@indigoai-us/hq-cli 5.131.0 → 5.133.0

package/dist/lib/mesh/live/daemon/presence.d.ts

@@ -34,7 +34,11 @@ export declare const CONNECT_STABLE_GRACE_MS = 5000;
  * waits at least this long regardless of the backoff/grace-reset state.
  */
 export declare const RECONNECT_MIN_DELAY_MS = 1000;
-/** Always emit the first N close info lines, then at most one per interval. */
+/**
+ * Close/reconnect info is one line per transition into reconnecting.
+ * Repeated `close` events while already reconnecting do not log again.
+ * Kept so older imports still resolve; they no longer gate the log.
+ */
 export declare const CLOSE_LOG_ALWAYS_COUNT = 3;
 export declare const CLOSE_LOG_INTERVAL_MS = 60000;
 export interface PresencePayload {
@@ -111,8 +115,8 @@ export declare class PresenceClient {
     private reconnectHandle;
     private stableHandle;
     private connectedAtMs;
-    private closeLogCount;
-    private lastCloseLogAtMs;
+    /** One close log per transition into reconnecting, until the next connect. */
+    private reconnectLogged;
     private stopped;
     private generation;
     private publishedTopics;

package/dist/lib/mesh/live/daemon/presence.js

@@ -34,7 +34,11 @@ export const CONNECT_STABLE_GRACE_MS = 5_000;
  * waits at least this long regardless of the backoff/grace-reset state.
  */
 export const RECONNECT_MIN_DELAY_MS = 1_000;
-/** Always emit the first N close info lines, then at most one per interval. */
+/**
+ * Close/reconnect info is one line per transition into reconnecting.
+ * Repeated `close` events while already reconnecting do not log again.
+ * Kept so older imports still resolve; they no longer gate the log.
+ */
 export const CLOSE_LOG_ALWAYS_COUNT = 3;
 export const CLOSE_LOG_INTERVAL_MS = 60_000;
 /**
@@ -81,8 +85,8 @@ export class PresenceClient {
     reconnectHandle = null;
     stableHandle = null;
     connectedAtMs = null;
-    closeLogCount = 0;
-    lastCloseLogAtMs = Number.NEGATIVE_INFINITY;
+    /** One close log per transition into reconnecting, until the next connect. */
+    reconnectLogged = false;
     stopped = false;
     generation = 0;
     publishedTopics = [];
@@ -281,6 +285,7 @@ export class PresenceClient {
                     this.attempt = 0;
                     this.lastBackoffMs = 0;
                 }, CONNECT_STABLE_GRACE_MS);
+                this.reconnectLogged = false;
                 this.setState("connected");
                 void this.publishAll("online").then(() => {
                     this.options.onOnline?.(bundle.companies.map((c) => c.companyUid));
@@ -383,13 +388,9 @@ export class PresenceClient {
         return delay;
     }
     maybeLogClose(elapsedMs, delayMs) {
-        const now = this.timers.now();
-        const withinAlways = this.closeLogCount < CLOSE_LOG_ALWAYS_COUNT;
-        const intervalElapsed = now - this.lastCloseLogAtMs >= CLOSE_LOG_INTERVAL_MS;
-        if (!withinAlways && !intervalElapsed)
+        if (this.reconnectLogged)
             return;
-        this.closeLogCount += 1;
-        this.lastCloseLogAtMs = now;
+        this.reconnectLogged = true;
         this.options.onInfo?.(`presence mqtt closed after ${elapsedMs}ms; reconnect in ${delayMs}ms`);
     }
     clearReconnect() {

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -18,6 +18,7 @@ import { type PidLockDeps } from "./pid-lock.js";
 import { PresenceClient, type MqttConnectFn } from "./presence.js";
 import { TranscriptWatcher, type TranscriptFs } from "./transcript-watch.js";
 import { type MeshEmitMode } from "./mode.js";
+import { type CommandRunner, type LegacyListenPlatform } from "./legacy-listen.js";
 export declare const SPOOL_DEBOUNCE_MS = 2000;
 export declare const FLUSH_INTERVAL_MS = 10000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
@@ -90,6 +91,11 @@ export interface DaemonRunDeps {
     resolveMembership?: (token: string, slug: string, signal?: AbortSignal) => Promise<{
         companyUid: string;
     } | null>;
+    /**
+     * Machine credential (fleet box or local bot). A refused or empty membership
+     * probe defers; it does not clear the company. Defaults to isMachineIdentity().
+     */
+    machineIdentity?: boolean;
     /** Test seam immediately before a device-default revocation's guarded commit. */
     beforeDeviceDefaultRevocationCommit?: () => void;
     log?: (dir: string, line: string) => void;
@@ -97,10 +103,22 @@ export interface DaemonRunDeps {
     runForMs?: number;
     /** CLI version loaded by this daemon. Defaults to this package's version. */
     daemonVersion?: string;
+    /**
+     * Subscribe to the personal work topic and write live-cache.json.
+     * The `hq mesh daemon run` command turns this on. Tests leave it off
+     * unless they inject credentials.
+     */
+    enableWorkCache?: boolean;
+    fetchPersonalCredentials?: import("./credentials.js").PersonalCredentialsFetcher;
     /** Read the currently installed CLI version behind the launch entrypoint. */
     readInstalledCliVersion?: () => string | null;
     random?: () => number;
     now?: () => Date;
+    /** Host for legacy listen retirement. Tests inject this; default is process.platform. */
+    legacyListenPlatform?: LegacyListenPlatform;
+    /** Service-manager runner for legacy listen retirement (tests inject). */
+    legacyListenRun?: CommandRunner;
+    windowsLegacyTaskPresent?: boolean;
 }
 export interface DaemonHandle {
     stop: () => Promise<void>;

package/dist/lib/mesh/live/daemon/run.js

@@ -14,7 +14,7 @@ import * as path from "node:path";
 import { CLI_VERSION } from "../../../../cli-version.js";
 import { createWorkSessionDeliverer } from "../../client.js";
 import { listActiveMembershipCompanies, meshJson, resolveActiveMembershipCompany } from "../../api.js";
-import { ensureCognitoToken } from "../../../../utils/cognito-session.js";
+import { ensureCognitoToken, isMachineIdentity } from "../../../../utils/cognito-session.js";
 import { replayOutbox } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
 import { ensureDefaultCompany } from "../../../work-context/default-company.js";
@@ -26,17 +26,19 @@ import { backfillHeldSessions, } from "../backfill-held.js";
 import { reconcileObservation } from "../../../work-context/reconcile.js";
 import { workMeshRoot, workMeshSpoolPath } from "../paths.js";
 import { createVaultBoardReader, refreshBoundSessionBoards, BOARD_REFRESH_INTERVAL_MS, } from "./board-refresh.js";
-import { createContract3Fetcher, realTimerHost, } from "./credentials.js";
+import { createContract3Fetcher, createPersonalRealtimeFetcher, realTimerHost, } from "./credentials.js";
 import { appendDaemonLog, daemonLogLine, ensureDaemonLog } from "./log.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock, } from "./pid-lock.js";
 import { daemonDir } from "./paths.js";
-import { PresenceClient, } from "./presence.js";
+import { PresenceClient, defaultMqttConnect, } from "./presence.js";
 import { defaultDaemonState, patchDaemonState, readDaemonState, writeDaemonState, } from "./state.js";
 import { workMeshHeldPath } from "../paths.js";
 import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
 import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
 import { hasCliVersionDrift, readInstalledCliVersion } from "./version-drift.js";
 import { readDaemonConfig } from "./config.js";
+import { retireLegacyListen } from "./legacy-listen.js";
+import { startWorkCacheSubscriber } from "./work-subscribe.js";
 export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
@@ -112,6 +114,15 @@ export async function runMeshDaemon(deps = {}) {
     const daemonVersion = deps.daemonVersion ?? CLI_VERSION;
     const installedCliVersion = deps.readInstalledCliVersion ?? readInstalledCliVersion;
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const hostPlatform = process.platform === "darwin" || process.platform === "linux" || process.platform === "win32"
+        ? process.platform
+        : "other";
+    const retiredListen = retireLegacyListen({
+        home,
+        platform: deps.legacyListenPlatform ?? hostPlatform,
+        run: deps.legacyListenRun,
+        windowsTaskPresent: deps.windowsLegacyTaskPresent,
+    });
     const configuredRoots = readDaemonConfig(dir).trustedHqRoots;
     const trustedRoots = [...new Set([
             ...(deps.hqRoot ? [deps.hqRoot] : []),
@@ -119,6 +130,9 @@ export async function runMeshDaemon(deps = {}) {
             ...configuredRoots,
         ])];
     ensureDaemonLog(dir);
+    if (retiredListen.removed) {
+        log(dir, "retired legacy listener ai.getindigo.hq-work-mesh-listen");
+    }
     const lockDeps = deps.pidLock ?? defaultPidLockDeps({ isProcessAlive: alive });
     const lock = acquirePidLock(dir, lockDeps);
     if (!lock.ok) {
@@ -143,6 +157,7 @@ export async function runMeshDaemon(deps = {}) {
     const defaultGetToken = async () => ensureCognitoToken({ interactive: false, tokenSource: "machine" });
     const getToken = deps.getToken ?? defaultGetToken;
     const resolveMembership = deps.resolveMembership ?? resolveActiveMembershipCompany;
+    const machineIdentity = deps.machineIdentity ?? isMachineIdentity();
     /** The sole authorization seam for daemon tenant I/O derived from a device default. */
     const tenantGate = {
         authorize: async (input) => {
@@ -161,9 +176,18 @@ export async function runMeshDaemon(deps = {}) {
                     authorization = await Promise.race([
                         (async () => {
                             const membership = await resolveMembership(await getToken(), slug, controller.signal);
-                            return membership
-                                ? { status: "authorized", uid: membership.companyUid }
-                                : { status: "denied" };
+                            if (membership)
+                                return { status: "authorized", uid: membership.companyUid };
+                            // A machine token often cannot read /membership/me (401/403, or an
+                            // empty person-membership list). That is "cannot tell", not "not
+                            // a member". Leave the company in place and retry.
+                            if (machineIdentity) {
+                                return {
+                                    status: "unavailable",
+                                    error: "membership probe on a machine token did not confirm a company; company left unchanged",
+                                };
+                            }
+                            return { status: "denied" };
                         })(),
                         new Promise((resolve) => {
                             controller.signal.addEventListener("abort", () => resolve({
@@ -359,6 +383,7 @@ export async function runMeshDaemon(deps = {}) {
             });
         });
     let presence = null;
+    let workCache = null;
     if (deps.enablePresence !== false) {
         const fetchCredentialsRaw = deps.fetchCredentials ??
             (async () => {
@@ -420,6 +445,31 @@ export async function runMeshDaemon(deps = {}) {
             // Continue draining spool even if MQTT is down.
         }
     }
+    if (deps.enableWorkCache) {
+        try {
+            workCache = await startWorkCacheSubscriber({
+                meshRoot,
+                fetchCredentials: deps.fetchPersonalCredentials ?? (async () => {
+                    const t = await getToken();
+                    return createPersonalRealtimeFetcher({
+                        token: t,
+                        baseUrl: resolveVaultApiBase(env),
+                    })();
+                }),
+                mqttConnect: (url, options) => {
+                    const connect = deps.mqttConnect ?? defaultMqttConnect;
+                    return connect(url, options);
+                },
+                now,
+                onInfo: (message) => log(dir, message.slice(0, 200)),
+                random: deps.random,
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log(dir, `work cache subscribe failed: ${msg.slice(0, 200)}`);
+        }
+    }
     let stopped = false;
     let restartRequested = false;
     let flushInFlight = null;
@@ -698,6 +748,15 @@ export async function runMeshDaemon(deps = {}) {
         // Final flush, then clean MQTT DISCONNECT so the broker emits the
         // lifecycle event; offline is published server-side only.
         await doFlushCycle("shutdown", { force: true });
+        if (workCache) {
+            try {
+                await workCache.stop();
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                log(dir, `work cache stop error: ${msg.slice(0, 120)}`);
+            }
+        }
         if (presence) {
             try {
                 await presence.stop();

package/dist/lib/mesh/live/daemon/work-subscribe.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Contract-2 subscriber for the personal work topic.
+ * Owns live-cache.json writes. Presence publish stays on PresenceClient.
+ */
+import type { IClientOptions } from "mqtt";
+import { type PersonalCredentialsFetcher } from "./credentials.js";
+export interface WorkCacheMqtt {
+    on(event: string, handler: (...args: any[]) => void): unknown;
+    subscribe(topic: string, opts: {
+        qos: 0 | 1;
+    }, cb?: (err?: Error | null) => void): unknown;
+    end(force?: boolean, cb?: () => void): unknown;
+}
+export interface WorkCacheSubscriber {
+    stop: () => Promise<void>;
+}
+export declare function startWorkCacheSubscriber(opts: {
+    meshRoot: string;
+    fetchCredentials?: PersonalCredentialsFetcher;
+    token?: () => Promise<string>;
+    baseUrl?: string;
+    mqttConnect: (url: string, options: IClientOptions) => WorkCacheMqtt;
+    now?: () => Date;
+    timers?: {
+        setTimeout: (fn: () => void, ms: number) => unknown;
+        clearTimeout: (handle: unknown) => void;
+    };
+    onInfo?: (message: string) => void;
+    random?: () => number;
+}): Promise<WorkCacheSubscriber>;
+//# sourceMappingURL=work-subscribe.d.ts.map

package/dist/lib/mesh/live/daemon/work-subscribe.js

@@ -0,0 +1,124 @@
+/**
+ * Contract-2 subscriber for the personal work topic.
+ * Owns live-cache.json writes. Presence publish stays on PresenceClient.
+ */
+import { createPersonalRealtimeFetcher, } from "./credentials.js";
+import { presignIotWssUrl } from "./presign.js";
+import { applyProjectViewPush, parseProjectViewPush } from "./live-cache.js";
+import { backoffDelayMs, RECONNECT_MIN_DELAY_MS } from "./presence.js";
+export async function startWorkCacheSubscriber(opts) {
+    const fetchCredentials = opts.fetchCredentials ??
+        (opts.token
+            ? createPersonalRealtimeFetcher({
+                token: await opts.token(),
+                baseUrl: opts.baseUrl,
+            })
+            : null);
+    if (!fetchCredentials) {
+        throw new Error("work cache subscriber needs credentials");
+    }
+    const now = opts.now ?? (() => new Date());
+    const timers = opts.timers ?? {
+        setTimeout: (fn, ms) => setTimeout(fn, ms),
+        clearTimeout: (handle) => clearTimeout(handle),
+    };
+    const random = opts.random ?? Math.random;
+    let stopped = false;
+    let client = null;
+    let reconnectLogged = false;
+    let attempt = 0;
+    let timer = null;
+    let generation = 0;
+    const connect = async () => {
+        if (stopped)
+            return;
+        const gen = ++generation;
+        let bundle;
+        try {
+            bundle = await fetchCredentials();
+        }
+        catch (err) {
+            schedule(err);
+            return;
+        }
+        if (stopped || gen !== generation)
+            return;
+        const topic = bundle.topics.work;
+        if (!topic) {
+            opts.onInfo?.("work cache subscribe skipped: credentials have no work topic");
+            return;
+        }
+        const url = presignIotWssUrl(bundle.credentials, bundle.iotEndpoint, bundle.region, now());
+        const next = opts.mqttConnect(url, {
+            clientId: `${bundle.clientId}-work`,
+            clean: true,
+            reconnectPeriod: 0,
+            protocolVersion: 4,
+        });
+        client = next;
+        next.on("connect", () => {
+            if (stopped || gen !== generation)
+                return;
+            reconnectLogged = false;
+            attempt = 0;
+            next.subscribe(topic, { qos: 1 }, () => undefined);
+        });
+        next.on("message", (_topic, payload) => {
+            if (stopped || gen !== generation)
+                return;
+            if (_topic !== topic)
+                return;
+            const push = parseProjectViewPush(payload);
+            if (!push)
+                return;
+            const result = applyProjectViewPush(opts.meshRoot, push, now().toISOString());
+            if (result.applied) {
+                opts.onInfo?.(`project-view cache cursor=${result.cursor} ${push.companyUid}/${push.projectId}`);
+            }
+        });
+        next.on("close", () => {
+            if (stopped || gen !== generation)
+                return;
+            schedule();
+        });
+    };
+    const schedule = (err) => {
+        if (stopped)
+            return;
+        if (!reconnectLogged) {
+            reconnectLogged = true;
+            const detail = err instanceof Error ? `: ${err.message}` : "";
+            opts.onInfo?.(`work cache mqtt reconnecting${detail}`.slice(0, 200));
+        }
+        if (timer !== null)
+            timers.clearTimeout(timer);
+        const delay = backoffDelayMs(attempt, 1000, 60_000, random, 0, RECONNECT_MIN_DELAY_MS);
+        attempt += 1;
+        timer = timers.setTimeout(() => {
+            timer = null;
+            void connect();
+        }, delay);
+    };
+    await connect();
+    return {
+        stop: async () => {
+            stopped = true;
+            generation += 1;
+            if (timer !== null)
+                timers.clearTimeout(timer);
+            const current = client;
+            client = null;
+            if (!current)
+                return;
+            await new Promise((resolve) => {
+                try {
+                    current.end(true, () => resolve());
+                }
+                catch {
+                    resolve();
+                }
+            });
+        },
+    };
+}
+//# sourceMappingURL=work-subscribe.js.map

package/dist/lib/mesh/live/emit-evidence.d.ts

@@ -37,6 +37,17 @@ export interface BuildEmitEvidenceInput {
     readMeta?: (sessionId: string, hqRoot: string | undefined) => string | undefined;
     /** Injectable work-tree finder (tests). */
     findRepo?: (startDir: string) => string | null;
+    /**
+     * Env for HQ_SPAWN_COMPANY and the identity file. Defaults to empty so a
+     * unit test does not inherit the developer shell. Callers that emit pass
+     * `process.env`.
+     */
+    env?: NodeJS.ProcessEnv;
+    /** Injectable machine-company reader (tests). */
+    readMachineCompany?: (env: NodeJS.ProcessEnv) => {
+        slug?: string;
+        uid?: string;
+    } | undefined;
 }
 /** Dedupe absolute-ish paths, preserving first-seen order. */
 export declare function normalizeTouchedPaths(paths: Array<string | undefined | null>): string[];
@@ -46,4 +57,12 @@ export declare function normalizeTouchedPaths(paths: Array<string | undefined |
  * first touched file). All fields are omitted when empty.
  */
 export declare function buildEmitEvidence(input: BuildEmitEvidenceInput): EmitEvidence;
+/**
+ * A machine credential with no company must not be posted. The server would
+ * file it as company NONE. Hold it instead.
+ */
+export declare function machineEmitDisposition(input: {
+    machine: boolean;
+    companySlug?: string;
+}): "post" | "hold";
 //# sourceMappingURL=emit-evidence.d.ts.map

package/dist/lib/mesh/live/emit-evidence.js

@@ -9,7 +9,7 @@
  * work-tree off disk. Never reads prompts/tokens; never hits the network.
  */
 import * as path from "node:path";
-import { readMetaCompanySlug } from "../../work-context/company.js";
+import { readMachineCompanyBinding, readMetaCompanySlug } from "../../work-context/company.js";
 import { findWorkTreeRoot } from "../../work-context/repo-remote.js";
 function clean(v) {
     return typeof v === "string" && v.trim() ? v.trim() : undefined;
@@ -41,7 +41,16 @@ export function buildEmitEvidence(input) {
     const cwd = clean(input.cwd);
     const hqRoot = clean(input.hqRoot);
     const touchedPaths = normalizeTouchedPaths(input.touchedPaths ?? []);
-    const companySlug = clean(input.companySlug) ?? clean(readMeta(input.sessionId, hqRoot));
+    const env = input.env ?? {};
+    const machine = (input.readMachineCompany ?? readMachineCompanyBinding)(env);
+    const spawned = clean(env.HQ_SPAWN_COMPANY);
+    // Explicit, spawn, session meta, then the box binding (slug, else uid).
+    // A uid with no slug still rides companySlug so the event is not company NONE.
+    const companySlug = clean(input.companySlug) ??
+        spawned ??
+        clean(readMeta(input.sessionId, hqRoot)) ??
+        (machine && machine.slug !== spawned ? clean(machine.slug) : undefined) ??
+        clean(machine?.uid);
     let repoPath = clean(input.repoPath);
     if (!repoPath) {
         // Search from the cwd (a directory) or the directory of the first touched
@@ -69,6 +78,15 @@ export function buildEmitEvidence(input) {
         evidence.task = task;
     return evidence;
 }
+/**
+ * A machine credential with no company must not be posted. The server would
+ * file it as company NONE. Hold it instead.
+ */
+export function machineEmitDisposition(input) {
+    if (input.machine && !clean(input.companySlug))
+        return "hold";
+    return "post";
+}
 /** Directory of the first absolute touched file, for work-tree discovery. */
 function firstFileDir(touchedPaths) {
     const abs = touchedPaths.find((p) => path.isAbsolute(p));

package/dist/lib/work-context/company.d.ts

@@ -77,7 +77,23 @@ export declare const DEFAULT_AGENT_IDENTITY_FILE = "/var/lib/hq-agent/identity.j
  * Missing/unreadable/malformed → undefined
  * (never throws; never logs file contents).
  */
+export interface AgentIdentityCompany {
+    uid?: string;
+    slug?: string;
+}
+/** Company uid and slug from the fleet identity file. Missing file → undefined. */
+export declare function readAgentIdentityCompany(env?: NodeJS.ProcessEnv): AgentIdentityCompany | undefined;
 export declare function readAgentIdentityCompanyUid(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Company named for a machine session.
+ * Order: HQ_SPAWN_COMPANY, identity-file slug, identity-file uid.
+ * Session meta is not included; callers place it between spawn and the file.
+ * No company → undefined. Never invents NONE.
+ */
+export declare function readMachineCompanyBinding(env?: NodeJS.ProcessEnv): {
+    slug?: string;
+    uid?: string;
+} | undefined;
 /**
  * Agent boxes must never infer a human device default. The file itself is the
  * machine marker; legacy identity files do not necessarily contain a company

package/dist/lib/work-context/company.js

@@ -38,13 +38,7 @@ function normalizeSlug(value) {
         return undefined;
     return s;
 }
-/**
- * Read `companyUid` from the agent identity file when
- * `HQ_AGENT_IDENTITY_FILE` is set, or the conventional fleet path otherwise.
- * Missing/unreadable/malformed → undefined
- * (never throws; never logs file contents).
- */
-export function readAgentIdentityCompanyUid(env = process.env) {
+function readAgentIdentityRecord(env) {
     // An explicit override (including empty/missing paths) never falls back to
     // another identity. This prevents accidental attribution to a different box.
     const file = (env[HQ_AGENT_IDENTITY_FILE_ENV] ?? DEFAULT_AGENT_IDENTITY_FILE).trim();
@@ -54,15 +48,49 @@ export function readAgentIdentityCompanyUid(env = process.env) {
         if (!fs.existsSync(file))
             return undefined;
         const raw = JSON.parse(fs.readFileSync(file, "utf8"));
-        const uid = raw.companyUid;
-        return typeof uid === "string" && uid.trim().length > 0
-            ? uid.trim()
-            : undefined;
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return undefined;
+        return raw;
     }
     catch {
         return undefined;
     }
 }
+/** Company uid and slug from the fleet identity file. Missing file → undefined. */
+export function readAgentIdentityCompany(env = process.env) {
+    const raw = readAgentIdentityRecord(env);
+    if (!raw)
+        return undefined;
+    const uid = typeof raw.companyUid === "string" ? raw.companyUid.trim() : "";
+    const slug = normalizeSlug(typeof raw.companySlug === "string" ? raw.companySlug : undefined);
+    if (!uid && !slug)
+        return undefined;
+    return {
+        ...(uid ? { uid } : {}),
+        ...(slug ? { slug } : {}),
+    };
+}
+export function readAgentIdentityCompanyUid(env = process.env) {
+    return readAgentIdentityCompany(env)?.uid;
+}
+/**
+ * Company named for a machine session.
+ * Order: HQ_SPAWN_COMPANY, identity-file slug, identity-file uid.
+ * Session meta is not included; callers place it between spawn and the file.
+ * No company → undefined. Never invents NONE.
+ */
+export function readMachineCompanyBinding(env = process.env) {
+    const spawn = normalizeSlug(env.HQ_SPAWN_COMPANY);
+    const identity = readAgentIdentityCompany(env);
+    if (spawn)
+        return { slug: spawn, ...(identity?.uid ? { uid: identity.uid } : {}) };
+    if (!identity?.slug && !identity?.uid)
+        return undefined;
+    return {
+        ...(identity?.slug ? { slug: identity.slug } : {}),
+        ...(identity?.uid ? { uid: identity.uid } : {}),
+    };
+}
 /**
  * Agent boxes must never infer a human device default. The file itself is the
  * machine marker; legacy identity files do not necessarily contain a company
@@ -273,11 +301,15 @@ export function resolveCompany(input) {
     // 4. Agent-box identity file (HQ_AGENT_IDENTITY_FILE). Prefer as the
     // device-default role with source trusted_explicit — never device_default /
     // "default company mode". Below HQ_SPAWN_COMPANY; above device default.
-    const identityUid = readAgentIdentityCompanyUid(env);
-    if (identityUid) {
+    const identity = readAgentIdentityCompany(env);
+    if (identity?.uid || identity?.slug) {
         return {
             status: "resolved",
-            company: { uid: identityUid, source: "trusted_explicit" },
+            company: {
+                ...(identity.slug ? { slug: identity.slug } : {}),
+                ...(identity.uid ? { uid: identity.uid } : {}),
+                source: "trusted_explicit",
+            },
         };
     }
     // 4b. Persisted per-repo company map (gap 4). A person answered once for this

package/dist/utils/self-update.js

@@ -282,7 +282,10 @@ async function updateAndReexec(argv, flavor, known, deps) {
     // A resident mesh daemon keeps the old JS loaded after a global install.
     // Service restart is best-effort and cannot turn a successful update red.
     try {
-        const restart = (deps.restartDaemon ?? restartDaemonServiceIfInstalled)();
+        const restart = (deps.restartDaemon ?? (() => restartDaemonServiceIfInstalled({
+            env,
+            hqRoot: env.HQ_ROOT,
+        })))();
         if (restart?.message)
             console.error(chalk.yellow(`  ${restart.message}`));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.131.0",
+  "version": "5.133.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -39,7 +39,7 @@
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "~6.16.60",
+    "@indigoai-us/hq-cloud": "~6.16.74",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@sentry/node": "^10.49.0",
     "@tobilu/qmd": "2.5.3",