@indigoai-us/hq-cli 5.146.0 → 5.148.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [5.148.0] — 2026-09-23
+
+## [5.147.0] — 2026-09-23
+
+### Fixed
+
+- Reinstalling an MCP server now updates its definition when the existing
+  Claude or Codex entry belongs to the same HQ pack. Unmarked and other-pack
+  entries still refuse replacement.
+- `hq mesh context prd-sync` now moves the Board. Its task_status events carry the session's company and project, and take sequence numbers from the session's shared counter (the same file the hooks use), so the server no longer rejects them as duplicates. Rejections print their codes.
+- The mesh daemon no longer treats a missing company slug, a membership timeout, or a lookup error as proof that the device owner is not a member. A device-default session that was cleared to `needs_company` is checked once against the configured default company and, when that membership is active, the company is put back and held events flush. The same cleared session is not counted as a new denial on every later flush.
+- `hq mesh project ensure` no longer fails when the server refuses to close the extra genesis thread; it leaves that thread open and prints one line. Registration and the calling session's binding complete.
+- The mesh daemon re-checks a `needs_project` or unresolved session when it flushes that session's events. If the project Board is now an exact or clear catalog match, the batch is posted with that project and the session file is bound. A tie or near miss stays `needs_project`. The check runs at most once a minute per session.
+
 ## [5.146.0] — 2026-09-23
 
 ### Fixed

package/dist/commands/mcp-registration.d.ts

@@ -74,6 +74,15 @@ export declare class ConfigParseError extends McpRegistrationError {
 export declare class ConfigPermissionError extends McpRegistrationError {
     readonly code: "ConfigPermissionError";
 }
+export type CodexMcpCollisionOwner = 'hq' | 'foreign' | 'unknown';
+export type CodexMcpCollisionField = 'command' | 'args' | 'env' | 'url' | 'other';
+/** Safe, value-free context for a Codex name collision reported to Sentry. */
+export interface CodexMcpCollisionDiagnostics {
+    client: 'codex';
+    serverName: string;
+    existingEntryOwner: CodexMcpCollisionOwner;
+    diffFields: CodexMcpCollisionField[];
+}
 /**
  * A server name is already present in the target config with a DIFFERENT
  * definition than the one being merged (def-equal = idempotent no-op;
@@ -82,6 +91,8 @@ export declare class ConfigPermissionError extends McpRegistrationError {
  */
 export declare class McpNameCollisionError extends McpRegistrationError {
     readonly code: "McpNameCollisionError";
+    readonly codexDiagnostics?: CodexMcpCollisionDiagnostics;
+    constructor(message: string, codexDiagnostics?: CodexMcpCollisionDiagnostics);
 }
 /**
  * The Codex runtime is absent (`~/.codex` missing). This is a FIRST-CLASS SKIP,
@@ -494,7 +505,8 @@ export declare function serverDefsEqual(a: unknown, b: unknown): boolean;
  *     it — but byte-equality of the rest means {@link writeConfigAtomic} writes
  *     nothing unless the stamp itself is the only delta, which we treat as a no-op
  *     by returning the original doc.
- *   - name PRESENT, def-DIFFERS -> {@link McpNameCollisionError} ABORT.
+ *   - name PRESENT, def-DIFFERS, same non-empty `_hqPack` -> replace the entry.
+ *   - name PRESENT, def-DIFFERS, unmarked or different owner -> collision ABORT.
  *
  * Never touches any OTHER server entry or any other top-level key.
  */
@@ -646,8 +658,8 @@ type TomlTable = Record<string, unknown>;
  * The Codex doc threaded through the safe-write core. We carry BOTH the parsed
  * value (`value`, for the merge fn + verify) AND the ORIGINAL file text
  * (`originalText`, `null` for a fresh/empty file). {@link codexConfigFormat.serialize}
- * uses `originalText` to APPEND the one new table without re-serializing — and so
- * without dropping — the user's existing comments and tables. This is the seam that
+ * uses `originalText` to APPEND a new table or replace sections of a same-pack
+ * owned table without re-serializing unrelated content. This is the seam that
  * makes "preserves comments" honest within a value-only TOML library.
  */
 export interface CodexTomlDoc {
@@ -661,7 +673,7 @@ export declare const CODEX_MCP_SERVERS_KEY = "mcp_servers";
 /**
  * Serialize EXACTLY ONE server table (`[mcp_servers.<name>]` + its sub-tables)
  * by wrapping the def under `mcp_servers.<name>` and round-tripping it through
- * smol-toml. Used both for the append path (preserve-comments) and for the
+ * smol-toml. Used for appending new servers, replacing an owned table, and the
  * collision/equality comparison. The output is deterministic for a given def so a
  * re-install produces byte-identical text (idempotency depends on it).
  */
@@ -670,15 +682,15 @@ export declare function serializeOneCodexServer(name: string, def: TomlTable): s
  * The Codex `ConfigFormat`. `parse` round-trips the file through smol-toml
  * (throwing `TomlError` on malformed NON-empty input → the substrate maps it to
  * {@link ConfigParseError}, FAIL-CLOSED). `serialize` is comment-preserving: when
- * the doc carries `originalText` (the file pre-existed) it APPENDS the new
- * `mcp_servers.<name>` table to the original bytes rather than re-serializing the
- * whole value; only when there is no original (`null`) does it serialize the full
- * value from scratch. `assertEntry` checks `mcp_servers.<name>` is present.
- *
- * Because `serialize` needs the merged value to know WHICH server to append, the
- * merge fn ({@link mergeCodexServer}) records the just-added server on the doc; the
- * append path reads it back. For an idempotent no-op (server already present,
- * def-equal) the merge returns the doc UNCHANGED with no pending append, so
+ * the doc carries `originalText` (the file pre-existed) it APPENDS a new server
+ * table or replaces only a same-pack owned table, rather than re-serializing the
+ * whole value. Only a fresh file (`null`) is serialized from scratch.
+ * `assertEntry` checks `mcp_servers.<name>` is present.
+ *
+ * Because `serialize` needs to know WHICH server to append or replace, the merge
+ * fn ({@link mergeCodexServer}) records the operation on the doc. For an
+ * idempotent no-op (server already present, def-equal) the merge returns the doc
+ * UNCHANGED, so
  * `serialize` reproduces the original text exactly (no write happens).
  */
 export declare const codexConfigFormat: ConfigFormat<CodexTomlDoc>;
@@ -716,9 +728,10 @@ export declare function buildCodexToolsTable(tools: McpManifest['tools']): TomlT
  *   - name PRESENT, def-equal (provenance-ignored) → NO-OP (idempotent re-install /
  *     PARTIAL self-heal): return the doc UNCHANGED with no pending append, so the
  *     original text round-trips byte-for-byte.
- *   - name PRESENT, def-DIFFERS → {@link McpNameCollisionError} ABORT (never mutate
- *     an existing table — which is also what keeps the comment-preserving append
- *     sound: we only ever ADD).
+ *   - name PRESENT, def-DIFFERS, same `_hqPack` owner → update that owned table
+ *     while preserving unrelated TOML bytes and comments.
+ *   - name PRESENT, def-DIFFERS, any other owner → {@link McpNameCollisionError}
+ *     ABORT with value-free diagnostics.
  *
  * Never touches any OTHER server table or any other top-level table.
  */

package/dist/commands/mcp-registration.js

@@ -99,6 +99,11 @@ export class ConfigPermissionError extends McpRegistrationError {
  */
 export class McpNameCollisionError extends McpRegistrationError {
     code = 'McpNameCollisionError';
+    codexDiagnostics;
+    constructor(message, codexDiagnostics) {
+        super(message);
+        this.codexDiagnostics = codexDiagnostics;
+    }
 }
 /**
  * The Codex runtime is absent (`~/.codex` missing). This is a FIRST-CLASS SKIP,
@@ -1009,7 +1014,8 @@ function canonicalJson(v) {
  *     it — but byte-equality of the rest means {@link writeConfigAtomic} writes
  *     nothing unless the stamp itself is the only delta, which we treat as a no-op
  *     by returning the original doc.
- *   - name PRESENT, def-DIFFERS -> {@link McpNameCollisionError} ABORT.
+ *   - name PRESENT, def-DIFFERS, same non-empty `_hqPack` -> replace the entry.
+ *   - name PRESENT, def-DIFFERS, unmarked or different owner -> collision ABORT.
  *
  * Never touches any OTHER server entry or any other top-level key.
  */
@@ -1023,6 +1029,12 @@ export function mergeClaudeServer(name, def) {
                 // (do not re-stamp) so a re-install is a true byte-for-byte no-op.
                 return doc;
             }
+            const existingPack = provenanceOf(existing);
+            const incomingPack = provenanceOf(def);
+            if (existingPack && existingPack === incomingPack) {
+                servers[name] = def;
+                return { ...doc, mcpServers: servers };
+            }
             throw new McpNameCollisionError(`MCP server "${name}" is already defined in ~/.claude.json with a different ` +
                 'definition — refusing to overwrite. Remove or rename the existing server, ' +
                 'or uninstall the conflicting pack, then re-install.');
@@ -1302,7 +1314,7 @@ export const CODEX_MCP_SERVERS_KEY = 'mcp_servers';
 /**
  * Serialize EXACTLY ONE server table (`[mcp_servers.<name>]` + its sub-tables)
  * by wrapping the def under `mcp_servers.<name>` and round-tripping it through
- * smol-toml. Used both for the append path (preserve-comments) and for the
+ * smol-toml. Used for appending new servers, replacing an owned table, and the
  * collision/equality comparison. The output is deterministic for a given def so a
  * re-install produces byte-identical text (idempotency depends on it).
  */
@@ -1313,15 +1325,15 @@ export function serializeOneCodexServer(name, def) {
  * The Codex `ConfigFormat`. `parse` round-trips the file through smol-toml
  * (throwing `TomlError` on malformed NON-empty input → the substrate maps it to
  * {@link ConfigParseError}, FAIL-CLOSED). `serialize` is comment-preserving: when
- * the doc carries `originalText` (the file pre-existed) it APPENDS the new
- * `mcp_servers.<name>` table to the original bytes rather than re-serializing the
- * whole value; only when there is no original (`null`) does it serialize the full
- * value from scratch. `assertEntry` checks `mcp_servers.<name>` is present.
+ * the doc carries `originalText` (the file pre-existed) it APPENDS a new server
+ * table or replaces only a same-pack owned table, rather than re-serializing the
+ * whole value. Only a fresh file (`null`) is serialized from scratch.
+ * `assertEntry` checks `mcp_servers.<name>` is present.
  *
- * Because `serialize` needs the merged value to know WHICH server to append, the
- * merge fn ({@link mergeCodexServer}) records the just-added server on the doc; the
- * append path reads it back. For an idempotent no-op (server already present,
- * def-equal) the merge returns the doc UNCHANGED with no pending append, so
+ * Because `serialize` needs to know WHICH server to append or replace, the merge
+ * fn ({@link mergeCodexServer}) records the operation on the doc. For an
+ * idempotent no-op (server already present, def-equal) the merge returns the doc
+ * UNCHANGED, so
  * `serialize` reproduces the original text exactly (no write happens).
  */
 export const codexConfigFormat = {
@@ -1332,7 +1344,16 @@ export const codexConfigFormat = {
         return { value, originalText: text };
     },
     serialize(doc) {
-        const pending = doc[PENDING_APPEND];
+        const pendingDoc = doc;
+        const pendingUpdate = pendingDoc[PENDING_UPDATE];
+        if (doc.originalText !== null && pendingUpdate) {
+            const updated = replaceCodexTable(doc.originalText, pendingUpdate.name, pendingUpdate.def);
+            if (updated === null) {
+                throw new McpNameCollisionError(codexCollisionMessage(pendingUpdate.name), pendingUpdate.diagnostics);
+            }
+            return updated;
+        }
+        const pending = pendingDoc[PENDING_APPEND];
         if (doc.originalText !== null && pending) {
             // APPEND path: keep the original bytes verbatim (comments + every existing
             // table/sub-table preserved), then append the one new server table.
@@ -1362,6 +1383,7 @@ export const codexConfigFormat = {
 };
 /** Symbol carrying the pending append on a {@link CodexTomlDoc} (merge → serialize). */
 const PENDING_APPEND = Symbol('hqPendingCodexAppend');
+const PENDING_UPDATE = Symbol('hqPendingCodexUpdate');
 /** Return a copy of `value` with `mcp_servers.<name> = def` set (used for fresh-file serialize). */
 function withServer(value, name, def) {
     const servers = { ...(value[CODEX_MCP_SERVERS_KEY] ?? {}) };
@@ -1384,6 +1406,171 @@ export function appendCodexTable(originalText, name, def) {
     const body = block.endsWith('\n') ? block : `${block}\n`;
     return `${trimmed}\n\n${body}`;
 }
+/** Return the decoded table path for a valid TOML table header, or null. */
+function codexTablePath(headerLine) {
+    try {
+        const value = parseToml(headerLine);
+        const matches = [];
+        const visit = (current, pathParts) => {
+            if (current === null || typeof current !== 'object')
+                return;
+            if (Array.isArray(current)) {
+                current.forEach((item, index) => visit(item, [...pathParts, String(index)]));
+                return;
+            }
+            const table = current;
+            const entries = Object.entries(table);
+            if (entries.length === 0) {
+                matches.push(pathParts);
+                return;
+            }
+            for (const [key, child] of entries) {
+                visit(child, [...pathParts, key]);
+            }
+        };
+        visit(value, []);
+        return matches.length === 1 ? matches[0] : null;
+    }
+    catch {
+        // The caller has already parsed the whole document. Ordinary values are
+        // not table headers.
+        return null;
+    }
+}
+/**
+ * Locate real table headers without mistaking bracket-like text in TOML values
+ * for a header. Parsing the preceding prefix ensures a candidate is not inside
+ * an unfinished multiline string or array; smol-toml decodes quoted key paths.
+ */
+function codexTomlSections(text) {
+    const headers = [];
+    let offset = 0;
+    for (const line of text.match(/[^\n]*(?:\n|$)/g) ?? []) {
+        if (line.length === 0)
+            continue;
+        const content = line.replace(/\r?\n$/, '');
+        if (content.trimStart().startsWith('[')) {
+            try {
+                parseToml(text.slice(0, offset));
+                const path = codexTablePath(content);
+                if (path)
+                    headers.push({ start: offset, path });
+            }
+            catch {
+                // The prefix is incomplete TOML, so this bracket is part of a value.
+            }
+        }
+        offset += line.length;
+    }
+    return headers.map((header, index) => {
+        const nextStart = headers[index + 1]?.start ?? text.length;
+        let end = nextStart;
+        const trailingLines = text.slice(header.start, nextStart).match(/[^\n]*(?:\n|$)/g) ?? [];
+        for (let lineIndex = trailingLines.length - 1; lineIndex >= 0; lineIndex -= 1) {
+            const content = trailingLines[lineIndex].replace(/\r?\n$/, '');
+            if (content.trim() === '' || content.trimStart().startsWith('#')) {
+                end -= trailingLines[lineIndex].length;
+            }
+            else {
+                break;
+            }
+        }
+        return { ...header, end };
+    });
+}
+/** Extract comment text outside TOML strings so updating an owned table drops no user notes. */
+function codexTomlComments(text) {
+    const comments = [];
+    let multiline = null;
+    let lineOffset = 0;
+    for (const lineWithEnding of text.match(/[^\n]*(?:\n|$)/g) ?? []) {
+        if (lineWithEnding.length === 0)
+            continue;
+        const line = lineWithEnding.replace(/\r?\n$/, '');
+        let quote = null;
+        let index = 0;
+        while (index < line.length) {
+            if (multiline) {
+                const delimiter = multiline === 'basic' ? '"""' : "'''";
+                if (multiline === 'basic' && line[index] === '\\') {
+                    index += 2;
+                }
+                else if (line.startsWith(delimiter, index)) {
+                    multiline = null;
+                    index += 3;
+                }
+                else {
+                    index += 1;
+                }
+                continue;
+            }
+            if (quote) {
+                const closing = quote === 'basic' ? '"' : "'";
+                if (quote === 'basic' && line[index] === '\\') {
+                    index += 2;
+                }
+                else if (line[index] === closing) {
+                    quote = null;
+                    index += 1;
+                }
+                else {
+                    index += 1;
+                }
+                continue;
+            }
+            if (line[index] === '#') {
+                comments.push({ offset: lineOffset + index, text: line.slice(index) });
+                break;
+            }
+            if (line.startsWith('"""', index)) {
+                multiline = 'basic';
+                index += 3;
+            }
+            else if (line.startsWith("'''", index)) {
+                multiline = 'literal';
+                index += 3;
+            }
+            else if (line[index] === '"') {
+                quote = 'basic';
+                index += 1;
+            }
+            else if (line[index] === "'") {
+                quote = 'literal';
+                index += 1;
+            }
+            else {
+                index += 1;
+            }
+        }
+        lineOffset += lineWithEnding.length;
+    }
+    return comments;
+}
+/** Replace all sections for one same-pack server while retaining unrelated bytes and comments. */
+function replaceCodexTable(originalText, name, def) {
+    const sections = codexTomlSections(originalText);
+    const target = sections.filter((section) => section.path[0] === CODEX_MCP_SERVERS_KEY && section.path[1] === name);
+    if (!target.some((section) => section.path.length === 2))
+        return null;
+    const newline = originalText.includes('\r\n') ? '\r\n' : '\n';
+    const comments = codexTomlComments(originalText)
+        .filter((comment) => target.some((section) => comment.offset >= section.start && comment.offset < section.end))
+        .map((comment) => comment.text);
+    let output = '';
+    let cursor = 0;
+    let inserted = false;
+    for (const section of target) {
+        output += originalText.slice(cursor, section.start);
+        if (!inserted) {
+            output += serializeOneCodexServer(name, def).replace(/\n/g, newline);
+            if (comments.length > 0)
+                output += comments.join(newline) + newline;
+            inserted = true;
+        }
+        cursor = section.end;
+    }
+    return inserted ? output + originalText.slice(cursor) : null;
+}
 /**
  * Build the Codex server table emitted as `[mcp_servers.<name>]`: pass the
  * transport fields through, resolve `${secret:}` in every argument/header/env value
@@ -1447,9 +1634,10 @@ export function buildCodexToolsTable(tools) {
  *   - name PRESENT, def-equal (provenance-ignored) → NO-OP (idempotent re-install /
  *     PARTIAL self-heal): return the doc UNCHANGED with no pending append, so the
  *     original text round-trips byte-for-byte.
- *   - name PRESENT, def-DIFFERS → {@link McpNameCollisionError} ABORT (never mutate
- *     an existing table — which is also what keeps the comment-preserving append
- *     sound: we only ever ADD).
+ *   - name PRESENT, def-DIFFERS, same `_hqPack` owner → update that owned table
+ *     while preserving unrelated TOML bytes and comments.
+ *   - name PRESENT, def-DIFFERS, any other owner → {@link McpNameCollisionError}
+ *     ABORT with value-free diagnostics.
  *
  * Never touches any OTHER server table or any other top-level table.
  */
@@ -1463,9 +1651,23 @@ export function mergeCodexServer(name, def) {
                 // so serialize reproduces the original text exactly.
                 return doc;
             }
-            throw new McpNameCollisionError(`MCP server "${name}" is already defined in ~/.codex/config.toml with a different ` +
-                'definition — refusing to overwrite. Remove or rename the existing server, ' +
-                'or uninstall the conflicting pack, then re-install.');
+            const diagnostics = codexCollisionDiagnostics(name, existing, def);
+            const existingPack = isTomlTable(existing)
+                ? existing[HQ_PACK_PROVENANCE_KEY]
+                : undefined;
+            if (doc.originalText !== null &&
+                isTomlTable(existing) &&
+                typeof existingPack === 'string' &&
+                existingPack.length > 0 &&
+                existingPack === def[HQ_PACK_PROVENANCE_KEY]) {
+                const next = {
+                    value: withServer(doc.value, name, def),
+                    originalText: doc.originalText,
+                    [PENDING_UPDATE]: { name, def, diagnostics },
+                };
+                return next;
+            }
+            throw new McpNameCollisionError(codexCollisionMessage(name), diagnostics);
         }
         // Insert into the value (for verify-after-write) AND record the pending append
         // (for comment-preserving serialize).
@@ -1478,6 +1680,41 @@ export function mergeCodexServer(name, def) {
         return next;
     };
 }
+function isTomlTable(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function codexCollisionMessage(name) {
+    return `MCP server "${name}" is already defined in ~/.codex/config.toml with a different ` +
+        'definition — refusing to overwrite. Remove or rename the existing server, ' +
+        'or uninstall the conflicting pack, then re-install.';
+}
+function codexCollisionDiagnostics(name, existing, incoming) {
+    const existingTable = isTomlTable(existing) ? existing : {};
+    const owner = typeof existingTable[HQ_PACK_PROVENANCE_KEY] === 'string' &&
+        existingTable[HQ_PACK_PROVENANCE_KEY].length > 0
+        ? 'hq'
+        : 'unknown';
+    const keys = new Set([...Object.keys(existingTable), ...Object.keys(incoming)]);
+    keys.delete(HQ_PACK_PROVENANCE_KEY);
+    const fields = new Set();
+    for (const key of keys) {
+        const existingHasKey = Object.prototype.hasOwnProperty.call(existingTable, key);
+        const incomingHasKey = Object.prototype.hasOwnProperty.call(incoming, key);
+        if (existingHasKey === incomingHasKey &&
+            canonicalJson(existingTable[key]) === canonicalJson(incoming[key])) {
+            continue;
+        }
+        fields.add(key === 'command' || key === 'args' || key === 'env' || key === 'url'
+            ? key
+            : 'other');
+    }
+    return {
+        client: 'codex',
+        serverName: name,
+        existingEntryOwner: owner,
+        diffFields: [...fields].sort(),
+    };
+}
 /**
  * Emit ONE server into the GLOBAL Codex surface (`~/.codex/config.toml`
  * `[mcp_servers.<name>]`) via {@link writeConfigAtomic}. A FIRST-CLASS SKIP when the

package/dist/commands/mesh.js

@@ -5,6 +5,7 @@
  * require hq-pack-work-mesh on disk and does not start MQTT listen.
  * Distinct from `hq doctor` (hook guardrails).
  */
+import { resolve as resolvePath } from "node:path";
 import * as os from "node:os";
 import { readFileSync } from "node:fs";
 import { findHqRoot } from "../utils/manifest.js";
@@ -42,6 +43,7 @@ import { findLocalPrd, listNeedsProjectSessions } from "../lib/work-context/bind
 import { bindCallingSession, formatSessionBoundLine } from "../lib/work-context/bind-calling-session.js";
 import { rebindNeedsProjectOnPrompt } from "../lib/work-context/prompt-rebind.js";
 import { planPrdSync } from "../lib/work-context/prd-sync.js";
+import { reserveSessionSeq } from "../lib/mesh/live/session-seq.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "../lib/work-context/contract.js";
 import { loadObservationFromFile, markUntracked, parseObservationJson, reconcileObservation, } from "../lib/work-context/reconcile.js";
 import { resolveCompany } from "../lib/work-context/company.js";
@@ -565,6 +567,15 @@ async function runPrdSync(opts) {
         console.error("work-mesh: prd-sync has changes but no token; snapshot not advanced");
         return;
     }
+    // Attribution evidence: without company and project the server files these
+    // as unassigned and the Board never moves.
+    const bound = readSessionState(sessionId, root);
+    const evidenceBase = {
+        ...(bound?.companySlug ? { companySlug: bound.companySlug } : {}),
+        ...(bound?.projectId ? { project: bound.projectId } : {}),
+        touchedPaths: [resolvePath(file)],
+    };
+    const seqFirst = reserveSessionSeq(sessionId, plan.events.length);
     const events = plan.events.map((event, index) => buildMeshEmitEvent({
         eventId: generateUlid(Date.now() + index),
         kind: "task_status",
@@ -572,18 +583,24 @@ async function runPrdSync(opts) {
         harness: "hq-sessions",
         adapterVersion: "1.0.0",
         at: new Date().toISOString(),
-        seq: plan.seqStart + index + 1,
+        seq: seqFirst + index,
         source: "hooks",
         taskId: event.taskId,
         status: event.status,
         summary: event.status === "done" ? `${event.taskId} passes` : `${event.taskId} in progress`,
+        evidence: { ...evidenceBase, task: event.taskId },
     }));
     const poster = createEmitPoster({ token, baseUrl: resolveVaultApiBase(process.env) });
-    await emitEvents({
+    const emitted = await emitEvents({
         workMeshRoot: workMeshHomeRoot(),
         poster,
         newEvents: events,
     });
+    if (emitted.unassigned > 0 || emitted.rejected > 0) {
+        console.error(`work-mesh: prd-sync sent ${events.length}; unassigned=${emitted.unassigned} rejected=${emitted.rejected}`);
+        for (const line of formatEmitRejectionLines(emitted.rejections))
+            console.error(line);
+    }
     plan.commit();
     if (plan.taskId) {
         updateSessionState(sessionId, root, (current) => {

package/dist/lib/mesh/api.d.ts

@@ -78,7 +78,7 @@ export declare function listActiveMembershipCompanies(token: string): Promise<Me
  * Returns null when the caller is not an active member. Throws on transport /
  * auth failures so the caller can surface DEFAULT_COMPANY_UNAVAILABLE.
  */
-export declare function resolveActiveMembershipCompany(token: string, slug: string): Promise<MeshCompany | null>;
+export declare function resolveActiveMembershipCompany(token: string, slug: string, signal?: AbortSignal): Promise<MeshCompany | null>;
 export interface RequireTokenOptions {
     /**
      * False from detached or unattended callers (the lane watcher). A person

package/dist/lib/mesh/api.js

@@ -113,11 +113,15 @@ export async function listActiveMembershipCompanies(token) {
  * Returns null when the caller is not an active member. Throws on transport /
  * auth failures so the caller can surface DEFAULT_COMPANY_UNAVAILABLE.
  */
-export async function resolveActiveMembershipCompany(token, slug) {
+export async function resolveActiveMembershipCompany(token, slug, signal) {
     const trimmed = slug.trim();
     if (!trimmed)
         return null;
-    const payload = asRecord(await meshJson(token, "/membership/me"));
+    // An aborted lookup is not "not a member". Throw so callers defer.
+    if (signal?.aborted) {
+        throw new Error("membership lookup aborted");
+    }
+    const payload = asRecord(await meshJson(token, "/membership/me", { signal }));
     if (!payload || !Array.isArray(payload.memberships)) {
         throw new Error("Malformed membership response: expected memberships array");
     }

package/dist/lib/mesh/live/daemon/run.js

@@ -165,8 +165,20 @@ export async function runMeshDaemon(deps = {}) {
                 ? readSessionState(input.sessionId, ctxRoot)
                 : null);
             const slug = input.companySlug ?? state?.companySlug;
+            // A uid alone is enough to ask /membership/me. Missing slug is not a
+            // denial. A device-default session whose company was cleared can be
+            // checked against the configured default; that is the same company the
+            // daemon assigned before the false denial.
+            const configuredDefault = input.deviceDefault
+                ? readDeviceConfig({ root: ctxRoot }).defaultCompany
+                : undefined;
+            const defaultCompany = configuredDefault?.enabled ? configuredDefault : undefined;
+            const usingDefaultFallback = !slug && !state?.companyUid && Boolean(defaultCompany?.slug || defaultCompany?.uid);
+            const lookupKey = slug || state?.companyUid || (usingDefaultFallback
+                ? (defaultCompany?.slug || defaultCompany?.uid)
+                : undefined);
             let authorization;
-            if (!slug) {
+            if (!lookupKey) {
                 authorization = { status: "denied" };
             }
             else {
@@ -175,7 +187,14 @@ export async function runMeshDaemon(deps = {}) {
                 try {
                     authorization = await Promise.race([
                         (async () => {
-                            const membership = await resolveMembership(await getToken(), slug, controller.signal);
+                            const membership = await resolveMembership(await getToken(), lookupKey, controller.signal);
+                            // Timeout wins even if the probe then returns null.
+                            if (controller.signal.aborted) {
+                                return {
+                                    status: "unavailable",
+                                    error: `membership lookup timed out after ${DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS}ms`,
+                                };
+                            }
                             if (membership)
                                 return { status: "authorized", uid: membership.companyUid };
                             // A machine token often cannot read /membership/me (401/403, or an
@@ -221,8 +240,43 @@ export async function runMeshDaemon(deps = {}) {
             if (authorization.status === "authorized" &&
                 (!input.companyUid || input.companyUid === authorization.uid) &&
                 (!state?.companyUid || state.companyUid === authorization.uid)) {
+                // A prior false denial cleared the company and left needs_company.
+                // Membership just confirmed the company, so put it back and let flush post.
+                if (state &&
+                    state.companyConfidence === "device_default" &&
+                    state.contextStatus === "needs_company") {
+                    const restoredSlug = state.companySlug || slug || defaultCompany?.slug;
+                    const restoredUid = authorization.uid;
+                    updateSessionState(state.sessionId, ctxRoot, (current) => {
+                        if (!current || current.contextStatus !== "needs_company")
+                            return null;
+                        if (current.companyUid && current.companyUid !== restoredUid)
+                            return null;
+                        if (current.companySlug &&
+                            restoredSlug &&
+                            !sameCompanyValue(current.companySlug, restoredSlug)) {
+                            return null;
+                        }
+                        return mergeLocalSessionFields({
+                            ...current,
+                            companyUid: restoredUid,
+                            ...(restoredSlug ? { companySlug: restoredSlug } : {}),
+                            contextStatus: current.projectId
+                                ? (current.taskId ? "bound" : "needs_task")
+                                : "needs_project",
+                            updatedAt: now().toISOString(),
+                        }, current, { preserveCompanyBinding: false });
+                    });
+                }
                 return authorization;
             }
+            // Already stripped. Do not revoke, count, or log this again on every flush.
+            if (state &&
+                state.contextStatus === "needs_company" &&
+                !state.companyUid &&
+                !state.companySlug) {
+                return { status: "denied" };
+            }
             try {
                 invalidateDefaultCompanyMemberships({ root: ctxRoot, now });
             }

package/dist/lib/mesh/live/flush.d.ts

@@ -16,6 +16,11 @@ export declare const HELD_TTL_MS: number;
 export declare const HELD_RETRY_INTERVAL_MS: number;
 /** Cap held.jsonl size; oldest overflow is dead-lettered with HELD_OVERFLOW. */
 export declare const HELD_MAX_LINES = 20000;
+/**
+ * Re-check an unbound session against the project catalog at most this often.
+ * The catalog itself is also cached inside bind-best.
+ */
+export declare const PROJECT_REBIND_INTERVAL_MS = 60000;
 export type HeldReason = "STATE_ABSENT" | "NEEDS_COMPANY" | "COMPANY_CONFLICT" | "NEEDS_PROJECT" | "HELD_EXPIRED" | "HELD_OVERFLOW";
 export interface HeldLineRecord {
     /** Original spool event fields. */
@@ -46,6 +51,9 @@ export interface FlushDeps {
     log?: (message: string) => void;
     /** Authoritative gate for state derived from a device default. */
     authorizeDeviceDefaultTenant?: (state: SessionStateFile) => Promise<boolean>;
+    /** Passed through to bind-best (catalog cache root and HQ_WORK_MESH_CACHE). */
+    env?: NodeJS.ProcessEnv;
+    home?: string;
 }
 export interface FlushSummary {
     claimed: number;

package/dist/lib/mesh/live/flush.js

@@ -12,6 +12,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { resolveCompany } from "../../work-context/company.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
+import { rebindNeedsProjectOnPrompt } from "../../work-context/prompt-rebind.js";
 import { readSessionState, updateSessionState } from "../../work-context/state.js";
 import { repairAckedRegisterStates } from "../../work-context/outbox.js";
 import { workContextRoot } from "../../work-context/paths.js";
@@ -25,6 +26,12 @@ export const HELD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export const HELD_RETRY_INTERVAL_MS = 5 * 60 * 1000;
 /** Cap held.jsonl size; oldest overflow is dead-lettered with HELD_OVERFLOW. */
 export const HELD_MAX_LINES = 20_000;
+/**
+ * Re-check an unbound session against the project catalog at most this often.
+ * The catalog itself is also cached inside bind-best.
+ */
+export const PROJECT_REBIND_INTERVAL_MS = 60_000;
+const lastProjectRebindAtMs = new Map();
 function parseLine(line) {
     try {
         const v = JSON.parse(line);
@@ -224,18 +231,25 @@ export async function flushSessionEvents(deps) {
         };
         const loggedProject404 = new Set();
         for (const [sessionId, items] of bySession) {
-            const state = readSessionState(sessionId, deps.workContextRoot);
+            let state = readSessionState(sessionId, deps.workContextRoot);
             if (state?.companyConfidence === "device_default" &&
-                deps.authorizeDeviceDefaultTenant &&
-                !(await deps.authorizeDeviceDefaultTenant(state))) {
-                const heldAt = now().toISOString();
-                for (const item of items) {
-                    appendHeldLine(heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? heldAt), deps.workMeshRoot);
-                    summary.held += 1;
-                    markDisposed(item.event);
+                deps.authorizeDeviceDefaultTenant) {
+                const allowed = await deps.authorizeDeviceDefaultTenant(state);
+                // Authorization may restore a company the gate previously cleared.
+                state = readSessionState(sessionId, deps.workContextRoot) ?? state;
+                if (!allowed) {
+                    const heldAt = now().toISOString();
+                    for (const item of items) {
+                        appendHeldLine(heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? heldAt), deps.workMeshRoot);
+                        summary.held += 1;
+                        markDisposed(item.event);
+                    }
+                    continue;
                 }
-                continue;
             }
+            // After the company gate (which may restore a cleared company), try to
+            // bind a needs_project session to an existing Board before classifying.
+            state = rebindUnboundSession(sessionId, items, state, deps, nowMs);
             const decision = classifySession(state);
             if (decision.action === "drop") {
                 appendDroppedReceipt({
@@ -502,6 +516,54 @@ function canonicalizeForRestore(event) {
     }
     return out;
 }
+function eventText(event, key) {
+    const value = event[key];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+/**
+ * Before a needs_project (or unresolved-with-company) batch is classified,
+ * run the prompt-submit bind-best refinement. A bind updates the session
+ * file so the batch posts with that projectId. Ties stay unbound. At most
+ * one attempt per session per minute; failures stay on the existing state.
+ */
+function rebindUnboundSession(sessionId, items, state, deps, nowMs) {
+    if (!state?.companyUid)
+        return state;
+    if (state.contextStatus !== "needs_project" && state.contextStatus !== "unresolved") {
+        return state;
+    }
+    const key = `${deps.workContextRoot}\0${sessionId}`;
+    const previous = lastProjectRebindAtMs.get(key);
+    if (previous !== undefined && nowMs - previous < PROJECT_REBIND_INTERVAL_MS) {
+        return state;
+    }
+    lastProjectRebindAtMs.set(key, nowMs);
+    const sample = items[0]?.event ?? {};
+    const started = Date.now();
+    try {
+        rebindNeedsProjectOnPrompt({
+            sessionId,
+            root: deps.workContextRoot,
+            hqRoot: eventText(sample, "hqRoot"),
+            cwd: eventText(sample, "cwd"),
+            companySlug: state.companySlug ?? eventText(sample, "companySlug"),
+            companyUid: state.companyUid,
+            hint: eventText(sample, "project"),
+            env: deps.env,
+            home: deps.home,
+            nowMs,
+            now: deps.now,
+        });
+    }
+    catch (err) {
+        deps.log?.(`work-mesh: session ${sessionId} project rebind failed: ${err instanceof Error ? err.message : "unknown"}`);
+    }
+    const elapsed = Date.now() - started;
+    if (elapsed > 300) {
+        deps.log?.(`work-mesh: session ${sessionId} project rebind took ${elapsed}ms`);
+    }
+    return readSessionState(sessionId, deps.workContextRoot) ?? state;
+}
 function classifySession(state) {
     if (!state) {
         return { action: "hold", heldReason: "STATE_ABSENT" };

package/dist/lib/mesh/live/session-seq.d.ts

@@ -0,0 +1,4 @@
+export declare function sessionSeqDir(env?: NodeJS.ProcessEnv): string;
+/** Reserve `count` consecutive seq numbers; returns the first one. */
+export declare function reserveSessionSeq(sessionId: string, count: number, env?: NodeJS.ProcessEnv): number;
+//# sourceMappingURL=session-seq.d.ts.map

package/dist/lib/mesh/live/session-seq.js

@@ -0,0 +1,33 @@
+/**
+ * Shared per-session event sequence, the same file the core hooks use
+ * (`~/.hq/work-mesh/seq/<sid>`, see core/scripts/lib/work-mesh-live-hook.sh).
+ * Every emitter for a session must take numbers from here, or the server
+ * treats the new events as duplicates of earlier ones and drops them.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export function sessionSeqDir(env = process.env) {
+    return env.WORK_MESH_SEQ_DIR?.trim() || path.join(os.homedir(), ".hq", "work-mesh", "seq");
+}
+/** Reserve `count` consecutive seq numbers; returns the first one. */
+export function reserveSessionSeq(sessionId, count, env = process.env) {
+    if (!/^[A-Za-z0-9._-]+$/.test(sessionId))
+        throw new Error("invalid session id");
+    const dir = sessionSeqDir(env);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = path.join(dir, sessionId);
+    let current = 0;
+    try {
+        const raw = fs.readFileSync(file, "utf8").trim();
+        if (/^\d+$/.test(raw))
+            current = Number(raw);
+    }
+    catch {
+        current = 0;
+    }
+    const first = current + 1;
+    fs.writeFileSync(file, `${current + Math.max(0, count)}\n`, { mode: 0o600 });
+    return first;
+}
+//# sourceMappingURL=session-seq.js.map

package/dist/lib/mesh/project-board.js

@@ -11,9 +11,17 @@ export async function closeSupersededProjectThread(input) {
         return;
     if (!input.openedThreadId || input.openedThreadId === input.canonicalThreadId)
         return;
-    await appendThreadEvent(input.token, input.companyUid, input.openedThreadId, "done", {
-        summary: "Superseded by the registered project thread.",
-    });
+    try {
+        await appendThreadEvent(input.token, input.companyUid, input.openedThreadId, "done", {
+            summary: "Superseded by the registered project thread.",
+        });
+    }
+    catch (err) {
+        // Best effort: the server may refuse (e.g. only the thread owner may mark
+        // it done). A leftover open thread must never fail registration.
+        const reason = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`Work mesh: left extra thread ${input.openedThreadId} open (${reason.slice(0, 120)})\n`);
+    }
 }
 /**
  * Create a missing Board. Register returns 403 PROJECT_NOT_IN_COMPANY until

package/dist/lib/work-context/prompt-rebind.d.ts

@@ -1,6 +1,7 @@
 /**
- * US-040: UserPromptSubmit re-runs bind-best for a session still in
- * needs_project. Catalog reads are cached. Failures stay local.
+ * US-040: re-run bind-best for a session still in needs_project, or
+ * unresolved once it has a company. The prompt hook and the mesh daemon
+ * flush both call this. Catalog reads are cached. Failures stay local.
  */
 export type PromptRebindResult = {
     action: "bound" | "skipped" | "unchanged";
@@ -14,7 +15,10 @@ export declare function rebindNeedsProjectOnPrompt(input: {
     cwd?: string;
     companySlug?: string;
     companyUid?: string;
+    /** Used when the session has no projectHint (for example a spool `project` field). */
+    hint?: string;
     env?: NodeJS.ProcessEnv;
+    home?: string;
     nowMs?: number;
     now?: () => Date;
 }): PromptRebindResult;

package/dist/lib/work-context/prompt-rebind.js

@@ -1,6 +1,7 @@
 /**
- * US-040: UserPromptSubmit re-runs bind-best for a session still in
- * needs_project. Catalog reads are cached. Failures stay local.
+ * US-040: re-run bind-best for a session still in needs_project, or
+ * unresolved once it has a company. The prompt hook and the mesh daemon
+ * flush both call this. Catalog reads are cached. Failures stay local.
  */
 import { projectIdFromCwd } from "./company.js";
 import { readMetaProjectTask } from "./project.js";
@@ -17,13 +18,17 @@ export function rebindNeedsProjectOnPrompt(input) {
     }
     if (!state)
         return { action: "skipped", reason: "no_state" };
-    if (state.contextStatus !== "needs_project") {
+    const companyUid = input.companyUid ?? state.companyUid;
+    const retryable = state.contextStatus === "needs_project" ||
+        (state.contextStatus === "unresolved" && Boolean(companyUid));
+    if (!retryable) {
         return { action: "skipped", reason: "not_needs_project" };
     }
     if (state.projectId)
         return { action: "skipped", reason: "different_project" };
     const env = input.env ?? process.env;
     const hint = state.projectHint?.trim() ||
+        input.hint?.trim() ||
         env.HQ_SPAWN_PROJECT?.trim() ||
         readMetaProjectTask(input.sessionId, input.hqRoot).projectId ||
         projectIdFromCwd(input.cwd, input.hqRoot) ||
@@ -36,9 +41,10 @@ export function rebindNeedsProjectOnPrompt(input) {
             hint,
             hqRoot: input.hqRoot,
             companySlug: input.companySlug ?? state.companySlug,
-            companyUid: input.companyUid ?? state.companyUid,
+            companyUid,
             repoPath: input.cwd,
             env,
+            home: input.home,
             nowMs: input.nowMs ?? Date.now(),
         });
     }
@@ -52,7 +58,10 @@ export function rebindNeedsProjectOnPrompt(input) {
     const reason = refined.reason;
     const nowIso = (input.now ?? (() => new Date()))().toISOString();
     const updated = updateSessionState(input.sessionId, input.root, (current) => {
-        if (!current || current.contextStatus !== "needs_project")
+        if (!current || (current.contextStatus !== "needs_project" && current.contextStatus !== "unresolved")) {
+            return current;
+        }
+        if (current.contextStatus === "unresolved" && !current.companyUid)
             return current;
         if (current.projectId && current.projectId !== projectId)
             return current;

package/dist/sentry.js

@@ -7,7 +7,7 @@ import { getCachedSentryUser } from "./utils/sentry-identity.js";
 import { isEpipe } from "./utils/epipe.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { incompleteInstallCaptureContext, incompleteInstallMessage, } from "./utils/incomplete-install-error.js";
-import { sentryFingerprintFor } from "./utils/sentry-fingerprint.js";
+import { sentryFingerprintFor, sentryMcpCollisionContextFor, } from "./utils/sentry-fingerprint.js";
 /**
  * Drop broken-pipe (EPIPE) crashes before scrubbing/send. A closed downstream
  * reader (`hq … | head`, `source <(hq …)`, a parent that exited) is normal
@@ -70,12 +70,20 @@ export function epipeAwareBeforeSend(event, hint) {
     // before the fleet scrubber — so it covers EVERY capture route (the top-level
     // boundary, the command-level captureException sites, bin/hq-auth-refresh,
     // any uncaughtException), mirroring the EPIPE and environmental-fs drops
-    // above. The classifier reads only a closed allowlist (never message/argv),
-    // and returns null for anything it cannot bound, in which case Sentry's
-    // default grouping is left untouched.
-    const fingerprint = sentryFingerprintFor(hint?.originalException);
-    if (fingerprint)
-        event.fingerprint = fingerprint;
+    // above. The typed error classifiers use closed allowlists. The Codex
+    // collision branch uses one fixed bucket and adds the validated server name
+    // only as a tag; it sends no config values or paths. Unclassifiable
+    // events retain Sentry's default grouping.
+    const mcpCollision = sentryMcpCollisionContextFor(hint?.originalException);
+    if (mcpCollision) {
+        event.tags = { ...event.tags, ...mcpCollision.tags };
+        event.fingerprint = mcpCollision.fingerprint;
+    }
+    else {
+        const fingerprint = sentryFingerprintFor(hint?.originalException);
+        if (fingerprint)
+            event.fingerprint = fingerprint;
+    }
     return beforeSend(event, hint);
 }
 /**

package/dist/utils/sentry-fingerprint.d.ts

@@ -1,3 +1,14 @@
+export interface SentryMcpCollisionContext {
+    tags: {
+        mcp_client: "codex";
+        server_name: string;
+        existing_entry_owner: "hq" | "foreign" | "unknown";
+        diff_fields: string;
+    };
+    fingerprint: string[];
+}
+/** Return bounded, value-free Sentry context for an instrumented Codex name collision. */
+export declare function sentryMcpCollisionContextFor(err: unknown): SentryMcpCollisionContext | null;
 /**
  * Return a bounded `event.fingerprint` array for `err`, or `null` when `err`
  * carries no discriminator from the closed allowlist (in which case the caller

package/dist/utils/sentry-fingerprint.js

@@ -1,8 +1,8 @@
 // src/utils/sentry-fingerprint.ts
 //
-// Compute a BOUNDED Sentry grouping fingerprint from an error, using only a
-// CLOSED allowlist of enumerable discriminators — never any upstream- or
-// user-minted text. Sibling in spirit to qmd-collection-missing-error.ts
+// Compute a BOUNDED Sentry grouping fingerprint from an error, using only
+// closed discriminators and a fixed Codex collision bucket, never arbitrary
+// upstream- or user-minted text. Sibling in spirit to qmd-collection-missing-error.ts
 // (HQ-CLI-S): the same unbounded-fingerprint discipline, applied to grouping
 // instead of to a printed line.
 //
@@ -45,14 +45,14 @@
 // grouping untouched.
 //
 // Two hard rules, mirroring HQ-CLI-S:
-//   1. CLOSED ALLOWLIST. The discriminator is one of a finite set of known
-//      JSON-RPC codes / HTTP statuses, or the literal `rpc:other` / `http:other`
-//      bucket. Total cardinality is therefore bounded — an over-wide key that
-//      minted a brand-new permanent issue per invocation is impossible.
-//   2. NO FREE TEXT. Only the error's `name` (a class identifier), a numeric
-//      `rpcCode`, and a numeric HTTP `status` are read. `message`, argv, URLs,
-//      connection ids, company slugs and any other upstream/user text can NEVER
-//      reach the fingerprint, so the key cannot be inflated by input.
+//   1. BOUNDED DISCRIMINATORS. RPC/HTTP values use closed allowlists and
+//      fallback buckets. Codex collisions use one fixed client bucket. The
+//      server-name tag is restricted to 64 lowercase letters, digits,
+//      underscores or hyphens; other names share one fallback value. Owner and
+//      field tags also use closed sets.
+//   2. NO FREE TEXT. Error messages, argv, URLs, connection ids, company slugs,
+//      config values and paths never reach a fingerprint or tags. The Codex
+//      branch uses a fixed fingerprint and bounded diagnostic tags.
 //
 // An error that carries no bounded discriminator returns `null`: the caller
 // leaves `event.fingerprint` unset and Sentry keeps its DEFAULT grouping, so the
@@ -79,6 +79,48 @@ const KNOWN_HTTP_STATUSES = new Set([
 ]);
 /** Sentry's placeholder for "keep the normal, stack-based grouping too". */
 const DEFAULT_GROUPING = "{{ default }}";
+const CODEX_COLLISION_NAME_RE = /^[a-z0-9_-]{1,64}$/;
+const CODEX_COLLISION_OWNERS = new Set(["hq", "foreign", "unknown"]);
+const CODEX_COLLISION_FIELDS = new Set(["command", "args", "env", "url", "other"]);
+function isCodexCollisionOwner(value) {
+    return typeof value === "string" && CODEX_COLLISION_OWNERS.has(value);
+}
+/** Return bounded, value-free Sentry context for an instrumented Codex name collision. */
+export function sentryMcpCollisionContextFor(err) {
+    if (err === null || typeof err !== "object")
+        return null;
+    const record = err;
+    if (record.name !== "McpNameCollisionError" || record.code !== "McpNameCollisionError") {
+        return null;
+    }
+    const diagnostics = record.codexDiagnostics;
+    if (diagnostics === null || typeof diagnostics !== "object")
+        return null;
+    const context = diagnostics;
+    const owner = context.existingEntryOwner;
+    if (context.client !== "codex" ||
+        typeof context.serverName !== "string" ||
+        !isCodexCollisionOwner(owner) ||
+        !Array.isArray(context.diffFields) ||
+        context.diffFields.length === 0 ||
+        context.diffFields.length > CODEX_COLLISION_FIELDS.size ||
+        !context.diffFields.every((field) => typeof field === "string" && CODEX_COLLISION_FIELDS.has(field))) {
+        return null;
+    }
+    const fields = [...new Set(context.diffFields)].sort();
+    const serverName = CODEX_COLLISION_NAME_RE.test(context.serverName)
+        ? context.serverName
+        : "other";
+    return {
+        tags: {
+            mcp_client: "codex",
+            server_name: serverName,
+            existing_entry_owner: owner,
+            diff_fields: fields.join(","),
+        },
+        fingerprint: ["mcp-name-collision", "codex"],
+    };
+}
 /**
  * The CLOSED set of error class names allowed to appear VERBATIM in a
  * fingerprint. This hook runs on every capture route and accepts `unknown`, so
@@ -216,6 +258,9 @@ export function sentryFingerprintFor(err) {
     const rawName = typeof record.name === "string" && record.name.length > 0 ? record.name : null;
     if (rawName === null)
         return null;
+    const mcpCollision = sentryMcpCollisionContextFor(record);
+    if (mcpCollision)
+        return mcpCollision.fingerprint;
     // qmd process failures carry a PROCESS EXIT CODE in `status` (never an HTTP
     // status) plus a subcommand in args[0]. Fingerprint them on a dedicated,
     // fully-bounded key BEFORE the HTTP-status branch so an exit code is never read

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.146.0",
+  "version": "5.148.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {