@indigoai-us/hq-cli 5.123.2 → 5.125.0

package/dist/commands/billing-sponsor.js

@@ -0,0 +1,344 @@
+/**
+ * `hq billing sponsor` — the individual-pull half of plan sponsorship, from the
+ * terminal ("ask a company to sponsor me", hq-pro #3609).
+ *
+ * A person who is over a personal limit has exactly three ways out: pay $50
+ * themselves, reduce what they store, or ask a company to cover the $50 plan
+ * line. This command is the third one, plus the admin side that answers it.
+ *
+ *   hq billing sponsor request <company>   — ask that company to cover my plan
+ *   hq billing sponsor list                — the queue (admins), or my own
+ *                                            single status (everyone else)
+ *   hq billing sponsor approve <id>        — admin: say yes
+ *   hq billing sponsor decline <id>        — admin: say no
+ *   hq billing sponsor revoke  <id>        — admin: end an active sponsorship
+ *   hq billing sponsor withdraw <id>       — me: take back my own request
+ *
+ * Every subcommand talks to the SAME hq-pro routes the console uses
+ * (`/v1/billing/sponsorship/...`). hq-pro is the authoritative gate on all of
+ * them: it resolves the caller's person id and the company's admin set
+ * server-side, so nothing here is trusted from the client.
+ *
+ * FEATURE SWITCH. The `plan` request kind only exists while hq-pro's
+ * `PLAN_SPONSORSHIP_REQUESTS_ENABLED` switch is on. With the switch off the
+ * backend does not recognise `plan` and answers 400 `MISSING_FIELDS` — which
+ * would read as "you typed something wrong". We translate that one case into a
+ * plain "not available yet" line so a person never sees a validation error for
+ * a feature that simply is not turned on.
+ */
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+/** The request kind this command files. Matches hq-pro's contract. */
+export const PLAN_RESOURCE = "plan";
+/** What a person is told when hq-pro's plan-sponsorship switch is off. */
+export const FEATURE_OFF_MESSAGE = "Asking a company to sponsor your plan isn't available yet.";
+/** What v1 sponsorship covers, stated wherever a person confirms or reads it. */
+export const COVERAGE_SENTENCE = "Your company pays your $50 plan. Storage above your plan's allowance is still yours.";
+/** What a person is told while an approval waits on the sponsor's card. */
+export const HELD_FOR_CARD_SENTENCE = "Your company said yes and is adding a card. Your limits still apply until then.";
+/**
+ * An error we already have plain wording for. `expected` marks it as a normal
+ * outcome (a decline, a rate limit) rather than a fault, matching the flag the
+ * rest of the CLI uses to keep Sentry quiet.
+ */
+class SponsorError extends Error {
+    expected = true;
+}
+function fail(err) {
+    console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+    process.exit(1);
+}
+/**
+ * Turn an hq-pro non-2xx into one plain sentence.
+ *
+ * The switch-off 400 is the important translation: with the feature off,
+ * `plan` is an unrecognised resource kind and the generic body reads
+ * "companyUid and resource ('outpost'|'agent') are required", which tells a
+ * person nothing true about what happened.
+ */
+export function messageForError(status, body) {
+    const code = body.code;
+    if (status === 400 && code === "MISSING_FIELDS")
+        return FEATURE_OFF_MESSAGE;
+    if (status === 401)
+        return "Your sign-in has expired. Run `hq login` and try again.";
+    if (status === 403 && code === "SPONSOR_PLAN_REQUIRED") {
+        return "That company's plan can't cover an individual plan. Only HQ Workforce and Enterprise companies can.";
+    }
+    if (status === 403) {
+        return "You're not allowed to do that. Only an owner or admin of the company can answer a sponsorship request.";
+    }
+    if (status === 404)
+        return "No sponsorship request with that id.";
+    if (status === 409 && code === "DUPLICATE_PENDING_REQUEST") {
+        return "You've already asked that company. They just need to answer.";
+    }
+    if (status === 429 && code === "PLAN_REQUEST_RATE_LIMITED") {
+        return "You asked that company in the last 24 hours. Give them a day before asking again.";
+    }
+    return body.error ?? body.message ?? `Request failed (${status}).`;
+}
+/** Call an hq-pro sponsorship route, or throw a sentence a person can read. */
+async function callApi(token, path, init = {}) {
+    const res = await vaultApiFetch({ token, path, ...init });
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        throw new SponsorError(messageForError(res.status, body));
+    }
+    return (await res.json());
+}
+/**
+ * Read the caller's OWN plan-sponsorship state for one company.
+ *
+ * Two non-2xx cases mean the same thing to a person and must NOT fall through
+ * to {@link messageForError}: a 400 `MISSING_FIELDS` (hq-pro does not accept the
+ * `plan` resource kind yet) and a 404 (an hq-pro that predates this route at
+ * all). Both are "the feature is not on", never "no request with that id" —
+ * there is no id in a list command for that sentence to be about.
+ */
+async function readSelfState(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/billing/sponsorship/mine",
+        query: { companyUid, resource: PLAN_RESOURCE },
+    });
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        if (res.status === 404 || (res.status === 400 && body.code === "MISSING_FIELDS")) {
+            throw new SponsorError(FEATURE_OFF_MESSAGE);
+        }
+        throw new SponsorError(messageForError(res.status, body));
+    }
+    return (await res.json());
+}
+/** Plain label for a request status. Never shows the raw enum. */
+export function statusLabel(status) {
+    switch (status) {
+        case "pending":
+            return "Waiting for an answer";
+        case "pending-sponsor-billing":
+            return "Said yes — waiting on their card";
+        case "active":
+            return "Covered by the company";
+        case "declined":
+            return "Not covered";
+        case "expired":
+            return "Expired";
+        default:
+            return status;
+    }
+}
+/** One line per request, in the same column order everywhere. */
+function renderRow(r) {
+    const when = r.requestedAt.slice(0, 10);
+    return `  ${chalk.bold(r.requestId)}  ${statusLabel(r.status).padEnd(32)} asked ${when}`;
+}
+/** Only plan rows belong on this surface; outpost/agent have their own. */
+function planRowsOf(rows) {
+    return rows.filter((r) => r.resource === PLAN_RESOURCE);
+}
+/** Shared body of approve / decline / revoke / withdraw. */
+async function transition(requestId, op) {
+    const token = await ensureCognitoToken();
+    const data = await callApi(token, `/v1/billing/sponsorship/request/${op}`, {
+        method: "POST",
+        body: { requestId },
+    });
+    return { ...data.request, code: data.code, addCardUrl: data.addCardUrl };
+}
+export function registerBillingSponsorCommands(billing) {
+    const sponsor = billing
+        .command("sponsor")
+        .description("Ask a company to cover your $50 plan, or answer a request");
+    sponsor
+        .command("request")
+        .argument("<company>", "Company slug or uid to ask")
+        .description("Ask a company to cover your $50 HQ plan")
+        .option("--json", "Emit raw JSON")
+        .action(async function (company, opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const companyUid = await getCompanyUid(token, company);
+            const data = await callApi(token, "/v1/billing/sponsorship/request", { method: "POST", body: { companyUid, resource: PLAN_RESOURCE } });
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(data.request, null, 2) + "\n");
+                return;
+            }
+            console.log(`Asked ${company} to cover your $50 HQ plan.`);
+            console.log(COVERAGE_SENTENCE);
+            console.log(`An owner or admin there answers next. Check with \`hq billing sponsor list\`.`);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    sponsor
+        .command("list")
+        .description("Show sponsorship requests — the company's queue, or your own")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            // A company the caller cannot resolve is not fatal here. The person
+            // this feature is for often belongs to no company at all, and they
+            // still need to be told what to do next.
+            const named = opts.company ?? billing.opts().company;
+            const companyUid = await getCompanyUid(token, named).catch(() => null);
+            // The admin queue is the richer view. A non-admin is refused it, so we
+            // fall back to the member SELF-READ — a different route with a
+            // different answer: hq-pro returns ONE status for that person and that
+            // company, not a list. Rendering it as a list (or reusing the list's
+            // "not found" wording) is what made this read wrong.
+            let rows = null;
+            if (companyUid) {
+                try {
+                    const data = await callApi(token, "/v1/billing/sponsorship/requests", { query: { companyUid } });
+                    rows = planRowsOf(data.requests);
+                }
+                catch (err) {
+                    if (!(err instanceof SponsorError))
+                        throw err;
+                }
+            }
+            if (rows === null) {
+                // The self-read is company-scoped by contract, so without a company
+                // there is nothing to ask for. Say which flag fixes it.
+                if (!companyUid) {
+                    const line = named
+                        ? `Couldn't find a company called ${named}.`
+                        : "Name the company you asked: `hq billing sponsor list --company <slug>`.";
+                    if (opts.json) {
+                        process.stdout.write(JSON.stringify({ error: line }, null, 2) + "\n");
+                        return;
+                    }
+                    console.log(line);
+                    return;
+                }
+                const state = await readSelfState(token, companyUid);
+                if (opts.json) {
+                    process.stdout.write(JSON.stringify(state, null, 2) + "\n");
+                    return;
+                }
+                const where = named ?? "that company";
+                if (!state.active) {
+                    console.log(`No company is covering your $50 HQ plan right now.`);
+                    console.log(`If you asked ${where}, they haven't answered yet — an owner or admin there answers next.`);
+                    return;
+                }
+                console.log(`Your $50 HQ plan: ${statusLabel(state.status ?? "active")}`);
+                if (state.requestId)
+                    console.log(`  ${chalk.bold(state.requestId)}`);
+                console.log(COVERAGE_SENTENCE);
+                if (state.status === "pending-sponsor-billing") {
+                    console.log(`\n${HELD_FOR_CARD_SENTENCE}`);
+                }
+                return;
+            }
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(rows, null, 2) + "\n");
+                return;
+            }
+            if (rows.length === 0) {
+                console.log("No one has asked this company to cover their plan.");
+                return;
+            }
+            console.log("Plan sponsorship requests:");
+            for (const r of rows)
+                console.log(renderRow(r));
+            if (rows.some((r) => r.status === "pending-sponsor-billing")) {
+                console.log(`\n${chalk.yellow("Add a card")} to start the requests you said yes to. Nothing is covered until then.`);
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    sponsor
+        .command("approve")
+        .argument("<id>", "Request id")
+        .description("Say yes — put someone's $50 plan on the company bill")
+        .option("--json", "Emit raw JSON")
+        .action(async function (id, opts) {
+        try {
+            const result = await transition(id, "approve");
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            if (result.status === "pending-sponsor-billing") {
+                console.log("Approved. Add a card to start this sponsorship — nothing is covered until then.");
+                if (result.addCardUrl)
+                    console.log(`  ${chalk.cyan(result.addCardUrl)}`);
+                return;
+            }
+            console.log("Approved. Their $50 plan is now on the company bill.");
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    sponsor
+        .command("decline")
+        .argument("<id>", "Request id")
+        .description("Say no to a plan sponsorship request")
+        .option("--json", "Emit raw JSON")
+        .action(async function (id, opts) {
+        try {
+            const result = await transition(id, "decline");
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log("Declined. Their plan stays theirs to pay or reduce.");
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    sponsor
+        .command("revoke")
+        .argument("<id>", "Request id")
+        .description("End a sponsorship the company is currently paying for")
+        .option("--json", "Emit raw JSON")
+        .action(async function (id, opts) {
+        try {
+            // Revoke and decline are the SAME hq-pro route: an active row flips to
+            // declined and the plan goes back to the person. Two names here because
+            // "revoke a sponsorship you're paying for" and "decline a request you
+            // haven't answered" are different things to the admin doing them.
+            const result = await transition(id, "decline");
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log("Ended. Their $50 plan goes back to them from the next bill.");
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    sponsor
+        .command("withdraw")
+        .argument("<id>", "Request id")
+        .description("Take back a sponsorship request you made")
+        .option("--json", "Emit raw JSON")
+        .action(async function (id, opts) {
+        try {
+            // hq-pro lets a person decline THEIR OWN plan row without being an admin
+            // (it resolves the caller's person id server-side and compares it to the
+            // row's requester), so withdraw is the same route scoped to yourself.
+            const result = await transition(id, "decline");
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log("Withdrawn. You can pay the $50 yourself, reduce what you store, or ask another company.");
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+}
+//# sourceMappingURL=billing-sponsor.js.map

package/dist/commands/billing.d.ts

@@ -11,6 +11,9 @@
  * Subcommands:
  *   hq billing status   [--company <slug>]              — subscription + card on file
  *   hq billing checkout [--company <slug>] [--personal] — mint a card-capture link
+ *   hq billing sponsor  …                               — ask a company to cover
+ *                                                         your $50 plan, or
+ *                                                         answer such a request
  */
 import { Command } from "commander";
 export declare function registerBillingCommand(program: Command): void;

package/dist/commands/billing.js

@@ -11,12 +11,16 @@
  * Subcommands:
  *   hq billing status   [--company <slug>]              — subscription + card on file
  *   hq billing checkout [--company <slug>] [--personal] — mint a card-capture link
+ *   hq billing sponsor  …                               — ask a company to cover
+ *                                                         your $50 plan, or
+ *                                                         answer such a request
  */
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { mintPaymentLink } from "../utils/billing-gate.js";
 import { upgradeToTeam } from "../utils/team-upgrade.js";
+import { registerBillingSponsorCommands } from "./billing-sponsor.js";
 function fail(err) {
     console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
     process.exit(1);
@@ -126,5 +130,6 @@ export function registerBillingCommand(program) {
             fail(err);
         }
     });
+    registerBillingSponsorCommands(billing);
 }
 //# sourceMappingURL=billing.js.map

package/dist/commands/login.js

@@ -4,6 +4,11 @@
 import chalk from 'chalk';
 import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
 import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
+import * as readline from "node:readline/promises";
+import { listActiveMembershipCompanies } from "../lib/mesh/api.js";
+import { setDefaultCompany } from "../lib/work-context/config.js";
+import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
+import { workContextRoot } from "../lib/work-context/paths.js";
 function peekIdToken(idToken) {
     try {
         const payload = idToken.split('.')[1];
@@ -24,21 +29,59 @@ export function registerLoginCommand(program) {
         .description('Authenticate with HQ via Cognito')
         .option('--provider <provider>', 'OAuth provider to use: google, microsoft, or picker')
         .action(async (options) => {
+        let accessToken;
         try {
             const existing = loadCachedTokens();
             if (existing && !isExpiring(existing, 120)) {
                 const who = peekIdToken(existing.idToken).email ?? 'cached session';
                 console.log(chalk.green(`Already logged in as ${who}. Run \`hq logout\` to switch accounts.`));
-                return;
+                accessToken = existing.accessToken;
+            }
+            else {
+                console.log('Opening browser for authentication...');
+                const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
+                const who = peekIdToken(tokens.idToken).email ?? 'HQ';
+                console.log(chalk.green(`Logged in as ${who}`));
+                accessToken = tokens.accessToken;
             }
-            console.log('Opening browser for authentication...');
-            const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
-            const who = peekIdToken(tokens.idToken).email ?? 'HQ';
-            console.log(chalk.green(`Logged in as ${who}`));
         }
         catch (error) {
             console.error(chalk.red('Login failed:'), error instanceof Error ? error.message : 'Unknown error');
-            process.exit(1);
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const root = workContextRoot();
+            const activation = await ensureDefaultCompany({
+                root,
+                listMemberships: () => listActiveMembershipCompanies(accessToken),
+                log: (message) => console.error(chalk.dim(message)),
+            });
+            if (activation.status === "needs_choice" && process.stdin.isTTY && process.stdout.isTTY) {
+                const choices = activation.memberships
+                    .map((membership, index) => `${index + 1}. ${membership.slug}`)
+                    .join("\n");
+                const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+                try {
+                    const answer = await rl.question(`Choose this device's default company:\n${choices}\nSelection: `);
+                    const selected = activation.memberships[Number.parseInt(answer, 10) - 1];
+                    if (selected) {
+                        await setDefaultCompany(selected.slug, {
+                            root,
+                            validateMembership: (candidate) => candidate === selected.slug ? { uid: selected.uid } : false,
+                        });
+                    }
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            else if (activation.status === "needs_choice") {
+                console.error(chalk.yellow("Multiple active memberships. Run `hq mesh context default set <slug>` to choose this device's default company."));
+            }
+        }
+        catch (error) {
+            console.error(chalk.yellow('Default-company setup failed:'), error instanceof Error ? error.message : 'Unknown error');
         }
     });
 }

package/dist/commands/mesh.js

@@ -12,13 +12,15 @@ import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js
 import * as readline from "node:readline/promises";
 import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveMembershipCompanies, listActiveThreads, patchStoryStatus, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
-import { clearDefaultCompany, getDefaultCompany, readDeviceConfig, recordMigrationCapabilitySnapshot, setDefaultCompany, } from "../lib/work-context/config.js";
+import { clearDefaultCompany, isDefaultCompanyDisabled, readDeviceConfig, recordMigrationCapabilitySnapshot, setRepairHeldWithDefault, setDefaultCompany, } from "../lib/work-context/config.js";
+import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
 import { DefaultCompanyUnavailableError, } from "../lib/work-context/errors.js";
 import { isValidSessionId } from "../lib/mesh/live/session-identity.js";
 import { CLI_KIND_TO_SCHEMA, resolveEnqueueSessionId, } from "../lib/mesh/live/index.js";
 import { flushSessionEvents } from "../lib/mesh/live/flush.js";
 import { backfillHeldSessions } from "../lib/mesh/live/backfill-held.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/live/session-events-client.js";
+const MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
 import { buildEmitEvidence } from "../lib/mesh/live/emit-evidence.js";
 import { createEmitPoster, buildMeshEmitEvent } from "../lib/mesh/live/emit-client.js";
 import { emitEvents } from "../lib/mesh/live/emit.js";
@@ -153,25 +155,73 @@ async function runContextReconcile(opts) {
     let fetchCandidates;
     let validateMembership;
     let offline = Boolean(opts.offline);
-    if (!offline) {
-        try {
-            const token = await requireToken();
-            deliver = createWorkSessionDeliverer({ token });
-            fetchCandidates = createCandidatesFetcher({ token });
-            validateMembership = async (candidate) => {
-                const membership = await resolveActiveMembershipCompany(token, candidate);
-                if (!membership)
-                    return false;
-                return { uid: membership.companyUid };
-            };
+    let token;
+    try {
+        // Offline is outbox-only delivery. It still refreshes a device default's
+        // token-backed membership so a revoked default cannot be preflighted.
+        token = await requireToken();
+        const sessionToken = token;
+        validateMembership = async (candidate) => {
+            const membership = await new Promise((resolve, reject) => {
+                const timer = setTimeout(() => reject(new Error("membership validation timed out")), MEMBERSHIP_VALIDATION_TIMEOUT_MS);
+                void resolveActiveMembershipCompany(sessionToken, candidate).then((value) => {
+                    clearTimeout(timer);
+                    resolve(value);
+                }, (error) => {
+                    clearTimeout(timer);
+                    reject(error);
+                });
+            });
+            if (!membership || typeof membership.companyUid !== "string" || !membership.companyUid) {
+                return false;
+            }
+            return { uid: membership.companyUid };
+        };
+        if (!offline) {
+            deliver = createWorkSessionDeliverer({ token: sessionToken });
+            fetchCandidates = createCandidatesFetcher({ token: sessionToken });
         }
-        catch {
+    }
+    catch {
+        if (!offline) {
             offline = true;
             if (!opts.machine) {
                 console.error(chalk.yellow("No Cognito session; reconciling offline (outbox only)."));
             }
         }
     }
+    if (token) {
+        const activation = await ensureDefaultCompany({
+            root,
+            listMemberships: () => listActiveMembershipCompanies(token),
+            log: (message) => console.error(chalk.dim(message)),
+        });
+        if (activation.status === "needs_choice") {
+            const interactive = !opts.machine && Boolean(process.stdin.isTTY && process.stdout.isTTY) && !isMachineIdentity();
+            if (interactive) {
+                const choices = activation.memberships
+                    .map((membership, index) => `${index + 1}. ${membership.slug}`)
+                    .join("\n");
+                const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+                try {
+                    const answer = await rl.question(`Choose this device's default company:\n${choices}\nSelection: `);
+                    const selected = activation.memberships[Number.parseInt(answer, 10) - 1];
+                    if (selected) {
+                        await setDefaultCompany(selected.slug, {
+                            root,
+                            validateMembership: (candidate) => candidate === selected.slug ? { uid: selected.uid } : false,
+                        });
+                    }
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            else if (!opts.machine) {
+                console.error(chalk.yellow("Multiple active memberships. Run `hq mesh context default set <slug>` to choose this device's default company."));
+            }
+        }
+    }
     const outcome = await reconcileObservation(obs, {
         root,
         env: process.env,
@@ -295,6 +345,7 @@ async function runContextBackfillHeld(opts) {
     const parsedLimit = opts.limit ? Number.parseInt(opts.limit, 10) : 0;
     const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : 0;
     const companyHint = opts.company?.trim() || undefined;
+    const useDeviceDefault = opts.useDeviceDefault === true || readDeviceConfig({ root }).repairHeldWithDefault === true;
     // Build the reconcile network seam exactly like `hq mesh context reconcile`.
     // Not needed in --dry-run (reconcile is never invoked then). Explicit types
     // because these are captured in the reconcile closure below (no control-flow
@@ -331,6 +382,7 @@ async function runContextBackfillHeld(opts) {
         // Mirror the reconcile closure's non-forcing hint in the dry-run predictor
         // so `--dry-run` and the real run report the same counts.
         remoteOwnerHint: companyHint || undefined,
+        useDeviceDefault,
         reconcile: (obs) => reconcileObservation(
         // Pass --company as a non-forcing hint (remoteOwnerSlug feeds
         // deterministic resolution BELOW the identity-file / device default,
@@ -342,6 +394,8 @@ async function runContextBackfillHeld(opts) {
             fetchCandidates,
             offline,
             validateMembership,
+            allowDeviceDefault: useDeviceDefault,
+            deviceDefaultConfidence: useDeviceDefault,
         }),
     });
     if (opts.json) {
@@ -364,16 +418,34 @@ async function runContextBackfillHeld(opts) {
 async function runContextDefaultGet(opts) {
     const root = workContextHomeRoot();
     const cfg = readDeviceConfig({ root });
-    const current = getDefaultCompany({ root });
+    const current = cfg.defaultCompany?.enabled && cfg.defaultCompany.slug
+        ? cfg.defaultCompany
+        : null;
+    const memberships = cfg.defaultCompanyMemberships?.memberships ?? [];
+    const disabled = isDefaultCompanyDisabled({ root });
+    const source = disabled ? "disabled" : current?.source ?? (current ? "chosen" : "unset");
     if (opts.json) {
-        console.log(JSON.stringify({ ok: true, config: cfg, defaultCompany: current }, null, 2));
+        console.log(JSON.stringify({
+            ok: true,
+            slug: current?.slug ?? null,
+            uid: current?.uid ?? null,
+            enabled: current?.enabled ?? false,
+            source,
+            needsChoice: !current && !disabled && memberships.length > 1,
+            memberships,
+            repairHeldWithDefault: cfg.repairHeldWithDefault === true,
+        }, null, 2));
+        return;
+    }
+    if (disabled) {
+        console.log("Default company disabled on this device.");
         return;
     }
     if (!current) {
         console.log("No device default company (default-company mode may be dark).");
         return;
     }
-    console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled}`);
+    console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled} source=${source}`);
 }
 async function runContextDefaultSet(slug, opts) {
     const root = workContextHomeRoot();
@@ -434,11 +506,14 @@ async function runContextDefaultSet(slug, opts) {
                 return { uid: membership.companyUid };
             },
         });
+        const configured = opts.repairHeldWithDefault
+            ? setRepairHeldWithDefault(true, { root })
+            : cfg;
         if (opts.json) {
-            console.log(JSON.stringify({ ok: true, config: cfg, migrationWarning }, null, 2));
+            console.log(JSON.stringify({ ok: true, config: configured, migrationWarning }, null, 2));
             return;
         }
-        const stored = cfg.defaultCompany;
+        const stored = configured.defaultCompany;
         console.log(`Default company set to ${stored?.slug ?? slug}${stored?.uid ? ` (${stored.uid})` : ""}`);
         if (migrationWarning)
             console.error(chalk.yellow(migrationWarning));
@@ -1035,7 +1110,8 @@ export function registerMeshCommand(program) {
         .option("--dry-run", "Report what would be reconciled; write nothing, no network")
         .option("--offline", "Reconcile outbox-only (no candidates/register network)")
         .option("--limit <n>", "Cap sessions processed (default 0 = no cap)")
-        .option("--company <slug>", "Optional non-forcing company hint (resolver default still wins)")
+        .option("--company <slug>", "Optional non-forcing company hint")
+        .option("--use-device-default", "Opt in to historical repair using the device default (lower-confidence attribution)")
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runContextBackfillHeld(opts))());
     context
@@ -1090,6 +1166,7 @@ export function registerMeshCommand(program) {
         .description("Set the device default company slug after verifying membership")
         .argument("<slug>", "Company slug")
         .option("--allow-without-migration", "Deprecated compatibility no-op; selected-company membership is always verified")
+        .option("--repair-held-with-default", "Persist opt-in for lower-confidence historical held-session repair")
         .option("--company <slug|uid>", "Deprecated no-op; the selected company is verified directly")
         .option("--json", "Print machine-readable JSON")
         .action((slug, opts) => wrap(() => runContextDefaultSet(slug, opts))());