@indigoai-us/hq-cli 5.345.202 → 5.345.204

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+## [5.345.204] — 2026-11-05
+- `hq bot create`, `hq doctor` and the Claude bot sign-in check now read the macOS Keychain item that Claude Code keeps under your login account name first. A Mac can also hold an older item for the same service under another account (often "unknown", with no Claude login in it). The check used to read that one and said Claude was not signed in right after you signed in from HQ Desktop, so Create bot failed.
+- `hq bot create --json` now includes `brainSignIn` (the same shape `hq bot list`, `status` and `start` report) when it refuses a Claude bot because Claude Code is not signed in, so HQ Desktop can offer its own sign-in instead of "Could not create".
+- `hq capacity` renews expired Claude tokens on a busy Mac again. The refresh check reads the lane list once per collect instead of once per account, runs its two reads together without blocking the mesh daemon, skips the Outpost mirror refresh it does not need, and allows each read 30 seconds instead of 15. On macOS it now reads each running `claude` process's environment, so an open session on the default home no longer blocks the refresh of every other account home. A process whose environment cannot be read still blocks every home, and if the lane read fails no token is refreshed. A session started with `HOME` set to another directory and no `CLAUDE_CONFIG_DIR` now blocks the refresh of that directory's `.claude` home.
+- `hq signals run` now runs the extract step on the Grok CLI when the main local bot runs on Grok, instead of failing every source item with "grok has no restricted tool mode". Each turn runs grok 1.0.70 or newer in `dontAsk` mode with only the file reader allowed, grok's own read-only shell list denied, the MCP bridge, web tools and subagents off, a turn cap, and a per-turn `strict` sandbox profile that can read only the item's channel folder (plus the scripts the candidate command needs) and grants no extra writes. Reads of the Grok login are denied for the literal `~/.grok` spelling, the isolated home and the real home, because Grok matches a `~` path literally before expanding it. An older grok, or a main bot on grok with no grok installed, is never run unrestricted: the step uses Claude Code, then Codex, when that tool is installed and signed in, records the fallback in the run's step detail, and otherwise fails the run naming the grok version it needs. On macOS and Windows the step does not select Grok, because Grok only blocks child-process network on Linux, and falls through the same way. Grok has no terminal tool: HQ validates its returned candidate commands, checks the pinned writer still matches the script it generated, and then invokes that writer with fixed arguments, rejecting shell chaining, substitutions and redirections. The host writes candidates after the turn. The resolved Grok executable is pinned for the probe and turn, and probe caching distinguishes changes to PATH. Its isolated temporary home carries only a private login-file copy, excludes user configuration and hooks, and is removed when the turn ends, and its environment is an allowlist.
+- `hq lanes` admission on macOS no longer holds every new lane while `kern.memorystatus_vm_pressure_level` is warn. A warn level now holds only when the free percentage (`kern.memorystatus_level`) is at or below `throttle.memory_warn_min_free_percent` (default 20, a number from 0 to 100); critical still always holds, and `throttle.min_available_mem_mb` still applies. The hold message states this rule.
+- The daemon's new-sync-engine units now plan on Windows. A Windows machine downloads the `windows-x64` or `windows-arm64` zip, installs `hq-syncd.exe` (moving a running copy aside to `hq-syncd.exe.old`), and writes an engine home with no symlinks: the config names the token file and the engine reads `menubar.json` and `work-mesh/` from the daemon's state folder. Windows vaults stay on the current sync, and no engine is downloaded, until `SYNC_CORE_WINDOWS_FULL_RELEASE` names an engine release whose Windows build runs full sync; it is unset in this release. One machine can test a build first by setting `HQ_SYNC_CORE_WINDOWS_FULL_RELEASE` to that release.
+- Show the upload-hold explanation and recovery command in sync status.
+
+## [5.345.203] — 2026-11-05
+- Fix Codex capacity routing after plan exhaustion: available credits keep accounts usable at lowest priority, and superseded snapshots or passed resets no longer retain exhausted usage.
+- Keep company Outpost integration commands on their delegated machine session and allow sharing connections with an `out_*` principal.
+- On macOS the `hq daemon` LaunchAgent now runs node directly and is no longer attributed to the HQ app, so launchd loads it at login whether or not the app is installed or allowed. `hq daemon status` now asks launchd or systemd and says whether the daemon runs under the service manager, runs outside it, or is not loaded. New `hq daemon start` loads the unit when it is missing and starts it. A Mac that still has the older plist, which runs through the app, gets it rewritten and reloaded when the daemon next starts or when `hq daemon start` runs, with no `hq daemon install` needed; `hq daemon status` warns while the plist, or the job launchd has loaded, still runs through the app, and `hq daemon start` reloads a job left on the old definition. `hq daemon start` leaves a daemon the desktop app hosts alone, and no longer mistakes state left by an earlier app-hosted daemon for that. `hq daemon install` treats a failed bootstrap as an error and retries it, and `hq daemon migrate --apply` loads the daemon's agent first and loads an older agent again if taking it over fails.
+- The daemon no longer holds a sync engine for 30 minutes when its heartbeat timeouts come from a slow transfer the engine reports progress on (up to six such restarts per episode; after that they count again), and a sync engine held because another process had its lock (exit 17) starts again as soon as that process exits.
+- The sync engine release can now be pinned on the server (`pin.json` on the engine download base); the CLI's built-in release is the fallback, and an installed engine is never downgraded.
+- A self-check in the daemon sends the person signed in on the machine a DM when a sync engine unit has been held or failing for over 30 minutes, at most once a day per machine, naming every affected vault. It reports only units the daemon runs, and sends nothing when the machine is signed in as an agent.
+- The Executive opt-in key is now `executive.enabled` in the HQ menubar settings file. The old `executiveMeetingRider.enabled` key is ignored, so values saved under it earlier now read as off.
+
 ## [5.345.202] — 2026-11-04
 - The long-running `hq daemon run` and `hq mesh daemon run` processes no longer start Sentry. On some Macs, Sentry in these processes kept opening connections after network changes until the machine ran out of ports, so Claude and HQ lost internet access while other apps kept working. Short-lived CLI commands still report errors to Sentry, and the daemons keep their local logs.
 - The Executive (meeting rider, action-item lanes and source report DMs) is now off unless `executiveMeetingRider.enabled` is set to `true` in the HQ menubar settings file. In 5.345.200 it was on by default for every setup bot.

package/dist/command-catalog.generated.d.ts

@@ -18236,6 +18236,18 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "start";
+        readonly description: "Load the daemon's OS unit if the service manager does not have it, and start it";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "uninstall";
         readonly description: "Stop the daemon and remove its OS unit";
@@ -18816,6 +18828,18 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "sync-core-selfcheck";
+            readonly description: "DM the person signed in here when a sync engine unit has been held or failing for over 30 minutes (at most daily per unit set)";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "sync-core-manifest";
             readonly description: "Upload the sync-audit manifest for every vault the new sync engine owns on this machine";

package/dist/command-catalog.generated.js

@@ -22248,6 +22248,19 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "start",
+                "description": "Load the daemon's OS unit if the service manager does not have it, and start it",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "uninstall",
                 "description": "Stop the daemon and remove its OS unit",
@@ -22941,6 +22954,19 @@ export const COMMAND_CATALOG = [
                         ],
                         "subcommands": []
                     },
+                    {
+                        "name": "sync-core-selfcheck",
+                        "description": "DM the person signed in here when a sync engine unit has been held or failing for over 30 minutes (at most daily per unit set)",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [],
+                        "subcommands": []
+                    },
                     {
                         "name": "sync-core-manifest",
                         "description": "Upload the sync-audit manifest for every vault the new sync engine owns on this machine",

package/dist/commands/bot.js

@@ -935,7 +935,11 @@ function requireClaudeCodeLoginForCreate(name) {
     const check = botCreateSeams.claudeLogin();
     if (check.signedIn)
         return;
-    throw Object.assign(new Error(`Claude Code is not signed in on this computer, so ${name} could not answer. ${describeClaudeLoginSources(check)} ${claudeLoginFix()}`.replace(/\s+/g, " ").trim()), { expected: true });
+    const reason = `Claude Code is not signed in on this computer, so ${name} could not answer.`;
+    // The same `brainSignIn` shape list, status and start report, so the
+    // desktop app offers its own sign-in instead of showing a terminal command.
+    const brainSignIn = { provider: "claude", needed: true, reason, command: "claude /login" };
+    throw Object.assign(new Error(`${reason} ${describeClaudeLoginSources(check)} ${claudeLoginFix()}`.replace(/\s+/g, " ").trim()), { expected: true, brainSignIn });
 }
 export const botStopSeams = {
     /** True when this process runs inside the bot process `botPid` (one of its turns). */
@@ -1099,7 +1103,8 @@ export async function runBotCreate(nameArg, opts) {
         // there too, not only a line on stderr.
         if (opts.json && !err?.jsonReported) {
             const message = err instanceof Error ? err.message : String(err);
-            console.log(JSON.stringify({ ok: false, name: nameArg, reason: "create-failed", message }, null, 2));
+            const brainSignIn = err?.brainSignIn ?? null;
+            console.log(JSON.stringify({ ok: false, name: nameArg, reason: "create-failed", message, ...(brainSignIn ? { brainSignIn } : {}) }, null, 2));
         }
         throw err;
     }

package/dist/commands/capacity.js

@@ -1,3 +1,4 @@
+import { hasCodexCreditRoom } from "../lib/capacity/codex-availability.js";
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -98,7 +99,10 @@ export function formatCapacityTable(view, nowMs, accounts = []) {
     return view.providers.map((provider) => {
         const head = `${provider.provider}  ${provider.state}`;
         if (!provider.accounts || provider.accounts.length === 0) {
-            return `${head}\n${formatLimitTable(provider.limits, nowMs)}`;
+            const creditNote = provider.provider === "codex" && provider.state === "ok"
+                && provider.limits.some((limit) => limit.state === "exhausted")
+                ? " — usable on Codex credits" : "";
+            return `${head}${creditNote}\n${formatLimitTable(provider.limits, nowMs)}`;
         }
         const blocks = provider.accounts.map((account) => {
             const labels = account.labels.map((label) => {
@@ -112,7 +116,11 @@ export function formatCapacityTable(view, nowMs, accounts = []) {
                 const fix = presented.command ? formatRefreshLine(provider.provider, presented.command) : "";
                 return fix ? `${title}\n${reason}\n${fix}` : `${title}\n${reason}`;
             }
-            return `${title}\n${formatLimitTable(account.limits, nowMs)}`;
+            const creditNote = provider.provider === "codex"
+                && account.limits.some((limit) => limit.state === "exhausted")
+                && hasCodexCreditRoom(account.limits, nowMs)
+                ? " — usable on Codex credits (ranked last)" : "";
+            return `${title}${creditNote}\n${formatLimitTable(account.limits, nowMs)}`;
         });
         return [head, ...blocks].join("\n");
     }).join("\n\n");

package/dist/commands/cloud.d.ts

@@ -210,15 +210,27 @@ export declare function scopeExcludedWarning(count: number): string | null;
  * largest count it sees instead of a sum: a repeated emit for the same hold
  * cannot inflate the total. A missing, non-numeric or negative count reads as 0.
  */
+export interface IdentityHeldNotice {
+    count: number;
+    /** Plain-language hold from hq-cloud, when that build sends one. */
+    message?: string;
+}
 export declare function createIdentityHeldTracker(): {
     observe: (event: {
         type: string;
         count?: unknown;
+        message?: unknown;
+        reason?: unknown;
     }) => void;
     count: () => number;
+    notice: () => IdentityHeldNotice;
 };
-/** Recovery lines for files held by the account-switch push fence. */
-export declare function identityHeldLines(count: number): string[];
+/**
+ * Recovery lines for files held by the account-switch push fence.
+ * A newer hq-cloud sends `message` (file names and `hq sync release-held`).
+ * Older builds send a count only, and this keeps the previous sentence.
+ */
+export declare function identityHeldLines(count: number, notice?: Pick<IdentityHeldNotice, "message">): string[];
 /** Actionable recovery for files refused because the vault baseline is stale. */
 export declare function staleUploadRefusalLines(count: number, paths?: readonly string[]): string[];
 /**

package/dist/commands/cloud.js

@@ -500,19 +500,9 @@ export function scopeExcludedWarning(count) {
         `They were skipped, not synced. Re-run with --json to list them, or ` +
         `ask an admin to grant you write on those paths.`);
 }
-/**
- * Counts the files share() held back because this sync scope is fenced after an account
- * switch on this computer (feedback_a69e12ba). share() reports the hold only as
- * an `identity-switch-push-held` event and leaves the files out of every
- * result counter, so without this the push printed "Pushed 0 file(s) (0 B,
- * 0 skipped)" as a success while the vault kept the old copy.
- *
- * Each event carries the size of one fenced hold, so the tracker keeps the
- * largest count it sees instead of a sum: a repeated emit for the same hold
- * cannot inflate the total. A missing, non-numeric or negative count reads as 0.
- */
 export function createIdentityHeldTracker() {
     let held = 0;
+    let message;
     return {
         observe(event) {
             if (event.type !== "identity-switch-push-held")
@@ -521,12 +511,24 @@ export function createIdentityHeldTracker() {
                 ? Math.max(0, Math.trunc(event.count))
                 : 0;
             held = Math.max(held, n);
+            // A company rebind uses the same event type and keeps its own warning.
+            if (event.reason === "company-rebind")
+                return;
+            if (typeof event.message === "string" && event.message.trim())
+                message = event.message.trim();
         },
         count: () => held,
+        notice: () => ({ count: held, ...(message ? { message } : {}) }),
     };
 }
-/** Recovery lines for files held by the account-switch push fence. */
-export function identityHeldLines(count) {
+/**
+ * Recovery lines for files held by the account-switch push fence.
+ * A newer hq-cloud sends `message` (file names and `hq sync release-held`).
+ * Older builds send a count only, and this keeps the previous sentence.
+ */
+export function identityHeldLines(count, notice) {
+    if (notice?.message)
+        return [`⚠ ${notice.message}`];
     if (count <= 0)
         return [];
     return [
@@ -1566,7 +1568,7 @@ export function registerCloudCommands(program) {
                 for (const line of uploadFailedLines(uploadFailed.count, uploadFailed.paths)) {
                     log(chalk.yellow(line));
                 }
-                for (const line of identityHeldLines(identityHeldCount)) {
+                for (const line of identityHeldLines(identityHeldCount, identityHeld.notice())) {
                     log(chalk.yellow(line));
                 }
                 await syncHealth.succeeded();
@@ -1599,7 +1601,12 @@ export function registerCloudCommands(program) {
                 for (const line of uploadFailedLines(uploadFailed.count, uploadFailed.paths)) {
                     log(chalk.yellow(line));
                 }
-                for (const line of identityHeldLines(identityHeldCount)) {
+                for (const line of identityHeldLines(identityHeldCount, identityHeld.notice())) {
+                    log(chalk.yellow(line));
+                }
+            }
+            else if (identityHeld.notice().message) {
+                for (const line of identityHeldLines(identityHeldCount, identityHeld.notice())) {
                     log(chalk.yellow(line));
                 }
             }
@@ -2469,8 +2476,10 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         const pushRefused = planLimitTracker.summary();
         const pushUploadFailed = readUploadFailures(pushResult);
         const pushHeldCount = pushIdentityHeld.count();
+        const pushHeldNotice = pushIdentityHeld.notice();
         const pushStatus = pushResult.aborted ||
             pushHeldCount > 0 ||
+            Boolean(pushHeldNotice.message) ||
             pushResult.filesExcludedByScope > 0 ||
             (pushResult.filesRefusedStale ?? 0) > 0 ||
             pushUploadFailed.count > 0 ||
@@ -2498,7 +2507,7 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         for (const line of uploadFailedLines(pushUploadFailed.count, pushUploadFailed.paths)) {
             console.log(chalk.yellow(line));
         }
-        for (const line of identityHeldLines(pushHeldCount)) {
+        for (const line of identityHeldLines(pushHeldCount, pushHeldNotice)) {
             console.log(chalk.yellow(line));
         }
         if (pushResult.aborted) {

package/dist/commands/daemon.d.ts

@@ -4,7 +4,8 @@
  *   hq daemon                     status (same as `hq daemon status`)
  *   hq daemon install             detect the machine type, install the one OS unit
  *   hq daemon run                 what the OS unit runs; starts the default services
- *   hq daemon status [--json]
+ *   hq daemon start               load the OS unit if needed and start it
+ *   hq daemon status [--json]     includes whether the service manager runs it
  *   hq daemon logs [unit] [--follow] [--lines N]
  *   hq daemon restart [unit] | trigger <unit>
  *   hq daemon enable|disable <service...>   per-machine overrides

package/dist/commands/daemon.js

@@ -4,7 +4,8 @@
  *   hq daemon                     status (same as `hq daemon status`)
  *   hq daemon install             detect the machine type, install the one OS unit
  *   hq daemon run                 what the OS unit runs; starts the default services
- *   hq daemon status [--json]
+ *   hq daemon start               load the OS unit if needed and start it
+ *   hq daemon status [--json]     includes whether the service manager runs it
  *   hq daemon logs [unit] [--follow] [--lines N]
  *   hq daemon restart [unit] | trigger <unit>
  *   hq daemon enable|disable <service...>   per-machine overrides
@@ -24,7 +25,8 @@ import { DEFAULT_SERVICES, SERVICE_DESCRIPTIONS, enabledServices, hqCloudUnits }
 import { applyServiceToggle, effectiveSyncOwner, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
 import { daemonUnitInstalled } from "../lib/daemon/handoff.js";
 import { adoptLegacyUnits, readAdoptedUnits, restoreLegacyUnits } from "../lib/daemon/migrate.js";
-import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, WINDOWS_START_WAIT_MS, daemonRootRefusal, installDaemonUnit, installScopeFor, classifyWindowsTask, legacyWindowsTask, readWindowsSid, uninstallDaemonUnit, windowsInteractiveSession, windowsTaskName, } from "../lib/daemon/install.js";
+import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, WINDOWS_START_WAIT_MS, daemonRootRefusal, installDaemonUnit, installScopeFor, classifyWindowsTask, daemonServiceStatus, describeSupervision, legacyWindowsTask, startDaemonUnit, readWindowsSid, uninstallDaemonUnit, windowsInteractiveSession, windowsTaskName, } from "../lib/daemon/install.js";
+import { PLIST_REFRESH_MARKER } from "../lib/daemon/plist-refresh.js";
 import { describeLegacyUnit, findLegacyUnits } from "../lib/daemon/legacy.js";
 import { isDaemonProcess, liveDaemonLock, runningDaemonPid } from "../lib/daemon/lock.js";
 import { bundledHqCloud, managedHqCloud, managedHqCloudRoot, readHqCloudCopy, readHqCloudUpdateState } from "../lib/daemon/hq-cloud.js";
@@ -438,28 +440,126 @@ function formatUnit(u) {
     const restarts = u.restarts > 0 ? ` (restarted ${u.restarts}x)` : "";
     return `  ${u.id.padEnd(40)} ${u.status.padEnd(12)} ${detail}${restarts}`;
 }
+/**
+ * True when the daemon holding the lock is the one the desktop app hosts.
+ * state.json outlives the daemon that wrote it, and a new daemon writes its own
+ * only after starting up, so a `host: "desktop"` left by an earlier app-hosted
+ * daemon counts only when its pid is the lock holder's.
+ */
+function hostedByDesktop(state, lockPid) {
+    return lockPid !== null && state?.host === "desktop" && state.pid === lockPid;
+}
+/**
+ * The service manager's warnings, plus where the automatic plist rewrite
+ * logged when it was tried and the plist still needs it.
+ */
+function statusWarnings(service, paths) {
+    const warnings = [...(service.warnings ?? [])];
+    if (warnings.length > 0 && fs.existsSync(path.join(paths.root, PLIST_REFRESH_MARKER))) {
+        warnings.push(`The daemon tried to rewrite it automatically and did not finish. See: ${path.join(paths.root, "logs", "plist-refresh.log")}`);
+    }
+    return warnings;
+}
 async function runStatus(d, opts) {
     const host = currentHost(d);
     const { paths } = host;
     const pid = runningDaemonPid(paths.lockPath, d.daemonAlive);
     const state = pid ? readState(paths) : null;
     const config = readDaemonConfig(paths.configPath);
+    // The pid lock alone says nothing about whether the daemon comes back after
+    // a crash or a login: ask the service manager too.
+    const service = daemonServiceStatus(hostFor(d, paths, false), d.run, pid);
+    // A daemon hosted by the desktop app is supervised by the app, not the OS.
+    const hosted = hostedByDesktop(state, pid);
     if (opts.json) {
-        d.out(JSON.stringify({ running: pid !== null, pid, machineType: state?.machineType ?? config.machineType ?? null, units: state?.units ?? [] }, null, 2));
+        d.out(JSON.stringify({
+            running: pid !== null,
+            pid,
+            supervision: hosted && service.supervision === "unmanaged" ? "desktop-app" : service.supervision,
+            serviceManager: {
+                manager: service.manager,
+                unitInstalled: service.unitInstalled,
+                loaded: service.loaded,
+                active: service.active,
+                pid: service.managerPid ?? null,
+                detail: service.detail,
+            },
+            warnings: statusWarnings(service, paths),
+            machineType: state?.machineType ?? config.machineType ?? null,
+            units: state?.units ?? [],
+        }, null, 2));
         return;
     }
+    const managerLine = hosted && service.supervision === "unmanaged"
+        ? `Service manager: running as the HQ desktop app's child (${service.detail}).`
+        : `Service manager: ${describeSupervision(service)}.`;
+    const warnings = statusWarnings(service, paths).map((w) => `Warning: ${w}`);
     if (!pid || !state) {
         const { detected } = host;
         d.out(`hq daemon is not running. Machine type: ${detected.type} (${detected.detail}).`);
+        d.out(managerLine);
+        for (const line of warnings)
+            d.out(line);
         d.out("Default services for this machine:");
         for (const line of describeServices(detected.type, config))
             d.out(line);
         return;
     }
     d.out(`hq daemon is running (pid ${pid}) on a ${state.machineType} machine.`);
+    d.out(managerLine);
+    for (const line of warnings)
+        d.out(line);
     for (const u of state.units)
         d.out(formatUnit(u));
 }
+async function runStart(d) {
+    const host = currentHost(d);
+    const { paths } = host;
+    const pid = runningDaemonPid(paths.lockPath, d.daemonAlive);
+    // The desktop app hosts this daemon and restarts it itself. Loading the OS
+    // unit now would start a second daemon that exits on the lock and is
+    // respawned until the app quits.
+    if (hostedByDesktop(readState(paths), pid)) {
+        d.out(`hq daemon is running (pid ${pid}) inside the desktop app, which restarts it. ` +
+            "Nothing to start. To run it under the service manager instead, quit the app, then run: hq daemon start");
+        return;
+    }
+    const before = daemonServiceStatus(hostFor(d, paths, false), d.run, pid);
+    if (!before.unitInstalled && before.manager !== "none") {
+        // Nothing to load: install writes the unit, loads it and starts it.
+        d.out("hq daemon is not installed here yet; installing it.");
+        await runInstall(d, {});
+        return;
+    }
+    const result = startDaemonUnit(hostFor(d, paths, false), {
+        run: d.run,
+        sleep: d.sleep,
+        daemonPid: () => runningDaemonPid(paths.lockPath, d.daemonAlive),
+    });
+    handOver(d, host);
+    const refresh = result.refresh;
+    if (refresh?.action === "rewritten" || refresh?.action === "reloaded") {
+        d.out(`Rewrote ${refresh.plistPath} so launchd loads the daemon at login without HQ.app.`);
+    }
+    if (refresh?.error)
+        d.err(`warning: ${refresh.error}`);
+    if (result.action === "already-running") {
+        d.out(`hq daemon is already running (pid ${result.status.daemonPid}) under the service manager.`);
+        return;
+    }
+    if (result.status.supervision !== "managed" || result.status.daemonPid === null) {
+        const what = result.action === "loaded"
+            ? "Loaded the daemon's unit"
+            : result.action === "reloaded"
+                ? "Reloaded the daemon's unit"
+                : "Asked the service manager to start the daemon";
+        const why = result.status.supervision === "managed"
+            ? `no daemon took the lock within 15 seconds (${result.status.detail})`
+            : `it is ${describeSupervision(result.status)}`;
+        throw new DaemonCommandError(`${what}, but ${why}. See: hq daemon logs`);
+    }
+    d.out(`${result.action === "loaded" ? "Loaded and started" : result.action === "reloaded" ? "Reloaded and started" : "Started"} hq daemon (pid ${result.status.daemonPid}) under the service manager.`);
+}
 function tailLines(file, lines) {
     const text = fs.readFileSync(file, "utf8");
     return text.split("\n").filter((l, i, all) => i < all.length - 1 || l !== "").slice(-lines);
@@ -886,7 +986,26 @@ async function runMigrate(d, opts) {
         if (!installed) {
             throw new DaemonCommandError("hq daemon is not installed here yet. Run `hq daemon install` first, then `hq daemon migrate --apply`.");
         }
-        const result = adoptLegacyUnits(units, migrateDeps(d, host.paths, host.runAsUser));
+        // The daemon starts the adopted services, so its own unit must be loaded
+        // before the older units are booted out (an installed but unloaded plist
+        // would leave every adopted service off until the next manual start).
+        const ensureDaemonLoaded = (when) => {
+            const daemonPid = () => runningDaemonPid(host.paths.lockPath, d.daemonAlive);
+            const status = daemonServiceStatus(hostFor(d, host.paths, false), d.run, daemonPid());
+            if (status.loaded || status.manager === "none")
+                return;
+            try {
+                startDaemonUnit(hostFor(d, host.paths, false), { run: d.run, sleep: d.sleep, daemonPid, waitMs: 0 });
+                d.out(`Loaded the daemon's unit ${when}.`);
+            }
+            catch (err) {
+                throw new DaemonCommandError(`The daemon's unit is not loaded and could not be loaded ${when}: ${err.message}`);
+            }
+        };
+        ensureDaemonLoaded("before taking over the older units");
+        const result = adoptLegacyUnits(units, { ...migrateDeps(d, host.paths, host.runAsUser), sleep: d.sleep });
+        if (result.adopted.length > 0)
+            ensureDaemonLoaded("after taking over the older units");
         handOver(d, host);
         for (const a of result.adopted)
             d.out(`Took over ${a.unitId} from ${describeLegacyUnit(a)}`);
@@ -1306,6 +1425,68 @@ async function runServiceCodexRemoteControl(d, opts) {
         watch: codex,
     });
 }
+/**
+ * DM the person signed in on this machine (the machine owner) through the
+ * same route as `hq dm`. A machine identity (agent box) has no person to tell.
+ */
+/**
+ * Which engine vaults the self-check reports, and their names: a vault skipped
+ * in ~/.hq/sync-core/skip.json or not on the rollout recorded in rollout.json
+ * is kept on the old sync on purpose, so a hold left over for it is not an outage.
+ */
+async function selfCheckVaults(home) {
+    const [{ readSyncCoreSkips }, { readSyncCoreRolloutState }] = await Promise.all([
+        import("../lib/sync-core/skip.js"),
+        import("../lib/sync-core/rollout-state.js"),
+    ]);
+    let skipped = new Set();
+    try {
+        skipped = new Set(readSyncCoreSkips(home).map((s) => s.uid));
+    }
+    catch {
+        // An unreadable skip list skips nothing here; the reconcile reports it.
+    }
+    let rollout = null;
+    try {
+        rollout = readSyncCoreRolloutState(home);
+    }
+    catch {
+        // No rollout file: every vault counts.
+    }
+    const onRollout = rollout ? new Map(rollout.vaults.map((v) => [v.uid, v])) : null;
+    return {
+        wanted: (uid) => !skipped.has(uid) && (onRollout === null || onRollout.has(uid)),
+        vaultName: (uid) => {
+            const v = onRollout?.get(uid);
+            if (!v)
+                return undefined;
+            return v.kind === "personal" ? "your personal vault" : v.slug;
+        },
+    };
+}
+async function sendDmToMachineOwner(message) {
+    const [{ ensureCognitoToken }, { agentUidFromToken, resolveCallerPersonUid, vaultApiFetch }] = await Promise.all([
+        import("../utils/cognito-session.js"),
+        import("../utils/vault-api.js"),
+    ]);
+    const token = await ensureCognitoToken();
+    // An agent box has no person signed in, and the server does not deliver a
+    // DM an agent sends itself: there is no owner to reach from here.
+    if (agentUidFromToken(token))
+        return null;
+    const personUid = await resolveCallerPersonUid(token, undefined, { command: "hq daemon service sync-core-selfcheck" });
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/notify/dm",
+        method: "POST",
+        body: { toPersonUid: personUid, body: message.body, details: message.details },
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new DaemonCommandError(`could not send the self-check DM: HTTP ${res.status} ${err.code ?? ""} ${err.error ?? err.message ?? ""}`.trim());
+    }
+    return personUid;
+}
 export function registerDaemonCommand(program, over = {}) {
     let resolved = null;
     const deps = () => (resolved ??= loadDefaults(over));
@@ -1330,6 +1511,10 @@ export function registerDaemonCommand(program, over = {}) {
         .option("--hq-root <path>", "HQ folder the services work against")
         .option("--user <login>", "on a box: the login user the daemon runs as (never root)")
         .action(wrap((d, opts) => runInstall(d, opts)));
+    daemon
+        .command("start")
+        .description("Load the daemon's OS unit if the service manager does not have it, and start it")
+        .action(wrap((d) => runStart(d)));
     daemon
         .command("uninstall")
         .description("Stop the daemon and remove its OS unit")
@@ -1601,6 +1786,42 @@ export function registerDaemonCommand(program, over = {}) {
             err: d.err,
         });
     }));
+    service
+        .command("sync-core-selfcheck")
+        .description("DM the person signed in here when a sync engine unit has been held or failing for over 30 minutes (at most daily per unit set)")
+        .action(wrap(async (d) => {
+        const [{ runSelfCheck }, { readUnitHolds }] = await Promise.all([
+            import("../lib/daemon/selfcheck.js"),
+            import("../lib/daemon/unit-holds.js"),
+        ]);
+        const { paths } = currentHost(d);
+        await runSelfCheck({
+            statePath: paths.statePath,
+            holdsPath: paths.holdsPath,
+            recordPath: path.join(paths.root, "selfcheck.json"),
+            now: Date.now,
+            machine: os.hostname(),
+            readState: () => {
+                try {
+                    return readState(paths);
+                }
+                catch {
+                    return null;
+                }
+            },
+            readHolds: () => {
+                try {
+                    return readUnitHolds(paths.holdsPath);
+                }
+                catch {
+                    return {};
+                }
+            },
+            sendToOwner: (message) => sendDmToMachineOwner(message),
+            ...(await selfCheckVaults(d.home)),
+            log: (line) => d.out(line),
+        });
+    }));
     service
         .command("sync-core-manifest")
         .description("Upload the sync-audit manifest for every vault the new sync engine owns on this machine")

package/dist/commands/integrations-core.d.ts

@@ -8,6 +8,7 @@
  * Sentry live in exactly one place. `integrations.ts` re-exports this module's
  * public surface, so existing importers keep working unchanged.
  */
+import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 export { bareProvider } from "../lib/integrations/provider-slug.js";
 /** Write policy on a connection — mirrors hq-pro's `WritePolicy`. */
 export type WritePolicy = "auto-allow" | "confirm" | "deny";
@@ -415,4 +416,6 @@ export declare function selectAccountConnections(connections: readonly AdminConn
     account: string;
     provider?: string;
 }): AdminConnection[];
+/** A runner-selected session must never fall back to a cached human identity. */
+export declare function ensureIntegrationIdToken(options?: Parameters<typeof ensureCognitoIdToken>[0]): Promise<string>;
 //# sourceMappingURL=integrations-core.d.ts.map

package/dist/commands/integrations-core.js

@@ -9,6 +9,8 @@
  * public surface, so existing importers keep working unchanged.
  */
 import { randomUUID } from "node:crypto";
+import { delegatedMachineSessionFilePath, loadDelegatedMachineSession, getValidMachineTokens } from "@indigoai-us/hq-cloud";
+import { DEFAULT_COGNITO, ensureCognitoIdToken } from "../utils/cognito-session.js";
 import chalk from "chalk";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { AuthError } from "../utils/auth-error.js";
@@ -991,4 +993,13 @@ export function selectAccountConnections(connections, opts) {
     }
     return matches;
 }
+/** A runner-selected session must never fall back to a cached human identity. */
+export async function ensureIntegrationIdToken(options) {
+    if (delegatedMachineSessionFilePath() !== null) {
+        if (!loadDelegatedMachineSession())
+            throw new Error("HQ_MACHINE_SESSION_FILE is not a usable delegated session; the job runner must rewrite it.");
+        return (await getValidMachineTokens(DEFAULT_COGNITO)).idToken;
+    }
+    return options === undefined ? ensureCognitoIdToken() : ensureCognitoIdToken(options);
+}
 //# sourceMappingURL=integrations-core.js.map

package/dist/commands/integrations-manage.js

@@ -71,10 +71,10 @@ export function parsePrincipal(raw) {
         return { granteeType: "group", granteeId: value };
     // Agents are people to the ACL: they hold an identity and a membership, so a
     // grant to `agt_…` is a person grant, not a separate grantee kind.
-    if (/^(prs|psn|agt)_[A-Za-z0-9_-]+$/i.test(value)) {
+    if (/^(prs|psn|agt|out)_[A-Za-z0-9_-]+$/i.test(value)) {
         return { granteeType: "person", granteeId: value };
     }
-    throw new IntegrationsCliError(`Could not tell what '${raw}' refers to. Use an email address, a uid (prs_… / agt_… / grp_…), \`everyone\`, or an explicit \`person:<id>\` / \`group:<id>\` form.`, { expected: true });
+    throw new IntegrationsCliError(`Could not tell what '${raw}' refers to. Use an email address, a uid (prs_… / agt_… / out_… / grp_…), \`everyone\`, or an explicit \`person:<id>\` / \`group:<id>\` form.`, { expected: true });
 }
 /** `--with` / `--to` / `--from` help. Groups resolve membership at call time. */
 export const PRINCIPAL_HELP = "Email, uid, vault group (grp_…), or `everyone`";