@indigoai-us/hq-cli 5.345.33 → 5.345.34

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.345.34] — 2026-10-07
+- Protect live remote-control tmux sessions with socket-scoped creator identity before cleanup.
+
+- Cap the shipped hook health checker at 20 seconds when hq reindex runs from a lifecycle hook while keeping the 60-second interactive bound.
+- Allow each company to configure its lane depth cap from 1 through 8. Invalid values fall back to the default cap of 4 with a stderr warning.
+- Mesh services now use the stable HQ launcher after package updates or relocation. Failed service-file replacement or reload restores the previous unit.
+
 ## [5.345.33] — 2026-10-06
 - Map each PRD ledger state to a Board column and send its original value in `ledgerState`; `hq mesh project reconcile` reports status drift and notes when the Board omits that field.
 

package/dist/commands/cloud-provision.d.ts

@@ -47,6 +47,8 @@ export interface CompanyConfig {
     companySlug: string;
     bucketName: string;
     vaultApiUrl: string;
+    /** Optional per-company worker lane depth limit (1 through 8). */
+    maxLaneDepth?: number;
 }
 /** Final stdout JSON shape. Consumers (designate-team, AppBar) parse this. */
 export interface ProvisionResult {

package/dist/commands/lanes.js

@@ -33,6 +33,7 @@ import { registerLaneReviewCommand } from "./lanes-review.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
+import { laneDepthCap } from "../lib/lanes/depth-cap.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 import { readLanesFlagLocalOverride, readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "../lib/lanes/registry-flag.js";
@@ -2070,12 +2071,12 @@ function seniorLaneChain(hqRoot, ref, ctx, visited = new Set(), override) {
     const depth = isOverridden ? override.depth : derivedLaneDepth(hqRoot, lane.senior, ctx, override);
     return [...prefix, { lane_id: lane.lane_id, depth }];
 }
-function maxLaneDepthError(depth, chain, description, extraDetails = {}) {
-    const parentLane = [...chain].reverse().find((entry) => entry.depth < MAX_LANE_DEPTH);
+function maxLaneDepthError(depth, chain, description, cap, extraDetails = {}) {
+    const parentLane = [...chain].reverse().find((entry) => entry.depth < cap.max);
     const nextStep = parentLane
         ? `Ask your senior lane ${parentLane.lane_id} to create this worker instead, or re-parent this lane under a shallower senior.`
         : "Ask a shallower senior to create this lane, or re-parent it to a shallower senior.";
-    return new LanesError("max_lane_depth", `${description}: senior chain length ${depth} exceeds cap ${MAX_LANE_DEPTH}`, { ...extraDetails, depth, max: MAX_LANE_DEPTH, senior_chain: chain, next_step: nextStep });
+    return new LanesError("max_lane_depth", `${description}: senior chain length ${depth} exceeds cap ${cap.max} (${cap.source === "company" ? "company config" : "default config"})`, { ...extraDetails, depth, max: cap.max, source: cap.source, senior_chain: chain, next_step: nextStep });
 }
 function callerDepth(hqRoot, ctx) {
     const laneId = ctx.env.HQ_LANE_ID?.trim();
@@ -3068,21 +3069,22 @@ async function runCreate(ctx, opts) {
         }
         assertKnownOutpost(requested, known);
     }
+    let company = companyFlag
+        ? await ctx.resolveCompany(companyFlag)
+        : null;
+    const depthCap = laneDepthCap(hqRoot, company?.slug);
     const depth = callerDepth(hqRoot, ctx);
-    if (depth >= MAX_LANE_DEPTH) {
+    if (depth >= depthCap.max) {
         const callerLaneId = ctx.env.HQ_LANE_ID?.trim();
         const chain = callerLaneId
             ? seniorLaneChain(hqRoot, { kind: "lane", id: callerLaneId }, ctx)
             : seniorLaneChain(hqRoot, sessionIdFromEnv(ctx.env)
                 ? { kind: "session", id: sessionIdFromEnv(ctx.env) }
                 : { kind: "user" }, ctx);
-        throw maxLaneDepthError(depth + 1, chain, `A depth-${depth} caller may not spawn a depth-${depth + 1} lane`);
+        throw maxLaneDepthError(depth + 1, chain, `A depth-${depth} caller may not spawn a depth-${depth + 1} lane`, depthCap);
     }
     const senior = opts.senior ? parseSeniorRef(opts.senior) : defaultSenior(ctx);
     assertSeniorExists(hqRoot, senior, ctx);
-    let company = companyFlag
-        ? await ctx.resolveCompany(companyFlag)
-        : null;
     const seniorCompany = companyOfSenior(hqRoot, senior, ctx);
     if (company === null && seniorCompany.binding === "company") {
         const seniorCompanyIdentifier = seniorCompany.slug ?? (seniorCompany.uid
@@ -3104,8 +3106,8 @@ async function runCreate(ctx, opts) {
     }
     const hireGrant = requestedHireGrant ?? 0;
     const laneDepth = derivedLaneDepth(hqRoot, senior, ctx);
-    if (laneDepth > MAX_LANE_DEPTH) {
-        throw maxLaneDepthError(laneDepth, seniorLaneChain(hqRoot, senior, ctx), `Creating lane at depth ${laneDepth} is refused`);
+    if (laneDepth > depthCap.max) {
+        throw maxLaneDepthError(laneDepth, seniorLaneChain(hqRoot, senior, ctx), `Creating lane at depth ${laneDepth} is refused`, depthCap);
     }
     // A no-company lane must not call company resolution (openMeshTransport).
     if (storyIds.length > 0 && ctx.storyLedgerEnabled()) {
@@ -7249,10 +7251,11 @@ function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false
         throw new LanesError("senior_cycle", `Re-parent would create a cycle through ${laneId}`, { lane_id: laneId, senior: nextSenior });
     }
     const newDepth = derivedLaneDepth(hqRoot, nextSenior, ctx);
-    if (newDepth > MAX_LANE_DEPTH) {
+    const depthCap = laneDepthCap(hqRoot, lane.company?.slug);
+    if (newDepth > depthCap.max) {
         const chain = seniorLaneChain(hqRoot, nextSenior, ctx);
         chain.push({ lane_id: lane.lane_id, depth: newDepth });
-        throw maxLaneDepthError(newDepth, chain, `Re-parent would put lane at depth ${newDepth}`);
+        throw maxLaneDepthError(newDepth, chain, `Re-parent would put lane at depth ${newDepth}`, depthCap);
     }
     const pending = pendingQuestionsForLane(hqRoot, laneId);
     const oldDepth = derivedLaneDepth(hqRoot, lane.senior, ctx);
@@ -7269,10 +7272,11 @@ function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false
         assertLaneRunsHereForOperatorMutation(ctx, other, "reparent descendant of");
         const oldDescendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx);
         const descendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx, override);
-        if (descendantDepth > MAX_LANE_DEPTH) {
+        const descendantCap = laneDepthCap(hqRoot, other.company?.slug);
+        if (descendantDepth > descendantCap.max) {
             const chain = seniorLaneChain(hqRoot, other.senior, ctx, new Set(), override);
             chain.push({ lane_id: other.lane_id, depth: descendantDepth });
-            throw maxLaneDepthError(descendantDepth, chain, `Re-parent would put descendant ${other.lane_id} at depth ${descendantDepth}`, { lane_id: other.lane_id });
+            throw maxLaneDepthError(descendantDepth, chain, `Re-parent would put descendant ${other.lane_id} at depth ${descendantDepth}`, descendantCap, { lane_id: other.lane_id });
         }
         if (descendantDepth > oldDescendantDepth &&
             pendingQuestionsForLane(hqRoot, other.lane_id).length > 0) {

package/dist/commands/reindex.js

@@ -47,6 +47,9 @@ const WORKTREE_HOOK_SWEEP_BUDGET_MS = 5_000;
  * bounded, which is the point.
  */
 const HOOK_CHECK_TIMEOUT_MS = 60_000;
+// Leave ten seconds inside the desktop's 30-second package-lease wait for
+// process startup and cleanup when reindex runs from a lifecycle hook.
+const HOOK_CHECK_FROM_HOOK_TIMEOUT_MS = 20_000;
 /** Ceiling override, in milliseconds. Present so tests need not wait a minute. */
 function hookCheckTimeoutMs() {
     const raw = process.env.HQ_HOOK_CHECK_TIMEOUT_MS?.trim();
@@ -367,11 +370,11 @@ function hasCommandHook(value) {
  * an older, unscoped checker — report healthy while the drift only this checker
  * detects goes unseen.
  */
-function runShippedHookCheck(hqRoot) {
+function runShippedHookCheck(hqRoot, timeoutLimitMs) {
     const checker = path.join(hqRoot, HOOK_CHECK_RELATIVE_PATH);
     if (!fs.existsSync(checker))
         return undefined;
-    const budgetMs = hookCheckTimeoutMs();
+    const budgetMs = Math.min(hookCheckTimeoutMs(), timeoutLimitMs ?? Number.POSITIVE_INFINITY);
     try {
         const result = spawnSync('bash', [checker, '--root', hqRoot], {
             encoding: 'utf8',
@@ -406,7 +409,7 @@ function runShippedHookCheck(hqRoot) {
  * reindex fires on every Stop / PostToolUse hook, that was the single most
  * expensive discarded result in the command.
  */
-function inspectHookHealth(hqRoot) {
+function inspectHookHealth(hqRoot, timeoutLimitMs) {
     const settingsPath = path.join(hqRoot, '.claude', 'settings.json');
     if (!fs.existsSync(settingsPath)) {
         return { state: 'extreme', reason: '.claude/settings.json is missing' };
@@ -435,7 +438,7 @@ function inspectHookHealth(hqRoot) {
             reason: `missing command hook wiring for ${HOOK_EVENTS.filter((event) => !commandEvents.includes(event)).join(', ')}`,
         };
     }
-    const checkerResult = runShippedHookCheck(hqRoot);
+    const checkerResult = runShippedHookCheck(hqRoot, timeoutLimitMs);
     if (checkerResult !== undefined && checkerResult.status !== 0) {
         return {
             state: 'minor',
@@ -491,12 +494,12 @@ function runSilently(operation) {
  * configuration is repaired only after a successful reindex; partial and
  * malformed configurations remain untouched and receive recovery guidance.
  */
-function repairExtremeHookDrift(hqRoot, allowRepair = true) {
+function repairExtremeHookDrift(hqRoot, allowRepair = true, timeoutLimitMs) {
     // `hq reindex` can still be invoked from an arbitrary directory. Never turn
     // an absent settings file there into a rescue attempt.
     if (!isHqRoot(hqRoot))
         return;
-    const health = inspectHookHealth(hqRoot);
+    const health = inspectHookHealth(hqRoot, timeoutLimitMs);
     if (health.state === 'healthy')
         return;
     printHookHealthWarning(hqRoot, health.reason);
@@ -510,7 +513,7 @@ function repairExtremeHookDrift(hqRoot, allowRepair = true) {
             paths: ['.claude'],
             assumeYes: true,
         }));
-        const afterRepair = inspectHookHealth(hqRoot);
+        const afterRepair = inspectHookHealth(hqRoot, timeoutLimitMs);
         if (result.status === 0 && afterRepair.state === 'healthy') {
             console.log('reindex: repaired HQ hook config');
             return;
@@ -691,7 +694,7 @@ export function registerReindexCommand(program) {
         const sweepStartedAt = Date.now();
         removeStaleHqWorktrees(hqRoot, sweepStartedAt, opts.fromHook ? sweepStartedAt + WORKTREE_HOOK_SWEEP_BUDGET_MS : Number.POSITIVE_INFINITY);
         const { status } = reindex({ repoRoot: opts.repoRoot });
-        repairExtremeHookDrift(hqRoot, status === 0);
+        repairExtremeHookDrift(hqRoot, status === 0, opts.fromHook ? HOOK_CHECK_FROM_HOOK_TIMEOUT_MS : undefined);
         if (status === 0) {
             // Only safe once reindex actually ran: a refused --from-hook reindex
             // means a sync/rescue holds the shared operation lock and may be

package/dist/lib/daemon/remote-control.js

@@ -24,6 +24,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 const TMUX_SOCKET = "hq-daemon";
+const TMUX_CREATOR_OPTION = "@hq-remote-control-creator";
 export const TMUX_SESSION = "remote-control";
 export const CODEX_TMUX_SESSION = "codex-remote-control";
 export function remoteControlArgs(opts) {
@@ -204,7 +205,56 @@ function safePaneTail(output) {
 }
 export async function runRemoteControlHost(deps) {
     const tmux = (...args) => deps.run(deps.tmux, ["-L", TMUX_SOCKET, ...args]);
-    const killSession = () => tmux("kill-session", "-t", deps.session);
+    const invokerPid = process.pid;
+    const killSession = () => {
+        if (tmux("has-session", "-t", deps.session).status !== 0)
+            return true;
+        const rawCreator = tmux("show-option", "-qv", "-t", deps.session, TMUX_CREATOR_OPTION);
+        let creator = null;
+        let legacyRecordReason = "no creator record";
+        if (rawCreator.status === 0 && rawCreator.stdout.trim() !== "") {
+            try {
+                const value = JSON.parse(rawCreator.stdout);
+                if (Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.cwd === "string") {
+                    creator = { pid: value.pid, cwd: value.cwd };
+                }
+                else {
+                    legacyRecordReason = "malformed creator record";
+                }
+            }
+            catch {
+                legacyRecordReason = "malformed creator record";
+            }
+        }
+        else if (rawCreator.status !== 0) {
+            legacyRecordReason = "malformed creator record";
+        }
+        if (!creator) {
+            deps.log(`remote-control tmux session has ${legacyRecordReason}; using bridge-owner liveness fallback; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+            const owner = foreignClaudeOwner(deps);
+            if (owner !== null) {
+                deps.log(`remote-control refused to kill legacy tmux session with live Claude bridge owner pid=${owner}; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+                return false;
+            }
+            const panePid = tmux("display-message", "-p", "-t", deps.session, "#{pane_pid}");
+            const paneCwd = tmux("display-message", "-p", "-t", deps.session, "#{pane_current_path}");
+            const victimPid = panePid.status === 0 && /^\d+$/.test(panePid.stdout.trim())
+                ? panePid.stdout.trim()
+                : "unknown";
+            const victimCwd = paneCwd.status === 0 && paneCwd.stdout.trim() !== ""
+                ? paneCwd.stdout.trim()
+                : "unknown";
+            deps.log(`remote-control kill tmux session victim pid=${victimPid} cwd=${JSON.stringify(victimCwd)} invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+            return tmux("kill-session", "-t", deps.session).status === 0;
+        }
+        const sameInvoker = creator.pid === invokerPid && creator.cwd === deps.cwd;
+        if (!sameInvoker && (deps.pidAlive ?? processAlive)(creator.pid)) {
+            deps.log(`remote-control refused to kill live tmux session creator pid=${creator.pid} cwd=${JSON.stringify(creator.cwd)}; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+            return false;
+        }
+        deps.log(`remote-control kill tmux session victim pid=${creator.pid} cwd=${JSON.stringify(creator.cwd)} invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+        return tmux("kill-session", "-t", deps.session).status === 0;
+    };
     /** When the session last printed anything, in ms; null when tmux cannot say. */
     const lastActivity = () => {
         const r = tmux("display-message", "-p", "-t", deps.session, "#{window_activity}");
@@ -213,7 +263,8 @@ export async function runRemoteControlHost(deps) {
     };
     // Remove this daemon's leftover private session before checking the process
     // pointer, so its previous command is not mistaken for a foreign owner.
-    killSession();
+    if (!killSession())
+        return 1;
     let waitingFor = null;
     for (;;) {
         if (deps.signal.aborted)
@@ -233,6 +284,14 @@ export async function runRemoteControlHost(deps) {
         deps.log(`could not create the tmux session: ${created.stderr.trim() || `tmux exited ${created.status}`}`);
         return 1;
     }
+    const creatorRecord = JSON.stringify({ pid: invokerPid, cwd: deps.cwd });
+    const recorded = tmux("set-option", "-t", deps.session, TMUX_CREATOR_OPTION, creatorRecord);
+    if (recorded.status !== 0) {
+        deps.log(`remote-control could not record session creator; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+        deps.log(`remote-control kill tmux session victim pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)} invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+        tmux("kill-session", "-t", deps.session);
+        return 1;
+    }
     const retained = tmux("set-window-option", "-t", deps.session, "remain-on-exit", "on");
     const started = retained.status === 0
         ? tmux("respawn-pane", "-k", "-t", deps.session, ...deps.argv)
@@ -242,7 +301,7 @@ export async function runRemoteControlHost(deps) {
         deps.log(`could not start the tmux session: ${started.stderr.trim() || `tmux exited ${started.status}`}`);
         return 1;
     }
-    deps.log(`${deps.label} started in ${deps.cwd}`);
+    deps.log(`${deps.label} started in ${JSON.stringify(deps.cwd)} (creator pid ${invokerPid})`);
     const startedWith = deps.binaryFingerprint();
     let updatedAt = null;
     for (;;) {

package/dist/lib/index-render/shared.d.ts

@@ -28,7 +28,9 @@ export declare function titleize(slug: string): string;
 export declare function date(now?: Date): string;
 export declare function timestamp(now?: Date): string;
 /** Write via a same-directory temporary file, then atomically replace the destination. */
-export declare function atomicWrite(file: string, content: string): void;
+export declare function atomicWrite(file: string, content: string | Buffer, options?: {
+    mode?: number;
+}): void;
 export declare function write(context: RenderContext, relative: string, content: string): string;
 /** Drop keep fences, the generated stamp, and the rolling date so two generated bodies can be compared. */
 export declare function generatedFingerprint(content: string): string;

package/dist/lib/index-render/shared.js

@@ -78,11 +78,14 @@ export function titleize(slug) {
 export function date(now = new Date()) { return now.toISOString().slice(0, 10); }
 export function timestamp(now = new Date()) { return now.toISOString().replace(/\.\d{3}Z$/, "Z"); }
 /** Write via a same-directory temporary file, then atomically replace the destination. */
-export function atomicWrite(file, content) {
+export function atomicWrite(file, content, options = {}) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`);
     try {
-        fs.writeFileSync(temporary, content, "utf8");
+        if (typeof content === "string")
+            fs.writeFileSync(temporary, content, { encoding: "utf8", mode: options.mode });
+        else
+            fs.writeFileSync(temporary, content, { mode: options.mode });
         fs.renameSync(temporary, file);
     }
     catch (error) {

package/dist/lib/lanes/depth-cap.d.ts

@@ -0,0 +1,7 @@
+export interface LaneDepthCap {
+    max: number;
+    source: "default" | "company";
+}
+/** Read the optional maxLaneDepth from companies/<slug>/.hq/config.json. */
+export declare function laneDepthCap(hqRoot: string, companySlug?: string | null): LaneDepthCap;
+//# sourceMappingURL=depth-cap.d.ts.map

package/dist/lib/lanes/depth-cap.js

@@ -0,0 +1,41 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { LanesError } from "./errors.js";
+import { MAX_LANE_DEPTH } from "./constants.js";
+/** Read the optional maxLaneDepth from companies/<slug>/.hq/config.json. */
+export function laneDepthCap(hqRoot, companySlug) {
+    if (!companySlug)
+        return { max: MAX_LANE_DEPTH, source: "default" };
+    if (!/^[a-z0-9][a-z0-9_-]*$/.test(companySlug)) {
+        throw new LanesError("lane_depth_config_invalid", `Invalid company slug for lane depth config: ${JSON.stringify(companySlug)}`, { company: companySlug });
+    }
+    const file = path.join(hqRoot, "companies", companySlug, ".hq", "config.json");
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { max: MAX_LANE_DEPTH, source: "default" };
+        throw new LanesError("lane_depth_config_unreadable", `Failed to read company lane depth config ${file}: ${err instanceof Error ? err.message : String(err)}`, { company: companySlug, path: file });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new LanesError("lane_depth_config_invalid", `Invalid JSON in company config ${file}: ${err instanceof Error ? err.message : String(err)}`, { company: companySlug, path: file });
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new LanesError("lane_depth_config_invalid", `Company config ${file} must be a JSON object`, { company: companySlug, path: file });
+    }
+    const value = parsed.maxLaneDepth;
+    if (value === undefined)
+        return { max: MAX_LANE_DEPTH, source: "default" };
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 8) {
+        process.stderr.write(`hq lanes: lane_depth_cap_invalid company=${companySlug} maxLaneDepth=${JSON.stringify(value)}; using default ${MAX_LANE_DEPTH}\n`);
+        return { max: MAX_LANE_DEPTH, source: "default" };
+    }
+    return { max: value, source: "company" };
+}
+//# sourceMappingURL=depth-cap.js.map

package/dist/lib/lanes/reconcile.d.ts

@@ -132,7 +132,7 @@ export declare function timeoutPath(hqRoot: string, laneId: string): string;
 export declare function laneRunsHere(lane: LaneRecord, host: ReconcileHost): boolean;
 export declare function agedAdvanceCount(question: QuestionRecord): number;
 export declare function currentHopStartedAtMs(question: QuestionRecord): number;
-export declare function shouldAgeQuestion(question: QuestionRecord, audience: SeniorRef, nowMs: number, ageWindowMs?: number): boolean;
+export declare function shouldAgeQuestion(question: QuestionRecord, audience: SeniorRef, nowMs: number, ageWindowMs?: number, maxAgedAdvances?: number): boolean;
 export declare function shouldAdvanceAudienceEnded(audience: SeniorRef, liveness: LivenessState | null): boolean;
 export declare function readTimeoutDeadline(hqRoot: string, laneId: string): {
     deadline_at: string;

package/dist/lib/lanes/reconcile.js

@@ -14,6 +14,7 @@ import { effectiveAccountHome } from "./account-home.js";
 import { enforceRegistryApprovalGate } from "./approval-gate.js";
 import { loadLanesConfig, providerQuotaDefaultHoldMs } from "./config.js";
 import { MAX_LANE_DEPTH } from "./constants.js";
+import { laneDepthCap } from "./depth-cap.js";
 import { AccountResolutionError, LanesError, isLaneVersionConflict } from "./errors.js";
 import { loadWorkerProfile } from "./profile.js";
 import { terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
@@ -155,12 +156,12 @@ export function currentHopStartedAtMs(question) {
     const ms = Date.parse(raw);
     return Number.isFinite(ms) ? ms : Number.NEGATIVE_INFINITY;
 }
-export function shouldAgeQuestion(question, audience, nowMs, ageWindowMs = QUESTION_AGE_MS) {
+export function shouldAgeQuestion(question, audience, nowMs, ageWindowMs = QUESTION_AGE_MS, maxAgedAdvances = MAX_AGED_ADVANCES) {
     if (question.status !== "pending")
         return false;
     if (audience.kind === "user")
         return false;
-    if (agedAdvanceCount(question) >= MAX_AGED_ADVANCES)
+    if (agedAdvanceCount(question) >= maxAgedAdvances)
         return false;
     const started = currentHopStartedAtMs(question);
     if (started === Number.NEGATIVE_INFINITY)
@@ -1121,16 +1122,26 @@ export async function runPassBody(hqRoot, deps) {
                 }
                 continue;
             }
-            if (shouldAgeQuestion(question, audience, nowMs, questionAgeWindowMs(audience))) {
+            let maxAgedAdvances;
+            try {
+                maxAgedAdvances = laneDepthCap(hqRoot, question.company?.slug).max * 2;
+            }
+            catch (err) {
+                if (!(err instanceof LanesError))
+                    throw err;
+                maxAgedAdvances = MAX_AGED_ADVANCES;
+                process.stderr.write(`hq lanes reconcile: lane depth config failed for company=${JSON.stringify(question.company?.slug)}; using default ${MAX_LANE_DEPTH}: ${err.message}\n`);
+            }
+            if (shouldAgeQuestion(question, audience, nowMs, questionAgeWindowMs(audience), maxAgedAdvances)) {
                 const nextHop = question.hop + 1;
                 const nextAudience = resolveQuestionAudience({ ...question, hop: nextHop }, readLaneSenior, readSessionSenior);
                 const result = casQuestionIf(hqRoot, question.question_id, (current) => {
                     if (current.status !== "pending" ||
-                        agedAdvanceCount(current) >= MAX_AGED_ADVANCES) {
+                        agedAdvanceCount(current) >= maxAgedAdvances) {
                         return false;
                     }
                     const currentAudience = resolveQuestionAudience(current, readLaneSenior, readSessionSenior);
-                    return shouldAgeQuestion(current, currentAudience, nowMs, questionAgeWindowMs(currentAudience));
+                    return shouldAgeQuestion(current, currentAudience, nowMs, questionAgeWindowMs(currentAudience), maxAgedAdvances);
                 }, (current) => {
                     const entry = {
                         hop: current.hop + 1,

package/dist/lib/mesh/live/daemon/install.d.ts

@@ -55,6 +55,8 @@ export interface InstallPaths {
      * host has no conhost (the task then runs node directly).
      */
     windowsHeadlessLauncher?: string;
+    /** Windows command processor used to execute the stable npm .cmd shim. */
+    windowsCommandProcessor?: string;
     /** When true, render the root/ec2-user system unit instead of user unit. */
     systemUser?: string;
     /** Verified HQ root to persist and pass to the installed service. */
@@ -102,7 +104,6 @@ export declare function restartDaemonServiceIfInstalled(opts?: {
     env?: NodeJS.ProcessEnv;
     existsSync?: typeof fs.existsSync;
     readFileSync?: typeof fs.readFileSync;
-    writeFileSync?: typeof fs.writeFileSync;
     run?: (command: string, args: string[]) => {
         status: number | null;
         stdout?: string;
@@ -119,7 +120,7 @@ export declare function detectPlatform(platform?: NodeJS.Platform): DaemonInstal
  * dies with MODULE_NOT_FOUND on the next restart. Prefer the live npm-global
  * binary when both exist.
  */
-export declare function preferStableHqBinary(entry: string): string;
+export declare function preferStableHqBinary(entry: string, platform?: DaemonInstallPlatform, existsSync?: typeof fs.existsSync): string;
 /**
  * Absolute path of the CLI entry that is executing this process.
  * realpath of argv[1] only — never a PATH lookup of `hq`.
@@ -153,7 +154,6 @@ export declare function installDaemonIfStale(opts: {
     run?: RunCommand;
     uid?: number;
     sleep?: SleepFn;
-    writeFileSync?: typeof fs.writeFileSync;
     mkdirSync?: typeof fs.mkdirSync;
     reloadSystemd?: () => {
         status: number | null;
@@ -193,6 +193,10 @@ export declare function buildInstallPaths(opts: {
     windowsUser?: string;
     /** Windows headless launcher override (tests); defaults to %SystemRoot%\System32\conhost.exe when present. */
     windowsHeadlessLauncher?: string | null;
+    /** Platform override for unit path and command rendering tests. */
+    platform?: DaemonInstallPlatform;
+    /** Filesystem seam for stable hq shim resolution tests. */
+    existsSync?: typeof fs.existsSync;
 }): InstallPaths;
 /** `DOMAIN\user` for the current account, as Task Scheduler expects. */
 export declare function resolveWindowsUser(env?: NodeJS.ProcessEnv): string;
@@ -277,7 +281,6 @@ export declare function installDaemonService(opts: {
     paths?: InstallPaths;
     /** When set, write the system unit template (does not sudo-install). */
     systemUser?: string;
-    writeFileSync?: typeof fs.writeFileSync;
     mkdirSync?: typeof fs.mkdirSync;
     /** Optional: actually load the service (disabled in tests). */
     activate?: (platform: DaemonInstallPlatform, dest: string) => void;

package/dist/lib/mesh/live/daemon/install.js

@@ -16,6 +16,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
 import semver from "semver";
+import { atomicWrite } from "../../../index-render/shared.js";
 import { resolveDaemonAssetDir } from "./log.js";
 import { LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, WINDOWS_TASK_NAME, daemonDir, daemonLogPath, daemonPidPath, } from "./paths.js";
 import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqRoot } from "./config.js";
@@ -123,17 +124,25 @@ function migrateLegacyDaemonUnit(opts) {
         // The rendered command only has to name a binary; install already resolved one.
     }
     if (platform === "darwin") {
-        opts.writeFileSync(unitPath, renderLaunchdPlist(paths), { mode: 0o600 });
+        replaceUnitFile(unitPath, renderLaunchdPlist(paths), 0o600, () => {
+            activateLaunchd(unitPath, asRunCommand(opts.run), opts.uid, { sleep: opts.sleep });
+        });
         return;
     }
     if (platform === "linux") {
-        opts.writeFileSync(unitPath, renderSystemdUserUnit(paths), { mode: 0o600 });
-        opts.run("systemctl", ["--user", "daemon-reload"]);
+        replaceUnitFile(unitPath, renderSystemdUserUnit(paths), 0o600, () => {
+            const result = opts.run("systemctl", ["--user", "daemon-reload"]);
+            if (result.status !== 0)
+                throw new Error("systemctl --user daemon-reload failed while repairing the mesh unit");
+        });
         return;
     }
     const rendered = renderWindowsTaskXml(paths);
-    opts.writeFileSync(unitPath, encodeWindowsTaskXml(rendered));
-    opts.run("schtasks.exe", ["/Create", "/TN", WINDOWS_TASK_NAME, "/XML", unitPath, "/F"]);
+    replaceUnitFile(unitPath, encodeWindowsTaskXml(rendered), 0o600, () => {
+        const result = opts.run("schtasks.exe", ["/Create", "/TN", WINDOWS_TASK_NAME, "/XML", unitPath, "/F"]);
+        if (result.status !== 0)
+            throw new Error("schtasks /Create failed while repairing the mesh unit");
+    });
 }
 /**
  * Restart the installed user daemon after a CLI upgrade. This is deliberately
@@ -155,7 +164,6 @@ export function restartDaemonServiceIfInstalled(opts = {}) {
     const home = opts.home ?? os.homedir();
     const existsSync = opts.existsSync ?? fs.existsSync;
     const readFileSync = opts.readFileSync ?? fs.readFileSync;
-    const writeFileSync = opts.writeFileSync ?? fs.writeFileSync;
     const run = opts.run ?? ((command, args) => {
         const result = spawnSync(command, args, { encoding: "utf8" });
         return {
@@ -165,7 +173,17 @@ export function restartDaemonServiceIfInstalled(opts = {}) {
         };
     });
     try {
-        migrateLegacyDaemonUnit({ platform, home, hqRoot: opts.hqRoot, env: opts.env, existsSync, readFileSync, writeFileSync, run });
+        migrateLegacyDaemonUnit({
+            platform,
+            home,
+            hqRoot: opts.hqRoot,
+            env: opts.env,
+            existsSync,
+            readFileSync,
+            run,
+            uid: opts.uid,
+            sleep: opts.sleep,
+        });
         if (platform === "darwin") {
             const plist = path.join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
             if (!existsSync(plist))
@@ -239,14 +257,46 @@ export function detectPlatform(platform = process.platform) {
  * dies with MODULE_NOT_FOUND on the next restart. Prefer the live npm-global
  * binary when both exist.
  */
-export function preferStableHqBinary(entry) {
-    const stale = `${path.sep}toolchain${path.sep}node${path.sep}bin${path.sep}`;
-    const stable = `${path.sep}toolchain${path.sep}npm-global${path.sep}bin${path.sep}`;
-    if (!entry.includes(stale))
-        return entry;
-    const candidate = entry.replace(stale, stable);
-    if (candidate !== entry && fs.existsSync(candidate))
-        return path.resolve(candidate);
+export function preferStableHqBinary(entry, platform = detectPlatform(), existsSync = fs.existsSync) {
+    const api = platform === "win32" ? path.win32 : path;
+    const sep = api.sep;
+    const stale = `${sep}toolchain${sep}node${sep}bin${sep}`;
+    const stable = `${sep}toolchain${sep}npm-global${sep}bin${sep}`;
+    if (entry.includes(stale)) {
+        const candidate = entry.replace(stale, stable);
+        if (candidate !== entry && existsSync(candidate))
+            return api.resolve(candidate);
+    }
+    const normalized = entry.replace(/\\/g, "/");
+    const parts = normalized.split("/").filter(Boolean);
+    let packageAt = -1;
+    for (let i = 0; i < parts.length - 2; i += 1) {
+        if (parts[i]?.toLowerCase() === "node_modules"
+            && parts[i + 1]?.toLowerCase() === "@indigoai-us"
+            && parts[i + 2]?.toLowerCase() === "hq-cli") {
+            packageAt = i;
+            break;
+        }
+    }
+    if (packageAt >= 0) {
+        const prefixParts = parts.slice(0, packageAt);
+        let prefix;
+        if (platform === "win32") {
+            const root = path.win32.parse(entry).root;
+            const rootParts = root.replace(/\\+$/, "").split(/[\\/]+/).filter(Boolean);
+            prefix = path.win32.resolve(root, ...prefixParts.slice(rootParts.length));
+        }
+        else {
+            if (prefixParts.at(-1) === "lib")
+                prefixParts.pop();
+            prefix = path.posix.resolve(`/${prefixParts.join("/")}`);
+        }
+        const shim = platform === "win32"
+            ? path.win32.join(prefix, "hq.cmd")
+            : path.posix.join(prefix, "bin", "hq");
+        if (existsSync(shim))
+            return api.resolve(shim);
+    }
     return entry;
 }
 /**
@@ -346,7 +396,6 @@ export function installDaemonIfStale(opts) {
         platform,
         paths: opts.paths,
         systemUser: opts.systemUser,
-        writeFileSync: opts.writeFileSync,
         mkdirSync: opts.mkdirSync,
         reloadSystemd: opts.reloadSystemd,
         schtasks: opts.schtasks,
@@ -357,9 +406,6 @@ export function installDaemonIfStale(opts) {
         uid: opts.uid,
         sleep: opts.sleep,
     });
-    if (platform === "linux" && !opts.systemUser && !opts.paths.systemUser) {
-        activateSystemd(SYSTEMD_UNIT_NAME, run);
-    }
     return {
         reinstalled: true,
         message: `${installed.message} Restarted with ${opts.paths.nodeBinary} ${opts.paths.hqBinary}.`,
@@ -413,7 +459,8 @@ export function buildInstallPaths(opts) {
     const home = opts.home ?? os.homedir();
     const env = opts.env ?? process.env;
     const ddir = daemonDir(opts.meshRoot, home, env);
-    const hqBinary = opts.hqBinary ?? resolveHqBinary(opts.argv, env);
+    const platform = opts.platform ?? detectPlatform();
+    const hqBinary = preferStableHqBinary(opts.hqBinary ?? resolveHqBinary(opts.argv, env), platform, opts.existsSync ?? fs.existsSync);
     const nodeBinary = opts.nodeBinary ?? resolveNodeBinary(opts.execPath, env);
     return {
         home,
@@ -430,6 +477,7 @@ export function buildInstallPaths(opts) {
         windowsHeadlessLauncher: opts.windowsHeadlessLauncher === undefined
             ? resolveWindowsHeadlessLauncher(env)
             : (opts.windowsHeadlessLauncher ?? undefined),
+        windowsCommandProcessor: path.win32.join(env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe"),
         systemUser: opts.systemUser,
         hqRoot: opts.hqRoot,
         hqRootSource: opts.hqRootSource,
@@ -480,7 +528,12 @@ export function windowsLogonNotice(paths) {
 function describeWindowsLaunchMode(paths) {
     return windowsLaunchMode(paths) === "conhost-headless"
         ? `mode: conhost --headless via ${paths.windowsHeadlessLauncher}`
-        : "mode: direct node (conhost --headless unavailable on this host; a console window may appear at logon)";
+        : isWindowsCommandShim(paths.hqBinary)
+            ? "mode: direct command processor (conhost --headless unavailable on this host; a console window may appear at logon)"
+            : "mode: direct node (conhost --headless unavailable on this host; a console window may appear at logon)";
+}
+function isWindowsCommandShim(file) {
+    return path.win32.extname(file).toLowerCase() === ".cmd";
 }
 function safeUsername() {
     try {
@@ -601,13 +654,19 @@ WantedBy=multi-user.target
  */
 export function renderWindowsTaskXml(paths) {
     const user = escapeXml(paths.windowsUser);
-    const nodeArg = windowsArgQuote(paths.nodeBinary);
+    const stableShim = isWindowsCommandShim(paths.hqBinary);
     const hqArg = windowsArgQuote(paths.hqBinary);
-    const command = paths.windowsHeadlessLauncher ?? paths.nodeBinary;
+    const commandProcessor = paths.windowsCommandProcessor ?? path.win32.join("C:\\Windows", "System32", "cmd.exe");
+    const command = stableShim ? (paths.windowsHeadlessLauncher ?? commandProcessor) : (paths.windowsHeadlessLauncher ?? paths.nodeBinary);
     const rootArgs = paths.hqRoot ? ` --hq-root ${windowsArgQuote(paths.hqRoot)}` : "";
-    const args = paths.windowsHeadlessLauncher
-        ? `--headless ${nodeArg} ${hqArg} mesh daemon run${rootArgs}`
-        : `${hqArg} mesh daemon run${rootArgs}`;
+    const commandLine = `${hqArg} mesh daemon run${rootArgs}`;
+    const args = stableShim
+        ? paths.windowsHeadlessLauncher
+            ? `--headless ${windowsArgQuote(commandProcessor)} /d /s /c "${commandLine}"`
+            : `/d /s /c "${commandLine}"`
+        : paths.windowsHeadlessLauncher
+            ? `--headless ${windowsArgQuote(paths.nodeBinary)} ${hqArg} mesh daemon run${rootArgs}`
+            : `${hqArg} mesh daemon run${rootArgs}`;
     return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
@@ -769,7 +828,7 @@ export function parseWindowsTaskHqRoot(xml) {
     if (quoted)
         return quoted[1].replace(/\\"/g, '"');
     const bare = /--hq-root (\S+)/.exec(args);
-    return bare ? bare[1] : null;
+    return bare ? bare[1].replace(/"+$/, "") : null;
 }
 /**
  * The HQ root the installed Windows task actually carries: the task XML on
@@ -812,11 +871,40 @@ function shellQuote(value) {
         return value;
     return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function replaceUnitFile(file, content, mode, reload) {
+    let previous = null;
+    let previousMode = mode;
+    try {
+        previous = fs.readFileSync(file);
+        previousMode = fs.statSync(file).mode & 0o777;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    try {
+        atomicWrite(file, content, { mode });
+        reload?.();
+    }
+    catch (error) {
+        try {
+            if (previous) {
+                atomicWrite(file, previous, { mode: previousMode });
+            }
+            else {
+                fs.rmSync(file, { force: true });
+            }
+        }
+        catch (rollbackError) {
+            throw new AggregateError([error, rollbackError], `Unit replacement and rollback failed: ${file}`);
+        }
+        throw error;
+    }
+}
 export function installDaemonService(opts) {
     const platform = opts.platform ?? detectPlatform();
     const paths = opts.paths ??
         buildInstallPaths({ systemUser: opts.systemUser });
-    const writeFileSync = opts.writeFileSync ?? fs.writeFileSync;
     const mkdirSync = opts.mkdirSync ?? fs.mkdirSync;
     mkdirSync(paths.daemonDir, { recursive: true, mode: 0o700 });
     registerTrustedHqRoot(paths.daemonDir, paths.hqRoot);
@@ -832,13 +920,12 @@ export function installDaemonService(opts) {
     if (platform === "darwin") {
         const rendered = renderLaunchdPlist(paths);
         mkdirSync(paths.launchAgentsDir, { recursive: true });
-        writeFileSync(paths.plistPath, rendered, { mode: 0o600 });
-        if (opts.run) {
-            activateLaunchd(paths.plistPath, opts.run, opts.uid, { sleep: opts.sleep });
-        }
-        else {
-            opts.activate?.(platform, paths.plistPath);
-        }
+        replaceUnitFile(paths.plistPath, rendered, 0o600, () => {
+            if (opts.run)
+                activateLaunchd(paths.plistPath, opts.run, opts.uid, { sleep: opts.sleep });
+            else
+                opts.activate?.(platform, paths.plistPath);
+        });
         return {
             platform,
             action: "install",
@@ -856,7 +943,7 @@ export function installDaemonService(opts) {
             });
             // Write under daemon dir as a template the operator can sudo-install.
             const dest = path.join(paths.daemonDir, SYSTEMD_UNIT_NAME);
-            writeFileSync(dest, rendered, { mode: 0o644 });
+            replaceUnitFile(dest, rendered, 0o644);
             return {
                 platform,
                 action: "install",
@@ -870,9 +957,18 @@ export function installDaemonService(opts) {
         }
         const rendered = renderSystemdUserUnit(paths);
         mkdirSync(paths.systemdUserDir, { recursive: true });
-        writeFileSync(paths.systemdUnitPath, rendered, { mode: 0o600 });
-        (opts.reloadSystemd ?? (() => spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" })))();
-        opts.activate?.(platform, paths.systemdUnitPath);
+        replaceUnitFile(paths.systemdUnitPath, rendered, 0o600, () => {
+            const result = (opts.reloadSystemd ?? (() => {
+                const reload = spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
+                return { status: reload.status };
+            }))();
+            if (result.status !== 0)
+                throw new Error("systemctl --user daemon-reload failed while installing the mesh unit");
+            if (opts.run)
+                activateSystemd(SYSTEMD_UNIT_NAME, opts.run);
+            else
+                opts.activate?.(platform, paths.systemdUnitPath);
+        });
         return {
             platform,
             action: "install",
@@ -885,14 +981,15 @@ export function installDaemonService(opts) {
     if (platform === "win32") {
         const schtasks = opts.schtasks ?? defaultSchtasks;
         const rendered = renderWindowsTaskXml(paths);
-        writeFileSync(paths.windowsTaskXmlPath, encodeWindowsTaskXml(rendered), { mode: 0o600 });
-        const created = schtasks([
-            "/Create", "/TN", WINDOWS_TASK_NAME, "/XML", paths.windowsTaskXmlPath, "/F",
-        ]);
-        if (created.status !== 0) {
-            throw new Error(`schtasks /Create failed for ${WINDOWS_TASK_NAME} (exit ${created.status ?? "signal"}): ` +
-                `${(created.stderr || created.stdout).trim()}`);
-        }
+        replaceUnitFile(paths.windowsTaskXmlPath, encodeWindowsTaskXml(rendered), 0o600, () => {
+            const created = schtasks([
+                "/Create", "/TN", WINDOWS_TASK_NAME, "/XML", paths.windowsTaskXmlPath, "/F",
+            ]);
+            if (created.status !== 0) {
+                throw new Error(`schtasks /Create failed for ${WINDOWS_TASK_NAME} (exit ${created.status ?? "signal"}): ` +
+                    `${(created.stderr || created.stdout).trim()}`);
+            }
+        });
         // /F replaced any previous registration without ending its instance; stop
         // the recorded daemon so the fresh task instance can take the pid lock.
         schtasks(["/End", "/TN", WINDOWS_TASK_NAME]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.33",
+  "version": "5.345.34",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {