@indigoai-us/hq-cli 5.108.1 → 5.108.3

package/dist/commands/mesh.js

@@ -5,9 +5,25 @@
  * require hq-pack-work-mesh on disk and does not start MQTT listen.
  * Distinct from `hq doctor` (hook guardrails).
  */
+import * as os from "node:os";
 import chalk from "chalk";
 import { loadCachedTokens } from "../utils/cognito-session.js";
-import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveThreads, patchStoryStatus, requireToken, resolveMeshCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+import * as readline from "node:readline/promises";
+import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveThreads, patchStoryStatus, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
+import { clearDefaultCompany, getDefaultCompany, readDeviceConfig, recordMigrationCapabilitySnapshot, setDefaultCompany, } from "../lib/work-context/config.js";
+import { DefaultCompanyLockedError, DefaultCompanyUnavailableError, } from "../lib/work-context/errors.js";
+import { isValidSessionId } from "../lib/mesh/live/session-identity.js";
+import { CLI_KIND_TO_SCHEMA, EnqueueValidationError, enqueueSessionEvent, } from "../lib/mesh/live/index.js";
+import { flushSessionEvents } from "../lib/mesh/live/flush.js";
+import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/live/session-events-client.js";
+import { workMeshRoot } from "../lib/mesh/live/paths.js";
+import { buildInstallPaths, collectDaemonDoctor, daemonServiceStatus, detectPlatform, formatDaemonDoctor, installDaemonService, runMeshDaemon, uninstallDaemonService, } from "../lib/mesh/live/daemon/index.js";
+import { workContextRoot } from "../lib/work-context/paths.js";
+import { formatMigrateConfirmation, submitSessionMigration, } from "../lib/work-context/migrate.js";
+import { formatOrganizeList, prepareOrganizeDecision, settleOrganizeAskWithoutBind, submitOrganizeDecision, } from "../lib/work-context/organize.js";
+import { readSessionState } from "../lib/work-context/state.js";
+import { loadObservationFromFile, markUntracked, parseObservationJson, reconcileObservation, } from "../lib/work-context/reconcile.js";
 export function formatCheckLines(threads, company, projectId) {
     if (threads.length === 0) {
         return ["Work mesh: no active project threads found."];
@@ -36,10 +52,12 @@ function requireProject(opts) {
         fail("`--project <slug>` is required.");
     return project;
 }
+/** Shared transport for existing mesh verbs (US-007A). */
 async function withCompany(opts) {
-    const token = await requireToken();
-    const company = await resolveMeshCompany(token, opts.company);
-    return { token, company };
+    return openMeshTransport(opts);
+}
+function workContextHomeRoot() {
+    return workContextRoot(os.homedir(), process.env);
 }
 async function runCheck(opts) {
     const { token, company } = await withCompany(opts);
@@ -107,6 +125,520 @@ async function runDoctor(opts) {
         ` (directory=${warmed.directory} inbox=${warmed.inbox}` +
         ` contacts=${warmed.contacts} pair-threads=${warmed.threads})`);
 }
+async function runContextReconcile(opts) {
+    if (!opts.observationFile && !opts.observationJson) {
+        fail("Provide --observation-file <path> or --observation-json <json>");
+    }
+    if (opts.observationFile && opts.observationJson) {
+        fail("Pass only one of --observation-file or --observation-json");
+    }
+    const obs = opts.observationFile
+        ? loadObservationFromFile(opts.observationFile)
+        : parseObservationJson(opts.observationJson);
+    const root = workContextHomeRoot();
+    let deliver;
+    let fetchCandidates;
+    let validateMembership;
+    let offline = Boolean(opts.offline);
+    if (!offline) {
+        try {
+            const token = await requireToken();
+            deliver = createWorkSessionDeliverer({ token });
+            fetchCandidates = createCandidatesFetcher({ token });
+            validateMembership = async (candidate) => {
+                const membership = await resolveActiveMembershipCompany(token, candidate);
+                if (!membership)
+                    return false;
+                return { uid: membership.companyUid };
+            };
+        }
+        catch {
+            offline = true;
+            if (!opts.machine) {
+                console.error(chalk.yellow("No Cognito session; reconciling offline (outbox only)."));
+            }
+        }
+    }
+    const outcome = await reconcileObservation(obs, {
+        root,
+        env: process.env,
+        deliver,
+        fetchCandidates,
+        offline,
+        validateMembership,
+    });
+    for (const line of outcome.diagnostics) {
+        console.error(line);
+    }
+    if (opts.machine) {
+        console.log(JSON.stringify(outcome.result));
+    }
+    else {
+        console.log(JSON.stringify(outcome.result, null, 2));
+    }
+    process.exitCode = outcome.exitCode;
+}
+async function runContextDefaultGet(opts) {
+    const root = workContextHomeRoot();
+    const cfg = readDeviceConfig({ root });
+    const current = getDefaultCompany({ root });
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, config: cfg, defaultCompany: current }, null, 2));
+        return;
+    }
+    if (!current) {
+        console.log("No device default company (default-company mode may be dark).");
+        return;
+    }
+    console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled}`);
+}
+async function runContextDefaultSet(slug, opts) {
+    const root = workContextHomeRoot();
+    void opts.company; // retained for CLI compatibility; unlock is memberships-wide
+    let token;
+    try {
+        token = await requireToken();
+    }
+    catch {
+        token = undefined;
+    }
+    // US-017B: unlock only when EVERY active membership advertises migration.
+    let migrationCapability = false;
+    if (token) {
+        const probe = await probeMigrationCapabilityForMemberships(token);
+        recordMigrationCapabilitySnapshot(probe, { root });
+        migrationCapability = probe.unlocked;
+        if (probe.offline && !opts.allowWithoutMigration) {
+            console.error(chalk.red("DEFAULT_COMPANY_LOCKED: cannot probe migration capability (offline or not logged in)"));
+            process.exitCode = 1;
+            return;
+        }
+        if (!probe.unlocked && !opts.allowWithoutMigration) {
+            const detail = probe.companies.length === 0
+                ? "no active memberships"
+                : probe.companies
+                    .filter((c) => !c.migration)
+                    .map((c) => c.companySlug || c.companyUid)
+                    .join(", ");
+            console.error(chalk.red(`DEFAULT_COMPANY_LOCKED: migration capability is not true for every company you belong to (${detail || "locked"})`));
+            process.exitCode = 1;
+            return;
+        }
+    }
+    else if (!opts.allowWithoutMigration) {
+        console.error(chalk.red("DEFAULT_COMPANY_LOCKED: cannot probe migration capability (no Cognito session)"));
+        process.exitCode = 1;
+        return;
+    }
+    if (!migrationCapability && opts.allowWithoutMigration) {
+        console.error(chalk.yellow("Warning: --allow-without-migration bypasses DEFAULT_COMPANY_LOCKED; a wrong default is hard to correct until migration is available for every company you belong to."));
+    }
+    try {
+        const cfg = await setDefaultCompany(slug, {
+            root,
+            migrationCapability,
+            allowWithoutMigration: opts.allowWithoutMigration,
+            validateMembership: async (candidate) => {
+                if (!token) {
+                    throw new DefaultCompanyUnavailableError(`Cannot verify membership for company "${candidate}" (no Cognito session; offline or not logged in)`);
+                }
+                let membership;
+                try {
+                    membership = await resolveActiveMembershipCompany(token, candidate);
+                }
+                catch (err) {
+                    throw new DefaultCompanyUnavailableError(`Cannot verify membership for company "${candidate}": ${err instanceof Error ? err.message : String(err)}`);
+                }
+                if (!membership) {
+                    return false;
+                }
+                return { uid: membership.companyUid };
+            },
+        });
+        if (opts.json) {
+            console.log(JSON.stringify({ ok: true, config: cfg }, null, 2));
+            return;
+        }
+        const stored = cfg.defaultCompany;
+        console.log(`Default company set to ${stored?.slug ?? slug}${stored?.uid ? ` (${stored.uid})` : ""}`);
+    }
+    catch (err) {
+        if (err instanceof DefaultCompanyLockedError ||
+            err instanceof DefaultCompanyUnavailableError) {
+            console.error(chalk.red(`${err.code}: ${err.message}`));
+            process.exitCode = 1;
+            return;
+        }
+        throw err;
+    }
+}
+async function defaultConfirm(message) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stderr,
+    });
+    try {
+        const answer = await rl.question(`${message}\nConfirm migrate? [y/N] `);
+        return /^y(es)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+/** Exported for confirmation-gate unit tests (US-017B). */
+export async function runContextCorrect(opts, deps = {}) {
+    const sessionId = opts.session?.trim();
+    if (!sessionId || !isValidSessionId(sessionId)) {
+        fail("`--session <sid>` is required and must be a valid session id");
+    }
+    const toCompany = opts.toCompany?.trim();
+    if (!toCompany) {
+        fail("`--to-company <slug>` is required");
+    }
+    const root = workContextHomeRoot();
+    const state = readSessionState(sessionId, root);
+    if (!state) {
+        fail(`No work-context state for session ${sessionId}`);
+    }
+    if (!state.companyUid) {
+        fail(`Session ${sessionId} has no verified companyUid; cannot migrate across companies`);
+    }
+    const token = await requireToken();
+    const dest = await resolveActiveMembershipCompany(token, toCompany);
+    if (!dest) {
+        fail(`Not an active member of destination company "${toCompany}" (or slug is ambiguous)`);
+    }
+    const destination = {};
+    if (opts.project?.trim())
+        destination.projectId = opts.project.trim();
+    if (opts.task?.trim())
+        destination.taskId = opts.task.trim();
+    const summary = formatMigrateConfirmation({
+        sessionId,
+        sourceCompanySlug: state.companySlug,
+        sourceCompanyUid: state.companyUid,
+        destinationCompanySlug: dest.companySlug,
+        destinationCompanyUid: dest.companyUid,
+        destination,
+    });
+    // Confirmation gate: without --yes or interactive yes, nothing is sent.
+    if (!opts.yes) {
+        const confirm = deps.confirm ?? defaultConfirm;
+        console.error(summary);
+        const ok = await confirm("Proceed with structured cross-company migration?");
+        if (!ok) {
+            if (opts.json || opts.machine) {
+                console.log(JSON.stringify({ ok: false, cancelled: true, action: "correct" }, null, opts.machine ? 0 : 2));
+            }
+            else {
+                console.error(chalk.yellow("Migration cancelled; nothing was sent."));
+            }
+            process.exitCode = 1;
+            return;
+        }
+    }
+    else {
+        console.error(summary);
+        console.error(chalk.dim("(--yes: confirmation skipped)"));
+    }
+    const expectedVersion = opts.expectedVersion !== undefined
+        ? Number.parseInt(opts.expectedVersion, 10)
+        : undefined;
+    if (opts.expectedVersion !== undefined &&
+        (!Number.isInteger(expectedVersion) || expectedVersion < 0)) {
+        fail("`--expected-version` must be a non-negative integer");
+    }
+    const postMigrate = createMigratePoster({ token });
+    const result = await submitSessionMigration({
+        sessionId,
+        root,
+        destinationCompanyUid: dest.companyUid,
+        destinationCompanySlug: dest.companySlug,
+        destination,
+        ...(expectedVersion !== undefined ? { expectedVersion } : {}),
+        postMigrate,
+    });
+    // Refresh capability snapshot opportunistically (unlock may now be relevant).
+    try {
+        const probe = await probeMigrationCapabilityForMemberships(token);
+        recordMigrationCapabilitySnapshot(probe, { root });
+    }
+    catch {
+        /* ignore */
+    }
+    if (!result.ok) {
+        console.error(chalk.red(`${result.errorCode ?? "MIGRATE_FAILED"}: ${result.message ?? "migrate failed"}`));
+        process.exitCode = 1;
+        if (opts.json || opts.machine) {
+            console.log(JSON.stringify({ ...result, ok: false, action: "correct" }, null, opts.machine ? 0 : 2));
+        }
+        return;
+    }
+    if (opts.json || opts.machine) {
+        console.log(JSON.stringify({ ...result, ok: true, action: "correct" }, null, opts.machine ? 0 : 2));
+        return;
+    }
+    const r = result.receipt;
+    console.log(`Work mesh: migrated ${sessionId} → ${dest.companySlug} (${r.destinationCompanyUid})` +
+        (r.destination.projectId ? ` project=${r.destination.projectId}` : "") +
+        (r.destination.taskId ? ` task=${r.destination.taskId}` : "") +
+        ` receipt=${r.receipt.operationId} (${r.receipt.status})`);
+}
+async function runContextDefaultClear(opts) {
+    const root = workContextHomeRoot();
+    const cfg = clearDefaultCompany({ root });
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, config: cfg }, null, 2));
+        return;
+    }
+    console.log("Default company cleared.");
+}
+async function runContextUntracked(sessionId, opts) {
+    if (!isValidSessionId(sessionId)) {
+        fail(`Invalid session id: ${sessionId}`);
+    }
+    const outcome = markUntracked(sessionId, { root: workContextHomeRoot() });
+    for (const line of outcome.diagnostics) {
+        console.error(line);
+    }
+    if (opts.machine) {
+        console.log(JSON.stringify(outcome.result));
+    }
+    else {
+        console.log(JSON.stringify(outcome.result, null, 2));
+    }
+    process.exitCode = outcome.exitCode;
+}
+async function runContextOrganize(opts) {
+    const sessionId = opts.session?.trim();
+    if (!sessionId || !isValidSessionId(sessionId)) {
+        fail("`--session <sid>` is required and must be a valid session id");
+    }
+    const root = workContextHomeRoot();
+    // Cancel / timeout / incapable → leave unresolved; never invent a project.
+    if (opts.cancel || opts.settle) {
+        const reason = opts.settle === "timeout"
+            ? "timeout"
+            : opts.settle === "incapable"
+                ? "incapable"
+                : "cancelled";
+        const state = settleOrganizeAskWithoutBind({ sessionId, root, reason });
+        if (opts.json || opts.machine) {
+            console.log(JSON.stringify({ ok: true, action: "settle", reason, state }, null, opts.machine ? 0 : 2));
+            return;
+        }
+        console.log(`Work mesh: session ${sessionId} left unresolved (${reason}); ask will not repeat.`);
+        return;
+    }
+    const isList = opts.list ||
+        (!opts.decision &&
+            !opts.option &&
+            !opts.createProject &&
+            !opts.createTask &&
+            !opts.untracked);
+    if (isList) {
+        let fetchCandidates;
+        let offline = Boolean(opts.offline);
+        if (!offline) {
+            try {
+                const token = await requireToken();
+                fetchCandidates = createCandidatesFetcher({ token });
+            }
+            catch {
+                offline = true;
+            }
+        }
+        const listed = await prepareOrganizeDecision({
+            sessionId,
+            root,
+            fetchCandidates,
+            offline,
+        });
+        if (opts.json || opts.machine) {
+            console.log(JSON.stringify({ ok: true, action: "list", ...listed }, null, opts.machine ? 0 : 2));
+            return;
+        }
+        for (const line of formatOrganizeList(listed)) {
+            console.log(line);
+        }
+        return;
+    }
+    let postOrganize;
+    if (!opts.untracked && !opts.offline) {
+        try {
+            const token = await requireToken();
+            postOrganize = createOrganizePoster({ token });
+        }
+        catch {
+            fail("Cognito session required to submit organize (server receipt only)");
+        }
+    }
+    const submitted = await submitOrganizeDecision({
+        sessionId,
+        root,
+        decisionId: opts.decision,
+        optionId: opts.option,
+        createProjectTitle: opts.createProject,
+        createTaskTitle: opts.createTask,
+        untracked: opts.untracked,
+        postOrganize,
+    });
+    if (!submitted.ok) {
+        console.error(chalk.red(`${submitted.errorCode ?? "ORGANIZE_FAILED"}: ${submitted.message ?? "organize failed"}`));
+        process.exitCode = 1;
+        if (opts.json || opts.machine) {
+            console.log(JSON.stringify({ ...submitted, ok: false, action: "submit" }, null, opts.machine ? 0 : 2));
+        }
+        return;
+    }
+    if (opts.json || opts.machine) {
+        console.log(JSON.stringify({ ...submitted, ok: true, action: "submit" }, null, opts.machine ? 0 : 2));
+        return;
+    }
+    if (submitted.localUntracked) {
+        console.log(`Work mesh: session ${sessionId} marked untracked (local receipt only)`);
+        return;
+    }
+    const r = submitted.receipt;
+    console.log(`Work mesh: organized ${sessionId} → ${r.projectId}` +
+        (r.taskId ? `/${r.taskId}` : "") +
+        ` receipt=${r.receipt.operationId} (${r.receipt.status})`);
+}
+async function runSessionStatus(opts) {
+    if (!opts.company?.trim()) {
+        fail("`--company <slug>` is required for `hq mesh session status`");
+    }
+    const { token, company } = await withCompany({ company: opts.company });
+    const live = await fetchCompanyLive(token, company.companyUid);
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: "session-status", company, live }, null, 2));
+        return;
+    }
+    for (const line of formatCompanyLiveTable(live, company.companySlug || company.companyUid)) {
+        console.log(line);
+    }
+}
+const HARNESSES = new Set([
+    "claude-code",
+    "codex",
+    "grok",
+    "hq-sessions",
+    "agent-box",
+]);
+function workMeshHomeRoot() {
+    return workMeshRoot(os.homedir(), process.env);
+}
+async function runSessionEnqueue(cliKind, opts) {
+    if (!opts.enqueue) {
+        fail("`hq mesh session …` requires --enqueue (local spool append; no network).");
+    }
+    const kind = CLI_KIND_TO_SCHEMA[cliKind];
+    if (!kind)
+        fail(`Unknown session verb: ${cliKind}`);
+    const harness = (opts.harness?.trim() || "");
+    if (!HARNESSES.has(harness)) {
+        fail("--harness is required (claude-code|codex|grok|hq-sessions|agent-box)");
+    }
+    const adapterVersion = opts.adapterVersion?.trim();
+    if (!adapterVersion)
+        fail("--adapter-version is required");
+    const seq = Number(opts.seq);
+    if (!Number.isInteger(seq) || seq < 1)
+        fail("--seq must be an integer >= 1");
+    let toolWrites;
+    if (opts.toolWrites !== undefined) {
+        toolWrites = Number(opts.toolWrites);
+        if (!Number.isInteger(toolWrites) || toolWrites < 0) {
+            fail("--tool-writes must be an integer >= 0");
+        }
+    }
+    try {
+        const result = enqueueSessionEvent({
+            kind: kind,
+            sessionId: opts.sessionId,
+            harness,
+            adapterVersion,
+            runtimeVersion: opts.runtimeVersion,
+            seq,
+            eventId: opts.eventId,
+            at: opts.at,
+            taskId: opts.taskId,
+            status: opts.status,
+            reason: opts.reason,
+            summary: opts.summary,
+            cwd: opts.cwd,
+            hqRoot: opts.hqRoot,
+            companySlug: opts.companySlug,
+            project: opts.project,
+            task: opts.task,
+            toolWrites,
+            root: workMeshHomeRoot(),
+            env: process.env,
+        });
+        if (opts.json) {
+            console.log(JSON.stringify({
+                ok: true,
+                action: "enqueue",
+                kind,
+                spoolPath: result.spoolPath,
+                eventId: result.event.eventId,
+            }, null, 2));
+            return;
+        }
+        // Quiet success for hooks/scripts — eventId on stderr only when not json.
+        console.error(`work-mesh: enqueued ${kind} ${result.event.eventId}`);
+    }
+    catch (err) {
+        if (err instanceof EnqueueValidationError) {
+            console.error(chalk.red(`enqueue validation failed: ${err.message}`));
+            process.exitCode = 1;
+            return;
+        }
+        throw err;
+    }
+}
+async function runSessionFlush(opts) {
+    const token = await requireToken();
+    const poster = createSessionEventsPoster({
+        token,
+        baseUrl: resolveVaultApiBase(process.env),
+    });
+    const summary = await flushSessionEvents({
+        workMeshRoot: workMeshHomeRoot(),
+        workContextRoot: workContextHomeRoot(),
+        poster,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: "flush", ...summary }, null, 2));
+        return;
+    }
+    console.log(`work-mesh flush: claimed=${summary.claimed} posted=${summary.posted}` +
+        ` held=${summary.held} dropped=${summary.dropped}` +
+        ` deadLettered=${summary.deadLettered} restored=${summary.restored}` +
+        ` batches=${summary.batches}`);
+}
+function addSessionEnqueueFlags(cmd) {
+    return cmd
+        .option("--enqueue", "Append one line to ~/.hq/work-mesh/spool.jsonl (no network)")
+        .option("--session-id <id>", "Session id (else HQ_SESSION_ID / harness env)")
+        .option("--harness <name>", "claude-code|codex|grok|hq-sessions|agent-box")
+        .option("--adapter-version <ver>", "Hook / adapter version")
+        .option("--runtime-version <ver>", "Host runtime version")
+        .option("--seq <n>", "Monotonic per-session sequence (>= 1)")
+        .option("--event-id <ulid>", "Explicit event ULID (default: generate)")
+        .option("--at <iso>", "Event timestamp (default: now)")
+        .option("--task-id <id>", "Canonical task id")
+        .option("--status <status>", "queued|in_progress|review|done")
+        .option("--reason <text>", "Blocked reason (max 500)")
+        .option("--summary <text>", "Short summary (max 280)")
+        .option("--cwd <path>", "Local-only working directory")
+        .option("--hq-root <path>", "Local-only HQ tree root")
+        .option("--company-slug <slug>", "Local-only company slug hint")
+        .option("--project <name>", "Local-only project hint")
+        .option("--task <label>", "Local-only task label hint")
+        .option("--tool-writes <n>", "Local-only tool write count")
+        .option("--json", "Print machine-readable JSON");
+}
 function wrap(action) {
     return async () => {
         try {
@@ -169,5 +701,201 @@ export function registerMeshCommand(program) {
         .option("--apply", "Reserved — Board PUTs from local prd are not in the CLI yet")
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runDoctor(opts))());
+    const context = mesh
+        .command("context")
+        .description("Work context reconcile, organize, correct, device default, and untracked consent");
+    context
+        .command("reconcile")
+        .description("Resolve session identity and company; durable local accept before network")
+        .option("--observation-file <path>", "Path to a SessionObservation JSON file")
+        .option("--observation-json <json>", "SessionObservation as a JSON string")
+        .option("--machine", "Write exactly one ContextResult JSON line to stdout")
+        .option("--offline", "Skip network; leave register operations queued in the outbox")
+        .action((opts) => wrap(() => runContextReconcile(opts))());
+    context
+        .command("organize")
+        .description("List or submit one-time project/task decisions (US-007B / US-005B)")
+        .argument("[action]", "Pass 'list' to print pending decisions (default when no submit flags)")
+        .requiredOption("--session <sid>", "Canonical session id")
+        .option("--list", "List pending decisions (same as action list)")
+        .option("--decision <decisionId>", "Pending decision id")
+        .option("--option <optionId>", "Stable option id from the pending decision")
+        .option("--create-project <title>", "Create a new project then bind")
+        .option("--create-task <title>", "Create a new task on the session project then bind")
+        .option("--untracked", "Mark the session untracked (local receipt only)")
+        .option("--cancel", "Settle ask without binding (leave unresolved; never repeat)")
+        .option("--settle <reason>", "Settle ask: cancelled|timeout|incapable (leave unresolved)")
+        .option("--offline", "Do not fetch candidates / submit to server")
+        .option("--json", "Print machine-readable JSON")
+        .option("--machine", "Compact JSON on stdout")
+        .action((action, opts) => wrap(() => runContextOrganize({
+        ...opts,
+        list: opts.list || action === "list",
+    }))());
+    context
+        .command("correct")
+        .description("Explicit cross-company session correction via server migrate (US-017B)")
+        .requiredOption("--session <sid>", "Canonical session id")
+        .requiredOption("--to-company <slug>", "Destination company slug")
+        .option("--project <id>", "Optional destination project id")
+        .option("--task <id>", "Optional destination task id")
+        .option("--expected-version <n>", "OCC expectedVersion (defaults to local state version or 0)")
+        .option("-y, --yes", "Skip the interactive confirmation prompt (for scripts)")
+        .option("--json", "Print machine-readable JSON")
+        .option("--machine", "Compact JSON on stdout")
+        .action((opts) => wrap(() => runContextCorrect(opts))());
+    const def = context
+        .command("default")
+        .description("Manage the device-local default company preference");
+    def
+        .command("get")
+        .description("Show the device default company (never activeCompany)")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runContextDefaultGet(opts))());
+    def
+        .command("set")
+        .description("Set the device default company slug (unlocked when migration is true for every membership)")
+        .argument("<slug>", "Company slug")
+        .option("--allow-without-migration", "Bypass DEFAULT_COMPANY_LOCKED with a warning")
+        .option("--company <slug|uid>", "Deprecated no-op; unlock probes every active membership")
+        .option("--json", "Print machine-readable JSON")
+        .action((slug, opts) => wrap(() => runContextDefaultSet(slug, opts))());
+    def
+        .command("clear")
+        .description("Clear the device default company")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runContextDefaultClear(opts))());
+    context
+        .command("untracked")
+        .description("Record an explicit user-origin untracked consent receipt (local only)")
+        .argument("<sessionId>", "Canonical session id")
+        .option("--machine", "Write exactly one ContextResult JSON line to stdout")
+        .action((sessionId, opts) => wrap(() => runContextUntracked(sessionId, opts))());
+    const session = mesh
+        .command("session")
+        .description("Local session-event spool: enqueue (printf-compatible), flush, and live status");
+    const sessionVerbs = [
+        { name: "start", description: "Enqueue session_start" },
+        { name: "turn-start", description: "Enqueue turn_start" },
+        { name: "turn-end", description: "Enqueue turn_end" },
+        { name: "end", description: "Enqueue session_end" },
+        { name: "task-status", description: "Enqueue task_status" },
+        { name: "blocked", description: "Enqueue blocked" },
+        { name: "note", description: "Enqueue note" },
+    ];
+    for (const verb of sessionVerbs) {
+        addSessionEnqueueFlags(session.command(verb.name).description(verb.description)).action((opts) => wrap(() => runSessionEnqueue(verb.name, opts))());
+    }
+    session
+        .command("flush")
+        .description("Claim spool/held by rename, hold or drop by context state, POST batches of ≤100")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runSessionFlush(opts))());
+    session
+        .command("status")
+        .description("Print the company-wide live read (US-004) as a table or --json")
+        .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runSessionStatus(opts))());
+    const daemon = mesh
+        .command("daemon")
+        .description("Resident spool drainer + MQTT presence (install as a user service)");
+    daemon
+        .command("run")
+        .description("Start the single-instance daemon (pid lock, spool watch, presence)")
+        .action(() => wrap(() => runDaemonRun())());
+    daemon
+        .command("install")
+        .description("Install LaunchAgent (macOS) or systemd user unit (Linux)")
+        .option("--system-user <user>", "Write a root-owned unit template for agent boxes (e.g. ec2-user)")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runDaemonInstall(opts))());
+    daemon
+        .command("uninstall")
+        .description("Remove the installed user-level daemon service")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runDaemonUninstall(opts))());
+    daemon
+        .command("status")
+        .description("Show whether the daemon service is installed/loaded")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runDaemonStatus(opts))());
+    daemon
+        .command("doctor")
+        .description("Report daemon running/MQTT/spool/held/dead-letter/outbox/flush health")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runDaemonDoctorCmd(opts))());
+}
+async function runDaemonRun() {
+    const handle = await runMeshDaemon();
+    // Stay alive until signal handlers call stop + exit.
+    await new Promise(() => {
+        void handle;
+    });
+}
+async function runDaemonInstall(opts) {
+    const result = installDaemonService({
+        platform: detectPlatform(),
+        paths: buildInstallPaths({ systemUser: opts.systemUser }),
+        systemUser: opts.systemUser,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify({
+            ok: true,
+            action: result.action,
+            platform: result.platform,
+            dest: result.dest,
+            message: result.message,
+        }, null, 2));
+        return;
+    }
+    console.log(result.message);
+}
+async function runDaemonUninstall(opts) {
+    const result = uninstallDaemonService({
+        platform: detectPlatform(),
+        paths: buildInstallPaths({}),
+    });
+    if (opts.json) {
+        console.log(JSON.stringify({
+            ok: true,
+            action: result.action,
+            platform: result.platform,
+            dest: result.dest,
+            message: result.message,
+        }, null, 2));
+        return;
+    }
+    console.log(result.message);
+}
+async function runDaemonStatus(opts) {
+    const result = daemonServiceStatus({
+        platform: detectPlatform(),
+        paths: buildInstallPaths({}),
+    });
+    if (opts.json) {
+        console.log(JSON.stringify({
+            ok: true,
+            action: result.action,
+            platform: result.platform,
+            running: result.running ?? false,
+            dest: result.dest,
+            message: result.message,
+        }, null, 2));
+        return;
+    }
+    console.log(result.message);
+}
+async function runDaemonDoctorCmd(opts) {
+    const report = collectDaemonDoctor();
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: !report.unhealthy, ...report }, null, 2));
+        return;
+    }
+    for (const line of formatDaemonDoctor(report)) {
+        console.log(line);
+    }
+    if (report.unhealthy)
+        process.exitCode = 1;
 }
 //# sourceMappingURL=mesh.js.map