@indigoai-us/hq-cli 5.345.50 → 5.345.52

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -100,6 +100,7 @@ export declare function buildOutpostLaneListCommand(input?: {
     laneUlids?: readonly string[];
     active?: boolean;
     hierarchy?: string | readonly string[];
+    senior?: string;
     snapshot?: boolean;
 }): string;
 /**

package/dist/lib/lanes/outpost-dispatch.js

@@ -93,6 +93,8 @@ export function buildOutpostLaneListCommand(input = {}) {
         ? [input.hierarchy]
         : input.hierarchy ?? [])
         args.push("--hierarchy", laneId);
+    if (input.senior !== undefined)
+        args.push("--senior", input.senior);
     if (input.snapshot)
         args.push("--snapshot");
     return withRemoteHqDir(joinCommandParts(args));

package/dist/lib/mesh/live/daemon/install.js

@@ -23,7 +23,7 @@ import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqR
 import { defaultPidLockDeps, pidLockStatus, readPidLock } from "./pid-lock.js";
 import { retireLegacyListen } from "./legacy-listen.js";
 import { readDaemonState } from "./state.js";
-import { activateLaunchd, defaultRunCommand, launchdIsLoaded, launchdServiceTarget, launchdPlistProgramArguments, launchdProgramArgumentsDiffer, parseLaunchctlPrintArguments, } from "../../../service-manager/launchd.js";
+import { activateLaunchd, defaultRunCommand, discoverLaunchdIdentity, installLaunchdPlist, launchdProgramArguments, launchdIsLoaded, launchdServiceTarget, launchdPlistProgramArguments, parseLaunchdCommand, launchdProgramArgumentsDiffer, parseLaunchctlPrintArguments, } from "../../../service-manager/launchd.js";
 import { activateSystemd, systemdIsActive } from "../../../service-manager/systemd.js";
 import { nodeBinaryProblem, preferStableNodeBinary } from "../../../node-binary.js";
 /**
@@ -428,9 +428,7 @@ export function installedDaemonNodeBinary(paths, platform, readUnit = (file) =>
         const text = readUnit(paths.plistPath);
         if (!text)
             return null;
-        const block = text.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
-        const first = block?.[1]?.match(/<string>([^<]*)<\/string>/);
-        return first?.[1] ?? null;
+        return parseLaunchdCommand(launchdPlistProgramArguments(text))?.node ?? null;
     }
     if (platform === "linux") {
         const text = readUnit(paths.systemdUnitPath);
@@ -544,19 +542,21 @@ function safeUsername() {
     }
 }
 export function renderLaunchdPlist(paths) {
+    const identity = discoverLaunchdIdentity(paths.home);
+    const args = launchdProgramArguments({
+        nodeBinary: paths.nodeBinary,
+        hqBinary: paths.hqBinary,
+        launchdLauncherBinary: identity.launcherBinary,
+    }, ["mesh", "daemon", "run"]);
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
   <string>${LAUNCHD_LABEL}</string>
-  <key>ProgramArguments</key>
+${identity.associatedBundleIdentifier ? `  <key>AssociatedBundleIdentifiers</key>\n  <array>\n    <string>${escapeXml(identity.associatedBundleIdentifier)}</string>\n  </array>\n` : ""}  <key>ProgramArguments</key>
   <array>
-    <string>${escapeXml(paths.nodeBinary)}</string>
-    <string>${escapeXml(paths.hqBinary)}</string>
-    <string>mesh</string>
-    <string>daemon</string>
-    <string>run</string>
+${args.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n")}
   </array>
   <key>WorkingDirectory</key>
   <string>${escapeXml(paths.daemonDir)}</string>
@@ -920,11 +920,24 @@ export function installDaemonService(opts) {
     if (platform === "darwin") {
         const rendered = renderLaunchdPlist(paths);
         mkdirSync(paths.launchAgentsDir, { recursive: true });
-        replaceUnitFile(paths.plistPath, rendered, 0o600, () => {
-            if (opts.run)
-                activateLaunchd(paths.plistPath, opts.run, opts.uid, { sleep: opts.sleep });
-            else
-                opts.activate?.(platform, paths.plistPath);
+        installLaunchdPlist(paths.plistPath, LAUNCHD_LABEL, rendered, {
+            files: {
+                existsSync: fs.existsSync,
+                readFileSync: (file) => fs.readFileSync(file, "utf8"),
+                writeFileSync: fs.writeFileSync,
+                chmodSync: fs.chmodSync,
+                renameSync: fs.renameSync,
+                unlinkSync: fs.unlinkSync,
+            },
+            activate: Boolean(opts.run || opts.activate),
+            uid: opts.uid,
+            rollbackOnReloadError: true,
+            reload: () => {
+                if (opts.run)
+                    activateLaunchd(paths.plistPath, opts.run, opts.uid, { sleep: opts.sleep });
+                else if (opts.activate)
+                    opts.activate(platform, paths.plistPath);
+            },
         });
         return {
             platform,

package/dist/lib/service-manager/index.d.ts

@@ -15,9 +15,12 @@ export interface ServiceManagerDeps {
     platform?: ServicePlatform;
     run?: RunCommand;
     writeFileSync?: typeof fs.writeFileSync;
+    chmodSync?: typeof fs.chmodSync;
+    renameSync?: typeof fs.renameSync;
     mkdirSync?: typeof fs.mkdirSync;
     unlinkSync?: typeof fs.unlinkSync;
     existsSync?: typeof fs.existsSync;
+    readFileSync?: typeof fs.readFileSync;
     /** When false, render + write units but do not (de)activate them. */
     activate?: boolean;
 }

package/dist/lib/service-manager/index.js

@@ -5,7 +5,7 @@
  * without touching the host's service manager.
  */
 import * as fs from "node:fs";
-import { activateLaunchd, deactivateLaunchd, defaultRunCommand, launchAgentsDir, launchdIsLoaded, launchdPlistPath, renderLaunchdPlist, } from "./launchd.js";
+import { deactivateLaunchd, defaultRunCommand, launchAgentsDir, launchdIsLoaded, launchdPlistPath, installLaunchdPlist, renderLaunchdPlist, } from "./launchd.js";
 import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdIsActive, systemdUnitName, systemdUnitPath, systemdUserDir, } from "./systemd.js";
 import { detectServicePlatform, } from "./types.js";
 export { detectServicePlatform } from "./types.js";
@@ -23,6 +23,11 @@ export function installServices(specs, host, deps = {}) {
     const platform = deps.platform ?? detectServicePlatform();
     const run = deps.run ?? defaultRunCommand;
     const writeFileSync = deps.writeFileSync ?? fs.writeFileSync;
+    const chmodSync = deps.chmodSync ?? fs.chmodSync;
+    const renameSync = deps.renameSync ?? fs.renameSync;
+    const unlinkSync = deps.unlinkSync ?? fs.unlinkSync;
+    const existsSync = deps.existsSync ?? fs.existsSync;
+    const readFileSync = deps.readFileSync ?? fs.readFileSync;
     const mkdirSync = deps.mkdirSync ?? fs.mkdirSync;
     const activate = deps.activate ?? true;
     if (platform === "other") {
@@ -38,14 +43,25 @@ export function installServices(specs, host, deps = {}) {
     for (const spec of specs) {
         const unitPath = unitPathFor(platform, host.home, spec);
         const rendered = renderUnit(platform, spec, host);
-        writeFileSync(unitPath, rendered, { mode: 0o600 });
+        if (platform === "darwin") {
+            const installed = installLaunchdPlist(unitPath, spec.label, rendered, {
+                run,
+                activate,
+                files: { existsSync, readFileSync: (file) => readFileSync(file, "utf8"), writeFileSync, chmodSync, renameSync, unlinkSync },
+            });
+            const unit = { name: spec.name, unitPath, rendered, installed: true };
+            if (activate)
+                unit.running = installed.loaded;
+            units.push(unit);
+            continue;
+        }
+        else {
+            writeFileSync(unitPath, rendered, { mode: 0o600 });
+        }
         const unit = { name: spec.name, unitPath, rendered, installed: true };
         if (activate) {
             try {
-                if (platform === "darwin")
-                    activateLaunchd(unitPath, run);
-                else
-                    activateSystemd(systemdUnitName(spec), run);
+                activateSystemd(systemdUnitName(spec), run);
                 unit.running = true;
             }
             catch (err) {

package/dist/lib/service-manager/launchd.d.ts

@@ -2,11 +2,24 @@
  * macOS LaunchAgent rendering + activation for kit services.
  *
  * Units live at ~/Library/LaunchAgents/<label>.plist. Activation uses the
- * modern `launchctl bootstrap gui/<uid>` form (bootout first so a re-install
- * picks up a changed plist). Command execution is injected so tests never
- * touch launchctl.
+ * modern `launchctl bootstrap gui/<uid>` form only after a serialized plist
+ * changes. Command execution is injected so tests never touch launchctl.
  */
+import * as fs from "node:fs";
 import { type ServiceHostPaths, type ServiceSpec } from "./types.js";
+export interface LaunchdIdentity {
+    launcherBinary?: string;
+    associatedBundleIdentifier?: string;
+}
+/** Find the installed HQ bundle and read its identity from the generated plist. */
+export declare function discoverLaunchdIdentity(home: string, io?: Pick<typeof fs, "existsSync" | "readFileSync">): LaunchdIdentity;
+export declare function launchdProgramArguments(host: Pick<ServiceHostPaths, "nodeBinary" | "hqBinary" | "launchdLauncherBinary">, args: string[]): string[];
+export declare function parseLaunchdCommand(args: string[]): {
+    node: string;
+    hq: string;
+    args: string[];
+} | null;
+export declare function launchdIdentityForHome(home: string): LaunchdIdentity;
 export declare function launchAgentsDir(home: string): string;
 export declare function launchdPlistPath(home: string, spec: Pick<ServiceSpec, "label">): string;
 export declare function renderLaunchdPlist(spec: ServiceSpec, host: ServiceHostPaths): string;
@@ -16,6 +29,30 @@ export type RunCommand = (cmd: string, args: string[]) => {
     stderr: string;
 };
 export type SleepFn = (ms: number) => void;
+export interface LaunchdPlistFiles {
+    existsSync(file: string): boolean;
+    readFileSync(file: string, encoding: "utf8"): string;
+    writeFileSync(file: string, contents: string, options?: {
+        mode?: number;
+    }): unknown;
+    chmodSync?(file: string, mode: number): unknown;
+    unlinkSync?(file: string): unknown;
+    renameSync?(from: string, to: string): unknown;
+}
+/** Write and activate a LaunchAgent only when its serialized plist changes. */
+export declare function installLaunchdPlist(plistPath: string, _label: string, rendered: string, deps: {
+    files: LaunchdPlistFiles;
+    run?: RunCommand;
+    uid?: number;
+    activate?: boolean;
+    reload?: () => unknown;
+    isLoaded?: () => boolean;
+    sleep?: SleepFn;
+    rollbackOnReloadError?: boolean;
+}): {
+    changed: boolean;
+    loaded: boolean;
+};
 /** How long to wait for a booted-out job to leave launchd before bootstrapping anyway. */
 export declare const LAUNCHD_UNLOAD_DEADLINE_MS = 10000;
 /** Interval between `launchctl print` polls while the old job unloads. */

package/dist/lib/service-manager/launchd.js

@@ -2,15 +2,55 @@
  * macOS LaunchAgent rendering + activation for kit services.
  *
  * Units live at ~/Library/LaunchAgents/<label>.plist. Activation uses the
- * modern `launchctl bootstrap gui/<uid>` form (bootout first so a re-install
- * picks up a changed plist). Command execution is injected so tests never
- * touch launchctl.
+ * modern `launchctl bootstrap gui/<uid>` form only after a serialized plist
+ * changes. Command execution is injected so tests never touch launchctl.
  */
 import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { escapeXml, } from "./types.js";
 const LAUNCHD_PATH_ENV = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin";
+const HQ_TASK_ARGUMENT = "--hq-launchd-task";
+/** Find the installed HQ bundle and read its identity from the generated plist. */
+export function discoverLaunchdIdentity(home, io = fs) {
+    const bundles = ["/Applications/HQ.app", path.join(home, "Applications", "HQ.app")];
+    for (const bundle of bundles) {
+        const infoPath = path.join(bundle, "Contents", "Info.plist");
+        const executable = path.join(bundle, "Contents", "MacOS", "hq-sync-menubar");
+        if (!io.existsSync(infoPath))
+            continue;
+        const xml = io.readFileSync(infoPath, "utf8");
+        const identifier = /<key>CFBundleIdentifier<\/key>\s*<string>([^<]+)<\/string>/.exec(xml)?.[1];
+        const version = /<key>HQLaunchdTaskVersion<\/key>\s*<integer>(\d+)<\/integer>/.exec(xml)?.[1];
+        if (!identifier)
+            throw new Error(`HQ.app Info.plist has no CFBundleIdentifier: ${infoPath}`);
+        if (version === "1" && !io.existsSync(executable)) {
+            throw new Error(`HQ.app advertises LaunchAgent launcher protocol 1 but its executable is missing: ${executable}`);
+        }
+        return {
+            associatedBundleIdentifier: identifier,
+            ...(version === "1" ? { launcherBinary: executable } : {}),
+        };
+    }
+    return {};
+}
+export function launchdProgramArguments(host, args) {
+    return host.launchdLauncherBinary
+        ? [host.launchdLauncherBinary, HQ_TASK_ARGUMENT, host.nodeBinary, host.hqBinary, ...args]
+        : [host.nodeBinary, host.hqBinary, ...args];
+}
+export function parseLaunchdCommand(args) {
+    const offset = args[1] === HQ_TASK_ARGUMENT ? 2 : 0;
+    const node = args[offset];
+    const hq = args[offset + 1];
+    if (!node || !hq)
+        return null;
+    return { node, hq, args: args.slice(offset + 2) };
+}
+export function launchdIdentityForHome(home) {
+    return discoverLaunchdIdentity(home);
+}
 export function launchAgentsDir(home) {
     return path.join(home, "Library", "LaunchAgents");
 }
@@ -18,7 +58,10 @@ export function launchdPlistPath(home, spec) {
     return path.join(launchAgentsDir(home), `${spec.label}.plist`);
 }
 export function renderLaunchdPlist(spec, host) {
-    const args = [host.nodeBinary, host.hqBinary, ...spec.args]
+    const discovered = discoverLaunchdIdentity(host.home);
+    const associatedBundleIdentifier = host.associatedBundleIdentifier ?? discovered.associatedBundleIdentifier;
+    const launcherBinary = host.launchdLauncherBinary ?? discovered.launcherBinary;
+    const args = launchdProgramArguments({ ...host, launchdLauncherBinary: launcherBinary }, spec.args)
         .map((a) => `    <string>${escapeXml(a)}</string>`)
         .join("\n");
     const env = {
@@ -36,7 +79,7 @@ export function renderLaunchdPlist(spec, host) {
 <dict>
   <key>Label</key>
   <string>${escapeXml(spec.label)}</string>
-  <key>ProgramArguments</key>
+${associatedBundleIdentifier ? `  <key>AssociatedBundleIdentifiers</key>\n  <array>\n    <string>${escapeXml(associatedBundleIdentifier)}</string>\n  </array>\n` : ""}  <key>ProgramArguments</key>
   <array>
 ${args}
   </array>
@@ -60,6 +103,64 @@ ${envXml}
 </plist>
 `;
 }
+/** Write and activate a LaunchAgent only when its serialized plist changes. */
+export function installLaunchdPlist(plistPath, _label, rendered, deps) {
+    const { files } = deps;
+    const current = files.existsSync(plistPath) ? files.readFileSync(plistPath, "utf8") : null;
+    const isLoaded = () => deps.isLoaded?.() ?? (deps.run ? launchdIsLoaded(_label, deps.run, deps.uid) : false);
+    if (current === rendered) {
+        if (deps.activate === false)
+            return { changed: false, loaded: false };
+        if (isLoaded())
+            return { changed: false, loaded: true };
+        if (deps.reload)
+            deps.reload();
+        else if (deps.run)
+            activateLaunchd(plistPath, deps.run, deps.uid, { sleep: deps.sleep });
+        return { changed: false, loaded: isLoaded() };
+    }
+    const write = (contents) => {
+        if (!files.renameSync) {
+            files.writeFileSync(plistPath, contents, { mode: 0o600 });
+            files.chmodSync?.(plistPath, 0o600);
+            return;
+        }
+        const tempPath = `${plistPath}.${process.pid}.tmp`;
+        try {
+            files.writeFileSync(tempPath, contents, { mode: 0o600 });
+            files.chmodSync?.(tempPath, 0o600);
+            files.renameSync(tempPath, plistPath);
+        }
+        catch (error) {
+            try {
+                files.unlinkSync?.(tempPath);
+            }
+            catch (cleanupError) {
+                throw new AggregateError([error, cleanupError], `Could not clean temporary LaunchAgent plist ${tempPath}`);
+            }
+            throw error;
+        }
+    };
+    write(rendered);
+    if (deps.activate === false)
+        return { changed: true, loaded: false };
+    try {
+        if (deps.reload)
+            deps.reload();
+        else if (deps.run)
+            activateLaunchd(plistPath, deps.run, deps.uid, { sleep: deps.sleep });
+    }
+    catch (error) {
+        if (deps.rollbackOnReloadError) {
+            if (current === null)
+                files.unlinkSync?.(plistPath);
+            else
+                write(current);
+        }
+        throw error;
+    }
+    return { changed: true, loaded: isLoaded() };
+}
 /** How long to wait for a booted-out job to leave launchd before bootstrapping anyway. */
 export const LAUNCHD_UNLOAD_DEADLINE_MS = 10_000;
 /** Interval between `launchctl print` polls while the old job unloads. */

package/dist/lib/service-manager/migration-state.d.ts

@@ -0,0 +1,12 @@
+export declare const LAUNCHD_MIGRATION_MARKER = ".launchd-node-migration-v1";
+export declare const DEFERRED_MIGRATION_RETRY_MS: number;
+export interface LaunchdMigrationMarker {
+    version: 1;
+    checkedAt: string;
+    deferredLabels: string[];
+}
+export declare function launchdMigrationMarkerPath(home: string): string;
+/** Old timestamp-only markers mean the previous migration completed successfully. */
+export declare function shouldRunLaunchdMigration(home: string, now?: number): boolean;
+export declare function writeLaunchdMigrationMarker(home: string, deferredLabels: string[], now?: number): void;
+//# sourceMappingURL=migration-state.d.ts.map

package/dist/lib/service-manager/migration-state.js

@@ -0,0 +1,46 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const LAUNCHD_MIGRATION_MARKER = ".launchd-node-migration-v1";
+export const DEFERRED_MIGRATION_RETRY_MS = 24 * 60 * 60 * 1000;
+export function launchdMigrationMarkerPath(home) {
+    return path.join(home, "Library", "Application Support", "Indigo HQ", LAUNCHD_MIGRATION_MARKER);
+}
+/** Old timestamp-only markers mean the previous migration completed successfully. */
+export function shouldRunLaunchdMigration(home, now = Date.now()) {
+    const marker = launchdMigrationMarkerPath(home);
+    if (!fs.existsSync(marker))
+        return true;
+    try {
+        const raw = fs.readFileSync(marker, "utf8");
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return Number.isNaN(Date.parse(raw.trim()));
+        }
+        if (!parsed || typeof parsed !== "object")
+            return true;
+        const state = parsed;
+        if (state.version !== 1 || typeof state.checkedAt !== "string")
+            return true;
+        if (!Array.isArray(state.deferredLabels) || state.deferredLabels.length === 0)
+            return false;
+        const checkedAt = Date.parse(state.checkedAt);
+        return !Number.isFinite(checkedAt) || now - checkedAt >= DEFERRED_MIGRATION_RETRY_MS;
+    }
+    catch {
+        return true;
+    }
+}
+export function writeLaunchdMigrationMarker(home, deferredLabels, now = Date.now()) {
+    const marker = launchdMigrationMarkerPath(home);
+    fs.mkdirSync(path.dirname(marker), { recursive: true, mode: 0o700 });
+    const state = {
+        version: 1,
+        checkedAt: new Date(now).toISOString(),
+        deferredLabels: [...new Set(deferredLabels)].sort(),
+    };
+    fs.writeFileSync(marker, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+}
+//# sourceMappingURL=migration-state.js.map

package/dist/lib/service-manager/migration.d.ts

@@ -0,0 +1,22 @@
+import * as fs from "node:fs";
+import { type RunCommand, type SleepFn } from "./launchd.js";
+export interface LaunchdMigrationOptions {
+    home: string;
+    run: RunCommand;
+    uid: number;
+    launcherBinary?: string;
+    associatedBundleIdentifier?: string;
+    files?: Pick<typeof fs, "existsSync" | "readFileSync" | "writeFileSync" | "renameSync" | "unlinkSync" | "readdirSync" | "mkdirSync">;
+    processArgs?: string[];
+    xpcServiceName?: string;
+    sleep?: SleepFn;
+}
+export interface LaunchdMigrationResult {
+    migrated: string[];
+    backupsRemoved: string[];
+    deferred: string[];
+    alreadyDone: boolean;
+}
+/** First-CLI-run cleanup for HQ's old Node-first LaunchAgents and backup plists. */
+export declare function migrateLegacyNodeLaunchAgents(options: LaunchdMigrationOptions): LaunchdMigrationResult;
+//# sourceMappingURL=migration.d.ts.map

package/dist/lib/service-manager/migration.js

@@ -0,0 +1,85 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { launchAgentsDir, activateLaunchd, launchdPlistProgramArguments, } from "./launchd.js";
+import { isVersionedNodePath, preferStableNodeBinary } from "../node-binary.js";
+import { preferStableHqBinary } from "../mesh/live/daemon/install.js";
+import { launchdMigrationMarkerPath, shouldRunLaunchdMigration, writeLaunchdMigrationMarker } from "./migration-state.js";
+const HQ_LABEL_PREFIXES = ["ai.indigo.hq-", "ai.getindigo.hq-"];
+function xml(value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function plistArgs(args) {
+    return `  <key>ProgramArguments</key>\n  <array>\n${args.map((arg) => `    <string>${xml(arg)}</string>`).join("\n")}\n  </array>`;
+}
+function isNodeProgram(program) {
+    return /(^|[\\/])node(?:\.exe)?$/i.test(program);
+}
+/** First-CLI-run cleanup for HQ's old Node-first LaunchAgents and backup plists. */
+export function migrateLegacyNodeLaunchAgents(options) {
+    const files = options.files ?? fs;
+    const marker = launchdMigrationMarkerPath(options.home);
+    if (files.existsSync(marker) && !shouldRunLaunchdMigration(options.home)) {
+        return { migrated: [], backupsRemoved: [], deferred: [], alreadyDone: true };
+    }
+    const dir = launchAgentsDir(options.home);
+    const migrated = [];
+    const backupsRemoved = [];
+    const deferred = [];
+    if (!files.existsSync(dir))
+        files.mkdirSync(dir, { recursive: true });
+    for (const name of files.readdirSync(dir)) {
+        const fullPath = path.join(dir, name);
+        if (name.startsWith("ai.indigo.") && name.includes(".plist.bak-")) {
+            files.unlinkSync(fullPath);
+            backupsRemoved.push(name);
+            continue;
+        }
+        if (!name.endsWith(".plist") || !HQ_LABEL_PREFIXES.some((prefix) => name.startsWith(prefix)))
+            continue;
+        const source = files.readFileSync(fullPath, "utf8");
+        const args = launchdPlistProgramArguments(source);
+        if (args.length < 2 || !isNodeProgram(args[0]))
+            continue;
+        const label = name.slice(0, -".plist".length);
+        const currentProcessIsJob = options.xpcServiceName === label ||
+            (options.processArgs?.length === args.length && options.processArgs.every((arg, index) => arg === args[index]));
+        if (currentProcessIsJob) {
+            deferred.push(label);
+            continue;
+        }
+        if (!options.launcherBinary) {
+            deferred.push(name.slice(0, -".plist".length));
+            continue;
+        }
+        const nodeBinary = preferStableNodeBinary(args[0]);
+        if (isVersionedNodePath(nodeBinary)) {
+            deferred.push(name.slice(0, -".plist".length));
+            continue;
+        }
+        const hqBinary = preferStableHqBinary(args[1]);
+        const nextArgs = [options.launcherBinary, "--hq-launchd-task", nodeBinary, hqBinary, ...args.slice(2)];
+        const renderedArgs = plistArgs(nextArgs);
+        let updated = source.replace(/<key>ProgramArguments<\/key>\s*<array>[\s\S]*?<\/array>/, renderedArgs);
+        if (options.associatedBundleIdentifier && !/<key>AssociatedBundleIdentifiers<\/key>/.test(updated)) {
+            const attribution = `  <key>AssociatedBundleIdentifiers</key>\n  <array>\n    <string>${xml(options.associatedBundleIdentifier)}</string>\n  </array>\n`;
+            updated = updated.replace(/(<key>Label<\/key>\s*<string>[^<]+<\/string>\s*)/, `$1${attribution}`);
+        }
+        if (updated === source)
+            throw new Error(`Could not safely rewrite ${fullPath}`);
+        const tmp = `${fullPath}.${process.pid}.migration.tmp`;
+        files.writeFileSync(tmp, updated, { mode: 0o600 });
+        files.renameSync(tmp, fullPath);
+        try {
+            activateLaunchd(fullPath, options.run, options.uid, { sleep: options.sleep });
+        }
+        catch (error) {
+            throw new Error(`Could not activate migrated HQ LaunchAgent ${name}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        }
+        migrated.push(label);
+    }
+    // A deferred/self/unsupported item is retried at most daily, rather than
+    // forcing every ordinary CLI invocation to rescan the LaunchAgents folder.
+    writeLaunchdMigrationMarker(options.home, deferred);
+    return { migrated, backupsRemoved, deferred, alreadyDone: false };
+}
+//# sourceMappingURL=migration.js.map

package/dist/lib/service-manager/startup-migration.d.ts

@@ -0,0 +1,24 @@
+import type { RunCommand } from "./launchd.js";
+export interface LaunchdStartupMigrationOptions {
+    home: string;
+    uid: number;
+    run?: RunCommand;
+    processArgs: string[];
+    xpcServiceName?: string;
+}
+export interface LaunchdStartupMigrationDependencies {
+    shouldRun?: (home: string) => boolean | Promise<boolean>;
+    discover?: (home: string) => {
+        launcherBinary?: string;
+        associatedBundleIdentifier?: string;
+    };
+    migrate?: (options: LaunchdStartupMigrationOptions & {
+        launcherBinary?: string;
+        associatedBundleIdentifier?: string;
+    }) => unknown;
+    markDeferred?: (home: string) => void;
+    warn?: (message: string) => void;
+}
+/** Best-effort migration; a compatibility cleanup never blocks the requested command. */
+export declare function runLaunchdMigrationAtStartup(options: LaunchdStartupMigrationOptions, dependencies?: LaunchdStartupMigrationDependencies): Promise<void>;
+//# sourceMappingURL=startup-migration.d.ts.map

package/dist/lib/service-manager/startup-migration.js

@@ -0,0 +1,27 @@
+/** Best-effort migration; a compatibility cleanup never blocks the requested command. */
+export async function runLaunchdMigrationAtStartup(options, dependencies = {}) {
+    try {
+        const state = await import("./migration-state.js");
+        const shouldRun = dependencies.shouldRun ?? state.shouldRunLaunchdMigration;
+        if (!await shouldRun(options.home))
+            return;
+        const launchd = await import("./launchd.js");
+        const migration = await import("./migration.js");
+        const discover = dependencies.discover ?? launchd.discoverLaunchdIdentity;
+        const migrate = dependencies.migrate ?? migration.migrateLegacyNodeLaunchAgents;
+        migrate({ ...options, run: options.run ?? launchd.defaultRunCommand, ...discover(options.home) });
+    }
+    catch {
+        try {
+            if (dependencies.markDeferred)
+                dependencies.markDeferred(options.home);
+            else {
+                const state = await import("./migration-state.js");
+                state.writeLaunchdMigrationMarker(options.home, ["migration-error"]);
+            }
+        }
+        catch { /* Keep the requested command available even if state cannot be saved. */ }
+        (dependencies.warn ?? console.warn)("hq: legacy LaunchAgent migration failed; continuing");
+    }
+}
+//# sourceMappingURL=startup-migration.js.map

package/dist/lib/service-manager/types.d.ts

@@ -26,6 +26,9 @@ export interface ServiceHostPaths {
     home: string;
     nodeBinary: string;
     hqBinary: string;
+    /** Optional signed HQ.app launcher and bundle attribution for macOS. */
+    launchdLauncherBinary?: string;
+    associatedBundleIdentifier?: string;
 }
 export type ServicePlatform = "darwin" | "linux" | "other";
 export declare function detectServicePlatform(platform?: NodeJS.Platform): ServicePlatform;

package/dist/main.js

@@ -166,6 +166,28 @@ program.hook("preAction", async () => {
     });
 });
 export async function runCli() {
+    const xpcServiceName = process.env.XPC_SERVICE_NAME ?? "";
+    const launchedByHqAgent = xpcServiceName.startsWith("ai.indigo.") || xpcServiceName.startsWith("ai.getindigo.");
+    const isDaemonEntryPoint = process.argv[2] === "daemon" && process.argv[3] === "run";
+    const isBotHotPath = process.argv[2] === "bot" && process.argv[3] === "run";
+    if (process.platform === "darwin" && typeof process.getuid === "function" &&
+        !launchedByHqAgent && !isDaemonEntryPoint && !isBotHotPath) {
+        const home = os.homedir();
+        // The startup helper checks its small marker before importing launchd or
+        // inspecting the app bundle. Linux never imports this Darwin-only path.
+        try {
+            const { runLaunchdMigrationAtStartup } = await import("./lib/service-manager/startup-migration.js");
+            await runLaunchdMigrationAtStartup({
+                home,
+                uid: process.getuid(),
+                processArgs: process.argv,
+                xpcServiceName,
+            });
+        }
+        catch {
+            console.warn("hq: legacy LaunchAgent migration failed; continuing");
+        }
+    }
     const foregroundNetworkBudget = createForegroundNetworkBudget();
     activeForegroundNetworkBudget = foregroundNetworkBudget;
     // Login must be usable before any identity or company is available, so do

package/dist/native-fast-route.d.ts

@@ -4,4 +4,8 @@ export declare function nativeFastRouteEnabled(argv: readonly string[], env?: No
 export declare function fastFlagEnabled(flagKey: string, env?: NodeJS.ProcessEnv, options?: {
     numericEnvironmentOverride?: boolean;
 }): Promise<boolean>;
+/** Reads a fail-safe flag that stays enabled unless a fresh value disables it. */
+export declare function fastFlagEnabledDefaultOn(flagKey: string, env?: NodeJS.ProcessEnv, options?: {
+    numericEnvironmentOverride?: boolean;
+}): Promise<boolean>;
 //# sourceMappingURL=native-fast-route.d.ts.map