@indigoai-us/hq-cli 5.108.22 → 5.108.24

package/CHANGELOG.md

@@ -2,6 +2,55 @@
 
 ## [Unreleased]
 
+## [5.108.24] — 2026-09-08
+
+### Added
+
+- `hq sync doctor --reconcile-conflicts [--yes]` folds legacy sibling
+  `.conflict-<ts>-<machine>` twins back into their live files (higher
+  frontmatter `version:` wins, else newer mtime), parks the losing side under
+  `.hq/conflict-backups/`, and surfaces undecidable pairs for manual review.
+  Dry-run by default; `--yes` applies.
+
+### Changed
+
+- Bump `@indigoai-us/hq-cloud` to 6.16.28: sync no longer writes sibling
+  `.conflict-*` twins on conflict and instead picks the higher `version:`
+  frontmatter side, parking the loser under `.hq/conflict-backups/`.
+
+## [5.108.23] — 2026-09-08
+
+### Added
+
+- `hq mesh context requeue` flips AUTH_DENIED-quarantined work-context outbox
+  operations (registrations, reconciles) back to queued so a box whose
+  registrations were denied before the ID-token fix recovers without a manual
+  reset (gap 10, #539).
+- `hq mesh context backfill-held` reconciles each unattributed held session
+  through the shared company resolver so the daemon's held retry can drain the
+  ended-session backlog that would otherwise never re-attribute. Opt-in and
+  per-box, with `--dry-run`/`--offline`/`--limit`/`--company`/`--json` (gap 2b,
+  #540).
+
+### Fixed
+
+- Work-context commands (`hq mesh context reconcile`/register) on agent boxes now
+  authenticate with the machine ID token, matching the presence daemon, instead
+  of the access token the server cannot attribute to the agent entity (which
+  answered 403 NO_PERSON_ENTITY and quarantined registrations as AUTH_DENIED).
+  requireToken() mints the machine ID token whenever the box is a machine
+  identity (gap 10, #539).
+- Work Mesh Live session events that carry the `agents-v2` runtime harness are
+  accepted by the shared session-event schema instead of being rejected as
+  SCHEMA_INVALID and dead-lettered; both copies of the schema stay byte-identical
+  (gap 9, #541).
+
+### Testing
+
+- The held-TTL flush tests (`HELD_OVERFLOW`, the 150k mid-flush-throw) inject a
+  deterministic clock instead of the real wall clock, so they no longer flip red
+  the moment the hardcoded `heldAt` fixtures cross the 7-day held TTL (#542).
+
 ## [5.108.22] — 2026-09-07
 
 ### Fixed

package/dist/commands/cloud.d.ts

@@ -336,6 +336,16 @@ export interface PerCompanyPullResolveResult {
 }
 export declare function resolvePerCompanyPullPlan(client: PerCompanyPullResolveClient, targetCompany: string | undefined): Promise<PerCompanyPullResolveResult>;
 export declare function registerCloudCommands(program: Command): void;
+/**
+ * `hq sync doctor --reconcile-conflicts [--yes]`.
+ *
+ * Reconcile mode is purely local — the engine walks the HQ root for legacy
+ * sibling conflict twins and never touches the vault — but the engine's
+ * `SyncDoctorOptions` type still requires `entity` / `vaultConfig` for its
+ * skill-key dedupe mode. Placeholders are passed; the reconcile branch returns
+ * before either is read (verified against hq-cloud's `doctor.js`).
+ */
+export declare function runSyncDoctorReconcileConflicts(hqRoot: string, yes: boolean): Promise<void>;
 /** Exported for the US-003 sync-health exit-path regression test. */
 export declare function runPullPersonal(hqRoot: string, onConflict?: ConflictStrategy): Promise<void>;
 //# sourceMappingURL=cloud.d.ts.map

package/dist/commands/cloud.js

@@ -15,7 +15,7 @@
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
-import { share, sync, getStateDir, listJournals, loadCachedTokens, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, } from "@indigoai-us/hq-cloud";
+import { share, sync, getStateDir, listJournals, loadCachedTokens, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, syncDoctor, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 import { companyFolderExceedsThreshold, emitNarrowHint, isStrictRefusal, resolveBannerLevel, resolveNarrowHintPresentationLevel, resolveNarrowHintMinBytes, } from "../lib/narrow-hint-banner.js";
 import { beginSyncHealthReport, } from "../utils/client-health.js";
@@ -1098,6 +1098,81 @@ export function registerCloudCommands(program) {
             process.exit(1);
         }
     });
+    program
+        .command("doctor")
+        .description("Repair the local HQ tree. `--reconcile-conflicts` folds legacy " +
+        "sibling `.conflict-*` twins back into their live files (higher " +
+        "frontmatter `version:` wins; losers are parked under " +
+        ".hq/conflict-backups/). Dry-run unless --yes.")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .option("--reconcile-conflicts", "Reconcile legacy sibling `.conflict-<ts>-<machine>` twins against " +
+        "their live files (purely local; no vault access).")
+        .option("--yes", "Apply the plan (default: dry-run, print only)")
+        .action(async (options) => {
+        try {
+            if (!options.reconcileConflicts) {
+                console.error(chalk.red("✗ hq sync doctor:"), "only `--reconcile-conflicts` mode is supported right now.");
+                console.error(chalk.dim("  Usage: hq sync doctor --reconcile-conflicts [--yes] [--hq-root <path>]"));
+                process.exit(1);
+                return;
+            }
+            await runSyncDoctorReconcileConflicts(options.hqRoot, options.yes === true);
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Sync doctor failed:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+/**
+ * `hq sync doctor --reconcile-conflicts [--yes]`.
+ *
+ * Reconcile mode is purely local — the engine walks the HQ root for legacy
+ * sibling conflict twins and never touches the vault — but the engine's
+ * `SyncDoctorOptions` type still requires `entity` / `vaultConfig` for its
+ * skill-key dedupe mode. Placeholders are passed; the reconcile branch returns
+ * before either is read (verified against hq-cloud's `doctor.js`).
+ */
+export async function runSyncDoctorReconcileConflicts(hqRoot, yes) {
+    console.log(chalk.bold("\nHQ Sync — Doctor (reconcile conflicts)"));
+    console.log(`  HQ root: ${hqRoot}`);
+    console.log(`  Mode:    ${yes ? "apply (--yes)" : "dry-run (pass --yes to apply)"}`);
+    console.log("");
+    const result = await syncDoctor({
+        entity: "local",
+        vaultConfig: {},
+        hqRoot,
+        yes,
+        reconcileConflicts: true,
+    });
+    const twins = result.conflictTwins;
+    const backupsDir = path.join(hqRoot, ".hq", "conflict-backups");
+    console.log(chalk.bold(twins?.applied ? "\nReconcile — applied" : "\nReconcile — dry-run (nothing written)"));
+    console.log(`  Twins found:     ${twins?.plan.length ?? 0}`);
+    console.log(`  Promoted:        ${twins?.promoted ?? 0}`);
+    console.log(`  Kept live:       ${twins?.removed ?? 0}`);
+    console.log(`  Backed up:       ${twins?.backedUp ?? 0}`);
+    console.log(`  Orphans parked:  ${twins?.orphansParked ?? 0}`);
+    console.log(`  Index rows dropped: ${twins?.indexRowsDropped ?? 0}`);
+    if ((twins?.warnings ?? result.warnings) > 0) {
+        console.log(chalk.yellow(`  Warnings:        ${twins?.warnings ?? result.warnings}`));
+    }
+    const manual = twins?.manualReview ?? [];
+    if (manual.length > 0) {
+        console.log(chalk.yellow(`\n  Manual review (${manual.length}) — NOT auto-resolved:`));
+        for (const item of manual) {
+            console.log(`    • ${item.livePath}`);
+            console.log(chalk.dim(`        twin:   ${item.twinPath}`));
+            console.log(chalk.dim(`        reason: ${item.reason}`));
+            if (item.backupPath) {
+                console.log(chalk.dim(`        backup: ${item.backupPath}`));
+            }
+        }
+    }
+    console.log(chalk.dim(`\n  Backups live under: ${backupsDir}`));
+    if (!twins?.applied) {
+        console.log(chalk.dim("  Re-run with --yes to apply the plan above."));
+    }
 }
 async function runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink) {
     console.log(chalk.bold("\nHQ Sync — Pull (all)"));

package/dist/commands/mesh.js

@@ -7,15 +7,16 @@
  */
 import * as os from "node:os";
 import chalk from "chalk";
-import { loadCachedTokens } from "../utils/cognito-session.js";
+import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
-import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveThreads, patchStoryStatus, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveMembershipCompanies, listActiveThreads, patchStoryStatus, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
 import { clearDefaultCompany, getDefaultCompany, readDeviceConfig, recordMigrationCapabilitySnapshot, setDefaultCompany, } from "../lib/work-context/config.js";
 import { DefaultCompanyLockedError, DefaultCompanyUnavailableError, } from "../lib/work-context/errors.js";
 import { isValidSessionId } from "../lib/mesh/live/session-identity.js";
 import { CLI_KIND_TO_SCHEMA, EnqueueValidationError, enqueueSessionEvent, } from "../lib/mesh/live/index.js";
 import { flushSessionEvents } from "../lib/mesh/live/flush.js";
+import { backfillHeldSessions } from "../lib/mesh/live/backfill-held.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/live/session-events-client.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
 import { buildInstallPaths, collectDaemonDoctor, daemonServiceStatus, detectPlatform, formatDaemonDoctor, installDaemonService, readDaemonState, runMeshDaemon, uninstallDaemonService, daemonDir, } from "../lib/mesh/live/daemon/index.js";
@@ -24,6 +25,10 @@ import { formatMigrateConfirmation, submitSessionMigration, } from "../lib/work-
 import { formatOrganizeList, prepareOrganizeDecision, settleOrganizeAskWithoutBind, submitOrganizeDecision, } from "../lib/work-context/organize.js";
 import { readSessionState } from "../lib/work-context/state.js";
 import { loadObservationFromFile, markUntracked, parseObservationJson, reconcileObservation, } from "../lib/work-context/reconcile.js";
+import { resolveCompany } from "../lib/work-context/company.js";
+import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../lib/work-context/repo-remote.js";
+import { promptRepoCompany, } from "../lib/work-context/repo-prompt.js";
+import { requeueQuarantinedOutbox } from "../lib/work-context/outbox.js";
 export function formatCheckLines(threads, company, projectId) {
     if (threads.length === 0) {
         return ["Work mesh: no active project threads found."];
@@ -178,6 +183,172 @@ async function runContextReconcile(opts) {
     }
     process.exitCode = outcome.exitCode;
 }
+/**
+ * `hq mesh context resolve` — interactive per-repo company prompt (gap 4).
+ *
+ * Owner decision: "Always ask per repo". When a person session is unresolved
+ * (needs_company) and this is an interactive person TTY, ask ONCE which company
+ * this repo's work is filed under, then remember it (persisted repo→company
+ * map). Never prompts on machine / agent-box identities (they resolve from the
+ * identity file) or in non-interactive / --json / --machine contexts — those
+ * fall through to needs_company exactly as before.
+ */
+async function runContextResolve(opts) {
+    const sessionId = opts.session?.trim();
+    if (!sessionId || !isValidSessionId(sessionId)) {
+        fail("`--session <sid>` is required and must be a valid session id");
+    }
+    const root = workContextHomeRoot();
+    const cwd = opts.cwd?.trim() || process.cwd();
+    const hqRoot = opts.hqRoot?.trim() || undefined;
+    const jsonMode = Boolean(opts.json || opts.machine);
+    const emit = (payload) => {
+        if (jsonMode) {
+            console.log(JSON.stringify(payload, null, opts.machine ? 0 : 2));
+        }
+    };
+    // Only prompt when the deterministic resolver leaves the session unresolved.
+    const remoteOwnerSlug = deriveRemoteOwnerSlug({ cwd, hqRoot }) ?? undefined;
+    const repoIdentityKey = deriveRepoIdentityKey({ cwd });
+    const resolution = resolveCompany({
+        root,
+        sessionId,
+        env: process.env,
+        cwd,
+        hqRoot,
+        remoteOwnerSlug,
+        repoIdentityKey,
+    });
+    if (resolution.status === "resolved") {
+        const c = resolution.company;
+        if (!jsonMode) {
+            console.error(chalk.dim(`Company already resolved via ${c.source}: ${c.slug ?? c.uid}`));
+        }
+        emit({ ok: true, status: "resolved", already: true, company: c });
+        return;
+    }
+    if (resolution.status === "company_conflict") {
+        if (!jsonMode) {
+            console.error(chalk.yellow("Company conflict — resolve with `hq mesh context correct`, not the per-repo prompt."));
+        }
+        emit({ ok: false, ...resolution });
+        process.exitCode = 1;
+        return;
+    }
+    // needs_company → interactive per-repo prompt (gated inside promptRepoCompany).
+    const outcome = await promptRepoCompany({
+        root,
+        cwd,
+        isMachineIdentity: () => isMachineIdentity(),
+        isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY) && !jsonMode,
+        listMemberships: async () => {
+            const token = await requireToken();
+            return listActiveMembershipCompanies(token);
+        },
+        ask: async (question) => {
+            const rl = readline.createInterface({
+                input: process.stdin,
+                output: process.stderr,
+            });
+            try {
+                return await rl.question(question);
+            }
+            finally {
+                rl.close();
+            }
+        },
+    });
+    if (outcome.status === "resolved") {
+        if (!jsonMode) {
+            const verb = outcome.alreadyMapped ? "already filed under" : "filed under";
+            console.error(chalk.green(`This repo is ${verb} ${outcome.company.slug}` +
+                `${outcome.company.uid ? ` (${outcome.company.uid})` : ""}.`));
+        }
+        emit({ ok: true, ...outcome });
+        return;
+    }
+    // Skipped — fall through to needs_company exactly as today.
+    if (!jsonMode) {
+        const reasons = {
+            machine: "Machine/agent-box identity — company comes from the identity file.",
+            non_interactive: "Non-interactive context — no prompt; session stays needs_company.",
+            no_repo_key: "Not inside a git repo — nothing to remember; needs_company.",
+            no_memberships: "No active memberships to choose from; needs_company.",
+            cancelled: "No selection made; session stays needs_company.",
+        };
+        console.error(chalk.dim(reasons[outcome.reason] ?? "needs_company"));
+    }
+    emit({ ok: true, status: "needs_company", skipped: outcome.reason });
+}
+async function runContextBackfillHeld(opts) {
+    const root = workContextHomeRoot();
+    const meshRoot = workMeshRoot(undefined, process.env);
+    const dryRun = Boolean(opts.dryRun);
+    const parsedLimit = opts.limit ? Number.parseInt(opts.limit, 10) : 0;
+    const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : 0;
+    const companyHint = opts.company?.trim() || undefined;
+    // Build the reconcile network seam exactly like `hq mesh context reconcile`.
+    // Not needed in --dry-run (reconcile is never invoked then). Explicit types
+    // because these are captured in the reconcile closure below (no control-flow
+    // narrowing, unlike the inline reconcile handler).
+    let deliver;
+    let fetchCandidates;
+    let validateMembership;
+    let offline = Boolean(opts.offline);
+    if (!dryRun && !offline) {
+        try {
+            const token = await requireToken();
+            deliver = createWorkSessionDeliverer({ token });
+            fetchCandidates = createCandidatesFetcher({ token });
+            validateMembership = async (candidate) => {
+                const membership = await resolveActiveMembershipCompany(token, candidate);
+                if (!membership)
+                    return false;
+                return { uid: membership.companyUid };
+            };
+        }
+        catch {
+            offline = true;
+            if (!opts.json) {
+                console.error(chalk.yellow("No Cognito session; reconciling offline (outbox only)."));
+            }
+        }
+    }
+    const result = await backfillHeldSessions({
+        workMeshRoot: meshRoot,
+        workContextRoot: root,
+        dryRun,
+        limit,
+        reconcile: (obs) => reconcileObservation(
+        // Pass --company as a non-forcing hint (remoteOwnerSlug feeds
+        // deterministic resolution BELOW the identity-file / device default,
+        // so the shared resolver still wins, as in normal reconcile).
+        companyHint ? { ...obs, remoteOwnerSlug: companyHint } : obs, {
+            root,
+            env: process.env,
+            deliver,
+            fetchCandidates,
+            offline,
+            validateMembership,
+        }),
+    });
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: "backfill-held", ...result }, null, 2));
+        return;
+    }
+    const verb = dryRun ? "would reconcile" : "reconciled";
+    console.log(`Backfill held: scanned ${result.scanned} session(s)` +
+        `${limit > 0 ? ` (considered ${result.considered})` : ""}; ` +
+        `${result.alreadyAttributed} already attributed, ` +
+        `${verb} ${result.reconciled}, ` +
+        `${result.unresolved} unresolved, ` +
+        `${result.errors} error(s).` +
+        (dryRun ? " (dry-run: nothing written)" : ""));
+    if (!dryRun && result.reconciled > 0) {
+        console.log("Reconciled session state files were rewritten with a resolved company; " +
+            "the mesh daemon's held retry will re-attribute and post those events.");
+    }
+}
 async function runContextDefaultGet(opts) {
     const root = workContextHomeRoot();
     const cfg = readDeviceConfig({ root });
@@ -393,6 +564,30 @@ async function runContextDefaultClear(opts) {
     }
     console.log("Default company cleared.");
 }
+async function runContextRequeue(opts) {
+    const root = workContextHomeRoot();
+    // Default: only AUTH_DENIED (the gap 10 regression). --all clears the code
+    // filter entirely; --error-code targets one specific lastErrorCode.
+    const errorCode = opts.all
+        ? null
+        : opts.errorCode?.trim()
+            ? opts.errorCode.trim()
+            : undefined;
+    const requeued = requeueQuarantinedOutbox(root, { errorCode });
+    if (opts.json) {
+        console.log(JSON.stringify({
+            ok: true,
+            requeued: requeued.length,
+            errorCode: errorCode === undefined ? "AUTH_DENIED" : errorCode,
+            operationIds: requeued.map((op) => op.operationId),
+        }, null, 2));
+        return;
+    }
+    const scope = errorCode === null
+        ? "all quarantine reasons"
+        : `lastErrorCode=${errorCode === undefined ? "AUTH_DENIED" : errorCode}`;
+    console.log(`Requeued ${requeued.length} quarantined outbox operation${requeued.length === 1 ? "" : "s"} (${scope}). The mesh daemon will retry them on its next replay.`);
+}
 async function runContextUntracked(sessionId, opts) {
     if (!isValidSessionId(sessionId)) {
         fail(`Invalid session id: ${sessionId}`);
@@ -524,6 +719,7 @@ const HARNESSES = new Set([
     "grok",
     "hq-sessions",
     "agent-box",
+    "agents-v2",
 ]);
 function workMeshHomeRoot() {
     return workMeshRoot(os.homedir(), process.env);
@@ -537,7 +733,7 @@ async function runSessionEnqueue(cliKind, opts) {
         fail(`Unknown session verb: ${cliKind}`);
     const harness = (opts.harness?.trim() || "");
     if (!HARNESSES.has(harness)) {
-        fail("--harness is required (claude-code|codex|grok|hq-sessions|agent-box)");
+        fail("--harness is required (claude-code|codex|grok|hq-sessions|agent-box|agents-v2)");
     }
     const adapterVersion = opts.adapterVersion?.trim();
     if (!adapterVersion)
@@ -621,7 +817,7 @@ function addSessionEnqueueFlags(cmd) {
     return cmd
         .option("--enqueue", "Append one line to ~/.hq/work-mesh/spool.jsonl (no network)")
         .option("--session-id <id>", "Session id (else HQ_SESSION_ID / harness env)")
-        .option("--harness <name>", "claude-code|codex|grok|hq-sessions|agent-box")
+        .option("--harness <name>", "claude-code|codex|grok|hq-sessions|agent-box|agents-v2")
         .option("--adapter-version <ver>", "Hook / adapter version")
         .option("--runtime-version <ver>", "Host runtime version")
         .option("--seq <n>", "Monotonic per-session sequence (>= 1)")
@@ -712,6 +908,24 @@ export function registerMeshCommand(program) {
         .option("--machine", "Write exactly one ContextResult JSON line to stdout")
         .option("--offline", "Skip network; leave register operations queued in the outbox")
         .action((opts) => wrap(() => runContextReconcile(opts))());
+    context
+        .command("resolve")
+        .description("Interactively ask (once per repo) which company this repo's work is filed under, and remember it (gap 4). Person TTYs only — never agent boxes / non-interactive.")
+        .requiredOption("--session <sid>", "Canonical session id")
+        .option("--cwd <path>", "Working directory to derive the repo identity (defaults to cwd)")
+        .option("--hq-root <path>", "HQ root for deterministic company evidence")
+        .option("--json", "Print machine-readable JSON (suppresses the prompt)")
+        .option("--machine", "Compact JSON on stdout (suppresses the prompt)")
+        .action((opts) => wrap(() => runContextResolve(opts))());
+    context
+        .command("backfill-held")
+        .description("Reconcile ENDED sessions whose held events lack a company so the daemon re-attributes the backlog (explicit, opt-in; no fleet fan-out)")
+        .option("--dry-run", "Report what would be reconciled; write nothing, no network")
+        .option("--offline", "Reconcile outbox-only (no candidates/register network)")
+        .option("--limit <n>", "Cap sessions processed (default 0 = no cap)")
+        .option("--company <slug>", "Optional non-forcing company hint (resolver default still wins)")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runContextBackfillHeld(opts))());
     context
         .command("organize")
         .description("List or submit one-time project/task decisions (US-007B / US-005B)")
@@ -744,6 +958,13 @@ export function registerMeshCommand(program) {
         .option("--json", "Print machine-readable JSON")
         .option("--machine", "Compact JSON on stdout")
         .action((opts) => wrap(() => runContextCorrect(opts))());
+    context
+        .command("requeue")
+        .description("Requeue quarantined outbox operations (default: only AUTH_DENIED — work-mesh-live gap 10 recovery)")
+        .option("--all", "Requeue every quarantined op regardless of lastErrorCode")
+        .option("--error-code <code>", "Requeue quarantined ops with this lastErrorCode")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runContextRequeue(opts))());
     const def = context
         .command("default")
         .description("Manage the device-local default company preference");

package/dist/lib/mesh/api.js

@@ -5,7 +5,7 @@
  * machine cache apps already read. Does not spawn the pack helper and does
  * not start MQTT listen.
  */
-import { ensureCognitoToken } from "../../utils/cognito-session.js";
+import { ensureCognitoToken, isMachineIdentity } from "../../utils/cognito-session.js";
 import { peekIdToken } from "../../utils/id-token.js";
 import { getCompanyUid, vaultApiFetch } from "../../utils/vault-api.js";
 import { meshCacheRoot, removeSessionFallbackFiles, writeMeshCacheFile, } from "./cache.js";
@@ -119,6 +119,19 @@ export async function resolveActiveMembershipCompany(token, slug) {
     return null;
 }
 export async function requireToken() {
+    // Agent/machine boxes must authenticate the way the mesh daemon does:
+    // an agent's identity claims (custom:entityType=agent, custom:entityUid)
+    // ride the ID token ONLY; a person-cache ACCESS token on the box carries
+    // no entity claims and the server answers 403 NO_PERSON_ENTITY, which the
+    // outbox then quarantines as AUTH_DENIED (work-mesh-live gap 10). Force
+    // the machine mint whenever machine creds are readable so we always send
+    // the agent ID token, matching src/lib/mesh/live/daemon/run.ts. Per the
+    // hard policy indigo-agent-caller-resolution-id-token, agent claims ride
+    // the ID token only; the server is correct to require it. Humans keep the
+    // person access token (unchanged).
+    if (isMachineIdentity()) {
+        return ensureCognitoToken({ tokenSource: "machine" });
+    }
     return ensureCognitoToken();
 }
 function asRecord(value) {

package/dist/lib/mesh/live/backfill-held.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Backfill held session events by reconciling their ENDED sessions (gap 2b).
+ *
+ * Background: hq-cli 5.108.22 fixed company resolution for sessions reconciled
+ * from now on, but the daemon's held retry (see flush.ts `classifySession` →
+ * NEEDS_COMPANY) decides purely from the per-session work-context state file,
+ * and only a reconcile rewrites that file. Held events belong to sessions that
+ * already ENDED, so nothing reconciles them again — the held backlog sits held
+ * forever.
+ *
+ * This module re-runs `reconcileObservation` once per distinct held session
+ * that still lacks a companyUid, which rewrites its state file with the resolved
+ * company (via the identity-file default resolver shipped in 5.108.22). The
+ * daemon's next held retry then re-attributes and posts those events naturally.
+ *
+ * Constraints (owner directive):
+ * - Explicit, opt-in only. Never automatic; never wired into a hook or daemon.
+ * - Idempotent: sessions that already carry a companyUid are skipped.
+ * - Never deletes held events; the daemon posts them on the next retry.
+ * - Purely local to the box it runs on; no fleet fan-out.
+ */
+import type { ReconcileObservation, ReconcileOutcome } from "../../work-context/reconcile.js";
+import { type SessionStateFile } from "../../work-context/state.js";
+/** One distinct session discovered in held.jsonl, with its harness. */
+export interface HeldSessionRef {
+    sessionId: string;
+    harness?: string;
+}
+export interface BackfillHeldResult {
+    /** Distinct sessions found in held.jsonl (before --limit). */
+    scanned: number;
+    /** Distinct sessions considered this run (after --limit). */
+    considered: number;
+    /** Skipped because state already has a companyUid. */
+    alreadyAttributed: number;
+    /** Reconcile invoked and a company was resolved (would-reconcile in dry-run). */
+    reconciled: number;
+    /** Reconcile ran but resolver found no company. */
+    unresolved: number;
+    /** Sessions that errored during reconcile. */
+    errors: number;
+    dryRun: boolean;
+}
+export interface BackfillHeldDeps {
+    /** Work-mesh root that holds held.jsonl. */
+    workMeshRoot: string;
+    /** Work-context root that holds sessions/<sid>.json. */
+    workContextRoot: string;
+    /** Report only; write nothing, call no network, invoke no reconcile. */
+    dryRun?: boolean;
+    /** Cap distinct sessions processed. 0 (default) = no cap. */
+    limit?: number;
+    /** Contract version stamped on the synthesized observation. */
+    contractVersion?: number;
+    /** Fresh clientOperationId per reconcile. Default crypto.randomUUID. */
+    newOperationId?: () => string;
+    /** State reader seam. Default readSessionState. */
+    readState?: (sessionId: string, root: string) => SessionStateFile | null;
+    /**
+     * Reconcile one observation. NOT called in dry-run. The CLI wrapper wires
+     * this to reconcileObservation with the real deliver/fetchCandidates/
+     * validateMembership seam (or offline fallback), exactly mirroring the
+     * `hq mesh context reconcile` handler.
+     */
+    reconcile: (obs: ReconcileObservation) => Promise<ReconcileOutcome>;
+    /** Optional progress logger. */
+    log?: (message: string) => void;
+}
+/**
+ * Read held.jsonl and return distinct sessions (first occurrence wins),
+ * carrying the harness from whichever held event we saw first for that session.
+ * Lines that fail to parse or carry no sessionId are ignored (the daemon owns
+ * their disposition; this backfill never mutates or deletes held lines).
+ */
+export declare function readHeldSessions(workMeshRoot: string): HeldSessionRef[];
+/**
+ * Reconcile ended sessions whose held events lack a company. Idempotent:
+ * re-running skips sessions that already carry a companyUid.
+ */
+export declare function backfillHeldSessions(deps: BackfillHeldDeps): Promise<BackfillHeldResult>;
+//# sourceMappingURL=backfill-held.d.ts.map