@indigoai-us/hq-cloud 5.24.0 → 5.26.0

package/dist/bin/sync-runner.d.ts

@@ -14,6 +14,10 @@
  *   --company <slug-or-uid>   Sync a single company (alternative to --companies)
  *   --on-conflict <strategy>  abort | overwrite | keep (default: abort)
  *   --hq-root <path>          Local HQ directory (default: $HOME/hq)
+ *   --skip-personal           Drop the personal target from the --companies
+ *                             fanout. Combined with HQ_SYNC_SKIP_PERSONAL env
+ *                             (either truthy disables personal sync). No-op
+ *                             outside --companies mode.
  *   --json                    Ignored — ndjson on stdout is the default and
  *                             only output mode. Accepted for symmetry with the
  *                             AppBar's argv in case someone passes it.
@@ -55,6 +59,7 @@ import { type VaultServiceConfig, type Membership, type EntityInfo, type Pending
 import { PERSONAL_VAULT_EXCLUDED_TOP_LEVEL, computePersonalVaultPaths } from "../personal-vault.js";
 import type { SyncOptions, SyncResult, SyncProgressEvent } from "../cli/sync.js";
 import type { ShareOptions, ShareResult } from "../cli/share.js";
+import { type Clock } from "../watcher.js";
 /**
  * Sync direction for a run.
  *
@@ -70,24 +75,48 @@ import type { ShareOptions, ShareResult } from "../cli/share.js";
 export type Direction = "pull" | "push" | "both";
 /**
  * Delete-propagation policy honored by the push leg of bidirectional sync.
- * Default `"owned-only"` in 5.24 — the pre-5.24 behavior is preserved so
- * existing users see zero change in delete-propagation semantics. The
- * stricter-and-safer `"currency-gated"` policy ships in 5.24 as opt-in
- * (set `HQ_SYNC_DELETE_POLICY=currency-gated` to enable per-file ETag
- * verification before any local-delete propagates to S3). Default flip
- * to `"currency-gated"` is scheduled for 5.25 after a soak period during
- * which currency-gated behavior is observed on at least one active
- * machine.
+ *
+ * Default `"currency-gated"` in 5.25 — flipped from `"owned-only"` after
+ * one machine (Indigo / corey) ran the 5.24 code path through real syncs
+ * for a week without surfacing surprise behavior. Currency-gated does a
+ * per-file ETag HEAD before propagating any local-delete to S3: if the
+ * remote object's current ETag no longer matches the journal's last-
+ * recorded one, the delete is refused and the next pull leg re-pulls the
+ * file via the standard 3-way merge path. This is strictly safer than
+ * `owned-only` (which propagates any local-delete the journal can prove
+ * came from this device) — the only delete-class that changes behavior
+ * is "deleted locally + modified remotely by another device", which
+ * previously destroyed remote work and now becomes a pull-and-conflict.
  *
  * Env override `HQ_SYNC_DELETE_POLICY=owned-only|all|currency-gated` is
- * also the rollback knob — once 5.25 flips the default, anyone surprised
- * by the new behavior flips the env back to `owned-only` without
- * re-deploying. `all` is the unsafe-mirror mode previously used by the
- * runner pre-5.20 — included only as an emergency reconcile lever, not a
- * recommended default.
+ * also the rollback knob — anyone surprised by 5.25's flip can revert
+ * to `owned-only` without redeploying. `all` is the unsafe-mirror mode
+ * previously used by the runner pre-5.20 — included only as an
+ * emergency reconcile lever, not a recommended default.
  */
 export type DeletePropagationPolicy = "currency-gated" | "owned-only" | "all";
 export declare function resolveDeletePolicy(): DeletePropagationPolicy;
+/**
+ * Resolve whether to skip the personal target in a `--companies` fanout.
+ *
+ * Two inputs combine: the `--skip-personal` CLI flag (parsed into
+ * `ParsedArgs.skipPersonal`) and the `HQ_SYNC_SKIP_PERSONAL` env var. Either
+ * being truthy skips the personal target — flag wins on conflict (CLI
+ * flag is the explicit-for-this-invocation knob, env is the persistent
+ * default usually set by the menubar in the spawned child process).
+ *
+ * Env truthy values: `1`, `true`, `yes` (case-insensitive). Anything else
+ * (including missing) is treated as falsy — same shape as classic
+ * Unix opt-in env conventions; conservative to avoid surprising opt-outs.
+ *
+ * Use case: the menubar app exposes a "Sync personal vault" toggle in
+ * Settings (default ON, matching the auto-provisioning UX). When the user
+ * flips it off, the menubar spawns `hq sync` with this env set so the
+ * fanout drops the personal target before walking the user's entire HQ
+ * tree (a sync that would otherwise scan thousands of files, including
+ * the new personal-vault default exclusions, just to do nothing useful).
+ */
+export declare function resolveSkipPersonal(flag: boolean): boolean;
 export { PERSONAL_VAULT_EXCLUDED_TOP_LEVEL, computePersonalVaultPaths };
 /**
  * Every event the runner emits. Channel routing (stdout vs stderr) is
@@ -153,12 +182,19 @@ export type RunnerEvent = {
     /**
      * Upload counters. Always emitted (0 when the run was pull-only) so
      * downstream consumers don't need to conditionally read the field.
-     * Tauri's `SyncCompleteEvent` ignores extra fields today; adding them
-     * to the Rust struct is a follow-up when the UI needs to surface push
-     * totals.
      */
     filesUploaded: number;
     bytesUploaded: number;
+    /**
+     * Push-side counters added in 5.25. Always emitted as numbers (0
+     * when no push leg ran). Tauri's `SyncCompleteEvent` carries them
+     * as Option<u32> for back-compat with <5.25 engines that don't
+     * include them; structural-typing-wise, the union just adds
+     * properties on top of `SyncResult`.
+     */
+    filesTombstoned: number;
+    filesRefusedStale: number;
+    filesExcludedByPolicy: number;
 } & SyncResult) | {
     type: "all-complete";
     companiesAttempted: number;
@@ -289,5 +325,103 @@ export declare function runRunner(argv: string[], deps?: RunnerDeps): Promise<nu
  * exit 0 today and so will retry — acceptable noise for the beta; deal with
  * it via a richer return shape if it shows up in Sentry.
  */
-export declare function runRunnerWithLoop(argv: string[]): Promise<number>;
+/**
+ * Test/event-driven seam (US-001).
+ *
+ * `runRunnerWithLoop` performs an unbounded poll loop in production. To make
+ * the loop deterministically testable (US-003 wires the event-driven watcher
+ * into this same loop), the inter-pass sleep is injectable via `deps.sleep`.
+ * The default uses the host timer and preserves exact production behavior.
+ *
+ * A test (or US-003's wiring) injects a fake sleep that resolves immediately
+ * and/or coordinates with the {@link WatchPushDriver} seam in `../watcher.js`,
+ * so the loop can be exercised without a real 10-minute wait.
+ */
+export interface RunnerLoopDeps {
+    /** Sleep `ms` between passes. Default: host setTimeout. */
+    sleep?: (ms: number) => Promise<void>;
+    /**
+     * Run a single sync pass. Defaults to {@link runRunner}. Injected by tests
+     * (and the event-push wiring) so the poll loop and the watcher-triggered
+     * targeted push share one seam and one in-flight guard. The default ignores
+     * `deps` and forwards just the argv to `runRunner`.
+     */
+    runPass?: (passArgv: string[]) => Promise<number>;
+    /**
+     * Clock seam for the event-push watcher's debounce window. Defaults to
+     * {@link systemClock}; tests inject a `FakeClock` to advance the window
+     * deterministically. Only consulted when `--event-push` is on.
+     */
+    clock?: Clock;
+    /**
+     * Factory for the file watcher used in event-push mode. Defaults to a real
+     * {@link TreeWatcher} over `hqRoot`. Tests inject a stub exposing the same
+     * `onChange`/`start`/`stop`/`dispose` surface so no real chokidar runs.
+     */
+    createWatcher?: (opts: {
+        hqRoot: string;
+        debounceMs: number;
+        clock: Clock;
+    }) => WatcherSurface;
+    /**
+     * Register a one-shot shutdown signal handler. Defaults to listening for
+     * SIGTERM/SIGINT on `process`. Tests inject a controllable trigger to assert
+     * clean teardown without sending real signals. The returned fn detaches the
+     * handler (called during teardown so tests don't leak listeners).
+     */
+    onShutdownSignal?: (handler: () => void) => () => void;
+}
+/**
+ * The minimal watcher surface the loop drives. {@link TreeWatcher} satisfies
+ * it; tests inject a lighter stub. Kept narrow so the loop never reaches past
+ * the lifecycle + change-subscription contract.
+ *
+ * `onChange`'s listener receives an OPTIONAL changed relative path. The real
+ * {@link TreeWatcher} emits a bare debounced signal (no path) — in that case
+ * the loop routes the targeted push to the personal vault. A path-aware
+ * watcher (or a test stub) can pass the changed `companies/<slug>/...`
+ * relative path so the loop targets just that company.
+ */
+export interface WatcherSurface {
+    onChange(listener: (changedRelPath?: string) => void): () => void;
+    start(): void;
+    stop(): void;
+    dispose(): void;
+}
+/**
+ * Route a changed relative path to the push target that owns it.
+ *
+ * - `companies/<slug>/...` → a single-company push for `<slug>` (the targeted
+ *   pass per PRD decision — push only the changed company, not a full
+ *   `--companies` fanout).
+ * - anything else under hqRoot → the personal target (a `--companies` push
+ *   restricted to personal via the personal-vault scope; modeled here as the
+ *   "personal" route the caller maps to the right argv).
+ *
+ * Returns `null` for paths the routing cannot attribute (defensive — the
+ * watcher's filter already drops excluded top-levels, so this is belt-and-
+ * suspenders for synthetic events).
+ */
+export declare function routeChangeToTarget(relPath: string): {
+    kind: "company";
+    slug: string;
+} | {
+    kind: "personal";
+} | null;
+/**
+ * Build the argv for a targeted push pass from a routed change. The push runs
+ * `--direction push` for just the routed target so a local edit propagates in
+ * seconds without a full fanout. Company routes use `--company <slug>`;
+ * personal routes use `--companies --direction push` (the personal-vault scope
+ * is resolved inside runRunner's fanout; skipUnchanged no-ops the company
+ * subtrees that didn't change). Inherits `--hq-root` / `--on-conflict` from
+ * the base argv. Pure helper, exported for unit testing the routing→argv map.
+ */
+export declare function buildTargetedPushArgv(route: {
+    kind: "company";
+    slug: string;
+} | {
+    kind: "personal";
+}, baseArgv: string[]): string[];
+export declare function runRunnerWithLoop(argv: string[], deps?: RunnerLoopDeps): Promise<number>;
 //# sourceMappingURL=sync-runner.d.ts.map

package/dist/bin/sync-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-runner.d.ts","sourceRoot":"","sources":["../../src/bin/sync-runner.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAMH,OAAO,EAOL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAKjE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAuBjD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,GAAG,YAAY,GAAG,KAAK,CAAC;AAE9E,wBAAgB,mBAAmB,IAAI,uBAAuB,CAM7D;AAMD,OAAO,EAAE,iCAAiC,EAAE,yBAAyB,EAAE,CAAC;AAMxE;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvC;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,GACD,CAAC;IACC;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GAC/D,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GACxG,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GACnG,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GACxG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;CAAE,GAC7G,CAAC;IACC,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,UAAU,CAAC,GACf;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IACpF,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD;;;;;;;;;;OAUG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,SAAS,EAAE,KAAK,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;CACJ,CAAC;AAEN;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/C,2BAA2B,EAAE,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnE,0BAA0B,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,oBAAoB,EAAE,CAAC,KAAK,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1B,MAAM,EAAE;QACN,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;KACrD,CAAC;CACH;AAED,mEAAmE;AACnE,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,gEAAgE;IAChE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,kBAAkB,CAAC;IACvE,kDAAkD;IAClD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,kEAAkE;IAClE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AA4ND,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,MAAM,CAAC,CAigBjB;AA4BD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBvE"}
+{"version":3,"file":"sync-runner.d.ts","sourceRoot":"","sources":["../../src/bin/sync-runner.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAMH,OAAO,EAOL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAIjE,OAAO,EAIL,KAAK,KAAK,EACX,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAuBjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,GAAG,YAAY,GAAG,KAAK,CAAC;AAE9E,wBAAgB,mBAAmB,IAAI,uBAAuB,CAM7D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAI1D;AAMD,OAAO,EAAE,iCAAiC,EAAE,yBAAyB,EAAE,CAAC;AAMxE;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvC;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,GACD,CAAC;IACC;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GAC/D,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GACxG,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GACnG,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GACxG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;CAAE,GAC7G,CAAC;IACC,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;CAC/B,GAAG,UAAU,CAAC,GACf;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IACpF,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD;;;;;;;;;;OAUG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,SAAS,EAAE,KAAK,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;CACJ,CAAC;AAEN;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/C,2BAA2B,EAAE,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnE,0BAA0B,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,oBAAoB,EAAE,CAAC,KAAK,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1B,MAAM,EAAE;QACN,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;KACrD,CAAC;CACH;AAED,mEAAmE;AACnE,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,gEAAgE;IAChE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,kBAAkB,CAAC;IACvE,kDAAkD;IAClD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,kEAAkE;IAClE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAuQD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,MAAM,CAAC,CA4hBjB;AA4BD;;;;;;;GAOG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD;;;;OAIG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,KAAK,CAAC;KACd,KAAK,cAAc,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;CACxD;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAClE,KAAK,IAAI,IAAI,CAAC;IACd,IAAI,IAAI,IAAI,CAAC;IACb,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAWjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,EAC/D,QAAQ,EAAE,MAAM,EAAE,GACjB,MAAM,EAAE,CAMV;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,CAsJjB"}

package/dist/bin/sync-runner.js

@@ -14,6 +14,10 @@
  *   --company <slug-or-uid>   Sync a single company (alternative to --companies)
  *   --on-conflict <strategy>  abort | overwrite | keep (default: abort)
  *   --hq-root <path>          Local HQ directory (default: $HOME/hq)
+ *   --skip-personal           Drop the personal target from the --companies
+ *                             fanout. Combined with HQ_SYNC_SKIP_PERSONAL env
+ *                             (either truthy disables personal sync). No-op
+ *                             outside --companies mode.
  *   --json                    Ignored — ndjson on stdout is the default and
  *                             only output mode. Accepted for symmetry with the
  *                             AppBar's argv in case someone passes it.
@@ -61,6 +65,7 @@ import { PERSONAL_VAULT_EXCLUDED_TOP_LEVEL, computePersonalVaultPaths, } from ".
 import { sync as defaultSync } from "../cli/sync.js";
 import { share as defaultShare } from "../cli/share.js";
 import { collectAndSendTelemetry } from "../telemetry.js";
+import { TreeWatcher, WatchPushDriver, systemClock, } from "../watcher.js";
 // ---------------------------------------------------------------------------
 // Defaults — mirror `hq-cli/src/utils/cognito-session.ts`. Inlined (not
 // imported) to avoid a circular dep between hq-cli and hq-cloud. If these
@@ -82,7 +87,33 @@ export function resolveDeletePolicy() {
     if (env === "owned-only" || env === "all" || env === "currency-gated") {
         return env;
     }
-    return "owned-only";
+    return "currency-gated";
+}
+/**
+ * Resolve whether to skip the personal target in a `--companies` fanout.
+ *
+ * Two inputs combine: the `--skip-personal` CLI flag (parsed into
+ * `ParsedArgs.skipPersonal`) and the `HQ_SYNC_SKIP_PERSONAL` env var. Either
+ * being truthy skips the personal target — flag wins on conflict (CLI
+ * flag is the explicit-for-this-invocation knob, env is the persistent
+ * default usually set by the menubar in the spawned child process).
+ *
+ * Env truthy values: `1`, `true`, `yes` (case-insensitive). Anything else
+ * (including missing) is treated as falsy — same shape as classic
+ * Unix opt-in env conventions; conservative to avoid surprising opt-outs.
+ *
+ * Use case: the menubar app exposes a "Sync personal vault" toggle in
+ * Settings (default ON, matching the auto-provisioning UX). When the user
+ * flips it off, the menubar spawns `hq sync` with this env set so the
+ * fanout drops the personal target before walking the user's entire HQ
+ * tree (a sync that would otherwise scan thousands of files, including
+ * the new personal-vault default exclusions, just to do nothing useful).
+ */
+export function resolveSkipPersonal(flag) {
+    if (flag)
+        return true;
+    const env = (process.env.HQ_SYNC_SKIP_PERSONAL ?? "").toLowerCase();
+    return env === "1" || env === "true" || env === "yes";
 }
 // Personal-vault scope (exclusion list + path computer) lives in
 // `../personal-vault.ts` so the `hq sync` CLI and this runner share the same
@@ -159,6 +190,8 @@ function parseArgs(argv) {
     let direction = "pull";
     let watch = false;
     let pollRemoteMs;
+    let skipPersonal = false;
+    let eventPush = false;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         switch (arg) {
@@ -214,6 +247,18 @@ function parseArgs(argv) {
             case "--json":
                 // Accepted but ignored — ndjson is the only output mode.
                 break;
+            case "--skip-personal":
+                // Drop the personal target from the fanout. No-op outside
+                // --companies mode. Combined with HQ_SYNC_SKIP_PERSONAL env via
+                // resolveSkipPersonal().
+                skipPersonal = true;
+                break;
+            case "--event-push":
+                // Phase 1 event-driven push enable flag. Requires --watch (validated
+                // below). Gated OFF by default; the menubar only passes it for
+                // @getindigo.ai identities for the first release.
+                eventPush = true;
+                break;
             default:
                 return { error: `Unknown argument: ${arg}` };
         }
@@ -227,7 +272,20 @@ function parseArgs(argv) {
     if (pollRemoteMs !== undefined && !watch) {
         return { error: "--poll-remote-ms requires --watch" };
     }
-    return { companies, company, onConflict, hqRoot, direction, watch, pollRemoteMs };
+    if (eventPush && !watch) {
+        return { error: "--event-push requires --watch" };
+    }
+    return {
+        companies,
+        company,
+        onConflict,
+        hqRoot,
+        direction,
+        watch,
+        pollRemoteMs,
+        skipPersonal,
+        eventPush,
+    };
 }
 // ---------------------------------------------------------------------------
 // Telemetry default — closes over the runner's vault client. Skipped when
@@ -421,7 +479,15 @@ export async function runRunner(argv, deps = {}) {
         }
         plan.push({ uid: m.companyUid, slug, ...(name ? { name } : {}) });
     }
-    if (parsed.companies) {
+    if (parsed.companies && !resolveSkipPersonal(parsed.skipPersonal)) {
+        // Personal-target fanout slot. Skipped entirely when --skip-personal
+        // (or HQ_SYNC_SKIP_PERSONAL=1) is set — see resolveSkipPersonal doc for
+        // the rationale (menubar opt-out for users who only want company sync).
+        // When skipped, the fanout-plan event below carries only company
+        // memberships and no "personal" slug; downstream consumers (menubar
+        // workspaces row, status surfaces) should already tolerate that
+        // shape since pre-5.25 fanout often had it (a user with no person
+        // entity yet, or before the canonical-person-entity machinery landed).
         const persons = await client.entity.listByType("person");
         const pick = pickCanonicalPersonEntity(persons);
         if (pick?.bucketName) {
@@ -529,6 +595,7 @@ export async function runRunner(argv, deps = {}) {
                 filesDeleted: 0,
                 filesTombstoned: 0,
                 filesRefusedStale: 0,
+                filesExcludedByPolicy: 0,
                 conflictPaths: [],
                 aborted: false,
             };
@@ -625,6 +692,17 @@ export async function runRunner(argv, deps = {}) {
                 filesUploaded: pushResult.filesUploaded,
                 bytesUploaded: pushResult.bytesUploaded,
                 filesSkipped: pullResult.filesSkipped + pushResult.filesSkipped,
+                // Push-side counters surfaced on `complete` so the menubar's
+                // `SyncCompleteEvent` (which carries them as Option<u32> for
+                // back-compat with pre-5.25 engines) can render the new totals.
+                // Always emitted as numbers (0 when no push leg ran) so Rust's
+                // serde decodes them as `Some(0)` rather than `None` — distinct
+                // from the legacy-engine `None` and useful when the UI wants to
+                // distinguish "engine ran, nothing tombstoned" from "engine
+                // didn't report".
+                filesTombstoned: pushResult.filesTombstoned,
+                filesRefusedStale: pushResult.filesRefusedStale,
+                filesExcludedByPolicy: pushResult.filesExcludedByPolicy,
                 // Sourced from the merged path list so push-side conflicts are
                 // counted too — `ShareResult` doesn't expose a numeric counter,
                 // and using `pullResult.conflicts` alone silently dropped any
@@ -663,6 +741,13 @@ export async function runRunner(argv, deps = {}) {
                 filesUploaded: state.filesUploaded,
                 bytesUploaded: state.bytesUploaded,
                 filesSkipped: 0,
+                // Mid-flight throw: we have no clean ShareResult to read these
+                // from. Report 0 so the event shape stays stable; the partial
+                // counts above already reflect what actually moved before the
+                // throw.
+                filesTombstoned: 0,
+                filesRefusedStale: 0,
+                filesExcludedByPolicy: 0,
                 conflicts: 0,
                 conflictPaths: [],
                 aborted: true,
@@ -767,37 +852,214 @@ const isDirectInvocation = (() => {
     }
 })();
 /**
- * Auto-sync (Beta) watch loop. Re-runs the one-shot runner every
- * `pollRemoteMs` until the process is killed (SIGTERM from the menubar's
- * stop_daemon command) or until a pass returns a non-zero exit code (hard
- * error worth surfacing to the operator). `setup-needed` and `auth-error`
- * exit 0 today and so will retry — acceptable noise for the beta; deal with
- * it via a richer return shape if it shows up in Sentry.
+ * Route a changed relative path to the push target that owns it.
+ *
+ * - `companies/<slug>/...` → a single-company push for `<slug>` (the targeted
+ *   pass per PRD decision — push only the changed company, not a full
+ *   `--companies` fanout).
+ * - anything else under hqRoot → the personal target (a `--companies` push
+ *   restricted to personal via the personal-vault scope; modeled here as the
+ *   "personal" route the caller maps to the right argv).
+ *
+ * Returns `null` for paths the routing cannot attribute (defensive — the
+ * watcher's filter already drops excluded top-levels, so this is belt-and-
+ * suspenders for synthetic events).
+ */
+export function routeChangeToTarget(relPath) {
+    const norm = relPath.split(path.sep).join("/").replace(/^\.\//, "");
+    if (norm === "" || norm.startsWith(".."))
+        return null;
+    const segments = norm.split("/").filter((s) => s.length > 0);
+    if (segments.length === 0)
+        return null;
+    if (segments[0] === "companies") {
+        // companies/<slug>/... — need at least the slug segment to target.
+        if (segments.length < 2 || segments[1].length === 0)
+            return null;
+        return { kind: "company", slug: segments[1] };
+    }
+    return { kind: "personal" };
+}
+/**
+ * Build the argv for a targeted push pass from a routed change. The push runs
+ * `--direction push` for just the routed target so a local edit propagates in
+ * seconds without a full fanout. Company routes use `--company <slug>`;
+ * personal routes use `--companies --direction push` (the personal-vault scope
+ * is resolved inside runRunner's fanout; skipUnchanged no-ops the company
+ * subtrees that didn't change). Inherits `--hq-root` / `--on-conflict` from
+ * the base argv. Pure helper, exported for unit testing the routing→argv map.
  */
-export async function runRunnerWithLoop(argv) {
+export function buildTargetedPushArgv(route, baseArgv) {
+    const carried = carriedFlags(baseArgv);
+    if (route.kind === "company") {
+        return ["--company", route.slug, "--direction", "push", ...carried];
+    }
+    return ["--companies", "--direction", "push", ...carried];
+}
+export async function runRunnerWithLoop(argv, deps = {}) {
     if (!argv.includes("--watch")) {
         return runRunner(argv);
     }
+    const sleep = deps.sleep ??
+        ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const runPass = deps.runPass ?? ((passArgv) => runRunner(passArgv));
     const pollIdx = argv.indexOf("--poll-remote-ms");
     const pollMs = pollIdx >= 0 && argv[pollIdx + 1] ? Number(argv[pollIdx + 1]) : 600_000;
-    // Strip --watch / --poll-remote-ms before delegating: the parser inside
-    // runRunner accepts them, but we don't want runRunner to think it's
-    // re-entering watch mode each iteration.
+    const eventPush = argv.includes("--event-push");
+    const hqIdx = argv.indexOf("--hq-root");
+    const hqRoot = hqIdx >= 0 && argv[hqIdx + 1] ? argv[hqIdx + 1] : DEFAULT_HQ_ROOT;
+    // Strip the loop-only flags before delegating: the parser inside runRunner
+    // accepts --watch/--poll-remote-ms/--event-push, but we don't want a per-
+    // iteration pass to think it's re-entering watch mode.
     const passArgv = argv.filter((a, i) => {
         if (a === "--watch")
             return false;
         if (a === "--poll-remote-ms")
             return false;
+        if (a === "--event-push")
+            return false;
         if (i > 0 && argv[i - 1] === "--poll-remote-ms")
             return false;
         return true;
     });
-    while (true) {
-        const code = await runRunner(passArgv);
-        if (code !== 0)
-            return code;
-        await new Promise((resolve) => setTimeout(resolve, pollMs));
+    // ---- shared in-flight guard ------------------------------------------
+    // The poll loop AND watcher-triggered targeted pushes funnel through this
+    // mutex so a watcher push never overlaps an in-flight pass (PRD AC). A
+    // trigger that arrives while a pass runs is collapsed by WatchPushDriver's
+    // own pending-while-pushing logic, then re-armed after the pass settles.
+    let inFlight = false;
+    let stopped = false;
+    const runGuarded = async (pass) => {
+        if (inFlight)
+            return "skipped";
+        inFlight = true;
+        try {
+            return await pass();
+        }
+        finally {
+            inFlight = false;
+        }
+    };
+    // ---- event-push wiring (Phase 1) -------------------------------------
+    let watcher = null;
+    let driver = null;
+    let detachSignal = null;
+    let lastChangedRel = null;
+    if (eventPush) {
+        const clock = deps.clock ?? systemClock;
+        const debounceMs = 2000;
+        const createWatcher = deps.createWatcher ??
+            ((opts) => new TreeWatcher({
+                hqRoot: opts.hqRoot,
+                debounceMs: opts.debounceMs,
+                clock: opts.clock,
+                personalMode: true,
+            }));
+        watcher = createWatcher({ hqRoot, debounceMs, clock });
+        // The driver runs the targeted push when a debounced burst settles. Its
+        // concurrency guard collapses a trigger that lands mid-pass; we ALSO gate
+        // through `runGuarded` so a poll pass in flight is never overlapped.
+        driver = new WatchPushDriver({
+            debounceMs: 0, // TreeWatcher already debounces; the driver just guards.
+            clock,
+            push: async () => {
+                if (stopped)
+                    return;
+                const rel = lastChangedRel;
+                const route = rel
+                    ? routeChangeToTarget(rel)
+                    : { kind: "personal" };
+                if (!route)
+                    return;
+                const targetedArgv = buildTargetedPushArgv(route, passArgv);
+                await runGuarded(() => runPass(targetedArgv));
+            },
+        });
+        // A debounced TreeWatcher 'changed' signal feeds the driver, which fires
+        // the targeted push after its own (zero) window — i.e. immediately, but
+        // still serialized behind any in-flight pass. A path-aware watcher passes
+        // the changed relative path so the push targets just its owning company;
+        // the bare-signal TreeWatcher leaves it null → personal-vault route.
+        watcher.onChange((changedRelPath) => {
+            if (stopped)
+                return;
+            lastChangedRel = changedRelPath ?? null;
+            driver?.notifyChange();
+        });
+        watcher.start();
+    }
+    // ---- clean shutdown --------------------------------------------------
+    // SIGTERM (menubar stop_daemon) / SIGINT must tear down BOTH the watcher and
+    // the poll loop with no leaked timers or fds. We flip `stopped`, dispose the
+    // watcher + driver, and let the poll loop observe `stopped` on its next tick.
+    let resolveStopped = null;
+    const stoppedSignal = new Promise((resolve) => {
+        resolveStopped = resolve;
+    });
+    const shutdown = () => {
+        if (stopped)
+            return;
+        stopped = true;
+        try {
+            driver?.dispose();
+        }
+        catch {
+            /* ignore */
+        }
+        try {
+            watcher?.dispose();
+        }
+        catch {
+            /* ignore */
+        }
+        resolveStopped?.();
+    };
+    const onShutdownSignal = deps.onShutdownSignal ??
+        ((handler) => {
+            const wrapped = () => handler();
+            process.on("SIGTERM", wrapped);
+            process.on("SIGINT", wrapped);
+            return () => {
+                process.off("SIGTERM", wrapped);
+                process.off("SIGINT", wrapped);
+            };
+        });
+    detachSignal = onShutdownSignal(shutdown);
+    try {
+        while (!stopped) {
+            const result = await runGuarded(() => runPass(passArgv));
+            // A poll pass that was skipped because a watcher push held the guard is
+            // benign — the next iteration retries after the poll interval.
+            if (typeof result === "number" && result !== 0) {
+                return result;
+            }
+            // Sleep the poll interval, but wake early on shutdown so SIGTERM stops
+            // the loop promptly instead of waiting out a 10-minute cycle.
+            await Promise.race([sleep(pollMs), stoppedSignal]);
+        }
+        return 0;
+    }
+    finally {
+        shutdown();
+        detachSignal?.();
+    }
+}
+/**
+ * Extract the `--hq-root` / `--on-conflict` pair-flags from a base argv so a
+ * re-targeted push pass inherits the same root and conflict policy. Pure
+ * helper used by the event-push targeted-push composer.
+ */
+function carriedFlags(baseArgv) {
+    const carried = [];
+    for (let i = 0; i < baseArgv.length; i++) {
+        const a = baseArgv[i];
+        if (a === "--hq-root" || a === "--on-conflict") {
+            carried.push(a);
+            if (baseArgv[i + 1] !== undefined)
+                carried.push(baseArgv[++i]);
+        }
     }
+    return carried;
 }
 if (isDirectInvocation) {
     runRunnerWithLoop(process.argv.slice(2))