@indigoai-us/hq-cli 5.345.178 → 5.345.180

package/dist/lib/daemon/run.js

@@ -23,6 +23,7 @@ import { botsRoot } from "../bot/paths.js";
 import { CLAUDE_RUNNER_SCRIPT, CODEX_RUNNER_SCRIPT, enabledServices, planUnits } from "./catalog.js";
 import { effectiveSyncOwner, readDaemonConfig } from "./config.js";
 import { inspectEngineHome } from "../sync-core/engine-home.js";
+import { fullModeHold } from "../sync-core/reconcile.js";
 import { readSyncCoreRolloutState } from "../sync-core/rollout-state.js";
 import { assertPersonalServiceSessionCapability, readRemoteControlPoolsConfig, remoteControlPoolSecretsEnv, } from "./remote-control-pools.js";
 import { loadLanesConfig } from "../lanes/config.js";
@@ -32,16 +33,16 @@ import { SUPERVISOR_HANDOFF_FLAG, readDaemonFlag } from "./flag.js";
 import { createBoundedDaemonFlagMonitor } from "./flag-monitor.js";
 import { DAEMON_CHILD_BOOTSTRAP_HANDOFF_WATCH_FLAG, DAEMON_LANES_RECONCILE_FILE_WATCH_FLAG, DAEMON_SEARCH_INDEX_RUNNER_OWNS_INDEX_FLAG, DAEMON_SYNC_PROCESS_SCAN_ON_MISSING_FLAG, } from "./kill-switch-flags.js";
 import { createLanesReconcileWatcher } from "./lanes-reconcile-watcher.js";
-import { findLegacyUnits, legacyMeshUnitsToRetire, legacyOwnerLookup } from "./legacy.js";
+import { findLegacyUnits, legacyMeshUnitsToRetire, legacyOwnerLookup, } from "./legacy.js";
 import { readLegacySyncEnv } from "./legacy-sync-env.js";
-import { readVaultSyncSwitches, unreadableSwitchesWarning } from "../vault-sync-switches.js";
+import { readVaultSyncSwitches, unreadableSwitchesWarning, writeVaultSyncSwitches } from "../vault-sync-switches.js";
 import { acquireDaemonLock, isProcessAlive, processCommandLine, releaseDaemonLock } from "./lock.js";
 import { retireLegacyMeshUnits } from "./migrate.js";
 import { daemonDir as meshDaemonDir, daemonPidPath as meshDaemonPidPath } from "../mesh/live/daemon/paths.js";
 import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
 import { registryDir, registryFile } from "../registry/registry.js";
 import { updateAnywhereRuntimeRevocationMarker } from "../anywhere-runtime-revocation-marker.js";
-import { daemonRootRefusal } from "./install.js";
+import { classifyWindowsTask, currentWindowsIdentity, daemonRootRefusal } from "./install.js";
 import { detectMachineType } from "./machine-type.js";
 import { appendPrivate, daemonPaths, ensurePrivateDir, openPrivateAppend } from "./paths.js";
 import { hqdSocketPath } from "./protocol.js";
@@ -65,24 +66,29 @@ export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 export const RESTART_EXIT_CODE = 75;
 const NON_SYNC_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + 5_000;
 const SYNC_RUNNER_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + SYNC_RUNNER_PERSIST_GRACE_MS + 5_000;
-function syncCoreVaultPlans(home, hqRoot, platform) {
+export function syncCoreVaultPlans(home, hqRoot, platform) {
     const state = readSyncCoreRolloutState(home);
     if (!state)
         return [];
-    return state.vaults.map((vault) => inspectEngineHome(home, hqRoot, {
-        uid: vault.uid,
-        kind: vault.kind,
-        ...(vault.slug ? { slug: vault.slug } : {}),
-        phase: vault.phase,
-        engineHome: vault.engineHome,
-        binaryPath: state.binaryPath,
-        release: state.release,
-        ...(vault.legacyOffSince ? { legacyOffSince: vault.legacyOffSince } : {}),
-    }, platform));
+    return state.vaults.map((vault) => {
+        const plan = inspectEngineHome(home, hqRoot, {
+            uid: vault.uid,
+            kind: vault.kind,
+            ...(vault.slug ? { slug: vault.slug } : {}),
+            phase: vault.phase,
+            engineHome: vault.engineHome,
+            binaryPath: state.binaryPath,
+            release: state.release,
+            ...(vault.legacyOffSince ? { legacyOffSince: vault.legacyOffSince } : {}),
+        }, platform);
+        const releaseHold = vault.phase === "full" ? fullModeHold(vault, state.release) : undefined;
+        return releaseHold ? { ...plan, blockedReason: releaseHold } : plan;
+    });
 }
 const rememberedSyncCoreVaults = new Map();
 export function planUnitsWithSyncCoreInterlock(services, context, supervisor) {
     const companies = new Set();
+    const runningVaults = new Set();
     let personal = false;
     for (const vault of context.syncCoreVaults ?? []) {
         rememberedSyncCoreVaults.set(vault.uid, { kind: vault.kind, slug: vault.slug, full: vault.phase === "full" });
@@ -90,7 +96,9 @@ export function planUnitsWithSyncCoreInterlock(services, context, supervisor) {
     for (const unit of supervisor?.state().units ?? []) {
         if (!unit.id.startsWith("sync-core:") || supervisor?.runningPlanKey(unit.id) === undefined)
             continue;
-        const vault = rememberedSyncCoreVaults.get(unit.id.slice("sync-core:".length));
+        const uid = unit.id.slice("sync-core:".length);
+        runningVaults.add(uid);
+        const vault = rememberedSyncCoreVaults.get(uid);
         if (!vault?.full)
             continue;
         if (vault.kind === "personal")
@@ -98,13 +106,53 @@ export function planUnitsWithSyncCoreInterlock(services, context, supervisor) {
         else if (vault.slug)
             companies.add(vault.slug);
     }
-    const transitionContext = {
+    let vaultSync = context.vaultSync;
+    let fallbackPersistenceFailed = false;
+    if (context.vaultSync && !context.vaultSync.allOff) {
+        let personalOff = context.vaultSync.personalOff;
+        const offCompanies = new Set(context.vaultSync.offCompanies);
+        let restorePersonal = false;
+        const restoreCompanies = {};
+        for (const vault of context.syncCoreVaults ?? []) {
+            if (vault.phase !== "full" || runningVaults.has(vault.uid) || !fullModeHold(vault, vault.release))
+                continue;
+            if (vault.kind === "personal") {
+                restorePersonal = personalOff;
+                personalOff = false;
+            }
+            else if (vault.slug) {
+                if (offCompanies.has(vault.slug))
+                    restoreCompanies[vault.slug] = true;
+                offCompanies.delete(vault.slug);
+            }
+        }
+        if (restorePersonal || Object.keys(restoreCompanies).length > 0) {
+            try {
+                writeVaultSyncSwitches(context.home, {
+                    ...(restorePersonal ? { personal: true } : {}),
+                    companies: restoreCompanies,
+                });
+            }
+            catch {
+                fallbackPersistenceFailed = true;
+            }
+        }
+        vaultSync = { ...context.vaultSync, personalOff, offCompanies };
+    }
+    let transitionContext = {
         ...context,
+        vaultSync,
         syncCoreRunning: { personal, companies },
         legacySyncReadyForCore: false,
     };
-    const waiting = planUnits(services, transitionContext);
-    const legacy = waiting.find((unit) => unit.id === "sync");
+    let waiting = planUnits(services, transitionContext);
+    let legacy = waiting.find((unit) => unit.id === "sync");
+    if (fallbackPersistenceFailed && (legacy === undefined || legacy.blocked !== undefined)) {
+        vaultSync = context.vaultSync;
+        transitionContext = { ...transitionContext, vaultSync };
+        waiting = planUnits(services, transitionContext);
+        legacy = waiting.find((unit) => unit.id === "sync");
+    }
     const legacySyncReadyForCore = legacy !== undefined
         && (legacy.blocked !== undefined || supervisor?.runningPlanKey("sync") === planKey(legacy, CLI_VERSION));
     return planUnits(services, { ...transitionContext, legacySyncReadyForCore });
@@ -310,9 +358,13 @@ export function listLocalBots(root = botsRoot()) {
         .map((d) => d.name)
         .sort();
 }
-export function windowsTaskExists(taskName) {
-    const r = spawnSync("schtasks.exe", ["/Query", "/TN", taskName], { encoding: "utf8", windowsHide: true });
-    return r.status === 0;
+/** Whose task `taskName` is: only the current user's own task may be taken over. */
+export function windowsTaskOwner(taskName) {
+    const run = (cmd, args) => {
+        const r = spawnSync(cmd, args, { encoding: "utf8", windowsHide: true });
+        return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+    };
+    return classifyWindowsTask(run, taskName, currentWindowsIdentity(run)).state;
 }
 export function probeLegacyUnits(platform, home) {
     return findLegacyUnits({
@@ -331,7 +383,7 @@ export function probeLegacyUnits(platform, home) {
             });
             return result.status === 0;
         },
-        windowsTaskExists,
+        windowsTaskOwner,
     });
 }
 /** Absolute path of `name` on PATH, or null. */

package/dist/lib/doctor/checks/anywhere.d.ts

@@ -9,6 +9,8 @@
  * on this machine the family reports a single NA line.
  */
 import { type HqdHealthResult } from "../../daemon/protocol.js";
+import { type DaemonHost } from "../../daemon/install.js";
+import type { RunCommand } from "../../service-manager/launchd.js";
 import type { CheckFamily } from "../types.js";
 export declare const REMEDIATION: {
     readonly installClaude: "hq install --global --runtime claude";
@@ -31,6 +33,10 @@ export interface DaemonServiceProbeOptions {
     launchdProbe?: (target: string) => boolean;
     /** Test seam for the desktop app's live managed daemon state. */
     hostedDaemonProbe?: () => boolean;
+    /** Test seam for the schtasks calls the Windows probe makes. */
+    run?: RunCommand;
+    /** Test seam for the Windows account the task name is built from. */
+    windowsIdentity?: Pick<DaemonHost, "windowsSid" | "windowsUser">;
 }
 export interface AnywhereDeps {
     home?: string;

package/dist/lib/doctor/checks/anywhere.js

@@ -20,7 +20,7 @@ import { CHATGPT_MODE } from "../../install/chatgpt-targets.js";
 import { GROK_MODE } from "../../install/grok-targets.js";
 import { HqdClientError, hqdRequest } from "../../daemon/protocol.js";
 import { daemonPresenceLabel, heartbeatFile, readHeartbeat } from "../../daemon/heartbeat.js";
-import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK } from "../../daemon/install.js";
+import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, LEGACY_DAEMON_WINDOWS_TASK, currentWindowsIdentity, legacyWindowsTask, windowsTaskName, } from "../../daemon/install.js";
 import { hostedDaemonRunning } from "../../daemon/handoff.js";
 import { daemonPaths } from "../../daemon/paths.js";
 import { runningDaemonPid } from "../../daemon/lock.js";
@@ -40,6 +40,15 @@ export const REMEDIATION = {
     daemonStatus: "hq daemon status",
     link: "hq link <repo-dir> <company>",
 };
+/** schtasks with the same 5s cap the probe always had, so a hung query cannot stall the doctor. */
+const runSchtasksWithTimeout = (cmd, args) => {
+    const r = spawnSync(cmd, args, { encoding: "utf8", timeout: 5_000, windowsHide: true });
+    return {
+        status: r.status,
+        stdout: typeof r.stdout === "string" ? r.stdout : "",
+        stderr: r.error ? r.error.message : (typeof r.stderr === "string" ? r.stderr : ""),
+    };
+};
 export function createAnywhereFamily(deps = {}) {
     return { id: ANYWHERE_FAMILY_ID, title: "HQ anywhere runtime", run: (context) => runAnywhereChecks(context, deps) };
 }
@@ -451,11 +460,31 @@ export function defaultServiceState(home, options = {}) {
         return { installed: true, loaded: probe.status === 0, detail: `systemd ${systemScope ? "system" : "user"} ${DAEMON_SYSTEMD_UNIT}` };
     }
     if (platform === "win32") {
-        const probe = spawnSync("schtasks.exe", ["/Query", "/TN", DAEMON_WINDOWS_TASK, "/FO", "CSV", "/NH"], { encoding: "utf8", timeout: 5_000 });
-        if (probe.status !== 0)
-            return { installed: false, loaded: false, detail: `no Scheduled Task ${DAEMON_WINDOWS_TASK}` };
-        const loaded = /,\s*"?Running"?\s*$/i.test(probe.stdout.trim());
-        return { installed: true, loaded, detail: `Scheduled Task ${DAEMON_WINDOWS_TASK}${loaded ? " is running" : " is not running"}` };
+        // Each Windows user has their own task. The shared task an older install
+        // registered counts only when it runs as this user.
+        const run = options.run ?? runSchtasksWithTimeout;
+        const identity = options.windowsIdentity ?? currentWindowsIdentity(run);
+        const task = windowsTaskName(identity);
+        const probe = run("schtasks.exe", ["/Query", "/TN", task, "/FO", "CSV", "/NH"]);
+        if (probe.status !== 0) {
+            const legacy = legacyWindowsTask(run, identity);
+            if (legacy.state === "mine") {
+                // Still this user's daemon until install moves it to the per-user name.
+                const legacyProbe = run("schtasks.exe", ["/Query", "/TN", LEGACY_DAEMON_WINDOWS_TASK, "/FO", "CSV", "/NH"]);
+                const legacyLoaded = legacyProbe.status === 0 && /,\s*"?Running"?\s*$/i.test(legacyProbe.stdout.replace(/\0/g, "").trim());
+                return {
+                    installed: true,
+                    loaded: legacyLoaded,
+                    detail: `your daemon runs from the shared task ${LEGACY_DAEMON_WINDOWS_TASK} from an older install${legacyLoaded ? " (running)" : " (not running)"}. Run hq daemon install to move it to your own task ${task}`,
+                };
+            }
+            const someoneElse = legacy.state === "other" || legacy.state === "unreadable"
+                ? ` (${LEGACY_DAEMON_WINDOWS_TASK} belongs to another Windows user and is not yours)`
+                : "";
+            return { installed: false, loaded: false, detail: `no Scheduled Task ${task}${someoneElse}` };
+        }
+        const loaded = /,\s*"?Running"?\s*$/i.test(probe.stdout.replace(/\0/g, "").trim());
+        return { installed: true, loaded, detail: `Scheduled Task ${task}${loaded ? " is running" : " is not running"}` };
     }
     return { installed: false, loaded: false, detail: `${platform}: service probe not available` };
 }