@indigoai-us/hq-cli 5.345.49 → 5.345.51

package/dist/lib/daemon/hq-cloud.js

@@ -54,10 +54,11 @@ export function pickHqCloud(bundled, managed, usable = () => true, pinnedVersion
         if (managed && managed.version === pinnedVersion && b && m && m[0] === b[0] && usable(managed)) {
             return { ...managed, source: "managed" };
         }
-        // The pinned version is not installed yet (the updater installs it). Keep
-        // running the newest usable copy meanwhile instead of dropping to an older
-        // bundled one, and report the missing pin.
-        return { ...pickNewest(bundled, managed, b, m, usable), pinnedVersionMissing: pinnedVersion };
+        if (bundled.version === pinnedVersion && b && usable(bundled))
+            return { ...bundled, source: "bundled" };
+        // A pin is an exact version contract. Do not silently run another installed
+        // package while npm has not yet delivered the pinned version.
+        return null;
     }
     return pickNewest(bundled, managed, b, m, usable);
 }
@@ -160,6 +161,17 @@ export function currentHqCloudAfterLeaseRelease(daemonRoot, expectedVersion) {
         return null;
     return { ...managed, source: "managed" };
 }
+function isTransientNpmFailure(result) {
+    // spawnSync's ETIMEDOUT means this attempt hit our full 10-minute process
+    // timeout. Retrying that result would multiply one stall across every attempt.
+    if (result.error?.code === "ETIMEDOUT")
+        return false;
+    const text = `${result.stderr ?? ""}\n${result.stdout ?? ""}\n${result.error?.message ?? ""}`;
+    return /\b(?:ETARGET|EAI_AGAIN|ECONNRESET|ECONNREFUSED|ENETUNREACH|ENOTFOUND|ETIMEDOUT|EHOSTUNREACH|ENETWORK|ECONNABORTED)\b|\bnotarget\b|network timeout|fetch failed|socket hang up/i.test(text);
+}
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
 function runNpm(file, args, shell, env) {
     return spawnSync(file, args, {
         encoding: "utf8",
@@ -180,7 +192,7 @@ export function updateManagedHqCloud(daemonRoot, env, deps = {}) {
     const platform = deps.platform ?? process.platform;
     const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
     const bundled = deps.bundled !== undefined ? deps.bundled : bundledHqCloud();
-    const from = currentHqCloud(daemonRoot)?.version ?? null;
+    const from = managedHqCloud(daemonRoot)?.version ?? bundled?.version ?? null;
     if (!bundled)
         return { ok: false, from, to: null, detail: "this CLI install has no bundled hq-cloud to match" };
     const prefix = managedHqCloudDir(daemonRoot);
@@ -203,9 +215,26 @@ export function updateManagedHqCloud(daemonRoot, env, deps = {}) {
         version = latest;
     }
     const cmd = hqCloudInstallCommand(prefix, version, platform);
-    const r = run(cmd.file, cmd.args, cmd.shell, env);
-    if (r.status !== 0)
-        return { ok: false, from, to: null, detail: npmFailure(r) };
-    return { ok: true, from, to: currentHqCloud(daemonRoot)?.version ?? null };
+    const retryDelays = [500, 1_000, 2_000];
+    const sleep = deps.sleep ?? sleepSync;
+    let r;
+    for (let attempt = 0;; attempt++) {
+        r = run(cmd.file, cmd.args, cmd.shell, env);
+        if (r.status === 0)
+            break;
+        const retryable = pinnedVersion !== undefined && pinnedVersion !== null && isTransientNpmFailure(r);
+        const delay = retryDelays[attempt];
+        if (!retryable || delay === undefined) {
+            const retries = retryable ? attempt : 0;
+            return {
+                ok: false,
+                from,
+                to: null,
+                detail: retries > 0 ? `pinned hq-cloud install failed after ${retries + 1} attempts: ${npmFailure(r)}` : npmFailure(r),
+            };
+        }
+        sleep(delay);
+    }
+    return { ok: true, from, to: managedHqCloud(daemonRoot)?.version ?? null };
 }
 //# sourceMappingURL=hq-cloud.js.map

package/dist/lib/daemon/install.js

@@ -17,7 +17,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { activateLaunchd, deactivateLaunchd, launchdPlistPath, renderLaunchdPlist, } from "../service-manager/launchd.js";
+import { activateLaunchd, deactivateLaunchd, defaultRunCommand, installLaunchdPlist, launchdIsLoaded, launchdPlistPath, renderLaunchdPlist, } from "../service-manager/launchd.js";
 import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdUnitPath, } from "../service-manager/systemd.js";
 import { escapeXml, shellQuote } from "../service-manager/types.js";
 import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
@@ -251,12 +251,43 @@ export function installDaemonUnit(host, options, deps) {
     fs.mkdirSync(path.dirname(plan.unitPath), { recursive: true });
     if (plan.kind !== "systemd-system")
         fs.mkdirSync(path.join(host.daemonDir, "logs"), { recursive: true });
-    if (plan.kind === "schtasks")
+    if (plan.kind === "launchd") {
+        let plist;
+        try {
+            plist = installLaunchdPlist(plan.unitPath, DAEMON_LAUNCHD_LABEL, plan.rendered, {
+                run: deps.run ?? defaultRunCommand,
+                uid: host.uid,
+                sleep: deps.sleep,
+                isLoaded: () => launchdIsLoaded(DAEMON_LAUNCHD_LABEL, deps.run ?? defaultRunCommand, host.uid),
+                files: {
+                    existsSync: fs.existsSync,
+                    readFileSync: (file) => fs.readFileSync(file, "utf8"),
+                    writeFileSync: fs.writeFileSync,
+                    chmodSync: fs.chmodSync,
+                    renameSync: fs.renameSync,
+                    unlinkSync: fs.unlinkSync,
+                },
+            });
+        }
+        catch (err) {
+            return {
+                kind: plan.kind,
+                unitPath: plan.unitPath,
+                installed: fs.existsSync(plan.unitPath),
+                running: launchdIsLoaded(DAEMON_LAUNCHD_LABEL, deps.run ?? defaultRunCommand, host.uid),
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+        if (!plist.loaded)
+            return { kind: plan.kind, unitPath: plan.unitPath, installed: true, running: false };
+    }
+    else if (plan.kind === "schtasks")
         fs.writeFileSync(plan.unitPath, encodeWindowsTaskXml(plan.rendered));
     else
         fs.writeFileSync(plan.unitPath, plan.rendered, { mode: plan.kind === "systemd-system" ? 0o644 : 0o600 });
     try {
-        activate(plan, host, deps.run, deps.sleep);
+        if (plan.kind !== "launchd")
+            activate(plan, host, deps.run, deps.sleep);
         return { kind: plan.kind, unitPath: plan.unitPath, installed: true, running: true };
     }
     catch (err) {

package/dist/lib/daemon/run.js

@@ -105,17 +105,26 @@ const HANDOFF_FLAG_TIMEOUT_MS = 10_000;
 const HQD_PERSON_SETTING_GRACE_MS = 30 * 60_000;
 export function syncRunnerSourceForPlan(stagedRunnerPath, hqCloud, legacyBundledRunnerPath = null, staged = { version: null }, currentSyncRunnerSource = null) {
     // A managed copy lives in the daemon directory, so it survives a CLI
-    // replacement. Before lease release pickHqCloud returns it only when it is
-    // pinned or newer than the bundled copy; after release it is the only
-    // eligible package, so it must not displace a newer staged bundle unless it
-    // is the pinned version. The staged bundle is built from the bundled copy and
-    // otherwise only stands in for that copy (hq-cli#1547).
+    // replacement. A configured pin is an exact version contract: only that
+    // installed package or an exactly matching staged bundle may start.
     const pin = staged.pinnedVersion;
-    const hasRunnerAtOrAbovePin = pin != null &&
-        ((staged.version !== null && !hqCloudVersionOlder(staged.version, pin)) ||
-            (hqCloud !== null && !hqCloudVersionOlder(hqCloud.version, pin)));
-    if (pin && !hasRunnerAtOrAbovePin && currentSyncRunnerSource?.runnerPath) {
-        return currentSyncRunnerSource;
+    if (pin) {
+        if (hqCloud?.version === pin) {
+            if (hqCloud.source === "managed") {
+                return { kind: "managed-full-package", runnerPath: path.join(hqCloud.root, "dist", "bin", "sync-runner.js") };
+            }
+            if (stagedRunnerPath && staged.version === pin)
+                return { kind: "staged-sync", runnerPath: stagedRunnerPath };
+            return { kind: "bundled-full-package", runnerPath: path.join(hqCloud.root, "dist", "bin", "sync-runner.js") };
+        }
+        if (stagedRunnerPath && staged.version === pin)
+            return { kind: "staged-sync", runnerPath: stagedRunnerPath };
+        // A transient install gap must not stop a runner that is already serving
+        // sync. On cold start there is no current source, so mismatched bundles
+        // remain unavailable and cannot be started.
+        if (currentSyncRunnerSource?.runnerPath)
+            return currentSyncRunnerSource;
+        return { kind: "unavailable", runnerPath: null };
     }
     const managedYieldsToStaged = stagedRunnerPath !== null &&
         hqCloud?.source === "managed" &&
@@ -408,6 +417,7 @@ export async function runDaemon(opts) {
     let legacySyncRunnerPathChecked = false;
     let legacySyncRunnerPath = null;
     let lastPlannedSyncRunnerSource = null;
+    let lastPlannedSyncRunnerVersion = null;
     let packageUseLeaseReleased = false;
     let hqCloudVersionBeforeRelease = null;
     let startupPlanOpen = true;
@@ -580,6 +590,7 @@ export async function runDaemon(opts) {
     let warnedMissingPin = null;
     let warnedMissingSyncRunner = false;
     const daemonSyncRunnerPids = new Set();
+    let supervisor = null;
     const plan = () => {
         const config = readDaemonConfig(paths.configPath);
         const legacy = legacyUnits();
@@ -594,19 +605,34 @@ export async function runDaemon(opts) {
             : currentHqCloud(paths.root);
         if (!packageUseLeaseReleased)
             hqCloudVersionBeforeRelease = hqCloud?.version ?? staged?.metadata.version ?? null;
-        const missingPin = hqCloud?.pinnedVersionMissing ?? null;
-        if (missingPin !== warnedMissingPin) {
-            warnedMissingPin = missingPin;
-            if (missingPin && hqCloud) {
-                log("warn", `hq-cloud is pinned to ${missingPin}, which is not installed; running ${hqCloud.version} (${hqCloud.source}) until the updater installs it`);
-            }
-        }
         if (!packageUseLeaseReleased && !legacySyncRunnerPathChecked) {
             legacySyncRunnerPath = resolveSyncRunnerPath();
             legacySyncRunnerPathChecked = true;
         }
-        const syncSource = syncRunnerSourceForPlan(staged?.runnerPath ?? null, hqCloud, packageUseLeaseReleased ? null : legacySyncRunnerPath, { version: staged?.metadata.version ?? null, pinnedVersion: config.hqCloudVersion ?? null }, lastPlannedSyncRunnerSource);
+        const syncSource = syncRunnerSourceForPlan(staged?.runnerPath ?? null, hqCloud, packageUseLeaseReleased ? null : legacySyncRunnerPath, { version: staged?.metadata.version ?? null, pinnedVersion: config.hqCloudVersion ?? null }, supervisor?.state().units.some((unit) => unit.id === "sync" && unit.status === "running" && typeof unit.pid === "number")
+            ? lastPlannedSyncRunnerSource
+            : null);
+        const retainedLiveSource = syncSource === lastPlannedSyncRunnerSource;
+        const syncRunnerVersion = retainedLiveSource
+            ? lastPlannedSyncRunnerVersion
+            : syncSource.kind === "staged-sync"
+                ? staged?.metadata.version ?? null
+                : hqCloud?.version ?? null;
+        const missingPin = config.hqCloudVersion && syncRunnerVersion !== config.hqCloudVersion ? config.hqCloudVersion : null;
+        const pinWarningKey = missingPin
+            ? `${missingPin}:${retainedLiveSource ? syncRunnerVersion ?? "unknown" : "unavailable"}`
+            : null;
+        if (pinWarningKey !== warnedMissingPin) {
+            warnedMissingPin = pinWarningKey;
+            if (missingPin && retainedLiveSource) {
+                log("warn", `hq-cloud is pinned to ${missingPin}, but the running sync runner is ${syncRunnerVersion ?? "unknown"}; keeping it running while the updater retries`);
+            }
+            else if (missingPin && syncSource.kind === "unavailable") {
+                log("warn", `hq-cloud is pinned to ${missingPin}, which is not installed; sync is unavailable until the updater installs it`);
+            }
+        }
         lastPlannedSyncRunnerSource = syncSource.runnerPath ? syncSource : null;
+        lastPlannedSyncRunnerVersion = syncSource.runnerPath ? syncRunnerVersion : null;
         if (!syncSource.runnerPath && !warnedMissingSyncRunner) {
             warnedMissingSyncRunner = true;
             log("warn", "the hq-cloud sync runner was not found in this CLI install; sync is unavailable");
@@ -797,7 +823,7 @@ export async function runDaemon(opts) {
     // Set once the shutdown path exists below; a restart request before then is dropped.
     let restartDaemon = () => false;
     let extendSyncShutdownCap;
-    const supervisor = createSupervisor({
+    supervisor = createSupervisor({
         machineType,
         host: opts.host,
         pid: process.pid,

package/dist/lib/db/app-ref.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Resolve the `--app` value of the `hq db` commands to an app id. The value can
+ * be the app id, its name or its subdomain. Only apps in the given company are
+ * searched, so a name never resolves to another company's app.
+ */
+import { deployApiRequest } from "../deploy-api.js";
+export interface AppRefRow {
+    id?: unknown;
+    name?: unknown;
+    subdomain?: unknown;
+}
+export declare class AppRefError extends Error {
+    constructor(message: string);
+}
+export declare function matchAppRef(apps: AppRefRow[], ref: string): string;
+export declare function resolveAppRef(input: {
+    token: string;
+    companySlug: string;
+    ref: string;
+}, request?: typeof deployApiRequest): Promise<string>;
+//# sourceMappingURL=app-ref.d.ts.map

package/dist/lib/db/app-ref.js

@@ -0,0 +1,45 @@
+/**
+ * Resolve the `--app` value of the `hq db` commands to an app id. The value can
+ * be the app id, its name or its subdomain. Only apps in the given company are
+ * searched, so a name never resolves to another company's app.
+ */
+import { deployApiRequest } from "../deploy-api.js";
+import { listDeployApps } from "../deploy-apps.js";
+export class AppRefError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AppRefError";
+    }
+}
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function matchAppRef(apps, ref) {
+    const ids = (rows) => [
+        ...new Set(rows.map((row) => row.id).filter((id) => typeof id === "string")),
+    ];
+    const byId = ids(apps.filter((row) => row.id === ref));
+    if (byId.length === 1)
+        return byId[0];
+    const byName = ids(apps.filter((row) => row.name === ref || row.subdomain === ref));
+    if (byName.length === 1)
+        return byName[0];
+    if (byName.length > 1) {
+        throw new AppRefError(`More than one app in this company is called "${ref}" (${byName.join(", ")}). Use the app id.`);
+    }
+    throw new AppRefError(`No app called "${ref}" was found in this company.`);
+}
+export async function resolveAppRef(input, request = deployApiRequest) {
+    const ref = input.ref.trim();
+    if (UUID_RE.test(ref))
+        return ref;
+    const headers = { "X-Org-Slug": input.companySlug };
+    const apps = await listDeployApps(async (cursor) => {
+        const route = cursor ? `/api/apps?cursor=${encodeURIComponent(cursor)}` : "/api/apps";
+        const res = await request(input.token, route, "GET", undefined, headers);
+        if (!res.ok) {
+            throw new AppRefError(`Could not look up the app "${ref}" (hq-deploy returned ${res.status}). Use the app id.`);
+        }
+        return (await res.json());
+    });
+    return matchAppRef(apps, ref);
+}
+//# sourceMappingURL=app-ref.js.map

package/dist/lib/doctor/checks/bots.js

@@ -10,6 +10,7 @@ import { botsRoot, botDir, launchdLabel } from "../../bot/paths.js";
 import { readBotConfig } from "../../bot/config.js";
 import { isPidAlive, readBotStatus } from "../../bot/status.js";
 import { nodeBinaryProblem } from "../../node-binary.js";
+import { launchdPlistProgramArguments, parseLaunchdCommand } from "../../service-manager/launchd.js";
 export const BOTS_FAMILY_ID = "bots";
 export const BOTS_FAMILY_TITLE = "Local bots";
 const DEFAULT_DEPS = {
@@ -35,14 +36,8 @@ export function checkBots(_context, deps = DEFAULT_DEPS) {
         ];
     }
 }
-function launchdPlistArgs(plist) {
-    const block = plist.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
-    if (!block)
-        return [];
-    return [...block[1].matchAll(/<string>([^<]*)<\/string>/g)].map((m) => m[1]);
-}
 function launchdPlistHqBinary(plist) {
-    return launchdPlistArgs(plist)[1] ?? null;
+    return parseLaunchdCommand(launchdPlistProgramArguments(plist))?.hq ?? null;
 }
 function runChecks(deps) {
     const home = deps.home();
@@ -122,7 +117,7 @@ function runChecks(deps) {
             try {
                 const text = fs.readFileSync(plistPath, "utf8");
                 hqPath = launchdPlistHqBinary(text);
-                nodePath = launchdPlistArgs(text)[0] ?? null;
+                nodePath = parseLaunchdCommand(launchdPlistProgramArguments(text))?.node ?? null;
             }
             catch {
                 hqPath = null;

package/dist/lib/lanes/keep-alive-audit.d.ts

@@ -1,4 +1,4 @@
-type KeepAliveAuditVerdict = "on_time" | "late" | "early_wake" | "message_wake" | "work_triggered" | "self_wake" | "early_by_keep_alive" | "restarted_untimed" | "not_restarted" | "stranded" | "keep_alive_off" | "waiting";
+type KeepAliveAuditVerdict = "on_time" | "late" | "early_wake" | "message_wake" | "work_triggered" | "self_wake" | "early_by_keep_alive" | "restarted_untimed" | "not_restarted" | "stranded" | "keep_alive_off" | "finished_story" | "idle_no_queued_work" | "waiting";
 interface KeepAliveAuditRestart {
     at: string | null;
     trigger: string;
@@ -17,6 +17,7 @@ interface KeepAliveAuditRow {
     blocked_outcome?: "woken" | "skipped";
     blocked_outcome_reason?: string;
     verdict: KeepAliveAuditVerdict;
+    queued_work_at_audit_time?: boolean;
     remediation?: string;
     terminal_reason?: string;
 }
@@ -25,6 +26,8 @@ interface KeepAliveAuditSummary {
     not_restarted: number;
     stranded: number;
     restarted_untimed: number;
+    finished_story: number;
+    idle_no_queued_work: number;
     late_restarts_after_window: number;
     late_over_10m: number;
     early_wake_by_others: number;
@@ -53,6 +56,7 @@ export interface StopEnvelope {
     name: string;
     mtimeMs: number;
     decision: "done" | "blocked";
+    storyComplete: boolean;
     nextCheckAt?: string;
 }
 export declare function readStopEnvelopes(hqRoot: string, laneId: string): {

package/dist/lib/lanes/keep-alive-audit.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS } from "./keep-alive.js";
+import { LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS, doneKeepAliveVerdict, hasPendingKeepAliveWork, undeliveredAnsweredQuestions } from "./keep-alive.js";
+import { dropboxDir, dropboxInboxPath } from "./dropbox.js";
 import { LanesError } from "./errors.js";
 import { laneRunDir } from "./spawn.js";
 import { compareEnvelopeNames } from "./envelope-sequence.js";
@@ -63,6 +64,8 @@ const VERDICTS = [
     "keep_alive_off",
     "not_restarted",
     "stranded",
+    "finished_story",
+    "idle_no_queued_work",
     "waiting",
 ];
 function parseTime(value) {
@@ -174,7 +177,7 @@ export function readStopEnvelopes(hqRoot, laneId) {
         if (!isRecord(raw) || raw.schema_version !== "hq-lane-envelope.v1") {
             throw new LanesError("keep_alive_audit_envelope_invalid", `Lane envelope is not hq-lane-envelope.v1: ${file}`, { lane_id: laneId, path: file });
         }
-        const doneStop = raw.decision === "done" && raw.story_complete === false;
+        const doneStop = raw.decision === "done";
         const blockedStop = raw.decision === "blocked" && typeof raw.next_check_at === "string" &&
             isIsoDateTime(raw.next_check_at) && Date.parse(raw.next_check_at) > stat.mtimeMs;
         if (!doneStop && !blockedStop)
@@ -183,6 +186,7 @@ export function readStopEnvelopes(hqRoot, laneId) {
             name,
             mtimeMs: stat.mtimeMs,
             decision: blockedStop ? "blocked" : "done",
+            storyComplete: raw.story_complete === true,
             ...(typeof raw.next_check_at === "string" ? { nextCheckAt: raw.next_check_at } : {}),
         });
     }
@@ -428,6 +432,48 @@ function firstRestartAfter(lane, stop, nextEnvelopeMs, workerResumeEvents) {
     // untimed instead of using the lane's mutable current state as a proxy.
     return nextEnvelopeMs === undefined ? null : { at: null, trigger: "unknown", caller: null };
 }
+/**
+ * When the work a finished standing lane is now waiting on first appeared.
+ * The earliest signal wins: if work was queued at 10:05 and more arrived at
+ * 11:59, keep-alive has owed a launch since 10:05. Returns undefined when no
+ * signal carries a time, which leaves the caller unable to open a window.
+ */
+function keepAliveQueuedWorkAt(hqRoot, lane) {
+    const candidates = [];
+    const pendingAt = parseTime(lane.pending_resume?.at);
+    if (pendingAt !== undefined)
+        candidates.push(pendingAt);
+    for (const candidate of [dropboxInboxPath(hqRoot, lane.lane_id), dropboxDir(hqRoot, lane.lane_id)]) {
+        try {
+            candidates.push(fs.statSync(candidate).mtimeMs);
+            break;
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+    }
+    const questions = [];
+    for (const questionId of listQuestionIds(hqRoot)) {
+        try {
+            const question = tryReadQuestion(hqRoot, questionId);
+            if (question)
+                questions.push(question);
+        }
+        catch {
+            // One unreadable question file must not fail the whole audit.
+            continue;
+        }
+    }
+    for (const question of undeliveredAnsweredQuestions(lane, questions)) {
+        const answeredAt = parseTime(question.answer?.answered_at);
+        if (answeredAt !== undefined)
+            candidates.push(answeredAt);
+    }
+    if (candidates.length === 0)
+        return undefined;
+    return Math.min(...candidates);
+}
 function classifyVerdict(input) {
     const { dueAt, restart, lane, nowMs } = input;
     if (restart?.trigger === "unknown" && laneWasKeepAliveOffAtStop(lane, input.stoppedAt))
@@ -478,6 +524,34 @@ function classifyVerdict(input) {
     }
     if (laneWasKeepAliveOffAtStop(lane, input.stoppedAt))
         return "keep_alive_off";
+    // Split the unrestarted stops by whether keep-alive owes this lane a wake at
+    // all. The discriminator is the shared done-state policy, not whether the
+    // envelope declared a next_check_at: a stop with story_complete false is owed
+    // a wake with or without one. Only done stops with no later envelope reach
+    // this branch, because a later envelope means the lane carried on.
+    if (input.decision === "done" && input.nextEnvelopeAt === undefined) {
+        const eligibility = doneKeepAliveVerdict(lane, {
+            decision: "done",
+            story_complete: input.storyComplete,
+            ...(input.nextCheckAt === undefined ? {} : { next_check_at: input.nextCheckAt }),
+        }, input.hasQueuedWork, { nowMs });
+        // Keep-alive is specified not to wake either case, so neither is a
+        // keep-alive liveness failure and neither counts against the KPI.
+        if (eligibility === "story_complete")
+            return "finished_story";
+        if (eligibility === "standing_idle")
+            return "idle_no_queued_work";
+        // A finished story becomes eligible again only once work is queued, which
+        // can be long after the stop. Open the failure window when that work
+        // appeared, not at the stop's own due time, or every normal exit from
+        // idle_no_queued_work reads as a liveness failure the moment it happens.
+        if (input.storyComplete) {
+            if (input.queuedWorkAt === undefined)
+                return "waiting";
+            const anchor = Math.max(dueAt, input.queuedWorkAt);
+            return nowMs > anchor + KEEP_ALIVE_NOT_RESTARTED_GRACE_MS ? "not_restarted" : "waiting";
+        }
+    }
     if (nowMs > dueAt + KEEP_ALIVE_NOT_RESTARTED_GRACE_MS)
         return "not_restarted";
     return "waiting";
@@ -546,6 +620,10 @@ export function buildKeepAliveAudit(input) {
         try {
             const { allMtimes, stops } = readStopEnvelopes(input.hqRoot, lane.lane_id);
             const keepAliveResumeEvents = readKeepAliveResumeEvents(input.hqRoot, lane.lane_id);
+            // Read at audit time, not stop time: for a stop with no restart the
+            // question is whether anything is going to resume the lane now.
+            const hasQueuedWork = lane.keep_alive_standing === true && hasPendingKeepAliveWork(input.hqRoot, lane);
+            const queuedWorkAt = hasQueuedWork ? keepAliveQueuedWorkAt(input.hqRoot, lane) : undefined;
             const laneWorkerResumeEvents = readLaneWorkerResumeEvents(input.hqRoot, lane.lane_id);
             const terminalClassifications = readTerminalClassifications(input.hqRoot, lane.lane_id);
             for (const stop of stops) {
@@ -572,7 +650,8 @@ export function buildKeepAliveAudit(input) {
                         blocked_outcome: blockedOutcome.status,
                         ...(blockedOutcome.reason === undefined ? {} : { blocked_outcome_reason: blockedOutcome.reason }),
                     } : {}),
-                    verdict: classifyVerdict({ dueAt: due.at, stoppedAt: stop.mtimeMs, nextCheckAt: stop.nextCheckAt, restart, lane, nowMs, resumeEvents: keepAliveResumeEvents, ...(nextEnvelopeMs === undefined ? {} : { nextEnvelopeAt: nextEnvelopeMs }), hqRoot: input.hqRoot }),
+                    verdict: classifyVerdict({ dueAt: due.at, stoppedAt: stop.mtimeMs, nextCheckAt: stop.nextCheckAt, restart, decision: stop.decision, storyComplete: stop.storyComplete, hasQueuedWork, ...(queuedWorkAt === undefined ? {} : { queuedWorkAt }), lane, nowMs, resumeEvents: keepAliveResumeEvents, ...(nextEnvelopeMs === undefined ? {} : { nextEnvelopeAt: nextEnvelopeMs }), hqRoot: input.hqRoot }),
+                    ...(stop.decision === "done" ? { queued_work_at_audit_time: hasQueuedWork } : {}),
                 });
             }
         }
@@ -611,6 +690,8 @@ export function buildKeepAliveAudit(input) {
             not_restarted: byVerdict.not_restarted,
             stranded: byVerdict.stranded,
             restarted_untimed: byVerdict.restarted_untimed,
+            finished_story: byVerdict.finished_story,
+            idle_no_queued_work: byVerdict.idle_no_queued_work,
             late_restarts_after_window: lateRestartsAfterWindow,
             late_over_10m: lateOverTenMinutes,
             early_wake_by_others: byVerdict.early_wake,
@@ -642,6 +723,7 @@ export function formatKeepAliveAuditText(result) {
         "",
         `Since ${result.since}; ${counts}`,
         `not_restarted=${result.summary.not_restarted}, stranded=${result.summary.stranded}, late_restarts_after_window=${result.summary.late_restarts_after_window}, late_over_10m=${result.summary.late_over_10m}, early_wake_by_others=${result.summary.early_wake_by_others}, self_wake=${result.summary.self_wake}`,
+        `finished_story=${result.summary.finished_story}, idle_no_queued_work=${result.summary.idle_no_queued_work} (neither counts against the keep-alive KPI)`,
         `Stopped and not restarted on their own: ${result.summary.stopped_and_not_restarted_on_their_own}`,
         ...result.rows.filter((row) => row.remediation).map((row) => `Stranded ${row.lane}: ${row.remediation}`),
         ...result.companyless_lead_lanes.map((lane) => `Company-less lead ${lane.lane} (${lane.project}): ${lane.reason}; repair with hq lanes repair-company ${lane.lane} --company <slug>`),

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -100,6 +100,7 @@ export declare function buildOutpostLaneListCommand(input?: {
     laneUlids?: readonly string[];
     active?: boolean;
     hierarchy?: string | readonly string[];
+    senior?: string;
     snapshot?: boolean;
 }): string;
 /**

package/dist/lib/lanes/outpost-dispatch.js

@@ -93,6 +93,8 @@ export function buildOutpostLaneListCommand(input = {}) {
         ? [input.hierarchy]
         : input.hierarchy ?? [])
         args.push("--hierarchy", laneId);
+    if (input.senior !== undefined)
+        args.push("--senior", input.senior);
     if (input.snapshot)
         args.push("--snapshot");
     return withRemoteHqDir(joinCommandParts(args));

package/dist/lib/mesh/live/daemon/install.js

@@ -23,7 +23,7 @@ import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqR
 import { defaultPidLockDeps, pidLockStatus, readPidLock } from "./pid-lock.js";
 import { retireLegacyListen } from "./legacy-listen.js";
 import { readDaemonState } from "./state.js";
-import { activateLaunchd, defaultRunCommand, launchdIsLoaded, launchdServiceTarget, launchdPlistProgramArguments, launchdProgramArgumentsDiffer, parseLaunchctlPrintArguments, } from "../../../service-manager/launchd.js";
+import { activateLaunchd, defaultRunCommand, discoverLaunchdIdentity, installLaunchdPlist, launchdProgramArguments, launchdIsLoaded, launchdServiceTarget, launchdPlistProgramArguments, parseLaunchdCommand, launchdProgramArgumentsDiffer, parseLaunchctlPrintArguments, } from "../../../service-manager/launchd.js";
 import { activateSystemd, systemdIsActive } from "../../../service-manager/systemd.js";
 import { nodeBinaryProblem, preferStableNodeBinary } from "../../../node-binary.js";
 /**
@@ -428,9 +428,7 @@ export function installedDaemonNodeBinary(paths, platform, readUnit = (file) =>
         const text = readUnit(paths.plistPath);
         if (!text)
             return null;
-        const block = text.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
-        const first = block?.[1]?.match(/<string>([^<]*)<\/string>/);
-        return first?.[1] ?? null;
+        return parseLaunchdCommand(launchdPlistProgramArguments(text))?.node ?? null;
     }
     if (platform === "linux") {
         const text = readUnit(paths.systemdUnitPath);
@@ -544,19 +542,21 @@ function safeUsername() {
     }
 }
 export function renderLaunchdPlist(paths) {
+    const identity = discoverLaunchdIdentity(paths.home);
+    const args = launchdProgramArguments({
+        nodeBinary: paths.nodeBinary,
+        hqBinary: paths.hqBinary,
+        launchdLauncherBinary: identity.launcherBinary,
+    }, ["mesh", "daemon", "run"]);
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
   <string>${LAUNCHD_LABEL}</string>
-  <key>ProgramArguments</key>
+${identity.associatedBundleIdentifier ? `  <key>AssociatedBundleIdentifiers</key>\n  <array>\n    <string>${escapeXml(identity.associatedBundleIdentifier)}</string>\n  </array>\n` : ""}  <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(paths.nodeBinary)}</string>
-    <string>${escapeXml(paths.hqBinary)}</string>
-    <string>mesh</string>
-    <string>daemon</string>
-    <string>run</string>
+${args.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n")}
   </array>
   <key>WorkingDirectory</key>
   <string>${escapeXml(paths.daemonDir)}</string>
@@ -920,11 +920,24 @@ export function installDaemonService(opts) {
     if (platform === "darwin") {
         const rendered = renderLaunchdPlist(paths);
         mkdirSync(paths.launchAgentsDir, { recursive: true });
-        replaceUnitFile(paths.plistPath, rendered, 0o600, () => {
-            if (opts.run)
-                activateLaunchd(paths.plistPath, opts.run, opts.uid, { sleep: opts.sleep });
-            else
-                opts.activate?.(platform, paths.plistPath);
+        installLaunchdPlist(paths.plistPath, LAUNCHD_LABEL, rendered, {
+            files: {
+                existsSync: fs.existsSync,
+                readFileSync: (file) => fs.readFileSync(file, "utf8"),
+                writeFileSync: fs.writeFileSync,
+                chmodSync: fs.chmodSync,
+                renameSync: fs.renameSync,
+                unlinkSync: fs.unlinkSync,
+            },
+            activate: Boolean(opts.run || opts.activate),
+            uid: opts.uid,
+            rollbackOnReloadError: true,
+            reload: () => {
+                if (opts.run)
+                    activateLaunchd(paths.plistPath, opts.run, opts.uid, { sleep: opts.sleep });
+                else if (opts.activate)
+                    opts.activate(platform, paths.plistPath);
+            },
         });
         return {
             platform,

package/dist/lib/service-manager/index.d.ts

@@ -15,9 +15,12 @@ export interface ServiceManagerDeps {
     platform?: ServicePlatform;
     run?: RunCommand;
     writeFileSync?: typeof fs.writeFileSync;
+    chmodSync?: typeof fs.chmodSync;
+    renameSync?: typeof fs.renameSync;
     mkdirSync?: typeof fs.mkdirSync;
     unlinkSync?: typeof fs.unlinkSync;
     existsSync?: typeof fs.existsSync;
+    readFileSync?: typeof fs.readFileSync;
     /** When false, render + write units but do not (de)activate them. */
     activate?: boolean;
 }