@indigoai-us/hq-cli 5.108.22 → 5.108.24

package/dist/lib/mesh/live/backfill-held.js

@@ -0,0 +1,131 @@
+/**
+ * Backfill held session events by reconciling their ENDED sessions (gap 2b).
+ *
+ * Background: hq-cli 5.108.22 fixed company resolution for sessions reconciled
+ * from now on, but the daemon's held retry (see flush.ts `classifySession` →
+ * NEEDS_COMPANY) decides purely from the per-session work-context state file,
+ * and only a reconcile rewrites that file. Held events belong to sessions that
+ * already ENDED, so nothing reconciles them again — the held backlog sits held
+ * forever.
+ *
+ * This module re-runs `reconcileObservation` once per distinct held session
+ * that still lacks a companyUid, which rewrites its state file with the resolved
+ * company (via the identity-file default resolver shipped in 5.108.22). The
+ * daemon's next held retry then re-attributes and posts those events naturally.
+ *
+ * Constraints (owner directive):
+ * - Explicit, opt-in only. Never automatic; never wired into a hook or daemon.
+ * - Idempotent: sessions that already carry a companyUid are skipped.
+ * - Never deletes held events; the daemon posts them on the next retry.
+ * - Purely local to the box it runs on; no fleet fan-out.
+ */
+import * as fs from "node:fs";
+import { readSessionState } from "../../work-context/state.js";
+import { WORK_CONTEXT_CONTRACT_VERSION } from "../../work-context/contract.js";
+import { workMeshHeldPath } from "./paths.js";
+/**
+ * Read held.jsonl and return distinct sessions (first occurrence wins),
+ * carrying the harness from whichever held event we saw first for that session.
+ * Lines that fail to parse or carry no sessionId are ignored (the daemon owns
+ * their disposition; this backfill never mutates or deletes held lines).
+ */
+export function readHeldSessions(workMeshRoot) {
+    const heldPath = workMeshHeldPath(workMeshRoot);
+    let raw;
+    try {
+        raw = fs.readFileSync(heldPath, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const seen = new Map();
+    for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            continue;
+        const obj = parsed;
+        // Peel the held envelope { event, heldReason, heldAt } if present.
+        const event = obj.event &&
+            typeof obj.event === "object" &&
+            !Array.isArray(obj.event) &&
+            typeof obj.heldReason === "string"
+            ? obj.event
+            : obj;
+        const sessionId = typeof event.sessionId === "string" && event.sessionId.trim()
+            ? event.sessionId.trim()
+            : null;
+        if (!sessionId || seen.has(sessionId))
+            continue;
+        const harness = typeof event.harness === "string" && event.harness.trim()
+            ? event.harness.trim()
+            : undefined;
+        seen.set(sessionId, { sessionId, harness });
+    }
+    return [...seen.values()];
+}
+/**
+ * Reconcile ended sessions whose held events lack a company. Idempotent:
+ * re-running skips sessions that already carry a companyUid.
+ */
+export async function backfillHeldSessions(deps) {
+    const dryRun = Boolean(deps.dryRun);
+    const limit = deps.limit && deps.limit > 0 ? deps.limit : 0;
+    const contractVersion = deps.contractVersion ?? WORK_CONTEXT_CONTRACT_VERSION;
+    const readState = deps.readState ?? readSessionState;
+    const newOperationId = deps.newOperationId ?? (() => globalThis.crypto.randomUUID());
+    const sessions = readHeldSessions(deps.workMeshRoot);
+    const considered = limit > 0 ? sessions.slice(0, limit) : sessions;
+    const result = {
+        scanned: sessions.length,
+        considered: considered.length,
+        alreadyAttributed: 0,
+        reconciled: 0,
+        unresolved: 0,
+        errors: 0,
+        dryRun,
+    };
+    for (const { sessionId, harness } of considered) {
+        const state = readState(sessionId, deps.workContextRoot);
+        if (state?.companyUid) {
+            result.alreadyAttributed += 1;
+            continue;
+        }
+        if (dryRun) {
+            // Would reconcile: no state read/write beyond the skip check above.
+            result.reconciled += 1;
+            deps.log?.(`would reconcile ${sessionId}${harness ? ` (${harness})` : ""}`);
+            continue;
+        }
+        const obs = {
+            contractVersion,
+            identity: harness ? { sessionId, harness } : { sessionId },
+            clientOperationId: newOperationId(),
+        };
+        try {
+            const outcome = await deps.reconcile(obs);
+            if (outcome.result.companyUid) {
+                result.reconciled += 1;
+                deps.log?.(`reconciled ${sessionId} → ${outcome.result.companyUid}`);
+            }
+            else {
+                result.unresolved += 1;
+                deps.log?.(`unresolved ${sessionId} (no company)`);
+            }
+        }
+        catch (err) {
+            result.errors += 1;
+            deps.log?.(`error ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=backfill-held.js.map

package/dist/lib/mesh/live/daemon/transcript-watch.js

@@ -32,7 +32,7 @@ import { CLI_VERSION } from "../../../../cli-version.js";
 import { companySlugFromCwd, projectIdFromCwd, resolveCompany, } from "../../../work-context/company.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "../../../work-context/contract.js";
 import { reconcileObservation, } from "../../../work-context/reconcile.js";
-import { deriveRemoteOwnerSlug } from "../../../work-context/repo-remote.js";
+import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../../work-context/repo-remote.js";
 import { isHookWrittenSessionState, readSessionState, writeSessionState, } from "../../../work-context/state.js";
 import { enqueueSessionEvent } from "../enqueue.js";
 import { isValidSessionId } from "../session-identity.js";
@@ -448,6 +448,10 @@ export function resolveTranscriptRegistration(input) {
     const remoteOwnerSlug = input.cwd
         ? deriveRemoteOwnerSlug({ cwd: input.cwd, hqRoot: input.hqRoot })
         : null;
+    // Detached transcript watch never prompts, but honours a persisted repo map.
+    const repoIdentityKey = input.cwd
+        ? deriveRepoIdentityKey({ cwd: input.cwd })
+        : null;
     const resolution = resolveCompany({
         root: input.workContextRoot,
         sessionId: input.sessionId,
@@ -455,6 +459,7 @@ export function resolveTranscriptRegistration(input) {
         cwd: input.cwd,
         hqRoot: input.hqRoot,
         remoteOwnerSlug,
+        repoIdentityKey,
     });
     const company = resolution.status === "resolved" ? resolution.company : undefined;
     const companySlug = company?.slug;

package/dist/lib/mesh/live/format-spool-line.d.ts

@@ -7,7 +7,7 @@ export type LocalOnlyField = (typeof LOCAL_ONLY_FIELDS)[number];
 /** Network + local key order matching work-mesh-enqueue.sh. */
 export declare const SPOOL_KEY_ORDER: readonly ["v", "eventId", "kind", "sessionId", "harness", "adapterVersion", "runtimeVersion", "source", "at", "seq", "taskId", "status", "reason", "summary", "cwd", "hqRoot", "companySlug", "project", "task", "toolWrites"];
 export type SessionEventKind = "session_start" | "turn_start" | "turn_end" | "session_end" | "task_status" | "blocked" | "note";
-export type SessionEventHarness = "claude-code" | "claude-desktop" | "codex" | "grok" | "hq-sessions" | "agent-box";
+export type SessionEventHarness = "claude-code" | "claude-desktop" | "codex" | "grok" | "hq-sessions" | "agent-box" | "agents-v2";
 export type SessionEventSource = "hooks" | "transcript";
 export interface SpoolEventInput {
     v?: 1;

package/dist/lib/mesh/live/session-event.schema.json

@@ -52,7 +52,8 @@
         "codex",
         "grok",
         "hq-sessions",
-        "agent-box"
+        "agent-box",
+        "agents-v2"
       ]
     },
     "adapterVersion": {

package/dist/lib/mesh/live/validate-session-event.d.ts

@@ -8,7 +8,7 @@
 import type { ValidateFunction } from "ajv";
 export declare const SESSION_EVENT_SCHEMA_PATH: string;
 /** Expected SHA-256 of the canonical schema bytes (hq-pro + hq-cli must match). */
-export declare const SESSION_EVENT_SCHEMA_SHA256 = "be300120b4793a5c6f1e713bf9f72b2fd22f6ac082bef8eedfa507b684b09ccb";
+export declare const SESSION_EVENT_SCHEMA_SHA256 = "4284bcc3718b8c9008c26156c1f79ae5cfd70fdd248beb2b1c776988f109e415";
 export declare const PROHIBITED_CONTENT_CLASSES: readonly ["prompts", "model_output", "transcripts", "message_bodies", "tokens", "credentials"];
 export type ProhibitedContentClass = (typeof PROHIBITED_CONTENT_CLASSES)[number];
 /** Fixture field name → prohibited class. */

package/dist/lib/mesh/live/validate-session-event.js

@@ -13,7 +13,7 @@ import Ajv2020 from "ajv/dist/2020.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 export const SESSION_EVENT_SCHEMA_PATH = join(HERE, "session-event.schema.json");
 /** Expected SHA-256 of the canonical schema bytes (hq-pro + hq-cli must match). */
-export const SESSION_EVENT_SCHEMA_SHA256 = "be300120b4793a5c6f1e713bf9f72b2fd22f6ac082bef8eedfa507b684b09ccb";
+export const SESSION_EVENT_SCHEMA_SHA256 = "4284bcc3718b8c9008c26156c1f79ae5cfd70fdd248beb2b1c776988f109e415";
 export const PROHIBITED_CONTENT_CLASSES = [
     "prompts",
     "model_output",

package/dist/lib/work-context/company.d.ts

@@ -8,6 +8,9 @@
  *   4. agent-box identity file (HQ_AGENT_IDENTITY_FILE → companyUid; source
  *      trusted_explicit — never "default company mode"; below HQ_SPAWN_COMPANY,
  *      above device default)
+ *   4b. persisted per-repo company map (gap 4 — person "always ask per repo",
+ *      remembered by repoIdentityKey; above the git-remote heuristic + device
+ *      default, below the identity file so an agent box always wins)
  *   5. enabled device default
  *   6. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
  *
@@ -16,7 +19,7 @@
  */
 import type { TrustedExplicitContext } from "./contract.js";
 import { type SessionStateFile } from "./state.js";
-export type CompanyResolutionSource = "trusted_explicit" | "existing_scope" | "session_meta" | "device_default" | "deterministic_cwd" | "deterministic_remote";
+export type CompanyResolutionSource = "trusted_explicit" | "existing_scope" | "session_meta" | "repo_map" | "device_default" | "deterministic_cwd" | "deterministic_remote";
 export interface ResolvedCompany {
     slug?: string;
     uid?: string;
@@ -55,6 +58,13 @@ export interface CompanyResolveInput {
     metaCompanySlug?: string | null;
     /** Optional injected deterministic remote ownership slug. */
     remoteOwnerSlug?: string | null;
+    /**
+     * Normalised per-repo identity key (deriveRepoIdentityKey). When present, the
+     * resolver consults the persisted repo→company map (gap 4) — above the
+     * git-remote heuristic and device default, below identity file / explicit /
+     * session-meta. Omitted (or unmapped) → the ladder falls through unchanged.
+     */
+    repoIdentityKey?: string | null;
 }
 /** Env naming the on-box identity.json (fleet agent boxes). */
 export declare const HQ_AGENT_IDENTITY_FILE_ENV = "HQ_AGENT_IDENTITY_FILE";

package/dist/lib/work-context/company.js

@@ -8,6 +8,9 @@
  *   4. agent-box identity file (HQ_AGENT_IDENTITY_FILE → companyUid; source
  *      trusted_explicit — never "default company mode"; below HQ_SPAWN_COMPANY,
  *      above device default)
+ *   4b. persisted per-repo company map (gap 4 — person "always ask per repo",
+ *      remembered by repoIdentityKey; above the git-remote heuristic + device
+ *      default, below the identity file so an agent box always wins)
  *   5. enabled device default
  *   6. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
  *
@@ -16,7 +19,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getDefaultCompany } from "./config.js";
+import { getDefaultCompany, getRepoCompany } from "./config.js";
 import { authoritativeCompanyFromState, readSessionState, } from "./state.js";
 /** Pointer to the US-017B correction client (never auto-switches). */
 export const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
@@ -247,6 +250,19 @@ export function resolveCompany(input) {
             company: { uid: identityUid, source: "trusted_explicit" },
         };
     }
+    // 4b. Persisted per-repo company map (gap 4). A person answered once for this
+    // repo; remember it. Above the git-remote heuristic + device default, below
+    // the identity file / explicit / session-meta so an agent box always wins.
+    const repoKey = input.repoIdentityKey?.trim();
+    if (repoKey) {
+        const mapped = getRepoCompany(repoKey, { root: input.root });
+        if (mapped?.slug) {
+            return {
+                status: "resolved",
+                company: { slug: mapped.slug, uid: mapped.uid, source: "repo_map" },
+            };
+        }
+    }
     // 5 + 6. Device default vs deterministic evidence.
     const deviceDefault = getDefaultCompany({ root: input.root });
     const deterministic = resolveDeterministicCompany({

package/dist/lib/work-context/config.d.ts

@@ -20,12 +20,27 @@ export interface MigrationCapabilitySnapshot {
         migration: boolean;
     }>;
 }
+/**
+ * Persisted per-repo company mapping (gap 4 — person "always ask per repo").
+ * Keyed by the normalised repo identity from deriveRepoIdentityKey
+ * (`remote:owner/name` or `root:<abs work-tree>`). Written only after a person
+ * answers the one-time interactive prompt; consulted by the resolver so the
+ * same repo never re-asks.
+ */
+export interface RepoCompanyMapping {
+    slug: string;
+    uid?: string;
+    updatedAt: string;
+}
+export type RepoCompanyMap = Record<string, RepoCompanyMapping>;
 export interface WorkContextDeviceConfig {
     schemaVersion: typeof DEVICE_CONFIG_SCHEMA_VERSION;
     /** Explicit device default. Never copied from activeCompany. */
     defaultCompany?: DeviceDefaultCompany | null;
     /** Last-known migration capability across memberships (doctor reports this). */
     migrationCapability?: MigrationCapabilitySnapshot | null;
+    /** Per-repo company map (gap 4). Remembers each repo's filed-under company. */
+    repoCompanyMap?: RepoCompanyMap | null;
     updatedAt: string;
 }
 /** true / { uid } = member; false = not a member. */
@@ -50,6 +65,19 @@ export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps &
     allowWithoutMigration?: boolean;
 }): Promise<WorkContextDeviceConfig>;
 export declare function clearDefaultCompany(deps: DeviceConfigDeps): WorkContextDeviceConfig;
+/**
+ * Read the persisted company mapping for a repo identity key (gap 4).
+ * Returns null when unmapped. Never throws.
+ */
+export declare function getRepoCompany(key: string, deps: Pick<DeviceConfigDeps, "root">): RepoCompanyMapping | null;
+/**
+ * Persist (or overwrite) the company mapping for a repo identity key (gap 4).
+ * Called after a person answers the one-time interactive prompt.
+ */
+export declare function setRepoCompany(key: string, mapping: {
+    slug: string;
+    uid?: string;
+}, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
 /** Persist the last memberships-wide migration capability probe (US-017B). */
 export declare function recordMigrationCapabilitySnapshot(snapshot: MigrationCapabilitySnapshot, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
 /** Convenience: build deps from HOME / injectable root. */

package/dist/lib/work-context/config.js

@@ -15,9 +15,36 @@ function emptyConfig(now) {
         schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
         defaultCompany: null,
         migrationCapability: null,
+        repoCompanyMap: null,
         updatedAt: now().toISOString(),
     };
 }
+/** Sanitize a raw repoCompanyMap from disk: drop malformed entries. */
+function sanitizeRepoCompanyMap(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const out = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (!key.trim())
+            continue;
+        if (!value || typeof value !== "object")
+            continue;
+        const v = value;
+        const slug = typeof v.slug === "string" ? v.slug.trim() : "";
+        if (!slug)
+            continue;
+        const entry = {
+            slug,
+            updatedAt: typeof v.updatedAt === "string" && v.updatedAt.trim()
+                ? v.updatedAt
+                : new Date(0).toISOString(),
+        };
+        if (typeof v.uid === "string" && v.uid.trim())
+            entry.uid = v.uid.trim();
+        out[key] = entry;
+    }
+    return Object.keys(out).length > 0 ? out : null;
+}
 function assertSafeConfigPath(configPath) {
     const dir = path.dirname(configPath);
     try {
@@ -60,6 +87,7 @@ export function readDeviceConfig(deps) {
             schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
             defaultCompany: raw.defaultCompany ?? null,
             migrationCapability: raw.migrationCapability ?? null,
+            repoCompanyMap: sanitizeRepoCompanyMap(raw.repoCompanyMap),
             updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : new Date(0).toISOString(),
         };
         return cleaned;
@@ -122,6 +150,7 @@ export async function setDefaultCompany(slug, deps) {
         schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
         defaultCompany,
         migrationCapability: prior.migrationCapability ?? null,
+        repoCompanyMap: prior.repoCompanyMap ?? null,
         updatedAt: now().toISOString(),
     };
     writeDeviceConfig(deps, next);
@@ -134,11 +163,56 @@ export function clearDefaultCompany(deps) {
         schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
         defaultCompany: null,
         migrationCapability: prior.migrationCapability ?? null,
+        repoCompanyMap: prior.repoCompanyMap ?? null,
         updatedAt: now().toISOString(),
     };
     writeDeviceConfig(deps, next);
     return next;
 }
+/**
+ * Read the persisted company mapping for a repo identity key (gap 4).
+ * Returns null when unmapped. Never throws.
+ */
+export function getRepoCompany(key, deps) {
+    const trimmed = key?.trim();
+    if (!trimmed)
+        return null;
+    const cfg = readDeviceConfig(deps);
+    const entry = cfg.repoCompanyMap?.[trimmed];
+    if (!entry || !entry.slug?.trim())
+        return null;
+    return entry;
+}
+/**
+ * Persist (or overwrite) the company mapping for a repo identity key (gap 4).
+ * Called after a person answers the one-time interactive prompt.
+ */
+export function setRepoCompany(key, mapping, deps) {
+    const trimmed = key?.trim();
+    if (!trimmed) {
+        throw new WorkContextError("InvalidRepoKey", "Empty repo identity key");
+    }
+    const slug = mapping.slug?.trim();
+    if (!slug || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(slug)) {
+        throw new WorkContextError("InvalidCompanySlug", `Invalid company slug: ${mapping.slug}`);
+    }
+    const now = deps.now ?? (() => new Date());
+    const prior = readDeviceConfig({ root: deps.root });
+    const entry = { slug, updatedAt: now().toISOString() };
+    const uid = mapping.uid?.trim();
+    if (uid)
+        entry.uid = uid;
+    const nextMap = { ...(prior.repoCompanyMap ?? {}), [trimmed]: entry };
+    const next = {
+        schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+        defaultCompany: prior.defaultCompany ?? null,
+        migrationCapability: prior.migrationCapability ?? null,
+        repoCompanyMap: nextMap,
+        updatedAt: now().toISOString(),
+    };
+    writeDeviceConfig({ root: deps.root }, next);
+    return next;
+}
 /** Persist the last memberships-wide migration capability probe (US-017B). */
 export function recordMigrationCapabilitySnapshot(snapshot, deps) {
     const prior = readDeviceConfig(deps);
@@ -155,6 +229,7 @@ export function recordMigrationCapabilitySnapshot(snapshot, deps) {
                 migration: c.migration,
             })),
         },
+        repoCompanyMap: prior.repoCompanyMap ?? null,
         updatedAt: now().toISOString(),
     };
     writeDeviceConfig({ root: deps.root }, next);

package/dist/lib/work-context/index.d.ts

@@ -17,7 +17,9 @@ export { decisionFromCandidates, digestOrganizePayload, formatOrganizeList, prep
 export type { CandidatesResponse, FetchCandidatesFn, OrganizeCandidate, OrganizeListResult, OrganizeReceipt, OrganizeSubmitDecision, OrganizeSubmitResult, PostOrganizeFn, } from "./organize.js";
 export { digestMigratePayload, formatMigrateConfirmation, stableMigrateOperationId, submitSessionMigration, } from "./migrate.js";
 export type { MigrateDestination, MigrateReceipt, MigrateSubmitResult, PostMigrateFn, } from "./migrate.js";
-export { deriveRemoteOwnerSlug, matchCompanySlugForRepo, normalizeRemoteOwnerName, } from "./repo-remote.js";
+export { deriveRemoteOwnerSlug, deriveRepoIdentityKey, findWorkTreeRoot, matchCompanySlugForRepo, normalizeRemoteOwnerName, } from "./repo-remote.js";
+export { matchMembershipAnswer, promptRepoCompany, } from "./repo-prompt.js";
+export type { RepoPromptCompany, RepoPromptDeps, RepoPromptOutcome, RepoPromptSkipReason, } from "./repo-prompt.js";
 export { loadObservationFromFile, markUntracked, parseObservationJson, reconcileObservation, } from "./reconcile.js";
 export type { ReconcileDeps, ReconcileObservation, ReconcileOutcome, } from "./reconcile.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/work-context/index.js

@@ -15,6 +15,7 @@ export * from "./company.js";
 export * from "./project.js";
 export { decisionFromCandidates, digestOrganizePayload, formatOrganizeList, prepareOrganizeDecision, settleOrganizeAskWithoutBind, stableDecisionId, stableOrganizeOperationId, submitOrganizeDecision, } from "./organize.js";
 export { digestMigratePayload, formatMigrateConfirmation, stableMigrateOperationId, submitSessionMigration, } from "./migrate.js";
-export { deriveRemoteOwnerSlug, matchCompanySlugForRepo, normalizeRemoteOwnerName, } from "./repo-remote.js";
+export { deriveRemoteOwnerSlug, deriveRepoIdentityKey, findWorkTreeRoot, matchCompanySlugForRepo, normalizeRemoteOwnerName, } from "./repo-remote.js";
+export { matchMembershipAnswer, promptRepoCompany, } from "./repo-prompt.js";
 export { loadObservationFromFile, markUntracked, parseObservationJson, reconcileObservation, } from "./reconcile.js";
 //# sourceMappingURL=index.js.map

package/dist/lib/work-context/outbox.d.ts

@@ -78,6 +78,25 @@ export declare function updateOutboxOperation(op: OutboxOperation, root: string)
 export declare function markOutboxAcked(operationId: string, root: string, receiptId: string, now?: () => Date): OutboxOperation | null;
 export declare function markOutboxQueued(operationId: string, root: string, errorCode: string, now?: () => Date, random?: () => number): OutboxOperation | null;
 export declare function markOutboxQuarantined(operationId: string, root: string, errorCode: string, now?: () => Date): OutboxOperation | null;
+/**
+ * Requeue quarantined outbox operations so the daemon's replay picks them up
+ * again. Quarantine is otherwise terminal: after the work-mesh-live gap 10 fix
+ * (agent boxes now send the ID token, see src/lib/mesh/api.ts requireToken),
+ * ops previously quarantined as AUTH_DENIED — 403 NO_PERSON_ENTITY caused by
+ * sending the person ACCESS token — will not retry on their own. This flips
+ * them back to `queued`, resets attemptCount, and clears nextAttemptAt so they
+ * are due immediately.
+ *
+ * `opts.errorCode` selects which quarantined ops to requeue by lastErrorCode:
+ *   - omitted → defaults to "AUTH_DENIED" (a bare call only recovers the gap 10
+ *     regression, never e.g. VALIDATION_FAILED ops that are genuinely bad).
+ *   - a string → only ops whose lastErrorCode matches.
+ *   - `null` → every quarantined op regardless of code.
+ */
+export declare function requeueQuarantinedOutbox(root: string, opts?: {
+    errorCode?: string | null;
+    now?: () => Date;
+}): OutboxOperation[];
 export type OutboxListReadFile = (filePath: string) => string;
 export declare function listOutboxOperations(root: string, deps?: {
     readFile?: OutboxListReadFile;

package/dist/lib/work-context/outbox.js

@@ -283,6 +283,40 @@ export function markOutboxQuarantined(operationId, root, errorCode, now = () =>
     updateOutboxOperation(op, root);
     return op;
 }
+/**
+ * Requeue quarantined outbox operations so the daemon's replay picks them up
+ * again. Quarantine is otherwise terminal: after the work-mesh-live gap 10 fix
+ * (agent boxes now send the ID token, see src/lib/mesh/api.ts requireToken),
+ * ops previously quarantined as AUTH_DENIED — 403 NO_PERSON_ENTITY caused by
+ * sending the person ACCESS token — will not retry on their own. This flips
+ * them back to `queued`, resets attemptCount, and clears nextAttemptAt so they
+ * are due immediately.
+ *
+ * `opts.errorCode` selects which quarantined ops to requeue by lastErrorCode:
+ *   - omitted → defaults to "AUTH_DENIED" (a bare call only recovers the gap 10
+ *     regression, never e.g. VALIDATION_FAILED ops that are genuinely bad).
+ *   - a string → only ops whose lastErrorCode matches.
+ *   - `null` → every quarantined op regardless of code.
+ */
+export function requeueQuarantinedOutbox(root, opts = {}) {
+    const errorCode = opts.errorCode === undefined ? "AUTH_DENIED" : opts.errorCode;
+    const now = opts.now ?? (() => new Date());
+    const requeued = [];
+    for (const op of listOutboxOperations(root)) {
+        if (op.delivery !== "quarantined")
+            continue;
+        if (errorCode !== null && op.lastErrorCode !== errorCode)
+            continue;
+        op.delivery = "queued";
+        op.attemptCount = 0;
+        op.lastErrorCode = undefined;
+        op.nextAttemptAt = undefined;
+        op.updatedAt = now().toISOString();
+        updateOutboxOperation(op, root);
+        requeued.push(op);
+    }
+    return requeued;
+}
 export function listOutboxOperations(root, deps = {}) {
     const readFile = deps.readFile ?? ((filePath) => fs.readFileSync(filePath, "utf8"));
     const dir = workContextOutboxDir(root);

package/dist/lib/work-context/reconcile.js

@@ -9,7 +9,7 @@ import { WORK_CONTEXT_CONTRACT_VERSION, normalizeTaskId, } from "./contract.js";
 import { EXIT_INVALID_IDENTITY, EXIT_NOT_TRACKING, EXIT_OK, InvalidDecisionOriginError, NotTrackingError, } from "./errors.js";
 import { decisionFromCandidates, } from "./organize.js";
 import { resolveProjectTask, shouldAskAfter } from "./project.js";
-import { deriveRemoteOwnerSlug } from "./repo-remote.js";
+import { deriveRemoteOwnerSlug, deriveRepoIdentityKey } from "./repo-remote.js";
 import { enqueueOutbox, markOutboxAcked, markOutboxQuarantined, markOutboxQueued, replayOutbox, } from "./outbox.js";
 import { mergeLocalSessionFields, readSessionState, writeSessionState, } from "./state.js";
 function resultOf(parts) {
@@ -210,6 +210,9 @@ export async function reconcileObservation(obs, deps) {
             cwd: cwd ?? process.cwd(),
             hqRoot,
         }) ?? undefined;
+    // Persisted per-repo company map key (gap 4). The detached reconcile path
+    // NEVER prompts, but it does honour a mapping a person already answered.
+    const repoIdentityKey = deriveRepoIdentityKey({ cwd: cwd ?? process.cwd() });
     const company = resolveCompany({
         root: deps.root,
         sessionId,
@@ -218,6 +221,7 @@ export async function reconcileObservation(obs, deps) {
         cwd,
         hqRoot,
         remoteOwnerSlug,
+        repoIdentityKey,
         existingState: prior,
     });
     const nowIso = nowFn().toISOString();

package/dist/lib/work-context/repo-prompt.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Interactive per-repo company prompt (Work Mesh Live gap 4 — person attribution).
+ *
+ * Owner decision ("Always ask per repo"): every person is asked ONCE PER REPO
+ * which company the work is filed under, then the answer is remembered for that
+ * repo (persisted repo→company map in the device config).
+ *
+ * Hard gates — the prompt NEVER fires:
+ *   - on machine / agent-box identities (isMachineIdentity) — those resolve from
+ *     the identity file, never a prompt;
+ *   - when stdin/stdout is not a TTY, or in --json / --machine / non-interactive
+ *     contexts;
+ *   - when cwd is not inside a git repo (no stable key to remember an answer);
+ *   - when the repo is already mapped (a second resolve is silent).
+ *
+ * There is NO auto-pick from a sole membership: even a caller with exactly one
+ * active membership is asked once. The core is dependency-injected so tests never
+ * need a real TTY, network, or identity file.
+ */
+import { type RepoCompanyMapping } from "./config.js";
+export interface RepoPromptCompany {
+    companyUid: string;
+    companySlug: string;
+}
+export interface RepoPromptDeps {
+    /** Work-context config root (~/.hq/work-context or injected tmp). */
+    root: string;
+    /** cwd used to derive the repo identity key. */
+    cwd?: string;
+    /** True when the caller is a machine / agent-box identity. */
+    isMachineIdentity: () => boolean;
+    /** True only for an interactive person TTY (not --json/--machine/piped). */
+    isInteractive: () => boolean;
+    /** Caller's active membership companies (reused across memberships). */
+    listMemberships: () => Promise<RepoPromptCompany[]>;
+    /** Ask a single plain question; returns the raw answer (trimmed by caller). */
+    ask: (question: string) => Promise<string>;
+    /** Injectable repo key derivation (defaults to deriveRepoIdentityKey). */
+    deriveKey?: (cwd?: string) => string | null;
+    /** Injectable persisted-map lookup (defaults to getRepoCompany). */
+    lookup?: (key: string, root: string) => RepoCompanyMapping | null;
+    /** Injectable persistence (defaults to setRepoCompany). */
+    persist?: (key: string, mapping: {
+        slug: string;
+        uid?: string;
+    }, root: string) => void;
+    now?: () => Date;
+}
+export type RepoPromptSkipReason = "machine" | "non_interactive" | "no_repo_key" | "no_memberships" | "cancelled";
+export type RepoPromptOutcome = {
+    status: "resolved";
+    repoKey: string;
+    company: {
+        slug: string;
+        uid?: string;
+    };
+    /** true when this call wrote the mapping; false when already remembered. */
+    persisted: boolean;
+    alreadyMapped: boolean;
+} | {
+    status: "skipped";
+    reason: RepoPromptSkipReason;
+    repoKey?: string;
+};
+/** Match a raw answer to a membership by 1-based number or slug/uid. */
+export declare function matchMembershipAnswer(answer: string, companies: RepoPromptCompany[]): RepoPromptCompany | null;
+/**
+ * Resolve a repo's company via the one-time interactive prompt (gap 4).
+ * Pure control flow over injected effects — no direct TTY/network/fs beyond the
+ * default config helpers. Callers must first confirm the session is unresolved
+ * (needs_company); this only decides whether/how to prompt and persist.
+ */
+export declare function promptRepoCompany(deps: RepoPromptDeps): Promise<RepoPromptOutcome>;
+//# sourceMappingURL=repo-prompt.d.ts.map