@indigoai-us/hq-cli 5.345.7 → 5.345.9

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.345.9] — 2026-10-05
+- Lane messages to exited sessions now queue durably when provider admission is busy, so delivery succeeds and reconcile can resume them later.
+- Keep the current sync runner until an hq-cloud version matching the configured pin is available.
+
+## [5.345.8] — 2026-10-05
+- Prioritize due lead keep-alive retries and honor due next-check times ahead of later backoff deadlines behind an hq-flags gate.
+- Drain bot turns before replacing a running bot after a daemon plan change.
+
 ## [5.345.7] — 2026-10-05
 - Retry a just-published hq-cli version when npm briefly reports `notarget`.
 - Wait for an active sync pass to finish before restarting sync after a CLI update.

package/dist/commands/__fixtures__/make-tar.d.ts

@@ -22,7 +22,7 @@
  * lists whatever bytes we wrote, so the guard sees the real attack everywhere.
  */
 /** ustar typeflag values we use. */
-export type TarType = 'file' | 'symlink' | 'hardlink';
+type TarType = 'file' | 'symlink' | 'hardlink';
 export interface TarEntrySpec {
     /** Recorded entry name — written VERBATIM (may contain `..`, be absolute…). */
     name: string;
@@ -32,15 +32,7 @@ export interface TarEntrySpec {
     /** File content (regular files only). */
     content?: string | Buffer;
 }
-/**
- * Build one 512-byte ustar header (plus content blocks for regular files) for a
- * single entry. The header checksum is computed exactly per spec: sum every
- * header byte treating the 8 checksum bytes themselves as ASCII spaces, then
- * write that sum as 6 octal digits + NUL + space.
- */
-export declare function makeTarEntry(spec: TarEntrySpec): Buffer;
-/** Concatenate entries and append the two zero blocks that end every tar. */
-export declare function makeTar(entries: TarEntrySpec[]): Buffer;
 /** Build the tar, gzip it, and write it to `outPath`. Returns `outPath`. */
 export declare function writeMaliciousTarGz(outPath: string, entries: TarEntrySpec[]): string;
+export {};
 //# sourceMappingURL=make-tar.d.ts.map

package/dist/commands/__fixtures__/make-tar.js

@@ -50,7 +50,7 @@ function writeOctal(buf, offset, width, value) {
  * header byte treating the 8 checksum bytes themselves as ASCII spaces, then
  * write that sum as 6 octal digits + NUL + space.
  */
-export function makeTarEntry(spec) {
+function makeTarEntry(spec) {
     const type = spec.type ?? 'file';
     const content = type === 'file'
         ? Buffer.isBuffer(spec.content)
@@ -89,7 +89,7 @@ export function makeTarEntry(spec) {
     return Buffer.concat([header, content, Buffer.alloc(pad)]);
 }
 /** Concatenate entries and append the two zero blocks that end every tar. */
-export function makeTar(entries) {
+function makeTar(entries) {
     const blocks = entries.map(makeTarEntry);
     blocks.push(Buffer.alloc(BLOCK * 2)); // end-of-archive marker
     return Buffer.concat(blocks);

package/dist/commands/agent-enroll.d.ts

@@ -17,18 +17,16 @@
 import { Command } from "commander";
 import { generateHostKeyPair } from "../lib/agent-kit/creds.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
-export declare const ENROLL_PATH = "/v1/agents/enroll";
 /** Canonical code: un-grouped, uppercase (server hashes exactly this). */
 export declare function normalizeEnrollmentCode(raw: string): string;
 /** 24 chars of Crockford base32 (no I, L, O, U). */
 export declare function isWellFormedEnrollmentCode(code: string): boolean;
-export interface HostInfo {
+interface HostInfo {
     os: string;
     arch: string;
     hostname: string;
     cliVersion: string;
 }
-export declare function collectHostInfo(): HostInfo;
 export type ExistingIdentity = {
     kind: "none";
 } | {
@@ -143,4 +141,5 @@ export interface EnrollResult {
 /** Pure-ish orchestration so tests can drive it without a TTY or network. */
 export declare function enrollHost(opts: EnrollOptions, deps?: EnrollDeps): Promise<EnrollResult>;
 export declare function registerAgentEnrollCommand(agent: Command): void;
+export {};
 //# sourceMappingURL=agent-enroll.d.ts.map

package/dist/commands/agent-enroll.js

@@ -25,7 +25,7 @@ import { networkTransportErrorCode } from "../utils/network-transport-error.js";
 import { canOfferTeamUpgrade, formatUpgradeRefusal, isPlanGateError, offerUpgradeLink, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
 import { generateHostKeyPair, machineCredsFileExists, readExternalMachineCreds, writeHostKeyPair, writeMachineCreds, } from "../lib/agent-kit/creds.js";
 import { DEFAULT_LOCAL_AGENT_NAME, agentKitPaths, localAgentDir, } from "../lib/agent-kit/paths.js";
-export const ENROLL_PATH = "/v1/agents/enroll";
+const ENROLL_PATH = "/v1/agents/enroll";
 /** Canonical code: un-grouped, uppercase (server hashes exactly this). */
 export function normalizeEnrollmentCode(raw) {
     return raw.replace(/[\s-]+/g, "").toUpperCase();
@@ -34,7 +34,7 @@ export function normalizeEnrollmentCode(raw) {
 export function isWellFormedEnrollmentCode(code) {
     return /^[0-9A-HJKMNP-TV-Z]{24}$/.test(code);
 }
-export function collectHostInfo() {
+function collectHostInfo() {
     return {
         os: `${os.platform()} ${os.release()}`,
         arch: os.arch(),

package/dist/commands/lanes-message.js

@@ -754,6 +754,59 @@ export function createLaneMessageHandlers(deps) {
                     ...(keepCurrentAccount && opts.model !== undefined ? { cliModel: opts.model } : {}),
                 });
             }
+            const queueResumeMessage = (queuedReason, archiveBeforeWrite) => {
+                const sessionId = lane.provider_session_id;
+                if (!sessionId) {
+                    throw new LanesError("no_provider_session", `Lane ${laneId} has no provider session id to queue this message`, {
+                        lane_id: laneId,
+                        provider: lane.provider,
+                    });
+                }
+                if (archiveBeforeWrite)
+                    archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+                const queued = casUpdateLane(hqRoot, laneId, (current) => {
+                    if (current.version !== lane.version ||
+                        current.state !== lane.state ||
+                        current.provider_session_id !== sessionId) {
+                        throw new LanesError("lane_admission_conflict", `Lane ${laneId} changed while its message was queued`, {
+                            lane_id: laneId,
+                            prepared_version: lane.version,
+                            version: current.version,
+                            state: current.state,
+                        });
+                    }
+                    return {
+                        ...current,
+                        state: "queued",
+                        queued_reason: queuedReason,
+                        queued_details: undefined,
+                        queued_at: at,
+                        admission_reserved_at: undefined,
+                        pending_resume: {
+                            session_id: sessionId,
+                            trigger: messageHistoryTrigger,
+                            caller: ctx.env.HQ_LANE_ID?.trim() || "user",
+                            text: deliveryText,
+                            ...(isMonitorEvent ? { monitor_event: true } : {}),
+                            message_id: messageId,
+                            compact: opts.compact !== false,
+                            at,
+                        },
+                    };
+                });
+                queuedOnAdmission = true;
+                storySwitchDeliveryStarted = true;
+                deps.onLaneMessageQueued?.(laneId, "admission");
+                if (!archiveBeforeWrite) {
+                    try {
+                        archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+                    }
+                    catch (archiveError) {
+                        process.stderr.write(`Could not write the resume message audit copy for ${laneId}: ${archiveError instanceof Error ? archiveError.message : String(archiveError)}\n`);
+                    }
+                }
+                return queued;
+            };
             let questionCancellation = null;
             if (move?.queued || queuedOnQuotaHold) {
                 // Parked at the target's cap: reconcile resumes the session there.
@@ -777,84 +830,56 @@ export function createLaneMessageHandlers(deps) {
                         // Exited worker with a recorded session: queue the message when capacity
                         // is occupied, otherwise start its next turn under the shared admission lock.
                         assertLaneRunsHereForAdmission(ctx, lane);
-                        return withLaneAdmissionLock(hqRoot, lane.provider, async () => {
-                            const admission = await assessLaneAdmission(ctx, lane, { queueAt: at });
-                            if (admission.action === "refuse" && admission.error)
-                                throw admission.error;
-                            return withResumeHireAdmission(ctx, lane, () => {
-                                if (admission.action === "queue") {
-                                    const sessionId = lane.provider_session_id;
-                                    if (!sessionId) {
-                                        throw new LanesError("no_provider_session", `Lane ${laneId} has no provider session id to queue this message resume`, {
-                                            lane_id: laneId,
-                                            provider: lane.provider,
-                                        });
+                        try {
+                            return await withLaneAdmissionLock(hqRoot, lane.provider, async () => {
+                                const admission = await assessLaneAdmission(ctx, lane, { queueAt: at });
+                                if (admission.action === "refuse" && admission.error)
+                                    throw admission.error;
+                                return withResumeHireAdmission(ctx, lane, () => {
+                                    if (admission.action === "queue") {
+                                        return queueResumeMessage(admission.reason ?? "throttle", true);
                                     }
-                                    archiveResumeMessage(hqRoot, laneId, dropboxMessage);
-                                    queuedOnAdmission = true;
-                                    const queued = casUpdateLane(hqRoot, laneId, (current) => {
-                                        if (current.version !== lane.version || current.state !== lane.state) {
-                                            throw new LanesError("lane_admission_conflict", `Lane ${laneId} changed while message admission was checked`, {
-                                                lane_id: laneId,
-                                                prepared_version: lane.version,
-                                                version: current.version,
-                                                state: current.state,
-                                            });
-                                        }
-                                        return {
-                                            ...current,
-                                            state: "queued",
-                                            queued_reason: admission.reason ?? "throttle",
-                                            queued_details: undefined,
-                                            queued_at: at,
-                                            pending_resume: {
-                                                session_id: sessionId,
-                                                trigger: messageHistoryTrigger,
-                                                caller: ctx.env.HQ_LANE_ID?.trim() || "user",
-                                                text: deliveryText,
-                                                ...(isMonitorEvent ? { monitor_event: true } : {}),
-                                                message_id: messageId,
-                                                compact: opts.compact !== false,
-                                                at,
-                                            },
-                                        };
+                                    const started = spawnLaneWorker(hqRoot, lane, {
+                                        env: ctx.env,
+                                        modelDeps: {
+                                            readFileSync: ctx.readFileSync,
+                                            probe: ctx.probeProvider,
+                                            env: ctx.env,
+                                        },
+                                        existsSync: ctx.existsSync,
+                                        spawnProcess: ctx.spawnProcess,
+                                        proveDetached: ctx.proveDetached,
+                                        killProcess: ctx.killProcess,
+                                        now: ctx.now,
+                                        resolveMachineIdentity: ctx.resolveMachineIdentity,
+                                        runCompaction: ctx.runCompaction,
+                                        locateTranscript: ctx.locateTranscript,
+                                    }, {
+                                        trigger: {
+                                            kind: "message",
+                                            text: deliveryText,
+                                            message_id: messageId,
+                                            ...(isMonitorEvent ? { monitor_event: true } : {}),
+                                            ...(isSystemNotice ? { system_notice: true } : {}),
+                                        },
+                                        compact: opts.compact !== false,
+                                        effort: resumeEffort ?? recordedResumeEffort(lane),
                                     });
                                     storySwitchDeliveryStarted = true;
-                                    deps.onLaneMessageQueued?.(laneId, "admission");
-                                    return queued;
-                                }
-                                const started = spawnLaneWorker(hqRoot, lane, {
-                                    env: ctx.env,
-                                    modelDeps: {
-                                        readFileSync: ctx.readFileSync,
-                                        probe: ctx.probeProvider,
-                                        env: ctx.env,
-                                    },
-                                    existsSync: ctx.existsSync,
-                                    spawnProcess: ctx.spawnProcess,
-                                    proveDetached: ctx.proveDetached,
-                                    killProcess: ctx.killProcess,
-                                    now: ctx.now,
-                                    resolveMachineIdentity: ctx.resolveMachineIdentity,
-                                    runCompaction: ctx.runCompaction,
-                                    locateTranscript: ctx.locateTranscript,
-                                }, {
-                                    trigger: {
-                                        kind: "message",
-                                        text: deliveryText,
-                                        message_id: messageId,
-                                        ...(isMonitorEvent ? { monitor_event: true } : {}),
-                                        ...(isSystemNotice ? { system_notice: true } : {}),
-                                    },
-                                    compact: opts.compact !== false,
-                                    effort: resumeEffort ?? recordedResumeEffort(lane),
-                                });
-                                storySwitchDeliveryStarted = true;
-                                deps.onLaneWorkerStarted?.(laneId, "message");
-                                archiveResumeMessage(hqRoot, laneId, dropboxMessage);
-                                return started;
-                            }, hireGrantContext);
-                        }, ctx.sleep);
+                                    deps.onLaneWorkerStarted?.(laneId, "message");
+                                    archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+                                    return started;
+                                }, hireGrantContext);
+                            }, ctx.sleep);
+                        }
+                        catch (error) {
+                            const expectedLockPath = path.join(hqRoot, "workspace", "lanes-runs", ".admission-locks", `${lane.provider}-provider.lock`);
+                            if (!(error instanceof LanesError) ||
+                                error.error !== "store_lock_timeout" ||
+                                error.details.path !== expectedLockPath)
+                                throw error;
+                            return queueResumeMessage(undefined, false);
+                        }
                     },
                 }, mechanism);
                 if (dispatched.mechanism === "resume")

package/dist/commands/mcp-status.d.ts

@@ -1,7 +1,7 @@
 import { Command } from 'commander';
 import { type SafeWriteEnv } from './mcp-registration.js';
 /** A server's presence on ONE runtime surface. */
-export type PresenceState = 
+type PresenceState = 
 /** The server def is present (and parsed) on this runtime. */
 'present'
 /** The runtime parsed fine but this server is not registered there. */
@@ -30,7 +30,7 @@ export interface RuntimeServerStatus {
     healthy?: boolean;
 }
 /** A single HQ-owned MCP server's cross-runtime status. */
-export interface McpServerStatus {
+interface McpServerStatus {
     /** The bare server name (the `mcpServers` / `mcp_servers` key). */
     server: string;
     /** The pack that owns it (`_hqPack` provenance). */
@@ -59,7 +59,7 @@ export interface McpServerStatus {
     drifted: boolean;
 }
 /** A runtime's top-level status. */
-export interface RuntimeStatus {
+interface RuntimeStatus {
     /** Whether the runtime is installed (Claude is always; Codex iff `~/.codex` exists). */
     installed: boolean;
     /** Whether the runtime's config parsed (false => unparseable). */
@@ -133,4 +133,5 @@ export declare function renderMcpCapabilities(caps: McpCapabilities): string;
  * {@link registerReindexCommand} and the subcommand-group pattern in index.ts.
  */
 export declare function registerMcpCommand(program: Command): void;
+export {};
 //# sourceMappingURL=mcp-status.d.ts.map

package/dist/commands/reindex.d.ts

@@ -5,12 +5,6 @@ import { Command } from 'commander';
  * layout scan and Git's status output rather than recursively walking trees.
  */
 export declare function removeStaleHqWorktrees(hqRoot: string, now?: number, deadline?: number): void;
-/**
- * Check hook health without relying on lifecycle hooks. A fully disabled
- * configuration is repaired only after a successful reindex; partial and
- * malformed configurations remain untouched and receive recovery guidance.
- */
-export declare function repairExtremeHookDrift(hqRoot: string, allowRepair?: boolean): void;
 /**
  * Stop the generated project settings from silently downgrading an operator who
  * chose Bypass mode globally.

package/dist/commands/reindex.js

@@ -491,7 +491,7 @@ function runSilently(operation) {
  * configuration is repaired only after a successful reindex; partial and
  * malformed configurations remain untouched and receive recovery guidance.
  */
-export function repairExtremeHookDrift(hqRoot, allowRepair = true) {
+function repairExtremeHookDrift(hqRoot, allowRepair = true) {
     // `hq reindex` can still be invoked from an arbitrary directory. Never turn
     // an absent settings file there into a rescue attempt.
     if (!isHqRoot(hqRoot))

package/dist/commands/safe-extract.d.ts

@@ -45,7 +45,7 @@ export declare const DEFAULT_CAPS: ExtractCaps;
 export declare class UnsafeArchiveError extends Error {
     constructor(message: string);
 }
-export type EntryType = 'file' | 'dir' | 'symlink' | 'hardlink' | 'other';
+type EntryType = 'file' | 'dir' | 'symlink' | 'hardlink' | 'other';
 export interface TarEntry {
     type: EntryType;
     /** Entry path as recorded in the archive (may contain `..`, be absolute…). */
@@ -108,14 +108,6 @@ export declare function resolveContainedPath(targetDir: string, entryName: strin
  * way the final location must be contained in the pack dir.
  */
 export declare function assertLinkTargetContained(packDir: string, entryAbs: string, linkTarget: string): void;
-/**
- * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
- * argv form, never a shell string, keeps hostile filenames out of shell syntax.
- * Windows drive paths always use a basename relative to the archive directory.
- * GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows' bundled
- * bsdtar accepts the same relative argv without GNU-only `--force-local`.
- */
-export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtractOptions, 'platform' | 'execFileSync'>): TarEntry[];
 /**
  * Pre-flight validation against the entry headers. Enforces (a) containment of
  * every entry name under `targetDir`, (b) containment of every link target
@@ -123,14 +115,6 @@ export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtract
  * UnsafeArchiveError on the first violation — default-deny.
  */
 export declare function validateEntries(entries: TarEntry[], targetDir: string, caps?: ExtractCaps): void;
-/**
- * Walk everything actually written under `stagingDir` and assert that no entry
- * — and, for symlinks, no link target — escapes. This is the defense-in-depth
- * backstop: it does not trust the pre-flight scan OR the tar binary. Uses
- * realpath on the link's PARENT (which exists) plus lstat to inspect links
- * without following them off-tree.
- */
-export declare function assertExtractContained(stagingDir: string): void;
 export interface SafeExtractOptions {
     caps?: ExtractCaps;
     /** Test seam for platform-specific argv construction. */
@@ -158,4 +142,5 @@ export interface SafeExtractOptions {
  * so a half-extracted pack can never be wired.
  */
 export declare function safeExtractTarball(tarballPath: string, finalDir: string, opts?: SafeExtractOptions): void;
+export {};
 //# sourceMappingURL=safe-extract.d.ts.map

package/dist/commands/safe-extract.js

@@ -219,7 +219,7 @@ function tarballArgvLocation(tarballPath, platform) {
  * GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows' bundled
  * bsdtar accepts the same relative argv without GNU-only `--force-local`.
  */
-export function listTarball(tarballPath, opts = {}) {
+function listTarball(tarballPath, opts = {}) {
     const platform = opts.platform ?? process.platform;
     const location = tarballArgvLocation(tarballPath, platform);
     const out = (opts.execFileSync ?? execFileSync)('tar', ['-tvf', location.archiveArg], {
@@ -277,7 +277,7 @@ export function validateEntries(entries, targetDir, caps = DEFAULT_CAPS) {
  * realpath on the link's PARENT (which exists) plus lstat to inspect links
  * without following them off-tree.
  */
-export function assertExtractContained(stagingDir) {
+function assertExtractContained(stagingDir) {
     const realRoot = fs.realpathSync(stagingDir);
     const walk = (dir) => {
         for (const dirent of fs.readdirSync(dir, { withFileTypes: true })) {

package/dist/commands/search.d.ts

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-export type SearchMode = 'keyword' | 'semantic' | 'hybrid';
+type SearchMode = 'keyword' | 'semantic' | 'hybrid';
 export type SearchOptions = {
     mode?: SearchMode;
     collection?: string;
@@ -32,4 +32,5 @@ export declare function normalizeQueryForQmd(query: string): string;
 export declare function buildSearchArgs(query: string, options?: SearchOptions): string[];
 export declare function buildGetArgs(document: string, options?: Pick<SearchOptions, 'collection'>): string[];
 export declare function registerSearchCommand(program: Command): void;
+export {};
 //# sourceMappingURL=search.d.ts.map

package/dist/lazy-commands.d.ts

@@ -5,12 +5,6 @@ export type LazyCommand = {
     /** Registers every contributor for this root and no unrelated root. */
     register: (program: Command) => Promise<void>;
 };
-/**
- * One entry for every root, including groups that are assembled by several
- * registrar modules. The routing metadata itself is generated from the eager
- * command graph and checked in tests and the build.
- */
-export declare const LAZY_COMMANDS: readonly LazyCommand[];
 /**
  * Keep the registration seam at register-all.js. Besides making one place own
  * the graph, this lets the torn-install recovery wrap failures while an update

package/dist/lazy-commands.js

@@ -9,7 +9,7 @@ const commandCatalog = COMMAND_CATALOG;
  * registrar modules. The routing metadata itself is generated from the eager
  * command graph and checked in tests and the build.
  */
-export const LAZY_COMMANDS = commandCatalog.map((command) => ({
+const LAZY_COMMANDS = commandCatalog.map((command) => ({
     name: command.name,
     register: async (program) => {
         const registered = await registerCommandRoot(program, command.name);

package/dist/lib/daemon/heartbeat.d.ts

@@ -5,9 +5,7 @@
  * from a stale one offline. A device with no beat for 5 minutes is
  * "daemon stale".
  */
-export declare const HEARTBEAT_INTERVAL_MS = 60000;
 export declare const HEARTBEAT_STALE_MS: number;
-export declare const HEARTBEAT_FILE = "hqd-heartbeat.json";
 export declare const DAEMON_STALE_LABEL = "daemon stale";
 export interface HeartbeatState {
     at: string;
@@ -16,8 +14,6 @@ export interface HeartbeatState {
     device: string;
 }
 export declare function heartbeatFile(home?: string, env?: NodeJS.ProcessEnv): string;
-/** Mesh session id for this device's daemon; only characters the spool accepts. */
-export declare function heartbeatSessionId(hostname?: string): string;
 export declare function readHeartbeat(file: string): HeartbeatState | null;
 /** Presence label for a device given its last beat: "daemon stale" after 5 minutes of silence. */
 export declare function daemonPresenceLabel(state: HeartbeatState | null, now?: Date): "daemon live" | typeof DAEMON_STALE_LABEL;

package/dist/lib/daemon/heartbeat.js

@@ -8,16 +8,16 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-export const HEARTBEAT_INTERVAL_MS = 60_000;
+const HEARTBEAT_INTERVAL_MS = 60_000;
 export const HEARTBEAT_STALE_MS = 5 * 60_000;
-export const HEARTBEAT_FILE = "hqd-heartbeat.json";
+const HEARTBEAT_FILE = "hqd-heartbeat.json";
 export const DAEMON_STALE_LABEL = "daemon stale";
 export function heartbeatFile(home = os.homedir(), env = process.env) {
     const dir = env.HQ_REGISTRY_DIR?.trim() ? path.resolve(env.HQ_REGISTRY_DIR.trim()) : path.join(home, ".hq");
     return path.join(dir, HEARTBEAT_FILE);
 }
 /** Mesh session id for this device's daemon; only characters the spool accepts. */
-export function heartbeatSessionId(hostname = os.hostname()) {
+function heartbeatSessionId(hostname = os.hostname()) {
     return `hqd-${hostname.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").slice(0, 48) || "device"}`;
 }
 export function readHeartbeat(file) {

package/dist/lib/daemon/run.d.ts

@@ -62,7 +62,7 @@ export type SyncRunnerSource = {
 export declare function syncRunnerSourceForPlan(stagedRunnerPath: string | null, hqCloud: PickedHqCloud | null, legacyBundledRunnerPath?: string | null, staged?: {
     version: string | null;
     pinnedVersion?: string | null;
-}): SyncRunnerSource;
+}, currentSyncRunnerSource?: SyncRunnerSource | null): SyncRunnerSource;
 /** Whether every executable in the first service plan remains usable after the CLI package is replaced. */
 export declare function daemonPlanCanReleasePackageUseLease(plans: readonly UnitPlan[], replaceablePackageRoots: readonly string[], stagingFailed: boolean, hqBootstrapReady?: boolean): boolean;
 export declare function daemonHqChildCommand(nodeBinary: string, hqBinary: string, args: readonly string[], bootstrapPath: string | null, packagePrefix: string | null): [string, string[]];

package/dist/lib/daemon/run.js

@@ -76,13 +76,20 @@ export function handoffForPackageUpdateRequest(requested, restartDaemon) {
 const LEGACY_PROBE_TTL_MS = 60_000;
 /** A flag read that has not answered by then counts as off. */
 const HANDOFF_FLAG_TIMEOUT_MS = 10_000;
-export function syncRunnerSourceForPlan(stagedRunnerPath, hqCloud, legacyBundledRunnerPath = null, staged = { version: null }) {
+export function syncRunnerSourceForPlan(stagedRunnerPath, hqCloud, legacyBundledRunnerPath = null, staged = { version: null }, currentSyncRunnerSource = null) {
     // A managed copy lives in the daemon directory, so it survives a CLI
     // replacement. Before lease release pickHqCloud returns it only when it is
     // pinned or newer than the bundled copy; after release it is the only
     // eligible package, so it must not displace a newer staged bundle unless it
     // is the pinned version. The staged bundle is built from the bundled copy and
     // otherwise only stands in for that copy (hq-cli#1547).
+    const pin = staged.pinnedVersion;
+    const hasRunnerAtOrAbovePin = pin != null &&
+        ((staged.version !== null && !hqCloudVersionOlder(staged.version, pin)) ||
+            (hqCloud !== null && !hqCloudVersionOlder(hqCloud.version, pin)));
+    if (pin && !hasRunnerAtOrAbovePin && currentSyncRunnerSource?.runnerPath) {
+        return currentSyncRunnerSource;
+    }
     const managedYieldsToStaged = stagedRunnerPath !== null &&
         hqCloud?.source === "managed" &&
         hqCloud.version !== staged.pinnedVersion &&
@@ -373,6 +380,7 @@ export async function runDaemon(opts) {
     let hqChildBootstrapStageFailed = false;
     let legacySyncRunnerPathChecked = false;
     let legacySyncRunnerPath = null;
+    let lastPlannedSyncRunnerSource = null;
     let packageUseLeaseReleased = false;
     let hqCloudVersionBeforeRelease = null;
     let startupPlanOpen = true;
@@ -570,7 +578,8 @@ export async function runDaemon(opts) {
             legacySyncRunnerPath = resolveSyncRunnerPath();
             legacySyncRunnerPathChecked = true;
         }
-        const syncSource = syncRunnerSourceForPlan(staged?.runnerPath ?? null, hqCloud, packageUseLeaseReleased ? null : legacySyncRunnerPath, { version: staged?.metadata.version ?? null, pinnedVersion: config.hqCloudVersion ?? null });
+        const syncSource = syncRunnerSourceForPlan(staged?.runnerPath ?? null, hqCloud, packageUseLeaseReleased ? null : legacySyncRunnerPath, { version: staged?.metadata.version ?? null, pinnedVersion: config.hqCloudVersion ?? null }, lastPlannedSyncRunnerSource);
+        lastPlannedSyncRunnerSource = syncSource.runnerPath ? syncSource : null;
         if (!syncSource.runnerPath && !warnedMissingSyncRunner) {
             warnedMissingSyncRunner = true;
             log("warn", "the hq-cloud sync runner was not found in this CLI install; sync is unavailable");

package/dist/lib/daemon/supervisor.js

@@ -683,6 +683,7 @@ export function createSupervisor(deps) {
             existing.blockedReads = 0;
             const adopted = existing.adopted === true;
             existing.adopted = false;
+            const hadDrainSignal = existing.plan.drainSignal !== undefined;
             const key = planKey(plan, deps.cliVersion);
             const wasBlocked = existing.plan.blocked !== undefined;
             const changed = key !== existing.key;
@@ -746,7 +747,7 @@ export function createSupervisor(deps) {
                 if (cliRestartInProgress && plan.service === "sync")
                     terminate(existing);
                 else
-                    terminate(existing, () => activate(existing));
+                    terminate(existing, () => activate(existing), hadDrainSignal);
             }
         }
         slots = next;

package/dist/lib/doctor/__testing__/fake-hq-tree.d.ts

@@ -25,7 +25,7 @@
  * which stands up a throwaway HQ tree with `mktemp -d` and stubbed hook scripts.
  */
 /** Claude/Codex lifecycle events a hook can be registered against. */
-export type HookEventName = "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "SessionStart" | "Stop" | "SubagentStop" | "PreCompact" | "Notification";
+type HookEventName = "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "SessionStart" | "Stop" | "SubagentStop" | "PreCompact" | "Notification";
 /** The three `hook-gate.sh` allowlist profiles. */
 export type GateProfile = "minimal" | "standard" | "strict";
 /** Canonical ordering of the gate profiles. */
@@ -35,7 +35,7 @@ export declare const GATE_PROFILES: readonly GateProfile[];
  * canonical `.claude/hooks/` scripts; only Codex runs duplicated copies, so the
  * Codex mirror is the entire drift surface the doctor has to watch.
  */
-export interface FakeCodexMirrorSpec {
+interface FakeCodexMirrorSpec {
     /** Whether the mirror file is written to `.codex/hooks/`. Default: true. */
     present?: boolean;
     /**
@@ -99,7 +99,7 @@ export interface FakeHookSpec {
  * written by default (declare a hook's `codex` spec explicitly, or set
  * `legacyHooksJson`, to model pre-adapter leftovers).
  */
-export interface FakeCodexAdapterSpec {
+interface FakeCodexAdapterSpec {
     /** Events wired to the adapter in config.toml. Default: the shipped eight. */
     events?: string[];
     /** Whether the adapter script is written. Default: true. */
@@ -111,10 +111,8 @@ export interface FakeCodexAdapterSpec {
     /** Whether a leftover `.codex/hooks.json` is still written. Default: false. */
     legacyHooksJson?: boolean;
 }
-/** The lifecycle events the shipped `.codex/config.toml` wires. */
-export declare const ADAPTER_DEFAULT_EVENTS: readonly string[];
 /** Declares the `.grok/hooks/` state. */
-export interface FakeGrokSpec {
+interface FakeGrokSpec {
     /** Whether the `.grok/hooks/` scaffold is created at all. Default: true. */
     present?: boolean;
     /** Whether `hq-grok-hook-adapter.sh` carries the executable bit. Default: true. */
@@ -147,7 +145,7 @@ export interface FakeHqTreeSpec {
     prefix?: string;
 }
 /** Manifest entry describing a materialised Codex mirror. */
-export interface FakeCodexManifestEntry {
+interface FakeCodexManifestEntry {
     /** Absolute path where the mirror lives (whether or not it was written). */
     scriptPath: string;
     /** Whether the mirror file exists on disk. */
@@ -162,7 +160,7 @@ export interface FakeCodexManifestEntry {
     drifted: boolean;
 }
 /** Manifest entry describing a materialised hook across all platforms. */
-export interface FakeHookManifestEntry {
+interface FakeHookManifestEntry {
     id: string;
     /** Absolute path of the Claude script (whether or not it was written). */
     scriptPath: string;
@@ -184,7 +182,7 @@ export interface FakeHookManifestEntry {
     codex: FakeCodexManifestEntry | null;
 }
 /** A structured description of everything {@link buildFakeHqTree} wrote. */
-export interface FakeHqTreeManifest {
+interface FakeHqTreeManifest {
     root: string;
     claudeSettingsPath: string;
     claudeHooksDir: string;
@@ -224,4 +222,5 @@ export declare function trackedFakeHqTreeRoots(): string[];
  * when the process exits.
  */
 export declare function buildFakeHqTree(spec?: FakeHqTreeSpec): FakeHqTree;
+export {};
 //# sourceMappingURL=fake-hq-tree.d.ts.map