@indigoai-us/hq-cli 5.124.0 → 5.126.0

package/dist/lib/work-context/outbox.js

@@ -21,6 +21,7 @@ export const OUTBOX_ALLOWLIST = [
     "companySlug",
     "projectId",
     "taskId",
+    "companyConfidence",
     "kind",
     "digest",
     "delivery",
@@ -96,6 +97,8 @@ function projectOutbox(op) {
         out.projectId = op.projectId;
     if (op.taskId)
         out.taskId = op.taskId;
+    if (op.companyConfidence)
+        out.companyConfidence = op.companyConfidence;
     if (op.lastErrorCode)
         out.lastErrorCode = op.lastErrorCode;
     if (op.receiptId)
@@ -143,6 +146,7 @@ export function enqueueOutbox(input, root) {
         companySlug: input.companySlug,
         projectId: input.projectId,
         taskId: input.taskId,
+        companyConfidence: input.companyConfidence,
         kind,
         destinationCompanyUid: input.destinationCompanyUid,
         destinationCompanySlug: input.destinationCompanySlug,
@@ -172,6 +176,7 @@ export function enqueueOutbox(input, root) {
         companySlug: input.companySlug,
         projectId: input.projectId,
         taskId: input.taskId,
+        companyConfidence: input.companyConfidence,
         kind,
         digest,
         delivery: "queued",

package/dist/lib/work-context/reconcile.d.ts

@@ -52,6 +52,10 @@ export interface ReconcileDeps {
     root: string;
     env?: NodeJS.ProcessEnv;
     now?: () => Date;
+    /** Used only by explicit historical repair; ordinary reconciliation keeps defaults enabled. */
+    allowDeviceDefault?: boolean;
+    /** Mark explicit historical default repair as lower-confidence local evidence. */
+    deviceDefaultConfidence?: boolean;
     /** Network deliverer; only called after outbox write. */
     deliver?: DeliverFn;
     /** Skip network even when company is resolved (local unit tests). */

package/dist/lib/work-context/reconcile.js

@@ -5,6 +5,7 @@
 import * as fs from "node:fs";
 import { InvalidSessionIdentityError, normalizeSessionIdentity, } from "../mesh/live/session-identity.js";
 import { companyCorrectionPath, companySlugFromCwd, resolveCompany, } from "./company.js";
+import { invalidateDefaultCompanyMemberships, } from "./config.js";
 import { WORK_CONTEXT_CONTRACT_VERSION, normalizeTaskId, } from "./contract.js";
 import { EXIT_INVALID_IDENTITY, EXIT_NOT_TRACKING, EXIT_OK, InvalidDecisionOriginError, NotTrackingError, } from "./errors.js";
 import { decisionFromCandidates, } from "./organize.js";
@@ -24,6 +25,8 @@ function resultOf(parts) {
     };
     if (parts.companyUid)
         out.companyUid = parts.companyUid;
+    if (parts.companySlug)
+        out.companySlug = parts.companySlug;
     if (parts.projectId)
         out.projectId = parts.projectId;
     if (parts.taskId)
@@ -222,6 +225,7 @@ export async function reconcileObservation(obs, deps) {
         hqRoot,
         remoteOwnerSlug,
         repoIdentityKey,
+        allowDeviceDefault: deps.allowDeviceDefault,
         existingState: prior,
     });
     const nowIso = nowFn().toISOString();
@@ -341,8 +345,26 @@ export async function reconcileObservation(obs, deps) {
         };
     }
     // Membership-validated slug→uid when local resolution only yielded a slug.
+    // A device default is weak, cached evidence: validate it authoritatively on
+    // every tenant-I/O path so a membership revocation takes effect immediately.
     let resolvedCompany = company.company;
-    if (!resolvedCompany.uid && resolvedCompany.slug && deps.validateMembership) {
+    const deviceDefaultRequiresValidation = resolvedCompany.source === "device_default";
+    if (deviceDefaultRequiresValidation && !deps.validateMembership) {
+        return {
+            result: resultOf({
+                kind: "needs_company",
+                classification: "needs_company",
+                delivery: "clean",
+                sessionId,
+                clientOperationId: obs.clientOperationId,
+            }),
+            exitCode: EXIT_OK,
+            diagnostics: ["needs_company: device-default membership validator unavailable"],
+        };
+    }
+    if (resolvedCompany.slug &&
+        deps.validateMembership &&
+        (!resolvedCompany.uid || deviceDefaultRequiresValidation)) {
         try {
             const membership = await deps.validateMembership(resolvedCompany.slug);
             if (membership && typeof membership === "object" && membership.uid) {
@@ -353,6 +375,9 @@ export async function reconcileObservation(obs, deps) {
                 diagnostics.push(`membership resolved companyUid for slug=${resolvedCompany.slug}`);
             }
             else if (membership === false) {
+                if (deviceDefaultRequiresValidation) {
+                    invalidateDefaultCompanyMemberships({ root: deps.root, now: nowFn });
+                }
                 diagnostics.push(`membership denied for slug=${resolvedCompany.slug}; treating as needs_company`);
                 const statePath = writeSessionState(mergeLocalSessionFields({
                     contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
@@ -384,6 +409,19 @@ export async function reconcileObservation(obs, deps) {
         }
         catch (err) {
             diagnostics.push(`membership lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+            if (deviceDefaultRequiresValidation) {
+                return {
+                    result: resultOf({
+                        kind: "needs_company",
+                        classification: "needs_company",
+                        delivery: "clean",
+                        sessionId,
+                        clientOperationId: obs.clientOperationId,
+                    }),
+                    exitCode: EXIT_OK,
+                    diagnostics: [...diagnostics, "needs_company: device-default membership refresh unavailable"],
+                };
+            }
         }
     }
     // Company resolved — resolve project/task (US-007B order).
@@ -480,6 +518,11 @@ export async function reconcileObservation(obs, deps) {
         registerClassification === "unresolved") {
         registerClassification = "needs_project";
     }
+    // Offline preflight has authoritative membership but deliberately does not
+    // invent a project. Expose that usable, validated state to hook consumers.
+    if (resolvedCompany.source === "device_default" && deps.offline && registerClassification === "unresolved") {
+        registerClassification = "needs_project";
+    }
     // Do not let a weak later observation erase a server-acknowledged company
     // binding. Keep the result unresolved so the normal candidate threshold can
     // still advance the session, while preserving the durable emitter projection.
@@ -544,6 +587,7 @@ export async function reconcileObservation(obs, deps) {
                 sessionId,
                 clientOperationId: obs.clientOperationId,
                 companyUid: resolvedCompany.uid,
+                companySlug: resolvedCompany.slug,
                 projectId,
                 taskId,
                 bindingEpisodeId: acknowledgedPrior.bindingEpisodeId,
@@ -553,6 +597,9 @@ export async function reconcileObservation(obs, deps) {
         };
     }
     let outboxOp;
+    const companyConfidence = company.status === "resolved" && company.company.source === "device_default"
+        ? "device_default"
+        : undefined;
     try {
         outboxOp = enqueueOutbox({
             clientOperationId: obs.clientOperationId,
@@ -562,6 +609,7 @@ export async function reconcileObservation(obs, deps) {
             companySlug: resolvedCompany.slug,
             projectId,
             taskId,
+            companyConfidence,
             kind: "register",
             now: nowFn,
         }, deps.root);
@@ -588,8 +636,9 @@ export async function reconcileObservation(obs, deps) {
         diagnostics.push(`project source=${projectResolved.source} projectId=${projectId ?? "-"} taskId=${taskId ?? "-"}`);
     }
     let statePath;
+    let stateWrite;
     try {
-        const stateWrite = mergeLocalSessionFields({
+        stateWrite = mergeLocalSessionFields({
             contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
             sessionId,
             companyUid: resolvedCompany.uid,
@@ -602,6 +651,7 @@ export async function reconcileObservation(obs, deps) {
             ...(typeof toolWrites === "number" ? { toolWrites } : {}),
             ...(hasTurn ? { hasTurn: true } : {}),
             ...(decision ? { decision } : {}),
+            ...(companyConfidence ? { companyConfidence } : {}),
             ...transcriptFields,
         }, prior);
         statePath = writeSessionState(stateWrite, deps.root);
@@ -616,6 +666,7 @@ export async function reconcileObservation(obs, deps) {
                     sessionId,
                     clientOperationId: obs.clientOperationId,
                     companyUid: resolvedCompany.uid,
+                    companySlug: resolvedCompany.slug,
                     projectId,
                     taskId,
                     errorCode: "NOT_TRACKING",
@@ -636,6 +687,7 @@ export async function reconcileObservation(obs, deps) {
                 sessionId,
                 clientOperationId: obs.clientOperationId,
                 companyUid: resolvedCompany.uid,
+                companySlug: resolvedCompany.slug,
                 projectId,
                 taskId,
             }),
@@ -649,23 +701,47 @@ export async function reconcileObservation(obs, deps) {
     if (delivered.ok) {
         markOutboxAcked(outboxOp.operationId, deps.root, delivered.receiptId, nowFn);
         writeAckedRegisterState(outboxOp, deps.root, delivered.receiptId, nowFn);
-        // Persist binding episode on success for bound registrations.
-        if (registerClassification === "bound") {
+        // Company attribution write for EVERY acked register that resolved a
+        // company — not only bound sessions. A company-only ack (needs_project /
+        // needs_task / unresolved) must still project companyUid/companySlug and
+        // the true computed classification into durable session state; otherwise
+        // the emitter and mesh presence lose the tenant the server already
+        // acknowledged. projectId / taskId are written only when genuinely
+        // resolved, and a fresh bindingEpisodeId only when the session is bound —
+        // never fabricated on a partial path. (writeAckedRegisterState above may
+        // have already recorded a receipt-derived episode for a resolved partial
+        // binding; the default merge preserves that when the binding still matches.)
+        if (resolvedCompany.uid) {
+            const bound = registerClassification === "bound";
+            // A server ack of the company makes it authoritative: the durable status
+            // is at least needs_project (company known, no project), needs_task
+            // (project, no task), or bound (project + task) — mirroring
+            // acknowledgedStatus() in state.ts. Never downgrade an acked company to a
+            // pre-threshold "unresolved" projection; that is what dropped the tenant.
+            const ackedClassification = projectId && taskId
+                ? "bound"
+                : projectId
+                    ? "needs_task"
+                    : "needs_project";
             writeSessionState(mergeLocalSessionFields({
                 contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
                 sessionId,
                 companyUid: resolvedCompany.uid,
                 companySlug: resolvedCompany.slug,
-                contextStatus: "bound",
-                projectId,
-                taskId,
-                bindingEpisodeId: delivered.receiptId,
+                contextStatus: bound ? "bound" : ackedClassification,
+                ...(projectId ? { projectId } : {}),
+                ...(taskId ? { taskId } : {}),
+                ...(bound ? { bindingEpisodeId: delivered.receiptId } : {}),
                 updatedAt: nowFn().toISOString(),
                 startedAt,
                 ...(typeof toolWrites === "number" ? { toolWrites } : {}),
                 ...(hasTurn ? { hasTurn: true } : {}),
                 ...transcriptFields,
-            }, prior), deps.root);
+            }, 
+            // Merge against the just-written projection rather than the stale
+            // pre-reconcile snapshot, so device confidence and any receipt
+            // attribution survive.
+            readSessionState(sessionId, deps.root) ?? stateWrite), deps.root);
         }
         const kind = registerClassification === "bound"
             ? "bound"
@@ -721,6 +797,7 @@ export async function reconcileObservation(obs, deps) {
             sessionId,
             clientOperationId: obs.clientOperationId,
             companyUid: resolvedCompany.uid,
+            companySlug: resolvedCompany.slug,
             projectId,
             taskId,
             errorCode: delivered.code,

package/dist/lib/work-context/state.d.ts

@@ -89,6 +89,8 @@ export interface SessionStateFile {
      * before SESSION_STATE sync (kept after AMEND-001).
      */
     transcriptMarker?: "from transcript";
+    /** Historical repair under device-default evidence is intentionally weak. */
+    companyConfidence?: "device_default";
     updatedAt: string;
 }
 /**

package/dist/lib/work-context/state.js

@@ -27,6 +27,7 @@ export const SESSION_STATE_ALLOWLIST = new Set([
     "source",
     "localHarness",
     "transcriptMarker",
+    "companyConfidence",
     "updatedAt",
 ]);
 export function readSessionState(sessionId, root) {
@@ -100,6 +101,8 @@ export function projectSessionState(state) {
         out.localHarness = state.localHarness;
     if (state.transcriptMarker)
         out.transcriptMarker = state.transcriptMarker;
+    if (state.companyConfidence)
+        out.companyConfidence = state.companyConfidence;
     return out;
 }
 /**
@@ -148,6 +151,13 @@ export function mergeLocalSessionFields(next, prior, options = {}) {
     if (!out.transcriptMarker && prior.transcriptMarker) {
         out.transcriptMarker = prior.transcriptMarker;
     }
+    const sameCompanyBinding = Boolean(prior.companyUid && out.companyUid && prior.companyUid === out.companyUid) ||
+        Boolean(prior.companySlug &&
+            out.companySlug &&
+            prior.companySlug.toLowerCase() === out.companySlug.toLowerCase());
+    if (!out.companyConfidence && prior.companyConfidence && sameCompanyBinding) {
+        out.companyConfidence = prior.companyConfidence;
+    }
     const sameBinding = prior.companyUid === out.companyUid &&
         prior.companySlug === out.companySlug &&
         prior.projectId === out.projectId &&
@@ -237,6 +247,10 @@ export function isHookWrittenSessionState(state) {
 export function authoritativeCompanyFromState(state) {
     if (!state)
         return null;
+    // A binding created only from the device default is deliberately weak. A
+    // later /startwork meta designation or remembered repo choice may replace it.
+    if (state.companyConfidence === "device_default")
+        return null;
     const writable = new Set([
         "unresolved",
         "needs_project",

package/dist/lib/work-context/windows-acl.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Windows DACL check for the work-context config (US-018).
+ *
+ * NTFS has no POSIX mode bits: Node reports `mode` 0666 for every regular
+ * file on win32, so the POSIX `mode & 0o022` test in config.ts can never pass
+ * there. Instead of skipping the check on Windows, this module reads the real
+ * DACL and refuses the config when any principal other than the current user,
+ * SYSTEM, Administrators, or the owner is granted write/modify/full access.
+ *
+ * How the DACL is read (no native dependency):
+ *   `icacls <path> /save <tmpfile>` writes the DACL as an SDDL string
+ *   (`D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-...)`). SDDL carries
+ *   SIDs or well-known SID abbreviations, never display names, so the check is
+ *   independent of the OS language (VORDEFINIERT\Administratoren is still BA /
+ *   S-1-5-32-544). The current user's SID comes from `whoami /user`. Display
+ *   names are only resolved (via PowerShell) for the error message.
+ *
+ * Trust is decided by SID: S-1-5-18 (SYSTEM), S-1-5-32-544 (Administrators),
+ * S-1-3-0 (CREATOR OWNER), S-1-3-4 (OWNER RIGHTS), the current user's SID and
+ * the owner's SID when known.
+ *
+ * Reduced-guarantee path (explicit, documented): the check does NOT throw and
+ * instead emits one stderr diagnostic that the config is unprotected on this
+ * platform when, and only when, the DACL cannot be evaluated:
+ *   - icacls is missing, fails, or its output has no SDDL line (unreadable);
+ *   - an ACE grants write to a principal whose SID we cannot resolve (an SDDL
+ *     abbreviation this module does not know), or carries a rights token we
+ *     cannot decode, or the current user's SID is unknown and the grant is to
+ *     a non-well-known SID (unresolvable).
+ * A DACL that parses and grants write to a resolved SID outside the trusted
+ * set always throws UnsafeConfigPathError. Nothing else falls back.
+ */
+export interface SddlAce {
+    /** ACE type token, e.g. `A` (allow) or `D` (deny). */
+    type: string;
+    /** ACE flag string, e.g. `OICIID`. */
+    flags: string;
+    /** Rights field as written, e.g. `FA`, `0x1200a9`, `CCDCLCSWRPWPRC`. */
+    rights: string;
+    /** Account field as written: full SID or two-letter abbreviation. */
+    account: string;
+}
+export type AclReadResult = {
+    readable: true;
+    sddl: string;
+} | {
+    readable: false;
+    reason: string;
+};
+export interface WindowsAclCheckOptions {
+    /** Current user SID (defaults to `whoami /user`). `null` = unknown. */
+    currentUserSid?: string | null;
+    /** Owner SID when known (icacls /save does not include the owner). */
+    ownerSid?: string | null;
+    /** DACL reader; injectable for tests. Defaults to `icacls <path> /save`. */
+    readAcl?: (targetPath: string) => AclReadResult;
+    /** SID → display name for error messages; injectable for tests. */
+    resolveSidName?: (sid: string) => string | null;
+    /** Diagnostic sink for the reduced-guarantee path (defaults to stderr). */
+    diagnostic?: (line: string) => void;
+}
+export type AclVerdict = {
+    kind: "safe";
+} | {
+    kind: "unsafe";
+    sid: string;
+    rights: string;
+} | {
+    kind: "unresolvable";
+    reason: string;
+};
+export declare const SID_SYSTEM = "S-1-5-18";
+export declare const SID_ADMINISTRATORS = "S-1-5-32-544";
+export declare const SID_CREATOR_OWNER = "S-1-3-0";
+export declare const SID_OWNER_RIGHTS = "S-1-3-4";
+/** Resolve an SDDL account field to a SID, or null when unknown. */
+export declare function sddlAccountToSid(account: string): string | null;
+/** Any of these bits lets the holder change the file or replace it. */
+export declare const WRITE_MASK: number;
+/** Decode an SDDL rights field to an access mask, or null when undecodable. */
+export declare function sddlRightsToMask(rights: string): number | null;
+/**
+ * Parse the DACL portion of an SDDL string into ACEs. Accepts a full security
+ * descriptor string (`O:...G:...D:...S:...`) or just the `D:` section.
+ * Returns null when no DACL section is present or an ACE is malformed.
+ */
+export declare function parseSddlDacl(sddl: string): SddlAce[] | null;
+/**
+ * Parse the file `icacls <path> /save <file>` writes: UTF-16LE (optional BOM),
+ * CRLF, alternating `<name>` / `<sddl>` lines. Returns the SDDL of the first
+ * entry (the target itself), or an unreadable result.
+ */
+export declare function parseIcaclsSaveOutput(raw: string | Buffer): AclReadResult;
+/**
+ * Absolute path of a System32 tool. PATH lookup is not safe here: Git Bash and
+ * MSYS environments put a coreutils `whoami` ahead of Windows' `whoami.exe`,
+ * which does not understand `/user` and would make the current user SID look
+ * unknown on every run.
+ */
+export declare function system32Tool(exe: string): string;
+export declare function readAclWithIcaclsSave(targetPath: string): AclReadResult;
+/** Current user's SID via `whoami /user /fo csv /nh`; null when unavailable. */
+export declare function readCurrentUserSid(): string | null;
+/** Best-effort SID → account name (only used to build error messages). */
+export declare function resolveSidNameWithPowerShell(sid: string): string | null;
+/**
+ * Evaluate parsed ACEs against the trusted SID set.
+ * - `unsafe`: an allow ACE grants a write bit to a resolved, untrusted SID.
+ * - `unresolvable`: a write-granting ACE whose SID or rights cannot be decoded,
+ *   or whose SID is a per-machine/domain SID while the current user is unknown.
+ * - `safe`: everything else (deny ACEs and read-only grants are ignored).
+ */
+export declare function evaluateDacl(aces: SddlAce[], opts: Pick<WindowsAclCheckOptions, "currentUserSid" | "ownerSid">): AclVerdict;
+/**
+ * Assert the Windows DACL of `targetPath` grants write only to trusted
+ * principals. Throws UnsafeConfigPathError naming the offending principal.
+ * Unreadable or unresolvable DACL → reduced-guarantee diagnostic (once per
+ * path), no throw. See the module header for the exact conditions.
+ */
+export declare function assertWindowsOwnerOnlyAcl(targetPath: string, kind: "file" | "directory", opts?: WindowsAclCheckOptions): void;
+/** Test hook: forget which paths already emitted the reduced-guarantee line. */
+export declare function resetWindowsAclDiagnostics(): void;
+//# sourceMappingURL=windows-acl.d.ts.map