account names are the same user, ignoring case. Both
+ * names must have the same form: `DOMAIN\user` matches only the same
+ * `DOMAIN\user`, and a bare `user` only the same bare `user`. A bare name is
+ * never matched against a domain name, because `bob` could be `PC\bob` or
+ * `CORP\bob`, and a wrong match would end and delete another user's task.
+ */
+export declare function sameWindowsUser(a: string, b: string): boolean;
+/**
+ * The shared task an older install registered, and whose it is. "mine" means
+ * its principal is the current user, so HQ may move it. "other" means another
+ * user's, or a principal HQ cannot match to the current user; "unreadable"
+ * means schtasks refused to show it. Both are left alone.
+ */
+export type LegacyWindowsTask = {
+    state: "none";
+} | {
+    state: "mine";
+    owner: string;
+} | {
+    state: "other";
+    owner: string;
+} | {
+    state: "unreadable";
+    reason: string;
+};
+export declare function legacyWindowsTask(run: RunCommand, host: Pick<DaemonHost, "windowsSid" | "windowsUser">): LegacyWindowsTask;
+/** Whose task `task` is, read from `schtasks /Query /XML`. */
+export declare function classifyWindowsTask(run: RunCommand, task: string, host: Pick<DaemonHost, "windowsSid" | "windowsUser">): LegacyWindowsTask;
 /** What to tell the user when HQ did not stop pid `pid` because it could not verify it. */
 export declare function oldDaemonWarning(pid: number, reason: string): string;
 export declare function installDaemonUnit(host: DaemonHost, options: InstallOptions, deps: InstallDeps): DaemonUnitResult;
@@ -127,5 +194,6 @@ export declare function uninstallDaemonUnit(host: DaemonHost, options: InstallOp
     unitPath: string;
     removed: boolean;
     warning?: string;
+    notice?: string;
 };
 //# sourceMappingURL=install.d.ts.map