@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/assets/scaffold/core/scripts/token-usage-report.sh

@@ -5,13 +5,15 @@
 #   scripts/token-usage-report.sh --last 14      # last 14 days
 #   scripts/token-usage-report.sh --since 2026-05-01
 #   scripts/token-usage-report.sh --json         # machine-readable
+#   scripts/token-usage-report.sh --project-dir <path> # read one activity folder
 #
 # Effective tokens weighting (matches weekly rate-limit volume):
 #   input + 5×output + 1.25×cache_creation + 0.1×cache_read
 
 set -euo pipefail
 
-PROJECT_DIR="${CLAUDE_PROJECTS_DIR:-$HOME/.claude/projects/-Users-{your-name}-Documents-HQ}"
+PROJECT_DIR=""
+PROJECT_DIR_SET=0
 LAST_DAYS=7
 SINCE=""
 JSON_MODE=0
@@ -24,6 +26,15 @@ while [ $# -gt 0 ]; do
     --last) LAST_DAYS="$2"; shift 2 ;;
     --since) SINCE="$2"; shift 2 ;;
     --json) JSON_MODE=1; shift ;;
+    --project-dir)
+      if [ "$#" -lt 2 ] || [ -z "$2" ]; then
+        echo "token-usage-report: --project-dir requires a path" >&2
+        exit 1
+      fi
+      PROJECT_DIR="$2"
+      PROJECT_DIR_SET=1
+      shift 2
+      ;;
     --compare-windows) shift ;;   # flag, presence triggers compare mode via --before/--after
     --before) COMPARE_BEFORE="$2"; shift 2 ;;
     --after)  COMPARE_AFTER="$2"; shift 2 ;;
@@ -38,14 +49,47 @@ done
 
 command -v node >/dev/null 2>&1 || { echo "token-usage-report: node is required" >&2; exit 1; }
 
+# Resolve roots in the same precedence order as the native command. Explicit
+# project directories and environment overrides select one exact activity root;
+# otherwise include standard, desktop-saved, and discovered Claude roots.
+PROJECT_DIRS=("")
+add_project_dir() {
+  local candidate="$1" existing
+  [ -d "$candidate" ] || return 0
+  for existing in "${PROJECT_DIRS[@]}"; do [ "$existing" = "$candidate" ] && return 0; done
+  PROJECT_DIRS+=("$candidate")
+}
+trim_env_path() {
+  local value="$1"
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  printf '%s' "$value"
+}
+if [ "$PROJECT_DIR_SET" -eq 1 ]; then
+  if [ ! -d "$PROJECT_DIR" ]; then echo "Project dir not found: $PROJECT_DIR" >&2; exit 1; fi
+  add_project_dir "$PROJECT_DIR"
+elif [ -n "$(trim_env_path "${CLAUDE_PROJECTS_DIR:-}")" ]; then
+  add_project_dir "$(trim_env_path "${CLAUDE_PROJECTS_DIR:-}")"
+elif [ -n "$(trim_env_path "${CLAUDE_CONFIG_DIR:-}")" ]; then
+  add_project_dir "$(trim_env_path "${CLAUDE_CONFIG_DIR:-}")/projects"
+else
+  add_project_dir "$HOME/.claude/projects"
+  SAVED_PROJECT_DIR="$(node -e 'try { const value = require(process.argv[1]).claudeProjectsDir; if (typeof value === "string" && value.trim()) process.stdout.write(value.trim()); } catch {}' "$HOME/.hq/menubar.json")"
+  [ -z "$SAVED_PROJECT_DIR" ] || add_project_dir "$SAVED_PROJECT_DIR"
+  for candidate in "$HOME"/.claude-*; do
+    [ -d "$candidate/projects" ] && add_project_dir "$candidate/projects"
+  done
+fi
+if [ "${#PROJECT_DIRS[@]}" -le 1 ]; then echo "Claude activity folders not found" >&2; exit 1; fi
+
 # --- Compare-windows mode (US-011) ---
 # Format: --before YYYY-MM-DD:YYYY-MM-DD --after YYYY-MM-DD:YYYY-MM-DD
 if [ -n "$COMPARE_BEFORE" ] && [ -n "$COMPARE_AFTER" ]; then
-  node - "$PROJECT_DIR" "$COMPARE_BEFORE" "$COMPARE_AFTER" "$MIN_HOURS" "$JSON_MODE" <<'JS'
+  node - "$COMPARE_BEFORE" "$COMPARE_AFTER" "$MIN_HOURS" "$JSON_MODE" "${PROJECT_DIRS[@]:1}" <<'JS'
 const fs = require("fs");
 const path = require("path");
 
-const [proj, before, after, minHoursS, jsonModeS] = process.argv.slice(2);
+const [before, after, minHoursS, jsonModeS, ...projectDirs] = process.argv.slice(2);
 const minHours = parseFloat(minHoursS);
 const jsonMode = parseInt(jsonModeS, 10) === 1;
 
@@ -54,13 +98,24 @@ const [bStart, bEnd] = parseRange(before);
 const [aStart, aEnd] = parseRange(after);
 
 const fmt = (n) => n.toLocaleString("en-US");
-const listJsonl = () => {
-  try { return fs.readdirSync(proj).filter((f) => f.endsWith(".jsonl")).sort(); } catch (e) { return []; }
+const listJsonl = (projectDir) => {
+  const found = [];
+  const visit = (current, relative) => {
+    let entries;
+    try { entries = fs.readdirSync(current, { withFileTypes: true }); } catch (e) { return; }
+    for (const entry of entries) {
+      const nextRelative = path.join(relative, entry.name);
+      if (entry.isDirectory() && entry.name !== "subagents") visit(path.join(current, entry.name), nextRelative);
+      else if (entry.isFile() && entry.name.endsWith(".jsonl")) found.push(nextRelative);
+    }
+  };
+  visit(projectDir, "");
+  return found.sort();
 };
 
 function collect(windowStart, windowEnd) {
   const rows = [];
-  for (const name of listJsonl()) {
+  for (const proj of projectDirs) for (const name of listJsonl(proj)) {
     const f = path.join(proj, name);
     let cr = 0, firstTs = null, lastTs = null;
     const sid = name.replace(/\.jsonl$/, "");
@@ -121,16 +176,11 @@ JS
   exit 0
 fi
 
-if [ ! -d "$PROJECT_DIR" ]; then
-  echo "Project dir not found: $PROJECT_DIR" >&2
-  exit 1
-fi
-
-node - "$PROJECT_DIR" "$LAST_DAYS" "$SINCE" "$JSON_MODE" <<'JS'
+node - "$LAST_DAYS" "$SINCE" "$JSON_MODE" "${PROJECT_DIRS[@]:1}" <<'JS'
 const fs = require("fs");
 const path = require("path");
 
-const [projectDir, lastDaysS, sinceS, jsonModeS] = process.argv.slice(2);
+const [lastDaysS, sinceS, jsonModeS, ...projectDirs] = process.argv.slice(2);
 const lastDays = parseInt(lastDaysS, 10);
 const jsonMode = parseInt(jsonModeS, 10) === 1;
 
@@ -147,11 +197,20 @@ const fmt = (n) => n.toLocaleString("en-US");
 const dayTotals = {};
 const sessionTotals = {};
 
-let names;
-try { names = fs.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).sort(); } catch (e) { names = []; }
-
-// Parent sessions only (top-level *.jsonl)
-for (const name of names) {
+// Parent sessions only; listJsonl skips each session's subagents/ tree.
+for (const projectDir of projectDirs) {
+  const listJsonl = (current, relative = "") => {
+    let entries;
+    try { entries = fs.readdirSync(current, { withFileTypes: true }); } catch (e) { return []; }
+    return entries.flatMap((entry) => {
+      const nextRelative = path.join(relative, entry.name);
+      if (entry.isDirectory() && entry.name !== "subagents") return listJsonl(path.join(current, entry.name), nextRelative);
+      if (entry.isFile() && entry.name.endsWith(".jsonl")) return [nextRelative];
+      return [];
+    }).sort();
+  };
+  const names = listJsonl(projectDir);
+  for (const name of names) {
   const f = path.join(projectDir, name);
   let mtime;
   try { mtime = fs.statSync(f).mtime; } catch (e) { continue; }
@@ -161,6 +220,7 @@ for (const name of names) {
   let firstTs = null, lastTs = null, firstUser = "";
   let subCount = 0;
   const sid = name.replace(/\.jsonl$/, "");
+  const sessionId = path.basename(path.dirname(projectDir)) + "/" + sid;
   let content;
   try { content = fs.readFileSync(f, "utf8"); } catch (e) { continue; }
   for (const line of content.split(/\r?\n/)) {
@@ -187,15 +247,16 @@ for (const name of names) {
   if (!day) day = mt;
   if (day < cutoff) continue;
   if (!dayTotals[day]) dayTotals[day] = { sessions: new Set(), inp: 0, out: 0, cc: 0, cr: 0 };
-  dayTotals[day].sessions.add(sid);
+  dayTotals[day].sessions.add(sessionId);
   dayTotals[day].inp += inp;
   dayTotals[day].out += out;
   dayTotals[day].cc += cc;
   dayTotals[day].cr += cr;
-  sessionTotals[sid] = {
+  sessionTotals[sessionId] = {
     day: day, inp: inp, out: out, cc: cc, cr: cr,
     eff: Math.trunc(eff), subagents: subCount, first_user: firstUser.split("\n").join(" "),
   };
+  }
 }
 
 const sortedDays = Object.keys(dayTotals).sort();

package/assets/scaffold/core/scripts/verify-story-deliverables.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# hq-core: public
+# verify-story-deliverables.sh — make `passes: true` checkable: verify the
+# evidence a story worker returns, and any deliverables the PRD declared
+# (2026-09-07).
+#
+# Why: a PRD "passes" flag recorded that a step RAN, not that work EXISTS. An
+# audit found a project marked 16/17 complete whose named deliverables mostly
+# did not exist anywhere. Nothing anywhere checked disk or git.
+#
+# Two inputs, both optional, deliberately NOT strict by default:
+#   * EVIDENCE — what the worker says it produced, returned at completion in
+#     the run-project / execute-task return contract (`evidence: [...]`, plus
+#     `commits: [...]` which are checked as `commit:` evidence). This is the
+#     primary signal: it is written at the moment of completion, so it is
+#     accurate to what was built, and --write records it on the story as an
+#     audit trail. A claimed-but-missing item FAILS (a fabricated claim is
+#     worse than no claim). No evidence at all is allowed (legacy workers).
+#   * DELIVERABLES — what the PRD declared up front (optional). Checked when
+#     present; a planned-but-missing item fails, because that is exactly the
+#     "16/17 complete, nothing on disk" case.
+#
+# Usage:
+#   verify-story-deliverables.sh --prd <prd.json> --story <id> [--repo <path>]
+#       [--evidence-json '<array>'] [--commits-json '<array>'] [--write] [--json] [--strict]
+#
+# Reference forms (evidence and deliverables share them):
+#   "deliverables": [
+#     "path:core/scripts/foo.sh",            # file or dir, relative to HQ root
+#     "repo-path:src/lib/bar.ts",            # relative to --repo (or metadata.repoPath)
+#     "branch:feature/x",                    # branch exists in --repo (local or origin)
+#     "commit:<sha-prefix>",                 # commit reachable in --repo
+#     "url:https://…"                        # HTTP 2xx/3xx (skipped with --offline)
+#   ]
+#   A bare string without a prefix is treated as "path:".
+#
+# Exit 0: every checked reference present. With nothing to check (no evidence,
+#         no declared deliverables) this is reported as "unverified" and still
+#         exits 0 — pass --strict to make that a failure.
+# Exit 3: one or more references missing (each is named on stderr).
+# Exit 2: usage / unreadable PRD / unknown story.
+# --write: on exit 0, record the verified references on the story in prd.json as
+#          `evidence: [{ref, verifiedAt}]` (only that field is touched).
+set -uo pipefail
+
+HQ_ROOT="${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}}"
+PRD=""; STORY=""; REPO=""; JSON=0; STRICT=0; WRITE=0; EVIDENCE_JSON="[]"; COMMITS_JSON="[]"; OFFLINE="${HQ_DELIVERABLES_OFFLINE:-0}"
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --prd) PRD="$2"; shift 2 ;;
+    --story) STORY="$2"; shift 2 ;;
+    --repo) REPO="$2"; shift 2 ;;
+    --evidence-json) EVIDENCE_JSON="$2"; shift 2 ;;
+    --commits-json) COMMITS_JSON="$2"; shift 2 ;;
+    --write) WRITE=1; shift ;;
+    --json) JSON=1; shift ;;
+    --strict) STRICT=1; shift ;;
+    --offline) OFFLINE=1; shift ;;
+    -h|--help) sed -n 2,30p "$0"; exit 0 ;;
+    *) echo "verify-story-deliverables: unknown arg $1" >&2; exit 2 ;;
+  esac
+done
+[ -n "$PRD" ] && [ -n "$STORY" ] || { echo "usage: --prd <prd.json> --story <id> [--repo <path>]" >&2; exit 2; }
+[ -r "$PRD" ] || { echo "verify-story-deliverables: cannot read $PRD" >&2; exit 2; }
+command -v jq >/dev/null 2>&1 || { echo "verify-story-deliverables: jq required" >&2; exit 2; }
+
+jq_capture() {
+  # jq.exe emits CRLF from Windows Bash; strip CR from every captured line.
+  jq "$@" | sed 's/\r$//'
+}
+
+story_json="$(jq_capture -c --arg id "$STORY" '.userStories[]? | select(.id == $id)' "$PRD" 2>/dev/null | head -1)"
+[ -n "$story_json" ] || { echo "verify-story-deliverables: story $STORY not in $PRD" >&2; exit 2; }
+[ -n "$REPO" ] || REPO="$(jq_capture -r '.metadata.repoPath // empty' "$PRD" 2>/dev/null)"
+case "$REPO" in ""|/*) ;; *) REPO="$HQ_ROOT/$REPO" ;; esac
+
+jq -e 'type == "array"' <<<"$EVIDENCE_JSON" >/dev/null 2>&1 || { echo "verify-story-deliverables: --evidence-json must be a JSON array" >&2; exit 2; }
+jq -e 'type == "array"' <<<"$COMMITS_JSON" >/dev/null 2>&1 || { echo "verify-story-deliverables: --commits-json must be a JSON array" >&2; exit 2; }
+# Everything to check: declared deliverables + worker evidence + worker commits
+# (as commit: refs), de-duplicated, in that order.
+REFS_JSON="$(jq_capture -cn --argjson d "$(printf '%s' "$story_json" | jq_capture -c '(.deliverables // [])')" --argjson e "$EVIDENCE_JSON" --argjson c "$COMMITS_JSON" \
+  '($d + $e + ($c | map("commit:" + tostring))) | map(select(type == "string" and length > 0)) | unique')"
+count="$(jq_capture -r 'length' <<<"$REFS_JSON")"
+declared="$(printf '%s' "$story_json" | jq_capture -r '(.deliverables // []) | length')"
+if [ "$count" = "0" ]; then
+  if [ "$STRICT" = "1" ]; then
+    echo "verify-story-deliverables: $STORY has no evidence and declares no deliverables (--strict)" >&2
+    [ "$JSON" = 1 ] && printf '{"story":"%s","status":"unverified","missing":[],"present":[]}\n' "$STORY"
+    exit 3
+  fi
+  [ "$JSON" = 1 ] && printf '{"story":"%s","status":"unverified","missing":[],"present":[]}\n' "$STORY" \
+    || echo "verify-story-deliverables: $STORY — nothing to verify (worker returned no evidence; PRD declares no deliverables). Allowed, but this done-mark is unverified."
+  exit 0
+fi
+
+present=(); missing=()
+while IFS= read -r d; do
+  [ -n "$d" ] || continue
+  kind="${d%%:*}"; val="${d#*:}"
+  case "$d" in *:*) ;; *) kind="path"; val="$d" ;; esac
+  ok=0
+  case "$kind" in
+    path)
+      case "$val" in /*) t="$val" ;; *) t="$HQ_ROOT/$val" ;; esac
+      [ -e "$t" ] && ok=1 ;;
+    repo-path)
+      [ -n "$REPO" ] && [ -e "$REPO/$val" ] && ok=1 ;;
+    branch)
+      [ -n "$REPO" ] && [ -d "$REPO" ] && {
+        git -C "$REPO" show-ref --verify --quiet "refs/heads/$val" \
+        || git -C "$REPO" show-ref --verify --quiet "refs/remotes/origin/$val"; } && ok=1 ;;
+    commit)
+      [ -n "$REPO" ] && [ -d "$REPO" ] && git -C "$REPO" cat-file -e "${val}^{commit}" 2>/dev/null && ok=1 ;;
+    url)
+      if [ "$OFFLINE" = "1" ]; then ok=1
+      else
+        code="$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 -L "$val" 2>/dev/null || echo 000)"
+        case "$code" in 2*|3*) ok=1 ;; esac
+      fi ;;
+    *) ok=0 ;;
+  esac
+  if [ "$ok" = 1 ]; then present+=("$d"); else missing+=("$d"); fi
+done < <(jq_capture -r '.[]' <<<"$REFS_JSON")
+
+if [ "$JSON" = 1 ]; then
+  jq -cn --arg s "$STORY" \
+    --argjson m "$(printf '%s\n' "${missing[@]:-}" | jq_capture -R . | jq_capture -s 'map(select(. != ""))')" \
+    --argjson p "$(printf '%s\n' "${present[@]:-}" | jq_capture -R . | jq_capture -s 'map(select(. != ""))')" \
+    '{story:$s, status:(if ($m|length)==0 then "present" else "missing" end), missing:$m, present:$p}'
+fi
+if [ "${#missing[@]}" -gt 0 ]; then
+  echo "verify-story-deliverables: $STORY is NOT verifiably complete — ${#missing[@]} of $count reference(s) do not exist:" >&2
+  for d in "${missing[@]}"; do echo "  - $d" >&2; done
+  echo "Do not write passes:true. A claimed path/branch/commit/URL must exist; a declared deliverable must be produced (or the declaration corrected)." >&2
+  exit 3
+fi
+if [ "$WRITE" = 1 ]; then
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  jq_capture --arg id "$STORY" --arg now "$now" --argjson refs "$(printf '%s\n' "${present[@]}" | jq_capture -R . | jq_capture -s 'map(select(. != ""))')" \
+    '.userStories = (.userStories | map(if .id == $id then .evidence = ($refs | map({ref: ., verifiedAt: $now})) else . end))' \
+    "$PRD" > "$PRD.tmp" && mv "$PRD.tmp" "$PRD"
+fi
+recorded_suffix=""
+if [ "$WRITE" = 1 ]; then
+  recorded_suffix="; recorded on the story"
+fi
+[ "$JSON" = 1 ] || echo "verify-story-deliverables: $STORY — all $count reference(s) present ($declared declared, $((count - declared)) from worker evidence)$recorded_suffix"
+exit 0

package/assets/scaffold/core/scripts/work-mesh-live-bind-trusted.sh

@@ -0,0 +1,152 @@
+#!/usr/bin/env bash
+# hq-core: public
+# US-011 — write session meta + reconcile with observation.trustedContext.
+# No --trusted CLI flag in hq-cli; trusted bind is the observation field.
+set -euo pipefail
+
+ROOT="${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-}}"
+if [ -z "$ROOT" ]; then
+  ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+fi
+
+COMPANY=""
+PROJECT=""
+TASK=""
+SESSION_ID=""
+NO_RECONCILE=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --company|--company-slug) COMPANY="${2:-}"; shift 2 ;;
+    --project) PROJECT="${2:-}"; shift 2 ;;
+    --task) TASK="${2:-}"; shift 2 ;;
+    --session|--session-id) SESSION_ID="${2:-}"; shift 2 ;;
+    --no-reconcile) NO_RECONCILE=1; shift ;;
+    --root) ROOT="${2:-}"; shift 2 ;;
+    -h|--help)
+      sed -n '2,8p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *) shift ;;
+  esac
+done
+
+HQ_SESSION="$ROOT/core/scripts/hq-session.sh"
+
+# Resolve session id before metadata writes so a known session is pinned even
+# when the caller omitted --session-id. Empty `pin` must still be safe on
+# macOS Bash 3.2 (`set -u` + `"${pin[@]}"` is an unbound-variable abort).
+if [ -z "$SESSION_ID" ]; then
+  SESSION_ID="${HQ_SESSION_ID:-${CLAUDE_CODE_SESSION_ID:-${CLAUDE_SESSION_ID:-${CODEX_SESSION_ID:-${CODEX_THREAD_ID:-}}}}}"
+  SESSION_ID="$(printf '%s' "$SESSION_ID" | tr -d '[:space:]')"
+  if [ -z "$SESSION_ID" ] && [ -f "$ROOT/workspace/sessions/.current" ]; then
+    SESSION_ID="$(tr -d '[:space:]' <"$ROOT/workspace/sessions/.current")"
+  fi
+fi
+
+pin=()
+if [ -n "$SESSION_ID" ]; then
+  pin=(--session-id "$SESSION_ID")
+fi
+
+if [ -n "$COMPANY" ]; then
+  bash "$HQ_SESSION" ${pin[@]+"${pin[@]}"} set company_slug "$COMPANY"
+fi
+if [ -n "$PROJECT" ]; then
+  bash "$HQ_SESSION" ${pin[@]+"${pin[@]}"} set project "$PROJECT"
+fi
+if [ -n "$TASK" ]; then
+  bash "$HQ_SESSION" ${pin[@]+"${pin[@]}"} set task "$TASK"
+fi
+
+if [ "$NO_RECONCILE" -eq 1 ]; then
+  exit 0
+fi
+
+[ -n "$SESSION_ID" ] || exit 0
+
+# shellcheck source=lib/work-mesh-enqueue.sh
+. "$ROOT/core/scripts/lib/work-mesh-enqueue.sh" 2>/dev/null || true
+
+HARNESS="${HQ_HARNESS:-${HQ_WORK_MESH_HARNESS:-claude-code}}"
+case "$HARNESS" in
+  claude|Claude|ClaudeCode) HARNESS=claude-code ;;
+  Codex) HARNESS=codex ;;
+  Grok) HARNESS=grok ;;
+esac
+ADAPTER="${HQ_ADAPTER_CONTRACT_VERSION:-1.0.0}"
+
+if command -v work_mesh_ulid >/dev/null 2>&1; then
+  work_mesh_ulid >/dev/null; CLIENT_OP=$REPLY
+else
+  CLIENT_OP="cop_$(date +%s)_$$"
+fi
+
+json_quote() {
+  if command -v work_mesh_json_quote >/dev/null 2>&1; then
+    work_mesh_json_quote "$1"; printf '%s' "$REPLY"
+    return 0
+  fi
+  if command -v jq >/dev/null 2>&1; then
+    jq -n --arg s "$1" '$s'
+    return 0
+  fi
+  # bash-only fallback (hooks-no-python)
+  local s=$1
+  s=${s//'\'/'\\'}
+  s=${s//'"'/'\"'}
+  s=${s//$'\n'/'\n'}
+  s=${s//$'\r'/'\r'}
+  s=${s//$'\t'/'\t'}
+  printf '"%s"' "$s"
+}
+
+_q_sid="$(json_quote "$SESSION_ID")"
+_q_har="$(json_quote "$HARNESS")"
+_q_ad="$(json_quote "$ADAPTER")"
+_q_op="$(json_quote "$CLIENT_OP")"
+_q_cwd="$(json_quote "${PWD:-}")"
+_q_root="$(json_quote "$ROOT")"
+
+OBS='{"contractVersion":1,"clientOperationId":'"$_q_op"',"identity":{"sessionId":'"$_q_sid"',"harness":'"$_q_har"',"adapterVersion":'"$_q_ad"'},"cwd":'"$_q_cwd"',"hqRoot":'"$_q_root"
+if [ -n "$COMPANY" ] || [ -n "$PROJECT" ] || [ -n "$TASK" ]; then
+  OBS+=',"trustedContext":{'
+  _first=1
+  if [ -n "$COMPANY" ]; then
+    OBS+='"companySlug":'"$(json_quote "$COMPANY")"
+    _first=0
+  fi
+  if [ -n "$PROJECT" ]; then
+    [ "$_first" -eq 1 ] || OBS+=','
+    OBS+='"project":'"$(json_quote "$PROJECT")"
+    _first=0
+  fi
+  if [ -n "$TASK" ]; then
+    [ "$_first" -eq 1 ] || OBS+=','
+    OBS+='"task":'"$(json_quote "$TASK")"
+  fi
+  OBS+='}'
+fi
+OBS+='}'
+
+OBS_DIR="${TMPDIR:-/tmp}/hq-work-mesh-obs"
+mkdir -p -- "$OBS_DIR" 2>/dev/null || true
+chmod 700 -- "$OBS_DIR" 2>/dev/null || true
+OBS_FILE="$OBS_DIR/$SESSION_ID.bind.$$.json"
+printf '%s\n' "$OBS" >"$OBS_FILE"
+
+if [ -n "${HQ_WORK_MESH_RECONCILE_LOG:-}" ]; then
+  printf 'reconcile-trusted %s\n' "$OBS_FILE" >>"$HQ_WORK_MESH_RECONCILE_LOG" 2>/dev/null || true
+fi
+
+if [ "${HQ_WORK_MESH_RECONCILE_STUB:-}" = "1" ]; then
+  exit 0
+fi
+
+HQ_BIN="$(command -v hq 2>/dev/null || true)"
+if [ -n "$HQ_BIN" ] && [ -f "$OBS_FILE" ]; then
+  nohup "$HQ_BIN" mesh context reconcile --observation-file "$OBS_FILE" --machine \
+    >/dev/null 2>&1 </dev/null &
+  disown 2>/dev/null || true
+fi
+exit 0

package/assets/scaffold/core/scripts/work-mesh-live-rebind.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# hq-core: public
+# US-011 — enqueue session_end/session_start when project binding changes.
+# Usage:
+#   work-mesh-live-rebind.sh --session <sid>
+#     Read state file and rebind if project changed vs live-binding marker.
+#   work-mesh-live-rebind.sh --session <sid> \
+#     --old-company C --old-project P [--old-task T] \
+#     --company C2 --project P2 [--task T2]
+set -euo pipefail
+
+ROOT="${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-}}"
+if [ -z "$ROOT" ]; then
+  ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+fi
+export HQ_ROOT="$ROOT"
+
+# shellcheck source=lib/work-mesh-enqueue.sh
+. "$ROOT/core/scripts/lib/work-mesh-enqueue.sh"
+# shellcheck source=lib/work-mesh-live-hook.sh
+. "$ROOT/core/scripts/lib/work-mesh-live-hook.sh" 2>/dev/null || true
+# shellcheck source=lib/work-mesh-live-rebind.sh
+. "$ROOT/core/scripts/lib/work-mesh-live-rebind.sh"
+
+SID=""
+OLD_CO="" OLD_PR="" OLD_TK=""
+NEW_CO="" NEW_PR="" NEW_TK=""
+FROM_STATE=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --session|--session-id) SID="${2:-}"; shift 2 ;;
+    --old-company) OLD_CO="${2:-}"; shift 2 ;;
+    --old-project) OLD_PR="${2:-}"; shift 2 ;;
+    --old-task) OLD_TK="${2:-}"; shift 2 ;;
+    --company|--company-slug) NEW_CO="${2:-}"; shift 2 ;;
+    --project) NEW_PR="${2:-}"; shift 2 ;;
+    --task) NEW_TK="${2:-}"; shift 2 ;;
+    --from-state) FROM_STATE=1; shift ;;
+    *) shift ;;
+  esac
+done
+
+[ -n "$SID" ] || { echo "usage: work-mesh-live-rebind.sh --session <sid> ..." >&2; exit 1; }
+
+if [ "$FROM_STATE" -eq 1 ] || [ -z "$NEW_PR" ]; then
+  work_mesh_live_maybe_rebind_from_state "$SID"
+else
+  if [ -z "$OLD_PR" ]; then
+    work_mesh_live_read_binding_marker "$SID"
+    old=$REPLY
+    OLD_CO="${old%%|*}"
+    rest="${old#*|}"
+    OLD_PR="${rest%%|*}"
+    OLD_TK="${rest#*|}"
+  fi
+  work_mesh_live_rebind "$SID" "$OLD_CO" "$OLD_PR" "$OLD_TK" "$NEW_CO" "$NEW_PR" "$NEW_TK"
+fi
+exit 0