@indigoai-us/hq-cli 5.123.0 → 5.123.2

package/dist/lib/work-context/state.d.ts

@@ -112,10 +112,12 @@ export declare function writeSessionState(state: SessionStateFile, root: string)
 /** Strip any non-allowlisted fields before durable write. */
 export declare function projectSessionState(state: SessionStateFile): SessionStateFile;
 /**
- * Merge prior local-only counters into a new state write so PostToolUse bumps
- * and reconcile updates do not clobber each other.
+ * Merge prior local fields into a new state write so PostToolUse bumps and
+ * reconcile updates do not clobber an acknowledged company binding.
  */
-export declare function mergeLocalSessionFields(next: SessionStateFile, prior: SessionStateFile | null): SessionStateFile;
+export declare function mergeLocalSessionFields(next: SessionStateFile, prior: SessionStateFile | null, options?: {
+    preserveBindingEpisode?: boolean;
+}): SessionStateFile;
 /**
  * Upgrade the local projection after the server acknowledges a register.
  *

package/dist/lib/work-context/state.js

@@ -103,13 +103,30 @@ export function projectSessionState(state) {
     return out;
 }
 /**
- * Merge prior local-only counters into a new state write so PostToolUse bumps
- * and reconcile updates do not clobber each other.
+ * Merge prior local fields into a new state write so PostToolUse bumps and
+ * reconcile updates do not clobber an acknowledged company binding.
  */
-export function mergeLocalSessionFields(next, prior) {
+export function mergeLocalSessionFields(next, prior, options = {}) {
     if (!prior)
         return next;
     const out = { ...next };
+    // Hook observations commonly carry only tool-write/session metadata. Those
+    // writes must not erase a company that an acknowledged register already
+    // projected locally; losing it causes held events and repeat registrations.
+    // A caller that carries either company field is intentionally changing the
+    // binding and remains authoritative.
+    if (!out.companyUid && !out.companySlug && (prior.companyUid || prior.companySlug)) {
+        out.companyUid = prior.companyUid;
+        out.companySlug = prior.companySlug;
+        out.contextStatus = prior.contextStatus;
+        if (!out.projectId && prior.projectId)
+            out.projectId = prior.projectId;
+        if (!out.taskId && prior.taskId)
+            out.taskId = prior.taskId;
+        if (out.version === undefined && prior.version !== undefined) {
+            out.version = prior.version;
+        }
+    }
     if (out.toolWrites === undefined && typeof prior.toolWrites === "number") {
         out.toolWrites = prior.toolWrites;
     }
@@ -131,7 +148,14 @@ export function mergeLocalSessionFields(next, prior) {
     if (!out.transcriptMarker && prior.transcriptMarker) {
         out.transcriptMarker = prior.transcriptMarker;
     }
-    if (!out.bindingEpisodeId && prior.bindingEpisodeId) {
+    const sameBinding = prior.companyUid === out.companyUid &&
+        prior.companySlug === out.companySlug &&
+        prior.projectId === out.projectId &&
+        prior.taskId === out.taskId;
+    if (options.preserveBindingEpisode !== false &&
+        !out.bindingEpisodeId &&
+        prior.bindingEpisodeId &&
+        sameBinding) {
         out.bindingEpisodeId = prior.bindingEpisodeId;
     }
     return out;

package/dist/utils/self-update.d.ts

@@ -57,6 +57,7 @@
  * version-check), `hq rescue --no-self-update`, and the re-exec guard env.
  */
 import { type RunningInstall, type UpdateResult } from "./version-gate.js";
+import { type RestartDaemonResult } from "../lib/mesh/live/daemon/install.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
  * One update + one re-exec per user invocation, ever.
@@ -153,6 +154,8 @@ export interface SelfUpdateDeps {
      * underneath themselves: hooks, scripts, agents, cron, CI.
      */
     interactive?: boolean;
+    /** Best-effort daemon kick after the CLI install converges (tests). */
+    restartDaemon?: () => RestartDaemonResult | void;
 }
 /**
  * Startup path: the running CLI is behind npm `latest`, so update in place and

package/dist/utils/self-update.js

@@ -63,6 +63,7 @@ import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
 import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, checkUpdateConvergence, isLocalDependencyInstall, isPrefixWritable, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, } from "./version-gate.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
+import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
  * One update + one re-exec per user invocation, ever.
@@ -278,6 +279,16 @@ async function updateAndReexec(argv, flavor, known, deps) {
         console.error(chalk.dim(`  Continuing the ${flavor.noun} on ${current}.`));
         return { action: "update-ineffective", latest };
     }
+    // A resident mesh daemon keeps the old JS loaded after a global install.
+    // Service restart is best-effort and cannot turn a successful update red.
+    try {
+        const restart = (deps.restartDaemon ?? restartDaemonServiceIfInstalled)();
+        if (restart?.message)
+            console.error(chalk.yellow(`  ${restart.message}`));
+    }
+    catch {
+        // Defensive only; the default helper already absorbs manager failures.
+    }
     const childEnv = { ...env, [REEXEC_GUARD_ENV]: "1" };
     const status = (deps.reexec ?? reexecHq)([...argv.slice(2)], childEnv);
     if (status === null) {

package/dist/utils/vault-api.js

@@ -320,16 +320,37 @@ async function resolveCompanyByUid(token, uid) {
     if (!res.ok) {
         raiseIfUnauthorized(res);
         const body = (await res.json().catch(() => ({})));
-        throw new Error(`Failed to resolve company '${uid}': ${body.error ?? res.statusText}`);
+        throw new Error(`Failed to resolve company '${uid}': ${formatSlugLookupReason(res, body)}`);
     }
     const data = (await res.json());
     return data.entity.uid;
 }
+/**
+ * Node's fetch (undici) often leaves `statusText` empty, and some vault
+ * error bodies send `error: ""` or omit it. `??` does not treat "" as missing,
+ * so `body.error ?? res.statusText` produced
+ * `Failed to resolve company slug '…':` with nothing after the colon
+ * (Shepherd #2306). Never return an empty reason: prefer a non-blank body
+ * error, then statusText, then `HTTP <status>`.
+ */
+function formatSlugLookupReason(res, body) {
+    const fromBody = typeof body.error === "string" ? body.error.trim() : "";
+    if (fromBody)
+        return fromBody;
+    const fromStatus = (res.statusText ?? "").trim();
+    if (fromStatus)
+        return fromStatus;
+    return `HTTP ${res.status}`;
+}
+function isTransientSlugLookupStatus(status) {
+    return status === 408 || status === 425 || status === 429 || status >= 500;
+}
 /**
  * Resolve a company slug WITHIN THE CALLER'S NAMESPACE via the server's
  * caller-scoped `/entity/check-slug/me` endpoint. Returns the caller's own
- * company uid for that slug, or `null` when the caller owns / actively belongs
- * to no company with that slug.
+ * company uid for that slug, `miss` when the caller owns / actively belongs
+ * to no company with that slug, or `transient` when the lookup itself failed
+ * (timeout, 429, 5xx) after one retry.
  *
  * This is the load-bearing fix for DEV-1742. Under hq-pro's per-user-namespace
  * model two unrelated tenants may each hold "acme", so the legacy GLOBAL
@@ -344,25 +365,63 @@ async function resolveCompanyByUid(token, uid) {
  * the same primitive hq-cloud's `context.ts` already resolves slugs through.
  */
 async function resolveSlugInCallerNamespace(token, slug) {
-    const res = await vaultApiFetch({
+    const attempt = async () => {
+        const res = await vaultApiFetch({
+            token,
+            path: "/entity/check-slug/me",
+            query: { type: "company", slug },
+            signal: AbortSignal.timeout(identityLookupTimeoutMs()),
+        });
+        if (!res.ok) {
+            raiseIfUnauthorized(res);
+            // Namespace lookup unavailable (e.g. membership table not configured →
+            // 503, or the caller has no person entity). A 401 short-circuits above
+            // because the token is bad and the global fallback would only 401 again.
+            // Transient statuses are retried once below; other non-2xx still mean
+            // "couldn't resolve here" and fall back to the global lookup.
+            // vaultApiFetch already recorded the non-2xx as a Sentry breadcrumb.
+            if (isTransientSlugLookupStatus(res.status)) {
+                return { kind: "transient" };
+            }
+            return { kind: "miss" };
+        }
+        const data = (await res.json());
+        // `available: false` carries the caller's own company holding the slug.
+        const uid = data.conflictingCompanyUid;
+        return uid ? { kind: "hit", uid } : { kind: "miss" };
+    };
+    const run = async () => {
+        try {
+            return await attempt();
+        }
+        catch (err) {
+            if (networkTransportErrorCode(err) === null)
+                throw err;
+            return { kind: "transient" };
+        }
+    };
+    const first = await run();
+    if (first.kind !== "transient")
+        return first;
+    return run();
+}
+async function fetchGlobalCompanyBySlug(token, ref) {
+    const attempt = () => vaultApiFetch({
         token,
-        path: '/entity/check-slug/me',
-        query: { type: 'company', slug },
+        path: `/entity/by-slug/company/${encodeURIComponent(ref)}`,
         signal: AbortSignal.timeout(identityLookupTimeoutMs()),
     });
-    if (!res.ok) {
-        raiseIfUnauthorized(res);
-        // Namespace lookup unavailable (e.g. membership table not configured →
-        // 503, or the caller has no person entity). A 401 short-circuits above
-        // because the token is bad and the global fallback would only 401 again;
-        // other non-2xx statuses signal "couldn't resolve here" and let the caller
-        // fall back to the global lookup. vaultApiFetch already recorded the
-        // non-2xx as a Sentry breadcrumb, so this is not a silent swallow.
-        return null;
+    try {
+        const res = await attempt();
+        if (res.ok || !isTransientSlugLookupStatus(res.status))
+            return res;
     }
-    const data = (await res.json());
-    // `available: false` carries the caller's own company holding the slug.
-    return data.conflictingCompanyUid ?? null;
+    catch (err) {
+        if (networkTransportErrorCode(err) === null)
+            throw err;
+        return attempt();
+    }
+    return attempt();
 }
 async function resolveCompanyUid(token, ref) {
     // Silent escape hatch: a `cmp_` ref is a uid, not a slug — resolve directly.
@@ -379,39 +438,25 @@ async function resolveCompanyUid(token, ref) {
     // caller's OWN company (unique within their namespace by the invariant
     // above), making a stranger's same-slug company invisible.
     //
-    // A non-2xx already degrades to the global fallback below (via `return null`).
-    // A TRANSPORT failure must degrade the SAME way, not abort the command:
-    // `resolveSlugInCallerNamespace`'s fetch is bounded by AbortSignal.timeout, so
-    // a vault gateway that accepts the connection but never answers rejects with a
-    // DOMException named `TimeoutError`. Before this catch, that rejection threw
-    // straight out of `resolveCompanyUid`, skipped the global by-slug lookup, and
-    // — being unclassified by main.ts — filed a Sentry crash report instead of an
-    // actionable connectivity message (Sentry HQ-CLI-1P / issue 7716090679).
-    // Degrade ONLY on a recognized transport failure; re-throw everything else
-    // unchanged, so a genuine hq-cli defect stays fatal and the 401 AuthError that
-    // `raiseIfUnauthorized` throws still short-circuits before any fallback.
-    let mine;
-    try {
-        mine = await resolveSlugInCallerNamespace(token, ref);
+    // A non-2xx already degrades to the global fallback below (`miss` /
+    // `transient`). A TRANSPORT failure must degrade the SAME way, not abort
+    // the command: `resolveSlugInCallerNamespace`'s fetch is bounded by
+    // AbortSignal.timeout, so a vault gateway that accepts the connection but
+    // never answers rejects with a DOMException named `TimeoutError`. That is
+    // classified as `transient` (and retried once) inside the helper; a genuine
+    // hq-cli defect still throws, and the 401 AuthError that
+    // `raiseIfUnauthorized` throws still short-circuits before any fallback
+    // (Sentry HQ-CLI-1P / issue 7716090679).
+    const mine = await resolveSlugInCallerNamespace(token, ref);
+    if (mine.kind === "hit") {
+        return mine.uid;
     }
-    catch (err) {
-        if (networkTransportErrorCode(err) === null) {
-            throw err;
-        }
-        mine = null;
-    }
-    if (mine) {
-        return mine;
-    }
-    // The caller owns / belongs to no company with this slug. Fall back to the
-    // GLOBAL by-slug lookup for the cross-company / admin resolutions that
-    // intentionally target a company the caller isn't a member of (e.g. a
-    // group-grant target). A single global match resolves cleanly.
-    const res = await vaultApiFetch({
-        token,
-        path: `/entity/by-slug/company/${encodeURIComponent(ref)}`,
-        signal: AbortSignal.timeout(identityLookupTimeoutMs()),
-    });
+    // The caller owns / belongs to no company with this slug, or the namespace
+    // lookup itself failed. Fall back to the GLOBAL by-slug lookup for the
+    // cross-company / admin resolutions that intentionally target a company the
+    // caller isn't a member of (e.g. a group-grant target). A single global
+    // match resolves cleanly.
+    const res = await fetchGlobalCompanyBySlug(token, ref);
     if (!res.ok) {
         raiseIfUnauthorized(res);
         const body = (await res.json().catch(() => ({})));
@@ -425,10 +470,19 @@ async function resolveCompanyUid(token, ref) {
                 `is in your namespace. Re-run with --company <uid> to pick one:\n` +
                 body.uids.map((u) => `  --company ${u}`).join('\n'));
         }
-        if (res.status === 404 && body.error === "Entity not found") {
+        // Only a clean namespace miss plus a global 404 is "this slug does not
+        // exist". A transient namespace failure followed by 404 is still a lookup
+        // failure — treating it as not-found sent owners to check a slug that
+        // was fine (Shepherd #2306).
+        if (res.status === 404 && mine.kind === "miss") {
             throw Object.assign(new Error(`Company slug '${ref}' was not found. Check the slug or run \`hq companies list\`.`), { expected: true });
         }
-        throw new Error(`Failed to resolve company slug '${ref}': ${body.error ?? res.statusText}`);
+        const reason = formatSlugLookupReason(res, body);
+        const retryable = mine.kind === "transient" || isTransientSlugLookupStatus(res.status);
+        const hint = retryable
+            ? " This is a temporary lookup failure, not a missing company. Retry the command."
+            : "";
+        throw new Error(`Failed to resolve company slug '${ref}': ${reason}.${hint}`);
     }
     const data = (await res.json());
     return data.entity.uid;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.123.0",
+  "version": "5.123.2",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {