@indigoai-us/hq-cli 5.146.0 → 5.147.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.147.0] — 2026-09-23
+
+### Fixed
+
+- `hq mesh context prd-sync` now moves the Board. Its task_status events carry the session's company and project, and take sequence numbers from the session's shared counter (the same file the hooks use), so the server no longer rejects them as duplicates. Rejections print their codes.
+- The mesh daemon no longer treats a missing company slug, a membership timeout, or a lookup error as proof that the device owner is not a member. A device-default session that was cleared to `needs_company` is checked once against the configured default company and, when that membership is active, the company is put back and held events flush. The same cleared session is not counted as a new denial on every later flush.
+- `hq mesh project ensure` no longer fails when the server refuses to close the extra genesis thread; it leaves that thread open and prints one line. Registration and the calling session's binding complete.
+- The mesh daemon re-checks a `needs_project` or unresolved session when it flushes that session's events. If the project Board is now an exact or clear catalog match, the batch is posted with that project and the session file is bound. A tie or near miss stays `needs_project`. The check runs at most once a minute per session.
+
 ## [5.146.0] — 2026-09-23
 
 ### Fixed

package/dist/commands/mesh.js

@@ -5,6 +5,7 @@
  * require hq-pack-work-mesh on disk and does not start MQTT listen.
  * Distinct from `hq doctor` (hook guardrails).
  */
+import { resolve as resolvePath } from "node:path";
 import * as os from "node:os";
 import { readFileSync } from "node:fs";
 import { findHqRoot } from "../utils/manifest.js";
@@ -42,6 +43,7 @@ import { findLocalPrd, listNeedsProjectSessions } from "../lib/work-context/bind
 import { bindCallingSession, formatSessionBoundLine } from "../lib/work-context/bind-calling-session.js";
 import { rebindNeedsProjectOnPrompt } from "../lib/work-context/prompt-rebind.js";
 import { planPrdSync } from "../lib/work-context/prd-sync.js";
+import { reserveSessionSeq } from "../lib/mesh/live/session-seq.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "../lib/work-context/contract.js";
 import { loadObservationFromFile, markUntracked, parseObservationJson, reconcileObservation, } from "../lib/work-context/reconcile.js";
 import { resolveCompany } from "../lib/work-context/company.js";
@@ -565,6 +567,15 @@ async function runPrdSync(opts) {
         console.error("work-mesh: prd-sync has changes but no token; snapshot not advanced");
         return;
     }
+    // Attribution evidence: without company and project the server files these
+    // as unassigned and the Board never moves.
+    const bound = readSessionState(sessionId, root);
+    const evidenceBase = {
+        ...(bound?.companySlug ? { companySlug: bound.companySlug } : {}),
+        ...(bound?.projectId ? { project: bound.projectId } : {}),
+        touchedPaths: [resolvePath(file)],
+    };
+    const seqFirst = reserveSessionSeq(sessionId, plan.events.length);
     const events = plan.events.map((event, index) => buildMeshEmitEvent({
         eventId: generateUlid(Date.now() + index),
         kind: "task_status",
@@ -572,18 +583,24 @@ async function runPrdSync(opts) {
         harness: "hq-sessions",
         adapterVersion: "1.0.0",
         at: new Date().toISOString(),
-        seq: plan.seqStart + index + 1,
+        seq: seqFirst + index,
         source: "hooks",
         taskId: event.taskId,
         status: event.status,
         summary: event.status === "done" ? `${event.taskId} passes` : `${event.taskId} in progress`,
+        evidence: { ...evidenceBase, task: event.taskId },
     }));
     const poster = createEmitPoster({ token, baseUrl: resolveVaultApiBase(process.env) });
-    await emitEvents({
+    const emitted = await emitEvents({
         workMeshRoot: workMeshHomeRoot(),
         poster,
         newEvents: events,
     });
+    if (emitted.unassigned > 0 || emitted.rejected > 0) {
+        console.error(`work-mesh: prd-sync sent ${events.length}; unassigned=${emitted.unassigned} rejected=${emitted.rejected}`);
+        for (const line of formatEmitRejectionLines(emitted.rejections))
+            console.error(line);
+    }
     plan.commit();
     if (plan.taskId) {
         updateSessionState(sessionId, root, (current) => {

package/dist/lib/mesh/api.d.ts

@@ -78,7 +78,7 @@ export declare function listActiveMembershipCompanies(token: string): Promise<Me
  * Returns null when the caller is not an active member. Throws on transport /
  * auth failures so the caller can surface DEFAULT_COMPANY_UNAVAILABLE.
  */
-export declare function resolveActiveMembershipCompany(token: string, slug: string): Promise<MeshCompany | null>;
+export declare function resolveActiveMembershipCompany(token: string, slug: string, signal?: AbortSignal): Promise<MeshCompany | null>;
 export interface RequireTokenOptions {
     /**
      * False from detached or unattended callers (the lane watcher). A person

package/dist/lib/mesh/api.js

@@ -113,11 +113,15 @@ export async function listActiveMembershipCompanies(token) {
  * Returns null when the caller is not an active member. Throws on transport /
  * auth failures so the caller can surface DEFAULT_COMPANY_UNAVAILABLE.
  */
-export async function resolveActiveMembershipCompany(token, slug) {
+export async function resolveActiveMembershipCompany(token, slug, signal) {
     const trimmed = slug.trim();
     if (!trimmed)
         return null;
-    const payload = asRecord(await meshJson(token, "/membership/me"));
+    // An aborted lookup is not "not a member". Throw so callers defer.
+    if (signal?.aborted) {
+        throw new Error("membership lookup aborted");
+    }
+    const payload = asRecord(await meshJson(token, "/membership/me", { signal }));
     if (!payload || !Array.isArray(payload.memberships)) {
         throw new Error("Malformed membership response: expected memberships array");
     }

package/dist/lib/mesh/live/daemon/run.js

@@ -165,8 +165,20 @@ export async function runMeshDaemon(deps = {}) {
                 ? readSessionState(input.sessionId, ctxRoot)
                 : null);
             const slug = input.companySlug ?? state?.companySlug;
+            // A uid alone is enough to ask /membership/me. Missing slug is not a
+            // denial. A device-default session whose company was cleared can be
+            // checked against the configured default; that is the same company the
+            // daemon assigned before the false denial.
+            const configuredDefault = input.deviceDefault
+                ? readDeviceConfig({ root: ctxRoot }).defaultCompany
+                : undefined;
+            const defaultCompany = configuredDefault?.enabled ? configuredDefault : undefined;
+            const usingDefaultFallback = !slug && !state?.companyUid && Boolean(defaultCompany?.slug || defaultCompany?.uid);
+            const lookupKey = slug || state?.companyUid || (usingDefaultFallback
+                ? (defaultCompany?.slug || defaultCompany?.uid)
+                : undefined);
             let authorization;
-            if (!slug) {
+            if (!lookupKey) {
                 authorization = { status: "denied" };
             }
             else {
@@ -175,7 +187,14 @@ export async function runMeshDaemon(deps = {}) {
                 try {
                     authorization = await Promise.race([
                         (async () => {
-                            const membership = await resolveMembership(await getToken(), slug, controller.signal);
+                            const membership = await resolveMembership(await getToken(), lookupKey, controller.signal);
+                            // Timeout wins even if the probe then returns null.
+                            if (controller.signal.aborted) {
+                                return {
+                                    status: "unavailable",
+                                    error: `membership lookup timed out after ${DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS}ms`,
+                                };
+                            }
                             if (membership)
                                 return { status: "authorized", uid: membership.companyUid };
                             // A machine token often cannot read /membership/me (401/403, or an
@@ -221,8 +240,43 @@ export async function runMeshDaemon(deps = {}) {
             if (authorization.status === "authorized" &&
                 (!input.companyUid || input.companyUid === authorization.uid) &&
                 (!state?.companyUid || state.companyUid === authorization.uid)) {
+                // A prior false denial cleared the company and left needs_company.
+                // Membership just confirmed the company, so put it back and let flush post.
+                if (state &&
+                    state.companyConfidence === "device_default" &&
+                    state.contextStatus === "needs_company") {
+                    const restoredSlug = state.companySlug || slug || defaultCompany?.slug;
+                    const restoredUid = authorization.uid;
+                    updateSessionState(state.sessionId, ctxRoot, (current) => {
+                        if (!current || current.contextStatus !== "needs_company")
+                            return null;
+                        if (current.companyUid && current.companyUid !== restoredUid)
+                            return null;
+                        if (current.companySlug &&
+                            restoredSlug &&
+                            !sameCompanyValue(current.companySlug, restoredSlug)) {
+                            return null;
+                        }
+                        return mergeLocalSessionFields({
+                            ...current,
+                            companyUid: restoredUid,
+                            ...(restoredSlug ? { companySlug: restoredSlug } : {}),
+                            contextStatus: current.projectId
+                                ? (current.taskId ? "bound" : "needs_task")
+                                : "needs_project",
+                            updatedAt: now().toISOString(),
+                        }, current, { preserveCompanyBinding: false });
+                    });
+                }
                 return authorization;
             }
+            // Already stripped. Do not revoke, count, or log this again on every flush.
+            if (state &&
+                state.contextStatus === "needs_company" &&
+                !state.companyUid &&
+                !state.companySlug) {
+                return { status: "denied" };
+            }
             try {
                 invalidateDefaultCompanyMemberships({ root: ctxRoot, now });
             }

package/dist/lib/mesh/live/flush.d.ts

@@ -16,6 +16,11 @@ export declare const HELD_TTL_MS: number;
 export declare const HELD_RETRY_INTERVAL_MS: number;
 /** Cap held.jsonl size; oldest overflow is dead-lettered with HELD_OVERFLOW. */
 export declare const HELD_MAX_LINES = 20000;
+/**
+ * Re-check an unbound session against the project catalog at most this often.
+ * The catalog itself is also cached inside bind-best.
+ */
+export declare const PROJECT_REBIND_INTERVAL_MS = 60000;
 export type HeldReason = "STATE_ABSENT" | "NEEDS_COMPANY" | "COMPANY_CONFLICT" | "NEEDS_PROJECT" | "HELD_EXPIRED" | "HELD_OVERFLOW";
 export interface HeldLineRecord {
     /** Original spool event fields. */
@@ -46,6 +51,9 @@ export interface FlushDeps {
     log?: (message: string) => void;
     /** Authoritative gate for state derived from a device default. */
     authorizeDeviceDefaultTenant?: (state: SessionStateFile) => Promise<boolean>;
+    /** Passed through to bind-best (catalog cache root and HQ_WORK_MESH_CACHE). */
+    env?: NodeJS.ProcessEnv;
+    home?: string;
 }
 export interface FlushSummary {
     claimed: number;

package/dist/lib/mesh/live/flush.js

@@ -12,6 +12,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { resolveCompany } from "../../work-context/company.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
+import { rebindNeedsProjectOnPrompt } from "../../work-context/prompt-rebind.js";
 import { readSessionState, updateSessionState } from "../../work-context/state.js";
 import { repairAckedRegisterStates } from "../../work-context/outbox.js";
 import { workContextRoot } from "../../work-context/paths.js";
@@ -25,6 +26,12 @@ export const HELD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export const HELD_RETRY_INTERVAL_MS = 5 * 60 * 1000;
 /** Cap held.jsonl size; oldest overflow is dead-lettered with HELD_OVERFLOW. */
 export const HELD_MAX_LINES = 20_000;
+/**
+ * Re-check an unbound session against the project catalog at most this often.
+ * The catalog itself is also cached inside bind-best.
+ */
+export const PROJECT_REBIND_INTERVAL_MS = 60_000;
+const lastProjectRebindAtMs = new Map();
 function parseLine(line) {
     try {
         const v = JSON.parse(line);
@@ -224,18 +231,25 @@ export async function flushSessionEvents(deps) {
         };
         const loggedProject404 = new Set();
         for (const [sessionId, items] of bySession) {
-            const state = readSessionState(sessionId, deps.workContextRoot);
+            let state = readSessionState(sessionId, deps.workContextRoot);
             if (state?.companyConfidence === "device_default" &&
-                deps.authorizeDeviceDefaultTenant &&
-                !(await deps.authorizeDeviceDefaultTenant(state))) {
-                const heldAt = now().toISOString();
-                for (const item of items) {
-                    appendHeldLine(heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? heldAt), deps.workMeshRoot);
-                    summary.held += 1;
-                    markDisposed(item.event);
+                deps.authorizeDeviceDefaultTenant) {
+                const allowed = await deps.authorizeDeviceDefaultTenant(state);
+                // Authorization may restore a company the gate previously cleared.
+                state = readSessionState(sessionId, deps.workContextRoot) ?? state;
+                if (!allowed) {
+                    const heldAt = now().toISOString();
+                    for (const item of items) {
+                        appendHeldLine(heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? heldAt), deps.workMeshRoot);
+                        summary.held += 1;
+                        markDisposed(item.event);
+                    }
+                    continue;
                 }
-                continue;
             }
+            // After the company gate (which may restore a cleared company), try to
+            // bind a needs_project session to an existing Board before classifying.
+            state = rebindUnboundSession(sessionId, items, state, deps, nowMs);
             const decision = classifySession(state);
             if (decision.action === "drop") {
                 appendDroppedReceipt({
@@ -502,6 +516,54 @@ function canonicalizeForRestore(event) {
     }
     return out;
 }
+function eventText(event, key) {
+    const value = event[key];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+/**
+ * Before a needs_project (or unresolved-with-company) batch is classified,
+ * run the prompt-submit bind-best refinement. A bind updates the session
+ * file so the batch posts with that projectId. Ties stay unbound. At most
+ * one attempt per session per minute; failures stay on the existing state.
+ */
+function rebindUnboundSession(sessionId, items, state, deps, nowMs) {
+    if (!state?.companyUid)
+        return state;
+    if (state.contextStatus !== "needs_project" && state.contextStatus !== "unresolved") {
+        return state;
+    }
+    const key = `${deps.workContextRoot}\0${sessionId}`;
+    const previous = lastProjectRebindAtMs.get(key);
+    if (previous !== undefined && nowMs - previous < PROJECT_REBIND_INTERVAL_MS) {
+        return state;
+    }
+    lastProjectRebindAtMs.set(key, nowMs);
+    const sample = items[0]?.event ?? {};
+    const started = Date.now();
+    try {
+        rebindNeedsProjectOnPrompt({
+            sessionId,
+            root: deps.workContextRoot,
+            hqRoot: eventText(sample, "hqRoot"),
+            cwd: eventText(sample, "cwd"),
+            companySlug: state.companySlug ?? eventText(sample, "companySlug"),
+            companyUid: state.companyUid,
+            hint: eventText(sample, "project"),
+            env: deps.env,
+            home: deps.home,
+            nowMs,
+            now: deps.now,
+        });
+    }
+    catch (err) {
+        deps.log?.(`work-mesh: session ${sessionId} project rebind failed: ${err instanceof Error ? err.message : "unknown"}`);
+    }
+    const elapsed = Date.now() - started;
+    if (elapsed > 300) {
+        deps.log?.(`work-mesh: session ${sessionId} project rebind took ${elapsed}ms`);
+    }
+    return readSessionState(sessionId, deps.workContextRoot) ?? state;
+}
 function classifySession(state) {
     if (!state) {
         return { action: "hold", heldReason: "STATE_ABSENT" };

package/dist/lib/mesh/live/session-seq.d.ts

@@ -0,0 +1,4 @@
+export declare function sessionSeqDir(env?: NodeJS.ProcessEnv): string;
+/** Reserve `count` consecutive seq numbers; returns the first one. */
+export declare function reserveSessionSeq(sessionId: string, count: number, env?: NodeJS.ProcessEnv): number;
+//# sourceMappingURL=session-seq.d.ts.map

package/dist/lib/mesh/live/session-seq.js

@@ -0,0 +1,33 @@
+/**
+ * Shared per-session event sequence, the same file the core hooks use
+ * (`~/.hq/work-mesh/seq/<sid>`, see core/scripts/lib/work-mesh-live-hook.sh).
+ * Every emitter for a session must take numbers from here, or the server
+ * treats the new events as duplicates of earlier ones and drops them.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export function sessionSeqDir(env = process.env) {
+    return env.WORK_MESH_SEQ_DIR?.trim() || path.join(os.homedir(), ".hq", "work-mesh", "seq");
+}
+/** Reserve `count` consecutive seq numbers; returns the first one. */
+export function reserveSessionSeq(sessionId, count, env = process.env) {
+    if (!/^[A-Za-z0-9._-]+$/.test(sessionId))
+        throw new Error("invalid session id");
+    const dir = sessionSeqDir(env);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = path.join(dir, sessionId);
+    let current = 0;
+    try {
+        const raw = fs.readFileSync(file, "utf8").trim();
+        if (/^\d+$/.test(raw))
+            current = Number(raw);
+    }
+    catch {
+        current = 0;
+    }
+    const first = current + 1;
+    fs.writeFileSync(file, `${current + Math.max(0, count)}\n`, { mode: 0o600 });
+    return first;
+}
+//# sourceMappingURL=session-seq.js.map

package/dist/lib/mesh/project-board.js

@@ -11,9 +11,17 @@ export async function closeSupersededProjectThread(input) {
         return;
     if (!input.openedThreadId || input.openedThreadId === input.canonicalThreadId)
         return;
-    await appendThreadEvent(input.token, input.companyUid, input.openedThreadId, "done", {
-        summary: "Superseded by the registered project thread.",
-    });
+    try {
+        await appendThreadEvent(input.token, input.companyUid, input.openedThreadId, "done", {
+            summary: "Superseded by the registered project thread.",
+        });
+    }
+    catch (err) {
+        // Best effort: the server may refuse (e.g. only the thread owner may mark
+        // it done). A leftover open thread must never fail registration.
+        const reason = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`Work mesh: left extra thread ${input.openedThreadId} open (${reason.slice(0, 120)})\n`);
+    }
 }
 /**
  * Create a missing Board. Register returns 403 PROJECT_NOT_IN_COMPANY until

package/dist/lib/work-context/prompt-rebind.d.ts

@@ -1,6 +1,7 @@
 /**
- * US-040: UserPromptSubmit re-runs bind-best for a session still in
- * needs_project. Catalog reads are cached. Failures stay local.
+ * US-040: re-run bind-best for a session still in needs_project, or
+ * unresolved once it has a company. The prompt hook and the mesh daemon
+ * flush both call this. Catalog reads are cached. Failures stay local.
  */
 export type PromptRebindResult = {
     action: "bound" | "skipped" | "unchanged";
@@ -14,7 +15,10 @@ export declare function rebindNeedsProjectOnPrompt(input: {
     cwd?: string;
     companySlug?: string;
     companyUid?: string;
+    /** Used when the session has no projectHint (for example a spool `project` field). */
+    hint?: string;
     env?: NodeJS.ProcessEnv;
+    home?: string;
     nowMs?: number;
     now?: () => Date;
 }): PromptRebindResult;

package/dist/lib/work-context/prompt-rebind.js

@@ -1,6 +1,7 @@
 /**
- * US-040: UserPromptSubmit re-runs bind-best for a session still in
- * needs_project. Catalog reads are cached. Failures stay local.
+ * US-040: re-run bind-best for a session still in needs_project, or
+ * unresolved once it has a company. The prompt hook and the mesh daemon
+ * flush both call this. Catalog reads are cached. Failures stay local.
  */
 import { projectIdFromCwd } from "./company.js";
 import { readMetaProjectTask } from "./project.js";
@@ -17,13 +18,17 @@ export function rebindNeedsProjectOnPrompt(input) {
     }
     if (!state)
         return { action: "skipped", reason: "no_state" };
-    if (state.contextStatus !== "needs_project") {
+    const companyUid = input.companyUid ?? state.companyUid;
+    const retryable = state.contextStatus === "needs_project" ||
+        (state.contextStatus === "unresolved" && Boolean(companyUid));
+    if (!retryable) {
         return { action: "skipped", reason: "not_needs_project" };
     }
     if (state.projectId)
         return { action: "skipped", reason: "different_project" };
     const env = input.env ?? process.env;
     const hint = state.projectHint?.trim() ||
+        input.hint?.trim() ||
         env.HQ_SPAWN_PROJECT?.trim() ||
         readMetaProjectTask(input.sessionId, input.hqRoot).projectId ||
         projectIdFromCwd(input.cwd, input.hqRoot) ||
@@ -36,9 +41,10 @@ export function rebindNeedsProjectOnPrompt(input) {
             hint,
             hqRoot: input.hqRoot,
             companySlug: input.companySlug ?? state.companySlug,
-            companyUid: input.companyUid ?? state.companyUid,
+            companyUid,
             repoPath: input.cwd,
             env,
+            home: input.home,
             nowMs: input.nowMs ?? Date.now(),
         });
     }
@@ -52,7 +58,10 @@ export function rebindNeedsProjectOnPrompt(input) {
     const reason = refined.reason;
     const nowIso = (input.now ?? (() => new Date()))().toISOString();
     const updated = updateSessionState(input.sessionId, input.root, (current) => {
-        if (!current || current.contextStatus !== "needs_project")
+        if (!current || (current.contextStatus !== "needs_project" && current.contextStatus !== "unresolved")) {
+            return current;
+        }
+        if (current.contextStatus === "unresolved" && !current.companyUid)
             return current;
         if (current.projectId && current.projectId !== projectId)
             return current;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.146.0",
+  "version": "5.147.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {