@indigoai-us/hq-cli 5.124.0 → 5.126.0

package/dist/commands/login.js

@@ -4,6 +4,11 @@
 import chalk from 'chalk';
 import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
 import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
+import * as readline from "node:readline/promises";
+import { listActiveMembershipCompanies } from "../lib/mesh/api.js";
+import { setDefaultCompany } from "../lib/work-context/config.js";
+import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
+import { workContextRoot } from "../lib/work-context/paths.js";
 function peekIdToken(idToken) {
     try {
         const payload = idToken.split('.')[1];
@@ -24,21 +29,59 @@ export function registerLoginCommand(program) {
         .description('Authenticate with HQ via Cognito')
         .option('--provider <provider>', 'OAuth provider to use: google, microsoft, or picker')
         .action(async (options) => {
+        let accessToken;
         try {
             const existing = loadCachedTokens();
             if (existing && !isExpiring(existing, 120)) {
                 const who = peekIdToken(existing.idToken).email ?? 'cached session';
                 console.log(chalk.green(`Already logged in as ${who}. Run \`hq logout\` to switch accounts.`));
-                return;
+                accessToken = existing.accessToken;
+            }
+            else {
+                console.log('Opening browser for authentication...');
+                const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
+                const who = peekIdToken(tokens.idToken).email ?? 'HQ';
+                console.log(chalk.green(`Logged in as ${who}`));
+                accessToken = tokens.accessToken;
             }
-            console.log('Opening browser for authentication...');
-            const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
-            const who = peekIdToken(tokens.idToken).email ?? 'HQ';
-            console.log(chalk.green(`Logged in as ${who}`));
         }
         catch (error) {
             console.error(chalk.red('Login failed:'), error instanceof Error ? error.message : 'Unknown error');
-            process.exit(1);
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const root = workContextRoot();
+            const activation = await ensureDefaultCompany({
+                root,
+                listMemberships: () => listActiveMembershipCompanies(accessToken),
+                log: (message) => console.error(chalk.dim(message)),
+            });
+            if (activation.status === "needs_choice" && process.stdin.isTTY && process.stdout.isTTY) {
+                const choices = activation.memberships
+                    .map((membership, index) => `${index + 1}. ${membership.slug}`)
+                    .join("\n");
+                const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+                try {
+                    const answer = await rl.question(`Choose this device's default company:\n${choices}\nSelection: `);
+                    const selected = activation.memberships[Number.parseInt(answer, 10) - 1];
+                    if (selected) {
+                        await setDefaultCompany(selected.slug, {
+                            root,
+                            validateMembership: (candidate) => candidate === selected.slug ? { uid: selected.uid } : false,
+                        });
+                    }
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            else if (activation.status === "needs_choice") {
+                console.error(chalk.yellow("Multiple active memberships. Run `hq mesh context default set <slug>` to choose this device's default company."));
+            }
+        }
+        catch (error) {
+            console.error(chalk.yellow('Default-company setup failed:'), error instanceof Error ? error.message : 'Unknown error');
         }
     });
 }

package/dist/commands/mesh.js

@@ -10,15 +10,17 @@ import { findHqRoot } from "../utils/manifest.js";
 import chalk from "chalk";
 import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
-import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveMembershipCompanies, listActiveThreads, patchStoryStatus, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+import { STORY_STATUSES, appendThreadEvent, ensureProjectThread, eventPayload, listActiveMembershipCompanies, listActiveThreads, patchStoryStatus, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
-import { clearDefaultCompany, getDefaultCompany, readDeviceConfig, recordMigrationCapabilitySnapshot, setDefaultCompany, } from "../lib/work-context/config.js";
+import { clearDefaultCompany, isDefaultCompanyDisabled, readDeviceConfig, recordMigrationCapabilitySnapshot, setRepairHeldWithDefault, setDefaultCompany, } from "../lib/work-context/config.js";
+import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
 import { DefaultCompanyUnavailableError, } from "../lib/work-context/errors.js";
 import { isValidSessionId } from "../lib/mesh/live/session-identity.js";
 import { CLI_KIND_TO_SCHEMA, resolveEnqueueSessionId, } from "../lib/mesh/live/index.js";
 import { flushSessionEvents } from "../lib/mesh/live/flush.js";
 import { backfillHeldSessions } from "../lib/mesh/live/backfill-held.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/live/session-events-client.js";
+const MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
 import { buildEmitEvidence } from "../lib/mesh/live/emit-evidence.js";
 import { createEmitPoster, buildMeshEmitEvent } from "../lib/mesh/live/emit-client.js";
 import { emitEvents } from "../lib/mesh/live/emit.js";
@@ -27,7 +29,7 @@ import { generateUlid } from "../lib/mesh/live/ulid.js";
 import { readLegacyBacklog } from "../lib/mesh/live/emit-replay.js";
 import { resolveMeshEmitMode, writeMeshConfigMode, } from "../lib/mesh/live/daemon/mode.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
-import { buildInstallPaths, collectDaemonDoctor, daemonServiceStatus, detectPlatform, formatDaemonDoctor, installDaemonService, readDaemonState, runMeshDaemon, uninstallDaemonService, daemonDir, } from "../lib/mesh/live/daemon/index.js";
+import { buildInstallPaths, collectDaemonDoctor, daemonServiceStatus, findAncestorHqRoot, resolveInstallHqRoot, detectPlatform, formatDaemonDoctor, installDaemonService, readDaemonState, runMeshDaemon, uninstallDaemonService, daemonDir, } from "../lib/mesh/live/daemon/index.js";
 import { workContextRoot } from "../lib/work-context/paths.js";
 import { formatMigrateConfirmation, submitSessionMigration, } from "../lib/work-context/migrate.js";
 import { formatOrganizeList, prepareOrganizeDecision, settleOrganizeAskWithoutBind, submitOrganizeDecision, } from "../lib/work-context/organize.js";
@@ -91,7 +93,10 @@ async function runEvent(verb, opts) {
         summary: opts.summary,
     });
     const eventKind = verb === "start" ? "claim" : verb;
-    const event = await appendThreadEvent(token, company.companyUid, ensured.threadId, eventKind, eventPayload(eventKind, opts, callerLabelFromToken(token)));
+    const claimant = eventKind === "claim"
+        ? await resolveMeshPrincipalUid(token, loadCachedTokens())
+        : "";
+    const event = await appendThreadEvent(token, company.companyUid, ensured.threadId, eventKind, eventPayload(eventKind, opts, claimant));
     if (opts.json) {
         console.log(JSON.stringify({
             ok: true,
@@ -153,25 +158,73 @@ async function runContextReconcile(opts) {
     let fetchCandidates;
     let validateMembership;
     let offline = Boolean(opts.offline);
-    if (!offline) {
-        try {
-            const token = await requireToken();
-            deliver = createWorkSessionDeliverer({ token });
-            fetchCandidates = createCandidatesFetcher({ token });
-            validateMembership = async (candidate) => {
-                const membership = await resolveActiveMembershipCompany(token, candidate);
-                if (!membership)
-                    return false;
-                return { uid: membership.companyUid };
-            };
+    let token;
+    try {
+        // Offline is outbox-only delivery. It still refreshes a device default's
+        // token-backed membership so a revoked default cannot be preflighted.
+        token = await requireToken();
+        const sessionToken = token;
+        validateMembership = async (candidate) => {
+            const membership = await new Promise((resolve, reject) => {
+                const timer = setTimeout(() => reject(new Error("membership validation timed out")), MEMBERSHIP_VALIDATION_TIMEOUT_MS);
+                void resolveActiveMembershipCompany(sessionToken, candidate).then((value) => {
+                    clearTimeout(timer);
+                    resolve(value);
+                }, (error) => {
+                    clearTimeout(timer);
+                    reject(error);
+                });
+            });
+            if (!membership || typeof membership.companyUid !== "string" || !membership.companyUid) {
+                return false;
+            }
+            return { uid: membership.companyUid };
+        };
+        if (!offline) {
+            deliver = createWorkSessionDeliverer({ token: sessionToken });
+            fetchCandidates = createCandidatesFetcher({ token: sessionToken });
         }
-        catch {
+    }
+    catch {
+        if (!offline) {
             offline = true;
             if (!opts.machine) {
                 console.error(chalk.yellow("No Cognito session; reconciling offline (outbox only)."));
             }
         }
     }
+    if (token) {
+        const activation = await ensureDefaultCompany({
+            root,
+            listMemberships: () => listActiveMembershipCompanies(token),
+            log: (message) => console.error(chalk.dim(message)),
+        });
+        if (activation.status === "needs_choice") {
+            const interactive = !opts.machine && Boolean(process.stdin.isTTY && process.stdout.isTTY) && !isMachineIdentity();
+            if (interactive) {
+                const choices = activation.memberships
+                    .map((membership, index) => `${index + 1}. ${membership.slug}`)
+                    .join("\n");
+                const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+                try {
+                    const answer = await rl.question(`Choose this device's default company:\n${choices}\nSelection: `);
+                    const selected = activation.memberships[Number.parseInt(answer, 10) - 1];
+                    if (selected) {
+                        await setDefaultCompany(selected.slug, {
+                            root,
+                            validateMembership: (candidate) => candidate === selected.slug ? { uid: selected.uid } : false,
+                        });
+                    }
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            else if (!opts.machine) {
+                console.error(chalk.yellow("Multiple active memberships. Run `hq mesh context default set <slug>` to choose this device's default company."));
+            }
+        }
+    }
     const outcome = await reconcileObservation(obs, {
         root,
         env: process.env,
@@ -295,6 +348,7 @@ async function runContextBackfillHeld(opts) {
     const parsedLimit = opts.limit ? Number.parseInt(opts.limit, 10) : 0;
     const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : 0;
     const companyHint = opts.company?.trim() || undefined;
+    const useDeviceDefault = opts.useDeviceDefault === true || readDeviceConfig({ root }).repairHeldWithDefault === true;
     // Build the reconcile network seam exactly like `hq mesh context reconcile`.
     // Not needed in --dry-run (reconcile is never invoked then). Explicit types
     // because these are captured in the reconcile closure below (no control-flow
@@ -331,6 +385,7 @@ async function runContextBackfillHeld(opts) {
         // Mirror the reconcile closure's non-forcing hint in the dry-run predictor
         // so `--dry-run` and the real run report the same counts.
         remoteOwnerHint: companyHint || undefined,
+        useDeviceDefault,
         reconcile: (obs) => reconcileObservation(
         // Pass --company as a non-forcing hint (remoteOwnerSlug feeds
         // deterministic resolution BELOW the identity-file / device default,
@@ -342,6 +397,8 @@ async function runContextBackfillHeld(opts) {
             fetchCandidates,
             offline,
             validateMembership,
+            allowDeviceDefault: useDeviceDefault,
+            deviceDefaultConfidence: useDeviceDefault,
         }),
     });
     if (opts.json) {
@@ -364,16 +421,34 @@ async function runContextBackfillHeld(opts) {
 async function runContextDefaultGet(opts) {
     const root = workContextHomeRoot();
     const cfg = readDeviceConfig({ root });
-    const current = getDefaultCompany({ root });
+    const current = cfg.defaultCompany?.enabled && cfg.defaultCompany.slug
+        ? cfg.defaultCompany
+        : null;
+    const memberships = cfg.defaultCompanyMemberships?.memberships ?? [];
+    const disabled = isDefaultCompanyDisabled({ root });
+    const source = disabled ? "disabled" : current?.source ?? (current ? "chosen" : "unset");
     if (opts.json) {
-        console.log(JSON.stringify({ ok: true, config: cfg, defaultCompany: current }, null, 2));
+        console.log(JSON.stringify({
+            ok: true,
+            slug: current?.slug ?? null,
+            uid: current?.uid ?? null,
+            enabled: current?.enabled ?? false,
+            source,
+            needsChoice: !current && !disabled && memberships.length > 1,
+            memberships,
+            repairHeldWithDefault: cfg.repairHeldWithDefault === true,
+        }, null, 2));
+        return;
+    }
+    if (disabled) {
+        console.log("Default company disabled on this device.");
         return;
     }
     if (!current) {
         console.log("No device default company (default-company mode may be dark).");
         return;
     }
-    console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled}`);
+    console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled} source=${source}`);
 }
 async function runContextDefaultSet(slug, opts) {
     const root = workContextHomeRoot();
@@ -434,11 +509,14 @@ async function runContextDefaultSet(slug, opts) {
                 return { uid: membership.companyUid };
             },
         });
+        const configured = opts.repairHeldWithDefault
+            ? setRepairHeldWithDefault(true, { root })
+            : cfg;
         if (opts.json) {
-            console.log(JSON.stringify({ ok: true, config: cfg, migrationWarning }, null, 2));
+            console.log(JSON.stringify({ ok: true, config: configured, migrationWarning }, null, 2));
             return;
         }
-        const stored = cfg.defaultCompany;
+        const stored = configured.defaultCompany;
         console.log(`Default company set to ${stored?.slug ?? slug}${stored?.uid ? ` (${stored.uid})` : ""}`);
         if (migrationWarning)
             console.error(chalk.yellow(migrationWarning));
@@ -1035,7 +1113,8 @@ export function registerMeshCommand(program) {
         .option("--dry-run", "Report what would be reconciled; write nothing, no network")
         .option("--offline", "Reconcile outbox-only (no candidates/register network)")
         .option("--limit <n>", "Cap sessions processed (default 0 = no cap)")
-        .option("--company <slug>", "Optional non-forcing company hint (resolver default still wins)")
+        .option("--company <slug>", "Optional non-forcing company hint")
+        .option("--use-device-default", "Opt in to historical repair using the device default (lower-confidence attribution)")
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runContextBackfillHeld(opts))());
     context
@@ -1090,6 +1169,7 @@ export function registerMeshCommand(program) {
         .description("Set the device default company slug after verifying membership")
         .argument("<slug>", "Company slug")
         .option("--allow-without-migration", "Deprecated compatibility no-op; selected-company membership is always verified")
+        .option("--repair-held-with-default", "Persist opt-in for lower-confidence historical held-session repair")
         .option("--company <slug|uid>", "Deprecated no-op; the selected company is verified directly")
         .option("--json", "Print machine-readable JSON")
         .action((slug, opts) => wrap(() => runContextDefaultSet(slug, opts))());
@@ -1150,11 +1230,13 @@ export function registerMeshCommand(program) {
     daemon
         .command("run")
         .description("Start the single-instance daemon (pid lock, spool watch, presence)")
-        .action(() => wrap(() => runDaemonRun())());
+        .option("--hq-root <path>", "HQ tree root (else HQ_ROOT / persisted trusted roots); the Windows task passes this explicitly")
+        .action((opts) => wrap(() => runDaemonRun(opts))());
     daemon
         .command("install")
-        .description("Install LaunchAgent (macOS) or systemd user unit (Linux)")
+        .description("Install LaunchAgent (macOS), systemd user unit (Linux), or Scheduled Task (Windows)")
         .option("--system-user <user>", "Write a root-owned unit template for agent boxes (e.g. ec2-user)")
+        .option("--hq-root <path>", "HQ root to record for the service (else HQ_ROOT, else the nearest HQ root above cwd)")
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runDaemonInstall(opts))());
     daemon
@@ -1173,19 +1255,24 @@ export function registerMeshCommand(program) {
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runDaemonDoctorCmd(opts))());
 }
-async function runDaemonRun() {
-    const handle = await runMeshDaemon();
+async function runDaemonRun(opts = {}) {
+    const hqRoot = opts.hqRoot?.trim() || undefined;
+    const handle = await runMeshDaemon(hqRoot ? { hqRoot } : {});
     // Stay alive until signal handlers call stop + exit.
     await new Promise(() => {
         void handle;
     });
 }
 async function runDaemonInstall(opts) {
+    // Verified root only: a repo's own .claude/ must never become the daemon's
+    // HQ root (that path is persisted as trusted and used for attribution).
+    const hqRoot = resolveInstallHqRoot({ explicit: opts.hqRoot });
     const result = installDaemonService({
         platform: detectPlatform(),
         paths: buildInstallPaths({
             systemUser: opts.systemUser,
-            hqRoot: process.env.HQ_ROOT?.trim() || findHqRoot(),
+            hqRoot: hqRoot.root,
+            hqRootSource: hqRoot.source,
         }),
         systemUser: opts.systemUser,
     });
@@ -1196,10 +1283,15 @@ async function runDaemonInstall(opts) {
             platform: result.platform,
             dest: result.dest,
             message: result.message,
+            hqRoot: hqRoot.root,
+            hqRootSource: hqRoot.source,
+            ...(result.notice ? { notice: result.notice } : {}),
         }, null, 2));
         return;
     }
     console.log(result.message);
+    if (result.notice)
+        console.log(result.notice);
 }
 async function runDaemonUninstall(opts) {
     const result = uninstallDaemonService({
@@ -1233,12 +1325,21 @@ async function runDaemonStatus(opts) {
             running: result.running ?? false,
             dest: result.dest,
             message: result.message,
+            ...(result.lastResult !== undefined ? { lastResult: result.lastResult } : {}),
+            ...(result.lastRunFailed !== undefined ? { lastRunFailed: result.lastRunFailed } : {}),
+            ...(result.recordedHqRoot !== undefined ? { hqRoot: result.recordedHqRoot } : {}),
+            ...(result.rootValid !== undefined ? { rootValid: result.rootValid } : {}),
+            ...(result.notice ? { notice: result.notice } : {}),
             mqttState: state?.mqttState,
             presenceRefusal,
         }, null, 2));
         return;
     }
     console.log(result.message);
+    if (result.recordedHqRoot)
+        console.log(`hq root: ${result.recordedHqRoot}`);
+    if (result.notice)
+        console.log(result.notice);
     if (presenceRefusal) {
         console.log(`presence refusal: ${presenceRefusal.code} (HTTP ${presenceRefusal.status}); next retry at ${presenceRefusal.nextRetryAt}`);
     }
@@ -1247,7 +1348,11 @@ async function runDaemonStatus(opts) {
     }
 }
 async function runDaemonDoctorCmd(opts) {
-    const report = collectDaemonDoctor({ hqRoot: process.env.HQ_ROOT?.trim() || findHqRoot() });
+    // Same predicate as install: a repo's .claude/ is not an HQ root. Doctor
+    // only reads, so an unresolvable root is reported as absent, not fatal.
+    const report = collectDaemonDoctor({
+        hqRoot: process.env.HQ_ROOT?.trim() || findAncestorHqRoot(process.cwd()) || undefined,
+    });
     if (opts.json) {
         console.log(JSON.stringify({ ok: !report.unhealthy, ...report }, null, 2));
         return;

package/dist/commands/onboard-create-identity.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Who a new company is created for, when `hq onboard create-company` is run
+ * without `--email` / `--person-name`.
+ *
+ * The signed-in account already carries both on its ID token. Asking the
+ * person to type their own name again — which is what the setup bot had to do,
+ * because `hq whoami` shows only the email — is a question HQ can answer
+ * itself. Explicit flags still win.
+ */
+export interface CreateCompanyIdentity {
+    email: string;
+    personName: string;
+}
+export type CreateCompanyIdentityResult = {
+    ok: true;
+    identity: CreateCompanyIdentity;
+} | {
+    ok: false;
+    message: string;
+};
+/** Pure: flags first, then the ID token's claims. */
+export declare function resolveCreateCompanyIdentity(flags: {
+    email?: string;
+    personName?: string;
+}, claims: Record<string, unknown>): CreateCompanyIdentityResult;
+//# sourceMappingURL=onboard-create-identity.d.ts.map

package/dist/commands/onboard-create-identity.js

@@ -0,0 +1,23 @@
+function text(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+/** Pure: flags first, then the ID token's claims. */
+export function resolveCreateCompanyIdentity(flags, claims) {
+    const email = text(flags.email) || text(claims.email);
+    const personName = text(flags.personName) ||
+        text(claims.name) ||
+        [text(claims.given_name), text(claims.family_name)].filter(Boolean).join(" ");
+    const missing = [];
+    if (!email)
+        missing.push("--email");
+    if (!personName)
+        missing.push("--person-name");
+    if (missing.length > 0) {
+        return {
+            ok: false,
+            message: `Your HQ sign-in does not say ${missing.length === 2 ? "your email or name" : missing[0] === "--email" ? "your email" : "your name"}. Pass ${missing.join(" and ")}.`,
+        };
+    }
+    return { ok: true, identity: { email, personName } };
+}
+//# sourceMappingURL=onboard-create-identity.js.map

package/dist/commands/onboard.js

@@ -20,11 +20,13 @@
  */
 import chalk from "chalk";
 import { runOnboardCli, readCheckpoint } from "../lib/onboarding/index.js";
-import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
+import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoIdToken, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 import { createDefaultVaultClient } from "./cloud-provision.js";
 import { detectOnboardingIdentityMismatch } from "./onboard-identity-guard.js";
 import { planOnboardJoin } from "./onboard-join.js";
 import { buildCreateCompanyWarning } from "./onboard-warning.js";
+import { resolveCreateCompanyIdentity } from "./onboard-create-identity.js";
+import { peekIdToken } from "../utils/id-token.js";
 import { addBotToNewCompany, botToAddAfterCreateCompany } from "./onboard-bot-membership.js";
 // ---------------------------------------------------------------------------
 // Command registration
@@ -40,11 +42,18 @@ export function registerOnboardCommand(program) {
         "a same-named company makes a separate one you'd be alone in.")
         .requiredOption("--slug <slug>", "Company slug (used as bucket name suffix)")
         .requiredOption("--name <name>", "Company display name")
-        .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
-        .requiredOption("--person-name <name>", "Your display name")
+        .option("--email <email>", "Your email (default: your HQ sign-in's email; must match it)")
+        .option("--person-name <name>", "Your display name (default: the name on your HQ sign-in)")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
-        .action(async (options) => {
+        .action(async (flags) => {
         try {
+            const idToken = await ensureCognitoIdToken();
+            const resolved = resolveCreateCompanyIdentity(flags, peekIdToken(idToken));
+            if (!resolved.ok) {
+                console.error(chalk.red(`\n✗ ${resolved.message}`));
+                process.exit(1);
+            }
+            const options = { ...flags, ...resolved.identity };
             console.log(chalk.bold(`\nHQ Onboard — Create Company`));
             console.log(`  Company:  ${options.name} (${options.slug})`);
             console.log(`  Person:   ${options.personName} <${options.email}>`);

package/dist/lib/bot/progress.d.ts

@@ -15,6 +15,10 @@
  * - the final answer is posted only when it adds something: text already
  *   posted (or about to be) is never repeated, including Grok's final result
  *   that is just every message concatenated
+ * - an in-between message that asks the person something (it has a "?") is
+ *   held, not posted: the model often asks, keeps working, then asks the same
+ *   thing again in its final answer, and the person read the question twice.
+ *   It goes out only if the turn ends without a final answer of its own
  *
  * Posts are sent strictly in order. A failed post is logged by the caller's
  * `send` and does not stop the turn.
@@ -46,6 +50,8 @@ export declare class ProgressPoster {
     private readonly workingNoticeMs;
     private readonly workingNoticeText;
     private pending;
+    /** In-between questions, held until the turn ends (see the header). */
+    private heldQuestions;
     /** Every message the model has said this turn (posted or pending), in order. */
     private readonly said;
     private flushTimer;

package/dist/lib/bot/progress.js

@@ -15,6 +15,10 @@
  * - the final answer is posted only when it adds something: text already
  *   posted (or about to be) is never repeated, including Grok's final result
  *   that is just every message concatenated
+ * - an in-between message that asks the person something (it has a "?") is
+ *   held, not posted: the model often asks, keeps working, then asks the same
+ *   thing again in its final answer, and the person read the question twice.
+ *   It goes out only if the turn ends without a final answer of its own
  *
  * Posts are sent strictly in order. A failed post is logged by the caller's
  * `send` and does not stop the turn.
@@ -37,6 +41,8 @@ export class ProgressPoster {
     workingNoticeMs;
     workingNoticeText;
     pending = [];
+    /** In-between questions, held until the turn ends (see the header). */
+    heldQuestions = [];
     /** Every message the model has said this turn (posted or pending), in order. */
     said = [];
     flushTimer = null;
@@ -75,6 +81,10 @@ export class ProgressPoster {
             return;
         this.cancelNotice();
         this.said.push(t);
+        if (t.includes("?")) {
+            this.heldQuestions.push(t);
+            return;
+        }
         this.pending.push(t);
         this.scheduleFlush();
     }
@@ -97,8 +107,12 @@ export class ProgressPoster {
         this.cancelNotice();
         this.cancelFlush();
         const final = finalText.trim();
+        const held = this.heldQuestions;
+        this.heldQuestions = [];
         if (final && !this.repeatsSaid(final))
             this.pending.push(final);
+        else if (held.length > 0)
+            this.pending.push(...held);
         if (this.pending.length === 0 && this.delivered === 0 && !final)
             this.pending.push("(no reply)");
         this.flushNow();
@@ -114,6 +128,8 @@ export class ProgressPoster {
         this.finished = true;
         this.cancelNotice();
         this.cancelFlush();
+        this.pending.push(...this.heldQuestions);
+        this.heldQuestions = [];
         this.flushNow();
         return this.chain;
     }

package/dist/lib/bot/runtime/grok.d.ts

@@ -1,16 +1,39 @@
 /**
  * Grok CLI headless adapter.
  *
- *   grok -p <prompt> --output-format streaming-messages-json --always-approve
+ *   grok -p <prompt> --output-format <streaming format> --always-approve
  *        --no-subagents --cwd <cwd> [-m m] [-r <sessionId>]
  *
- * stdout is NDJSON in the Anthropic Messages shape (see messages-stream.ts).
- * The plain `json` format glued every interim sentence into one reply; the
- * streaming format lets each message be posted as it is written.
- * Verified against grok (grok-4.6) on 2026-09-12 (fixtures/grok-stream.ndjson);
- * the older `{ text, sessionId }` envelope is still accepted.
+ * stdout is NDJSON. Older grok (before 0.2.56) wrote Anthropic Messages
+ * shapes under `--output-format streaming-messages-json` (see
+ * messages-stream.ts). grok 0.2.56 dropped that value and emits token
+ * events under `streaming-json`:
+ *
+ *   {"type":"thought","data":…}
+ *   {"type":"text","data":"Hi"}
+ *   {"type":"end","stopReason":"EndTurn","sessionId":…}
+ *
+ * The format is probed from `grok --help` once per process (and cached).
+ * If an older grok still lists `streaming-messages-json`, that is used.
+ * If the probe misses and grok rejects the old value, the turn retries
+ * with `streaming-json`. The older `{ text, sessionId }` envelope is
+ * still accepted.
  */
 import { type BotRuntime, type RuntimeTurnInput } from "./types.js";
+export declare const GROK_OUTPUT_FORMAT_LEGACY = "streaming-messages-json";
+export declare const GROK_OUTPUT_FORMAT_STREAMING_JSON = "streaming-json";
+export declare function resetGrokOutputFormatCache(): void;
+/** Pick the streaming `--output-format` grok's `--help` says it accepts. */
+export declare function grokOutputFormatFromHelp(helpText: string): string;
+/** Probe `grok --help` once and cache the streaming format. */
+export declare function probeGrokOutputFormat(readHelp?: () => string): string;
+/**
+ * When grok 0.2.56 rejects the pre-0.2.56 flag, rewrite argv to
+ * `streaming-json` and remember that for later turns.
+ */
+export declare function grokRetryArgsAfterInvalidOutputFormat(args: string[], stderr: string): string[] | undefined;
 export declare function grokPrompt(input: RuntimeTurnInput): string;
-export declare function createGrokRuntime(): BotRuntime;
+export declare function createGrokRuntime(opts?: {
+    grokHelp?: string;
+}): BotRuntime;
 //# sourceMappingURL=grok.d.ts.map