@indigoai-us/hq-cli 5.345.201 → 5.345.203

package/dist/lib/service-manager/types.d.ts

@@ -21,6 +21,14 @@ export interface ServiceSpec {
     restartSec: number;
     /** systemd unit file name; defaults to `hq-agent-<name>.service`. */
     unitName?: string;
+    /**
+     * macOS: run the job directly under node, without the HQ.app launcher and
+     * without AssociatedBundleIdentifiers, so launchd loads it at login whether
+     * or not the app is installed, enabled or allowed. The daemon sets this:
+     * on 2026-11-03 launchd skipped both app-associated agents at login and the
+     * daemon stayed down for 16 hours.
+     */
+    independentOfApp?: boolean;
 }
 export interface ServiceHostPaths {
     home: string;

package/dist/lib/sync-core/reconcile.d.ts

@@ -1,5 +1,5 @@
 import { type SyncCoreVault } from "./engine-home.js";
-import { type SyncCoreBinaryInstall } from "./release.js";
+import { type SyncCoreBinaryInstall, type SyncCorePin } from "./release.js";
 import { type SyncCoreRolloutState } from "./rollout-state.js";
 export interface SyncCoreMembership {
     companyUid: string;
@@ -14,7 +14,10 @@ export interface SyncCoreReconcileDeps {
     resolvePersonUid: () => Promise<string | null>;
     readRolloutFlag: (companyUid: string) => Promise<boolean>;
     ensureBinary: (release: string) => Promise<SyncCoreBinaryInstall>;
+    /** A fixed release (tests). Otherwise readPin decides, then SYNC_CORE_RELEASE. */
     release?: string;
+    /** Reads the server-side engine pin; never throws (see readSyncCorePin). */
+    readPin?: () => Promise<SyncCorePin>;
     now?: () => Date;
     log?: (line: string) => void;
 }

package/dist/lib/sync-core/reconcile.js

@@ -3,7 +3,7 @@ import * as path from "node:path";
 import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { readVaultSyncSwitches, writeVaultSyncSwitches } from "../vault-sync-switches.js";
 import { clearEngineStatus, engineFirstCycle, isSyncCoreVaultUid, removeEngineOwnership, syncCoreEngineHome, writeEngineHome, } from "./engine-home.js";
-import { SYNC_CORE_FULL_RELEASE, SYNC_CORE_RELEASE, fullModeAllowed, installedSyncCoreRelease, syncCoreBinaryPath, } from "./release.js";
+import { SYNC_CORE_FULL_RELEASE, SYNC_CORE_RELEASE, compareSyncCoreReleases, fullModeAllowed, installedSyncCoreRelease, syncCoreBinaryPath, } from "./release.js";
 import { readSyncCoreSkips } from "./skip.js";
 import { SYNC_RUST_ENGINE_ROLLOUT_FLAG } from "./flag.js";
 import { readSyncCoreRolloutState, syncCoreRolloutStatePath, writeSyncCoreRolloutState, } from "./rollout-state.js";
@@ -65,8 +65,8 @@ function ownedVaultsWithoutState(home, hqRoot) {
 export async function reconcileSyncCore(deps) {
     const now = deps.now ?? (() => new Date());
     const log = deps.log ?? (() => { });
-    const release = deps.release ?? SYNC_CORE_RELEASE;
     const warnings = [];
+    let release = deps.release ?? SYNC_CORE_RELEASE;
     const previous = readSyncCoreRolloutState(deps.home);
     const previousVaults = previous?.vaults ?? ownedVaultsWithoutState(deps.home, deps.hqRoot);
     const previousByUid = new Map(previousVaults.map((vault) => [vault.uid, vault]));
@@ -117,6 +117,16 @@ export async function reconcileSyncCore(deps) {
     let binaryPath = syncCoreBinaryPath(deps.home);
     let installedRelease = installedSyncCoreRelease(deps.home);
     if (desired.length > 0) {
+        if (deps.release === undefined && deps.readPin) {
+            const pin = await deps.readPin();
+            release = pin.release;
+            if (pin.warning)
+                warnings.push(pin.warning);
+            if (pin.source === "server" && installedRelease && compareSyncCoreReleases(pin.release, installedRelease) < 0) {
+                // The no-downgrade guard in ensureSyncCoreBinary keeps the newer engine.
+                log(`the server pins hq-syncd ${pin.release}, older than the installed ${installedRelease}; keeping ${installedRelease}`);
+            }
+        }
         try {
             const install = await deps.ensureBinary(release);
             binaryPath = install.binaryPath;

package/dist/lib/sync-core/release.d.ts

@@ -4,6 +4,29 @@ export declare function compareSyncCoreReleases(a: string, b: string): number;
 export declare function fullModeAllowed(release: string): boolean;
 export declare const SYNC_CORE_DOWNLOAD_BASE = "https://indigoai-public.s3.amazonaws.com/hq-sync-core";
 export declare const SYNC_CORE_DOWNLOAD_BASE_ENV = "HQ_SYNC_CORE_DOWNLOAD_BASE";
+/** The server-side engine pin, published next to the release folders on the download base. */
+export declare const SYNC_CORE_PIN_FILE = "pin.json";
+export interface SyncCorePin {
+    /** The engine release machines should run. */
+    release: string;
+    /** "server": read from pin.json; "built-in": SYNC_CORE_RELEASE, because no server pin could be used. */
+    source: "server" | "built-in";
+    /** Why the server pin was not used, when it exists but could not be read. A missing pin.json sets none. */
+    warning?: string;
+}
+/**
+ * The engine release to install, read from `<download base>/pin.json`
+ * (`{"release":"v0.1.24"}`), so an engine release reaches machines without an
+ * hq-cli release. Falls back to SYNC_CORE_RELEASE when the file is missing,
+ * unreadable or malformed. Never throws. Windows stays unsupported: the pin
+ * only picks a version, and syncCoreAssetName has no Windows build.
+ */
+export declare function readSyncCorePin(opts?: {
+    env?: NodeJS.ProcessEnv;
+    baseUrl?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<SyncCorePin>;
 export declare function syncCoreBinaryPath(home?: string): string;
 export declare function syncCoreReleaseMarkerPath(home?: string): string;
 export declare function syncCoreAssetName(release: string, platform: NodeJS.Platform, arch: string): string | null;

package/dist/lib/sync-core/release.js

@@ -21,6 +21,45 @@ export function fullModeAllowed(release) {
 export const SYNC_CORE_DOWNLOAD_BASE = "https://indigoai-public.s3.amazonaws.com/hq-sync-core";
 export const SYNC_CORE_DOWNLOAD_BASE_ENV = "HQ_SYNC_CORE_DOWNLOAD_BASE";
 const DOWNLOAD_TIMEOUT_MS = 600_000;
+/** The server-side engine pin, published next to the release folders on the download base. */
+export const SYNC_CORE_PIN_FILE = "pin.json";
+const PIN_TIMEOUT_MS = 10_000;
+const RELEASE_PATTERN = /^v\d+\.\d+\.\d+$/;
+/**
+ * The engine release to install, read from `<download base>/pin.json`
+ * (`{"release":"v0.1.24"}`), so an engine release reaches machines without an
+ * hq-cli release. Falls back to SYNC_CORE_RELEASE when the file is missing,
+ * unreadable or malformed. Never throws. Windows stays unsupported: the pin
+ * only picks a version, and syncCoreAssetName has no Windows build.
+ */
+export async function readSyncCorePin(opts = {}) {
+    const builtIn = (warning) => ({ release: SYNC_CORE_RELEASE, source: "built-in", ...(warning ? { warning } : {}) });
+    const url = `${opts.baseUrl?.replace(/\/+$/, "") ?? syncCoreDownloadBase(opts.env)}/${SYNC_CORE_PIN_FILE}`;
+    let response;
+    try {
+        response = await (opts.fetch ?? fetch)(url, { signal: AbortSignal.timeout(opts.timeoutMs ?? PIN_TIMEOUT_MS) });
+    }
+    catch (error) {
+        return builtIn(`could not read the engine pin ${url}: ${error instanceof Error ? error.message : String(error)}; using built-in ${SYNC_CORE_RELEASE}`);
+    }
+    // S3 answers 403 for a missing key on a bucket without public listing.
+    if (response.status === 404 || response.status === 403)
+        return builtIn();
+    if (!response.ok)
+        return builtIn(`could not read the engine pin ${url}: HTTP ${response.status}; using built-in ${SYNC_CORE_RELEASE}`);
+    let parsed;
+    try {
+        parsed = JSON.parse(await response.text());
+    }
+    catch {
+        return builtIn(`the engine pin ${url} is not JSON; using built-in ${SYNC_CORE_RELEASE}`);
+    }
+    const release = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed.release : undefined;
+    if (typeof release !== "string" || !RELEASE_PATTERN.test(release)) {
+        return builtIn(`the engine pin ${url} has no valid "release" (want vX.Y.Z); using built-in ${SYNC_CORE_RELEASE}`);
+    }
+    return { release, source: "server" };
+}
 export function syncCoreBinaryPath(home = os.homedir()) {
     return path.join(home, ".hq", "bin", "hq-syncd");
 }

package/dist/main.js

@@ -61,7 +61,7 @@ import { packageRoot } from "./utils/hq-roots.js";
 import { classifyModuleNotFound, installTreeTornCaptureContext, installTreeTornStderrLine, isInstallTreeTornError, } from "./utils/install-tree-torn.js";
 import { isVaultAccessDeniedError, vaultAccessDeniedMessage, } from "./utils/vault-access-denied-error.js";
 import { fallbackOperatorMessage, unexpectedCliErrorMessage } from "./utils/unexpected-cli-error.js";
-import { runGlobalNetworkLifecycle } from "./utils/cli-network-lifecycle.js";
+import { isHqDaemonRunCommand, runGlobalNetworkLifecycle, runSentryInitialization, } from "./utils/cli-network-lifecycle.js";
 import * as os from "node:os";
 import { adoptAgentIdentityEnv } from "./lib/agent-kit/adopt-identity.js";
 import { agentKitPaths } from "./lib/agent-kit/paths.js";
@@ -131,7 +131,7 @@ let activeForegroundNetworkBudget;
  */
 const RUNNING_ENTRY_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), "index.js");
 installStreamErrorBoundary();
-runGlobalNetworkLifecycle(process.argv, () => initSentry());
+runSentryInitialization(process.argv, () => initSentry());
 const program = new Command();
 program
     .name("hq")
@@ -169,7 +169,7 @@ program.hook("preAction", async () => {
 export async function runCli() {
     const xpcServiceName = process.env.XPC_SERVICE_NAME ?? "";
     const launchedByHqAgent = xpcServiceName.startsWith("ai.indigo.") || xpcServiceName.startsWith("ai.getindigo.");
-    const isDaemonEntryPoint = process.argv[2] === "daemon" && process.argv[3] === "run";
+    const isDaemonEntryPoint = isHqDaemonRunCommand(process.argv);
     const isBotHotPath = process.argv[2] === "bot" && process.argv[3] === "run";
     if (process.platform === "darwin" && typeof process.getuid === "function" &&
         !launchedByHqAgent && !isDaemonEntryPoint && !isBotHotPath) {

package/dist/utils/cli-network-lifecycle.d.ts

@@ -1,3 +1,12 @@
+export declare function isHqDaemonRunCommand(argv: readonly string[]): boolean;
+/**
+ * Resident daemons keep their own bounded local logs. Do not initialize the
+ * process-wide Sentry transport in these commands: they can live across many
+ * network changes, while the SDK is designed around one short CLI invocation.
+ */
+export declare function isLongLivedDaemonCommand(argv: readonly string[]): boolean;
+/** Suppress only Sentry startup; every other global lifecycle operation still runs. */
+export declare function runSentryInitialization<T>(argv: readonly string[], operation: () => T): T | undefined;
 export declare function isMonitorFastPathCommand(argv: readonly string[]): boolean;
 /** The commit-msg hook runs `hq fingerprint self --offline`; it must stay fast and offline. */
 export declare function isOfflineFingerprintCommand(argv: readonly string[]): boolean;

package/dist/utils/cli-network-lifecycle.js

@@ -1,4 +1,27 @@
 const MONITOR_HIDDEN_NETWORK_BYPASS = new Set(["drain", "wait", "enabled", "_run"]);
+function commandArgv(argv) {
+    return argv.slice(2).filter((arg) => arg !== "--verbose");
+}
+export function isHqDaemonRunCommand(argv) {
+    const command = commandArgv(argv);
+    return command[0] === "daemon" && command[1] === "run";
+}
+/**
+ * Resident daemons keep their own bounded local logs. Do not initialize the
+ * process-wide Sentry transport in these commands: they can live across many
+ * network changes, while the SDK is designed around one short CLI invocation.
+ */
+export function isLongLivedDaemonCommand(argv) {
+    const command = commandArgv(argv);
+    return (isHqDaemonRunCommand(argv) ||
+        (command[0] === "mesh" && command[1] === "daemon" && command[2] === "run"));
+}
+/** Suppress only Sentry startup; every other global lifecycle operation still runs. */
+export function runSentryInitialization(argv, operation) {
+    if (isLongLivedDaemonCommand(argv))
+        return undefined;
+    return operation();
+}
 export function isMonitorFastPathCommand(argv) {
     return argv[2] === "monitor" && MONITOR_HIDDEN_NETWORK_BYPASS.has(argv[3] ?? "");
 }
@@ -8,8 +31,9 @@ export function isOfflineFingerprintCommand(argv) {
 }
 /** Skip process-wide network lifecycle work for hooks and detached monitor supervisors. */
 export function runGlobalNetworkLifecycle(argv, operation) {
-    if (isMonitorFastPathCommand(argv) || isOfflineFingerprintCommand(argv))
+    if (isMonitorFastPathCommand(argv) || isOfflineFingerprintCommand(argv)) {
         return undefined;
+    }
     return operation();
 }
 //# sourceMappingURL=cli-network-lifecycle.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.201",
+  "version": "5.345.203",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -48,7 +48,8 @@
     "prepare": "husky || true",
     "check:no-hermes": "bash scripts/check-no-hermes.sh",
     "prepack": "node scripts/hook-engine-manifest.mjs",
-    "postpublish": "node scripts/hook-engine-manifest.mjs restore"
+    "postpublish": "node scripts/hook-engine-manifest.mjs restore",
+    "build:ci": "node scripts/prepare-fixture-privacy-baseline.mjs && pnpm run build"
   },
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
@@ -116,11 +117,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.201",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.201",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.201",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.201",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.201",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.201"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.203",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.203",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.203",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.203",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.203",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.203"
   }
 }