@indigoai-us/hq-cli 5.345.179 → 5.345.181

package/dist/lib/bot/runtime-auth.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Which model login a local bot uses, per runtime.
+ *
+ * - default: the owner's own sign-in for that runtime (no config dir set).
+ * - own:     a sign-in that belongs to the bot alone, kept in
+ *            ~/.hq/bots/<name>/auth/<runtime>/ (CLAUDE_CONFIG_DIR / CODEX_HOME).
+ * - account: an existing `hq capacity` / lanes account home, by id.
+ *
+ * Also the session set-aside a runtime switch needs: session files belong to
+ * one runtime, so they move to a backup folder and the new runtime starts
+ * fresh. DM history, memory and the cloud identity are never touched.
+ *
+ * This module never reads, prints, copies or hashes a credential. It only
+ * names directories and checks whether they exist.
+ */
+import type { BotConfig, BotRuntimeId } from "./config.js";
+import type { LanesConfig } from "../lanes/types.js";
+/** Runtimes `hq bot login` can sign in for (each has a config-dir variable and a login command). */
+export declare const BOT_LOGIN_RUNTIMES: readonly ["claude", "codex"];
+export type BotLoginRuntime = (typeof BOT_LOGIN_RUNTIMES)[number];
+export declare function isBotLoginRuntime(value: unknown): value is BotLoginRuntime;
+export type BotRuntimeAuth = {
+    mode: "own";
+} | {
+    mode: "account";
+    account: string;
+};
+export type BotRuntimeAuthMap = Partial<Record<BotRuntimeId, BotRuntimeAuth>>;
+export declare const BOT_AUTH_DIRNAME = "auth";
+export declare const BOT_SESSION_ARCHIVE_DIRNAME = "session-archive";
+export declare const VENDOR_LOGIN: Record<BotLoginRuntime, {
+    command: string;
+    args: string[];
+}>;
+export declare const VENDOR_LOGOUT: Record<BotLoginRuntime, {
+    command: string;
+    args: string[];
+}>;
+/** The bot's own config home for a runtime: <botDir>/auth/<runtime>. */
+export declare function botOwnAuthHome(dir: string, runtime: BotRuntimeId): string;
+/** The saved login choice for a runtime, or null for the owner's default. Tolerant of junk on read. */
+export declare function botRuntimeAuth(config: Pick<BotConfig, "runtime" | "runtimeAuth">, runtime?: BotRuntimeId): BotRuntimeAuth | null;
+/** A copy of the map with `runtime` set to `auth` (null = back to the owner's default). */
+export declare function withRuntimeAuth(map: BotRuntimeAuthMap | undefined, runtime: BotRuntimeId, auth: BotRuntimeAuth | null): BotRuntimeAuthMap | undefined;
+export interface AccountLookupDeps {
+    loadConfig?: (hqRoot: string) => LanesConfig;
+    existsSync?: (p: string) => boolean;
+}
+/** The home directory of a capacity account for a runtime. Throws an expected error when it is not usable. */
+export declare function capacityAccountHome(hqRoot: string, runtime: BotRuntimeId, accountId: string, deps?: AccountLookupDeps): string;
+/**
+ * The environment a bot's model turn runs with: `base` with the runtime's
+ * config-dir variable pointed at the bot's chosen login. A missing own login
+ * or a gone account is an error: falling back to the owner's login is the
+ * thing this setting exists to prevent.
+ */
+export declare function botAuthEnv(dir: string, config: Pick<BotConfig, "name" | "runtime" | "runtimeAuth" | "hqRoot">, base: NodeJS.ProcessEnv, deps?: AccountLookupDeps): NodeJS.ProcessEnv;
+export interface BotAuthDescription {
+    runtime: BotRuntimeId;
+    login: "default" | "own" | "account" | "invalid";
+    account?: string;
+    /** The config-dir variable the bot's turns set (never its value's contents). */
+    envVar?: string;
+    /** Own login: whether its folder exists. Never a token check. */
+    present?: boolean;
+}
+export declare function describeBotAuth(dir: string, config: Pick<BotConfig, "runtime" | "runtimeAuth">, existsSync?: (p: string) => boolean): BotAuthDescription;
+export declare function formatBotAuth(d: BotAuthDescription, name: string): string;
+export type SpawnInteractive = (command: string, args: string[], env: NodeJS.ProcessEnv) => {
+    status: number | null;
+    error?: Error;
+};
+/** Runs the vendor's own login/logout with the terminal attached. Its output goes to the terminal only, never to HQ's log. */
+export declare const defaultSpawnInteractive: SpawnInteractive;
+/** Logout runs quietly: nothing it prints is shown or logged. */
+export declare const defaultSpawnQuiet: SpawnInteractive;
+/**
+ * Sign a bot in with its own login for `runtime`. The vendor CLI writes the
+ * credential into the bot's home (or, for Claude on macOS, a keychain item
+ * keyed by that home). HQ never sees it.
+ */
+export declare function signInBotRuntime(dir: string, runtime: BotLoginRuntime, deps?: {
+    spawn?: SpawnInteractive;
+    quietSpawn?: SpawnInteractive;
+    env?: NodeJS.ProcessEnv;
+}): {
+    home: string;
+    created: boolean;
+};
+/**
+ * Sign the bot's own login out and delete its home. The vendor logout runs
+ * first so a Claude keychain item keyed by the home is removed too.
+ */
+export declare function signOutBotRuntime(dir: string, runtime: BotLoginRuntime, deps?: {
+    spawn?: SpawnInteractive;
+    env?: NodeJS.ProcessEnv;
+}): {
+    removed: boolean;
+    vendorLogout: "ok" | "failed" | "skipped";
+};
+/** True for the model-session files of a bot dir (owner DM, other DMs, rooms, jobs). */
+export declare function isBotSessionFile(name: string): boolean;
+export interface SessionSetAside {
+    archiveDir: string;
+    moved: string[];
+}
+/**
+ * Before a runtime switch: back up bot.json and move every session file into
+ * <dir>/session-archive/<stamp>-<oldRuntime>/, so the new runtime starts
+ * fresh and the old sessions can be put back.
+ */
+export declare function setAsideBotSessions(dir: string, oldRuntime: BotRuntimeId, now?: Date): SessionSetAside;
+/**
+ * Undo setAsideBotSessions: the moved session files go back. bot.json is not
+ * overwritten (the bot may have written fields since); the caller patches the
+ * settings it changed back. The backup folder stays for manual recovery.
+ */
+export declare function restoreBotSessions(dir: string, aside: SessionSetAside): void;
+//# sourceMappingURL=runtime-auth.d.ts.map

package/dist/lib/bot/runtime-auth.js

@@ -0,0 +1,251 @@
+/**
+ * Which model login a local bot uses, per runtime.
+ *
+ * - default: the owner's own sign-in for that runtime (no config dir set).
+ * - own:     a sign-in that belongs to the bot alone, kept in
+ *            ~/.hq/bots/<name>/auth/<runtime>/ (CLAUDE_CONFIG_DIR / CODEX_HOME).
+ * - account: an existing `hq capacity` / lanes account home, by id.
+ *
+ * Also the session set-aside a runtime switch needs: session files belong to
+ * one runtime, so they move to a backup folder and the new runtime starts
+ * fresh. DM history, memory and the cloud identity are never touched.
+ *
+ * This module never reads, prints, copies or hashes a credential. It only
+ * names directories and checks whether they exist.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { botConfigPath } from "./paths.js";
+import { PROVIDER_HOME_ENV, isDefaultProviderHome, withProviderHomeEnv } from "../lanes/provider-home.js";
+import { effectiveAccountHome } from "../lanes/account-home.js";
+import { loadLanesConfig } from "../lanes/config.js";
+/** Runtimes `hq bot login` can sign in for (each has a config-dir variable and a login command). */
+export const BOT_LOGIN_RUNTIMES = ["claude", "codex"];
+export function isBotLoginRuntime(value) {
+    return typeof value === "string" && BOT_LOGIN_RUNTIMES.includes(value);
+}
+export const BOT_AUTH_DIRNAME = "auth";
+export const BOT_SESSION_ARCHIVE_DIRNAME = "session-archive";
+const ACCOUNT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+export const VENDOR_LOGIN = {
+    claude: { command: "claude", args: ["auth", "login"] },
+    codex: { command: "codex", args: ["login"] },
+};
+export const VENDOR_LOGOUT = {
+    claude: { command: "claude", args: ["auth", "logout"] },
+    codex: { command: "codex", args: ["logout"] },
+};
+function expected(message) {
+    return Object.assign(new Error(message), { expected: true });
+}
+/** The bot's own config home for a runtime: <botDir>/auth/<runtime>. */
+export function botOwnAuthHome(dir, runtime) {
+    return path.join(dir, BOT_AUTH_DIRNAME, runtime);
+}
+/** The saved login choice for a runtime, or null for the owner's default. Tolerant of junk on read. */
+export function botRuntimeAuth(config, runtime = config.runtime) {
+    const raw = config.runtimeAuth?.[runtime];
+    if (!raw || typeof raw !== "object")
+        return null;
+    if (raw.mode === "own")
+        return { mode: "own" };
+    if (raw.mode === "account" && typeof raw.account === "string" && ACCOUNT_ID_RE.test(raw.account)) {
+        return { mode: "account", account: raw.account };
+    }
+    return null;
+}
+/** A copy of the map with `runtime` set to `auth` (null = back to the owner's default). */
+export function withRuntimeAuth(map, runtime, auth) {
+    const next = { ...(map ?? {}) };
+    if (auth)
+        next[runtime] = auth;
+    else
+        delete next[runtime];
+    return Object.keys(next).length ? next : undefined;
+}
+/** The home directory of a capacity account for a runtime. Throws an expected error when it is not usable. */
+export function capacityAccountHome(hqRoot, runtime, accountId, deps = {}) {
+    if (!ACCOUNT_ID_RE.test(accountId))
+        throw expected(`"${accountId.slice(0, 40)}" is not an account id.`);
+    const cfg = (deps.loadConfig ?? loadLanesConfig)(hqRoot);
+    const provider = cfg.providers[runtime];
+    const account = provider?.accounts[accountId];
+    if (!account) {
+        const known = Object.keys(provider?.accounts ?? {});
+        throw expected(`No ${runtime} account named "${accountId}"${known.length ? ` (known: ${known.join(", ")})` : ""}. Add one with: hq capacity login ${runtime}`);
+    }
+    if (!account.enabled)
+        throw expected(`The ${runtime} account "${accountId}" is disabled.`);
+    const home = effectiveAccountHome(account).home;
+    if (isDefaultProviderHome(runtime, home)) {
+        throw expected(`The ${runtime} account "${accountId}" is your default ${runtime} login, so it would not give the bot a login of its own. Pick another account, or use: hq bot login`);
+    }
+    if (!(deps.existsSync ?? fs.existsSync)(home))
+        throw expected(`The ${runtime} account "${accountId}" has no home folder on this computer. Sign it in with: hq capacity login ${runtime} --account ${accountId}`);
+    return home;
+}
+/**
+ * The environment a bot's model turn runs with: `base` with the runtime's
+ * config-dir variable pointed at the bot's chosen login. A missing own login
+ * or a gone account is an error: falling back to the owner's login is the
+ * thing this setting exists to prevent.
+ */
+export function botAuthEnv(dir, config, base, deps = {}) {
+    const auth = botRuntimeAuth(config);
+    const runtime = config.runtime;
+    if (!auth) {
+        // A saved choice HQ cannot read is not the owner's default: refuse it.
+        if (config.runtimeAuth?.[runtime] !== undefined) {
+            throw expected(`${config.name}'s saved ${runtime} login setting is not readable. Set it again with: hq bot login ${config.name} --runtime ${runtime}, or hq bot set ${config.name} --account <id|default>`);
+        }
+        return { ...base };
+    }
+    if (auth.mode === "own") {
+        const home = botOwnAuthHome(dir, runtime);
+        if (!(deps.existsSync ?? fs.existsSync)(home)) {
+            throw expected(`${config.name} is set to its own ${runtime} login but has none on this computer. Sign it in with: hq bot login ${config.name} --runtime ${runtime}`);
+        }
+        return withProviderHomeEnv(base, runtime, home);
+    }
+    return withProviderHomeEnv(base, runtime, capacityAccountHome(config.hqRoot, runtime, auth.account, deps));
+}
+export function describeBotAuth(dir, config, existsSync = fs.existsSync) {
+    const auth = botRuntimeAuth(config);
+    const runtime = config.runtime;
+    if (!auth)
+        return config.runtimeAuth?.[runtime] !== undefined ? { runtime, login: "invalid" } : { runtime, login: "default" };
+    const envVar = PROVIDER_HOME_ENV[runtime];
+    if (auth.mode === "own")
+        return { runtime, login: "own", ...(envVar ? { envVar } : {}), present: existsSync(botOwnAuthHome(dir, runtime)) };
+    return { runtime, login: "account", account: auth.account, ...(envVar ? { envVar } : {}) };
+}
+export function formatBotAuth(d, name) {
+    if (d.login === "default")
+        return `default (your own ${d.runtime} sign-in)`;
+    if (d.login === "invalid")
+        return `unreadable setting; turns are refused until it is set again (hq bot login ${name} --runtime ${d.runtime})`;
+    if (d.login === "account")
+        return `account ${d.account}`;
+    return d.present ? `own (signed in for ${name} only)` : `own, but not signed in (run: hq bot login ${name} --runtime ${d.runtime})`;
+}
+/** Runs the vendor's own login/logout with the terminal attached. Its output goes to the terminal only, never to HQ's log. */
+export const defaultSpawnInteractive = (command, args, env) => {
+    const r = spawnSync(command, args, { stdio: "inherit", env });
+    return { status: r.status, ...(r.error ? { error: r.error } : {}) };
+};
+/** Logout runs quietly: nothing it prints is shown or logged. */
+export const defaultSpawnQuiet = (command, args, env) => {
+    const r = spawnSync(command, args, { stdio: ["ignore", "ignore", "ignore"], env, timeout: 30_000 });
+    return { status: r.status, ...(r.error ? { error: r.error } : {}) };
+};
+/** Refuse to touch anything that is not exactly <dir>/auth/<runtime>. */
+function assertOwnAuthHome(dir, home) {
+    const root = path.resolve(dir, BOT_AUTH_DIRNAME);
+    const rel = path.relative(root, path.resolve(home));
+    if (!rel || rel.startsWith("..") || path.isAbsolute(rel) || rel.includes(path.sep)) {
+        throw new Error(`refusing to touch ${home}: not a bot login folder`);
+    }
+    for (const p of [root, home]) {
+        let link = false;
+        try {
+            link = fs.lstatSync(p).isSymbolicLink();
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        if (link)
+            throw new Error(`refusing to touch ${p}: it is a symbolic link`);
+    }
+}
+/**
+ * Sign a bot in with its own login for `runtime`. The vendor CLI writes the
+ * credential into the bot's home (or, for Claude on macOS, a keychain item
+ * keyed by that home). HQ never sees it.
+ */
+export function signInBotRuntime(dir, runtime, deps = {}) {
+    const home = botOwnAuthHome(dir, runtime);
+    assertOwnAuthHome(dir, home);
+    const created = !fs.existsSync(home);
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    fs.chmodSync(path.join(dir, BOT_AUTH_DIRNAME), 0o700);
+    fs.chmodSync(home, 0o700);
+    const { command, args } = VENDOR_LOGIN[runtime];
+    const r = (deps.spawn ?? defaultSpawnInteractive)(command, args, withProviderHomeEnv(deps.env ?? process.env, runtime, home));
+    if (r.error || r.status !== 0) {
+        // A first sign-in that failed leaves nothing behind.
+        if (created) {
+            // A keychain item keyed by this folder may already exist: sign it out first.
+            const { command: out, args: outArgs } = VENDOR_LOGOUT[runtime];
+            (deps.quietSpawn ?? defaultSpawnQuiet)(out, outArgs, withProviderHomeEnv(deps.env ?? process.env, runtime, home));
+            fs.rmSync(home, { recursive: true, force: true });
+        }
+        const why = r.error?.code === "ENOENT" ? `${command} is not installed` : `${command} ${args.join(" ")} did not finish (exit ${r.status ?? "signal"})`;
+        throw expected(`Sign-in failed: ${why}. Nothing was changed.`);
+    }
+    return { home, created };
+}
+/**
+ * Sign the bot's own login out and delete its home. The vendor logout runs
+ * first so a Claude keychain item keyed by the home is removed too.
+ */
+export function signOutBotRuntime(dir, runtime, deps = {}) {
+    const home = botOwnAuthHome(dir, runtime);
+    assertOwnAuthHome(dir, home);
+    if (!fs.existsSync(home))
+        return { removed: false, vendorLogout: "skipped" };
+    const { command, args } = VENDOR_LOGOUT[runtime];
+    const r = (deps.spawn ?? defaultSpawnQuiet)(command, args, withProviderHomeEnv(deps.env ?? process.env, runtime, home));
+    if (r.error || r.status !== 0) {
+        // Keep the folder: it is the only handle on a keychain item keyed by it.
+        return { removed: false, vendorLogout: "failed" };
+    }
+    fs.rmSync(home, { recursive: true, force: true });
+    return { removed: true, vendorLogout: "ok" };
+}
+/** True for the model-session files of a bot dir (owner DM, other DMs, rooms, jobs). */
+export function isBotSessionFile(name) {
+    return name === "session.json" || /^session-(dm|room|job)-[A-Za-z0-9._-]+\.json$/.test(name);
+}
+/**
+ * Before a runtime switch: back up bot.json and move every session file into
+ * <dir>/session-archive/<stamp>-<oldRuntime>/, so the new runtime starts
+ * fresh and the old sessions can be put back.
+ */
+export function setAsideBotSessions(dir, oldRuntime, now = new Date()) {
+    const stamp = now.toISOString().replace(/[:.]/g, "-");
+    const archiveDir = path.join(dir, BOT_SESSION_ARCHIVE_DIRNAME, `${stamp}-${oldRuntime}`);
+    fs.mkdirSync(archiveDir, { recursive: true, mode: 0o700 });
+    fs.copyFileSync(botConfigPath(dir), path.join(archiveDir, "bot.json"));
+    const moved = [];
+    try {
+        for (const name of fs.readdirSync(dir)) {
+            if (!isBotSessionFile(name))
+                continue;
+            fs.renameSync(path.join(dir, name), path.join(archiveDir, name));
+            moved.push(name);
+        }
+    }
+    catch (err) {
+        restoreBotSessions(dir, { archiveDir, moved });
+        throw err;
+    }
+    return { archiveDir, moved };
+}
+/**
+ * Undo setAsideBotSessions: the moved session files go back. bot.json is not
+ * overwritten (the bot may have written fields since); the caller patches the
+ * settings it changed back. The backup folder stays for manual recovery.
+ */
+export function restoreBotSessions(dir, aside) {
+    for (const name of fs.readdirSync(dir)) {
+        // Files the new runtime wrote in the meantime are not the old runtime's.
+        if (isBotSessionFile(name) && !aside.moved.includes(name))
+            fs.rmSync(path.join(dir, name), { force: true });
+    }
+    for (const name of aside.moved) {
+        fs.copyFileSync(path.join(aside.archiveDir, name), path.join(dir, name));
+    }
+}
+//# sourceMappingURL=runtime-auth.js.map

package/dist/lib/daemon/catalog.d.ts

@@ -189,6 +189,7 @@ export declare function hqCloudUnits(machineType: MachineType, enabled: readonly
 export declare const CODEX_RUNNER_SCRIPT = "/usr/local/bin/outpost-codex-runner.sh";
 /** The outpost's Claude runner script, read for the session name it uses. */
 export declare const CLAUDE_RUNNER_SCRIPT = "/usr/local/bin/outpost-runner.sh";
+export declare function daemonAloneRunsLegacySync(ctx: PlanContext): boolean;
 /** Turn enabled services into concrete units for this host. */
 export declare function planUnits(services: readonly ServiceName[], ctx: PlanContext): UnitPlan[];
 export {};

package/dist/lib/daemon/catalog.js

@@ -148,7 +148,7 @@ function syncOwnerBlock(ctx) {
     }
     return undefined;
 }
-function daemonAloneRunsLegacySync(ctx) {
+export function daemonAloneRunsLegacySync(ctx) {
     return ctx.syncOwner === "daemon" && ctx.legacySyncUnitManagesSync !== true && syncOwnerBlock(ctx) === undefined;
 }
 function planService(service, ctx) {

package/dist/lib/daemon/run.d.ts

@@ -6,6 +6,7 @@
  * signing in takes effect without restarting the daemon.
  */
 import { type PlanContext, type ServiceName, type UnitPlan } from "./catalog.js";
+import { type SyncCoreVaultPlan } from "../sync-core/engine-home.js";
 import { type LegacyUnit, type WindowsTaskOwner } from "./legacy.js";
 import { type DaemonLockResult } from "./lock.js";
 import { type MachineType } from "./machine-type.js";
@@ -14,6 +15,7 @@ import { type HostApp, type Supervisor } from "./supervisor.js";
 export declare const LOG_ROTATE_BYTES: number;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export declare const RESTART_EXIT_CODE = 75;
+export declare function syncCoreVaultPlans(home: string, hqRoot: string | undefined, platform: NodeJS.Platform): SyncCoreVaultPlan[];
 export declare function planUnitsWithSyncCoreInterlock(services: readonly ServiceName[], context: PlanContext, supervisor: Pick<Supervisor, "runningPlanKey" | "state"> | null | undefined): UnitPlan[];
 /** A bounded shutdown deadline that can account for sync push persistence. */
 export declare function createShutdownCap(): {

package/dist/lib/daemon/run.js

@@ -23,6 +23,7 @@ import { botsRoot } from "../bot/paths.js";
 import { CLAUDE_RUNNER_SCRIPT, CODEX_RUNNER_SCRIPT, enabledServices, planUnits } from "./catalog.js";
 import { effectiveSyncOwner, readDaemonConfig } from "./config.js";
 import { inspectEngineHome } from "../sync-core/engine-home.js";
+import { fullModeHold } from "../sync-core/reconcile.js";
 import { readSyncCoreRolloutState } from "../sync-core/rollout-state.js";
 import { assertPersonalServiceSessionCapability, readRemoteControlPoolsConfig, remoteControlPoolSecretsEnv, } from "./remote-control-pools.js";
 import { loadLanesConfig } from "../lanes/config.js";
@@ -34,7 +35,7 @@ import { DAEMON_CHILD_BOOTSTRAP_HANDOFF_WATCH_FLAG, DAEMON_LANES_RECONCILE_FILE_
 import { createLanesReconcileWatcher } from "./lanes-reconcile-watcher.js";
 import { findLegacyUnits, legacyMeshUnitsToRetire, legacyOwnerLookup, } from "./legacy.js";
 import { readLegacySyncEnv } from "./legacy-sync-env.js";
-import { readVaultSyncSwitches, unreadableSwitchesWarning } from "../vault-sync-switches.js";
+import { readVaultSyncSwitches, unreadableSwitchesWarning, writeVaultSyncSwitches } from "../vault-sync-switches.js";
 import { acquireDaemonLock, isProcessAlive, processCommandLine, releaseDaemonLock } from "./lock.js";
 import { retireLegacyMeshUnits } from "./migrate.js";
 import { daemonDir as meshDaemonDir, daemonPidPath as meshDaemonPidPath } from "../mesh/live/daemon/paths.js";
@@ -65,24 +66,29 @@ export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 export const RESTART_EXIT_CODE = 75;
 const NON_SYNC_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + 5_000;
 const SYNC_RUNNER_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + SYNC_RUNNER_PERSIST_GRACE_MS + 5_000;
-function syncCoreVaultPlans(home, hqRoot, platform) {
+export function syncCoreVaultPlans(home, hqRoot, platform) {
     const state = readSyncCoreRolloutState(home);
     if (!state)
         return [];
-    return state.vaults.map((vault) => inspectEngineHome(home, hqRoot, {
-        uid: vault.uid,
-        kind: vault.kind,
-        ...(vault.slug ? { slug: vault.slug } : {}),
-        phase: vault.phase,
-        engineHome: vault.engineHome,
-        binaryPath: state.binaryPath,
-        release: state.release,
-        ...(vault.legacyOffSince ? { legacyOffSince: vault.legacyOffSince } : {}),
-    }, platform));
+    return state.vaults.map((vault) => {
+        const plan = inspectEngineHome(home, hqRoot, {
+            uid: vault.uid,
+            kind: vault.kind,
+            ...(vault.slug ? { slug: vault.slug } : {}),
+            phase: vault.phase,
+            engineHome: vault.engineHome,
+            binaryPath: state.binaryPath,
+            release: state.release,
+            ...(vault.legacyOffSince ? { legacyOffSince: vault.legacyOffSince } : {}),
+        }, platform);
+        const releaseHold = vault.phase === "full" ? fullModeHold(vault, state.release) : undefined;
+        return releaseHold ? { ...plan, blockedReason: releaseHold } : plan;
+    });
 }
 const rememberedSyncCoreVaults = new Map();
 export function planUnitsWithSyncCoreInterlock(services, context, supervisor) {
     const companies = new Set();
+    const runningVaults = new Set();
     let personal = false;
     for (const vault of context.syncCoreVaults ?? []) {
         rememberedSyncCoreVaults.set(vault.uid, { kind: vault.kind, slug: vault.slug, full: vault.phase === "full" });
@@ -90,7 +96,9 @@ export function planUnitsWithSyncCoreInterlock(services, context, supervisor) {
     for (const unit of supervisor?.state().units ?? []) {
         if (!unit.id.startsWith("sync-core:") || supervisor?.runningPlanKey(unit.id) === undefined)
             continue;
-        const vault = rememberedSyncCoreVaults.get(unit.id.slice("sync-core:".length));
+        const uid = unit.id.slice("sync-core:".length);
+        runningVaults.add(uid);
+        const vault = rememberedSyncCoreVaults.get(uid);
         if (!vault?.full)
             continue;
         if (vault.kind === "personal")
@@ -98,13 +106,53 @@ export function planUnitsWithSyncCoreInterlock(services, context, supervisor) {
         else if (vault.slug)
             companies.add(vault.slug);
     }
-    const transitionContext = {
+    let vaultSync = context.vaultSync;
+    let fallbackPersistenceFailed = false;
+    if (context.vaultSync && !context.vaultSync.allOff) {
+        let personalOff = context.vaultSync.personalOff;
+        const offCompanies = new Set(context.vaultSync.offCompanies);
+        let restorePersonal = false;
+        const restoreCompanies = {};
+        for (const vault of context.syncCoreVaults ?? []) {
+            if (vault.phase !== "full" || runningVaults.has(vault.uid) || !fullModeHold(vault, vault.release))
+                continue;
+            if (vault.kind === "personal") {
+                restorePersonal = personalOff;
+                personalOff = false;
+            }
+            else if (vault.slug) {
+                if (offCompanies.has(vault.slug))
+                    restoreCompanies[vault.slug] = true;
+                offCompanies.delete(vault.slug);
+            }
+        }
+        if (restorePersonal || Object.keys(restoreCompanies).length > 0) {
+            try {
+                writeVaultSyncSwitches(context.home, {
+                    ...(restorePersonal ? { personal: true } : {}),
+                    companies: restoreCompanies,
+                });
+            }
+            catch {
+                fallbackPersistenceFailed = true;
+            }
+        }
+        vaultSync = { ...context.vaultSync, personalOff, offCompanies };
+    }
+    let transitionContext = {
         ...context,
+        vaultSync,
         syncCoreRunning: { personal, companies },
         legacySyncReadyForCore: false,
     };
-    const waiting = planUnits(services, transitionContext);
-    const legacy = waiting.find((unit) => unit.id === "sync");
+    let waiting = planUnits(services, transitionContext);
+    let legacy = waiting.find((unit) => unit.id === "sync");
+    if (fallbackPersistenceFailed && (legacy === undefined || legacy.blocked !== undefined)) {
+        vaultSync = context.vaultSync;
+        transitionContext = { ...transitionContext, vaultSync };
+        waiting = planUnits(services, transitionContext);
+        legacy = waiting.find((unit) => unit.id === "sync");
+    }
     const legacySyncReadyForCore = legacy !== undefined
         && (legacy.blocked !== undefined || supervisor?.runningPlanKey("sync") === planKey(legacy, CLI_VERSION));
     return planUnits(services, { ...transitionContext, legacySyncReadyForCore });