@indigoai-us/hq-cli 5.145.0 → 5.147.0

package/dist/lib/mesh/live/daemon/credentials.js

@@ -2,9 +2,13 @@
  * Contract-3 realtime credential vend + 80%-of-lifetime renewal.
  * Never logs or persists credential material.
  */
+import * as fs from "node:fs";
+import * as path from "node:path";
 import { DEFAULT_VAULT_API_URL } from "../../../../utils/cognito-session.js";
 import { vaultApiFetch } from "../../../../utils/vault-api.js";
 import { readAgentIdentityCompanyUid } from "../../../work-context/company.js";
+import { readDeviceConfig } from "../../../work-context/config.js";
+import { workContextSessionsDir } from "../../../work-context/paths.js";
 export const REALTIME_CREDENTIALS_PATH = "/v1/realtime/credentials";
 export const MQTT_KEEPALIVE_SECONDS = 15;
 /** Renew at 80% of credential lifetime. */
@@ -20,6 +24,12 @@ export const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 export const MAX_TIMER_DELAY_MS = 2_147_483_647;
 /** Cap any single retry so a bogus Retry-After cannot park the daemon. */
 export const MAX_RETRY_DELAY_MS = 24 * 60 * 60 * 1000;
+/** Contract-3 vend accepts at most this many preferred company uids. */
+export const PREFERRED_COMPANY_LIMIT = 5;
+/** Session files older than this do not count as companies in use. */
+export const PREFERRED_SESSION_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** Preferred-set changes re-vend at most this often. */
+export const PREFERRED_REVEND_MIN_MS = 60_000;
 /**
  * Typed vend failure. `refused` = server will not vend right now
  * (FEATURE_DISABLED / REALTIME_CONTRACT_UNSUPPORTED / 403); daemon should
@@ -241,8 +251,14 @@ export function normalizeContract3Bundle(raw) {
         const companyUid = typeof row.companyUid === "string" ? row.companyUid.trim() : "";
         if (!companyUid)
             continue;
+        const slug = typeof row.companySlug === "string"
+            ? row.companySlug.trim()
+            : typeof row.slug === "string"
+                ? row.slug.trim()
+                : "";
         droppedCompanies.push({
             companyUid,
+            ...(slug ? { label: slug } : {}),
             reason: typeof row.reason === "string" && row.reason.trim()
                 ? row.reason.trim()
                 : "not included",
@@ -282,6 +298,101 @@ export function scopeBundleToAgentIdentity(bundle, env = process.env) {
     }
     return { ...bundle, companies: matched };
 }
+function pushDistinct(out, seen, uid) {
+    const trimmed = uid?.trim();
+    if (!trimmed || seen.has(trimmed) || out.length >= PREFERRED_COMPANY_LIMIT)
+        return;
+    seen.add(trimmed);
+    out.push(trimmed);
+}
+/**
+ * Device default first, then distinct company uids from session files updated
+ * in the last 24 hours, newest first, max 5. Any read error returns undefined
+ * so the vend body omits the field.
+ */
+export function readPreferredCompanyUids(input) {
+    try {
+        const nowMs = input.nowMs ?? Date.now();
+        const config = readDeviceConfig({ root: input.workContextRoot });
+        const out = [];
+        const seen = new Set();
+        if (config.defaultCompany?.enabled && config.defaultCompany.uid) {
+            pushDistinct(out, seen, config.defaultCompany.uid);
+        }
+        const dir = workContextSessionsDir(input.workContextRoot);
+        let names = [];
+        try {
+            names = fs.readdirSync(dir);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== "ENOENT")
+                throw err;
+        }
+        const recent = [];
+        for (const name of names) {
+            if (!name.endsWith(".json"))
+                continue;
+            const full = path.join(dir, name);
+            const stat = fs.statSync(full);
+            if (!stat.isFile())
+                continue;
+            const raw = JSON.parse(fs.readFileSync(full, "utf8"));
+            const parsedAt = typeof raw.updatedAt === "string" ? Date.parse(raw.updatedAt) : Number.NaN;
+            const at = Number.isFinite(parsedAt) ? parsedAt : stat.mtimeMs;
+            if (!Number.isFinite(at) || nowMs - at > PREFERRED_SESSION_WINDOW_MS)
+                continue;
+            if (nowMs < at)
+                continue;
+            if (typeof raw.companyUid !== "string")
+                continue;
+            recent.push({ uid: raw.companyUid, at });
+        }
+        recent.sort((a, b) => b.at - a.at || a.uid.localeCompare(b.uid));
+        for (const row of recent)
+            pushDistinct(out, seen, row.uid);
+        return out;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function preferredCompanyKey(uids) {
+    return (uids ?? []).join("\n");
+}
+/** True when a new preferred set should force a vend, at most once per minute. */
+export function shouldRevendPreferredCompanies(input) {
+    if (!input.next)
+        return false;
+    if (preferredCompanyKey(input.previous) === preferredCompanyKey(input.next)) {
+        return false;
+    }
+    const min = input.minIntervalMs ?? PREFERRED_REVEND_MIN_MS;
+    return input.nowMs - input.lastVendMs >= min;
+}
+export function contract3VendBody(preferredCompanyUids) {
+    const body = {
+        contractVersion: 3,
+    };
+    if (preferredCompanyUids && preferredCompanyUids.length > 0) {
+        body.preferredCompanyUids = preferredCompanyUids.slice(0, PREFERRED_COMPANY_LIMIT);
+    }
+    return body;
+}
+/** Plain doctor line for one company the vend left out. */
+export function formatDroppedPresenceCompany(company) {
+    const name = company.label?.trim() || company.companyUid;
+    if (company.reason === "gate_disabled") {
+        return `${name}: not included (presence is turned off for this company)`;
+    }
+    if (company.reason === "policy_budget") {
+        return `${name}: not included (too many companies for one credential)`;
+    }
+    if (!company.reason || company.reason === "unknown" || company.reason === "not included") {
+        return `${name}: not included`;
+    }
+    return `${name}: not included (${company.reason})`;
+}
 function headerGet(headers, name) {
     if (!headers)
         return null;
@@ -294,11 +405,19 @@ function headerGet(headers, name) {
 }
 export function createContract3Fetcher(opts) {
     return async () => {
+        let preferred;
+        if (opts.readPreferredCompanyUids) {
+            try {
+                preferred = opts.readPreferredCompanyUids();
+            }
+            catch {
+                preferred = undefined;
+            }
+        }
+        const body = contract3VendBody(preferred);
         let bundle;
         if (opts.post) {
-            const res = await opts.post(REALTIME_CREDENTIALS_PATH, {
-                contractVersion: 3,
-            });
+            const res = await opts.post(REALTIME_CREDENTIALS_PATH, body);
             if (res.status < 200 || res.status >= 300) {
                 throw classifyCredentialVendFailure(res.status, res.body, headerGet(res.headers, "Retry-After"));
             }
@@ -309,23 +428,23 @@ export function createContract3Fetcher(opts) {
                 token: opts.token,
                 path: REALTIME_CREDENTIALS_PATH,
                 method: "POST",
-                body: { contractVersion: 3 },
+                body,
                 baseUrl: opts.baseUrl ?? DEFAULT_VAULT_API_URL,
             });
             const text = await res.text();
-            let body = {};
+            let parsed = {};
             if (text) {
                 try {
-                    body = JSON.parse(text);
+                    parsed = JSON.parse(text);
                 }
                 catch {
-                    body = { raw: text.slice(0, 200) };
+                    parsed = { raw: text.slice(0, 200) };
                 }
             }
             if (!res.ok) {
-                throw classifyCredentialVendFailure(res.status, body, res.headers.get("Retry-After"));
+                throw classifyCredentialVendFailure(res.status, parsed, res.headers.get("Retry-After"));
             }
-            bundle = normalizeContract3Bundle(body);
+            bundle = normalizeContract3Bundle(parsed);
         }
         return scopeBundleToAgentIdentity(bundle, opts.env ?? process.env);
     };
@@ -344,6 +463,7 @@ export class CredentialRenewalManager {
     random;
     handle = null;
     stopped = false;
+    inflight = false;
     constructor(fetchCredentials, onRenewed, onError = () => { }, timers = realTimerHost, retryDelayMs = 30_000, refusedRetryMs = DEFAULT_REFUSED_RETRY_MS, random = Math.random) {
         this.fetchCredentials = fetchCredentials;
         this.onRenewed = onRenewed;
@@ -360,9 +480,17 @@ export class CredentialRenewalManager {
         const delay = renewalDelayMs(this.timers.now(), bundle.expiresAt);
         this.handle = scheduleBoundedTimeout(this.timers, () => void this.renew(), delay);
     }
+    /** Vend now (preferred companies changed). No-op while a vend is in flight. */
+    renewNow() {
+        if (this.stopped || this.inflight)
+            return;
+        this.clear();
+        void this.renew();
+    }
     async renew() {
-        if (this.stopped)
+        if (this.stopped || this.inflight)
             return;
+        this.inflight = true;
         try {
             const bundle = await this.fetchCredentials();
             if (this.stopped)
@@ -389,6 +517,9 @@ export class CredentialRenewalManager {
                 return;
             this.handle = scheduleBoundedTimeout(this.timers, () => void this.renew(), delay);
         }
+        finally {
+            this.inflight = false;
+        }
     }
     stop() {
         this.stopped = true;

package/dist/lib/mesh/live/daemon/doctor.js

@@ -9,6 +9,7 @@ import { describeCognitoTokenSource, formatCognitoSubject, loadMachineCachedToke
 import { listOutboxOperations, outboxStats, } from "../../../work-context/outbox.js";
 import { readSessionState } from "../../../work-context/state.js";
 import { workContextRoot } from "../../../work-context/paths.js";
+import { formatDroppedPresenceCompany } from "./credentials.js";
 import { countJsonlLines, countUnattributedEvents, } from "../spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../paths.js";
 import { daemonDir, daemonPidPath } from "./paths.js";
@@ -239,9 +240,9 @@ export function formatDaemonDoctor(report) {
     if (report.presenceDroppedCompanies.length > 0) {
         lines.push(`presence not published for ${report.presenceDroppedCompanies.length} companies: ` +
             report.presenceDroppedCompanies
-                .map((company) => `${company.companyUid} (${company.reason})`)
-                .join(", ") +
-            `; presence credential holds ${report.companiesOnline.length} companies; these were not included`);
+                .map((company) => formatDroppedPresenceCompany(company))
+                .join("; ") +
+            `; presence credential holds ${report.companiesOnline.length} companies`);
     }
     if (report.unhealthy) {
         lines.push(`health: UNHEALTHY`);

package/dist/lib/mesh/live/daemon/presence.d.ts

@@ -84,6 +84,13 @@ export interface PresenceClientOptions {
     onRefusal?: (refusal: PresenceRefusal | null) => void;
     now?: () => Date;
     env?: NodeJS.ProcessEnv;
+    /**
+     * Companies the daemon is working in. When the set changes, presence
+     * re-vends instead of waiting for credential expiry (at most once a minute).
+     * Undefined means a read failed — do not re-vend.
+     */
+    readPreferredCompanyUids?: () => string[] | undefined;
+    preferredRevendMinMs?: number;
 }
 /**
  * Full-jitter capped exponential backoff (1s base → 60s cap by default),
@@ -123,6 +130,9 @@ export declare class PresenceClient {
     /** Last refusal code we logged via onError (episode dedupe). */
     private loggedRefusalKey;
     private refusal;
+    private preferredHandle;
+    private preferredSnapshot;
+    private lastPreferredVendMs;
     private readonly mqttConnect;
     private readonly timers;
     private readonly random;
@@ -137,6 +147,11 @@ export declare class PresenceClient {
     getRefusal(): PresenceRefusal | null;
     /** Topics this client has published to (for doctor / tests). */
     getPublishedTopics(): readonly string[];
+    private preferredMinMs;
+    private notePreferredVend;
+    private clearPreferredWatch;
+    private armPreferredWatch;
+    private maybeRevendPreferred;
     private setState;
     start(): Promise<void>;
     /**

package/dist/lib/mesh/live/daemon/presence.js

@@ -12,7 +12,7 @@
  * - Server credential refusals use a long retry (default 10m ±20%)
  */
 import mqtt from "mqtt";
-import { CredentialVendError, CredentialRenewalManager, MQTT_KEEPALIVE_SECONDS, clampRetryDelayMs, defaultRefusedRetryMs, realTimerHost, refusedRetryDelayMs, scheduleBoundedTimeout, } from "./credentials.js";
+import { CredentialVendError, CredentialRenewalManager, MQTT_KEEPALIVE_SECONDS, PREFERRED_REVEND_MIN_MS, clampRetryDelayMs, defaultRefusedRetryMs, realTimerHost, refusedRetryDelayMs, scheduleBoundedTimeout, shouldRevendPreferredCompanies, } from "./credentials.js";
 import { presignIotWssUrl } from "./presign.js";
 /**
  * A connection that drops before this grace window after `connect` is treated
@@ -93,6 +93,9 @@ export class PresenceClient {
     /** Last refusal code we logged via onError (episode dedupe). */
     loggedRefusalKey = null;
     refusal = null;
+    preferredHandle = null;
+    preferredSnapshot = [];
+    lastPreferredVendMs = 0;
     mqttConnect;
     timers;
     random;
@@ -128,6 +131,67 @@ export class PresenceClient {
     getPublishedTopics() {
         return this.publishedTopics;
     }
+    preferredMinMs() {
+        return this.options.preferredRevendMinMs ?? PREFERRED_REVEND_MIN_MS;
+    }
+    notePreferredVend() {
+        const read = this.options.readPreferredCompanyUids;
+        if (!read)
+            return;
+        let next;
+        try {
+            next = read();
+        }
+        catch {
+            return;
+        }
+        if (!next)
+            return;
+        this.preferredSnapshot = next;
+        this.lastPreferredVendMs = this.timers.now();
+    }
+    clearPreferredWatch() {
+        if (this.preferredHandle) {
+            this.preferredHandle.clear();
+            this.preferredHandle = null;
+        }
+    }
+    armPreferredWatch() {
+        if (!this.options.readPreferredCompanyUids || this.stopped)
+            return;
+        this.clearPreferredWatch();
+        this.preferredHandle = scheduleBoundedTimeout(this.timers, () => {
+            this.preferredHandle = null;
+            if (this.stopped)
+                return;
+            this.maybeRevendPreferred();
+            this.armPreferredWatch();
+        }, this.preferredMinMs());
+    }
+    maybeRevendPreferred() {
+        const read = this.options.readPreferredCompanyUids;
+        if (!read || this.stopped || this.refusal)
+            return;
+        let next;
+        try {
+            next = read();
+        }
+        catch {
+            return;
+        }
+        if (!shouldRevendPreferredCompanies({
+            previous: this.preferredSnapshot,
+            next,
+            lastVendMs: this.lastPreferredVendMs,
+            nowMs: this.timers.now(),
+            minIntervalMs: this.preferredMinMs(),
+        })) {
+            return;
+        }
+        this.lastPreferredVendMs = this.timers.now();
+        this.preferredSnapshot = next;
+        this.renewal.renewNow();
+    }
     setState(state) {
         if (this.state === state)
             return;
@@ -149,6 +213,7 @@ export class PresenceClient {
         this.stopped = true;
         this.generation += 1;
         this.renewal.stop();
+        this.clearPreferredWatch();
         this.clearReconnect();
         this.clearStableTimer();
         this.connectedAtMs = null;
@@ -190,6 +255,7 @@ export class PresenceClient {
     }
     async onCredentialsRenewed(bundle) {
         this.bundle = bundle;
+        this.notePreferredVend();
         // Successful vend ends a refusal episode (renewal skips connectOnce's vend path).
         this.clearRefusal(true);
         if (this.stopped)
@@ -249,6 +315,8 @@ export class PresenceClient {
                 // Successful vend ends a refusal episode (even before MQTT connects).
                 this.clearRefusal(true);
                 this.renewal.schedule(this.bundle);
+                this.notePreferredVend();
+                this.armPreferredWatch();
             }
             const bundle = this.bundle;
             const url = presignIotWssUrl(bundle.credentials, bundle.iotEndpoint, bundle.region, this.now());

package/dist/lib/mesh/live/daemon/run.js

@@ -26,7 +26,7 @@ import { backfillHeldSessions, } from "../backfill-held.js";
 import { reconcileObservation } from "../../../work-context/reconcile.js";
 import { workMeshRoot, workMeshSpoolPath } from "../paths.js";
 import { createVaultBoardReader, refreshBoundSessionBoards, BOARD_REFRESH_INTERVAL_MS, } from "./board-refresh.js";
-import { createContract3Fetcher, createPersonalRealtimeFetcher, realTimerHost, } from "./credentials.js";
+import { createContract3Fetcher, createPersonalRealtimeFetcher, readPreferredCompanyUids, realTimerHost, } from "./credentials.js";
 import { appendDaemonLog, daemonLogLine, ensureDaemonLog } from "./log.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock, } from "./pid-lock.js";
 import { daemonDir } from "./paths.js";
@@ -165,8 +165,20 @@ export async function runMeshDaemon(deps = {}) {
                 ? readSessionState(input.sessionId, ctxRoot)
                 : null);
             const slug = input.companySlug ?? state?.companySlug;
+            // A uid alone is enough to ask /membership/me. Missing slug is not a
+            // denial. A device-default session whose company was cleared can be
+            // checked against the configured default; that is the same company the
+            // daemon assigned before the false denial.
+            const configuredDefault = input.deviceDefault
+                ? readDeviceConfig({ root: ctxRoot }).defaultCompany
+                : undefined;
+            const defaultCompany = configuredDefault?.enabled ? configuredDefault : undefined;
+            const usingDefaultFallback = !slug && !state?.companyUid && Boolean(defaultCompany?.slug || defaultCompany?.uid);
+            const lookupKey = slug || state?.companyUid || (usingDefaultFallback
+                ? (defaultCompany?.slug || defaultCompany?.uid)
+                : undefined);
             let authorization;
-            if (!slug) {
+            if (!lookupKey) {
                 authorization = { status: "denied" };
             }
             else {
@@ -175,7 +187,14 @@ export async function runMeshDaemon(deps = {}) {
                 try {
                     authorization = await Promise.race([
                         (async () => {
-                            const membership = await resolveMembership(await getToken(), slug, controller.signal);
+                            const membership = await resolveMembership(await getToken(), lookupKey, controller.signal);
+                            // Timeout wins even if the probe then returns null.
+                            if (controller.signal.aborted) {
+                                return {
+                                    status: "unavailable",
+                                    error: `membership lookup timed out after ${DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS}ms`,
+                                };
+                            }
                             if (membership)
                                 return { status: "authorized", uid: membership.companyUid };
                             // A machine token often cannot read /membership/me (401/403, or an
@@ -221,8 +240,43 @@ export async function runMeshDaemon(deps = {}) {
             if (authorization.status === "authorized" &&
                 (!input.companyUid || input.companyUid === authorization.uid) &&
                 (!state?.companyUid || state.companyUid === authorization.uid)) {
+                // A prior false denial cleared the company and left needs_company.
+                // Membership just confirmed the company, so put it back and let flush post.
+                if (state &&
+                    state.companyConfidence === "device_default" &&
+                    state.contextStatus === "needs_company") {
+                    const restoredSlug = state.companySlug || slug || defaultCompany?.slug;
+                    const restoredUid = authorization.uid;
+                    updateSessionState(state.sessionId, ctxRoot, (current) => {
+                        if (!current || current.contextStatus !== "needs_company")
+                            return null;
+                        if (current.companyUid && current.companyUid !== restoredUid)
+                            return null;
+                        if (current.companySlug &&
+                            restoredSlug &&
+                            !sameCompanyValue(current.companySlug, restoredSlug)) {
+                            return null;
+                        }
+                        return mergeLocalSessionFields({
+                            ...current,
+                            companyUid: restoredUid,
+                            ...(restoredSlug ? { companySlug: restoredSlug } : {}),
+                            contextStatus: current.projectId
+                                ? (current.taskId ? "bound" : "needs_task")
+                                : "needs_project",
+                            updatedAt: now().toISOString(),
+                        }, current, { preserveCompanyBinding: false });
+                    });
+                }
                 return authorization;
             }
+            // Already stripped. Do not revoke, count, or log this again on every flush.
+            if (state &&
+                state.contextStatus === "needs_company" &&
+                !state.companyUid &&
+                !state.companySlug) {
+                return { status: "denied" };
+            }
             try {
                 invalidateDefaultCompanyMemberships({ root: ctxRoot, now });
             }
@@ -392,6 +446,7 @@ export async function runMeshDaemon(deps = {}) {
                     token: t,
                     baseUrl: resolveVaultApiBase(env),
                     env,
+                    readPreferredCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
                 })();
             });
         const fetchCredentials = async () => {
@@ -418,6 +473,7 @@ export async function runMeshDaemon(deps = {}) {
                 }, now);
                 log(dir, `presence online companies=${companies.length}`);
             },
+            readPreferredCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
             onRefusal: (refusal) => {
                 patchDaemonState(dir, {
                     presenceRefusal: refusal,

package/dist/lib/mesh/live/flush.d.ts

@@ -16,6 +16,11 @@ export declare const HELD_TTL_MS: number;
 export declare const HELD_RETRY_INTERVAL_MS: number;
 /** Cap held.jsonl size; oldest overflow is dead-lettered with HELD_OVERFLOW. */
 export declare const HELD_MAX_LINES = 20000;
+/**
+ * Re-check an unbound session against the project catalog at most this often.
+ * The catalog itself is also cached inside bind-best.
+ */
+export declare const PROJECT_REBIND_INTERVAL_MS = 60000;
 export type HeldReason = "STATE_ABSENT" | "NEEDS_COMPANY" | "COMPANY_CONFLICT" | "NEEDS_PROJECT" | "HELD_EXPIRED" | "HELD_OVERFLOW";
 export interface HeldLineRecord {
     /** Original spool event fields. */
@@ -46,6 +51,9 @@ export interface FlushDeps {
     log?: (message: string) => void;
     /** Authoritative gate for state derived from a device default. */
     authorizeDeviceDefaultTenant?: (state: SessionStateFile) => Promise<boolean>;
+    /** Passed through to bind-best (catalog cache root and HQ_WORK_MESH_CACHE). */
+    env?: NodeJS.ProcessEnv;
+    home?: string;
 }
 export interface FlushSummary {
     claimed: number;

package/dist/lib/mesh/live/flush.js

@@ -12,6 +12,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { resolveCompany } from "../../work-context/company.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
+import { rebindNeedsProjectOnPrompt } from "../../work-context/prompt-rebind.js";
 import { readSessionState, updateSessionState } from "../../work-context/state.js";
 import { repairAckedRegisterStates } from "../../work-context/outbox.js";
 import { workContextRoot } from "../../work-context/paths.js";
@@ -25,6 +26,12 @@ export const HELD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export const HELD_RETRY_INTERVAL_MS = 5 * 60 * 1000;
 /** Cap held.jsonl size; oldest overflow is dead-lettered with HELD_OVERFLOW. */
 export const HELD_MAX_LINES = 20_000;
+/**
+ * Re-check an unbound session against the project catalog at most this often.
+ * The catalog itself is also cached inside bind-best.
+ */
+export const PROJECT_REBIND_INTERVAL_MS = 60_000;
+const lastProjectRebindAtMs = new Map();
 function parseLine(line) {
     try {
         const v = JSON.parse(line);
@@ -224,18 +231,25 @@ export async function flushSessionEvents(deps) {
         };
         const loggedProject404 = new Set();
         for (const [sessionId, items] of bySession) {
-            const state = readSessionState(sessionId, deps.workContextRoot);
+            let state = readSessionState(sessionId, deps.workContextRoot);
             if (state?.companyConfidence === "device_default" &&
-                deps.authorizeDeviceDefaultTenant &&
-                !(await deps.authorizeDeviceDefaultTenant(state))) {
-                const heldAt = now().toISOString();
-                for (const item of items) {
-                    appendHeldLine(heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? heldAt), deps.workMeshRoot);
-                    summary.held += 1;
-                    markDisposed(item.event);
+                deps.authorizeDeviceDefaultTenant) {
+                const allowed = await deps.authorizeDeviceDefaultTenant(state);
+                // Authorization may restore a company the gate previously cleared.
+                state = readSessionState(sessionId, deps.workContextRoot) ?? state;
+                if (!allowed) {
+                    const heldAt = now().toISOString();
+                    for (const item of items) {
+                        appendHeldLine(heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? heldAt), deps.workMeshRoot);
+                        summary.held += 1;
+                        markDisposed(item.event);
+                    }
+                    continue;
                 }
-                continue;
             }
+            // After the company gate (which may restore a cleared company), try to
+            // bind a needs_project session to an existing Board before classifying.
+            state = rebindUnboundSession(sessionId, items, state, deps, nowMs);
             const decision = classifySession(state);
             if (decision.action === "drop") {
                 appendDroppedReceipt({
@@ -502,6 +516,54 @@ function canonicalizeForRestore(event) {
     }
     return out;
 }
+function eventText(event, key) {
+    const value = event[key];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+/**
+ * Before a needs_project (or unresolved-with-company) batch is classified,
+ * run the prompt-submit bind-best refinement. A bind updates the session
+ * file so the batch posts with that projectId. Ties stay unbound. At most
+ * one attempt per session per minute; failures stay on the existing state.
+ */
+function rebindUnboundSession(sessionId, items, state, deps, nowMs) {
+    if (!state?.companyUid)
+        return state;
+    if (state.contextStatus !== "needs_project" && state.contextStatus !== "unresolved") {
+        return state;
+    }
+    const key = `${deps.workContextRoot}\0${sessionId}`;
+    const previous = lastProjectRebindAtMs.get(key);
+    if (previous !== undefined && nowMs - previous < PROJECT_REBIND_INTERVAL_MS) {
+        return state;
+    }
+    lastProjectRebindAtMs.set(key, nowMs);
+    const sample = items[0]?.event ?? {};
+    const started = Date.now();
+    try {
+        rebindNeedsProjectOnPrompt({
+            sessionId,
+            root: deps.workContextRoot,
+            hqRoot: eventText(sample, "hqRoot"),
+            cwd: eventText(sample, "cwd"),
+            companySlug: state.companySlug ?? eventText(sample, "companySlug"),
+            companyUid: state.companyUid,
+            hint: eventText(sample, "project"),
+            env: deps.env,
+            home: deps.home,
+            nowMs,
+            now: deps.now,
+        });
+    }
+    catch (err) {
+        deps.log?.(`work-mesh: session ${sessionId} project rebind failed: ${err instanceof Error ? err.message : "unknown"}`);
+    }
+    const elapsed = Date.now() - started;
+    if (elapsed > 300) {
+        deps.log?.(`work-mesh: session ${sessionId} project rebind took ${elapsed}ms`);
+    }
+    return readSessionState(sessionId, deps.workContextRoot) ?? state;
+}
 function classifySession(state) {
     if (!state) {
         return { action: "hold", heldReason: "STATE_ABSENT" };

package/dist/lib/mesh/live/session-seq.d.ts

@@ -0,0 +1,4 @@
+export declare function sessionSeqDir(env?: NodeJS.ProcessEnv): string;
+/** Reserve `count` consecutive seq numbers; returns the first one. */
+export declare function reserveSessionSeq(sessionId: string, count: number, env?: NodeJS.ProcessEnv): number;
+//# sourceMappingURL=session-seq.d.ts.map

package/dist/lib/mesh/live/session-seq.js

@@ -0,0 +1,33 @@
+/**
+ * Shared per-session event sequence, the same file the core hooks use
+ * (`~/.hq/work-mesh/seq/<sid>`, see core/scripts/lib/work-mesh-live-hook.sh).
+ * Every emitter for a session must take numbers from here, or the server
+ * treats the new events as duplicates of earlier ones and drops them.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export function sessionSeqDir(env = process.env) {
+    return env.WORK_MESH_SEQ_DIR?.trim() || path.join(os.homedir(), ".hq", "work-mesh", "seq");
+}
+/** Reserve `count` consecutive seq numbers; returns the first one. */
+export function reserveSessionSeq(sessionId, count, env = process.env) {
+    if (!/^[A-Za-z0-9._-]+$/.test(sessionId))
+        throw new Error("invalid session id");
+    const dir = sessionSeqDir(env);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = path.join(dir, sessionId);
+    let current = 0;
+    try {
+        const raw = fs.readFileSync(file, "utf8").trim();
+        if (/^\d+$/.test(raw))
+            current = Number(raw);
+    }
+    catch {
+        current = 0;
+    }
+    const first = current + 1;
+    fs.writeFileSync(file, `${current + Math.max(0, count)}\n`, { mode: 0o600 });
+    return first;
+}
+//# sourceMappingURL=session-seq.js.map