@indigoai-us/hq-cli 5.131.0 → 5.132.0

package/dist/lib/lanes/types.d.ts

@@ -250,6 +250,13 @@ export interface LaneRecord {
     senior_history: SeniorHistoryEntry[];
     state: LaneState;
     queued_reason?: QueuedReason;
+    /**
+     * Set by `hq lanes pickup` when it stores an outpost lane and cleared by
+     * the account bind once the model probe has finished. While set, the
+     * reconcile pass does not admit the lane: a spawn during the probe would
+     * leave a running worker behind a record the probe result then rewrites.
+     */
+    pickup_validation_pending?: true;
     priority: number;
     worker?: string;
     /** Registry-relative directory of the resolved worker, when --worker was set. */
@@ -258,6 +265,20 @@ export interface LaneRecord {
     worker_pack?: string;
     provider: LaneProvider;
     account?: string;
+    /**
+     * Every operator move of the lane's session to another account of the
+     * same provider (`hq lanes resume|message --account`), newest last, capped
+     * like the other histories.
+     */
+    account_history?: AccountHistoryEntry[];
+    /**
+     * Set by an account move (`--account`) until the spawn claims the lane:
+     * the turn the move was asked to run. While set it reserves a slot on the
+     * account for the capacity check of later moves. When the target was at
+     * its cap the lane is queued there and the reconcile pass resumes the
+     * recorded session with this turn instead of starting fresh from the brief.
+     */
+    pending_resume?: PendingResume;
     host: LaneHost;
     /**
      * Creating machine's identity when `host.kind` is `outpost` (spec §5.2).
@@ -308,8 +329,10 @@ export interface LaneRecord {
     terminal_reason?: string;
     /**
      * Structured detail behind a named `terminal_reason` (dispatch, pickup and
-     * spawn failures), or the missing-binary search path behind
-     * `provider_binary_missing`. Written by the command and spawn writers.
+     * spawn failures), the missing-binary search path behind
+     * `provider_binary_missing`, or the provider's own message, status, model
+     * and account behind `provider_rejected`. Written by the command, spawn
+     * and watcher writers.
      */
     terminal_details?: Record<string, unknown>;
     /** SSM command id of the `hq outposts exec` pickup that started this lane. */
@@ -368,9 +391,27 @@ export interface LaneEnvelopeRepair {
     envelope_ref?: string;
     at: string;
 }
+export interface AccountHistoryEntry {
+    from: string | null;
+    to: string;
+    at: string;
+    reason: "operator_move";
+}
+export interface PendingResume {
+    session_id: string;
+    trigger: "message" | "resume";
+    resumed_from?: "interrupted" | "done" | "blocked";
+    text?: string;
+    message_id?: string;
+    /** False when the command passed --no-compact; the deferred spawn honours it. */
+    compact?: boolean;
+    at: string;
+}
 export interface LaneResumeRecord {
     session_id: string;
     at: string;
+    /** Account the resumed run was bound to. */
+    account?: string;
     trigger: "answered_questions" | "message" | "resume";
     message_id?: string;
     /**
@@ -508,6 +549,12 @@ export interface ProviderConfig {
      * means the five-minute default.
      */
     progress_event_min_interval_ms?: number;
+    /**
+     * Hold applied to an account after a 429 whose message names no reset
+     * time: the account is skipped for this long. Absent means the
+     * fifteen-minute default.
+     */
+    quota_default_hold_ms?: number;
     accounts: Record<string, AccountConfig>;
 }
 export interface ThrottleConfig {

package/dist/lib/lanes/types.js

@@ -198,13 +198,14 @@ export const LANE_FIELD_WRITERS = {
     project_id: ["command"], story_id: ["command"], thread_id: ["creator", "command"],
     depth: ["command"], senior: ["command"], senior_history: ["command"],
     state: ["creator", "command", "watcher", "reconcile", "spawn"], queued_reason: ["creator", "command", "spawn", "reconcile"],
+    pickup_validation_pending: ["creator", "command", "spawn"],
     priority: ["command"], worker: ["creator"], worker_path: ["creator"], worker_pack: ["creator"],
-    provider: ["creator"], account: ["creator", "spawn"], host: ["creator"], origin_host: ["creator"], origin_host_source: ["creator"],
+    provider: ["creator"], account: ["creator", "spawn", "command"], account_history: ["command"], pending_resume: ["command", "spawn"], host: ["creator"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], attribution_history: ["command"],
-    last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn"], effort: ["creator", "spawn"], effort_source: ["creator", "spawn"],
+    last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn", "command"], effort: ["creator", "spawn"], effort_source: ["creator", "spawn"],
     last_message_at: ["command"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],
     overdue: ["reconcile"], overdue_at: ["reconcile"], last_host_report_at: ["watcher", "spawn", "reconcile"], stalled: ["watcher"], stalled_at: ["watcher"], stalled_reason: ["watcher"],
-    admitted_reason: ["reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], terminal_details: ["command", "spawn"],
+    admitted_reason: ["reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], terminal_details: ["command", "spawn", "watcher", "reconcile"],
     quota_reset_at: ["watcher", "reconcile"], model_quota_marker: ["watcher", "reconcile"], outpost_command_id: ["command"],
     provider_session_id: ["watcher"], provider_session_id_absent: ["watcher"], last_resume: ["spawn"], last_run_usage: ["watcher"], envelope_repair: ["watcher", "reconcile"], last_progress_event_at: ["watcher"],
 };

package/dist/lib/lanes/watcher.d.ts

@@ -33,6 +33,7 @@
  */
 import { type LaneEnvelope, type LaneRecord, type LaneState } from "./types.js";
 import { type QuotaSignal } from "./quota.js";
+import { type ProviderRejection } from "./provider-rejection.js";
 import { type LaneMesh } from "./mesh-events.js";
 import { type EnvelopeRepairSpawnInput } from "./spawn.js";
 /** Spec §5.7: no signal for 20 minutes while the process is still alive. */
@@ -73,6 +74,7 @@ export interface WatcherTickInput {
     invalidEnvelope?: {
         errors: string[];
     } | null;
+    providerRejection?: ProviderRejection | null;
 }
 export interface WatcherTickResult {
     emit?: WatcherSignal;
@@ -97,7 +99,30 @@ export declare function classifyLaneExit(input: {
     invalidEnvelope?: {
         errors: string[];
     } | null;
+    /**
+     * Set when the worker's output stream carries a provider-level turn
+     * failure (codex `turn.failed`, a Claude error result with an HTTP status,
+     * a grok error object). Failed, never interrupted: the provider refused
+     * the turn, so there is nothing to resume and no envelope to repair.
+     */
+    providerRejection?: ProviderRejection | null;
 }): TerminalClassification;
+/**
+ * One decision for an exited worker's output. An explicit provider status
+ * wins over the quota text heuristics: a 429 from any provider (including
+ * codex `turn.failed` and grok error objects, which the claude-shaped quota
+ * reader never sees) becomes a quota signal; any other explicit status is a
+ * rejection even when its text sounds like a quota message (a 402 "requires
+ * usage credits" is a rejection, not a hold). A failure with no status at
+ * all is matched against the quota text heuristics first: a status-less
+ * "usage limit" / "rate limit" turn.failed still creates the account hold;
+ * any other status-less message is a rejection. Only when the stream
+ * carries no failure object does the quota reader's own read apply.
+ */
+export declare function routeProviderFailure(failure: ProviderRejection | null, readQuota: () => QuotaSignal | null, model: string | undefined, now: Date): {
+    quota: QuotaSignal | null;
+    rejection: ProviderRejection | null;
+};
 export declare function tickWatcher(input: WatcherTickInput): WatcherTickResult;
 export declare function watcherEventsPath(hqRoot: string, laneId: string): string;
 export declare function watcherOutLogPath(hqRoot: string, laneId: string): string;
@@ -119,6 +144,8 @@ export interface ApplyTerminalOpts {
     envelopeRef?: string;
     at?: string;
     quota?: QuotaSignal | null;
+    /** Written to `terminal_details` with the model and account the run used. */
+    providerRejection?: ProviderRejection | null;
 }
 export declare function stalledReason(silenceMs: number): string;
 /**

package/dist/lib/lanes/watcher.js

@@ -38,9 +38,10 @@ import { raiseEnvelopeQuestions } from "./questions.js";
 import { isTerminalLaneState, parseLaneEnvelope, } from "./types.js";
 import { readLane, retryUpdateLane } from "./store.js";
 import { readWorkerRunResult } from "./delivery.js";
-import { readQuotaSignal, recordAccountQuota } from "./quota.js";
+import { applyDefaultQuotaHold, quotaSignalFromFields, readQuotaSignal, recordAccountQuota, } from "./quota.js";
+import { PROVIDER_REJECTED_REASON, QUOTA_STATUS, providerRejectionDetails, readProviderRejection, } from "./provider-rejection.js";
 import { readToolActivity, toolActivityPath } from "./dropbox.js";
-import { loadLanesConfig, providerProgressEventMinIntervalMs } from "./config.js";
+import { loadLanesConfig, providerProgressEventMinIntervalMs, providerQuotaDefaultHoldMs } from "./config.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneProgressEvent, progressEventDue, } from "./mesh-events.js";
 import { envelopeQuestionId } from "./questions.js";
 import { laneRunDir, missingPidProbe, probePidRecord, readPidRecord, readProcStarttime, readSpawnManifest, envelopeRepairMode, spawnEnvelopeRepair, } from "./spawn.js";
@@ -86,6 +87,9 @@ export function classifyLaneExit(input) {
             return { state: "blocked" };
         throw new LanesError("unknown_envelope_decision", `Unknown envelope decision ${JSON.stringify(input.envelope.decision)}. Accepted: done, ask, blocked`, { accepted: ["done", "ask", "blocked"], value: input.envelope.decision });
     }
+    if (input.providerRejection) {
+        return { state: "failed", reason: PROVIDER_REJECTED_REASON };
+    }
     if (input.invalidEnvelope) {
         return { state: "failed", reason: ENVELOPE_INVALID_REASON };
     }
@@ -100,6 +104,34 @@ export function classifyLaneExit(input) {
     }
     return { state: "failed", reason: "exited_without_envelope" };
 }
+/**
+ * One decision for an exited worker's output. An explicit provider status
+ * wins over the quota text heuristics: a 429 from any provider (including
+ * codex `turn.failed` and grok error objects, which the claude-shaped quota
+ * reader never sees) becomes a quota signal; any other explicit status is a
+ * rejection even when its text sounds like a quota message (a 402 "requires
+ * usage credits" is a rejection, not a hold). A failure with no status at
+ * all is matched against the quota text heuristics first: a status-less
+ * "usage limit" / "rate limit" turn.failed still creates the account hold;
+ * any other status-less message is a rejection. Only when the stream
+ * carries no failure object does the quota reader's own read apply.
+ */
+export function routeProviderFailure(failure, readQuota, model, now) {
+    if (failure && failure.status === QUOTA_STATUS) {
+        return {
+            quota: quotaSignalFromFields({ api_error_status: QUOTA_STATUS, is_error: true, result: failure.message }, model, now),
+            rejection: null,
+        };
+    }
+    if (failure && failure.status === null) {
+        const quota = quotaSignalFromFields({ api_error_status: undefined, is_error: true, result: failure.message }, model, now);
+        if (quota)
+            return { quota, rejection: null };
+    }
+    if (failure)
+        return { quota: null, rejection: failure };
+    return { quota: readQuota(), rejection: null };
+}
 export function tickWatcher(input) {
     const silenceMs = input.silenceMs ?? SILENCE_MS;
     const at = new Date(input.nowMs).toISOString();
@@ -109,6 +141,7 @@ export function tickWatcher(input) {
             hasPartialOutput: input.hasPartialOutput,
             quota: input.quota,
             invalidEnvelope: input.invalidEnvelope,
+            providerRejection: input.providerRejection,
         });
         return {
             emit: { kind: "terminal", at, classification },
@@ -301,6 +334,9 @@ export function applyTerminalToLaneWithResult(hqRoot, laneId, classification, op
         if (opts.quota?.marker) {
             next.model_quota_marker = opts.quota.marker;
         }
+        if (opts.providerRejection) {
+            next.terminal_details = providerRejectionDetails(opts.providerRejection, current);
+        }
         if (opts.envelope && opts.envelopeRef) {
             next.last_envelope = {
                 ref: opts.envelopeRef,
@@ -589,19 +625,37 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
         const hasPartialOutput = logFiles.some((file) => fileNonEmpty(file));
         let quota = null;
         let quotaLane = null;
+        let providerRejection = null;
         if (!processAlive && !envelope) {
             try {
                 quotaLane = readLane(hqRoot, laneId);
-                quota = readQuotaSignal(runDir, quotaLane.model, new Date(now()), readSpawnManifest(runDir).worker_out_offset ?? 0);
+                const workerOutOffset = readSpawnManifest(runDir).worker_out_offset ?? 0;
+                const routed = routeProviderFailure(readProviderRejection(runDir, quotaLane.provider, workerOutOffset), () => readQuotaSignal(runDir, quotaLane.model, new Date(now()), workerOutOffset), quotaLane.model, new Date(now()));
+                // A reset-less 429 still holds the account: the configured default
+                // hold becomes its reset, recorded as such.
+                quota = routed.quota
+                    ? applyDefaultQuotaHold(routed.quota, providerQuotaDefaultHoldMs(loadLanesConfig(hqRoot).providers[quotaLane.provider]), new Date(now()))
+                    : null;
+                providerRejection = routed.rejection;
             }
             catch (err) {
                 process.stderr.write(`hq lanes watcher: quota read failed for ${laneId}: ${err instanceof Error ? err.message : String(err)}\n`);
             }
         }
         // Spec §4: the process exited and its envelope file does not parse.
-        // Exactly one repair turn, then failed with both errors.
+        // Exactly one repair turn, then failed with both errors. A provider
+        // rejection skips the repair: the provider refused the turn, so a
+        // second turn on the same model and account would be refused the same
+        // way. A quota signal skips it too: a repair turn on an exhausted account
+        // fails the same way, and would end the lane envelope_invalid without
+        // ever recording the hold. The quota result applies immediately instead.
         let invalidEnvelope = null;
-        if (!processAlive && !envelope && latestFile && latestFile.envelope === null) {
+        if (!processAlive &&
+            !envelope &&
+            !providerRejection &&
+            !quota &&
+            latestFile &&
+            latestFile.envelope === null) {
             const repair = decideEnvelopeRepair(hqRoot, laneId, latestFile, now(), spawnRepair, logDecision);
             if (repair.action === "spawned") {
                 lastSignalMs = now();
@@ -626,6 +680,7 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
             silenceMs,
             quota,
             invalidEnvelope,
+            providerRejection,
         });
         if (processAlive) {
             maybeHeartbeatLane(hqRoot, laneId, now());
@@ -702,6 +757,13 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
                     state: classification.state,
                     reason: classification.reason,
                     ...(invalidEnvelope ? { envelope_errors: invalidEnvelope.errors } : {}),
+                    ...(providerRejection
+                        ? {
+                            provider_status: providerRejection.status,
+                            provider_message: providerRejection.message,
+                            retryable: providerRejection.retryable,
+                        }
+                        : {}),
                 });
                 if (quota &&
                     quotaLane?.account &&
@@ -719,6 +781,7 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
                     envelopeRef: latest?.ref,
                     at: tick.emit.at,
                     quota,
+                    providerRejection,
                 });
                 const updated = terminalWrite.record;
                 logDecision({

package/dist/lib/mesh/live/backfill-held.d.ts

@@ -49,15 +49,16 @@ export interface HeldSessionRef {
     /** Task id carried on the event, if any. */
     task?: string;
     /**
-     * Per-event local evidence retained while coalescing a held session. Event
-     * timestamps are instance boundaries: a session id may be reused, so a root
-     * observed before the current state.startedAt must not attribute it.
+     * Per-event local evidence retained while coalescing a held session. A
+     * session id may be reused. The current instance is state.bindingEpisodeId,
+     * never the event timestamp: a later `at` on another episode is still stale.
      */
     eventEvidence?: Array<{
         hqRoot?: string;
         cwd?: string;
         harness?: string;
         at?: string;
+        bindingEpisodeId?: string;
     }>;
 }
 export interface BackfillHeldResult {

package/dist/lib/mesh/live/backfill-held.js

@@ -163,9 +163,11 @@ function localCompanyCandidates(ref, state, canonicalHqRoot, canonicalHqRoots =
     return candidates;
 }
 /**
- * Keep only event evidence that belongs to the current session instance. A
- * current state is a durable instance marker; metadata from a held event that
- * predates it could belong to a prior use of the same session id.
+ * Keep only event evidence for the current session instance. When the state
+ * file has a binding episode, that id is the instance. A timestamp, including
+ * one later than startedAt, does not make another episode current.
+ * Sessions that predate episodes still use startedAt so an older event is
+ * not treated as this instance.
  */
 function currentInstanceEventEvidence(ref, state) {
     const evidence = ref.eventEvidence ?? [
@@ -176,6 +178,9 @@ function currentInstanceEventEvidence(ref, state) {
         },
         ...(ref.hqRoots ?? []).filter((hqRoot) => hqRoot !== ref.hqRoot).map((hqRoot) => ({ hqRoot })),
     ];
+    if (state?.bindingEpisodeId) {
+        return evidence.filter((entry) => Boolean(entry.hqRoot) && entry.bindingEpisodeId === state.bindingEpisodeId);
+    }
     if (!state?.startedAt)
         return evidence;
     const startedAt = Date.parse(state.startedAt);
@@ -188,8 +193,19 @@ function currentInstanceEventEvidence(ref, state) {
         return Number.isFinite(eventAt) && eventAt >= startedAt;
     });
 }
+/** Plain reason when every rooted held event belongs to another episode. */
+function episodeMismatchReason(ref, state) {
+    if (!state?.bindingEpisodeId)
+        return null;
+    const rooted = (ref.eventEvidence ?? []).filter((entry) => entry.hqRoot);
+    if (rooted.length === 0)
+        return null;
+    if (rooted.some((entry) => entry.bindingEpisodeId === state.bindingEpisodeId))
+        return null;
+    return "episode does not match the current instance";
+}
 function hasOnlyStaleEventEvidence(ref, state) {
-    return Boolean(state?.startedAt &&
+    return Boolean((state?.bindingEpisodeId || state?.startedAt) &&
         ref.eventEvidence?.some((entry) => entry.hqRoot) &&
         !currentInstanceEventEvidence(ref, state).some((entry) => entry.hqRoot));
 }
@@ -310,12 +326,18 @@ function latestAcknowledgedRegistration(sessionId, operations) {
 function acknowledgedRegistrationMatches(operation, ref, evidence, state) {
     if (!operation.companyUid || !operation.receiptId)
         return false;
-    if (!state?.startedAt)
-        return false;
-    const startedAt = Date.parse(state.startedAt);
-    const registeredAt = Date.parse(operation.createdAt);
-    if (!Number.isFinite(startedAt) || !Number.isFinite(registeredAt) || registeredAt < startedAt) {
-        return false;
+    if (state?.bindingEpisodeId) {
+        if (state.bindingEpisodeId !== operation.receiptId)
+            return false;
+    }
+    else {
+        if (!state?.startedAt)
+            return false;
+        const startedAt = Date.parse(state.startedAt);
+        const registeredAt = Date.parse(operation.createdAt);
+        if (!Number.isFinite(startedAt) || !Number.isFinite(registeredAt) || registeredAt < startedAt) {
+            return false;
+        }
     }
     if (evidence &&
         !candidatesAgree(evidence, {
@@ -325,8 +347,6 @@ function acknowledgedRegistrationMatches(operation, ref, evidence, state) {
         return false;
     if (ref.harness && operation.harness && ref.harness !== operation.harness)
         return false;
-    if (state?.bindingEpisodeId && state.bindingEpisodeId !== operation.receiptId)
-        return false;
     return true;
 }
 /** Shared doctor/backfill gate for a receipt that is safe to treat as current evidence. */
@@ -407,8 +427,9 @@ export function readHeldSessions(workMeshRoot) {
         if (task && !ref.task)
             ref.task = task;
         const at = str(event.at) ?? (envelope ? str(envelope.heldAt) : undefined);
+        const bindingEpisodeId = str(event.bindingEpisodeId);
         if (hqRoot || cwd) {
-            ref.eventEvidence = [...(ref.eventEvidence ?? []), { hqRoot, cwd, harness, at }];
+            ref.eventEvidence = [...(ref.eventEvidence ?? []), { hqRoot, cwd, harness, at, bindingEpisodeId }];
         }
         seen.set(sessionId, ref);
     }
@@ -481,7 +502,9 @@ export async function backfillHeldSessions(deps) {
         if (!evidence.candidate?.slug && deps.useDeviceDefault !== true) {
             result.unresolved += 1;
             result.noEvidence += 1;
-            deps.log?.(`would stay unresolved ${sessionId} (${hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence"})`);
+            const staleReason = episodeMismatchReason(ref, state)
+                ?? (hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence");
+            deps.log?.(`would stay unresolved ${sessionId} (${staleReason})`);
             continue;
         }
         const evidenceRef = {

package/dist/lib/mesh/live/daemon/doctor.js

@@ -126,7 +126,7 @@ export function collectDaemonDoctor(deps = {}) {
     if (deadLetterCount > 0) {
         unhealthyReasons.push(`dead-letter count=${deadLetterCount}`);
     }
-    if (emitMode === "legacy" && heldCount > 0) {
+    if (heldCount > 0) {
         unhealthyReasons.push(`held events awaiting company attribution=${heldCount}`);
     }
     if (heldWithNoLocalEvidence > 0) {
@@ -205,7 +205,10 @@ export function formatDaemonDoctor(report) {
     if (report.emitMode === "legacy") {
         // Legacy emit path only: the spool/held/outbox queues do not exist in
         // receive-only (direct) mode.
-        lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
+        lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}${report.heldCount > 0 ? " (needs_company; not sent as NONE)" : ""}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
+    }
+    if (report.emitMode !== "legacy" && report.heldCount > 0) {
+        lines.push(`held: ${report.heldCount} (needs_company; not sent as NONE)`);
     }
     lines.push(`attributed by device default: ${report.attributedByDeviceDefault}`, `device-default authorization denials: ${report.deviceDefaultAuthorizationDenials}`, `dead-letter: ${report.deadLetterCount}`, `unattributed events: ${report.unattributedEvents.total} ` +
         `(spool=${report.unattributedEvents.spool} held=${report.unattributedEvents.held} dead-letter=${report.unattributedEvents.deadLetter})`, `token source: ${report.tokenSource}`, `actor kind: ${report.actorKind}`, `identity whoami: ${report.whoamiSubject}`, `identity daemon: ${report.daemonSubject}`);

package/dist/lib/mesh/live/daemon/install.d.ts

@@ -101,7 +101,12 @@ export declare function restartDaemonServiceIfInstalled(opts?: {
     platform?: DaemonInstallPlatform;
     home?: string;
     uid?: number;
+    /** HQ root the daemon was serving, or the root this update was run from. */
+    hqRoot?: string;
+    env?: NodeJS.ProcessEnv;
     existsSync?: typeof fs.existsSync;
+    readFileSync?: typeof fs.readFileSync;
+    writeFileSync?: typeof fs.writeFileSync;
     run?: (command: string, args: string[]) => {
         status: number | null;
     };

package/dist/lib/mesh/live/daemon/install.js

@@ -17,7 +17,7 @@ import * as path from "node:path";
 import { spawnSync } from "node:child_process";
 import { resolveDaemonAssetDir } from "./log.js";
 import { LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, WINDOWS_TASK_NAME, daemonDir, daemonLogPath, daemonPidPath, } from "./paths.js";
-import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot } from "./config.js";
+import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqRoot } from "./config.js";
 import { defaultPidLockDeps, pidLockStatus, readPidLock } from "./pid-lock.js";
 /**
  * `schtasks /End` terminates the task's root process only. The daemon is
@@ -49,6 +49,86 @@ export const defaultSchtasks = (args) => {
         stderr: r.error ? r.error.message : (r.stderr ?? ""),
     };
 };
+function readServiceText(file, existsSync, readFileSync) {
+    if (!existsSync(file))
+        return "";
+    const raw = readFileSync(file);
+    const buf = Buffer.isBuffer(raw) ? raw : Buffer.from(String(raw));
+    if ((buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe) || buf.includes(0)) {
+        return buf.toString("utf16le").replace(/^\uFEFF/, "");
+    }
+    return buf.toString("utf8");
+}
+function hqRootFromUnitText(platform, text) {
+    if (platform === "win32")
+        return parseWindowsTaskHqRoot(text);
+    if (platform === "darwin") {
+        const match = /<key>HQ_ROOT<\/key>\s*<string>([^<]*)<\/string>/.exec(text);
+        return match?.[1] ?? null;
+    }
+    const match = /^Environment=HQ_ROOT=(.*)$/m.exec(text);
+    if (!match)
+        return null;
+    const value = match[1].trim();
+    return value.startsWith("'") && value.endsWith("'") ? value.slice(1, -1) : value;
+}
+/**
+ * Record the HQ root the daemon was serving and replace a pre-allowlist unit
+ * before the process is restarted. A unit with no HQ_ROOT (or Restart=on-failure)
+ * comes back with an empty root allowlist unless this runs first.
+ */
+function migrateLegacyDaemonUnit(opts) {
+    const { platform, home } = opts;
+    if (platform !== "darwin" && platform !== "linux" && platform !== "win32")
+        return;
+    const unitPath = platform === "darwin"
+        ? path.join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`)
+        : platform === "linux"
+            ? path.join(home, ".config", "systemd", "user", SYSTEMD_UNIT_NAME)
+            : path.join(daemonDir(undefined, home, opts.env), `${WINDOWS_TASK_NAME}.xml`);
+    if (!opts.existsSync(unitPath))
+        return;
+    const text = readServiceText(unitPath, opts.existsSync, opts.readFileSync);
+    const fromUnit = hqRootFromUnitText(platform, text);
+    const verified = verifyHqRoot(fromUnit ?? undefined)
+        ?? verifyHqRoot(opts.hqRoot)
+        ?? verifyHqRoot(opts.env?.HQ_ROOT);
+    if (!verified)
+        return;
+    registerTrustedHqRoot(daemonDir(undefined, home, opts.env), verified);
+    const legacy = platform === "linux"
+        ? !text.includes("Environment=HQ_ROOT=") || /Restart=on-failure/.test(text)
+        : platform === "darwin"
+            ? !/<key>HQ_ROOT<\/key>/.test(text)
+            : !fromUnit;
+    if (!legacy)
+        return;
+    const paths = buildInstallPaths({
+        home,
+        env: opts.env,
+        hqRoot: verified,
+        hqBinary: "/usr/bin/hq",
+        nodeBinary: process.execPath || "/usr/bin/node",
+    });
+    try {
+        paths.hqBinary = resolveHqBinary(process.argv, opts.env ?? process.env);
+    }
+    catch {
+        // The rendered command only has to name a binary; install already resolved one.
+    }
+    if (platform === "darwin") {
+        opts.writeFileSync(unitPath, renderLaunchdPlist(paths), { mode: 0o600 });
+        return;
+    }
+    if (platform === "linux") {
+        opts.writeFileSync(unitPath, renderSystemdUserUnit(paths), { mode: 0o600 });
+        opts.run("systemctl", ["--user", "daemon-reload"]);
+        return;
+    }
+    const rendered = renderWindowsTaskXml(paths);
+    opts.writeFileSync(unitPath, encodeWindowsTaskXml(rendered));
+    opts.run("schtasks.exe", ["/Create", "/TN", WINDOWS_TASK_NAME, "/XML", unitPath, "/F"]);
+}
 /**
  * Restart the installed user daemon after a CLI upgrade. This is deliberately
  * best-effort: an update must remain successful if a user has no service,
@@ -58,8 +138,11 @@ export function restartDaemonServiceIfInstalled(opts = {}) {
     const platform = opts.platform ?? detectPlatform();
     const home = opts.home ?? os.homedir();
     const existsSync = opts.existsSync ?? fs.existsSync;
+    const readFileSync = opts.readFileSync ?? fs.readFileSync;
+    const writeFileSync = opts.writeFileSync ?? fs.writeFileSync;
     const run = opts.run ?? ((command, args) => spawnSync(command, args, { stdio: "ignore" }));
     try {
+        migrateLegacyDaemonUnit({ platform, home, hqRoot: opts.hqRoot, env: opts.env, existsSync, readFileSync, writeFileSync, run });
         if (platform === "darwin") {
             const plist = path.join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
             if (!existsSync(plist))

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -90,6 +90,11 @@ export interface DaemonRunDeps {
     resolveMembership?: (token: string, slug: string, signal?: AbortSignal) => Promise<{
         companyUid: string;
     } | null>;
+    /**
+     * Machine credential (fleet box or local bot). A refused or empty membership
+     * probe defers; it does not clear the company. Defaults to isMachineIdentity().
+     */
+    machineIdentity?: boolean;
     /** Test seam immediately before a device-default revocation's guarded commit. */
     beforeDeviceDefaultRevocationCommit?: () => void;
     log?: (dir: string, line: string) => void;

package/dist/lib/mesh/live/daemon/run.js

@@ -14,7 +14,7 @@ import * as path from "node:path";
 import { CLI_VERSION } from "../../../../cli-version.js";
 import { createWorkSessionDeliverer } from "../../client.js";
 import { listActiveMembershipCompanies, meshJson, resolveActiveMembershipCompany } from "../../api.js";
-import { ensureCognitoToken } from "../../../../utils/cognito-session.js";
+import { ensureCognitoToken, isMachineIdentity } from "../../../../utils/cognito-session.js";
 import { replayOutbox } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
 import { ensureDefaultCompany } from "../../../work-context/default-company.js";
@@ -143,6 +143,7 @@ export async function runMeshDaemon(deps = {}) {
     const defaultGetToken = async () => ensureCognitoToken({ interactive: false, tokenSource: "machine" });
     const getToken = deps.getToken ?? defaultGetToken;
     const resolveMembership = deps.resolveMembership ?? resolveActiveMembershipCompany;
+    const machineIdentity = deps.machineIdentity ?? isMachineIdentity();
     /** The sole authorization seam for daemon tenant I/O derived from a device default. */
     const tenantGate = {
         authorize: async (input) => {
@@ -161,9 +162,18 @@ export async function runMeshDaemon(deps = {}) {
                     authorization = await Promise.race([
                         (async () => {
                             const membership = await resolveMembership(await getToken(), slug, controller.signal);
-                            return membership
-                                ? { status: "authorized", uid: membership.companyUid }
-                                : { status: "denied" };
+                            if (membership)
+                                return { status: "authorized", uid: membership.companyUid };
+                            // A machine token often cannot read /membership/me (401/403, or an
+                            // empty person-membership list). That is "cannot tell", not "not
+                            // a member". Leave the company in place and retry.
+                            if (machineIdentity) {
+                                return {
+                                    status: "unavailable",
+                                    error: "membership probe on a machine token did not confirm a company; company left unchanged",
+                                };
+                            }
+                            return { status: "denied" };
                         })(),
                         new Promise((resolve) => {
                             controller.signal.addEventListener("abort", () => resolve({