@indigoai-us/hq-cli 5.345.47 → 5.345.48

package/dist/commands/secrets.js

@@ -1,9 +1,153 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as yaml from "js-yaml";
 import { buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
+export function readSessionCompanyLock(env = process.env) {
+    const root = resolveDefaultHqRoot({ env });
+    const sessionId = resolveSessionId(root, env);
+    if (!sessionId)
+        return undefined;
+    const sessionDir = path.join(root, "workspace/sessions", sessionId);
+    const capabilityPath = path.join(sessionDir, "scope-capability.json");
+    const metaPath = path.join(sessionDir, "meta.yaml");
+    let primary;
+    let companies;
+    let hasCapability = false;
+    try {
+        fs.lstatSync(capabilityPath);
+        hasCapability = true;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT" && code !== "ENOTDIR")
+            throw new Error("Cannot verify this session's company lock because its scope capability is unreadable.");
+    }
+    if (hasCapability) {
+        let value;
+        try {
+            value = JSON.parse(fs.readFileSync(capabilityPath, "utf8"));
+        }
+        catch {
+            throw new Error("Cannot verify this session's company lock because its scope capability is unreadable.");
+        }
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
+        const cap = value;
+        if (cap.session_id !== sessionId)
+            throw new Error("Cannot verify this session's company lock because its scope capability does not match the active session.");
+        if (typeof cap.company_slug !== "string" || !/^[A-Za-z0-9_-]+$/.test(cap.company_slug))
+            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
+        primary = cap.company_slug;
+        if (cap.company_slugs === undefined)
+            companies = [primary];
+        else if (Array.isArray(cap.company_slugs)
+            && cap.company_slugs.length > 0
+            && cap.company_slugs.every((slug) => typeof slug === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(slug))
+            && cap.company_slugs[0] === primary
+            && new Set(cap.company_slugs).size === cap.company_slugs.length
+            && ((primary === "personal" && cap.company_slugs.length === 1)
+                || (primary !== "personal" && !cap.company_slugs.includes("personal"))))
+            companies = [...cap.company_slugs];
+        else
+            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
+    }
+    else {
+        try {
+            const meta = fs.readFileSync(metaPath, "utf8");
+            const read = (key) => meta.split(/\r?\n/).find((line) => new RegExp(`^\\s*${key}:`).test(line))?.replace(/^\s*[^:]+:\s*/, "").replace(/^"|"$/g, "") ?? "";
+            primary = read("company_slug");
+            const hasList = meta.split(/\r?\n/).some((line) => /^\s*company_slugs:/.test(line));
+            const listed = hasList ? read("company_slugs") : "";
+            if (hasList && (!listed || !primary))
+                throw new Error("invalid company lock");
+            companies = hasList ? listed.split(",") : primary ? [primary] : [];
+            if (companies.some((slug) => !/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(slug)))
+                throw new Error("invalid company lock");
+            if (new Set(companies).size !== companies.length)
+                throw new Error("invalid company lock");
+            if (primary && companies[0] !== primary)
+                throw new Error("invalid company lock");
+            if (companies.length > 1 && companies.includes("personal"))
+                throw new Error("invalid company lock");
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES")
+                return { sessionId, companies: [] };
+            throw new Error("Cannot verify this session's company lock because its metadata is invalid.");
+        }
+    }
+    const real = companies.filter((slug) => {
+        if (slug === "personal")
+            return true;
+        try {
+            const companyPath = path.join(root, "companies", slug);
+            const stat = fs.lstatSync(companyPath);
+            return stat.isDirectory() && !stat.isSymbolicLink();
+        }
+        catch {
+            return false;
+        }
+    });
+    if (primary && real[0] !== primary)
+        return { sessionId, companies: [] };
+    return { sessionId, companies: real };
+}
+function companyUidForSlug(root, slug) {
+    try {
+        const doc = yaml.load(fs.readFileSync(path.join(root, "companies", "manifest.yaml"), "utf8"));
+        const uid = doc.companies?.[slug]?.cloud_uid;
+        return typeof uid === "string" && looksLikeCompanyUid(uid) ? uid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function companySlugForUid(root, companies, uid) {
+    if (!looksLikeCompanyUid(uid))
+        return undefined;
+    try {
+        const doc = yaml.load(fs.readFileSync(path.join(root, "companies", "manifest.yaml"), "utf8"));
+        return companies.find((slug) => doc.companies?.[slug]?.cloud_uid === uid);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveApiKeyCompanyWithinLock(input) {
+    let candidates = input.companies;
+    if (input.requestedCompany) {
+        const companySlug = input.companies.includes(input.requestedCompany)
+            ? input.requestedCompany
+            : companySlugForUid(input.root, input.companies, input.requestedCompany);
+        if (!companySlug) {
+            throw new Error("HQ_API_KEY is not bound to a company in this session's locked company set.");
+        }
+        candidates = [companySlug];
+    }
+    for (const companySlug of candidates) {
+        const companyUid = companyUidForSlug(input.root, companySlug);
+        if (!companyUid)
+            continue;
+        const response = await vaultApiFetch({ token: input.token, path: `/v1/keys/secrets/${encodeURIComponent(companyUid)}` });
+        if (response.ok)
+            return { companyUid, companySlug };
+        if (response.status === 401)
+            throw new Error("HQ_API_KEY is invalid or no longer active.");
+        if (response.status !== 403)
+            throw new Error(`Could not verify HQ_API_KEY company scope (HTTP ${response.status}).`);
+    }
+    throw new Error("HQ_API_KEY is not bound to a company in this session's locked company set.");
+}
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { removeCacheEntry, clearAllCache } from "../utils/secrets-cache.js";
 import { isHqCliChild, releaseChildWrapperPackageUseLeaseAfterStart } from "../utils/child-wrapper-lease.js";
+import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
+import { fastFlagEnabled } from "../native-fast-route.js";
+import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
+import { resolveSessionId } from "../lib/core-utils/session-id.js";
 import { secretsExecChildExitCode } from "../utils/child-wrapper-exit.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
@@ -1085,6 +1229,7 @@ export function registerSecretsCommand(program) {
         .command("exec")
         .description("Run a command with secrets injected as env vars")
         .requiredOption("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--script <path>", "Attach local script identity for script-locked secrets")
         .option("--script-id <id>", "Stable script identifier approved by policy")
         .allowUnknownOption(true)
@@ -1104,10 +1249,44 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
+            const multiCompanyLockEnabled = await fastFlagEnabled(MULTI_COMPANY_SESSION_LOCK_FLAG);
+            const sessionLock = multiCompanyLockEnabled ? readSessionCompanyLock(process.env) : undefined;
+            const parentScope = secrets.opts();
+            const inheritedCompany = parentScope.company;
+            const requestedCompany = _opts.company ?? inheritedCompany;
+            const hasLockedCompanies = (sessionLock?.companies.length ?? 0) > 0;
+            const lockRoot = hasLockedCompanies ? resolveDefaultHqRoot({ env: process.env }) : undefined;
+            const selectedCompany = (hasLockedCompanies && requestedCompany && looksLikeCompanyUid(requestedCompany)
+                ? companySlugForUid(lockRoot, sessionLock.companies, requestedCompany) ?? requestedCompany
+                : requestedCompany)
+                ?? (multiCompanyLockEnabled && !parentScope.personal ? sessionLock?.companies[0] : undefined);
+            if (hasLockedCompanies && selectedCompany && !sessionLock.companies.includes(selectedCompany)) {
+                throw new Error(`Company '${selectedCompany}' is outside this session's locked company set.`);
+            }
+            if (hasLockedCompanies && parentScope.personal && !sessionLock.companies.includes("personal")) {
+                throw new Error("Personal scope is outside this session's locked company set.");
+            }
+            if (hasLockedCompanies && !selectedCompany && !parentScope.personal) {
+                throw new Error("This session has no locked company scope for secrets exec.");
+            }
+            if (hasLockedCompanies && !requestedCompany && sessionLock.companies.length > 1) {
+                console.error(`Using primary company ${sessionLock.companies[0]} from this session's lock; pass --company <slug> to choose another locked company.`);
+            }
+            const secretScope = selectedCompany === "personal"
+                ? scopeOpts({ personal: true })
+                : scopeOpts({ ...parentScope, ...(selectedCompany ? { company: selectedCompany } : {}) });
             const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets exec", secretsCredentialOptions());
+            const apiKeyCompany = cred.kind === "api-key" && hasLockedCompanies
+                ? await resolveApiKeyCompanyWithinLock({
+                    token: cred.token,
+                    root: lockRoot,
+                    companies: sessionLock.companies,
+                    ...(requestedCompany ? { requestedCompany } : {}),
+                })
+                : undefined;
             const companyUid = cred.kind === "api-key"
-                ? "__api_key__"
-                : await getEntityUid(cred.token, scopeOpts(secrets.opts()), { allowOfflineScopeFallback: true });
+                ? (apiKeyCompany?.companyUid ?? "__api_key__")
+                : await getEntityUid(cred.token, secretScope, { allowOfflineScopeFallback: true });
             const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
                 : undefined, { allowOfflineFallback: true });

package/dist/commands/workers.d.ts

@@ -6,12 +6,15 @@ import { type RegistryWorker } from "../lib/workers-registry/read.js";
  * company_slug. Undefined when no session context is set. Pure/read-only.
  */
 export declare function resolveActiveCompany(hqRoot: string): string | undefined;
+/** Resolve the active ordered lock set; default-off preserves primary-only access. */
+export declare function resolveActiveCompanies(hqRoot: string, multiCompanyLockEnabled: boolean): string[] | undefined;
+export declare function denyWorkerCompanyOutsideLock(company: string, lockedCompanies: string[] | undefined): boolean;
 /**
  * Membership-aware access filter for worker discovery: public workers always;
  * company workers only for the active company. Mirrors the /run skill and the
  * inject-worker-suggestion hook so all three surfaces agree.
  */
-export declare function filterAccessibleWorkers(workers: RegistryWorker[], activeCompany: string | undefined): RegistryWorker[];
+export declare function filterAccessibleWorkers(workers: RegistryWorker[], activeCompany: string | string[] | undefined): RegistryWorker[];
 /**
  * The company-relative vault prefix for a worker, e.g.
  * companies/indigo/workers/deal-brain/ -> workers/deal-brain/. Returns null for

package/dist/commands/workers.js

@@ -7,6 +7,9 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
 import { GROUP_ID_PATTERN, EMAIL_PATTERN, toSharedFolderGlob } from "./_patterns.js";
 import { findHqRoot } from "../utils/manifest.js";
+import { fastFlagEnabled } from "../native-fast-route.js";
+import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
+import { resolveSessionId } from "../lib/core-utils/session-id.js";
 export { readWorkerRegistry } from "../lib/workers-registry/read.js";
 import { readWorkerRegistry } from "../lib/workers-registry/read.js";
 /**
@@ -14,34 +17,68 @@ import { readWorkerRegistry } from "../lib/workers-registry/read.js";
  * company_slug. Undefined when no session context is set. Pure/read-only.
  */
 export function resolveActiveCompany(hqRoot) {
+    return resolveActiveCompanies(hqRoot, false)?.[0];
+}
+/** Resolve the active ordered lock set; default-off preserves primary-only access. */
+export function resolveActiveCompanies(hqRoot, multiCompanyLockEnabled) {
+    const current = resolveSessionId(hqRoot);
+    if (!current)
+        return undefined;
     try {
-        const currentFile = path.join(hqRoot, "workspace/sessions/.current");
-        const current = fs.readFileSync(currentFile, "utf8").trim();
-        if (!current)
-            return undefined;
         const metaPath = path.join(hqRoot, "workspace/sessions", current, "meta.yaml");
         if (!fs.existsSync(metaPath))
-            return undefined;
+            return multiCompanyLockEnabled ? [] : undefined;
         const meta = yaml.load(fs.readFileSync(metaPath, "utf8"));
-        const co = meta?.company_slug;
-        return typeof co === "string" && co ? co : undefined;
+        const primary = meta?.company_slug;
+        if (typeof primary !== "string" || !/^[A-Za-z0-9_-]+$/.test(primary))
+            return multiCompanyLockEnabled ? [] : undefined;
+        const rawListed = meta?.company_slugs;
+        const listed = multiCompanyLockEnabled && typeof rawListed === "string"
+            ? rawListed.split(",")
+            : [primary];
+        if (!multiCompanyLockEnabled)
+            return [primary];
+        const companies = [...new Set(listed.filter((slug) => {
+                if (typeof slug !== "string" || !/^[A-Za-z0-9_-]+$/.test(slug))
+                    return false;
+                if (slug === "personal")
+                    return true;
+                try {
+                    const stat = fs.lstatSync(path.join(hqRoot, "companies", slug));
+                    return stat.isDirectory() && !stat.isSymbolicLink();
+                }
+                catch {
+                    return false;
+                }
+            }))];
+        if (companies.length > 1 && companies.includes("personal"))
+            return [primary];
+        return companies[0] === primary ? companies : undefined;
     }
     catch {
-        return undefined;
+        return multiCompanyLockEnabled ? [] : undefined;
     }
 }
+export function denyWorkerCompanyOutsideLock(company, lockedCompanies) {
+    if (lockedCompanies === undefined || lockedCompanies.includes(company))
+        return false;
+    console.error(`Company '${company}' is outside this session's locked company set.`);
+    process.exitCode = 1;
+    return true;
+}
 /**
  * Membership-aware access filter for worker discovery: public workers always;
  * company workers only for the active company. Mirrors the /run skill and the
  * inject-worker-suggestion hook so all three surfaces agree.
  */
 export function filterAccessibleWorkers(workers, activeCompany) {
+    const allowed = new Set(Array.isArray(activeCompany) ? activeCompany : activeCompany ? [activeCompany] : []);
     return workers.filter((w) => {
         if (w.visibility === "public")
             return true;
         if (!w.company)
             return false;
-        return activeCompany !== undefined && w.company === activeCompany;
+        return allowed.has(w.company);
     });
 }
 /**
@@ -159,14 +196,18 @@ async function runWorkersShare(workerId, opts) {
     console.log(chalk.green("✓"), `Shared worker '${workerId}' with ${classified.label} (${permission}).`);
     console.log(chalk.dim(`  Vault prefix ${prefix} granted in company '${companySlug}'. It will sync to granted members and appear in their /run list.`));
 }
-function runWorkersList(opts) {
+async function runWorkersList(opts) {
     const hqRoot = findHqRoot();
-    const activeCompany = opts.company ?? resolveActiveCompany(hqRoot);
-    let workers = filterAccessibleWorkers(readWorkerRegistry(hqRoot), activeCompany);
+    const enabled = await fastFlagEnabled(MULTI_COMPANY_SESSION_LOCK_FLAG);
+    const lockedCompanies = resolveActiveCompanies(hqRoot, enabled);
+    if (enabled && opts.company && denyWorkerCompanyOutsideLock(opts.company, lockedCompanies))
+        return;
+    const activeCompanies = opts.company ? [opts.company] : lockedCompanies;
+    let workers = filterAccessibleWorkers(readWorkerRegistry(hqRoot), activeCompanies);
     if (opts.shared)
         workers = workers.filter((w) => Boolean(w.grants && w.grants.trim()));
     if (opts.mine)
-        workers = workers.filter((w) => Boolean(w.company) && w.company === activeCompany);
+        workers = workers.filter((w) => Boolean(w.company) && activeCompanies?.includes(w.company) === true);
     if (workers.length === 0) {
         console.log("No accessible workers.");
         return;
@@ -185,8 +226,9 @@ function runWorkersList(opts) {
         }
     };
     printGroup("Public", publicWorkers);
-    if (activeCompany)
-        printGroup(activeCompany, companyWorkers);
+    for (const company of activeCompanies ?? []) {
+        printGroup(company, companyWorkers.filter((worker) => worker.company === company));
+    }
     console.log(chalk.dim("\nUsage: hq run {worker-id} [skill] [args]"));
     console.log(chalk.dim("Share a company worker: hq workers share {worker-id} --with {grp_<name>|@all} --permission read"));
 }

package/dist/lib/cli-flag-keys.d.ts

@@ -1,3 +1,4 @@
 /** hq-flags keys used by CLI-wide routes. */
 export declare const CLI_COMMAND_HELP_CATALOG_FLAG = "cli.command-help-catalog";
+export declare const MULTI_COMPANY_SESSION_LOCK_FLAG = "hooks.multi-company-session-lock";
 //# sourceMappingURL=cli-flag-keys.d.ts.map

package/dist/lib/cli-flag-keys.js

@@ -1,3 +1,4 @@
 /** hq-flags keys used by CLI-wide routes. */
 export const CLI_COMMAND_HELP_CATALOG_FLAG = "cli.command-help-catalog";
+export const MULTI_COMPANY_SESSION_LOCK_FLAG = "hooks.multi-company-session-lock";
 //# sourceMappingURL=cli-flag-keys.js.map

package/dist/lib/core-utils/session-id.d.ts

@@ -0,0 +1,6 @@
+export declare const SESSION_ID_ENV_KEYS: readonly ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID", "GROK_SESSION_ID"];
+export declare function validSessionId(value: string): boolean;
+export declare function sessionIdFromEnv(env: NodeJS.ProcessEnv): string;
+/** Resolve the caller's session before using the global, last-writer-wins .current fallback. */
+export declare function resolveSessionId(root: string, env?: NodeJS.ProcessEnv, readFile?: (filePath: string, encoding: BufferEncoding) => string): string;
+//# sourceMappingURL=session-id.d.ts.map

package/dist/lib/core-utils/session-id.js

@@ -0,0 +1,35 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const SESSION_ID_ENV_KEYS = [
+    "HQ_SESSION_ID",
+    "CLAUDE_CODE_SESSION_ID",
+    "CLAUDE_SESSION_ID",
+    "CODEX_SESSION_ID",
+    "CODEX_THREAD_ID",
+    "GROK_SESSION_ID",
+];
+export function validSessionId(value) {
+    return Boolean(value) && value !== "." && value !== ".." && /^[A-Za-z0-9._-]+$/.test(value);
+}
+export function sessionIdFromEnv(env) {
+    for (const key of SESSION_ID_ENV_KEYS) {
+        const value = (env[key] ?? "").replace(/[\t\n\v\f\r ]/g, "");
+        if (validSessionId(value))
+            return value;
+    }
+    return "";
+}
+/** Resolve the caller's session before using the global, last-writer-wins .current fallback. */
+export function resolveSessionId(root, env = process.env, readFile = (filePath, encoding) => fs.readFileSync(filePath, encoding)) {
+    const fromEnv = sessionIdFromEnv(env);
+    if (fromEnv)
+        return fromEnv;
+    try {
+        const current = readFile(path.join(root, "workspace", "sessions", ".current"), "utf8").replace(/[\t\n\v\f\r ]/g, "");
+        return validSessionId(current) ? current : "";
+    }
+    catch {
+        return "";
+    }
+}
+//# sourceMappingURL=session-id.js.map

package/dist/lib/daemon/catalog.js

@@ -230,7 +230,7 @@ function planService(service, ctx) {
             return [
                 base(service, {
                     kind: "scheduled",
-                    // Polls every 15 s so keep-alive resumes are admitted on time (#1396).
+                    // Polls every 15 s so local keep-alive resumes are admitted on time (#1396).
                     // Each pass is a fresh `hq` node process (~1.8 s CPU, ~200 MB RSS), so
                     // desktops first check the lane store in-process
                     // (lanes-reconcile-guard.ts) and fall back to the pre-#1396 60 s

package/dist/lib/daemon/lanes-reconcile-guard.d.ts

@@ -7,12 +7,13 @@
  * JSON reads, no child process) and tells the supervisor how urgent the next
  * pass is:
  *
- * - `spawn`: something the 15-second cadence exists for may be due — lane
- *   admission, a running lane's heartbeat, or a keep-alive resume (#1396).
+ * - `spawn`: something the desktop's 15-second cadence exists for may be due —
+ *   local lane admission/heartbeat, a local keep-alive resume (#1396), or a
+ *   pending question.
  * - `idle`: only work that ran on the pre-#1396 60-second cadence remains
- *   (terminal lanes, worker-profile resumes, question aging, Codex rollout
- *   retention, lead-autopilot registry). The supervisor runs it at most once
- *   per `idleIntervalSec`.
+ *   (terminal lanes, worker-profile resumes, question aging, outpost mirror
+ *   refresh, Codex retention, lead-autopilot registry). The supervisor runs it
+ *   at most once per `idleIntervalSec`.
  * - `skip`: the store holds no lane or question records, no lead registry and
  *   no lanes config, so a reconcile pass has no input to act on.
  *

package/dist/lib/daemon/lanes-reconcile-guard.js

@@ -7,12 +7,13 @@
  * JSON reads, no child process) and tells the supervisor how urgent the next
  * pass is:
  *
- * - `spawn`: something the 15-second cadence exists for may be due — lane
- *   admission, a running lane's heartbeat, or a keep-alive resume (#1396).
+ * - `spawn`: something the desktop's 15-second cadence exists for may be due —
+ *   local lane admission/heartbeat, a local keep-alive resume (#1396), or a
+ *   pending question.
  * - `idle`: only work that ran on the pre-#1396 60-second cadence remains
- *   (terminal lanes, worker-profile resumes, question aging, Codex rollout
- *   retention, lead-autopilot registry). The supervisor runs it at most once
- *   per `idleIntervalSec`.
+ *   (terminal lanes, worker-profile resumes, question aging, outpost mirror
+ *   refresh, Codex retention, lead-autopilot registry). The supervisor runs it
+ *   at most once per `idleIntervalSec`.
  * - `skip`: the store holds no lane or question records, no lead registry and
  *   no lanes config, so a reconcile pass has no input to act on.
  *
@@ -38,6 +39,9 @@ export const LEAD_REGISTRY_FILE = path.join("workspace", "lane-briefs", "juniors
  * keep-alive, which is checked separately.
  */
 const QUIET_LANE_STATES = new Set(["done", "failed", "interrupted", "cancelled", "killed", "blocked"]);
+const KNOWN_LANE_STATES = new Set([
+    "queued", "running", "awaiting_input", "blocked", "done", "failed", "interrupted", "cancelled", "killed",
+]);
 const realFs = {
     readdirSync: (dir) => fs.readdirSync(dir),
     readFileSync: (file, encoding) => fs.readFileSync(file, encoding),
@@ -63,9 +67,24 @@ function readRecord(fsDeps, file) {
     }
     return parsed;
 }
-/** A lane that may need the 15-second cadence. Unknown shapes count as urgent. */
+/** A lane that may need the desktop's 15-second cadence. Unknown shapes count as urgent. */
 function laneIsUrgent(lane) {
-    if (typeof lane.state !== "string" || !QUIET_LANE_STATES.has(lane.state))
+    if (typeof lane.state !== "string" || !KNOWN_LANE_STATES.has(lane.state))
+        return true;
+    const host = lane.host;
+    if (typeof host !== "object" || host === null || Array.isArray(host))
+        return true;
+    const hostRecord = host;
+    if (typeof hostRecord.id !== "string" || hostRecord.id.length === 0)
+        return true;
+    // This guard is installed only on desktops. The outpost's own daemon keeps
+    // its 15-second cadence; the desktop's outpost mirror/registry refresh can
+    // use the 60-second idle cadence. Pending questions remain urgent below.
+    if (hostRecord.kind === "outpost")
+        return false;
+    if (hostRecord.kind !== "local")
+        return true;
+    if (!QUIET_LANE_STATES.has(lane.state))
         return true;
     if (lane.keep_alive === true)
         return true;

package/dist/lib/daemon/run.d.ts

@@ -14,6 +14,12 @@ import { type HostApp } from "./supervisor.js";
 export declare const LOG_ROTATE_BYTES: number;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export declare const RESTART_EXIT_CODE = 75;
+/** A bounded shutdown deadline that can account for sync push persistence. */
+export declare function createShutdownCap(): {
+    promise: Promise<"timeout">;
+    extendForSyncRunnerPersist(): void;
+    clear(): void;
+};
 export interface DaemonLockConflictOutcome {
     exitCode: 0 | 1;
     stdout?: string;

package/dist/lib/daemon/run.js

@@ -45,12 +45,36 @@ import { stageHqChildBootstrap } from "./hq-child-bootstrap-stage.js";
 import { runnerSessionName } from "./remote-control.js";
 import { adoptChild, createChildTracker, finishSuccession, handoffEligible, readProcStart, stopOrphans, successionPaths, systemdKillMode, takeSuccession, writeHandoff, } from "./succession.js";
 import { listSyncRunnerProcesses, readWatchRunnerOwnerStatus, syncHeartbeatTimeoutMs, syncRunnerNodeOptions, watchRunnerOwnerStatusPath, } from "./sync-runner.js";
-import { STOP_ESCALATION_MS, createSupervisor, } from "./supervisor.js";
+import { STOP_ESCALATION_MS, SYNC_RUNNER_PERSIST_GRACE_MS, createSupervisor, } from "./supervisor.js";
 import { userToolDirs } from "./tools.js";
 import { daemonRunGuard } from "./lanes-reconcile-guard.js";
 export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export const RESTART_EXIT_CODE = 75;
+const NON_SYNC_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + 5_000;
+const SYNC_RUNNER_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + SYNC_RUNNER_PERSIST_GRACE_MS + 5_000;
+/** A bounded shutdown deadline that can account for sync push persistence. */
+export function createShutdownCap() {
+    const startedAt = Date.now();
+    let deadline = startedAt + NON_SYNC_SHUTDOWN_CAP_MS;
+    let resolveCap;
+    let timer;
+    const promise = new Promise((resolve) => { resolveCap = resolve; });
+    const arm = () => {
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(() => resolveCap("timeout"), Math.max(0, deadline - Date.now()));
+    };
+    arm();
+    return {
+        promise,
+        extendForSyncRunnerPersist() {
+            deadline = Math.max(deadline, startedAt + SYNC_RUNNER_SHUTDOWN_CAP_MS);
+            arm();
+        },
+        clear() { clearTimeout(timer); },
+    };
+}
 /** Preserve the legacy lock failure unless Anywhere explicitly enables the no-op behavior. */
 export function daemonLockConflictOutcome(lock, anywhereEnabled) {
     if (lock.ok)
@@ -772,6 +796,7 @@ export async function runDaemon(opts) {
     };
     // Set once the shutdown path exists below; a restart request before then is dropped.
     let restartDaemon = () => false;
+    let extendSyncShutdownCap;
     const supervisor = createSupervisor({
         machineType,
         host: opts.host,
@@ -794,6 +819,7 @@ export async function runDaemon(opts) {
         runGuard: daemonRunGuard,
         writeState: (state) => writeJsonAtomic(paths.statePath, state),
         log,
+        onSyncRunnerStopping: () => extendSyncShutdownCap?.(),
         syncOwnerBlockReason: () => {
             const config = readDaemonConfig(paths.configPath);
             const hqRoot = config.hqRoot ?? env.HQ_ROOT?.trim();
@@ -891,14 +917,15 @@ export async function runDaemon(opts) {
             stopping = true;
             log("info", `${why}; stopping services`);
             closeHqd();
-            // The supervisor escalates to SIGKILL after STOP_ESCALATION_MS; the extra
-            // margin only covers a child that survives even that.
-            let capTimer;
-            const cap = new Promise((r) => {
-                capTimer = setTimeout(() => r("timeout"), STOP_ESCALATION_MS + 5_000);
-            });
-            void Promise.race([supervisor.stop(), cap]).then((result) => {
-                clearTimeout(capTimer);
+            // Keep shutdown bounded, but let a stopping sync runner reach its persist deadline.
+            const cap = createShutdownCap();
+            extendSyncShutdownCap = cap.extendForSyncRunnerPersist;
+            if (supervisor.hasStoppingSyncRunner())
+                cap.extendForSyncRunnerPersist();
+            const servicesStopped = supervisor.stop();
+            void Promise.race([servicesStopped, cap.promise]).then((result) => {
+                cap.clear();
+                extendSyncShutdownCap = undefined;
                 if (result === "timeout")
                     log("error", "some services did not exit after SIGKILL; releasing the lock anyway");
                 else

package/dist/lib/daemon/supervisor.d.ts

@@ -13,7 +13,8 @@
  * - restart/trigger/stop requests from the CLI are polled and applied; a
  *   request for a unit that is not planned yet re-reads the plan first;
  * - stop() sends SIGTERM to every child, escalates to SIGKILL after
- *   STOP_ESCALATION_MS, and resolves once every child has exited;
+ *   STOP_ESCALATION_MS except for a sync runner already stopping, which it lets
+ *   finish persisting pending pushes before resolving;
  * - release() instead leaves every child running and reports the long-running
  *   ones, so the next daemon can adopt them (`adopt`). Adopted units whose
  *   command is unchanged keep running; changed ones are replaced one at a
@@ -26,6 +27,7 @@ import type { MachineType } from "./machine-type.js";
 import type { ControlRequest } from "./requests.js";
 import { syncPassResult } from "./sync-runner.js";
 export declare const STOP_ESCALATION_MS = 10000;
+export declare const SYNC_RUNNER_PERSIST_GRACE_MS = 60000;
 export declare const CLI_UPDATE_SYNC_IDLE_KILL_GRACE_MS = 60000;
 /** After a handoff, how long a replaced unit must stay up before the next one is replaced. */
 export declare const HANDOFF_STAGGER_MS = 15000;
@@ -98,6 +100,8 @@ export interface SupervisorDeps {
     restartDaemon?: () => void | boolean | Promise<boolean | void>;
     writeState: (state: DaemonState) => void;
     log: (level: "info" | "warn" | "error", msg: string) => void;
+    /** Extend the daemon shutdown deadline when a sync runner reports stopping. */
+    onSyncRunnerStopping?: () => void;
     now?: () => number;
     setTimeout?: (fn: () => void, ms: number) => unknown;
     clearTimeout?: (handle: unknown) => void;
@@ -120,6 +124,8 @@ export interface Supervisor {
     stop(): Promise<void>;
     reconcile(): void;
     state(): DaemonState;
+    /** True while a live sync runner has reported that it is persisting pushes. */
+    hasStoppingSyncRunner(): boolean;
     /** Stop supervising without signalling any child; returns the long-running units left running. */
     release(): ReleasedUnit[];
 }