@indigoai-us/hq-cli 5.126.0 → 5.128.0

package/dist/lib/mesh/live/daemon/run.js

@@ -19,7 +19,7 @@ import { replayOutbox } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
 import { ensureDefaultCompany } from "../../../work-context/default-company.js";
 import { invalidateDefaultCompanyMemberships, readDeviceConfig, } from "../../../work-context/config.js";
-import { readSessionState, writeSessionState, } from "../../../work-context/state.js";
+import { readSessionState, mergeLocalSessionFields, updateSessionState, } from "../../../work-context/state.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../session-events-client.js";
 import { flushSessionEvents, HELD_RETRY_INTERVAL_MS, } from "../flush.js";
 import { backfillHeldSessions, } from "../backfill-held.js";
@@ -58,6 +58,30 @@ export function shouldFlushOnSpoolDirEvent(filename) {
         return true;
     return String(filename) === "spool.jsonl";
 }
+function sameCompanyValue(a, b) {
+    return Boolean(a && b && a.toLowerCase() === b.toLowerCase());
+}
+function stillMatchesDeniedCompany(current, input, slug) {
+    const deniedUid = input.companyUid ?? input.state?.companyUid;
+    const deniedSlug = input.companySlug ?? input.state?.companySlug ?? slug;
+    if (deniedUid && current.companyUid && deniedUid !== current.companyUid)
+        return false;
+    if (deniedSlug && current.companySlug && !sameCompanyValue(deniedSlug, current.companySlug))
+        return false;
+    return Boolean(current.companyUid || current.companySlug);
+}
+function stillMatchesDeniedDeviceDefaultBinding(current, original, input, slug) {
+    return stillMatchesDeniedCompany(current, input, slug) &&
+        current.companyUid === original.companyUid &&
+        current.companySlug === original.companySlug &&
+        current.contextStatus === original.contextStatus &&
+        current.projectId === original.projectId &&
+        current.taskId === original.taskId &&
+        current.bindingEpisodeId === original.bindingEpisodeId &&
+        current.source === original.source &&
+        current.version === original.version &&
+        current.updatedAt === original.updatedAt;
+}
 function alive(pid) {
     try {
         process.kill(pid, 0);
@@ -123,33 +147,54 @@ export async function runMeshDaemon(deps = {}) {
                 ? readSessionState(input.sessionId, ctxRoot)
                 : null);
             const slug = input.companySlug ?? state?.companySlug;
-            const membership = await (async () => {
+            let authorization;
+            if (!slug) {
+                authorization = { status: "denied" };
+            }
+            else {
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS);
                 try {
-                    if (!slug)
-                        return null;
-                    const controller = new AbortController();
-                    const timeout = setTimeout(() => controller.abort(), DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS);
-                    try {
-                        return await Promise.race([
-                            resolveMembership(await getToken(), slug, controller.signal),
-                            new Promise((resolve) => controller.signal.addEventListener("abort", () => resolve(null), { once: true })),
-                        ]);
-                    }
-                    finally {
-                        clearTimeout(timeout);
-                    }
+                    authorization = await Promise.race([
+                        (async () => {
+                            const membership = await resolveMembership(await getToken(), slug, controller.signal);
+                            return membership
+                                ? { status: "authorized", uid: membership.companyUid }
+                                : { status: "denied" };
+                        })(),
+                        new Promise((resolve) => {
+                            controller.signal.addEventListener("abort", () => resolve({
+                                status: "unavailable",
+                                error: `membership lookup timed out after ${DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS}ms`,
+                            }), { once: true });
+                        }),
+                    ]);
                 }
-                catch {
-                    return null;
+                catch (err) {
+                    authorization = {
+                        status: "unavailable",
+                        error: err instanceof Error ? err.message : String(err),
+                    };
                 }
-            })();
-            const uid = membership?.companyUid;
+                finally {
+                    clearTimeout(timeout);
+                }
+            }
+            if (authorization.status === "unavailable") {
+                const prior = readDaemonState(dir)?.deviceDefaultMembershipLookupFailures ?? 0;
+                patchDaemonState(dir, {
+                    lastErrorCode: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED",
+                    deviceDefaultMembershipLookupFailures: prior + 1,
+                }, now);
+                log(dir, `device-default membership lookup unavailable${slug ? ` company=${slug}` : ""}: ${authorization.error.slice(0, 160)}`);
+                return authorization;
+            }
             if (!input.deviceDefault)
-                return uid ? { uid } : false;
-            if (uid &&
-                (!input.companyUid || input.companyUid === uid) &&
-                (!state?.companyUid || state.companyUid === uid)) {
-                return { uid };
+                return authorization;
+            if (authorization.status === "authorized" &&
+                (!input.companyUid || input.companyUid === authorization.uid) &&
+                (!state?.companyUid || state.companyUid === authorization.uid)) {
+                return authorization;
             }
             try {
                 invalidateDefaultCompanyMemberships({ root: ctxRoot, now });
@@ -158,20 +203,39 @@ export async function runMeshDaemon(deps = {}) {
                 log(dir, `default membership cache invalidation failed: ${String(err).slice(0, 160)}`);
             }
             if (state) {
-                writeSessionState({
-                    ...state,
-                    companyUid: undefined,
-                    companySlug: undefined,
-                    contextStatus: "needs_company",
-                    updatedAt: now().toISOString(),
-                }, ctxRoot);
+                // Commit only if the device-default binding that started this lookup is
+                // still current. The shared session-state lock also makes a hook writer
+                // that arrives at this boundary commit after us rather than get lost.
+                deps.beforeDeviceDefaultRevocationCommit?.();
+                const revoked = updateSessionState(state.sessionId, ctxRoot, (current) => {
+                    if (!current || !stillMatchesDeniedDeviceDefaultBinding(current, state, input, slug)) {
+                        return null;
+                    }
+                    return mergeLocalSessionFields({
+                        ...current,
+                        companyUid: undefined,
+                        companySlug: undefined,
+                        contextStatus: "needs_company",
+                        updatedAt: now().toISOString(),
+                    }, current, { preserveCompanyBinding: false });
+                });
+                if (!revoked) {
+                    log(dir, `device-default membership denial left newer session binding intact session=${state.sessionId}`);
+                }
             }
             const prior = readDaemonState(dir)?.deviceDefaultAuthorizationDenials ?? 0;
             patchDaemonState(dir, { deviceDefaultAuthorizationDenials: prior + 1 }, now);
             log(dir, `device-default membership denied${slug ? ` company=${slug}` : ""}; work held`);
-            return false;
+            return { status: "denied" };
         },
     };
+    const validateDaemonMembership = async (slug, deviceDefault) => {
+        const authorization = await tenantGate.authorize({ companySlug: slug, deviceDefault });
+        if (authorization.status === "unavailable") {
+            throw new Error(`device-default membership lookup unavailable: ${authorization.error}`);
+        }
+        return authorization.status === "authorized" ? { uid: authorization.uid } : false;
+    };
     /** In-memory held re-attempt throttle (survives watch-triggered flushes). */
     let lastHeldRetryAtMs = 0;
     const flushFn = deps.flush ??
@@ -191,12 +255,12 @@ export async function runMeshDaemon(deps = {}) {
                     lastHeldRetryAtMs = atMs;
                 },
                 log: (message) => log(dir, message),
-                authorizeDeviceDefaultTenant: async (state) => Boolean(await tenantGate.authorize({
+                authorizeDeviceDefaultTenant: async (state) => (await tenantGate.authorize({
                     state,
                     companySlug: state.companySlug,
                     companyUid: state.companyUid,
                     deviceDefault: true,
-                })),
+                })).status === "authorized",
             });
         });
     const replayFn = deps.replayOutbox ??
@@ -215,13 +279,16 @@ export async function runMeshDaemon(deps = {}) {
                     // only authority that may release them.
                     !op.companyConfidence;
                 if (requiresMembershipCheck) {
-                    const allowed = await tenantGate.authorize({
+                    const authorization = await tenantGate.authorize({
                         state: state ?? undefined,
                         companySlug: op.companySlug ?? state?.companySlug,
                         companyUid: op.companyUid ?? state?.companyUid,
                         deviceDefault: true,
                     });
-                    if (!allowed) {
+                    if (authorization.status === "unavailable") {
+                        return { ok: false, retryable: true, code: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED" };
+                    }
+                    if (authorization.status !== "authorized") {
                         return { ok: false, retryable: false, code: "DEVICE_DEFAULT_MEMBERSHIP_DENIED" };
                     }
                 }
@@ -260,13 +327,11 @@ export async function runMeshDaemon(deps = {}) {
                     root: ctxRoot,
                     env,
                     deliver,
-                    validateMembership: async (slug) => tenantGate.authorize({
-                        companySlug: slug,
-                        deviceDefault: useDeviceDefault,
-                    }),
+                    validateMembership: (slug) => validateDaemonMembership(slug, useDeviceDefault),
                     allowDeviceDefault: useDeviceDefault,
                     deviceDefaultConfidence: useDeviceDefault,
                 }),
+                validateMembership: (slug) => validateDaemonMembership(slug, useDeviceDefault),
             });
         });
     const boardLast = new Map();
@@ -282,12 +347,12 @@ export async function runMeshDaemon(deps = {}) {
                 lastRefresh: boardLast,
                 intervalMs: BOARD_REFRESH_INTERVAL_MS,
                 now: () => timers.now(),
-                authorizeDeviceDefaultTenant: async (_sessionId, state) => Boolean(await tenantGate.authorize({
+                authorizeDeviceDefaultTenant: async (_sessionId, state) => (await tenantGate.authorize({
                     state,
                     companySlug: state.companySlug,
                     companyUid: state.companyUid,
                     deviceDefault: true,
-                })),
+                })).status === "authorized",
             });
         });
     let presence = null;
@@ -387,18 +452,10 @@ export async function runMeshDaemon(deps = {}) {
             fs: deps.transcriptFs,
             now: () => now().getTime(),
             lastHookEventAt,
-            validateMembership: async (slug) => {
-                try {
-                    const token = await getToken();
-                    const membership = await resolveActiveMembershipCompany(token, slug);
-                    if (!membership)
-                        return false;
-                    return { uid: membership.companyUid };
-                }
-                catch {
-                    return false;
-                }
-            },
+            // Transcript watch has no direct state writer: reconcile owns its write
+            // and merges local fields. Surface transient lookup failures as throws so
+            // reconcile defers without turning them into an authoritative denial.
+            validateMembership: (slug) => validateDaemonMembership(slug, true),
             deliver: async (op) => {
                 try {
                     const token = await getToken();

package/dist/lib/mesh/live/daemon/state.d.ts

@@ -29,6 +29,8 @@ export interface DaemonStateFile {
     emitMode?: "legacy" | "direct";
     /** Authoritative membership denials for device-default-derived tenant I/O. */
     deviceDefaultAuthorizationDenials?: number;
+    /** Transient device-default membership refresh failures; the next cycle retries. */
+    deviceDefaultMembershipLookupFailures?: number;
     updatedAt: string;
 }
 export declare function defaultDaemonState(pid: number, now?: () => Date): DaemonStateFile;

package/dist/lib/mesh/live/daemon/transcript-watch.d.ts

@@ -49,6 +49,9 @@ export declare const TRANSCRIPT_WATCH_REVALIDATE_MS: number;
 export declare const TRANSCRIPT_TURN_QUIET_MS = 5000;
 export declare const TRANSCRIPT_SESSION_END_MS: number;
 export declare const TRANSCRIPT_HOOK_COVER_MS = 60000;
+/** Retry unavailable transcript-start reconciliation without hot-looping. */
+export declare const TRANSCRIPT_START_RETRY_BASE_MS = 30000;
+export declare const TRANSCRIPT_START_RETRY_MAX_MS = 120000;
 /** Ignore cold transcripts whose mtime is older than this on first sight. */
 export declare const TRANSCRIPT_FRESH_MS: number;
 export declare const TRANSCRIPT_MARKER: "from transcript";

package/dist/lib/mesh/live/daemon/transcript-watch.js

@@ -54,6 +54,9 @@ export const TRANSCRIPT_WATCH_REVALIDATE_MS = 5 * 60_000;
 export const TRANSCRIPT_TURN_QUIET_MS = 5_000;
 export const TRANSCRIPT_SESSION_END_MS = 10 * 60_000;
 export const TRANSCRIPT_HOOK_COVER_MS = 60_000;
+/** Retry unavailable transcript-start reconciliation without hot-looping. */
+export const TRANSCRIPT_START_RETRY_BASE_MS = 30_000;
+export const TRANSCRIPT_START_RETRY_MAX_MS = 120_000;
 /** Ignore cold transcripts whose mtime is older than this on first sight. */
 export const TRANSCRIPT_FRESH_MS = TRANSCRIPT_SESSION_END_MS;
 export const TRANSCRIPT_MARKER = "from transcript";
@@ -652,6 +655,8 @@ export class TranscriptWatcher {
                         ended: false,
                         pendingTurn: false,
                         seq: 0,
+                        startRetryAttempts: 0,
+                        nextStartRetryAtMs: 0,
                     };
                     this.tracked.set(d.path, track);
                     const started = await this.emitStart(track, nowMs);
@@ -661,6 +666,14 @@ export class TranscriptWatcher {
                 }
                 if (track.ended)
                     continue;
+                if (!track.started) {
+                    if (nowMs < track.nextStartRetryAtMs)
+                        continue;
+                    const started = await this.emitStart(track, nowMs);
+                    if (started)
+                        result.started += 1;
+                    continue;
+                }
                 if (d.mtimeMs > track.lastMtimeMs) {
                     track.lastMtimeMs = d.mtimeMs;
                     track.lastChangeAtMs = nowMs;
@@ -737,14 +750,22 @@ export class TranscriptWatcher {
             hqRoot: this.deps.hqRoot,
             source: "transcript",
         };
-        await this.reconcileFn(observation, {
-            root: this.deps.workContextRoot,
-            env: this.deps.env,
-            now: () => new Date(nowMs),
-            validateMembership: this.deps.validateMembership,
-            deliver: this.deps.deliver,
-            offline: !this.deps.deliver,
-        });
+        try {
+            await this.reconcileFn(observation, {
+                root: this.deps.workContextRoot,
+                env: this.deps.env,
+                now: () => new Date(nowMs),
+                validateMembership: this.deps.validateMembership,
+                deliver: this.deps.deliver,
+                offline: !this.deps.deliver,
+            });
+        }
+        catch {
+            track.startRetryAttempts += 1;
+            const delayMs = Math.min(TRANSCRIPT_START_RETRY_BASE_MS * 2 ** (track.startRetryAttempts - 1), TRANSCRIPT_START_RETRY_MAX_MS);
+            track.nextStartRetryAtMs = nowMs + delayMs;
+            return false;
+        }
         // Re-check: a hook may have raced us during reconcile.
         const after = this.readState(track.sessionId, this.deps.workContextRoot);
         if (isHookWrittenSessionState(after)) {
@@ -753,6 +774,8 @@ export class TranscriptWatcher {
         }
         this.emitKind(track, "session_start", nowMs);
         track.started = true;
+        track.startRetryAttempts = 0;
+        track.nextStartRetryAtMs = 0;
         return true;
     }
     emitKind(track, kind, nowMs) {

package/dist/lib/scan-packages/index.d.ts

@@ -1,3 +1,4 @@
+import type { PackContributeKey } from '../../types.js';
 type Logger = (message: string) => void;
 export interface ScanPackagesOptions {
     quiet?: boolean;
@@ -7,6 +8,7 @@ export interface ScanPackagesOptions {
 export interface ScanPackagesResult {
     status: 0 | 1;
 }
+export declare function readContributes(manifest: string): Partial<Record<PackContributeKey, string[]>>;
 /** Wire installed pack contributions into their table-declared host locations. */
 export declare function scanPackages(hqRoot: string, options?: ScanPackagesOptions): ScanPackagesResult;
 export {};

package/dist/lib/scan-packages/index.js

@@ -18,7 +18,7 @@ catch {
     return false;
 } }
 function normalized(relative) { return relative.replaceAll(path.sep, '/'); }
-function readContributes(manifest) {
+export function readContributes(manifest) {
     // This deliberately mirrors the staging script's shallow awk grammar rather
     // than accepting YAML forms the legacy ABI never recognized (notably a
     // non-empty inline list). Mapping remains single-sourced in

package/dist/lib/work-context/state.d.ts

@@ -109,8 +109,19 @@ export interface AcknowledgedRegisterBinding {
 }
 /** Allowlisted keys that may appear in the durable state projection. */
 export declare const SESSION_STATE_ALLOWLIST: Set<string>;
+/**
+ * Serialize a session-state read/modify/write with every state writer. Atomic
+ * rename protects readers from torn files, but only this shared lock protects
+ * a writer that has to verify the current binding before changing it.
+ */
+export declare function withSessionStateLock<T>(sessionId: string, root: string, fn: () => T): T;
 export declare function readSessionState(sessionId: string, root: string): SessionStateFile | null;
 export declare function writeSessionState(state: SessionStateFile, root: string): string;
+/**
+ * Commit a state change only after inspecting the latest value under the same
+ * lock used by ordinary session writers. Returning null declines the write.
+ */
+export declare function updateSessionState(sessionId: string, root: string, update: (current: SessionStateFile | null) => SessionStateFile | null): SessionStateFile | null;
 /** Strip any non-allowlisted fields before durable write. */
 export declare function projectSessionState(state: SessionStateFile): SessionStateFile;
 /**
@@ -119,6 +130,7 @@ export declare function projectSessionState(state: SessionStateFile): SessionSta
  */
 export declare function mergeLocalSessionFields(next: SessionStateFile, prior: SessionStateFile | null, options?: {
     preserveBindingEpisode?: boolean;
+    preserveCompanyBinding?: boolean;
 }): SessionStateFile;
 /**
  * Upgrade the local projection after the server acknowledges a register.

package/dist/lib/work-context/state.js

@@ -3,9 +3,10 @@
  * Written only by hq mesh context. Owner 0600. Metadata-only — never prompts/tokens.
  */
 import * as fs from "node:fs";
+import * as path from "node:path";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
-import { atomicWriteJson, ensureOwnerDir } from "./atomic.js";
-import { NotTrackingError } from "./errors.js";
+import { atomicWriteJson, ensureOwnerDir, resolveRealTarget } from "./atomic.js";
+import { NotTrackingError, UnsafeConfigPathError } from "./errors.js";
 import { isSafeWorkContextSegment, workContextSessionPath, workContextSessionsDir, } from "./paths.js";
 /** Allowlisted keys that may appear in the durable state projection. */
 export const SESSION_STATE_ALLOWLIST = new Set([
@@ -30,6 +31,113 @@ export const SESSION_STATE_ALLOWLIST = new Set([
     "companyConfidence",
     "updatedAt",
 ]);
+const SESSION_STATE_LOCK_TIMEOUT_MS = 5_000;
+const SESSION_STATE_LOCK_RETRY_MS = 10;
+function waitForSessionStateLock(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function asPersistenceFailure(err) {
+    if (err instanceof NotTrackingError || err instanceof UnsafeConfigPathError)
+        throw err;
+    const message = err instanceof Error ? err.message : String(err);
+    throw new NotTrackingError(`Failed to persist session state: ${message}`, "NOT_TRACKING");
+}
+function reclaimStaleSessionStateLock(lockPath) {
+    const claim = `${lockPath}.reclaim.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`;
+    try {
+        fs.renameSync(lockPath, claim);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+    try {
+        return true;
+    }
+    finally {
+        try {
+            fs.unlinkSync(claim);
+        }
+        catch { /* private claim cannot block writers */ }
+    }
+}
+/**
+ * Serialize a session-state read/modify/write with every state writer. Atomic
+ * rename protects readers from torn files, but only this shared lock protects
+ * a writer that has to verify the current binding before changing it.
+ */
+export function withSessionStateLock(sessionId, root, fn) {
+    if (!isSafeWorkContextSegment(sessionId)) {
+        throw new NotTrackingError(`Unsafe session id for state file: ${sessionId}`, "NOT_TRACKING");
+    }
+    try {
+        ensureOwnerDir(workContextSessionsDir(root));
+    }
+    catch (err) {
+        asPersistenceFailure(err);
+    }
+    const statePath = resolveRealTarget(workContextSessionPath(sessionId, root));
+    const lockPath = `${statePath}.lock`;
+    const token = `${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`;
+    const deadline = Date.now() + SESSION_STATE_LOCK_TIMEOUT_MS;
+    let fd;
+    while (fd === undefined) {
+        try {
+            fd = fs.openSync(lockPath, "wx", 0o600);
+            fs.writeSync(fd, JSON.stringify({ pid: process.pid, token }));
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                asPersistenceFailure(err);
+            let ownerPid = 0;
+            try {
+                const raw = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+                ownerPid = typeof raw.pid === "number" && Number.isInteger(raw.pid) ? raw.pid : 0;
+            }
+            catch {
+                // A malformed lock cannot safely protect the state.
+            }
+            let ownerAlive = false;
+            if (ownerPid > 0) {
+                try {
+                    process.kill(ownerPid, 0);
+                    ownerAlive = true;
+                }
+                catch {
+                    // Dead owners do not retain the lock.
+                }
+            }
+            if (!ownerAlive) {
+                try {
+                    reclaimStaleSessionStateLock(lockPath);
+                }
+                catch (err) {
+                    asPersistenceFailure(err);
+                }
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                throw new NotTrackingError(`Timed out waiting for session state lock: ${path.basename(statePath)}`, "NOT_TRACKING");
+            }
+            waitForSessionStateLock(SESSION_STATE_LOCK_RETRY_MS);
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        fs.closeSync(fd);
+        try {
+            const current = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+            if (current.token === token)
+                fs.unlinkSync(lockPath);
+        }
+        catch {
+            // A stale-lock reclaimer or replacement owner has already retired it.
+        }
+    }
+}
 export function readSessionState(sessionId, root) {
     if (!isSafeWorkContextSegment(sessionId))
         return null;
@@ -50,6 +158,9 @@ export function writeSessionState(state, root) {
     if (!isSafeWorkContextSegment(state.sessionId)) {
         throw new NotTrackingError(`Unsafe session id for state file: ${state.sessionId}`, "NOT_TRACKING");
     }
+    return withSessionStateLock(state.sessionId, root, () => writeSessionStateUnlocked(state, root));
+}
+function writeSessionStateUnlocked(state, root) {
     const projected = projectSessionState(state);
     try {
         ensureOwnerDir(workContextSessionsDir(root));
@@ -61,6 +172,20 @@ export function writeSessionState(state, root) {
         throw new NotTrackingError(`Failed to persist session state: ${err instanceof Error ? err.message : String(err)}`, "NOT_TRACKING");
     }
 }
+/**
+ * Commit a state change only after inspecting the latest value under the same
+ * lock used by ordinary session writers. Returning null declines the write.
+ */
+export function updateSessionState(sessionId, root, update) {
+    return withSessionStateLock(sessionId, root, () => {
+        const current = readSessionState(sessionId, root);
+        const next = update(current);
+        if (!next)
+            return null;
+        writeSessionStateUnlocked(next, root);
+        return next;
+    });
+}
 /** Strip any non-allowlisted fields before durable write. */
 export function projectSessionState(state) {
     const out = {
@@ -118,7 +243,10 @@ export function mergeLocalSessionFields(next, prior, options = {}) {
     // projected locally; losing it causes held events and repeat registrations.
     // A caller that carries either company field is intentionally changing the
     // binding and remains authoritative.
-    if (!out.companyUid && !out.companySlug && (prior.companyUid || prior.companySlug)) {
+    if (options.preserveCompanyBinding !== false &&
+        !out.companyUid &&
+        !out.companySlug &&
+        (prior.companyUid || prior.companySlug)) {
         out.companyUid = prior.companyUid;
         out.companySlug = prior.companySlug;
         out.contextStatus = prior.contextStatus;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.126.0",
+  "version": "5.128.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -13,6 +13,8 @@
     "assets/scaffold",
     "assets/bot-workers",
     "assets/mesh-daemon",
+    "assets/lanes-reconcile",
+    "assets/lanes-hooks",
     "CHANGELOG.md",
     "README.md"
   ],