@indigoai-us/hq-cli 5.345.49 → 5.345.50

package/dist/commands/dm.js

@@ -5,6 +5,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
 import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN } from "../lib/notify-recipient.js";
+import { dmForwardCliEnabled } from "./dm-forward-flag.js";
 /**
  * Classify a recipient arg as an email or a person/agent uid. Mirrors the
  * email/uid heuristic used by `hq members`. Returns null for neither.
@@ -346,6 +347,32 @@ function friendlyDmError(status, code, fallback) {
         return `Server error: ${fallback}`;
     return fallback;
 }
+function friendlyForwardError(code) {
+    switch (code) {
+        case "FORWARD_SOURCE_NOT_FOUND":
+            return "Source message not found or you cannot read it.";
+        case "INVALID_FORWARD_OF":
+            return "Invalid source message reference; provide a valid eventId and --from value.";
+        case "INVALID_FILE_ACCESS":
+            return "Invalid file access choice; use --grant-files or --omit-files.";
+        case "FORWARD_FILE_ACCESS_REQUIRED":
+            return "Some forwarded files are not readable by the recipient.";
+        case "FORWARD_FILES_NOT_ALLOWED":
+            return "Files cannot be granted for this channel or cross-company forward.";
+        case "CROSS_COMPANY_ACK_REQUIRED":
+            return "Warning: this forward crosses company boundaries; review the destination and retry with --cross-company.";
+        case "CROSS_COMPANY_FORBIDDEN":
+            return "Cross-company forwarding requires owner or admin access in both companies.";
+        case "FORWARD_FILE_SHARE_FORBIDDEN":
+            return "You do not have permission to share one or more forwarded files.";
+        case "FORWARD_FILE_GRANT_FAILED":
+            return "The recipient could not be granted access to a forwarded file; no message was sent.";
+        case "RECIPIENT_NOT_FOUND":
+            return "Recipient not found or not reachable.";
+        default:
+            return "Message forwarding failed; check the source and destination, then try again.";
+    }
+}
 /**
  * Resolve a connection request from a pending-requests list by a caller-supplied
  * identifier (email, personUid, or pairKey). Pure → unit-testable.
@@ -529,6 +556,21 @@ export async function fetchChannelMembers(token, channelId) {
     const data = (await res.json());
     return data.members ?? [];
 }
+/** Resolve structured mentions in a channel message body, failing before post on invalid names. */
+async function resolveChannelBodyMentions(token, channelId, body) {
+    const tokens = parseMentionTokens(body);
+    if (tokens.length === 0)
+        return { ok: true, body, mentions: [] };
+    const members = await fetchChannelMembers(token, channelId);
+    const resolved = resolveMentions(tokens, members);
+    if (!resolved.ok)
+        return resolved;
+    return {
+        ok: true,
+        body: stripMentionQuotes(body),
+        mentions: resolved.mentions,
+    };
+}
 /** Fetch a channel history page (GET /v1/notify/channels/{id}/messages). Newest-first. */
 async function fetchChannelMessages(token, channelId, query = {}) {
     const res = await vaultApiFetch({
@@ -546,9 +588,9 @@ async function fetchChannelMessages(token, channelId, query = {}) {
 /**
  * Channel DM path: `hq dm vyg-dev "msg"`, `hq dm '#vyg-dev' "msg"`, or
  * `hq dm --channel vyg-dev "msg"`. Resolves the caller's channel by name via
- * GET /v1/notify/channels, then posts the message into it. Scheduling /
- * prompt / details are 1:1-DM features and are rejected here rather than
- * silently dropped.
+ * GET /v1/notify/channels, then posts the message into it. Scheduling remains
+ * a 1:1-DM feature; prompt and details are supported for channel sends while
+ * the dm.forward-cli kill switch is enabled.
  */
 async function runChannelSend(channelName, message, opts) {
     try {
@@ -557,12 +599,17 @@ async function runChannelSend(channelName, message, opts) {
             console.error(chalk.red(`A message body is required: hq dm ${channelName} "<message>" (or hq dm --channel ${channelName} "<message>").`));
             process.exit(1);
         }
-        const unsupported = [
-            opts.prompt || opts.promptFile ? "--prompt/--prompt-file" : null,
-            opts.details || opts.detailsFile ? "--details/--details-file" : null,
-            opts.at ? "--at" : null,
-            opts.in ? "--in" : null,
-        ].filter(Boolean);
+        const hasChannelContext = opts.prompt !== undefined || opts.promptFile !== undefined ||
+            opts.details !== undefined || opts.detailsFile !== undefined;
+        if (hasChannelContext && !dmForwardCliEnabled()) {
+            console.error(chalk.red("Channel --details/--prompt support is disabled by the dm.forward-cli kill switch."));
+            process.exit(1);
+        }
+        if (opts.promptFile === "" || opts.detailsFile === "") {
+            console.error(chalk.red("--prompt-file and --details-file require a non-empty path."));
+            process.exit(1);
+        }
+        const unsupported = [opts.at ? "--at" : null, opts.in ? "--in" : null].filter(Boolean);
         if (unsupported.length > 0) {
             console.error(chalk.red(`${unsupported.join(", ")} ${unsupported.length === 1 ? "is" : "are"} only supported for 1:1 DMs, not channel messages.`));
             process.exit(1);
@@ -599,21 +646,16 @@ async function runChannelSend(channelName, message, opts) {
         // and posts the text literally.
         let mentions = [];
         if (opts.mentions !== false) {
-            const tokens = parseMentionTokens(body);
-            if (tokens.length > 0) {
-                const members = await fetchChannelMembers(token, channel.channelId);
-                const resolved = resolveMentions(tokens, members);
-                if (!resolved.ok) {
-                    console.error(chalk.red(resolved.error));
-                    process.exit(1);
-                    return;
-                }
-                mentions = resolved.mentions;
+            const resolved = await resolveChannelBodyMentions(token, channel.channelId, body);
+            if (!resolved.ok) {
+                console.error(chalk.red(resolved.error));
+                process.exit(1);
+                return;
             }
+            body = resolved.body;
+            mentions = resolved.mentions;
         }
         // Send the human-readable form: the quotes only existed for parsing.
-        if (mentions.length > 0)
-            body = stripMentionQuotes(body);
         let audience;
         if (opts.audience !== undefined && opts.audience !== "") {
             if (!DM_AUDIENCE_VALUES.includes(opts.audience)) {
@@ -622,6 +664,12 @@ async function runChannelSend(channelName, message, opts) {
             audience = opts.audience;
         }
         const payload = { body };
+        const prompt = opts.promptFile ? readFileSync(opts.promptFile, "utf8") : opts.prompt;
+        const details = opts.detailsFile ? readFileSync(opts.detailsFile, "utf8") : opts.details;
+        if (prompt !== undefined)
+            payload.prompt = prompt;
+        if (details !== undefined)
+            payload.details = details;
         if (mentions.length > 0)
             payload.mentions = mentions;
         if (rootEventId)
@@ -736,6 +784,130 @@ async function runDmSend(recipient, message, opts) {
         process.exit(1);
     }
 }
+async function resolveForwardSourceConversation(token, source) {
+    if (source.includes(",")) {
+        throw new Error("--from accepts one person or channel, not a group recipient list.");
+    }
+    const channelName = parseChannelName(source);
+    if (channelName !== null) {
+        const channel = await resolveChannel(token, channelName);
+        return { conversationId: channel.channelId };
+    }
+    const recipient = detectRecipient(source);
+    if (!recipient) {
+        throw new Error("--from must be a person email, person/agent UID, or channel name/ID.");
+    }
+    if (recipient.toPersonUid)
+        return { conversationId: recipient.toPersonUid };
+    const res = await vaultApiFetch({ token, path: "/v1/notify/contacts" });
+    if (!res.ok)
+        throw new Error("Could not resolve the source person; use their person UID.");
+    const data = (await res.json());
+    const peer = (data.contacts ?? []).find((contact) => contact.email?.trim().toLowerCase() === recipient.toEmail);
+    if (!peer?.personUid)
+        throw new Error("Source person not found in your contacts; use their person UID.");
+    return { conversationId: peer.personUid };
+}
+async function runDmForward(eventId, opts) {
+    try {
+        if (!dmForwardCliEnabled()) {
+            console.error(chalk.red("Message forwarding is disabled by the dm.forward-cli kill switch."));
+            process.exit(1);
+        }
+        if (opts.grantFiles && opts.omitFiles) {
+            console.error(chalk.red("Choose only one of --grant-files or --omit-files."));
+            process.exit(1);
+        }
+        if (opts.note !== undefined && opts.noteFile !== undefined) {
+            console.error(chalk.red("Choose only one of --note or --note-file."));
+            process.exit(1);
+        }
+        if (!eventId.trim()) {
+            console.error(chalk.red("A source eventId is required."));
+            process.exit(1);
+        }
+        if (opts.to.includes(",")) {
+            console.error(chalk.red("--to accepts one recipient or channel, not a group recipient list."));
+            process.exit(1);
+        }
+        const note = opts.noteFile !== undefined
+            ? readFileSync(opts.noteFile, "utf8")
+            : opts.note;
+        const token = await ensureCognitoToken();
+        const source = await resolveForwardSourceConversation(token, opts.from);
+        const destinationChannelName = parseChannelName(opts.to);
+        const fileAccess = opts.grantFiles ? "grant" : opts.omitFiles ? "omit" : undefined;
+        const shared = {
+            ...(note !== undefined ? { body: note } : {}),
+            forwardOf: { conversationId: source.conversationId, eventId: eventId.trim() },
+            ...(fileAccess ? { fileAccess } : {}),
+            ...(opts.crossCompany ? { acknowledgeCrossCompany: true } : {}),
+        };
+        let path;
+        let payload;
+        let destinationLabel;
+        if (destinationChannelName !== null) {
+            const channel = await resolveChannel(token, destinationChannelName);
+            path = `/v1/notify/channels/${encodeURIComponent(channel.channelId)}/messages`;
+            payload = { ...shared };
+            if (note !== undefined) {
+                const resolved = await resolveChannelBodyMentions(token, channel.channelId, note);
+                if (!resolved.ok) {
+                    console.error(chalk.red(resolved.error));
+                    process.exit(1);
+                    return;
+                }
+                payload.body = resolved.body;
+                if (resolved.mentions.length > 0)
+                    payload.mentions = resolved.mentions;
+            }
+            destinationLabel = `#${channel.name ?? destinationChannelName}`;
+        }
+        else {
+            const recipient = detectRecipient(opts.to);
+            if (!recipient) {
+                console.error(chalk.red("--to must be a person email, person/agent UID, or channel name/ID."));
+                process.exit(1);
+            }
+            path = "/v1/notify/dm";
+            payload = { ...recipient, ...shared };
+            destinationLabel = opts.to;
+        }
+        const res = await vaultApiFetch({ token, path, method: "POST", body: payload });
+        if (!res.ok) {
+            const err = (await res.json().catch(() => ({})));
+            const code = typeof err.code === "string" ? err.code : undefined;
+            if (code === "FORWARD_FILE_ACCESS_REQUIRED") {
+                console.error(chalk.yellow(friendlyForwardError(code)));
+                const files = Array.isArray(err.files) ? err.files : [];
+                for (const item of files) {
+                    if (!item || typeof item !== "object")
+                        continue;
+                    const file = item;
+                    const label = typeof file.name === "string" ? file.name : "forwarded file";
+                    const location = typeof file.vaultPath === "string" ? file.vaultPath :
+                        typeof file.path === "string" ? file.path : undefined;
+                    console.error(chalk.dim(`  - ${label}${location ? ` (${location})` : ""}`));
+                }
+                console.error(chalk.dim("Retry with --grant-files or --omit-files."));
+            }
+            else {
+                console.error(chalk.red(friendlyForwardError(code)));
+            }
+            process.exit(1);
+        }
+        const data = (await res.json().catch(() => ({})));
+        if (typeof data.eventId !== "string" || !data.eventId.trim()) {
+            console.error(chalk.red("Forward succeeded without returning an eventId."));
+            process.exit(1);
+        }
+        console.log(chalk.green(`Message forwarded to ${destinationLabel}. New eventId: ${data.eventId}`));
+    }
+    catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
 async function runDmRequests() {
     try {
         const token = await ensureCognitoToken();
@@ -871,7 +1043,11 @@ export function formatThreadMessage(m, nowMs) {
     const who = m.direction === "out" ? "you" : senderLabel(m);
     const when = chalk.dim(formatRelativeTime(m.createdAt, nowMs));
     const audienceTag = m.audience === "agent" ? chalk.dim(" [agent]") : "";
-    return `${arrow} ${chalk.bold(who)} ${when}${audienceTag}\n    ${firstLine(m.body)}${formatAttachments(m)}`;
+    const id = m.eventId ? `  ${chalk.dim(m.eventId)}` : "";
+    const forwarded = m.forwardedFrom?.senderName
+        ? `\n    ${chalk.dim(`Forwarded from ${m.forwardedFrom.senderName}`)}`
+        : "";
+    return `${arrow} ${chalk.bold(who)} ${when}${audienceTag}${id}${forwarded}\n    ${firstLine(m.body)}${formatAttachments(m)}`;
 }
 /** Render one channel/group message line. */
 export function formatChannelMessage(m, nowMs, opts = {}) {
@@ -886,7 +1062,10 @@ export function formatChannelMessage(m, nowMs, opts = {}) {
         (senderLabel(m).toLowerCase() === "hq"
             ? "System notification (no text provided)."
             : "(no message text)");
-    return `${indent}${who} ${when}${idPart}\n${bodyIndent}${readableBody}${formatAttachments(m, bodyIndent)}`;
+    const forwarded = m.forwardedFrom?.senderName
+        ? `${bodyIndent}${chalk.dim(`Forwarded from ${m.forwardedFrom.senderName}`)}\n`
+        : "";
+    return `${indent}${who} ${when}${idPart}\n${forwarded}${bodyIndent}${readableBody}${formatAttachments(m, bodyIndent)}`;
 }
 /**
  * Read the caller's person/agent uid and email from a JWT we already hold.
@@ -1330,16 +1509,29 @@ export function registerDmCommand(program) {
         .option("--channel <name>", "Post the message to one of your DM channels by name (e.g. --channel vyg-dev)")
         .option("--no-mentions", "Do not resolve `@name` in a channel message into structured mentions — post the text literally")
         .option("--thread <eventId>", 'Reply in a channel thread. Pass a root eventId from `hq dm channel`, or `last` for your most recent top-level message in that channel')
-        .option("--prompt <text>", "Agent-context prompt the recipient can one-click copy into their agent (1:1 DMs only)")
-        .option("--prompt-file <path>", "Read the agent prompt from a file (1:1 DMs only)")
-        .option("--details <text>", "Longer detail shown in the recipient's DM detail window (1:1 DMs only)")
-        .option("--details-file <path>", "Read the details from a file (1:1 DMs only)")
+        .option("--prompt <text>", "Agent-context prompt the recipient can one-click copy into their agent (1:1 DMs; channel sends also supported)")
+        .option("--prompt-file <path>", "Read the agent prompt from a file (1:1 DMs; channel sends also supported)")
+        .option("--details <text>", "Longer detail shown in the recipient's DM detail window (1:1 DMs; channel sends also supported)")
+        .option("--details-file <path>", "Read the details from a file (1:1 DMs; channel sends also supported)")
         .option("--at <iso>", "Schedule delivery at an ISO8601 time (store-and-forward; delivered within ~60s of the time; 1:1 DMs only)")
         .option("--in <duration>", "Schedule delivery after a relative delay: 30s, 10m, 2h, 1d (1:1 DMs only)")
         .option("--audience <human|agent|both>", "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both")
         .action(async (recipient, message, opts) => {
         await runDmSend(recipient, message, opts);
     });
+    dm
+        .command("forward <eventId>")
+        .description("Forward a DM or channel message through the existing send routes.")
+        .requiredOption("--from <person|channel>", "Source person email/UID or channel name/ID")
+        .requiredOption("--to <person|agent|channel>", "Destination person email/UID, agent UID, or channel name/ID")
+        .option("--note <text>", "Optional note to add above the forwarded message")
+        .option("--note-file <path>", "Read the optional forward note from a file")
+        .option("--grant-files", "Grant the recipient access to files they cannot currently open")
+        .option("--omit-files", "Omit files the recipient cannot currently open")
+        .option("--cross-company", "Confirm forwarding across company boundaries")
+        .action(async (eventId, opts) => {
+        await runDmForward(eventId, opts);
+    });
     dm
         .command("inbox")
         .description("List your recent incoming direct messages.")

package/dist/lib/daemon/hq-cloud.d.ts

@@ -14,8 +14,6 @@ export interface HqCloudCopy {
 }
 export interface PickedHqCloud extends HqCloudCopy {
     source: "bundled" | "managed";
-    /** Set when a version is pinned but that version is not the installed managed copy. */
-    pinnedVersionMissing?: string;
 }
 export type ManagedHqCloud = PickedHqCloud & {
     source: "managed";
@@ -85,6 +83,8 @@ export interface UpdateHqCloudDeps {
     run?: (file: string, args: string[], shell: boolean, env: NodeJS.ProcessEnv) => NpmRunResult;
     bundled?: HqCloudCopy | null;
     platform?: NodeJS.Platform;
+    /** Test seam for bounded install retry delays. */
+    sleep?: (ms: number) => void;
 }
 /** Install or update the updater's copy, as this (the login) user. */
 export declare function updateManagedHqCloud(daemonRoot: string, env: NodeJS.ProcessEnv, deps?: UpdateHqCloudDeps): HqCloudUpdateOutcome;

package/dist/lib/daemon/hq-cloud.js

@@ -54,10 +54,11 @@ export function pickHqCloud(bundled, managed, usable = () => true, pinnedVersion
         if (managed && managed.version === pinnedVersion && b && m && m[0] === b[0] && usable(managed)) {
             return { ...managed, source: "managed" };
         }
-        // The pinned version is not installed yet (the updater installs it). Keep
-        // running the newest usable copy meanwhile instead of dropping to an older
-        // bundled one, and report the missing pin.
-        return { ...pickNewest(bundled, managed, b, m, usable), pinnedVersionMissing: pinnedVersion };
+        if (bundled.version === pinnedVersion && b && usable(bundled))
+            return { ...bundled, source: "bundled" };
+        // A pin is an exact version contract. Do not silently run another installed
+        // package while npm has not yet delivered the pinned version.
+        return null;
     }
     return pickNewest(bundled, managed, b, m, usable);
 }
@@ -160,6 +161,17 @@ export function currentHqCloudAfterLeaseRelease(daemonRoot, expectedVersion) {
         return null;
     return { ...managed, source: "managed" };
 }
+function isTransientNpmFailure(result) {
+    // spawnSync's ETIMEDOUT means this attempt hit our full 10-minute process
+    // timeout. Retrying that result would multiply one stall across every attempt.
+    if (result.error?.code === "ETIMEDOUT")
+        return false;
+    const text = `${result.stderr ?? ""}\n${result.stdout ?? ""}\n${result.error?.message ?? ""}`;
+    return /\b(?:ETARGET|EAI_AGAIN|ECONNRESET|ECONNREFUSED|ENETUNREACH|ENOTFOUND|ETIMEDOUT|EHOSTUNREACH|ENETWORK|ECONNABORTED)\b|\bnotarget\b|network timeout|fetch failed|socket hang up/i.test(text);
+}
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
 function runNpm(file, args, shell, env) {
     return spawnSync(file, args, {
         encoding: "utf8",
@@ -180,7 +192,7 @@ export function updateManagedHqCloud(daemonRoot, env, deps = {}) {
     const platform = deps.platform ?? process.platform;
     const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
     const bundled = deps.bundled !== undefined ? deps.bundled : bundledHqCloud();
-    const from = currentHqCloud(daemonRoot)?.version ?? null;
+    const from = managedHqCloud(daemonRoot)?.version ?? bundled?.version ?? null;
     if (!bundled)
         return { ok: false, from, to: null, detail: "this CLI install has no bundled hq-cloud to match" };
     const prefix = managedHqCloudDir(daemonRoot);
@@ -203,9 +215,26 @@ export function updateManagedHqCloud(daemonRoot, env, deps = {}) {
         version = latest;
     }
     const cmd = hqCloudInstallCommand(prefix, version, platform);
-    const r = run(cmd.file, cmd.args, cmd.shell, env);
-    if (r.status !== 0)
-        return { ok: false, from, to: null, detail: npmFailure(r) };
-    return { ok: true, from, to: currentHqCloud(daemonRoot)?.version ?? null };
+    const retryDelays = [500, 1_000, 2_000];
+    const sleep = deps.sleep ?? sleepSync;
+    let r;
+    for (let attempt = 0;; attempt++) {
+        r = run(cmd.file, cmd.args, cmd.shell, env);
+        if (r.status === 0)
+            break;
+        const retryable = pinnedVersion !== undefined && pinnedVersion !== null && isTransientNpmFailure(r);
+        const delay = retryDelays[attempt];
+        if (!retryable || delay === undefined) {
+            const retries = retryable ? attempt : 0;
+            return {
+                ok: false,
+                from,
+                to: null,
+                detail: retries > 0 ? `pinned hq-cloud install failed after ${retries + 1} attempts: ${npmFailure(r)}` : npmFailure(r),
+            };
+        }
+        sleep(delay);
+    }
+    return { ok: true, from, to: managedHqCloud(daemonRoot)?.version ?? null };
 }
 //# sourceMappingURL=hq-cloud.js.map

package/dist/lib/daemon/run.js

@@ -105,17 +105,26 @@ const HANDOFF_FLAG_TIMEOUT_MS = 10_000;
 const HQD_PERSON_SETTING_GRACE_MS = 30 * 60_000;
 export function syncRunnerSourceForPlan(stagedRunnerPath, hqCloud, legacyBundledRunnerPath = null, staged = { version: null }, currentSyncRunnerSource = null) {
     // A managed copy lives in the daemon directory, so it survives a CLI
-    // replacement. Before lease release pickHqCloud returns it only when it is
-    // pinned or newer than the bundled copy; after release it is the only
-    // eligible package, so it must not displace a newer staged bundle unless it
-    // is the pinned version. The staged bundle is built from the bundled copy and
-    // otherwise only stands in for that copy (hq-cli#1547).
+    // replacement. A configured pin is an exact version contract: only that
+    // installed package or an exactly matching staged bundle may start.
     const pin = staged.pinnedVersion;
-    const hasRunnerAtOrAbovePin = pin != null &&
-        ((staged.version !== null && !hqCloudVersionOlder(staged.version, pin)) ||
-            (hqCloud !== null && !hqCloudVersionOlder(hqCloud.version, pin)));
-    if (pin && !hasRunnerAtOrAbovePin && currentSyncRunnerSource?.runnerPath) {
-        return currentSyncRunnerSource;
+    if (pin) {
+        if (hqCloud?.version === pin) {
+            if (hqCloud.source === "managed") {
+                return { kind: "managed-full-package", runnerPath: path.join(hqCloud.root, "dist", "bin", "sync-runner.js") };
+            }
+            if (stagedRunnerPath && staged.version === pin)
+                return { kind: "staged-sync", runnerPath: stagedRunnerPath };
+            return { kind: "bundled-full-package", runnerPath: path.join(hqCloud.root, "dist", "bin", "sync-runner.js") };
+        }
+        if (stagedRunnerPath && staged.version === pin)
+            return { kind: "staged-sync", runnerPath: stagedRunnerPath };
+        // A transient install gap must not stop a runner that is already serving
+        // sync. On cold start there is no current source, so mismatched bundles
+        // remain unavailable and cannot be started.
+        if (currentSyncRunnerSource?.runnerPath)
+            return currentSyncRunnerSource;
+        return { kind: "unavailable", runnerPath: null };
     }
     const managedYieldsToStaged = stagedRunnerPath !== null &&
         hqCloud?.source === "managed" &&
@@ -408,6 +417,7 @@ export async function runDaemon(opts) {
     let legacySyncRunnerPathChecked = false;
     let legacySyncRunnerPath = null;
     let lastPlannedSyncRunnerSource = null;
+    let lastPlannedSyncRunnerVersion = null;
     let packageUseLeaseReleased = false;
     let hqCloudVersionBeforeRelease = null;
     let startupPlanOpen = true;
@@ -580,6 +590,7 @@ export async function runDaemon(opts) {
     let warnedMissingPin = null;
     let warnedMissingSyncRunner = false;
     const daemonSyncRunnerPids = new Set();
+    let supervisor = null;
     const plan = () => {
         const config = readDaemonConfig(paths.configPath);
         const legacy = legacyUnits();
@@ -594,19 +605,34 @@ export async function runDaemon(opts) {
             : currentHqCloud(paths.root);
         if (!packageUseLeaseReleased)
             hqCloudVersionBeforeRelease = hqCloud?.version ?? staged?.metadata.version ?? null;
-        const missingPin = hqCloud?.pinnedVersionMissing ?? null;
-        if (missingPin !== warnedMissingPin) {
-            warnedMissingPin = missingPin;
-            if (missingPin && hqCloud) {
-                log("warn", `hq-cloud is pinned to ${missingPin}, which is not installed; running ${hqCloud.version} (${hqCloud.source}) until the updater installs it`);
-            }
-        }
         if (!packageUseLeaseReleased && !legacySyncRunnerPathChecked) {
             legacySyncRunnerPath = resolveSyncRunnerPath();
             legacySyncRunnerPathChecked = true;
         }
-        const syncSource = syncRunnerSourceForPlan(staged?.runnerPath ?? null, hqCloud, packageUseLeaseReleased ? null : legacySyncRunnerPath, { version: staged?.metadata.version ?? null, pinnedVersion: config.hqCloudVersion ?? null }, lastPlannedSyncRunnerSource);
+        const syncSource = syncRunnerSourceForPlan(staged?.runnerPath ?? null, hqCloud, packageUseLeaseReleased ? null : legacySyncRunnerPath, { version: staged?.metadata.version ?? null, pinnedVersion: config.hqCloudVersion ?? null }, supervisor?.state().units.some((unit) => unit.id === "sync" && unit.status === "running" && typeof unit.pid === "number")
+            ? lastPlannedSyncRunnerSource
+            : null);
+        const retainedLiveSource = syncSource === lastPlannedSyncRunnerSource;
+        const syncRunnerVersion = retainedLiveSource
+            ? lastPlannedSyncRunnerVersion
+            : syncSource.kind === "staged-sync"
+                ? staged?.metadata.version ?? null
+                : hqCloud?.version ?? null;
+        const missingPin = config.hqCloudVersion && syncRunnerVersion !== config.hqCloudVersion ? config.hqCloudVersion : null;
+        const pinWarningKey = missingPin
+            ? `${missingPin}:${retainedLiveSource ? syncRunnerVersion ?? "unknown" : "unavailable"}`
+            : null;
+        if (pinWarningKey !== warnedMissingPin) {
+            warnedMissingPin = pinWarningKey;
+            if (missingPin && retainedLiveSource) {
+                log("warn", `hq-cloud is pinned to ${missingPin}, but the running sync runner is ${syncRunnerVersion ?? "unknown"}; keeping it running while the updater retries`);
+            }
+            else if (missingPin && syncSource.kind === "unavailable") {
+                log("warn", `hq-cloud is pinned to ${missingPin}, which is not installed; sync is unavailable until the updater installs it`);
+            }
+        }
         lastPlannedSyncRunnerSource = syncSource.runnerPath ? syncSource : null;
+        lastPlannedSyncRunnerVersion = syncSource.runnerPath ? syncRunnerVersion : null;
         if (!syncSource.runnerPath && !warnedMissingSyncRunner) {
             warnedMissingSyncRunner = true;
             log("warn", "the hq-cloud sync runner was not found in this CLI install; sync is unavailable");
@@ -797,7 +823,7 @@ export async function runDaemon(opts) {
     // Set once the shutdown path exists below; a restart request before then is dropped.
     let restartDaemon = () => false;
     let extendSyncShutdownCap;
-    const supervisor = createSupervisor({
+    supervisor = createSupervisor({
         machineType,
         host: opts.host,
         pid: process.pid,

package/dist/lib/db/app-ref.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Resolve the `--app` value of the `hq db` commands to an app id. The value can
+ * be the app id, its name or its subdomain. Only apps in the given company are
+ * searched, so a name never resolves to another company's app.
+ */
+import { deployApiRequest } from "../deploy-api.js";
+export interface AppRefRow {
+    id?: unknown;
+    name?: unknown;
+    subdomain?: unknown;
+}
+export declare class AppRefError extends Error {
+    constructor(message: string);
+}
+export declare function matchAppRef(apps: AppRefRow[], ref: string): string;
+export declare function resolveAppRef(input: {
+    token: string;
+    companySlug: string;
+    ref: string;
+}, request?: typeof deployApiRequest): Promise<string>;
+//# sourceMappingURL=app-ref.d.ts.map

package/dist/lib/db/app-ref.js

@@ -0,0 +1,45 @@
+/**
+ * Resolve the `--app` value of the `hq db` commands to an app id. The value can
+ * be the app id, its name or its subdomain. Only apps in the given company are
+ * searched, so a name never resolves to another company's app.
+ */
+import { deployApiRequest } from "../deploy-api.js";
+import { listDeployApps } from "../deploy-apps.js";
+export class AppRefError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AppRefError";
+    }
+}
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function matchAppRef(apps, ref) {
+    const ids = (rows) => [
+        ...new Set(rows.map((row) => row.id).filter((id) => typeof id === "string")),
+    ];
+    const byId = ids(apps.filter((row) => row.id === ref));
+    if (byId.length === 1)
+        return byId[0];
+    const byName = ids(apps.filter((row) => row.name === ref || row.subdomain === ref));
+    if (byName.length === 1)
+        return byName[0];
+    if (byName.length > 1) {
+        throw new AppRefError(`More than one app in this company is called "${ref}" (${byName.join(", ")}). Use the app id.`);
+    }
+    throw new AppRefError(`No app called "${ref}" was found in this company.`);
+}
+export async function resolveAppRef(input, request = deployApiRequest) {
+    const ref = input.ref.trim();
+    if (UUID_RE.test(ref))
+        return ref;
+    const headers = { "X-Org-Slug": input.companySlug };
+    const apps = await listDeployApps(async (cursor) => {
+        const route = cursor ? `/api/apps?cursor=${encodeURIComponent(cursor)}` : "/api/apps";
+        const res = await request(input.token, route, "GET", undefined, headers);
+        if (!res.ok) {
+            throw new AppRefError(`Could not look up the app "${ref}" (hq-deploy returned ${res.status}). Use the app id.`);
+        }
+        return (await res.json());
+    });
+    return matchAppRef(apps, ref);
+}
+//# sourceMappingURL=app-ref.js.map

package/dist/lib/lanes/keep-alive-audit.d.ts

@@ -1,4 +1,4 @@
-type KeepAliveAuditVerdict = "on_time" | "late" | "early_wake" | "message_wake" | "work_triggered" | "self_wake" | "early_by_keep_alive" | "restarted_untimed" | "not_restarted" | "stranded" | "keep_alive_off" | "waiting";
+type KeepAliveAuditVerdict = "on_time" | "late" | "early_wake" | "message_wake" | "work_triggered" | "self_wake" | "early_by_keep_alive" | "restarted_untimed" | "not_restarted" | "stranded" | "keep_alive_off" | "finished_story" | "idle_no_queued_work" | "waiting";
 interface KeepAliveAuditRestart {
     at: string | null;
     trigger: string;
@@ -17,6 +17,7 @@ interface KeepAliveAuditRow {
     blocked_outcome?: "woken" | "skipped";
     blocked_outcome_reason?: string;
     verdict: KeepAliveAuditVerdict;
+    queued_work_at_audit_time?: boolean;
     remediation?: string;
     terminal_reason?: string;
 }
@@ -25,6 +26,8 @@ interface KeepAliveAuditSummary {
     not_restarted: number;
     stranded: number;
     restarted_untimed: number;
+    finished_story: number;
+    idle_no_queued_work: number;
     late_restarts_after_window: number;
     late_over_10m: number;
     early_wake_by_others: number;
@@ -53,6 +56,7 @@ export interface StopEnvelope {
     name: string;
     mtimeMs: number;
     decision: "done" | "blocked";
+    storyComplete: boolean;
     nextCheckAt?: string;
 }
 export declare function readStopEnvelopes(hqRoot: string, laneId: string): {