@indigoai-us/hq-cli 5.125.0 → 5.127.0

package/dist/commands/mesh.js

@@ -6,11 +6,12 @@
  * Distinct from `hq doctor` (hook guardrails).
  */
 import * as os from "node:os";
+import { readFileSync } from "node:fs";
 import { findHqRoot } from "../utils/manifest.js";
 import chalk from "chalk";
 import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
-import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveMembershipCompanies, listActiveThreads, patchStoryStatus, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+import { STORY_STATUSES, appendThreadEvent, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
 import { clearDefaultCompany, isDefaultCompanyDisabled, readDeviceConfig, recordMigrationCapabilitySnapshot, setRepairHeldWithDefault, setDefaultCompany, } from "../lib/work-context/config.js";
 import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
@@ -29,7 +30,7 @@ import { generateUlid } from "../lib/mesh/live/ulid.js";
 import { readLegacyBacklog } from "../lib/mesh/live/emit-replay.js";
 import { resolveMeshEmitMode, writeMeshConfigMode, } from "../lib/mesh/live/daemon/mode.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
-import { buildInstallPaths, collectDaemonDoctor, daemonServiceStatus, detectPlatform, formatDaemonDoctor, installDaemonService, readDaemonState, runMeshDaemon, uninstallDaemonService, daemonDir, } from "../lib/mesh/live/daemon/index.js";
+import { buildInstallPaths, collectDaemonDoctor, daemonServiceStatus, findAncestorHqRoot, resolveInstallHqRoot, detectPlatform, formatDaemonDoctor, installDaemonService, readDaemonState, runMeshDaemon, uninstallDaemonService, daemonDir, } from "../lib/mesh/live/daemon/index.js";
 import { workContextRoot } from "../lib/work-context/paths.js";
 import { formatMigrateConfirmation, submitSessionMigration, } from "../lib/work-context/migrate.js";
 import { formatOrganizeList, prepareOrganizeDecision, settleOrganizeAskWithoutBind, submitOrganizeDecision, } from "../lib/work-context/organize.js";
@@ -88,12 +89,20 @@ async function runCheck(opts) {
 async function runEvent(verb, opts) {
     const { token, company } = await withCompany(opts);
     const projectId = requireProject(opts);
+    const eventKind = verb === "start" ? "claim" : verb;
+    let claimant = "";
+    if (eventKind === "claim") {
+        const resolvedClaimant = await resolveMeshPrincipalUid(token, loadCachedTokens());
+        if (!resolvedClaimant) {
+            fail("Could not resolve the authenticated claimant. Sign in again and retry `hq mesh start`.");
+        }
+        claimant = resolvedClaimant;
+    }
     const ensured = await ensureProjectThread(token, company, projectId, {
         threadId: opts.threadId,
         summary: opts.summary,
     });
-    const eventKind = verb === "start" ? "claim" : verb;
-    const event = await appendThreadEvent(token, company.companyUid, ensured.threadId, eventKind, eventPayload(eventKind, opts, callerLabelFromToken(token)));
+    const event = await appendThreadEvent(token, company.companyUid, ensured.threadId, eventKind, eventPayload(eventKind, opts, claimant));
     if (opts.json) {
         console.log(JSON.stringify({
             ok: true,
@@ -112,17 +121,215 @@ async function runEvent(verb, opts) {
 async function runStory(opts) {
     const storyId = opts.story?.trim();
     const status = opts.status?.trim();
-    if (!storyId || !status || !STORY_STATUSES.has(status)) {
-        fail("story requires --story <id> and --status queued|in_progress|review|done");
+    const assignee = opts.assignee?.trim();
+    if (!storyId) {
+        fail("story requires --story <id>");
+    }
+    if (!status && !assignee) {
+        fail("story requires --status queued|in_progress|review|done or --assignee <uid|me|none>");
+    }
+    if (status && !STORY_STATUSES.has(status)) {
+        fail("story --status must be queued|in_progress|review|done");
     }
     const { token, company } = await withCompany(opts);
     const projectId = requireProject(opts);
-    const patched = await patchStoryStatus(token, company.companyUid, projectId, storyId, status);
+    let assigneeUid;
+    let clearAssignee = false;
+    if (assignee === "none") {
+        clearAssignee = true;
+    }
+    else if (assignee === "me") {
+        const resolved = await resolveMeshPrincipalUid(token, loadCachedTokens());
+        if (!resolved || resolved === "session") {
+            fail("`--assignee me` needs the signed-in person or agent. The synthetic session identity cannot be assigned. Sign in again and retry `hq mesh story`.");
+        }
+        assigneeUid = resolved;
+    }
+    else if (assignee) {
+        if (!/^(prs|agt)_/.test(assignee)) {
+            fail("`--assignee` must be a person or agent uid, `me`, or `none`.");
+        }
+        assigneeUid = assignee;
+    }
+    const patched = await patchStory(token, company.companyUid, projectId, storyId, {
+        ...(status ? { status } : {}),
+        ...(assigneeUid ? { assigneeUid } : {}),
+        ...(clearAssignee ? { clearAssignee: true } : {}),
+    });
     if (opts.json) {
         console.log(JSON.stringify({ ok: true, action: "story", company, ...patched, storyId }, null, 2));
         return;
     }
-    console.log(`Work mesh: story ${storyId} → ${patched.status} (v${patched.version ?? "?"})`);
+    const assignment = assignee === "none"
+        ? "assignee cleared"
+        : assignee
+            ? `assignee ${patched.assigneeUid ?? assigneeUid}`
+            : "";
+    const statusPart = status ? `${storyId} → ${patched.status}` : storyId;
+    console.log(`Work mesh: story ${statusPart}${assignment ? ` ${assignment}` : ""} (v${patched.version ?? "?"})`);
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function parseProjectRepoSpec(value, source) {
+    const raw = value.trim();
+    const separator = raw.lastIndexOf("@");
+    const path = (separator > 0 ? raw.slice(0, separator) : raw).trim();
+    const branch = (separator > 0 ? raw.slice(separator + 1) : "").trim();
+    if (!path)
+        fail(`${source} requires a non-empty repository path.`);
+    if (separator > 0 && !branch)
+        fail(`${source} has an empty branch after @.`);
+    return { path, branch };
+}
+function parseProjectRepos(value, source) {
+    if (!Array.isArray(value))
+        fail(`${source} must be a JSON repository array.`);
+    return value.map((raw, index) => {
+        if (typeof raw === "string")
+            return parseProjectRepoSpec(raw, `${source}[${index}]`);
+        const repo = record(raw);
+        const path = typeof repo?.path === "string"
+            ? repo.path.trim()
+            : typeof repo?.repoPath === "string"
+                ? repo.repoPath.trim()
+                : typeof repo?.repo === "string"
+                    ? repo.repo.trim()
+                    : "";
+        const branchValue = repo?.branch ?? repo?.branchName;
+        const branch = branchValue === undefined ? "" : typeof branchValue === "string" ? branchValue.trim() : null;
+        if (!repo || !path)
+            fail(`${source}[${index}].path requires a string.`);
+        if (branch === null)
+            fail(`${source}[${index}].branch requires a string.`);
+        return { path, branch };
+    });
+}
+function parseProjectReposJson(raw, source) {
+    try {
+        return parseProjectRepos(JSON.parse(raw), source);
+    }
+    catch (err) {
+        if (err instanceof SyntaxError)
+            fail(`${source} must contain valid JSON.`);
+        throw err;
+    }
+}
+function projectStoriesFromJson(value, source) {
+    const plan = Array.isArray(value) ? null : record(value);
+    const rawStories = Array.isArray(value)
+        ? value
+        : Array.isArray(plan?.userStories)
+            ? plan.userStories
+            : Array.isArray(plan?.stories)
+                ? plan.stories
+                : null;
+    if (!rawStories) {
+        fail(`${source} must be a JSON story array or an object with userStories.`);
+    }
+    const stories = rawStories.map((raw, index) => {
+        const story = record(raw);
+        const id = typeof story?.id === "string" ? story.id.trim() : "";
+        const title = typeof story?.title === "string" ? story.title.trim() : "";
+        if (!story || !id || !title) {
+            fail(`${source} userStories[${index}] requires string id and title.`);
+        }
+        const status = typeof story.status === "string" ? story.status.trim() : undefined;
+        if (status && !STORY_STATUSES.has(status)) {
+            fail(`${source} userStories[${index}].status must be queued|in_progress|review|done.`);
+        }
+        const resolvedStatus = status || (story.passes === true ? "done" : undefined);
+        return {
+            id,
+            title,
+            ...(typeof story.description === "string" ? { description: story.description } : {}),
+            ...(Array.isArray(story.acceptanceCriteria)
+                ? {
+                    acceptanceCriteria: story.acceptanceCriteria.filter((item) => typeof item === "string"),
+                }
+                : {}),
+            ...(resolvedStatus ? { status: resolvedStatus } : {}),
+            // hq-pro makes passes mirror the Board status. A completed PRD story
+            // without an explicit status must therefore become done.
+            passes: resolvedStatus === "done",
+            ...(typeof story.priority === "number" && Number.isFinite(story.priority)
+                ? { priority: story.priority }
+                : {}),
+        };
+    });
+    const metadata = record(plan?.metadata);
+    const repos = metadata && Object.hasOwn(metadata, "repos")
+        ? parseProjectRepos(metadata.repos, `${source} metadata.repos`)
+        : undefined;
+    return {
+        ...(typeof plan?.name === "string" ? { name: plan.name } : {}),
+        ...(typeof plan?.description === "string" ? { description: plan.description } : {}),
+        stories,
+        ...(repos ? { repos } : {}),
+    };
+}
+function parseProjectPlan(raw, source) {
+    try {
+        return projectStoriesFromJson(JSON.parse(raw), source);
+    }
+    catch (err) {
+        if (err instanceof SyntaxError)
+            fail(`${source} must contain valid JSON.`);
+        throw err;
+    }
+}
+async function runProjectSet(projectId, opts) {
+    if (opts.storiesFile && opts.storiesJson) {
+        fail("Pass only one of --stories-file or --stories-json.");
+    }
+    if (opts.reposJson && opts.repo?.length) {
+        fail("Pass only one of --repos-json or --repo.");
+    }
+    const source = opts.storiesFile
+        ? parseProjectPlan(readFileSync(opts.storiesFile, "utf8"), opts.storiesFile)
+        : opts.storiesJson
+            ? parseProjectPlan(opts.storiesJson, "--stories-json")
+            : undefined;
+    const explicitRepos = opts.reposJson
+        ? parseProjectReposJson(opts.reposJson, "--repos-json")
+        : opts.repo?.length
+            ? opts.repo.map((repo, index) => parseProjectRepoSpec(repo, `--repo[${index}]`))
+            : undefined;
+    const { token, company } = await withCompany(opts);
+    const current = await getProjectView(token, company.companyUid, projectId);
+    const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
+    const view = await putProjectView(token, company.companyUid, projectId, {
+        name: opts.name?.trim() || source?.name || current.name,
+        ...(opts.description !== undefined
+            ? { description: opts.description }
+            : source?.description !== undefined
+                ? { description: source.description }
+                : { description: current.description }),
+        stories: source?.stories ?? current.stories,
+        repos: explicitRepos ?? source?.repos ?? current.repos,
+        ...(current.version !== undefined ? { version: current.version } : {}),
+    });
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: "project.set", principalUid, ...view }, null, 2));
+        return;
+    }
+    console.log(`Work mesh: project ${view.projectId} set (${view.name}; ${view.stories.length} stories)`);
+}
+async function runProjectRegister(projectId, opts) {
+    if (opts.channel?.trim()) {
+        fail("--channel is not supported by the current Work Mesh registration API; omit it to let the server create or bind the project channel.");
+    }
+    const { token, company } = await withCompany(opts);
+    const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
+    const registration = await registerMeshProject(token, company.companyUid, projectId);
+    const boardState = "registered";
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: "project.register", principalUid, boardState, ...registration }, null, 2));
+        return;
+    }
+    console.log(`Work mesh: project ${registration.projectId} registered (${boardState}; channel ${registration.channelId} ${registration.channelCreated ? "created" : "bound"})`);
 }
 async function runDoctor(opts) {
     if (opts.apply) {
@@ -131,6 +338,9 @@ async function runDoctor(opts) {
     }
     const token = await requireToken();
     const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
+    if (!principalUid) {
+        fail("Could not resolve the authenticated principal. Sign in again and retry `hq mesh doctor`.");
+    }
     const warmed = await warmMeshConversationCache(token, principalUid);
     if (opts.json) {
         console.log(JSON.stringify({ ok: true, action: "doctor", ...warmed }, null, 2));
@@ -346,19 +556,20 @@ async function runContextBackfillHeld(opts) {
     const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : 0;
     const companyHint = opts.company?.trim() || undefined;
     const useDeviceDefault = opts.useDeviceDefault === true || readDeviceConfig({ root }).repairHeldWithDefault === true;
-    // Build the reconcile network seam exactly like `hq mesh context reconcile`.
-    // Not needed in --dry-run (reconcile is never invoked then). Explicit types
-    // because these are captured in the reconcile closure below (no control-flow
-    // narrowing, unlike the inline reconcile handler).
+    // Build the membership seam for both modes; dry-run is read-only but must
+    // validate a locally resolved slug just as live reconciliation does.
+    // The remaining seams are captured in the reconcile closure below.
     let deliver;
     let fetchCandidates;
     let validateMembership;
     let offline = Boolean(opts.offline);
-    if (!dryRun && !offline) {
+    if (!offline) {
         try {
             const token = await requireToken();
-            deliver = createWorkSessionDeliverer({ token });
-            fetchCandidates = createCandidatesFetcher({ token });
+            if (!dryRun) {
+                deliver = createWorkSessionDeliverer({ token });
+                fetchCandidates = createCandidatesFetcher({ token });
+            }
             validateMembership = async (candidate) => {
                 const membership = await resolveActiveMembershipCompany(token, candidate);
                 if (!membership)
@@ -383,6 +594,7 @@ async function runContextBackfillHeld(opts) {
         // so `--dry-run` and the real run report the same counts.
         remoteOwnerHint: companyHint || undefined,
         useDeviceDefault,
+        validateMembership,
         reconcile: (obs) => reconcileObservation(
         // Pass --company as a non-forcing hint (remoteOwnerSlug feeds
         // deterministic resolution BELOW the identity-file / device default,
@@ -410,6 +622,9 @@ async function runContextBackfillHeld(opts) {
         `${result.unresolved} unresolved, ` +
         `${result.errors} error(s).` +
         (dryRun ? " (dry-run: nothing written)" : ""));
+    for (const { sessionId, reason } of result.unresolvedReasons) {
+        console.log(`Unresolved ${sessionId}: ${reason}`);
+    }
     if (!dryRun && result.reconciled > 0) {
         console.log("Reconciled session state files were rewritten with a resolved company; " +
             "the mesh daemon's held retry will re-attribute and post those events.");
@@ -1075,9 +1290,32 @@ export function registerMeshCommand(program) {
         .option("--summary <text>", "Note text")).action((opts) => wrap(() => runEvent("note", opts))());
     addSharedFlags(mesh
         .command("story")
-        .description("PATCH one Board story status")
+        .description("PATCH one Board story status and/or assignee")
         .requiredOption("--story <id>", "Story id, e.g. US-001")
-        .requiredOption("--status <status>", "queued|in_progress|review|done")).action((opts) => wrap(() => runStory(opts))());
+        .option("--status <status>", "queued|in_progress|review|done")
+        .option("--assignee <uid|me|none>", "Assign a person or agent uid, yourself, or clear")).action((opts) => wrap(() => runStory(opts))());
+    const project = mesh
+        .command("project")
+        .description("Set a project Board view or register its project channel");
+    project
+        .command("set <projectId>")
+        .description("PUT the project Board view from flags or a PRD JSON file")
+        .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
+        .option("--name <name>", "Project name")
+        .option("--description <text>", "Project description")
+        .option("--stories-file <path>", "PRD JSON file with userStories")
+        .option("--stories-json <json>", "Story array or JSON object with userStories")
+        .option("--repos-json <json>", "Repository array, such as [{path,branch}]")
+        .option("--repo <path[@branch]>", "Repository binding (repeatable)", collectRepeatable)
+        .option("--json", "Print machine-readable JSON")
+        .action((projectId, opts) => wrap(() => runProjectSet(projectId, opts))());
+    project
+        .command("register <projectId>")
+        .description("POST project registration to create or bind its project channel and Board")
+        .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
+        .option("--channel <channelId>", "Reserved: the current server chooses the project channel")
+        .option("--json", "Print machine-readable JSON")
+        .action((projectId, opts) => wrap(() => runProjectRegister(projectId, opts))());
     mesh
         .command("doctor")
         .description("Warm ~/.hq/work-mesh/cache from hq-pro (directory, inbox, pair DMs). Not `hq doctor`.")
@@ -1107,7 +1345,7 @@ export function registerMeshCommand(program) {
     context
         .command("backfill-held")
         .description("Reconcile ENDED sessions whose held events lack a company so the daemon re-attributes the backlog (explicit, opt-in; no fleet fan-out)")
-        .option("--dry-run", "Report what would be reconciled; write nothing, no network")
+        .option("--dry-run", "Report what would be reconciled; write nothing or deliver events")
         .option("--offline", "Reconcile outbox-only (no candidates/register network)")
         .option("--limit <n>", "Cap sessions processed (default 0 = no cap)")
         .option("--company <slug>", "Optional non-forcing company hint")
@@ -1227,11 +1465,13 @@ export function registerMeshCommand(program) {
     daemon
         .command("run")
         .description("Start the single-instance daemon (pid lock, spool watch, presence)")
-        .action(() => wrap(() => runDaemonRun())());
+        .option("--hq-root <path>", "HQ tree root (else HQ_ROOT / persisted trusted roots); the Windows task passes this explicitly")
+        .action((opts) => wrap(() => runDaemonRun(opts))());
     daemon
         .command("install")
-        .description("Install LaunchAgent (macOS) or systemd user unit (Linux)")
+        .description("Install LaunchAgent (macOS), systemd user unit (Linux), or Scheduled Task (Windows)")
         .option("--system-user <user>", "Write a root-owned unit template for agent boxes (e.g. ec2-user)")
+        .option("--hq-root <path>", "HQ root to record for the service (else HQ_ROOT, else the nearest HQ root above cwd)")
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runDaemonInstall(opts))());
     daemon
@@ -1250,19 +1490,24 @@ export function registerMeshCommand(program) {
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runDaemonDoctorCmd(opts))());
 }
-async function runDaemonRun() {
-    const handle = await runMeshDaemon();
+async function runDaemonRun(opts = {}) {
+    const hqRoot = opts.hqRoot?.trim() || undefined;
+    const handle = await runMeshDaemon(hqRoot ? { hqRoot } : {});
     // Stay alive until signal handlers call stop + exit.
     await new Promise(() => {
         void handle;
     });
 }
 async function runDaemonInstall(opts) {
+    // Verified root only: a repo's own .claude/ must never become the daemon's
+    // HQ root (that path is persisted as trusted and used for attribution).
+    const hqRoot = resolveInstallHqRoot({ explicit: opts.hqRoot });
     const result = installDaemonService({
         platform: detectPlatform(),
         paths: buildInstallPaths({
             systemUser: opts.systemUser,
-            hqRoot: process.env.HQ_ROOT?.trim() || findHqRoot(),
+            hqRoot: hqRoot.root,
+            hqRootSource: hqRoot.source,
         }),
         systemUser: opts.systemUser,
     });
@@ -1273,10 +1518,15 @@ async function runDaemonInstall(opts) {
             platform: result.platform,
             dest: result.dest,
             message: result.message,
+            hqRoot: hqRoot.root,
+            hqRootSource: hqRoot.source,
+            ...(result.notice ? { notice: result.notice } : {}),
         }, null, 2));
         return;
     }
     console.log(result.message);
+    if (result.notice)
+        console.log(result.notice);
 }
 async function runDaemonUninstall(opts) {
     const result = uninstallDaemonService({
@@ -1310,12 +1560,21 @@ async function runDaemonStatus(opts) {
             running: result.running ?? false,
             dest: result.dest,
             message: result.message,
+            ...(result.lastResult !== undefined ? { lastResult: result.lastResult } : {}),
+            ...(result.lastRunFailed !== undefined ? { lastRunFailed: result.lastRunFailed } : {}),
+            ...(result.recordedHqRoot !== undefined ? { hqRoot: result.recordedHqRoot } : {}),
+            ...(result.rootValid !== undefined ? { rootValid: result.rootValid } : {}),
+            ...(result.notice ? { notice: result.notice } : {}),
             mqttState: state?.mqttState,
             presenceRefusal,
         }, null, 2));
         return;
     }
     console.log(result.message);
+    if (result.recordedHqRoot)
+        console.log(`hq root: ${result.recordedHqRoot}`);
+    if (result.notice)
+        console.log(result.notice);
     if (presenceRefusal) {
         console.log(`presence refusal: ${presenceRefusal.code} (HTTP ${presenceRefusal.status}); next retry at ${presenceRefusal.nextRetryAt}`);
     }
@@ -1324,7 +1583,11 @@ async function runDaemonStatus(opts) {
     }
 }
 async function runDaemonDoctorCmd(opts) {
-    const report = collectDaemonDoctor({ hqRoot: process.env.HQ_ROOT?.trim() || findHqRoot() });
+    // Same predicate as install: a repo's .claude/ is not an HQ root. Doctor
+    // only reads, so an unresolvable root is reported as absent, not fatal.
+    const report = collectDaemonDoctor({
+        hqRoot: process.env.HQ_ROOT?.trim() || findAncestorHqRoot(process.cwd()) || undefined,
+    });
     if (opts.json) {
         console.log(JSON.stringify({ ok: !report.unhealthy, ...report }, null, 2));
         return;

package/dist/commands/onboard-create-identity.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Who a new company is created for, when `hq onboard create-company` is run
+ * without `--email` / `--person-name`.
+ *
+ * The signed-in account already carries both on its ID token. Asking the
+ * person to type their own name again — which is what the setup bot had to do,
+ * because `hq whoami` shows only the email — is a question HQ can answer
+ * itself. Explicit flags still win.
+ */
+export interface CreateCompanyIdentity {
+    email: string;
+    personName: string;
+}
+export type CreateCompanyIdentityResult = {
+    ok: true;
+    identity: CreateCompanyIdentity;
+} | {
+    ok: false;
+    message: string;
+};
+/** Pure: flags first, then the ID token's claims. */
+export declare function resolveCreateCompanyIdentity(flags: {
+    email?: string;
+    personName?: string;
+}, claims: Record<string, unknown>): CreateCompanyIdentityResult;
+//# sourceMappingURL=onboard-create-identity.d.ts.map

package/dist/commands/onboard-create-identity.js

@@ -0,0 +1,23 @@
+function text(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+/** Pure: flags first, then the ID token's claims. */
+export function resolveCreateCompanyIdentity(flags, claims) {
+    const email = text(flags.email) || text(claims.email);
+    const personName = text(flags.personName) ||
+        text(claims.name) ||
+        [text(claims.given_name), text(claims.family_name)].filter(Boolean).join(" ");
+    const missing = [];
+    if (!email)
+        missing.push("--email");
+    if (!personName)
+        missing.push("--person-name");
+    if (missing.length > 0) {
+        return {
+            ok: false,
+            message: `Your HQ sign-in does not say ${missing.length === 2 ? "your email or name" : missing[0] === "--email" ? "your email" : "your name"}. Pass ${missing.join(" and ")}.`,
+        };
+    }
+    return { ok: true, identity: { email, personName } };
+}
+//# sourceMappingURL=onboard-create-identity.js.map

package/dist/commands/onboard.js

@@ -20,11 +20,13 @@
  */
 import chalk from "chalk";
 import { runOnboardCli, readCheckpoint } from "../lib/onboarding/index.js";
-import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
+import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoIdToken, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 import { createDefaultVaultClient } from "./cloud-provision.js";
 import { detectOnboardingIdentityMismatch } from "./onboard-identity-guard.js";
 import { planOnboardJoin } from "./onboard-join.js";
 import { buildCreateCompanyWarning } from "./onboard-warning.js";
+import { resolveCreateCompanyIdentity } from "./onboard-create-identity.js";
+import { peekIdToken } from "../utils/id-token.js";
 import { addBotToNewCompany, botToAddAfterCreateCompany } from "./onboard-bot-membership.js";
 // ---------------------------------------------------------------------------
 // Command registration
@@ -40,11 +42,18 @@ export function registerOnboardCommand(program) {
         "a same-named company makes a separate one you'd be alone in.")
         .requiredOption("--slug <slug>", "Company slug (used as bucket name suffix)")
         .requiredOption("--name <name>", "Company display name")
-        .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
-        .requiredOption("--person-name <name>", "Your display name")
+        .option("--email <email>", "Your email (default: your HQ sign-in's email; must match it)")
+        .option("--person-name <name>", "Your display name (default: the name on your HQ sign-in)")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
-        .action(async (options) => {
+        .action(async (flags) => {
         try {
+            const idToken = await ensureCognitoIdToken();
+            const resolved = resolveCreateCompanyIdentity(flags, peekIdToken(idToken));
+            if (!resolved.ok) {
+                console.error(chalk.red(`\n✗ ${resolved.message}`));
+                process.exit(1);
+            }
+            const options = { ...flags, ...resolved.identity };
             console.log(chalk.bold(`\nHQ Onboard — Create Company`));
             console.log(`  Company:  ${options.name} (${options.slug})`);
             console.log(`  Person:   ${options.personName} <${options.email}>`);

package/dist/lib/bot/progress.d.ts

@@ -15,6 +15,10 @@
  * - the final answer is posted only when it adds something: text already
  *   posted (or about to be) is never repeated, including Grok's final result
  *   that is just every message concatenated
+ * - an in-between message that asks the person something (it has a "?") is
+ *   held, not posted: the model often asks, keeps working, then asks the same
+ *   thing again in its final answer, and the person read the question twice.
+ *   It goes out only if the turn ends without a final answer of its own
  *
  * Posts are sent strictly in order. A failed post is logged by the caller's
  * `send` and does not stop the turn.
@@ -46,6 +50,8 @@ export declare class ProgressPoster {
     private readonly workingNoticeMs;
     private readonly workingNoticeText;
     private pending;
+    /** In-between questions, held until the turn ends (see the header). */
+    private heldQuestions;
     /** Every message the model has said this turn (posted or pending), in order. */
     private readonly said;
     private flushTimer;

package/dist/lib/bot/progress.js

@@ -15,6 +15,10 @@
  * - the final answer is posted only when it adds something: text already
  *   posted (or about to be) is never repeated, including Grok's final result
  *   that is just every message concatenated
+ * - an in-between message that asks the person something (it has a "?") is
+ *   held, not posted: the model often asks, keeps working, then asks the same
+ *   thing again in its final answer, and the person read the question twice.
+ *   It goes out only if the turn ends without a final answer of its own
  *
  * Posts are sent strictly in order. A failed post is logged by the caller's
  * `send` and does not stop the turn.
@@ -37,6 +41,8 @@ export class ProgressPoster {
     workingNoticeMs;
     workingNoticeText;
     pending = [];
+    /** In-between questions, held until the turn ends (see the header). */
+    heldQuestions = [];
     /** Every message the model has said this turn (posted or pending), in order. */
     said = [];
     flushTimer = null;
@@ -75,6 +81,10 @@ export class ProgressPoster {
             return;
         this.cancelNotice();
         this.said.push(t);
+        if (t.includes("?")) {
+            this.heldQuestions.push(t);
+            return;
+        }
         this.pending.push(t);
         this.scheduleFlush();
     }
@@ -97,8 +107,12 @@ export class ProgressPoster {
         this.cancelNotice();
         this.cancelFlush();
         const final = finalText.trim();
+        const held = this.heldQuestions;
+        this.heldQuestions = [];
         if (final && !this.repeatsSaid(final))
             this.pending.push(final);
+        else if (held.length > 0)
+            this.pending.push(...held);
         if (this.pending.length === 0 && this.delivered === 0 && !final)
             this.pending.push("(no reply)");
         this.flushNow();
@@ -114,6 +128,8 @@ export class ProgressPoster {
         this.finished = true;
         this.cancelNotice();
         this.cancelFlush();
+        this.pending.push(...this.heldQuestions);
+        this.heldQuestions = [];
         this.flushNow();
         return this.chain;
     }