@indigoai-us/hq-cli 5.345.50 → 5.345.51

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.345.51] — 2026-10-08
+
+- Multi-company session locking now defaults on across native CLI readers; an explicit false flag value remains the kill switch.
+
+- The Codex skill bridge regression suite now checks that the repo `.agents/skills` mirror exposes every skill from the Claude listing source once.
+- `hq lanes message`, `resume` and `grant` now reach an Outpost-hosted lane that has no local record even when the owner's lane store is too large for one hierarchy read. The lane, its senior, its siblings and its children are read in bounded parts instead of the command failing with `lane_not_found`.
+- HQ CLI compares LaunchAgent plists before writing or reloading them, attributes jobs to an installed HQ.app, uses its signed launcher when available, and migrates legacy Node-first agents once.
+
 ## [5.345.50] — 2026-10-08
 - The lane keep-alive audit now admits every `done` stop envelope and splits the unrestarted ones by keep-alive eligibility: a stop keep-alive is specified not to wake is reported as `finished_story` or `idle_no_queued_work` instead of being counted as a liveness failure. `stopped_and_not_restarted_on_their_own` keeps its name and its value on the stops the audit already reported.
 - A finished standing lane that receives queued work long after it stopped now gets the normal grace period measured from when that work appeared, so a normal exit from `idle_no_queued_work` is no longer reported as a keep-alive liveness failure.

package/dist/commands/core-hq-session-native.js

@@ -781,11 +781,11 @@ export async function runHqSessionFast(argv, _stdin, cwd, hqRoot) {
         || (commandArgs[0] === "get" && commandArgs[1] === "company_slugs");
     let enabled = false;
     if (needsMultiCompanyFlag) {
-        const [{ fastFlagEnabled }, { MULTI_COMPANY_SESSION_LOCK_FLAG }] = await Promise.all([
+        const [{ fastFlagEnabledDefaultOn }, { MULTI_COMPANY_SESSION_LOCK_FLAG }] = await Promise.all([
             import("../native-fast-route.js"),
             import("../lib/cli-flag-keys.js"),
         ]);
-        enabled = await fastFlagEnabled(MULTI_COMPANY_SESSION_LOCK_FLAG);
+        enabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG);
     }
     const result = executeHqSession(argv, { cwd, hqRoot }, { multiCompanyLockEnabled: enabled });
     if (result.stdout)

package/dist/commands/core-resolve-company-native.js

@@ -4,7 +4,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { awkCannotOpenFileDiagnostic } from "../lib/core-utils/awk-diagnostics.js";
 import { buildCmdExeSpawnPlan, isWindowsBatchFile } from "../utils/windows-spawn.js";
-import { fastFlagEnabled } from "../native-fast-route.js";
+import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 export const RESOLVE_COMPANY_ASSET = "core/scripts/resolve-company.sh";
 export const RESOLVE_COMPANY_HELP = [
     "hq-core: public",
@@ -603,7 +603,7 @@ export async function runResolveCompanyFast(args, stdin, cwd, hqRoot, _commandNa
         hqRoot,
         stdin: actualStdin,
         stdinIsTty: process.stdin.isTTY === true,
-        multiCompanyLockEnabled: await fastFlagEnabled("hooks.multi-company-session-lock"),
+        multiCompanyLockEnabled: await fastFlagEnabledDefaultOn("hooks.multi-company-session-lock"),
     });
     process.stdout.write(result.stdout);
     if (result.stderr.length)

package/dist/commands/lanes.js

@@ -947,6 +947,7 @@ function laneListQueryFlags(query) {
         ...(query.laneUlids?.length ? ["--lane-ulid"] : []),
         ...(query.active ? ["--active"] : []),
         ...(query.hierarchy?.length ? ["--hierarchy"] : []),
+        ...(query.senior !== undefined ? ["--senior"] : []),
         ...(query.snapshot ? ["--snapshot"] : []),
     ];
 }
@@ -1404,6 +1405,7 @@ function normalizedLaneListQuery(query) {
         ...(laneUlids === undefined ? {} : { laneUlids }),
         ...(query.active ? { active: true } : {}),
         ...(hierarchy === undefined ? {} : { hierarchy }),
+        ...(query.senior === undefined ? {} : { senior: query.senior }),
         ...(query.snapshot ? { snapshot: true } : {}),
         ...(query.strictSnapshot ? { strictSnapshot: true } : {}),
         ...(query.includeForeignHostRows ? { includeForeignHostRows: true } : {}),
@@ -1503,6 +1505,48 @@ async function readOutpostLaneRecords(ctx, outpostId, requestedQuery = {}, dispa
     }
     return invocationMemo.getOrCreate(outpostId, query, () => readOutpostLaneRecordsUncached(ctx, outpostId, query, dispatchOptions));
 }
+/**
+ * Read the owner rows the hire-grant context for `laneId` is built from.
+ *
+ * The owner's `--hierarchy` selector also returns every lane that shares the
+ * target's company and project, so on a store with hundreds of lanes in one
+ * project the response reaches the Outpost exec output limit and the read
+ * fails before a single row is parsed. When that happens, and the target has a
+ * lane senior, assemble the rows the context builder needs from bounded reads
+ * every owner CLI supports: the target and its senior by id, the senior's
+ * direct children (the target's siblings) and the target's own children by
+ * `--senior`. The owner rejects `--senior` together with `--snapshot`, so the
+ * two `--senior` reads use the plain JSON list; the dispatched command sets
+ * HQ_LANES_REMOTE_READ=1, which keeps that list from refreshing remote
+ * mirrors, and the view-only fields it adds are stripped before parsing. A
+ * session-senior target needs same-company profile rows that no bounded
+ * filter selects, so its oversized read stays an error.
+ */
+async function readOutpostLaneHierarchy(ctx, outpostId, laneId) {
+    let tooLarge;
+    try {
+        return await readOutpostLaneRecords(ctx, outpostId, { hierarchy: [laneId], snapshot: true });
+    }
+    catch (err) {
+        if (!isLanesError(err) || err.error !== "outpost_lane_list_too_large")
+            throw err;
+        tooLarge = err;
+    }
+    const targets = await readOutpostLaneRecords(ctx, outpostId, { laneIds: [laneId], snapshot: true });
+    const target = targets.find((lane) => lane.lane_id === laneId);
+    if (target === undefined)
+        return targets;
+    if (target.senior.kind !== "lane" || !target.senior.id) {
+        throw new LanesError(tooLarge.error, `${tooLarge.message}; lane ${laneId} has a ${target.senior.kind} senior, whose hierarchy cannot be read in bounded parts`, { ...tooLarge.details, lane_id: laneId, senior: target.senior });
+    }
+    const seniorId = target.senior.id;
+    const [seniorRows, siblings, children] = await Promise.all([
+        readOutpostLaneRecords(ctx, outpostId, { laneIds: [seniorId], snapshot: true }),
+        readOutpostLaneRecords(ctx, outpostId, { senior: `lane:${seniorId}` }),
+        readOutpostLaneRecords(ctx, outpostId, { senior: `lane:${laneId}` }),
+    ]);
+    return mergeOwnerLaneRecords([...targets, ...seniorRows, ...siblings], children);
+}
 /** Refresh this host's selected Outpost mirrors in one bounded owner query per Outpost. */
 async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, options = {}) {
     const result = {
@@ -1829,9 +1873,12 @@ async function resolveCommandLaneTarget(ctx, laneId, options = {}) {
     for (const outpostId of lookupOutpostIds) {
         let ownerLanes;
         try {
-            ownerLanes = await readOutpostLaneRecords(ctx, outpostId, hostlessUlidLookup
-                ? { laneUlids: [requestedUlid], snapshot: true }
-                : { hierarchy: [laneId], snapshot: true });
+            // The hierarchy read is shared with the grant context built after
+            // resolution, so one owner round trip serves both whenever the Outpost
+            // exec output limit can carry the owner's response.
+            ownerLanes = hostlessUlidLookup
+                ? await readOutpostLaneRecords(ctx, outpostId, { laneUlids: [requestedUlid], snapshot: true })
+                : await readOutpostLaneHierarchy(ctx, outpostId, laneId);
             probedOutpostIds.push(outpostId);
         }
         catch (err) {
@@ -4665,20 +4712,14 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
     let grantContext;
     let grantHierarchy;
     if (action === "grant") {
-        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId, {
-            hierarchy: [lane.lane_id],
-            snapshot: true,
-        }));
+        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneHierarchy(ctx, outpostId, lane.lane_id));
         const hierarchy = await hierarchyWithVerifiedRemoteSenior(ctx, ctx.hqRoot(), lane, ownerHierarchy);
         grantHierarchy = hierarchy;
         grantContext = createOutpostHireGrantContext(lane, hierarchy);
     }
     else if ((action === "resume" && lane.senior.kind === "lane") ||
         (action === "message" && (lane.senior.kind === "lane" || lane.senior.kind === "session"))) {
-        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId, {
-            hierarchy: [lane.lane_id],
-            snapshot: true,
-        }));
+        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneHierarchy(ctx, outpostId, lane.lane_id));
         const hierarchy = await hierarchyWithVerifiedRemoteSenior(ctx, ctx.hqRoot(), lane, ownerHierarchy);
         grantContext = createOutpostHireGrantContext(lane, hierarchy, action === "message" ? options.supersededMessageCallerId : undefined, action === "message" ? options.supersededMessageSessionId : undefined);
     }

package/dist/commands/secrets.js

@@ -145,7 +145,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { removeCacheEntry, clearAllCache } from "../utils/secrets-cache.js";
 import { isHqCliChild, releaseChildWrapperPackageUseLeaseAfterStart } from "../utils/child-wrapper-lease.js";
 import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
-import { fastFlagEnabled } from "../native-fast-route.js";
+import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
 import { resolveSessionId } from "../lib/core-utils/session-id.js";
 import { secretsExecChildExitCode } from "../utils/child-wrapper-exit.js";
@@ -1249,7 +1249,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
-            const multiCompanyLockEnabled = await fastFlagEnabled(MULTI_COMPANY_SESSION_LOCK_FLAG);
+            const multiCompanyLockEnabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG);
             const sessionLock = multiCompanyLockEnabled ? readSessionCompanyLock(process.env) : undefined;
             const parentScope = secrets.opts();
             const inheritedCompany = parentScope.company;

package/dist/commands/workers.js

@@ -7,7 +7,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
 import { GROUP_ID_PATTERN, EMAIL_PATTERN, toSharedFolderGlob } from "./_patterns.js";
 import { findHqRoot } from "../utils/manifest.js";
-import { fastFlagEnabled } from "../native-fast-route.js";
+import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
 import { resolveSessionId } from "../lib/core-utils/session-id.js";
 export { readWorkerRegistry } from "../lib/workers-registry/read.js";
@@ -198,7 +198,7 @@ async function runWorkersShare(workerId, opts) {
 }
 async function runWorkersList(opts) {
     const hqRoot = findHqRoot();
-    const enabled = await fastFlagEnabled(MULTI_COMPANY_SESSION_LOCK_FLAG);
+    const enabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG);
     const lockedCompanies = resolveActiveCompanies(hqRoot, enabled);
     if (enabled && opts.company && denyWorkerCompanyOutsideLock(opts.company, lockedCompanies))
         return;

package/dist/lib/bot/daemon.d.ts

@@ -64,7 +64,7 @@ export interface BotDaemonDeps {
     platform?: BotDaemonPlatform;
     launchctl?: LaunchctlExec;
     uid?: number;
-    fsImpl?: Pick<typeof fs, "existsSync" | "writeFileSync" | "mkdirSync" | "unlinkSync">;
+    fsImpl?: Pick<typeof fs, "existsSync" | "readFileSync" | "writeFileSync" | "mkdirSync" | "unlinkSync"> & Partial<Pick<typeof fs, "chmodSync" | "renameSync">>;
     /** Blocking sleep, injectable for tests. */
     sleepMs?: (ms: number) => void;
     /**

package/dist/lib/bot/daemon.js

@@ -15,7 +15,7 @@ import * as path from "node:path";
 import { spawn } from "node:child_process";
 import { resolveHqBinary, resolveNodeBinary, preferStableHqBinary } from "../mesh/live/daemon/install.js";
 import { botLogPath, launchdLabel } from "./paths.js";
-import { reloadLaunchd } from "../service-manager/launchd.js";
+import { discoverLaunchdIdentity, installLaunchdPlist, launchdProgramArguments, launchdPlistProgramArguments as parsePlistArguments, parseLaunchdCommand, reloadLaunchd } from "../service-manager/launchd.js";
 import { nodeBinaryProblem, preferStableNodeBinary } from "../node-binary.js";
 export function detectBotPlatform(platform = process.platform) {
     if (platform === "darwin")
@@ -66,6 +66,12 @@ function escapeXml(value) {
         .replace(/"/g, """);
 }
 export function renderBotLaunchdPlist(p) {
+    const identity = discoverLaunchdIdentity(p.home);
+    const args = launchdProgramArguments({
+        nodeBinary: p.nodeBinary,
+        hqBinary: p.hqBinary,
+        launchdLauncherBinary: identity.launcherBinary,
+    }, ["bot", "run", p.name]);
     const envRows = [
         ["HOME", p.home],
         ["PATH", p.pathEntries.join(":")],
@@ -80,13 +86,9 @@ export function renderBotLaunchdPlist(p) {
 <dict>
   <key>Label</key>
   <string>${escapeXml(p.label)}</string>
-  <key>ProgramArguments</key>
+${identity.associatedBundleIdentifier ? `  <key>AssociatedBundleIdentifiers</key>\n  <array>\n    <string>${escapeXml(identity.associatedBundleIdentifier)}</string>\n  </array>\n` : ""}  <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(p.nodeBinary)}</string>
-    <string>${escapeXml(p.hqBinary)}</string>
-    <string>bot</string>
-    <string>run</string>
-    <string>${escapeXml(p.name)}</string>
+${args.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n")}
   </array>
   <key>WorkingDirectory</key>
   <string>${escapeXml(p.hqRoot ?? p.botDir)}</string>
@@ -190,16 +192,13 @@ function launchdLoaded(p, deps) {
     return deps.launchctl(["print", `${launchdDomain(deps.uid)}/${p.label}`]).ok;
 }
 export function launchdPlistProgramArguments(plist) {
-    const block = plist.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
-    if (!block)
-        return [];
-    return [...block[1].matchAll(/<string>([^<]*)<\/string>/g)].map((m) => m[1]);
+    return parsePlistArguments(plist);
 }
 /** The hq script path baked into an installed unit, or null if none. */
 export function installedDaemonHqBinary(p, io = fs) {
     if (io.existsSync(p.plistPath)) {
         const args = launchdPlistProgramArguments(io.readFileSync(p.plistPath, "utf8"));
-        return args[1] ?? null;
+        return parseLaunchdCommand(args)?.hq ?? null;
     }
     if (io.existsSync(p.systemdUnitPath)) {
         const unit = io.readFileSync(p.systemdUnitPath, "utf8");
@@ -212,7 +211,7 @@ export function installedDaemonHqBinary(p, io = fs) {
 export function installedDaemonNodeBinary(p, io = fs) {
     if (io.existsSync(p.plistPath)) {
         const args = launchdPlistProgramArguments(io.readFileSync(p.plistPath, "utf8"));
-        return args[0] ?? null;
+        return parseLaunchdCommand(args)?.node ?? null;
     }
     if (io.existsSync(p.systemdUnitPath)) {
         const unit = io.readFileSync(p.systemdUnitPath, "utf8");
@@ -383,19 +382,27 @@ export function installBotDaemon(p, deps = {}) {
     io.mkdirSync(path.dirname(p.logPath), { recursive: true, mode: 0o700 });
     if (platform === "darwin") {
         io.mkdirSync(path.dirname(p.plistPath), { recursive: true });
-        // Replace rather than overwrite, so re-adopting a bot over the stale plist
-        // a wiped ~/.hq left behind lands a fresh file at 0600 (writeFileSync
-        // keeps the mode an existing file already has).
-        if (io.existsSync(p.plistPath))
-            io.unlinkSync(p.plistPath);
-        io.writeFileSync(p.plistPath, renderBotLaunchdPlist(p), { mode: 0o600 });
-        let loaded = false;
-        if (deps.launchctl) {
-            // bootout first so a re-install picks up a changed plist.
-            const r = rebootstrapLaunchd(p, deps);
-            if (!r.ok) {
-                const detail = `launchctl bootstrap failed after ${r.bootstrapAttempts} attempts: ${(r.error ?? "").slice(0, 200)}`;
-                if (r.loaded) {
+        const reloadState = { result: null };
+        const written = installLaunchdPlist(p.plistPath, p.label, renderBotLaunchdPlist(p), {
+            files: {
+                existsSync: io.existsSync,
+                readFileSync: (file) => io.readFileSync(file, "utf8"),
+                writeFileSync: io.writeFileSync,
+                ...(io.chmodSync ? { chmodSync: io.chmodSync } : {}),
+                ...(io.renameSync ? { renameSync: io.renameSync } : {}),
+                unlinkSync: io.unlinkSync,
+            },
+            activate: Boolean(deps.launchctl),
+            isLoaded: () => launchdLoaded(p, deps),
+            ...(deps.launchctl ? { reload: () => { reloadState.result = rebootstrapLaunchd(p, deps); return reloadState.result; } } : {}),
+        });
+        let loaded = written.loaded;
+        if (deps.launchctl && reloadState.result) {
+            const r = reloadState.result;
+            loaded = r.loaded;
+            if (!r?.ok) {
+                const detail = `launchctl bootstrap failed after ${r?.bootstrapAttempts ?? 0} attempts: ${(r?.error ?? "").slice(0, 200)}`;
+                if (r?.loaded) {
                     // The previous definition survived the bootout; keep it running.
                     deps.launchctl(["kickstart", "-k", `${launchdDomain(deps.uid)}/${p.label}`]);
                 }
@@ -403,14 +410,13 @@ export function installBotDaemon(p, deps = {}) {
                     platform,
                     action: "install",
                     installed: true,
-                    loaded: r.loaded,
+                    loaded: r?.loaded ?? false,
                     dest: p.plistPath,
-                    message: r.loaded
+                    message: r?.loaded
                         ? `Wrote ${p.plistPath} but ${detail}. The previous definition of ${p.label} is still loaded and was restarted; the rewritten plist is not active yet.`
                         : `Wrote ${p.plistPath} but ${detail}. ${p.label} is NOT loaded. Load it with: launchctl bootstrap ${launchdDomain(deps.uid)} ${p.plistPath}`,
                 };
             }
-            loaded = true;
         }
         return {
             platform,

package/dist/lib/daemon/install.js

@@ -17,7 +17,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { activateLaunchd, deactivateLaunchd, launchdPlistPath, renderLaunchdPlist, } from "../service-manager/launchd.js";
+import { activateLaunchd, deactivateLaunchd, defaultRunCommand, installLaunchdPlist, launchdIsLoaded, launchdPlistPath, renderLaunchdPlist, } from "../service-manager/launchd.js";
 import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdUnitPath, } from "../service-manager/systemd.js";
 import { escapeXml, shellQuote } from "../service-manager/types.js";
 import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
@@ -251,12 +251,43 @@ export function installDaemonUnit(host, options, deps) {
     fs.mkdirSync(path.dirname(plan.unitPath), { recursive: true });
     if (plan.kind !== "systemd-system")
         fs.mkdirSync(path.join(host.daemonDir, "logs"), { recursive: true });
-    if (plan.kind === "schtasks")
+    if (plan.kind === "launchd") {
+        let plist;
+        try {
+            plist = installLaunchdPlist(plan.unitPath, DAEMON_LAUNCHD_LABEL, plan.rendered, {
+                run: deps.run ?? defaultRunCommand,
+                uid: host.uid,
+                sleep: deps.sleep,
+                isLoaded: () => launchdIsLoaded(DAEMON_LAUNCHD_LABEL, deps.run ?? defaultRunCommand, host.uid),
+                files: {
+                    existsSync: fs.existsSync,
+                    readFileSync: (file) => fs.readFileSync(file, "utf8"),
+                    writeFileSync: fs.writeFileSync,
+                    chmodSync: fs.chmodSync,
+                    renameSync: fs.renameSync,
+                    unlinkSync: fs.unlinkSync,
+                },
+            });
+        }
+        catch (err) {
+            return {
+                kind: plan.kind,
+                unitPath: plan.unitPath,
+                installed: fs.existsSync(plan.unitPath),
+                running: launchdIsLoaded(DAEMON_LAUNCHD_LABEL, deps.run ?? defaultRunCommand, host.uid),
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+        if (!plist.loaded)
+            return { kind: plan.kind, unitPath: plan.unitPath, installed: true, running: false };
+    }
+    else if (plan.kind === "schtasks")
         fs.writeFileSync(plan.unitPath, encodeWindowsTaskXml(plan.rendered));
     else
         fs.writeFileSync(plan.unitPath, plan.rendered, { mode: plan.kind === "systemd-system" ? 0o644 : 0o600 });
     try {
-        activate(plan, host, deps.run, deps.sleep);
+        if (plan.kind !== "launchd")
+            activate(plan, host, deps.run, deps.sleep);
         return { kind: plan.kind, unitPath: plan.unitPath, installed: true, running: true };
     }
     catch (err) {

package/dist/lib/doctor/checks/bots.js

@@ -10,6 +10,7 @@ import { botsRoot, botDir, launchdLabel } from "../../bot/paths.js";
 import { readBotConfig } from "../../bot/config.js";
 import { isPidAlive, readBotStatus } from "../../bot/status.js";
 import { nodeBinaryProblem } from "../../node-binary.js";
+import { launchdPlistProgramArguments, parseLaunchdCommand } from "../../service-manager/launchd.js";
 export const BOTS_FAMILY_ID = "bots";
 export const BOTS_FAMILY_TITLE = "Local bots";
 const DEFAULT_DEPS = {
@@ -35,14 +36,8 @@ export function checkBots(_context, deps = DEFAULT_DEPS) {
         ];
     }
 }
-function launchdPlistArgs(plist) {
-    const block = plist.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
-    if (!block)
-        return [];
-    return [...block[1].matchAll(/<string>([^<]*)<\/string>/g)].map((m) => m[1]);
-}
 function launchdPlistHqBinary(plist) {
-    return launchdPlistArgs(plist)[1] ?? null;
+    return parseLaunchdCommand(launchdPlistProgramArguments(plist))?.hq ?? null;
 }
 function runChecks(deps) {
     const home = deps.home();
@@ -122,7 +117,7 @@ function runChecks(deps) {
             try {
                 const text = fs.readFileSync(plistPath, "utf8");
                 hqPath = launchdPlistHqBinary(text);
-                nodePath = launchdPlistArgs(text)[0] ?? null;
+                nodePath = parseLaunchdCommand(launchdPlistProgramArguments(text))?.node ?? null;
             }
             catch {
                 hqPath = null;

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -100,6 +100,7 @@ export declare function buildOutpostLaneListCommand(input?: {
     laneUlids?: readonly string[];
     active?: boolean;
     hierarchy?: string | readonly string[];
+    senior?: string;
     snapshot?: boolean;
 }): string;
 /**

package/dist/lib/lanes/outpost-dispatch.js

@@ -93,6 +93,8 @@ export function buildOutpostLaneListCommand(input = {}) {
         ? [input.hierarchy]
         : input.hierarchy ?? [])
         args.push("--hierarchy", laneId);
+    if (input.senior !== undefined)
+        args.push("--senior", input.senior);
     if (input.snapshot)
         args.push("--snapshot");
     return withRemoteHqDir(joinCommandParts(args));

package/dist/lib/mesh/live/daemon/install.js

@@ -23,7 +23,7 @@ import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqR
 import { defaultPidLockDeps, pidLockStatus, readPidLock } from "./pid-lock.js";
 import { retireLegacyListen } from "./legacy-listen.js";
 import { readDaemonState } from "./state.js";
-import { activateLaunchd, defaultRunCommand, launchdIsLoaded, launchdServiceTarget, launchdPlistProgramArguments, launchdProgramArgumentsDiffer, parseLaunchctlPrintArguments, } from "../../../service-manager/launchd.js";
+import { activateLaunchd, defaultRunCommand, discoverLaunchdIdentity, installLaunchdPlist, launchdProgramArguments, launchdIsLoaded, launchdServiceTarget, launchdPlistProgramArguments, parseLaunchdCommand, launchdProgramArgumentsDiffer, parseLaunchctlPrintArguments, } from "../../../service-manager/launchd.js";
 import { activateSystemd, systemdIsActive } from "../../../service-manager/systemd.js";
 import { nodeBinaryProblem, preferStableNodeBinary } from "../../../node-binary.js";
 /**
@@ -428,9 +428,7 @@ export function installedDaemonNodeBinary(paths, platform, readUnit = (file) =>
         const text = readUnit(paths.plistPath);
         if (!text)
             return null;
-        const block = text.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
-        const first = block?.[1]?.match(/<string>([^<]*)<\/string>/);
-        return first?.[1] ?? null;
+        return parseLaunchdCommand(launchdPlistProgramArguments(text))?.node ?? null;
     }
     if (platform === "linux") {
         const text = readUnit(paths.systemdUnitPath);
@@ -544,19 +542,21 @@ function safeUsername() {
     }
 }
 export function renderLaunchdPlist(paths) {
+    const identity = discoverLaunchdIdentity(paths.home);
+    const args = launchdProgramArguments({
+        nodeBinary: paths.nodeBinary,
+        hqBinary: paths.hqBinary,
+        launchdLauncherBinary: identity.launcherBinary,
+    }, ["mesh", "daemon", "run"]);
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
   <string>${LAUNCHD_LABEL}</string>
-  <key>ProgramArguments</key>
+${identity.associatedBundleIdentifier ? `  <key>AssociatedBundleIdentifiers</key>\n  <array>\n    <string>${escapeXml(identity.associatedBundleIdentifier)}</string>\n  </array>\n` : ""}  <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(paths.nodeBinary)}</string>
-    <string>${escapeXml(paths.hqBinary)}</string>
-    <string>mesh</string>
-    <string>daemon</string>
-    <string>run</string>
+${args.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n")}
   </array>
   <key>WorkingDirectory</key>
   <string>${escapeXml(paths.daemonDir)}</string>
@@ -920,11 +920,24 @@ export function installDaemonService(opts) {
     if (platform === "darwin") {
         const rendered = renderLaunchdPlist(paths);
         mkdirSync(paths.launchAgentsDir, { recursive: true });
-        replaceUnitFile(paths.plistPath, rendered, 0o600, () => {
-            if (opts.run)
-                activateLaunchd(paths.plistPath, opts.run, opts.uid, { sleep: opts.sleep });
-            else
-                opts.activate?.(platform, paths.plistPath);
+        installLaunchdPlist(paths.plistPath, LAUNCHD_LABEL, rendered, {
+            files: {
+                existsSync: fs.existsSync,
+                readFileSync: (file) => fs.readFileSync(file, "utf8"),
+                writeFileSync: fs.writeFileSync,
+                chmodSync: fs.chmodSync,
+                renameSync: fs.renameSync,
+                unlinkSync: fs.unlinkSync,
+            },
+            activate: Boolean(opts.run || opts.activate),
+            uid: opts.uid,
+            rollbackOnReloadError: true,
+            reload: () => {
+                if (opts.run)
+                    activateLaunchd(paths.plistPath, opts.run, opts.uid, { sleep: opts.sleep });
+                else if (opts.activate)
+                    opts.activate(platform, paths.plistPath);
+            },
         });
         return {
             platform,

package/dist/lib/service-manager/index.d.ts

@@ -15,9 +15,12 @@ export interface ServiceManagerDeps {
     platform?: ServicePlatform;
     run?: RunCommand;
     writeFileSync?: typeof fs.writeFileSync;
+    chmodSync?: typeof fs.chmodSync;
+    renameSync?: typeof fs.renameSync;
     mkdirSync?: typeof fs.mkdirSync;
     unlinkSync?: typeof fs.unlinkSync;
     existsSync?: typeof fs.existsSync;
+    readFileSync?: typeof fs.readFileSync;
     /** When false, render + write units but do not (de)activate them. */
     activate?: boolean;
 }

package/dist/lib/service-manager/index.js

@@ -5,7 +5,7 @@
  * without touching the host's service manager.
  */
 import * as fs from "node:fs";
-import { activateLaunchd, deactivateLaunchd, defaultRunCommand, launchAgentsDir, launchdIsLoaded, launchdPlistPath, renderLaunchdPlist, } from "./launchd.js";
+import { deactivateLaunchd, defaultRunCommand, launchAgentsDir, launchdIsLoaded, launchdPlistPath, installLaunchdPlist, renderLaunchdPlist, } from "./launchd.js";
 import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdIsActive, systemdUnitName, systemdUnitPath, systemdUserDir, } from "./systemd.js";
 import { detectServicePlatform, } from "./types.js";
 export { detectServicePlatform } from "./types.js";
@@ -23,6 +23,11 @@ export function installServices(specs, host, deps = {}) {
     const platform = deps.platform ?? detectServicePlatform();
     const run = deps.run ?? defaultRunCommand;
     const writeFileSync = deps.writeFileSync ?? fs.writeFileSync;
+    const chmodSync = deps.chmodSync ?? fs.chmodSync;
+    const renameSync = deps.renameSync ?? fs.renameSync;
+    const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    const readFileSync = deps.readFileSync ?? fs.readFileSync;
     const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
     const activate = deps.activate ?? true;
     if (platform === "other") {
@@ -38,14 +43,25 @@ export function installServices(specs, host, deps = {}) {
     for (const spec of specs) {
         const unitPath = unitPathFor(platform, host.home, spec);
         const rendered = renderUnit(platform, spec, host);
-        writeFileSync(unitPath, rendered, { mode: 0o600 });
+        if (platform === "darwin") {
+            const installed = installLaunchdPlist(unitPath, spec.label, rendered, {
+                run,
+                activate,
+                files: { existsSync, readFileSync: (file) => readFileSync(file, "utf8"), writeFileSync, chmodSync, renameSync, unlinkSync },
+            });
+            const unit = { name: spec.name, unitPath, rendered, installed: true };
+            if (activate)
+                unit.running = installed.loaded;
+            units.push(unit);
+            continue;
+        }
+        else {
+            writeFileSync(unitPath, rendered, { mode: 0o600 });
+        }
         const unit = { name: spec.name, unitPath, rendered, installed: true };
         if (activate) {
             try {
-                if (platform === "darwin")
-                    activateLaunchd(unitPath, run);
-                else
-                    activateSystemd(systemdUnitName(spec), run);
+                activateSystemd(systemdUnitName(spec), run);
                 unit.running = true;
             }
             catch (err) {

package/dist/lib/service-manager/launchd.d.ts

@@ -2,11 +2,24 @@
  * macOS LaunchAgent rendering + activation for kit services.
  *
  * Units live at ~/Library/LaunchAgents/<label>.plist. Activation uses the
- * modern `launchctl bootstrap gui/<uid>` form (bootout first so a re-install
- * picks up a changed plist). Command execution is injected so tests never
- * touch launchctl.
+ * modern `launchctl bootstrap gui/<uid>` form only after a serialized plist
+ * changes. Command execution is injected so tests never touch launchctl.
  */
+import * as fs from "node:fs";
 import { type ServiceHostPaths, type ServiceSpec } from "./types.js";
+export interface LaunchdIdentity {
+    launcherBinary?: string;
+    associatedBundleIdentifier?: string;
+}
+/** Find the installed HQ bundle and read its identity from the generated plist. */
+export declare function discoverLaunchdIdentity(home: string, io?: Pick<typeof fs, "existsSync" | "readFileSync">): LaunchdIdentity;
+export declare function launchdProgramArguments(host: Pick<ServiceHostPaths, "nodeBinary" | "hqBinary" | "launchdLauncherBinary">, args: string[]): string[];
+export declare function parseLaunchdCommand(args: string[]): {
+    node: string;
+    hq: string;
+    args: string[];
+} | null;
+export declare function launchdIdentityForHome(home: string): LaunchdIdentity;
 export declare function launchAgentsDir(home: string): string;
 export declare function launchdPlistPath(home: string, spec: Pick<ServiceSpec, "label">): string;
 export declare function renderLaunchdPlist(spec: ServiceSpec, host: ServiceHostPaths): string;
@@ -16,6 +29,30 @@ export type RunCommand = (cmd: string, args: string[]) => {
     stderr: string;
 };
 export type SleepFn = (ms: number) => void;
+export interface LaunchdPlistFiles {
+    existsSync(file: string): boolean;
+    readFileSync(file: string, encoding: "utf8"): string;
+    writeFileSync(file: string, contents: string, options?: {
+        mode?: number;
+    }): unknown;
+    chmodSync?(file: string, mode: number): unknown;
+    unlinkSync?(file: string): unknown;
+    renameSync?(from: string, to: string): unknown;
+}
+/** Write and activate a LaunchAgent only when its serialized plist changes. */
+export declare function installLaunchdPlist(plistPath: string, _label: string, rendered: string, deps: {
+    files: LaunchdPlistFiles;
+    run?: RunCommand;
+    uid?: number;
+    activate?: boolean;
+    reload?: () => unknown;
+    isLoaded?: () => boolean;
+    sleep?: SleepFn;
+    rollbackOnReloadError?: boolean;
+}): {
+    changed: boolean;
+    loaded: boolean;
+};
 /** How long to wait for a booted-out job to leave launchd before bootstrapping anyway. */
 export declare const LAUNCHD_UNLOAD_DEADLINE_MS = 10000;
 /** Interval between `launchctl print` polls while the old job unloads. */

package/dist/lib/service-manager/launchd.js

@@ -2,15 +2,55 @@
  * macOS LaunchAgent rendering + activation for kit services.
  *
  * Units live at ~/Library/LaunchAgents/<label>.plist. Activation uses the
- * modern `launchctl bootstrap gui/<uid>` form (bootout first so a re-install
- * picks up a changed plist). Command execution is injected so tests never
- * touch launchctl.
+ * modern `launchctl bootstrap gui/<uid>` form only after a serialized plist
+ * changes. Command execution is injected so tests never touch launchctl.
  */
 import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { escapeXml, } from "./types.js";
 const LAUNCHD_PATH_ENV = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin";
+const HQ_TASK_ARGUMENT = "--hq-launchd-task";
+/** Find the installed HQ bundle and read its identity from the generated plist. */
+export function discoverLaunchdIdentity(home, io = fs) {
+    const bundles = ["/Applications/HQ.app", path.join(home, "Applications", "HQ.app")];
+    for (const bundle of bundles) {
+        const infoPath = path.join(bundle, "Contents", "Info.plist");
+        const executable = path.join(bundle, "Contents", "MacOS", "hq-sync-menubar");
+        if (!io.existsSync(infoPath))
+            continue;
+        const xml = io.readFileSync(infoPath, "utf8");
+        const identifier = /<key>CFBundleIdentifier<\/key>\s*<string>([^<]+)<\/string>/.exec(xml)?.[1];
+        const version = /<key>HQLaunchdTaskVersion<\/key>\s*<integer>(\d+)<\/integer>/.exec(xml)?.[1];
+        if (!identifier)
+            throw new Error(`HQ.app Info.plist has no CFBundleIdentifier: ${infoPath}`);
+        if (version === "1" && !io.existsSync(executable)) {
+            throw new Error(`HQ.app advertises LaunchAgent launcher protocol 1 but its executable is missing: ${executable}`);
+        }
+        return {
+            associatedBundleIdentifier: identifier,
+            ...(version === "1" ? { launcherBinary: executable } : {}),
+        };
+    }
+    return {};
+}
+export function launchdProgramArguments(host, args) {
+    return host.launchdLauncherBinary
+        ? [host.launchdLauncherBinary, HQ_TASK_ARGUMENT, host.nodeBinary, host.hqBinary, ...args]
+        : [host.nodeBinary, host.hqBinary, ...args];
+}
+export function parseLaunchdCommand(args) {
+    const offset = args[1] === HQ_TASK_ARGUMENT ? 2 : 0;
+    const node = args[offset];
+    const hq = args[offset + 1];
+    if (!node || !hq)
+        return null;
+    return { node, hq, args: args.slice(offset + 2) };
+}
+export function launchdIdentityForHome(home) {
+    return discoverLaunchdIdentity(home);
+}
 export function launchAgentsDir(home) {
     return path.join(home, "Library", "LaunchAgents");
 }
@@ -18,7 +58,10 @@ export function launchdPlistPath(home, spec) {
     return path.join(launchAgentsDir(home), `${spec.label}.plist`);
 }
 export function renderLaunchdPlist(spec, host) {
-    const args = [host.nodeBinary, host.hqBinary, ...spec.args]
+    const discovered = discoverLaunchdIdentity(host.home);
+    const associatedBundleIdentifier = host.associatedBundleIdentifier ?? discovered.associatedBundleIdentifier;
+    const launcherBinary = host.launchdLauncherBinary ?? discovered.launcherBinary;
+    const args = launchdProgramArguments({ ...host, launchdLauncherBinary: launcherBinary }, spec.args)
         .map((a) => `    <string>${escapeXml(a)}</string>`)
         .join("\n");
     const env = {
@@ -36,7 +79,7 @@ export function renderLaunchdPlist(spec, host) {
 <dict>
   <key>Label</key>
   <string>${escapeXml(spec.label)}</string>
-  <key>ProgramArguments</key>
+${associatedBundleIdentifier ? `  <key>AssociatedBundleIdentifiers</key>\n  <array>\n    <string>${escapeXml(associatedBundleIdentifier)}</string>\n  </array>\n` : ""}  <key>ProgramArguments</key>
   <array>
 ${args}
   </array>
@@ -60,6 +103,64 @@ ${envXml}
 </plist>
 `;
 }
+/** Write and activate a LaunchAgent only when its serialized plist changes. */
+export function installLaunchdPlist(plistPath, _label, rendered, deps) {
+    const { files } = deps;
+    const current = files.existsSync(plistPath) ? files.readFileSync(plistPath, "utf8") : null;
+    const isLoaded = () => deps.isLoaded?.() ?? (deps.run ? launchdIsLoaded(_label, deps.run, deps.uid) : false);
+    if (current === rendered) {
+        if (deps.activate === false)
+            return { changed: false, loaded: false };
+        if (isLoaded())
+            return { changed: false, loaded: true };
+        if (deps.reload)
+            deps.reload();
+        else if (deps.run)
+            activateLaunchd(plistPath, deps.run, deps.uid, { sleep: deps.sleep });
+        return { changed: false, loaded: isLoaded() };
+    }
+    const write = (contents) => {
+        if (!files.renameSync) {
+            files.writeFileSync(plistPath, contents, { mode: 0o600 });
+            files.chmodSync?.(plistPath, 0o600);
+            return;
+        }
+        const tempPath = `${plistPath}.${process.pid}.tmp`;
+        try {
+            files.writeFileSync(tempPath, contents, { mode: 0o600 });
+            files.chmodSync?.(tempPath, 0o600);
+            files.renameSync(tempPath, plistPath);
+        }
+        catch (error) {
+            try {
+                files.unlinkSync?.(tempPath);
+            }
+            catch (cleanupError) {
+                throw new AggregateError([error, cleanupError], `Could not clean temporary LaunchAgent plist ${tempPath}`);
+            }
+            throw error;
+        }
+    };
+    write(rendered);
+    if (deps.activate === false)
+        return { changed: true, loaded: false };
+    try {
+        if (deps.reload)
+            deps.reload();
+        else if (deps.run)
+            activateLaunchd(plistPath, deps.run, deps.uid, { sleep: deps.sleep });
+    }
+    catch (error) {
+        if (deps.rollbackOnReloadError) {
+            if (current === null)
+                files.unlinkSync?.(plistPath);
+            else
+                write(current);
+        }
+        throw error;
+    }
+    return { changed: true, loaded: isLoaded() };
+}
 /** How long to wait for a booted-out job to leave launchd before bootstrapping anyway. */
 export const LAUNCHD_UNLOAD_DEADLINE_MS = 10_000;
 /** Interval between `launchctl print` polls while the old job unloads. */

package/dist/lib/service-manager/migration-state.d.ts

@@ -0,0 +1,12 @@
+export declare const LAUNCHD_MIGRATION_MARKER = ".launchd-node-migration-v1";
+export declare const DEFERRED_MIGRATION_RETRY_MS: number;
+export interface LaunchdMigrationMarker {
+    version: 1;
+    checkedAt: string;
+    deferredLabels: string[];
+}
+export declare function launchdMigrationMarkerPath(home: string): string;
+/** Old timestamp-only markers mean the previous migration completed successfully. */
+export declare function shouldRunLaunchdMigration(home: string, now?: number): boolean;
+export declare function writeLaunchdMigrationMarker(home: string, deferredLabels: string[], now?: number): void;
+//# sourceMappingURL=migration-state.d.ts.map

package/dist/lib/service-manager/migration-state.js

@@ -0,0 +1,46 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const LAUNCHD_MIGRATION_MARKER = ".launchd-node-migration-v1";
+export const DEFERRED_MIGRATION_RETRY_MS = 24 * 60 * 60 * 1000;
+export function launchdMigrationMarkerPath(home) {
+    return path.join(home, "Library", "Application Support", "Indigo HQ", LAUNCHD_MIGRATION_MARKER);
+}
+/** Old timestamp-only markers mean the previous migration completed successfully. */
+export function shouldRunLaunchdMigration(home, now = Date.now()) {
+    const marker = launchdMigrationMarkerPath(home);
+    if (!fs.existsSync(marker))
+        return true;
+    try {
+        const raw = fs.readFileSync(marker, "utf8");
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return Number.isNaN(Date.parse(raw.trim()));
+        }
+        if (!parsed || typeof parsed !== "object")
+            return true;
+        const state = parsed;
+        if (state.version !== 1 || typeof state.checkedAt !== "string")
+            return true;
+        if (!Array.isArray(state.deferredLabels) || state.deferredLabels.length === 0)
+            return false;
+        const checkedAt = Date.parse(state.checkedAt);
+        return !Number.isFinite(checkedAt) || now - checkedAt >= DEFERRED_MIGRATION_RETRY_MS;
+    }
+    catch {
+        return true;
+    }
+}
+export function writeLaunchdMigrationMarker(home, deferredLabels, now = Date.now()) {
+    const marker = launchdMigrationMarkerPath(home);
+    fs.mkdirSync(path.dirname(marker), { recursive: true, mode: 0o700 });
+    const state = {
+        version: 1,
+        checkedAt: new Date(now).toISOString(),
+        deferredLabels: [...new Set(deferredLabels)].sort(),
+    };
+    fs.writeFileSync(marker, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+}
+//# sourceMappingURL=migration-state.js.map

package/dist/lib/service-manager/migration.d.ts

@@ -0,0 +1,22 @@
+import * as fs from "node:fs";
+import { type RunCommand, type SleepFn } from "./launchd.js";
+export interface LaunchdMigrationOptions {
+    home: string;
+    run: RunCommand;
+    uid: number;
+    launcherBinary?: string;
+    associatedBundleIdentifier?: string;
+    files?: Pick<typeof fs, "existsSync" | "readFileSync" | "writeFileSync" | "renameSync" | "unlinkSync" | "readdirSync" | "mkdirSync">;
+    processArgs?: string[];
+    xpcServiceName?: string;
+    sleep?: SleepFn;
+}
+export interface LaunchdMigrationResult {
+    migrated: string[];
+    backupsRemoved: string[];
+    deferred: string[];
+    alreadyDone: boolean;
+}
+/** First-CLI-run cleanup for HQ's old Node-first LaunchAgents and backup plists. */
+export declare function migrateLegacyNodeLaunchAgents(options: LaunchdMigrationOptions): LaunchdMigrationResult;
+//# sourceMappingURL=migration.d.ts.map

package/dist/lib/service-manager/migration.js

@@ -0,0 +1,85 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { launchAgentsDir, activateLaunchd, launchdPlistProgramArguments, } from "./launchd.js";
+import { isVersionedNodePath, preferStableNodeBinary } from "../node-binary.js";
+import { preferStableHqBinary } from "../mesh/live/daemon/install.js";
+import { launchdMigrationMarkerPath, shouldRunLaunchdMigration, writeLaunchdMigrationMarker } from "./migration-state.js";
+const HQ_LABEL_PREFIXES = ["ai.indigo.hq-", "ai.getindigo.hq-"];
+function xml(value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function plistArgs(args) {
+    return `  <key>ProgramArguments</key>\n  <array>\n${args.map((arg) => `    <string>${xml(arg)}</string>`).join("\n")}\n  </array>`;
+}
+function isNodeProgram(program) {
+    return /(^|[\\/])node(?:\.exe)?$/i.test(program);
+}
+/** First-CLI-run cleanup for HQ's old Node-first LaunchAgents and backup plists. */
+export function migrateLegacyNodeLaunchAgents(options) {
+    const files = options.files ?? fs;
+    const marker = launchdMigrationMarkerPath(options.home);
+    if (files.existsSync(marker) && !shouldRunLaunchdMigration(options.home)) {
+        return { migrated: [], backupsRemoved: [], deferred: [], alreadyDone: true };
+    }
+    const dir = launchAgentsDir(options.home);
+    const migrated = [];
+    const backupsRemoved = [];
+    const deferred = [];
+    if (!files.existsSync(dir))
+        files.mkdirSync(dir, { recursive: true });
+    for (const name of files.readdirSync(dir)) {
+        const fullPath = path.join(dir, name);
+        if (name.startsWith("ai.indigo.") && name.includes(".plist.bak-")) {
+            files.unlinkSync(fullPath);
+            backupsRemoved.push(name);
+            continue;
+        }
+        if (!name.endsWith(".plist") || !HQ_LABEL_PREFIXES.some((prefix) => name.startsWith(prefix)))
+            continue;
+        const source = files.readFileSync(fullPath, "utf8");
+        const args = launchdPlistProgramArguments(source);
+        if (args.length < 2 || !isNodeProgram(args[0]))
+            continue;
+        const label = name.slice(0, -".plist".length);
+        const currentProcessIsJob = options.xpcServiceName === label ||
+            (options.processArgs?.length === args.length && options.processArgs.every((arg, index) => arg === args[index]));
+        if (currentProcessIsJob) {
+            deferred.push(label);
+            continue;
+        }
+        if (!options.launcherBinary) {
+            deferred.push(name.slice(0, -".plist".length));
+            continue;
+        }
+        const nodeBinary = preferStableNodeBinary(args[0]);
+        if (isVersionedNodePath(nodeBinary)) {
+            deferred.push(name.slice(0, -".plist".length));
+            continue;
+        }
+        const hqBinary = preferStableHqBinary(args[1]);
+        const nextArgs = [options.launcherBinary, "--hq-launchd-task", nodeBinary, hqBinary, ...args.slice(2)];
+        const renderedArgs = plistArgs(nextArgs);
+        let updated = source.replace(/<key>ProgramArguments<\/key>\s*<array>[\s\S]*?<\/array>/, renderedArgs);
+        if (options.associatedBundleIdentifier && !/<key>AssociatedBundleIdentifiers<\/key>/.test(updated)) {
+            const attribution = `  <key>AssociatedBundleIdentifiers</key>\n  <array>\n    <string>${xml(options.associatedBundleIdentifier)}</string>\n  </array>\n`;
+            updated = updated.replace(/(<key>Label<\/key>\s*<string>[^<]+<\/string>\s*)/, `$1${attribution}`);
+        }
+        if (updated === source)
+            throw new Error(`Could not safely rewrite ${fullPath}`);
+        const tmp = `${fullPath}.${process.pid}.migration.tmp`;
+        files.writeFileSync(tmp, updated, { mode: 0o600 });
+        files.renameSync(tmp, fullPath);
+        try {
+            activateLaunchd(fullPath, options.run, options.uid, { sleep: options.sleep });
+        }
+        catch (error) {
+            throw new Error(`Could not activate migrated HQ LaunchAgent ${name}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        }
+        migrated.push(label);
+    }
+    // A deferred/self/unsupported item is retried at most daily, rather than
+    // forcing every ordinary CLI invocation to rescan the LaunchAgents folder.
+    writeLaunchdMigrationMarker(options.home, deferred);
+    return { migrated, backupsRemoved, deferred, alreadyDone: false };
+}
+//# sourceMappingURL=migration.js.map

package/dist/lib/service-manager/startup-migration.d.ts

@@ -0,0 +1,24 @@
+import type { RunCommand } from "./launchd.js";
+export interface LaunchdStartupMigrationOptions {
+    home: string;
+    uid: number;
+    run?: RunCommand;
+    processArgs: string[];
+    xpcServiceName?: string;
+}
+export interface LaunchdStartupMigrationDependencies {
+    shouldRun?: (home: string) => boolean | Promise<boolean>;
+    discover?: (home: string) => {
+        launcherBinary?: string;
+        associatedBundleIdentifier?: string;
+    };
+    migrate?: (options: LaunchdStartupMigrationOptions & {
+        launcherBinary?: string;
+        associatedBundleIdentifier?: string;
+    }) => unknown;
+    markDeferred?: (home: string) => void;
+    warn?: (message: string) => void;
+}
+/** Best-effort migration; a compatibility cleanup never blocks the requested command. */
+export declare function runLaunchdMigrationAtStartup(options: LaunchdStartupMigrationOptions, dependencies?: LaunchdStartupMigrationDependencies): Promise<void>;
+//# sourceMappingURL=startup-migration.d.ts.map

package/dist/lib/service-manager/startup-migration.js

@@ -0,0 +1,27 @@
+/** Best-effort migration; a compatibility cleanup never blocks the requested command. */
+export async function runLaunchdMigrationAtStartup(options, dependencies = {}) {
+    try {
+        const state = await import("./migration-state.js");
+        const shouldRun = dependencies.shouldRun ?? state.shouldRunLaunchdMigration;
+        if (!await shouldRun(options.home))
+            return;
+        const launchd = await import("./launchd.js");
+        const migration = await import("./migration.js");
+        const discover = dependencies.discover ?? launchd.discoverLaunchdIdentity;
+        const migrate = dependencies.migrate ?? migration.migrateLegacyNodeLaunchAgents;
+        migrate({ ...options, run: options.run ?? launchd.defaultRunCommand, ...discover(options.home) });
+    }
+    catch {
+        try {
+            if (dependencies.markDeferred)
+                dependencies.markDeferred(options.home);
+            else {
+                const state = await import("./migration-state.js");
+                state.writeLaunchdMigrationMarker(options.home, ["migration-error"]);
+            }
+        }
+        catch { /* Keep the requested command available even if state cannot be saved. */ }
+        (dependencies.warn ?? console.warn)("hq: legacy LaunchAgent migration failed; continuing");
+    }
+}
+//# sourceMappingURL=startup-migration.js.map

package/dist/lib/service-manager/types.d.ts

@@ -26,6 +26,9 @@ export interface ServiceHostPaths {
     home: string;
     nodeBinary: string;
     hqBinary: string;
+    /** Optional signed HQ.app launcher and bundle attribution for macOS. */
+    launchdLauncherBinary?: string;
+    associatedBundleIdentifier?: string;
 }
 export type ServicePlatform = "darwin" | "linux" | "other";
 export declare function detectServicePlatform(platform?: NodeJS.Platform): ServicePlatform;

package/dist/main.js

@@ -166,6 +166,28 @@ program.hook("preAction", async () => {
     });
 });
 export async function runCli() {
+    const xpcServiceName = process.env.XPC_SERVICE_NAME ?? "";
+    const launchedByHqAgent = xpcServiceName.startsWith("ai.indigo.") || xpcServiceName.startsWith("ai.getindigo.");
+    const isDaemonEntryPoint = process.argv[2] === "daemon" && process.argv[3] === "run";
+    const isBotHotPath = process.argv[2] === "bot" && process.argv[3] === "run";
+    if (process.platform === "darwin" && typeof process.getuid === "function" &&
+        !launchedByHqAgent && !isDaemonEntryPoint && !isBotHotPath) {
+        const home = os.homedir();
+        // The startup helper checks its small marker before importing launchd or
+        // inspecting the app bundle. Linux never imports this Darwin-only path.
+        try {
+            const { runLaunchdMigrationAtStartup } = await import("./lib/service-manager/startup-migration.js");
+            await runLaunchdMigrationAtStartup({
+                home,
+                uid: process.getuid(),
+                processArgs: process.argv,
+                xpcServiceName,
+            });
+        }
+        catch {
+            console.warn("hq: legacy LaunchAgent migration failed; continuing");
+        }
+    }
     const foregroundNetworkBudget = createForegroundNetworkBudget();
     activeForegroundNetworkBudget = foregroundNetworkBudget;
     // Login must be usable before any identity or company is available, so do

package/dist/native-fast-route.d.ts

@@ -4,4 +4,8 @@ export declare function nativeFastRouteEnabled(argv: readonly string[], env?: No
 export declare function fastFlagEnabled(flagKey: string, env?: NodeJS.ProcessEnv, options?: {
     numericEnvironmentOverride?: boolean;
 }): Promise<boolean>;
+/** Reads a fail-safe flag that stays enabled unless a fresh value disables it. */
+export declare function fastFlagEnabledDefaultOn(flagKey: string, env?: NodeJS.ProcessEnv, options?: {
+    numericEnvironmentOverride?: boolean;
+}): Promise<boolean>;
 //# sourceMappingURL=native-fast-route.d.ts.map

package/dist/native-fast-route.js

@@ -28,6 +28,26 @@ export async function fastFlagEnabled(flagKey, env = process.env, options = {})
         return false;
     }
 }
+/** Reads a fail-safe flag that stays enabled unless a fresh value disables it. */
+export async function fastFlagEnabledDefaultOn(flagKey, env = process.env, options = {}) {
+    try {
+        const override = nativeRouteOverride(flagKey, env, options.numericEnvironmentOverride !== false);
+        if (override !== null)
+            return override;
+        const [{ resolveProcessFlagCompanyContext }, { readFlagSnapshotFile }] = await Promise.all([
+            import("./lib/process-flag-company-context.js"),
+            import("./lib/flag-snapshot-file.js"),
+        ]);
+        const { companyUid } = resolveProcessFlagCompanyContext(env);
+        if (!companyUid)
+            return true;
+        return readFlagSnapshotFile(companyUid, { env })?.flags[flagKey] !== false;
+    }
+    catch {
+        // This flag is a kill switch: missing scope or cache data must leave the feature enabled.
+        return true;
+    }
+}
 /** The route's documented CLI override also accepts the conventional 1/0. */
 function nativeRouteOverride(flagKey, env, numericEnvironmentOverride) {
     const override = readLocalOverride(flagKey, env);

package/dist/utils/resident-package-preload.js

@@ -41,7 +41,7 @@ export const RESIDENT_PACKAGE_MODULES = {
     ],
     "bot-logs-follow": [],
     mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js", "../lib/anywhere-person-setting.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client"],
-    childWrapper: ["../main.js"],
+    childWrapper: ["../main.js", "../lib/service-manager/startup-migration.js"],
     coreJobRun: ["../lib/flag-registry.js"],
     "daemon-call": ["../lib/daemon/protocol.js"],
     daemon: [
@@ -200,6 +200,7 @@ const LOADERS = {
     ],
     childWrapper: [
         () => import("../main.js"),
+        () => import("../lib/service-manager/startup-migration.js"),
     ],
     coreJobRun: [
         () => import("../lib/flag-registry.js"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.50",
+  "version": "5.345.51",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {