@indigoai-us/hq-cli 5.124.0 → 5.126.0

package/dist/lib/mesh/live/daemon/run.js

@@ -13,10 +13,13 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { CLI_VERSION } from "../../../../cli-version.js";
 import { createWorkSessionDeliverer } from "../../client.js";
-import { meshJson, resolveActiveMembershipCompany } from "../../api.js";
+import { listActiveMembershipCompanies, meshJson, resolveActiveMembershipCompany } from "../../api.js";
 import { ensureCognitoToken } from "../../../../utils/cognito-session.js";
 import { replayOutbox } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
+import { ensureDefaultCompany } from "../../../work-context/default-company.js";
+import { invalidateDefaultCompanyMemberships, readDeviceConfig, } from "../../../work-context/config.js";
+import { readSessionState, writeSessionState, } from "../../../work-context/state.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../session-events-client.js";
 import { flushSessionEvents, HELD_RETRY_INTERVAL_MS, } from "../flush.js";
 import { backfillHeldSessions, } from "../backfill-held.js";
@@ -28,7 +31,7 @@ import { appendDaemonLog, daemonLogLine, ensureDaemonLog } from "./log.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock, } from "./pid-lock.js";
 import { daemonDir } from "./paths.js";
 import { PresenceClient, } from "./presence.js";
-import { defaultDaemonState, patchDaemonState, writeDaemonState, } from "./state.js";
+import { defaultDaemonState, patchDaemonState, readDaemonState, writeDaemonState, } from "./state.js";
 import { workMeshHeldPath } from "../paths.js";
 import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
 import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
@@ -38,6 +41,7 @@ export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
+export const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2_000;
 /** Non-zero exit reserved for CLI version drift so legacy Restart=on-failure units restart. */
 export const DAEMON_VERSION_DRIFT_EXIT_CODE = 75;
 /**
@@ -111,12 +115,69 @@ export async function runMeshDaemon(deps = {}) {
     // daemon went dark once its IoT credentials expired.
     const defaultGetToken = async () => ensureCognitoToken({ interactive: false, tokenSource: "machine" });
     const getToken = deps.getToken ?? defaultGetToken;
+    const resolveMembership = deps.resolveMembership ?? resolveActiveMembershipCompany;
+    /** The sole authorization seam for daemon tenant I/O derived from a device default. */
+    const tenantGate = {
+        authorize: async (input) => {
+            const state = input.state ?? (input.sessionId
+                ? readSessionState(input.sessionId, ctxRoot)
+                : null);
+            const slug = input.companySlug ?? state?.companySlug;
+            const membership = await (async () => {
+                try {
+                    if (!slug)
+                        return null;
+                    const controller = new AbortController();
+                    const timeout = setTimeout(() => controller.abort(), DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS);
+                    try {
+                        return await Promise.race([
+                            resolveMembership(await getToken(), slug, controller.signal),
+                            new Promise((resolve) => controller.signal.addEventListener("abort", () => resolve(null), { once: true })),
+                        ]);
+                    }
+                    finally {
+                        clearTimeout(timeout);
+                    }
+                }
+                catch {
+                    return null;
+                }
+            })();
+            const uid = membership?.companyUid;
+            if (!input.deviceDefault)
+                return uid ? { uid } : false;
+            if (uid &&
+                (!input.companyUid || input.companyUid === uid) &&
+                (!state?.companyUid || state.companyUid === uid)) {
+                return { uid };
+            }
+            try {
+                invalidateDefaultCompanyMemberships({ root: ctxRoot, now });
+            }
+            catch (err) {
+                log(dir, `default membership cache invalidation failed: ${String(err).slice(0, 160)}`);
+            }
+            if (state) {
+                writeSessionState({
+                    ...state,
+                    companyUid: undefined,
+                    companySlug: undefined,
+                    contextStatus: "needs_company",
+                    updatedAt: now().toISOString(),
+                }, ctxRoot);
+            }
+            const prior = readDaemonState(dir)?.deviceDefaultAuthorizationDenials ?? 0;
+            patchDaemonState(dir, { deviceDefaultAuthorizationDenials: prior + 1 }, now);
+            log(dir, `device-default membership denied${slug ? ` company=${slug}` : ""}; work held`);
+            return false;
+        },
+    };
     /** In-memory held re-attempt throttle (survives watch-triggered flushes). */
     let lastHeldRetryAtMs = 0;
     const flushFn = deps.flush ??
         (async () => {
             const t = await getToken();
-            const poster = createSessionEventsPoster({
+            const poster = deps.poster ?? createSessionEventsPoster({
                 token: t,
                 baseUrl: resolveVaultApiBase(env),
             });
@@ -130,32 +191,81 @@ export async function runMeshDaemon(deps = {}) {
                     lastHeldRetryAtMs = atMs;
                 },
                 log: (message) => log(dir, message),
+                authorizeDeviceDefaultTenant: async (state) => Boolean(await tenantGate.authorize({
+                    state,
+                    companySlug: state.companySlug,
+                    companyUid: state.companyUid,
+                    deviceDefault: true,
+                })),
             });
         });
     const replayFn = deps.replayOutbox ??
         (async () => {
             const t = await getToken();
-            const deliver = createWorkSessionDeliverer({ token: t });
-            return replayOutbox(ctxRoot, deliver);
+            const deliver = deps.deliver ?? createWorkSessionDeliverer({ token: t });
+            return replayOutbox(ctxRoot, async (op) => {
+                const state = readSessionState(op.sessionId, ctxRoot);
+                // Provenance must survive session-state loss. For pre-upgrade outbox
+                // entries without provenance, absent state is unknown and therefore
+                // requires the same membership check before delivery.
+                const requiresMembershipCheck = op.companyConfidence === "device_default" ||
+                    state?.companyConfidence === "device_default" ||
+                    // Pre-provenance entries are untrusted even if an equally legacy
+                    // session state happens to exist. A current membership read is the
+                    // only authority that may release them.
+                    !op.companyConfidence;
+                if (requiresMembershipCheck) {
+                    const allowed = await tenantGate.authorize({
+                        state: state ?? undefined,
+                        companySlug: op.companySlug ?? state?.companySlug,
+                        companyUid: op.companyUid ?? state?.companyUid,
+                        deviceDefault: true,
+                    });
+                    if (!allowed) {
+                        return { ok: false, retryable: false, code: "DEVICE_DEFAULT_MEMBERSHIP_DENIED" };
+                    }
+                }
+                return deliver(op);
+            });
         });
+    const activateDefaultCompany = async () => {
+        try {
+            const token = await getToken();
+            await ensureDefaultCompany({
+                root: ctxRoot,
+                env,
+                listMemberships: () => listActiveMembershipCompanies(token),
+                log: (message) => log(dir, message),
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            log(dir, `default company activation skipped: ${message.slice(0, 160)}`);
+        }
+    };
     const backfillFn = deps.backfillHeld ??
         (async () => {
+            await activateDefaultCompany();
             const token = await getToken();
             const deliver = createWorkSessionDeliverer({ token });
+            const useDeviceDefault = readDeviceConfig({ root: ctxRoot }).repairHeldWithDefault === true;
             return backfillHeldSessions({
                 workMeshRoot: meshRoot,
                 workContextRoot: ctxRoot,
                 hqRoots: trustedRoots,
                 limit: deps.heldBackfillBatchSize ?? HELD_BACKFILL_STARTUP_BATCH_SIZE,
                 env,
+                useDeviceDefault,
                 reconcile: (observation) => reconcileObservation(observation, {
                     root: ctxRoot,
                     env,
                     deliver,
-                    validateMembership: async (slug) => {
-                        const membership = await resolveActiveMembershipCompany(token, slug);
-                        return membership ? { uid: membership.companyUid } : false;
-                    },
+                    validateMembership: async (slug) => tenantGate.authorize({
+                        companySlug: slug,
+                        deviceDefault: useDeviceDefault,
+                    }),
+                    allowDeviceDefault: useDeviceDefault,
+                    deviceDefaultConfidence: useDeviceDefault,
                 }),
             });
         });
@@ -163,7 +273,7 @@ export async function runMeshDaemon(deps = {}) {
     const refreshFn = deps.refreshBoards ??
         (async () => {
             const t = await getToken();
-            const reader = createVaultBoardReader({
+            const reader = deps.readBoard ?? createVaultBoardReader({
                 getJson: (p) => meshJson(t, p),
             });
             return refreshBoundSessionBoards({
@@ -172,6 +282,12 @@ export async function runMeshDaemon(deps = {}) {
                 lastRefresh: boardLast,
                 intervalMs: BOARD_REFRESH_INTERVAL_MS,
                 now: () => timers.now(),
+                authorizeDeviceDefaultTenant: async (_sessionId, state) => Boolean(await tenantGate.authorize({
+                    state,
+                    companySlug: state.companySlug,
+                    companyUid: state.companyUid,
+                    deviceDefault: true,
+                })),
             });
         });
     let presence = null;
@@ -490,6 +606,9 @@ export async function runMeshDaemon(deps = {}) {
     if (!requestRestartForVersionDrift() && emitPath) {
         void doFlushCycle("start");
     }
+    else {
+        void activateDefaultCompany();
+    }
     void refreshFn().catch(() => undefined);
     if (emitPath) {
         void runTranscriptTick();

package/dist/lib/mesh/live/daemon/state.d.ts

@@ -27,6 +27,8 @@ export interface DaemonStateFile {
     presenceRefusal?: PresenceRefusalState | null;
     /** Daemon emit mode: "legacy" (spool/flush) or "direct" (receive-only). */
     emitMode?: "legacy" | "direct";
+    /** Authoritative membership denials for device-default-derived tenant I/O. */
+    deviceDefaultAuthorizationDenials?: number;
     updatedAt: string;
 }
 export declare function defaultDaemonState(pid: number, now?: () => Date): DaemonStateFile;

package/dist/lib/mesh/live/flush.d.ts

@@ -8,6 +8,7 @@
  * Orphan `*.claimed` files from a prior crash are recovered first.
  * 2xx responses are accounted per eventId (accepted / duplicates / rejected).
  */
+import { type SessionStateFile } from "../../work-context/state.js";
 import { type RandomFn, type SleepFn } from "./backoff.js";
 import { type SessionEventsPoster } from "./session-events-client.js";
 export declare const HELD_TTL_MS: number;
@@ -43,6 +44,8 @@ export interface FlushDeps {
     heldMaxLines?: number;
     /** Optional logger (daemon wires this); used once per overflow trim. */
     log?: (message: string) => void;
+    /** Authoritative gate for state derived from a device default. */
+    authorizeDeviceDefaultTenant?: (state: SessionStateFile) => Promise<boolean>;
 }
 export interface FlushSummary {
     claimed: number;

package/dist/lib/mesh/live/flush.js

@@ -218,6 +218,17 @@ export async function flushSessionEvents(deps) {
         };
         for (const [sessionId, items] of bySession) {
             const state = readSessionState(sessionId, deps.workContextRoot);
+            if (state?.companyConfidence === "device_default" &&
+                deps.authorizeDeviceDefaultTenant &&
+                !(await deps.authorizeDeviceDefaultTenant(state))) {
+                const heldAt = now().toISOString();
+                for (const item of items) {
+                    appendHeldLine(heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? heldAt), deps.workMeshRoot);
+                    summary.held += 1;
+                    markDisposed(item.event);
+                }
+                continue;
+            }
             const decision = classifySession(state);
             if (decision.action === "drop") {
                 appendDroppedReceipt({

package/dist/lib/scan-packages/index.js

@@ -163,34 +163,39 @@ function ensureSymlink(link, info, warn) {
         warn(`payload missing: ${link.src} (declared but not shipped)`);
         return;
     }
+    const relativeSrc = path.relative(path.dirname(link.dst), link.src);
     fs.mkdirSync(path.dirname(link.dst), { recursive: true });
     try {
         const stat = fs.lstatSync(link.dst);
         if (stat.isSymbolicLink()) {
             const existing = fs.readlinkSync(link.dst);
-            if (existing === link.src)
+            // Correct form is relative to the host directory so a tree can move
+            // between machines. An absolute match (this host, pre-relative installer)
+            // is ours and converges. A dangling leftover from another HQ root is
+            // not host content and is rewritten the same way.
+            if (existing === relativeSrc)
                 return;
-            // "Host content wins" protects content. A symlink that does not resolve
-            // is not content — and it is the shape every pack link takes when a tree
-            // moves between machines, because these links are absolute and the old
-            // HQ root does not exist on the new host. Skipping it would make that
-            // state permanent: stale on this run, and on every run after it.
-            //
+            if (existing === link.src) {
+                fs.rmSync(link.dst, { force: true });
+                fs.symlinkSync(relativeSrc, link.dst);
+                info(`relinked ${link.dst} -> ${relativeSrc} (was ${existing})`);
+                return;
+            }
             // Only a lookup that specifically says "not there" earns a relink.
             // fs.existsSync also answers false for EACCES, which would read content
             // this user merely cannot traverse as absent and delete the link to it.
             const lookup = targetLookup(link.dst);
             if (lookup === 'absent') {
                 fs.rmSync(link.dst, { force: true });
-                fs.symlinkSync(link.src, link.dst);
-                info(`relinked ${link.dst} -> ${link.src} (was ${existing}, which does not exist here)`);
+                fs.symlinkSync(relativeSrc, link.dst);
+                info(`relinked ${link.dst} -> ${relativeSrc} (was ${existing}, which does not exist here)`);
                 return;
             }
             if (lookup !== 'present') {
                 warn(`collision: ${link.dst} points at ${existing}, which could not be checked (${lookup}) — leaving it alone`);
                 return;
             }
-            warn(`collision: ${link.dst} already points at ${existing} (wanted ${link.src}) — skipping`);
+            warn(`collision: ${link.dst} already points at ${existing} (wanted ${relativeSrc}) — skipping`);
             return;
         }
         warn(`collision: ${link.dst} exists as regular file/dir — host content wins, skipping`);
@@ -200,8 +205,8 @@ function ensureSymlink(link, info, warn) {
         if (error.code !== 'ENOENT')
             throw error;
     }
-    fs.symlinkSync(link.src, link.dst);
-    info(`linked ${link.dst} -> ${link.src}`);
+    fs.symlinkSync(relativeSrc, link.dst);
+    info(`linked ${link.dst} -> ${relativeSrc}`);
 }
 /**
  * The link text, when `entry` is a symlink whose target is definitively not

package/dist/lib/work-context/company.d.ts

@@ -65,6 +65,8 @@ export interface CompanyResolveInput {
      * session-meta. Omitted (or unmapped) → the ladder falls through unchanged.
      */
     repoIdentityKey?: string | null;
+    /** Explicit historical repair may disable weak device-default evidence. */
+    allowDeviceDefault?: boolean;
 }
 /** Env naming the on-box identity.json (fleet agent boxes). */
 export declare const HQ_AGENT_IDENTITY_FILE_ENV = "HQ_AGENT_IDENTITY_FILE";
@@ -76,6 +78,12 @@ export declare const DEFAULT_AGENT_IDENTITY_FILE = "/var/lib/hq-agent/identity.j
  * (never throws; never logs file contents).
  */
 export declare function readAgentIdentityCompanyUid(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Agent boxes must never infer a human device default. The file itself is the
+ * machine marker; legacy identity files do not necessarily contain a company
+ * UID, so parsing for that field is not an eligibility check.
+ */
+export declare function hasAgentIdentityFile(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Compare companies: UIDs when both sides have them; otherwise normalized
  * slugs when both have slugs. Never treat uid+slug vs slug-only as a

package/dist/lib/work-context/company.js

@@ -63,6 +63,23 @@ export function readAgentIdentityCompanyUid(env = process.env) {
         return undefined;
     }
 }
+/**
+ * Agent boxes must never infer a human device default. The file itself is the
+ * machine marker; legacy identity files do not necessarily contain a company
+ * UID, so parsing for that field is not an eligibility check.
+ */
+export function hasAgentIdentityFile(env = process.env) {
+    const configured = env[HQ_AGENT_IDENTITY_FILE_ENV];
+    const identityPath = configured === undefined ? DEFAULT_AGENT_IDENTITY_FILE : configured.trim();
+    if (!identityPath)
+        return false;
+    try {
+        return fs.existsSync(identityPath);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Compare companies: UIDs when both sides have them; otherwise normalized
  * slugs when both have slugs. Never treat uid+slug vs slug-only as a
@@ -178,6 +195,16 @@ export function resolveDeterministicCompany(input) {
     }
     return null;
 }
+function conflictingDeterministicEvidence(input) {
+    const cwd = companySlugFromCwd(input.cwd, input.hqRoot);
+    const remote = normalizeSlug(input.remoteOwnerSlug ?? undefined);
+    if (!cwd || !remote || cwd.toLowerCase() === remote.toLowerCase())
+        return null;
+    return {
+        cwd: { slug: cwd, source: "deterministic_cwd" },
+        remote: { slug: remote, source: "deterministic_remote" },
+    };
+}
 export function resolveCompany(input) {
     const env = input.env ?? process.env;
     // 1. Trusted explicit: HQ_SPAWN_COMPANY or observation trusted/explicit.
@@ -205,28 +232,31 @@ export function resolveCompany(input) {
             uid: prior.uid,
             source: "existing_scope",
         };
-        // After a binding exists, a suspected other-company mismatch cannot
-        // auto-switch — return company_conflict with the US-017B correction path.
+        // Deterministic evidence from another company never silently replaces a
+        // scoped session, even before it has a project binding. Preserve the
+        // original scope and surface a conflict before tenant I/O.
         const hadBinding = Boolean(state &&
             (state.contextStatus === "bound" ||
                 state.contextStatus === "needs_task" ||
                 state.contextStatus === "needs_project") &&
             (state.projectId || state.bindingEpisodeId));
-        if (hadBinding) {
-            const deterministic = resolveDeterministicCompany({
-                cwd: input.cwd,
-                hqRoot: input.hqRoot,
-                remoteOwnerSlug: input.remoteOwnerSlug,
-            });
-            if (deterministic && !sameCompany(scoped, deterministic)) {
-                return {
-                    status: "company_conflict",
-                    defaultCompany: scoped,
-                    evidenceCompany: deterministic,
-                    afterBinding: true,
-                    correctionPath: companyCorrectionPath(input.sessionId),
-                };
-            }
+        const deterministic = resolveDeterministicCompany({
+            cwd: input.cwd,
+            hqRoot: input.hqRoot,
+            remoteOwnerSlug: input.remoteOwnerSlug,
+        });
+        if (deterministic && !sameCompany(scoped, deterministic)) {
+            return {
+                status: "company_conflict",
+                defaultCompany: scoped,
+                evidenceCompany: deterministic,
+                ...(hadBinding
+                    ? {
+                        afterBinding: true,
+                        correctionPath: companyCorrectionPath(input.sessionId),
+                    }
+                    : {}),
+            };
         }
         return { status: "resolved", company: scoped };
     }
@@ -264,12 +294,26 @@ export function resolveCompany(input) {
         }
     }
     // 5 + 6. Device default vs deterministic evidence.
-    const deviceDefault = getDefaultCompany({ root: input.root });
+    const deviceDefault = input.allowDeviceDefault === false ? null : getDefaultCompany({ root: input.root });
     const deterministic = resolveDeterministicCompany({
         cwd: input.cwd,
         hqRoot: input.hqRoot,
         remoteOwnerSlug: input.remoteOwnerSlug,
     });
+    const deterministicConflict = conflictingDeterministicEvidence({
+        cwd: input.cwd,
+        hqRoot: input.hqRoot,
+        remoteOwnerSlug: input.remoteOwnerSlug,
+    });
+    // Cwd and remote are both deterministic evidence. Their disagreement is
+    // never permission to fall through to a weaker device preference.
+    if (deterministicConflict) {
+        return {
+            status: "company_conflict",
+            defaultCompany: deterministicConflict.cwd,
+            evidenceCompany: deterministicConflict.remote,
+        };
+    }
     if (deviceDefault?.enabled && deviceDefault.slug) {
         const def = {
             slug: deviceDefault.slug,

package/dist/lib/work-context/config.d.ts

@@ -2,12 +2,25 @@
  * Device-local default company preference (~/.hq/work-context/config.json).
  * Preference only — never authority. activeCompany is never treated as default.
  */
+import * as fs from "node:fs";
+import { type WindowsAclCheckOptions } from "./windows-acl.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 export declare const DEVICE_CONFIG_SCHEMA_VERSION: 1;
 export interface DeviceDefaultCompany {
     slug: string;
     uid?: string;
     enabled: boolean;
+    /** Whether this device chose the value or safely inferred its only membership. */
+    source?: "auto_single" | "chosen" | "disabled";
+}
+export interface DefaultCompanyMembership {
+    slug: string;
+    uid: string;
+}
+/** Cached active memberships. This avoids a network lookup for each hook. */
+export interface DefaultCompanyMembershipSnapshot {
+    checkedAt: string;
+    memberships: DefaultCompanyMembership[];
 }
 /** Last probe of GET /v1/work-mesh/capabilities across memberships (US-017B). */
 export interface MigrationCapabilitySnapshot {
@@ -36,10 +49,16 @@ export interface WorkContextDeviceConfig {
     schemaVersion: typeof DEVICE_CONFIG_SCHEMA_VERSION;
     /** Explicit device default. Never copied from activeCompany. */
     defaultCompany?: DeviceDefaultCompany | null;
+    /** Marks a null default written by the automatic-activation implementation. */
+    defaultCompanyAutomaticEligible?: true;
     /** Last-known migration capability across memberships (doctor reports this). */
     migrationCapability?: MigrationCapabilitySnapshot | null;
     /** Per-repo company map (gap 4). Remembers each repo's filed-under company. */
     repoCompanyMap?: RepoCompanyMap | null;
+    /** Membership cache used to activate an unconfigured device default. */
+    defaultCompanyMemberships?: DefaultCompanyMembershipSnapshot | null;
+    /** Historical held-session repair stays opt-in because a default is weak evidence. */
+    repairHeldWithDefault?: boolean;
     updatedAt: string;
 }
 /** true / { uid } = member; false = not a member. */
@@ -58,8 +77,34 @@ export interface DeviceConfigDeps {
     validateMembership?: (slug: string) => Promise<MembershipValidationResult> | MembershipValidationResult;
     now?: () => Date;
 }
+export declare const CONFIG_LOCK_STALE_MS = 30000;
+/** Acquire an interprocess config lock; exported for direct lock regression tests. */
+export declare function acquireDeviceConfigLock(root: string, options?: {
+    timeoutMs?: number;
+    staleMs?: number;
+}): () => void;
+/** Injection points for assertSafeConfigPath (tests only). */
+export interface SafeConfigPathIo {
+    platform?: NodeJS.Platform;
+    existsSync?: (p: string) => boolean;
+    lstatSync?: (p: string) => Pick<fs.Stats, "mode" | "isSymbolicLink">;
+    windowsAcl?: WindowsAclCheckOptions;
+}
+/**
+ * Refuse a config path that is a symlink (every platform) or writable by
+ * anyone other than the owner.
+ *
+ * - POSIX (darwin/linux/...): `mode & 0o022` must be clear. Unchanged.
+ * - win32: NTFS has no POSIX mode bits; Node reports 0666 for every regular
+ *   file, so the mode test would reject every config (US-018). We read the
+ *   real DACL instead (see windows-acl.ts). Unreadable DACL → documented
+ *   reduced-guarantee path: one diagnostic line, no throw.
+ */
+export declare function assertSafeConfigPath(configPath: string, io?: SafeConfigPathIo): void;
 export declare function readDeviceConfig(deps: Pick<DeviceConfigDeps, "root">): WorkContextDeviceConfig;
 export declare function getDefaultCompany(deps: Pick<DeviceConfigDeps, "root">): DeviceDefaultCompany | null;
+/** A clear is a durable opt-out, not an invitation for automatic reactivation. */
+export declare function isDefaultCompanyDisabled(deps: Pick<DeviceConfigDeps, "root">): boolean;
 export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps): Promise<WorkContextDeviceConfig>;
 export declare function clearDefaultCompany(deps: DeviceConfigDeps): WorkContextDeviceConfig;
 /**
@@ -77,6 +122,16 @@ export declare function setRepoCompany(key: string, mapping: {
 }, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
 /** Persist the last memberships-wide migration capability probe (US-017B). */
 export declare function recordMigrationCapabilitySnapshot(snapshot: MigrationCapabilitySnapshot, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
+export declare function recordDefaultCompanyMemberships(snapshot: DefaultCompanyMembershipSnapshot, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
+/** Drop cached membership evidence immediately after an authoritative denial. */
+export declare function invalidateDefaultCompanyMemberships(deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
+/** Persist a default only after the complete active-membership list verified it. */
+export declare function setAutoDefaultCompany(membership: DefaultCompanyMembership, deps: Pick<DeviceConfigDeps, "root" | "now"> & {
+    expectedUpdatedAt?: string;
+    /** Test seam: runs after the guarded read while the config lock is held. */
+    afterCompareAndSwap?: () => void;
+}): WorkContextDeviceConfig;
+export declare function setRepairHeldWithDefault(enabled: boolean, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
 /** Convenience: build deps from HOME / injectable root. */
 export declare function deviceConfigDepsFromHome(home?: string, extras?: Partial<DeviceConfigDeps>): DeviceConfigDeps;
 /** Re-export for callers that stamp contractVersion on related state. */