@indigoai-us/hq-cli 5.123.2 → 5.125.0

package/dist/lib/work-context/outbox.js

@@ -21,6 +21,7 @@ export const OUTBOX_ALLOWLIST = [
     "companySlug",
     "projectId",
     "taskId",
+    "companyConfidence",
     "kind",
     "digest",
     "delivery",
@@ -96,6 +97,8 @@ function projectOutbox(op) {
         out.projectId = op.projectId;
     if (op.taskId)
         out.taskId = op.taskId;
+    if (op.companyConfidence)
+        out.companyConfidence = op.companyConfidence;
     if (op.lastErrorCode)
         out.lastErrorCode = op.lastErrorCode;
     if (op.receiptId)
@@ -143,6 +146,7 @@ export function enqueueOutbox(input, root) {
         companySlug: input.companySlug,
         projectId: input.projectId,
         taskId: input.taskId,
+        companyConfidence: input.companyConfidence,
         kind,
         destinationCompanyUid: input.destinationCompanyUid,
         destinationCompanySlug: input.destinationCompanySlug,
@@ -172,6 +176,7 @@ export function enqueueOutbox(input, root) {
         companySlug: input.companySlug,
         projectId: input.projectId,
         taskId: input.taskId,
+        companyConfidence: input.companyConfidence,
         kind,
         digest,
         delivery: "queued",

package/dist/lib/work-context/reconcile.d.ts

@@ -52,6 +52,10 @@ export interface ReconcileDeps {
     root: string;
     env?: NodeJS.ProcessEnv;
     now?: () => Date;
+    /** Used only by explicit historical repair; ordinary reconciliation keeps defaults enabled. */
+    allowDeviceDefault?: boolean;
+    /** Mark explicit historical default repair as lower-confidence local evidence. */
+    deviceDefaultConfidence?: boolean;
     /** Network deliverer; only called after outbox write. */
     deliver?: DeliverFn;
     /** Skip network even when company is resolved (local unit tests). */

package/dist/lib/work-context/reconcile.js

@@ -5,6 +5,7 @@
 import * as fs from "node:fs";
 import { InvalidSessionIdentityError, normalizeSessionIdentity, } from "../mesh/live/session-identity.js";
 import { companyCorrectionPath, companySlugFromCwd, resolveCompany, } from "./company.js";
+import { invalidateDefaultCompanyMemberships, } from "./config.js";
 import { WORK_CONTEXT_CONTRACT_VERSION, normalizeTaskId, } from "./contract.js";
 import { EXIT_INVALID_IDENTITY, EXIT_NOT_TRACKING, EXIT_OK, InvalidDecisionOriginError, NotTrackingError, } from "./errors.js";
 import { decisionFromCandidates, } from "./organize.js";
@@ -24,6 +25,8 @@ function resultOf(parts) {
     };
     if (parts.companyUid)
         out.companyUid = parts.companyUid;
+    if (parts.companySlug)
+        out.companySlug = parts.companySlug;
     if (parts.projectId)
         out.projectId = parts.projectId;
     if (parts.taskId)
@@ -222,6 +225,7 @@ export async function reconcileObservation(obs, deps) {
         hqRoot,
         remoteOwnerSlug,
         repoIdentityKey,
+        allowDeviceDefault: deps.allowDeviceDefault,
         existingState: prior,
     });
     const nowIso = nowFn().toISOString();
@@ -341,8 +345,26 @@ export async function reconcileObservation(obs, deps) {
         };
     }
     // Membership-validated slug→uid when local resolution only yielded a slug.
+    // A device default is weak, cached evidence: validate it authoritatively on
+    // every tenant-I/O path so a membership revocation takes effect immediately.
     let resolvedCompany = company.company;
-    if (!resolvedCompany.uid && resolvedCompany.slug && deps.validateMembership) {
+    const deviceDefaultRequiresValidation = resolvedCompany.source === "device_default";
+    if (deviceDefaultRequiresValidation && !deps.validateMembership) {
+        return {
+            result: resultOf({
+                kind: "needs_company",
+                classification: "needs_company",
+                delivery: "clean",
+                sessionId,
+                clientOperationId: obs.clientOperationId,
+            }),
+            exitCode: EXIT_OK,
+            diagnostics: ["needs_company: device-default membership validator unavailable"],
+        };
+    }
+    if (resolvedCompany.slug &&
+        deps.validateMembership &&
+        (!resolvedCompany.uid || deviceDefaultRequiresValidation)) {
         try {
             const membership = await deps.validateMembership(resolvedCompany.slug);
             if (membership && typeof membership === "object" && membership.uid) {
@@ -353,6 +375,9 @@ export async function reconcileObservation(obs, deps) {
                 diagnostics.push(`membership resolved companyUid for slug=${resolvedCompany.slug}`);
             }
             else if (membership === false) {
+                if (deviceDefaultRequiresValidation) {
+                    invalidateDefaultCompanyMemberships({ root: deps.root, now: nowFn });
+                }
                 diagnostics.push(`membership denied for slug=${resolvedCompany.slug}; treating as needs_company`);
                 const statePath = writeSessionState(mergeLocalSessionFields({
                     contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
@@ -384,6 +409,19 @@ export async function reconcileObservation(obs, deps) {
         }
         catch (err) {
             diagnostics.push(`membership lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+            if (deviceDefaultRequiresValidation) {
+                return {
+                    result: resultOf({
+                        kind: "needs_company",
+                        classification: "needs_company",
+                        delivery: "clean",
+                        sessionId,
+                        clientOperationId: obs.clientOperationId,
+                    }),
+                    exitCode: EXIT_OK,
+                    diagnostics: [...diagnostics, "needs_company: device-default membership refresh unavailable"],
+                };
+            }
         }
     }
     // Company resolved — resolve project/task (US-007B order).
@@ -480,6 +518,11 @@ export async function reconcileObservation(obs, deps) {
         registerClassification === "unresolved") {
         registerClassification = "needs_project";
     }
+    // Offline preflight has authoritative membership but deliberately does not
+    // invent a project. Expose that usable, validated state to hook consumers.
+    if (resolvedCompany.source === "device_default" && deps.offline && registerClassification === "unresolved") {
+        registerClassification = "needs_project";
+    }
     // Do not let a weak later observation erase a server-acknowledged company
     // binding. Keep the result unresolved so the normal candidate threshold can
     // still advance the session, while preserving the durable emitter projection.
@@ -544,6 +587,7 @@ export async function reconcileObservation(obs, deps) {
                 sessionId,
                 clientOperationId: obs.clientOperationId,
                 companyUid: resolvedCompany.uid,
+                companySlug: resolvedCompany.slug,
                 projectId,
                 taskId,
                 bindingEpisodeId: acknowledgedPrior.bindingEpisodeId,
@@ -553,6 +597,9 @@ export async function reconcileObservation(obs, deps) {
         };
     }
     let outboxOp;
+    const companyConfidence = company.status === "resolved" && company.company.source === "device_default"
+        ? "device_default"
+        : undefined;
     try {
         outboxOp = enqueueOutbox({
             clientOperationId: obs.clientOperationId,
@@ -562,6 +609,7 @@ export async function reconcileObservation(obs, deps) {
             companySlug: resolvedCompany.slug,
             projectId,
             taskId,
+            companyConfidence,
             kind: "register",
             now: nowFn,
         }, deps.root);
@@ -588,8 +636,9 @@ export async function reconcileObservation(obs, deps) {
         diagnostics.push(`project source=${projectResolved.source} projectId=${projectId ?? "-"} taskId=${taskId ?? "-"}`);
     }
     let statePath;
+    let stateWrite;
     try {
-        const stateWrite = mergeLocalSessionFields({
+        stateWrite = mergeLocalSessionFields({
             contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
             sessionId,
             companyUid: resolvedCompany.uid,
@@ -602,6 +651,7 @@ export async function reconcileObservation(obs, deps) {
             ...(typeof toolWrites === "number" ? { toolWrites } : {}),
             ...(hasTurn ? { hasTurn: true } : {}),
             ...(decision ? { decision } : {}),
+            ...(companyConfidence ? { companyConfidence } : {}),
             ...transcriptFields,
         }, prior);
         statePath = writeSessionState(stateWrite, deps.root);
@@ -616,6 +666,7 @@ export async function reconcileObservation(obs, deps) {
                     sessionId,
                     clientOperationId: obs.clientOperationId,
                     companyUid: resolvedCompany.uid,
+                    companySlug: resolvedCompany.slug,
                     projectId,
                     taskId,
                     errorCode: "NOT_TRACKING",
@@ -636,6 +687,7 @@ export async function reconcileObservation(obs, deps) {
                 sessionId,
                 clientOperationId: obs.clientOperationId,
                 companyUid: resolvedCompany.uid,
+                companySlug: resolvedCompany.slug,
                 projectId,
                 taskId,
             }),
@@ -665,7 +717,10 @@ export async function reconcileObservation(obs, deps) {
                 ...(typeof toolWrites === "number" ? { toolWrites } : {}),
                 ...(hasTurn ? { hasTurn: true } : {}),
                 ...transcriptFields,
-            }, prior), deps.root);
+            }, 
+            // Merge against the just-written projection rather than the stale
+            // snapshot from before reconciliation (retains device confidence).
+            readSessionState(sessionId, deps.root) ?? stateWrite), deps.root);
         }
         const kind = registerClassification === "bound"
             ? "bound"
@@ -721,6 +776,7 @@ export async function reconcileObservation(obs, deps) {
             sessionId,
             clientOperationId: obs.clientOperationId,
             companyUid: resolvedCompany.uid,
+            companySlug: resolvedCompany.slug,
             projectId,
             taskId,
             errorCode: delivered.code,

package/dist/lib/work-context/state.d.ts

@@ -89,6 +89,8 @@ export interface SessionStateFile {
      * before SESSION_STATE sync (kept after AMEND-001).
      */
     transcriptMarker?: "from transcript";
+    /** Historical repair under device-default evidence is intentionally weak. */
+    companyConfidence?: "device_default";
     updatedAt: string;
 }
 /**

package/dist/lib/work-context/state.js

@@ -27,6 +27,7 @@ export const SESSION_STATE_ALLOWLIST = new Set([
     "source",
     "localHarness",
     "transcriptMarker",
+    "companyConfidence",
     "updatedAt",
 ]);
 export function readSessionState(sessionId, root) {
@@ -100,6 +101,8 @@ export function projectSessionState(state) {
         out.localHarness = state.localHarness;
     if (state.transcriptMarker)
         out.transcriptMarker = state.transcriptMarker;
+    if (state.companyConfidence)
+        out.companyConfidence = state.companyConfidence;
     return out;
 }
 /**
@@ -148,6 +151,13 @@ export function mergeLocalSessionFields(next, prior, options = {}) {
     if (!out.transcriptMarker && prior.transcriptMarker) {
         out.transcriptMarker = prior.transcriptMarker;
     }
+    const sameCompanyBinding = Boolean(prior.companyUid && out.companyUid && prior.companyUid === out.companyUid) ||
+        Boolean(prior.companySlug &&
+            out.companySlug &&
+            prior.companySlug.toLowerCase() === out.companySlug.toLowerCase());
+    if (!out.companyConfidence && prior.companyConfidence && sameCompanyBinding) {
+        out.companyConfidence = prior.companyConfidence;
+    }
     const sameBinding = prior.companyUid === out.companyUid &&
         prior.companySlug === out.companySlug &&
         prior.projectId === out.projectId &&
@@ -237,6 +247,10 @@ export function isHookWrittenSessionState(state) {
 export function authoritativeCompanyFromState(state) {
     if (!state)
         return null;
+    // A binding created only from the device default is deliberately weak. A
+    // later /startwork meta designation or remembered repo choice may replace it.
+    if (state.companyConfidence === "device_default")
+        return null;
     const writable = new Set([
         "unresolved",
         "needs_project",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.123.2",
+  "version": "5.125.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {