@indigoai-us/hq-cli 5.345.49 → 5.345.51

package/dist/commands/dm.js

@@ -5,6 +5,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
 import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN } from "../lib/notify-recipient.js";
+import { dmForwardCliEnabled } from "./dm-forward-flag.js";
 /**
  * Classify a recipient arg as an email or a person/agent uid. Mirrors the
  * email/uid heuristic used by `hq members`. Returns null for neither.
@@ -346,6 +347,32 @@ function friendlyDmError(status, code, fallback) {
         return `Server error: ${fallback}`;
     return fallback;
 }
+function friendlyForwardError(code) {
+    switch (code) {
+        case "FORWARD_SOURCE_NOT_FOUND":
+            return "Source message not found or you cannot read it.";
+        case "INVALID_FORWARD_OF":
+            return "Invalid source message reference; provide a valid eventId and --from value.";
+        case "INVALID_FILE_ACCESS":
+            return "Invalid file access choice; use --grant-files or --omit-files.";
+        case "FORWARD_FILE_ACCESS_REQUIRED":
+            return "Some forwarded files are not readable by the recipient.";
+        case "FORWARD_FILES_NOT_ALLOWED":
+            return "Files cannot be granted for this channel or cross-company forward.";
+        case "CROSS_COMPANY_ACK_REQUIRED":
+            return "Warning: this forward crosses company boundaries; review the destination and retry with --cross-company.";
+        case "CROSS_COMPANY_FORBIDDEN":
+            return "Cross-company forwarding requires owner or admin access in both companies.";
+        case "FORWARD_FILE_SHARE_FORBIDDEN":
+            return "You do not have permission to share one or more forwarded files.";
+        case "FORWARD_FILE_GRANT_FAILED":
+            return "The recipient could not be granted access to a forwarded file; no message was sent.";
+        case "RECIPIENT_NOT_FOUND":
+            return "Recipient not found or not reachable.";
+        default:
+            return "Message forwarding failed; check the source and destination, then try again.";
+    }
+}
 /**
  * Resolve a connection request from a pending-requests list by a caller-supplied
  * identifier (email, personUid, or pairKey). Pure → unit-testable.
@@ -529,6 +556,21 @@ export async function fetchChannelMembers(token, channelId) {
     const data = (await res.json());
     return data.members ?? [];
 }
+/** Resolve structured mentions in a channel message body, failing before post on invalid names. */
+async function resolveChannelBodyMentions(token, channelId, body) {
+    const tokens = parseMentionTokens(body);
+    if (tokens.length === 0)
+        return { ok: true, body, mentions: [] };
+    const members = await fetchChannelMembers(token, channelId);
+    const resolved = resolveMentions(tokens, members);
+    if (!resolved.ok)
+        return resolved;
+    return {
+        ok: true,
+        body: stripMentionQuotes(body),
+        mentions: resolved.mentions,
+    };
+}
 /** Fetch a channel history page (GET /v1/notify/channels/{id}/messages). Newest-first. */
 async function fetchChannelMessages(token, channelId, query = {}) {
     const res = await vaultApiFetch({
@@ -546,9 +588,9 @@ async function fetchChannelMessages(token, channelId, query = {}) {
 /**
  * Channel DM path: `hq dm vyg-dev "msg"`, `hq dm '#vyg-dev' "msg"`, or
  * `hq dm --channel vyg-dev "msg"`. Resolves the caller's channel by name via
- * GET /v1/notify/channels, then posts the message into it. Scheduling /
- * prompt / details are 1:1-DM features and are rejected here rather than
- * silently dropped.
+ * GET /v1/notify/channels, then posts the message into it. Scheduling remains
+ * a 1:1-DM feature; prompt and details are supported for channel sends while
+ * the dm.forward-cli kill switch is enabled.
  */
 async function runChannelSend(channelName, message, opts) {
     try {
@@ -557,12 +599,17 @@ async function runChannelSend(channelName, message, opts) {
             console.error(chalk.red(`A message body is required: hq dm ${channelName} "<message>" (or hq dm --channel ${channelName} "<message>").`));
             process.exit(1);
         }
-        const unsupported = [
-            opts.prompt || opts.promptFile ? "--prompt/--prompt-file" : null,
-            opts.details || opts.detailsFile ? "--details/--details-file" : null,
-            opts.at ? "--at" : null,
-            opts.in ? "--in" : null,
-        ].filter(Boolean);
+        const hasChannelContext = opts.prompt !== undefined || opts.promptFile !== undefined ||
+            opts.details !== undefined || opts.detailsFile !== undefined;
+        if (hasChannelContext && !dmForwardCliEnabled()) {
+            console.error(chalk.red("Channel --details/--prompt support is disabled by the dm.forward-cli kill switch."));
+            process.exit(1);
+        }
+        if (opts.promptFile === "" || opts.detailsFile === "") {
+            console.error(chalk.red("--prompt-file and --details-file require a non-empty path."));
+            process.exit(1);
+        }
+        const unsupported = [opts.at ? "--at" : null, opts.in ? "--in" : null].filter(Boolean);
         if (unsupported.length > 0) {
             console.error(chalk.red(`${unsupported.join(", ")} ${unsupported.length === 1 ? "is" : "are"} only supported for 1:1 DMs, not channel messages.`));
             process.exit(1);
@@ -599,21 +646,16 @@ async function runChannelSend(channelName, message, opts) {
         // and posts the text literally.
         let mentions = [];
         if (opts.mentions !== false) {
-            const tokens = parseMentionTokens(body);
-            if (tokens.length > 0) {
-                const members = await fetchChannelMembers(token, channel.channelId);
-                const resolved = resolveMentions(tokens, members);
-                if (!resolved.ok) {
-                    console.error(chalk.red(resolved.error));
-                    process.exit(1);
-                    return;
-                }
-                mentions = resolved.mentions;
+            const resolved = await resolveChannelBodyMentions(token, channel.channelId, body);
+            if (!resolved.ok) {
+                console.error(chalk.red(resolved.error));
+                process.exit(1);
+                return;
             }
+            body = resolved.body;
+            mentions = resolved.mentions;
         }
         // Send the human-readable form: the quotes only existed for parsing.
-        if (mentions.length > 0)
-            body = stripMentionQuotes(body);
         let audience;
         if (opts.audience !== undefined && opts.audience !== "") {
             if (!DM_AUDIENCE_VALUES.includes(opts.audience)) {
@@ -622,6 +664,12 @@ async function runChannelSend(channelName, message, opts) {
             audience = opts.audience;
         }
         const payload = { body };
+        const prompt = opts.promptFile ? readFileSync(opts.promptFile, "utf8") : opts.prompt;
+        const details = opts.detailsFile ? readFileSync(opts.detailsFile, "utf8") : opts.details;
+        if (prompt !== undefined)
+            payload.prompt = prompt;
+        if (details !== undefined)
+            payload.details = details;
         if (mentions.length > 0)
             payload.mentions = mentions;
         if (rootEventId)
@@ -736,6 +784,130 @@ async function runDmSend(recipient, message, opts) {
         process.exit(1);
     }
 }
+async function resolveForwardSourceConversation(token, source) {
+    if (source.includes(",")) {
+        throw new Error("--from accepts one person or channel, not a group recipient list.");
+    }
+    const channelName = parseChannelName(source);
+    if (channelName !== null) {
+        const channel = await resolveChannel(token, channelName);
+        return { conversationId: channel.channelId };
+    }
+    const recipient = detectRecipient(source);
+    if (!recipient) {
+        throw new Error("--from must be a person email, person/agent UID, or channel name/ID.");
+    }
+    if (recipient.toPersonUid)
+        return { conversationId: recipient.toPersonUid };
+    const res = await vaultApiFetch({ token, path: "/v1/notify/contacts" });
+    if (!res.ok)
+        throw new Error("Could not resolve the source person; use their person UID.");
+    const data = (await res.json());
+    const peer = (data.contacts ?? []).find((contact) => contact.email?.trim().toLowerCase() === recipient.toEmail);
+    if (!peer?.personUid)
+        throw new Error("Source person not found in your contacts; use their person UID.");
+    return { conversationId: peer.personUid };
+}
+async function runDmForward(eventId, opts) {
+    try {
+        if (!dmForwardCliEnabled()) {
+            console.error(chalk.red("Message forwarding is disabled by the dm.forward-cli kill switch."));
+            process.exit(1);
+        }
+        if (opts.grantFiles && opts.omitFiles) {
+            console.error(chalk.red("Choose only one of --grant-files or --omit-files."));
+            process.exit(1);
+        }
+        if (opts.note !== undefined && opts.noteFile !== undefined) {
+            console.error(chalk.red("Choose only one of --note or --note-file."));
+            process.exit(1);
+        }
+        if (!eventId.trim()) {
+            console.error(chalk.red("A source eventId is required."));
+            process.exit(1);
+        }
+        if (opts.to.includes(",")) {
+            console.error(chalk.red("--to accepts one recipient or channel, not a group recipient list."));
+            process.exit(1);
+        }
+        const note = opts.noteFile !== undefined
+            ? readFileSync(opts.noteFile, "utf8")
+            : opts.note;
+        const token = await ensureCognitoToken();
+        const source = await resolveForwardSourceConversation(token, opts.from);
+        const destinationChannelName = parseChannelName(opts.to);
+        const fileAccess = opts.grantFiles ? "grant" : opts.omitFiles ? "omit" : undefined;
+        const shared = {
+            ...(note !== undefined ? { body: note } : {}),
+            forwardOf: { conversationId: source.conversationId, eventId: eventId.trim() },
+            ...(fileAccess ? { fileAccess } : {}),
+            ...(opts.crossCompany ? { acknowledgeCrossCompany: true } : {}),
+        };
+        let path;
+        let payload;
+        let destinationLabel;
+        if (destinationChannelName !== null) {
+            const channel = await resolveChannel(token, destinationChannelName);
+            path = `/v1/notify/channels/${encodeURIComponent(channel.channelId)}/messages`;
+            payload = { ...shared };
+            if (note !== undefined) {
+                const resolved = await resolveChannelBodyMentions(token, channel.channelId, note);
+                if (!resolved.ok) {
+                    console.error(chalk.red(resolved.error));
+                    process.exit(1);
+                    return;
+                }
+                payload.body = resolved.body;
+                if (resolved.mentions.length > 0)
+                    payload.mentions = resolved.mentions;
+            }
+            destinationLabel = `#${channel.name ?? destinationChannelName}`;
+        }
+        else {
+            const recipient = detectRecipient(opts.to);
+            if (!recipient) {
+                console.error(chalk.red("--to must be a person email, person/agent UID, or channel name/ID."));
+                process.exit(1);
+            }
+            path = "/v1/notify/dm";
+            payload = { ...recipient, ...shared };
+            destinationLabel = opts.to;
+        }
+        const res = await vaultApiFetch({ token, path, method: "POST", body: payload });
+        if (!res.ok) {
+            const err = (await res.json().catch(() => ({})));
+            const code = typeof err.code === "string" ? err.code : undefined;
+            if (code === "FORWARD_FILE_ACCESS_REQUIRED") {
+                console.error(chalk.yellow(friendlyForwardError(code)));
+                const files = Array.isArray(err.files) ? err.files : [];
+                for (const item of files) {
+                    if (!item || typeof item !== "object")
+                        continue;
+                    const file = item;
+                    const label = typeof file.name === "string" ? file.name : "forwarded file";
+                    const location = typeof file.vaultPath === "string" ? file.vaultPath :
+                        typeof file.path === "string" ? file.path : undefined;
+                    console.error(chalk.dim(`  - ${label}${location ? ` (${location})` : ""}`));
+                }
+                console.error(chalk.dim("Retry with --grant-files or --omit-files."));
+            }
+            else {
+                console.error(chalk.red(friendlyForwardError(code)));
+            }
+            process.exit(1);
+        }
+        const data = (await res.json().catch(() => ({})));
+        if (typeof data.eventId !== "string" || !data.eventId.trim()) {
+            console.error(chalk.red("Forward succeeded without returning an eventId."));
+            process.exit(1);
+        }
+        console.log(chalk.green(`Message forwarded to ${destinationLabel}. New eventId: ${data.eventId}`));
+    }
+    catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
 async function runDmRequests() {
     try {
         const token = await ensureCognitoToken();
@@ -871,7 +1043,11 @@ export function formatThreadMessage(m, nowMs) {
     const who = m.direction === "out" ? "you" : senderLabel(m);
     const when = chalk.dim(formatRelativeTime(m.createdAt, nowMs));
     const audienceTag = m.audience === "agent" ? chalk.dim(" [agent]") : "";
-    return `${arrow} ${chalk.bold(who)} ${when}${audienceTag}\n    ${firstLine(m.body)}${formatAttachments(m)}`;
+    const id = m.eventId ? `  ${chalk.dim(m.eventId)}` : "";
+    const forwarded = m.forwardedFrom?.senderName
+        ? `\n    ${chalk.dim(`Forwarded from ${m.forwardedFrom.senderName}`)}`
+        : "";
+    return `${arrow} ${chalk.bold(who)} ${when}${audienceTag}${id}${forwarded}\n    ${firstLine(m.body)}${formatAttachments(m)}`;
 }
 /** Render one channel/group message line. */
 export function formatChannelMessage(m, nowMs, opts = {}) {
@@ -886,7 +1062,10 @@ export function formatChannelMessage(m, nowMs, opts = {}) {
         (senderLabel(m).toLowerCase() === "hq"
             ? "System notification (no text provided)."
             : "(no message text)");
-    return `${indent}${who} ${when}${idPart}\n${bodyIndent}${readableBody}${formatAttachments(m, bodyIndent)}`;
+    const forwarded = m.forwardedFrom?.senderName
+        ? `${bodyIndent}${chalk.dim(`Forwarded from ${m.forwardedFrom.senderName}`)}\n`
+        : "";
+    return `${indent}${who} ${when}${idPart}\n${forwarded}${bodyIndent}${readableBody}${formatAttachments(m, bodyIndent)}`;
 }
 /**
  * Read the caller's person/agent uid and email from a JWT we already hold.
@@ -1330,16 +1509,29 @@ export function registerDmCommand(program) {
         .option("--channel <name>", "Post the message to one of your DM channels by name (e.g. --channel vyg-dev)")
         .option("--no-mentions", "Do not resolve `@name` in a channel message into structured mentions — post the text literally")
         .option("--thread <eventId>", 'Reply in a channel thread. Pass a root eventId from `hq dm channel`, or `last` for your most recent top-level message in that channel')
-        .option("--prompt <text>", "Agent-context prompt the recipient can one-click copy into their agent (1:1 DMs only)")
-        .option("--prompt-file <path>", "Read the agent prompt from a file (1:1 DMs only)")
-        .option("--details <text>", "Longer detail shown in the recipient's DM detail window (1:1 DMs only)")
-        .option("--details-file <path>", "Read the details from a file (1:1 DMs only)")
+        .option("--prompt <text>", "Agent-context prompt the recipient can one-click copy into their agent (1:1 DMs; channel sends also supported)")
+        .option("--prompt-file <path>", "Read the agent prompt from a file (1:1 DMs; channel sends also supported)")
+        .option("--details <text>", "Longer detail shown in the recipient's DM detail window (1:1 DMs; channel sends also supported)")
+        .option("--details-file <path>", "Read the details from a file (1:1 DMs; channel sends also supported)")
         .option("--at <iso>", "Schedule delivery at an ISO8601 time (store-and-forward; delivered within ~60s of the time; 1:1 DMs only)")
         .option("--in <duration>", "Schedule delivery after a relative delay: 30s, 10m, 2h, 1d (1:1 DMs only)")
         .option("--audience <human|agent|both>", "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both")
         .action(async (recipient, message, opts) => {
         await runDmSend(recipient, message, opts);
     });
+    dm
+        .command("forward <eventId>")
+        .description("Forward a DM or channel message through the existing send routes.")
+        .requiredOption("--from <person|channel>", "Source person email/UID or channel name/ID")
+        .requiredOption("--to <person|agent|channel>", "Destination person email/UID, agent UID, or channel name/ID")
+        .option("--note <text>", "Optional note to add above the forwarded message")
+        .option("--note-file <path>", "Read the optional forward note from a file")
+        .option("--grant-files", "Grant the recipient access to files they cannot currently open")
+        .option("--omit-files", "Omit files the recipient cannot currently open")
+        .option("--cross-company", "Confirm forwarding across company boundaries")
+        .action(async (eventId, opts) => {
+        await runDmForward(eventId, opts);
+    });
     dm
         .command("inbox")
         .description("List your recent incoming direct messages.")

package/dist/commands/lanes.js

@@ -947,6 +947,7 @@ function laneListQueryFlags(query) {
         ...(query.laneUlids?.length ? ["--lane-ulid"] : []),
         ...(query.active ? ["--active"] : []),
         ...(query.hierarchy?.length ? ["--hierarchy"] : []),
+        ...(query.senior !== undefined ? ["--senior"] : []),
         ...(query.snapshot ? ["--snapshot"] : []),
     ];
 }
@@ -1404,6 +1405,7 @@ function normalizedLaneListQuery(query) {
         ...(laneUlids === undefined ? {} : { laneUlids }),
         ...(query.active ? { active: true } : {}),
         ...(hierarchy === undefined ? {} : { hierarchy }),
+        ...(query.senior === undefined ? {} : { senior: query.senior }),
         ...(query.snapshot ? { snapshot: true } : {}),
         ...(query.strictSnapshot ? { strictSnapshot: true } : {}),
         ...(query.includeForeignHostRows ? { includeForeignHostRows: true } : {}),
@@ -1503,6 +1505,48 @@ async function readOutpostLaneRecords(ctx, outpostId, requestedQuery = {}, dispa
     }
     return invocationMemo.getOrCreate(outpostId, query, () => readOutpostLaneRecordsUncached(ctx, outpostId, query, dispatchOptions));
 }
+/**
+ * Read the owner rows the hire-grant context for `laneId` is built from.
+ *
+ * The owner's `--hierarchy` selector also returns every lane that shares the
+ * target's company and project, so on a store with hundreds of lanes in one
+ * project the response reaches the Outpost exec output limit and the read
+ * fails before a single row is parsed. When that happens, and the target has a
+ * lane senior, assemble the rows the context builder needs from bounded reads
+ * every owner CLI supports: the target and its senior by id, the senior's
+ * direct children (the target's siblings) and the target's own children by
+ * `--senior`. The owner rejects `--senior` together with `--snapshot`, so the
+ * two `--senior` reads use the plain JSON list; the dispatched command sets
+ * HQ_LANES_REMOTE_READ=1, which keeps that list from refreshing remote
+ * mirrors, and the view-only fields it adds are stripped before parsing. A
+ * session-senior target needs same-company profile rows that no bounded
+ * filter selects, so its oversized read stays an error.
+ */
+async function readOutpostLaneHierarchy(ctx, outpostId, laneId) {
+    let tooLarge;
+    try {
+        return await readOutpostLaneRecords(ctx, outpostId, { hierarchy: [laneId], snapshot: true });
+    }
+    catch (err) {
+        if (!isLanesError(err) || err.error !== "outpost_lane_list_too_large")
+            throw err;
+        tooLarge = err;
+    }
+    const targets = await readOutpostLaneRecords(ctx, outpostId, { laneIds: [laneId], snapshot: true });
+    const target = targets.find((lane) => lane.lane_id === laneId);
+    if (target === undefined)
+        return targets;
+    if (target.senior.kind !== "lane" || !target.senior.id) {
+        throw new LanesError(tooLarge.error, `${tooLarge.message}; lane ${laneId} has a ${target.senior.kind} senior, whose hierarchy cannot be read in bounded parts`, { ...tooLarge.details, lane_id: laneId, senior: target.senior });
+    }
+    const seniorId = target.senior.id;
+    const [seniorRows, siblings, children] = await Promise.all([
+        readOutpostLaneRecords(ctx, outpostId, { laneIds: [seniorId], snapshot: true }),
+        readOutpostLaneRecords(ctx, outpostId, { senior: `lane:${seniorId}` }),
+        readOutpostLaneRecords(ctx, outpostId, { senior: `lane:${laneId}` }),
+    ]);
+    return mergeOwnerLaneRecords([...targets, ...seniorRows, ...siblings], children);
+}
 /** Refresh this host's selected Outpost mirrors in one bounded owner query per Outpost. */
 async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, options = {}) {
     const result = {
@@ -1829,9 +1873,12 @@ async function resolveCommandLaneTarget(ctx, laneId, options = {}) {
     for (const outpostId of lookupOutpostIds) {
         let ownerLanes;
         try {
-            ownerLanes = await readOutpostLaneRecords(ctx, outpostId, hostlessUlidLookup
-                ? { laneUlids: [requestedUlid], snapshot: true }
-                : { hierarchy: [laneId], snapshot: true });
+            // The hierarchy read is shared with the grant context built after
+            // resolution, so one owner round trip serves both whenever the Outpost
+            // exec output limit can carry the owner's response.
+            ownerLanes = hostlessUlidLookup
+                ? await readOutpostLaneRecords(ctx, outpostId, { laneUlids: [requestedUlid], snapshot: true })
+                : await readOutpostLaneHierarchy(ctx, outpostId, laneId);
             probedOutpostIds.push(outpostId);
         }
         catch (err) {
@@ -4665,20 +4712,14 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
     let grantContext;
     let grantHierarchy;
     if (action === "grant") {
-        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId, {
-            hierarchy: [lane.lane_id],
-            snapshot: true,
-        }));
+        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneHierarchy(ctx, outpostId, lane.lane_id));
         const hierarchy = await hierarchyWithVerifiedRemoteSenior(ctx, ctx.hqRoot(), lane, ownerHierarchy);
         grantHierarchy = hierarchy;
         grantContext = createOutpostHireGrantContext(lane, hierarchy);
     }
     else if ((action === "resume" && lane.senior.kind === "lane") ||
         (action === "message" && (lane.senior.kind === "lane" || lane.senior.kind === "session"))) {
-        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId, {
-            hierarchy: [lane.lane_id],
-            snapshot: true,
-        }));
+        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneHierarchy(ctx, outpostId, lane.lane_id));
         const hierarchy = await hierarchyWithVerifiedRemoteSenior(ctx, ctx.hqRoot(), lane, ownerHierarchy);
         grantContext = createOutpostHireGrantContext(lane, hierarchy, action === "message" ? options.supersededMessageCallerId : undefined, action === "message" ? options.supersededMessageSessionId : undefined);
     }

package/dist/commands/secrets.js

@@ -145,7 +145,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { removeCacheEntry, clearAllCache } from "../utils/secrets-cache.js";
 import { isHqCliChild, releaseChildWrapperPackageUseLeaseAfterStart } from "../utils/child-wrapper-lease.js";
 import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
-import { fastFlagEnabled } from "../native-fast-route.js";
+import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
 import { resolveSessionId } from "../lib/core-utils/session-id.js";
 import { secretsExecChildExitCode } from "../utils/child-wrapper-exit.js";
@@ -1249,7 +1249,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
-            const multiCompanyLockEnabled = await fastFlagEnabled(MULTI_COMPANY_SESSION_LOCK_FLAG);
+            const multiCompanyLockEnabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG);
             const sessionLock = multiCompanyLockEnabled ? readSessionCompanyLock(process.env) : undefined;
             const parentScope = secrets.opts();
             const inheritedCompany = parentScope.company;

package/dist/commands/workers.js

@@ -7,7 +7,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
 import { GROUP_ID_PATTERN, EMAIL_PATTERN, toSharedFolderGlob } from "./_patterns.js";
 import { findHqRoot } from "../utils/manifest.js";
-import { fastFlagEnabled } from "../native-fast-route.js";
+import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
 import { resolveSessionId } from "../lib/core-utils/session-id.js";
 export { readWorkerRegistry } from "../lib/workers-registry/read.js";
@@ -198,7 +198,7 @@ async function runWorkersShare(workerId, opts) {
 }
 async function runWorkersList(opts) {
     const hqRoot = findHqRoot();
-    const enabled = await fastFlagEnabled(MULTI_COMPANY_SESSION_LOCK_FLAG);
+    const enabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG);
     const lockedCompanies = resolveActiveCompanies(hqRoot, enabled);
     if (enabled && opts.company && denyWorkerCompanyOutsideLock(opts.company, lockedCompanies))
         return;

package/dist/lib/bot/daemon.d.ts

@@ -64,7 +64,7 @@ export interface BotDaemonDeps {
     platform?: BotDaemonPlatform;
     launchctl?: LaunchctlExec;
     uid?: number;
-    fsImpl?: Pick<typeof fs, "existsSync" | "writeFileSync" | "mkdirSync" | "unlinkSync">;
+    fsImpl?: Pick<typeof fs, "existsSync" | "readFileSync" | "writeFileSync" | "mkdirSync" | "unlinkSync"> & Partial<Pick<typeof fs, "chmodSync" | "renameSync">>;
     /** Blocking sleep, injectable for tests. */
     sleepMs?: (ms: number) => void;
     /**

package/dist/lib/bot/daemon.js

@@ -15,7 +15,7 @@ import * as path from "node:path";
 import { spawn } from "node:child_process";
 import { resolveHqBinary, resolveNodeBinary, preferStableHqBinary } from "../mesh/live/daemon/install.js";
 import { botLogPath, launchdLabel } from "./paths.js";
-import { reloadLaunchd } from "../service-manager/launchd.js";
+import { discoverLaunchdIdentity, installLaunchdPlist, launchdProgramArguments, launchdPlistProgramArguments as parsePlistArguments, parseLaunchdCommand, reloadLaunchd } from "../service-manager/launchd.js";
 import { nodeBinaryProblem, preferStableNodeBinary } from "../node-binary.js";
 export function detectBotPlatform(platform = process.platform) {
     if (platform === "darwin")
@@ -66,6 +66,12 @@ function escapeXml(value) {
         .replace(/"/g, """);
 }
 export function renderBotLaunchdPlist(p) {
+    const identity = discoverLaunchdIdentity(p.home);
+    const args = launchdProgramArguments({
+        nodeBinary: p.nodeBinary,
+        hqBinary: p.hqBinary,
+        launchdLauncherBinary: identity.launcherBinary,
+    }, ["bot", "run", p.name]);
     const envRows = [
         ["HOME", p.home],
         ["PATH", p.pathEntries.join(":")],
@@ -80,13 +86,9 @@ export function renderBotLaunchdPlist(p) {
 <dict>
   <key>Label</key>
   <string>${escapeXml(p.label)}</string>
-  <key>ProgramArguments</key>
+${identity.associatedBundleIdentifier ? `  <key>AssociatedBundleIdentifiers</key>\n  <array>\n    <string>${escapeXml(identity.associatedBundleIdentifier)}</string>\n  </array>\n` : ""}  <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(p.nodeBinary)}</string>
-    <string>${escapeXml(p.hqBinary)}</string>
-    <string>bot</string>
-    <string>run</string>
-    <string>${escapeXml(p.name)}</string>
+${args.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n")}
   </array>
   <key>WorkingDirectory</key>
   <string>${escapeXml(p.hqRoot ?? p.botDir)}</string>
@@ -190,16 +192,13 @@ function launchdLoaded(p, deps) {
     return deps.launchctl(["print", `${launchdDomain(deps.uid)}/${p.label}`]).ok;
 }
 export function launchdPlistProgramArguments(plist) {
-    const block = plist.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
-    if (!block)
-        return [];
-    return [...block[1].matchAll(/<string>([^<]*)<\/string>/g)].map((m) => m[1]);
+    return parsePlistArguments(plist);
 }
 /** The hq script path baked into an installed unit, or null if none. */
 export function installedDaemonHqBinary(p, io = fs) {
     if (io.existsSync(p.plistPath)) {
         const args = launchdPlistProgramArguments(io.readFileSync(p.plistPath, "utf8"));
-        return args[1] ?? null;
+        return parseLaunchdCommand(args)?.hq ?? null;
     }
     if (io.existsSync(p.systemdUnitPath)) {
         const unit = io.readFileSync(p.systemdUnitPath, "utf8");
@@ -212,7 +211,7 @@ export function installedDaemonHqBinary(p, io = fs) {
 export function installedDaemonNodeBinary(p, io = fs) {
     if (io.existsSync(p.plistPath)) {
         const args = launchdPlistProgramArguments(io.readFileSync(p.plistPath, "utf8"));
-        return args[0] ?? null;
+        return parseLaunchdCommand(args)?.node ?? null;
     }
     if (io.existsSync(p.systemdUnitPath)) {
         const unit = io.readFileSync(p.systemdUnitPath, "utf8");
@@ -383,19 +382,27 @@ export function installBotDaemon(p, deps = {}) {
     io.mkdirSync(path.dirname(p.logPath), { recursive: true, mode: 0o700 });
     if (platform === "darwin") {
         io.mkdirSync(path.dirname(p.plistPath), { recursive: true });
-        // Replace rather than overwrite, so re-adopting a bot over the stale plist
-        // a wiped ~/.hq left behind lands a fresh file at 0600 (writeFileSync
-        // keeps the mode an existing file already has).
-        if (io.existsSync(p.plistPath))
-            io.unlinkSync(p.plistPath);
-        io.writeFileSync(p.plistPath, renderBotLaunchdPlist(p), { mode: 0o600 });
-        let loaded = false;
-        if (deps.launchctl) {
-            // bootout first so a re-install picks up a changed plist.
-            const r = rebootstrapLaunchd(p, deps);
-            if (!r.ok) {
-                const detail = `launchctl bootstrap failed after ${r.bootstrapAttempts} attempts: ${(r.error ?? "").slice(0, 200)}`;
-                if (r.loaded) {
+        const reloadState = { result: null };
+        const written = installLaunchdPlist(p.plistPath, p.label, renderBotLaunchdPlist(p), {
+            files: {
+                existsSync: io.existsSync,
+                readFileSync: (file) => io.readFileSync(file, "utf8"),
+                writeFileSync: io.writeFileSync,
+                ...(io.chmodSync ? { chmodSync: io.chmodSync } : {}),
+                ...(io.renameSync ? { renameSync: io.renameSync } : {}),
+                unlinkSync: io.unlinkSync,
+            },
+            activate: Boolean(deps.launchctl),
+            isLoaded: () => launchdLoaded(p, deps),
+            ...(deps.launchctl ? { reload: () => { reloadState.result = rebootstrapLaunchd(p, deps); return reloadState.result; } } : {}),
+        });
+        let loaded = written.loaded;
+        if (deps.launchctl && reloadState.result) {
+            const r = reloadState.result;
+            loaded = r.loaded;
+            if (!r?.ok) {
+                const detail = `launchctl bootstrap failed after ${r?.bootstrapAttempts ?? 0} attempts: ${(r?.error ?? "").slice(0, 200)}`;
+                if (r?.loaded) {
                     // The previous definition survived the bootout; keep it running.
                     deps.launchctl(["kickstart", "-k", `${launchdDomain(deps.uid)}/${p.label}`]);
                 }
@@ -403,14 +410,13 @@ export function installBotDaemon(p, deps = {}) {
                     platform,
                     action: "install",
                     installed: true,
-                    loaded: r.loaded,
+                    loaded: r?.loaded ?? false,
                     dest: p.plistPath,
-                    message: r.loaded
+                    message: r?.loaded
                         ? `Wrote ${p.plistPath} but ${detail}. The previous definition of ${p.label} is still loaded and was restarted; the rewritten plist is not active yet.`
                         : `Wrote ${p.plistPath} but ${detail}. ${p.label} is NOT loaded. Load it with: launchctl bootstrap ${launchdDomain(deps.uid)} ${p.plistPath}`,
                 };
             }
-            loaded = true;
         }
         return {
             platform,

package/dist/lib/daemon/hq-cloud.d.ts

@@ -14,8 +14,6 @@ export interface HqCloudCopy {
 }
 export interface PickedHqCloud extends HqCloudCopy {
     source: "bundled" | "managed";
-    /** Set when a version is pinned but that version is not the installed managed copy. */
-    pinnedVersionMissing?: string;
 }
 export type ManagedHqCloud = PickedHqCloud & {
     source: "managed";
@@ -85,6 +83,8 @@ export interface UpdateHqCloudDeps {
     run?: (file: string, args: string[], shell: boolean, env: NodeJS.ProcessEnv) => NpmRunResult;
     bundled?: HqCloudCopy | null;
     platform?: NodeJS.Platform;
+    /** Test seam for bounded install retry delays. */
+    sleep?: (ms: number) => void;
 }
 /** Install or update the updater's copy, as this (the login) user. */
 export declare function updateManagedHqCloud(daemonRoot: string, env: NodeJS.ProcessEnv, deps?: UpdateHqCloudDeps): HqCloudUpdateOutcome;