@indigoai-us/hq-cli 5.306.0 → 5.308.0

package/assets/scaffold/core/scripts/lib/portable.sh

@@ -0,0 +1,211 @@
+# shellcheck shell=bash
+# portable.sh — shared OS-portability helpers for hq-core shell scripts.
+#
+# SOURCED, never executed:  . "$ROOT/core/scripts/lib/portable.sh"
+# bash 3.2 safe; works under Linux, macOS, and Windows Git Bash with set -u.
+#
+# Canonicalizes good in-repo dual-implementation patterns:
+#   - work-mesh-lib.sh wm_file_mtime (numeric-probe dual stat)
+#   - archive-old-threads.sh dual stat / date -d | date -v
+#   - compute-checksums.sh Git Bash awareness
+#
+# JSON engines are NOT here — source core/scripts/hook-lib.sh (hq_json_get /
+# hq_json_encode: jq first, then node). This file owns OS primitives + hard-fail
+# jq install messaging only.
+
+# portable_stat_mtime <path>
+#   Print mtime as epoch seconds. Uses BSD-form stat -f first, accepts only a
+#   strictly numeric result (GNU stat -f is filesystem mode and may print text),
+#   then falls through to GNU stat -c. Mirrors work-mesh-lib.sh:215-230.
+#   Returns 1 when both forms fail.
+portable_stat_mtime() {
+  local f="${1:-}" value
+  [ -n "$f" ] || return 1
+  value="$(stat -f %m "$f" 2>/dev/null)" || value=""
+  case "$value" in
+    ''|*[!0-9]*) ;;
+    *) printf '%s' "$value"; return 0 ;;
+  esac
+  value="$(stat -c %Y "$f" 2>/dev/null)" || value=""
+  case "$value" in
+    ''|*[!0-9]*) return 1 ;;
+    *) printf '%s' "$value"; return 0 ;;
+  esac
+}
+
+# portable_sed_inplace <sed-script> <file> [extra sed args...]
+#   In-place sed that works on both GNU sed (sed -i) and BSD sed (sed -i '').
+portable_sed_inplace() {
+  local script="${1:-}"
+  local file="${2:-}"
+  shift 2 2>/dev/null || true
+  [ -n "$script" ] && [ -n "$file" ] || return 1
+  [ -f "$file" ] || return 1
+  # Prefer GNU form; fall back to BSD empty-suffix form.
+  if sed --version >/dev/null 2>&1; then
+    sed -i "$@" -e "$script" "$file"
+  else
+    sed -i '' "$@" -e "$script" "$file"
+  fi
+}
+
+# portable_tmpdir
+#   Print a writable temp directory (no trailing slash). Prefer TMPDIR, else /tmp.
+portable_tmpdir() {
+  local d="${TMPDIR:-/tmp}"
+  # Strip trailing slash except for root.
+  case "$d" in
+    /) printf '%s' "$d" ;;
+    */) printf '%s' "${d%/}" ;;
+    *) printf '%s' "$d" ;;
+  esac
+}
+
+# portable_date_epoch_to_iso <epoch_seconds>
+#   Convert epoch seconds to UTC ISO-8601 (YYYY-MM-DDTHH:MM:SSZ).
+#   Dual: GNU date -d @N / BSD date -r N.
+portable_date_epoch_to_iso() {
+  local epoch="${1:-}"
+  case "$epoch" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  date -u -d "@${epoch}" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null \
+    || date -u -r "$epoch" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null \
+    || return 1
+}
+
+# portable_user
+#   Print a filename-safe user key from USER or USERNAME (Git Bash often lacks USER).
+portable_user() {
+  local u="${USER:-${USERNAME:-unknown}}"
+  # shellcheck disable=SC2001
+  u="$(printf '%s' "$u" | sed 's/[^[:alnum:]_.-]/_/g')"
+  [ -n "$u" ] || u="unknown"
+  printf '%s' "$u"
+}
+
+# portable_jq_install_hint
+#   Print multi-line per-OS jq install guidance to stdout.
+portable_jq_install_hint() {
+  # Single multi-OS line so portability lint does not flag brew-only messages.
+  printf '%s\n' "Install jq: Windows: winget install jqlang.jq | choco install jq | scoop install jq; Linux: sudo apt install jq | sudo dnf install jq; macOS: brew install jq"
+}
+
+# require_jq
+#   Return 0 if jq is on PATH. Otherwise print install guidance to stderr and
+#   return 1. Caller decides whether to die. Does not implement JSON parse.
+require_jq() {
+  if command -v jq >/dev/null 2>&1; then
+    return 0
+  fi
+  printf 'jq is required but not installed.\n' >&2
+  portable_jq_install_hint >&2
+  return 1
+}
+
+# portable_native_path <path>
+#   Print a path a native (non-MSYS) Windows binary can open. Git Bash mktemp
+#   and $TMPDIR often yield /tmp/... which Node's hq.exe cannot read, so
+#   --body-file looks empty. cygpath -m produces C:/... mixed paths. On
+#   POSIX hosts this is identity. Empty input returns 1.
+portable_native_path() {
+  local p="${1:-}"
+  [ -n "$p" ] || return 1
+  if command -v cygpath >/dev/null 2>&1; then
+    cygpath -m "$p" 2>/dev/null || printf '%s' "$p"
+    return 0
+  fi
+  printf '%s' "$p"
+}
+
+# portable_qmd_models_dir
+#   Print qmd's GGUF cache directory (no trailing slash). Override with
+#   QMD_MODELS_DIR. Otherwise XDG_CACHE_HOME/qmd/models, then
+#   HOME/.cache/qmd/models, then USERPROFILE/.cache/qmd/models (Windows).
+portable_qmd_models_dir() {
+  local d
+  if [ -n "${QMD_MODELS_DIR:-}" ]; then
+    d="$QMD_MODELS_DIR"
+  elif [ -n "${XDG_CACHE_HOME:-}" ]; then
+    d="$XDG_CACHE_HOME/qmd/models"
+  elif [ -n "${HOME:-}" ]; then
+    d="$HOME/.cache/qmd/models"
+  elif [ -n "${USERPROFILE:-}" ]; then
+    d="$USERPROFILE/.cache/qmd/models"
+    if command -v cygpath >/dev/null 2>&1; then
+      d="$(cygpath -u "$d" 2>/dev/null || printf '%s' "$d")"
+    fi
+  else
+    return 1
+  fi
+  case "$d" in
+    */) d="${d%/}" ;;
+  esac
+  printf '%s' "$d"
+}
+
+# portable_qmd_embed_model_ready
+#   Return 0 when a usable GGUF already sits in the qmd models dir so
+#   vsearch/query/embed will not start a multi-hundred-MB download. A file
+#   named by QMD_EMBED_MODEL (basename after the last /) counts; otherwise
+#   any *.gguf of at least 1 MiB counts. Missing dir or tiny placeholders
+#   return 1.
+portable_qmd_embed_model_ready() {
+  local dir want f sz
+  dir="$(portable_qmd_models_dir)" || return 1
+  [ -d "$dir" ] || return 1
+  if [ -n "${QMD_EMBED_MODEL:-}" ]; then
+    want="${QMD_EMBED_MODEL##*/}"
+    if [ -n "$want" ] && [ -f "$dir/$want" ]; then
+      sz="$(wc -c < "$dir/$want" | tr -d '[:space:]')"
+      case "$sz" in
+        ''|*[!0-9]*) ;;
+        *) [ "$sz" -ge 1048576 ] && return 0 ;;
+      esac
+    fi
+  fi
+  for f in "$dir"/*.gguf; do
+    [ -f "$f" ] || continue
+    sz="$(wc -c < "$f" | tr -d '[:space:]')"
+    case "$sz" in
+      ''|*[!0-9]*) continue ;;
+    esac
+    [ "$sz" -ge 1048576 ] && return 0
+  done
+  return 1
+}
+
+# portable_qmd_cmd_would_download_model <command>
+#   Return 0 when a shell command would invoke qmd vsearch, query, embed, or
+#   pull — the subcommands that auto-download GGUF models on first use.
+#   First non-flag argument after a qmd token is the subcommand, so
+#   `qmd search "how to vsearch"` is NOT a match.
+portable_qmd_cmd_would_download_model() {
+  local cmd="${1:-}"
+  [ -n "$cmd" ] || return 1
+  case "$cmd" in
+    *qmd*) ;;
+    *) return 1 ;;
+  esac
+  printf '%s\n' "$cmd" | awk '
+    BEGIN { found = 0 }
+    {
+      n = split($0, raw, /[[:space:];|&]+/)
+      for (i = 1; i <= n; i++) {
+        tok = raw[i]
+        if (tok == "") continue
+        base = tok
+        sub(/^.*\//, "", base)
+        if (base == "qmd" || base == "qmd.exe") {
+          j = i + 1
+          while (j <= n && raw[j] ~ /^-/) j++
+          if (j <= n && raw[j] ~ /^(vsearch|query|embed|pull)$/) {
+            found = 1
+            exit
+          }
+        }
+      }
+    }
+    END { exit found ? 0 : 1 }
+  '
+}

package/assets/scaffold/core/scripts/refresh-vault-access.sh

@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+# hq-core: public
+# refresh-vault-access.sh — build/refresh the local vault-access manifest that
+# enforce-vault-write-access.sh (PreToolUse hook) reads.
+#
+# Output: <hqRoot>/.hq/vault-access.json
+#
+#   {
+#     "version": 1,
+#     "generatedAt": "2026-01-01T00:00:00Z",
+#     "companies": {
+#       "<slug>": {
+#         "role": "owner|admin|member|guest|unknown",
+#         "grants": [ { "path": "reports/*", "permission": "read|write" } ]
+#       }
+#     }
+#   }
+#
+# Sources (best-effort, all via the hq CLI):
+#   - grants: `hq files shared-with-me` (explicit per-prefix grants)
+#   - role:   `hq members --company <slug> list` matched against the caller's
+#             email (from `hq whoami`, override with HQ_VAULT_ACCESS_EMAIL)
+#
+# Fail-open by design: anything this script cannot determine is recorded as
+# role "unknown" (the hook does not enforce unknown roles), and a company it
+# cannot query at all is left out of the manifest entirely (the hook allows
+# companies absent from the manifest). The server-side STS/ACL layer remains
+# the authoritative security boundary — this manifest only powers the local
+# early-warning block for read-only shares.
+#
+# Usage:
+#   bash core/scripts/refresh-vault-access.sh [--company <slug>]... [--root <hqRoot>]
+#
+# With no --company, refreshes every company that appears in the
+# `hq files shared-with-me` cross-company roll-up.
+
+set -uo pipefail
+
+log() { printf 'refresh-vault-access: %s\n' "$*" >&2; }
+
+ROOT=""
+SLUGS=()
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --root)
+      ROOT="${2:-}"
+      shift 2 || { log "--root requires a value"; exit 1; }
+      ;;
+    --company)
+      SLUGS[${#SLUGS[@]}]="${2:-}"
+      shift 2 || { log "--company requires a value"; exit 1; }
+      ;;
+    -h|--help)
+      sed -n '2,33p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *)
+      log "unknown argument: $1"
+      exit 1
+      ;;
+  esac
+done
+
+is_hq_root() { [ -n "${1:-}" ] && [ -d "${1%/}/core" ] && [ -d "${1%/}/.claude" ]; }
+
+if [ -z "$ROOT" ]; then
+  if is_hq_root "${CLAUDE_PROJECT_DIR:-}"; then
+    ROOT="$CLAUDE_PROJECT_DIR"
+  else
+    dir="$PWD"
+    while [ -n "$dir" ] && [ "$dir" != "/" ]; do
+      if is_hq_root "$dir"; then ROOT="$dir"; break; fi
+      dir="$(dirname "$dir")"
+    done
+  fi
+fi
+if ! is_hq_root "$ROOT"; then
+  log "could not resolve the HQ root (pass --root <hqRoot>)"
+  exit 1
+fi
+
+command -v jq >/dev/null 2>&1 || { log "jq is required"; exit 1; }
+if ! command -v hq >/dev/null 2>&1; then
+  log "hq CLI not found — nothing refreshed (the write-access hook stays fail-open without a manifest)"
+  exit 0
+fi
+
+strip_ansi() { sed -e 's/\x1b\[[0-9;]*m//g'; }
+
+# ── caller email (for role lookup) ─────────────────────────────────────────
+EMAIL="${HQ_VAULT_ACCESS_EMAIL:-}"
+if [ -z "$EMAIL" ]; then
+  EMAIL="$(hq whoami 2>/dev/null | strip_ansi \
+    | grep -Eo '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' \
+    | grep -v '@outposts\.' | head -1 || true)"
+fi
+[ -n "$EMAIL" ] || log "could not determine caller email — roles will be 'unknown' (hook will not enforce)"
+
+# ── explicit grants via shared-with-me ─────────────────────────────────────
+# Table columns: COMPANY  PATH  PERMISSION  SOURCE (header + ─── separator).
+fetch_grants_tsv() {
+  # $1 = optional slug filter; prints "slug<TAB>path<TAB>permission" rows.
+  local slug="${1:-}" out
+  if [ -n "$slug" ]; then
+    out="$(hq files shared-with-me --company "$slug" 2>/dev/null | strip_ansi)" || return 1
+  else
+    out="$(hq files shared-with-me 2>/dev/null | strip_ansi)" || return 1
+  fi
+  # hq-cli >= 5.142 renders a private-folder row as "foo/ (private folder)";
+  # drop the label so the PATH column stays the verbatim `foo/` pattern.
+  printf '%s\n' "$out" | awk '
+    { sub(/ \(private folder\)/, "") }
+    /^COMPANY[[:space:]]/ { next }
+    /^─/ { next }
+    /^[[:space:]]*$/ { next }
+    /^Nothing is explicitly shared/ { next }
+    NF >= 3 {
+      perm = ""
+      if ($3 == "read" || $3 == "write" || $3 == "admin") perm = $3
+      else if (NF >= 4 && ($4 == "read" || $4 == "write" || $4 == "admin")) perm = $4
+      if (perm != "") printf "%s\t%s\t%s\n", $1, $2, perm
+    }'
+}
+
+# ── role lookup ────────────────────────────────────────────────────────────
+fetch_role() {
+  # $1 = slug; prints role or "unknown". Never fails.
+  local slug="$1" out role=""
+  if [ -n "$EMAIL" ]; then
+    # --company is declared on the parent `members` group, so it goes first.
+    out="$(hq members --company "$slug" list 2>/dev/null | strip_ansi)" || out=""
+    if [ -n "$out" ]; then
+      role="$(printf '%s\n' "$out" | awk -v email="$EMAIL" '$1 == email { print $2; exit }')"
+    fi
+  fi
+  case "$role" in
+    owner|admin|member|guest) printf '%s' "$role" ;;
+    *) printf 'unknown' ;;
+  esac
+}
+
+GRANTS_TSV=""
+if [ "${#SLUGS[@]}" -gt 0 ]; then
+  for slug in "${SLUGS[@]}"; do
+    rows="$(fetch_grants_tsv "$slug")" || { log "skipping $slug — shared-with-me query failed"; continue; }
+    GRANTS_TSV="${GRANTS_TSV}${rows}
+"
+  done
+else
+  GRANTS_TSV="$(fetch_grants_tsv)" || { log "shared-with-me roll-up failed — nothing refreshed"; exit 0; }
+fi
+
+# Companies to include = every slug present in the grant rows (plus any
+# explicitly requested slugs, so a company with zero explicit grants still
+# gets a role entry when asked for by name).
+ALL_SLUGS="$(printf '%s\n' "$GRANTS_TSV" | awk -F'\t' 'NF { print $1 }' | sort -u)"
+if [ "${#SLUGS[@]}" -gt 0 ]; then
+  ALL_SLUGS="$(printf '%s\n%s\n' "$ALL_SLUGS" "$(printf '%s\n' "${SLUGS[@]}")" | awk 'NF' | sort -u)"
+fi
+
+if [ -z "$ALL_SLUGS" ]; then
+  log "no explicit grants found — writing an empty manifest (hook stays fail-open everywhere)"
+fi
+
+COMPANIES_JSON="{}"
+while IFS= read -r slug; do
+  [ -n "$slug" ] || continue
+  role="$(fetch_role "$slug")"
+  grants_json="$(printf '%s\n' "$GRANTS_TSV" \
+    | awk -F'\t' -v s="$slug" '$1 == s { printf "%s\t%s\n", $2, $3 }' \
+    | jq -Rn '[inputs | split("\t") | select(length == 2) | {path: .[0], permission: .[1]}]')"
+  COMPANIES_JSON="$(printf '%s' "$COMPANIES_JSON" \
+    | jq --arg slug "$slug" --arg role "$role" --argjson grants "$grants_json" \
+        '. + {($slug): {role: $role, grants: $grants}}')"
+done <<EOF
+$ALL_SLUGS
+EOF
+
+mkdir -p "$ROOT/.hq"
+TMP_OUT="$(mktemp "$ROOT/.hq/vault-access.json.XXXXXX")"
+jq -n --argjson companies "$COMPANIES_JSON" \
+  --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+  '{version: 1, generatedAt: $ts, companies: $companies}' > "$TMP_OUT"
+mv "$TMP_OUT" "$ROOT/.hq/vault-access.json"
+
+N_COMPANIES="$(printf '%s\n' "$ALL_SLUGS" | awk 'NF' | wc -l | tr -d ' ')"
+log "wrote .hq/vault-access.json ($N_COMPANIES companies, identity: ${EMAIL:-unknown})"
+exit 0

package/assets/scaffold/core/scripts/resolve-company.sh

@@ -0,0 +1,199 @@
+#!/usr/bin/env bash
+# hq-core: public
+# resolve-company.sh — resolve the active company for skills and routing.
+#
+# Resolution order (first hit wins): explicit manifest slug in the prompt,
+# session company_slug, enabled device default, then none. Prompt matching is
+# whole-token only; free text never guesses a company.
+#
+# Output: {"company":"<slug>","source":"prompt|session|device_default|none"}
+# Always exits 0 and never writes state.
+
+set -uo pipefail
+
+ROOT=""
+PROMPT=""
+HAVE_PROMPT=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --root) ROOT="${2:-}"; shift 2 || shift ;;
+    --prompt) PROMPT="${2:-}"; HAVE_PROMPT=1; shift 2 || shift ;;
+    --help|-h)
+      sed -n '2,14p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *) shift ;;
+  esac
+done
+
+if [ "$HAVE_PROMPT" -eq 0 ] && [ ! -t 0 ]; then
+  PROMPT="$(cat 2>/dev/null || true)"
+fi
+: "${PROMPT:=}"
+
+emit() {
+  printf '{"company":"%s","source":"%s"}\n' "$1" "$2"
+  exit 0
+}
+
+if [ -z "$ROOT" ]; then
+  ROOT="${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && cd .. && pwd)}}"
+fi
+
+MANIFEST="$ROOT/companies/manifest.yaml"
+[ -f "$MANIFEST" ] || emit "" "none"
+
+SLUGS="$(
+  awk '
+    function keep(slug) {
+      return slug != "" && slug != "_template" && slug != "companies" && slug != "unaffiliated_repos"
+    }
+    /^companies:[[:space:]]*$/ { wrapped = 1; next }
+    wrapped && /^[^[:space:]][^:]*:[[:space:]]*$/ { wrapped = 0 }
+    wrapped && /^  [A-Za-z][A-Za-z0-9_-]*:/ {
+      line = $0; sub(/^[[:space:]]+/, "", line); sub(/:.*/, "", line)
+      if (keep(line)) print line
+      next
+    }
+    !wrapped && /^[A-Za-z][A-Za-z0-9_-]*:/ {
+      line = $0; sub(/:.*/, "", line)
+      if (keep(line)) print line
+    }
+  ' "$MANIFEST" | sort -u
+)"
+[ -n "$SLUGS" ] || emit "" "none"
+
+is_known_slug() {
+  printf '%s\n' "$SLUGS" | grep -Fxq "$1"
+}
+
+prompt_slug() {
+  local normalized="" match=""
+  [ -n "$PROMPT" ] || return 0
+  normalized="$(printf '%s' "$PROMPT" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9_-' ' ')"
+  match="$(
+    # Prompt normalization is case-insensitive, but company IDs are not.
+    # Keep a folded match only when exactly one registered ID has that key.
+    # If IDs differ only by case, do not guess which tenant the prompt means.
+    printf '%s\n' "$SLUGS" | awk -v line="$normalized" '
+      BEGIN {
+        n = split(line, tok, /[ \t]+/)
+        for (i = 1; i <= n; i++) if (tok[i] != "" && !(tok[i] in pos)) pos[tok[i]] = i
+        bestSlug = ""; bestLen = 0; bestPos = 0
+      }
+      {
+        slug = $0
+        key = tolower(slug)
+        if (key in pos) {
+          matches[key]++
+          candidate[key] = slug
+        }
+      }
+      END {
+        for (key in matches) {
+          if (matches[key] != 1) continue
+          slug = candidate[key]
+          len = length(slug); p = pos[key]
+          if (len > bestLen || (len == bestLen && p < bestPos)) {
+            bestSlug = slug; bestLen = len; bestPos = p
+          }
+        }
+        if (bestSlug != "") print bestSlug
+      }
+    '
+  )"
+  printf '%s' "$match"
+}
+
+MATCH="$(prompt_slug)"
+[ -n "$MATCH" ] && emit "$MATCH" "prompt"
+
+SESSION_CO=""
+if [ -x "$ROOT/core/scripts/hq-session.sh" ]; then
+  SESSION_CO="$(bash "$ROOT/core/scripts/hq-session.sh" get company_slug 2>/dev/null || true)"
+  SESSION_CO="$(printf '%s' "$SESSION_CO" | tr -d '[:space:]\"')"
+fi
+if [ -n "$SESSION_CO" ] && is_known_slug "$SESSION_CO"; then
+  emit "$SESSION_CO" "session"
+fi
+
+is_fleet_identity() {
+  [ -n "${HQ_AGENT_WORKDIR:-}" ] && return 0
+  [ -n "${HQ_AGENT_COMPANY_DIR:-}" ] && return 0
+  [ -n "${HQ_AGENT_IDENTITY_FILE:-}" ] && return 0
+  [ -f /etc/hq-agent/identity.json ] && return 0
+  [ -f /etc/hq-agent/machine-creds.json ] && return 0
+  agent_root="${HQ_AGENT_ROOT_PREFIX:-}"
+  if [ -n "$agent_root" ]; then
+    [ -f "${agent_root%/}/var/lib/hq-agent/identity.json" ] && return 0
+  else
+    [ -f /var/lib/hq-agent/identity.json ] && return 0
+  fi
+  [ -f /var/lib/hq-agent/machine-creds.json ] && return 0
+  return 1
+}
+
+run_with_timeout() {
+  command -v node >/dev/null 2>&1 || return 127
+  node -e '
+const { spawn } = require("child_process");
+const command = process.argv[1];
+if (!command) process.exit(127);
+const child = spawn(command, process.argv.slice(2), { detached: true, stdio: ["ignore", "pipe", "ignore"] });
+let finished = false;
+const finish = (status) => {
+  if (finished) return;
+  finished = true;
+  clearTimeout(timer);
+  try { process.kill(-child.pid, "SIGTERM"); } catch (_) {}
+  process.exit(status);
+};
+child.stdout.on("data", (chunk) => process.stdout.write(chunk));
+child.once("error", () => finish(127));
+child.once("exit", (code) => finish(typeof code === "number" ? code : 1));
+const timer = setTimeout(() => finish(124), 2000);
+' "$@"
+}
+
+if ! is_fleet_identity && command -v hq >/dev/null 2>&1 && command -v jq >/dev/null 2>&1; then
+  DEFAULT_JSON="$(run_with_timeout hq mesh context default get --json 2>/dev/null || true)"
+  DEFAULT_SLUG="$(printf '%s' "$DEFAULT_JSON" | jq -er '(.defaultCompany // .) as $default | if $default.enabled == true and ($default.source // "") != "disabled" and ($default.needsChoice // false) == false and ($default.slug | type == "string") then $default.slug else empty end' 2>/dev/null || true)"
+  DEFAULT_SLUG="$(printf '%s' "$DEFAULT_SLUG" | tr -d '[:space:]\"')"
+  if [ -n "$DEFAULT_SLUG" ] && is_known_slug "$DEFAULT_SLUG"; then
+    # A device default is only a local preference. Reconcile performs the
+    # token-backed active-membership check; never promote this fallback when
+    # that preflight is unavailable, times out, or returns a noncanonical row.
+    PREFLIGHT_SESSION_ID="resolve-default-$$-$RANDOM"
+    PREFLIGHT_OPERATION_ID="resolve-default-op-$$-$RANDOM"
+    PREFLIGHT_OBSERVATION="$(jq -cn \
+      --arg session_id "$PREFLIGHT_SESSION_ID" \
+      --arg operation_id "$PREFLIGHT_OPERATION_ID" \
+      --arg root "$ROOT" \
+      '{contractVersion:1,clientOperationId:$operation_id,identity:{sessionId:$session_id,harness:"hq-core",adapterVersion:"1"},cwd:$root,hqRoot:$root}')"
+    PREFLIGHT_STATUS=0
+    PREFLIGHT_RESULT="$(run_with_timeout hq mesh context reconcile --observation-json "$PREFLIGHT_OBSERVATION" --machine --offline 2>/dev/null)" || PREFLIGHT_STATUS=$?
+    VALIDATED_SLUG=""
+    if [ "$PREFLIGHT_STATUS" -eq 0 ]; then
+      VALIDATED_SLUG="$(printf '%s' "$PREFLIGHT_RESULT" | jq -er \
+        --arg slug "$DEFAULT_SLUG" \
+        --arg session_id "$PREFLIGHT_SESSION_ID" \
+        --arg operation_id "$PREFLIGHT_OPERATION_ID" '
+          if type == "object"
+            and .contractVersion == 1
+            and (.sessionId | type == "string") and .sessionId == $session_id
+            and (.clientOperationId | type == "string") and .clientOperationId == $operation_id
+            and (.kind == "queued" or .kind == "needs_project" or .kind == "needs_task" or .kind == "bound")
+            and (.classification == "needs_project" or .classification == "needs_task" or .classification == "bound")
+            and (.delivery == "queued" or .delivery == "acked")
+            and .lifecycle == "open"
+            and .companySlug == $slug
+            and (.companyUid | type == "string") and (.companyUid | length > 0)
+          then .companySlug else empty end
+        ' 2>/dev/null || true)"
+    fi
+    [ "$VALIDATED_SLUG" = "$DEFAULT_SLUG" ] && emit "$DEFAULT_SLUG" "device_default"
+  fi
+fi
+
+emit "" "none"

package/dist/command-catalog.generated.d.ts

@@ -5730,6 +5730,71 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [];
             readonly subcommands: readonly [];
         }];
+    }, {
+        readonly name: "resolve-company";
+        readonly description: "Resolve the active company for skills and routing";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "audit-log";
+        readonly description: "Append, query, or summarize the HQ audit log";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "git-pack-extension-check";
+        readonly description: "Find or repair extensionless Git pack files";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "pin";
+        readonly description: "Pin the current session to one goal";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "refresh-vault-access";
+        readonly description: "Refresh the local vault access manifest";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "worktree-gc";
         readonly description: "Safely collect old, preserved HQ worktrees";