@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/lib/mesh/live/daemon/board-refresh.js

@@ -1,12 +1,16 @@
 /**
  * Refresh ~/.hq/work-context/sessions/<sid>/board.md for bound sessions
- * from GET /companies/{companyUid}/board at most every 60s.
+ * from the ProjectView read route at most every 60s.
+ *
+ * Board JSON remains the fallback for older projects, but story status is
+ * authoritative in ProjectView because `hq mesh story` writes there.
  * Metadata-only snapshot — never prompts or tokens.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { workContextSessionsDir } from "../../../work-context/paths.js";
 import { readSessionState } from "../../../work-context/state.js";
+import { mapReaderStoryStatus } from "../../story-status.js";
 import { sessionBoardPath } from "./paths.js";
 export const BOARD_REFRESH_INTERVAL_MS = 60_000;
 function listBoundSessionIds(workContextRoot) {
@@ -89,6 +93,12 @@ export async function refreshBoundSessionBoards(deps) {
             skipped += 1;
             continue;
         }
+        if (state.companyConfidence === "device_default" &&
+            deps.authorizeDeviceDefaultTenant &&
+            !(await deps.authorizeDeviceDefaultTenant(sessionId, state))) {
+            skipped += 1;
+            continue;
+        }
         try {
             const board = await deps.readBoard(state.companyUid, state.projectId);
             if (!board) {
@@ -115,9 +125,72 @@ export async function refreshBoundSessionBoards(deps) {
     }
     return { refreshed, skipped, errors };
 }
+function storiesFromProject(project) {
+    const storiesRaw = Array.isArray(project.stories) ? project.stories : [];
+    const stories = [];
+    for (const s of storiesRaw) {
+        if (!s || typeof s !== "object" || Array.isArray(s))
+            continue;
+        const row = s;
+        const id = typeof row.id === "string"
+            ? row.id
+            : typeof row.storyId === "string"
+                ? row.storyId
+                : typeof row.taskId === "string"
+                    ? row.taskId
+                    : "";
+        if (!id)
+            continue;
+        stories.push({
+            id,
+            title: typeof row.title === "string"
+                ? row.title.slice(0, 120)
+                : typeof row.name === "string"
+                    ? row.name.slice(0, 120)
+                    : undefined,
+            status: mapReaderStoryStatus(row),
+        });
+    }
+    return stories;
+}
+function projectViewSnapshot(raw, companyUid, projectId) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const project = raw;
+    if (project.companyUid !== companyUid || project.projectId !== projectId)
+        return null;
+    return {
+        projectId,
+        projectName: typeof project.name === "string"
+            ? project.name
+            : typeof project.title === "string"
+                ? project.title
+                : undefined,
+        stories: storiesFromProject(project),
+    };
+}
+function isMissingProject(error) {
+    // hq-pro's GET ProjectView handler emits PROJECT_VIEW_NOT_FOUND; retain the
+    // legacy PROJECT_NOT_FOUND code for compatibility with older producers.
+    return (error instanceof Error &&
+        /^404\s+(?:PROJECT_VIEW_NOT_FOUND|PROJECT_NOT_FOUND)\b/.test(error.message));
+}
 /** Build a BoardReader from meshJson-compatible fetch. */
 export function createVaultBoardReader(opts) {
     return async (companyUid, projectId) => {
+        // ProjectView is the live story-status source. Only use board.json when
+        // this project has not been migrated into ProjectView yet.
+        try {
+            const view = await opts.getJson(`/v1/work-mesh/projects/${encodeURIComponent(projectId)}?companyUid=${encodeURIComponent(companyUid)}`);
+            const snapshot = projectViewSnapshot(view, companyUid, projectId);
+            if (snapshot)
+                return snapshot;
+            throw new Error("ProjectView response did not match the requested company and project");
+        }
+        catch (error) {
+            if (!isMissingProject(error))
+                throw error;
+        }
         const raw = await opts.getJson(`/companies/${encodeURIComponent(companyUid)}/board`);
         if (!raw || typeof raw !== "object")
             return null;
@@ -140,35 +213,10 @@ export function createVaultBoardReader(opts) {
             const id = typeof p.id === "string" ? p.id : typeof p.projectId === "string" ? p.projectId : "";
             if (id !== projectId)
                 continue;
-            const storiesRaw = Array.isArray(p.stories)
-                ? p.stories
-                : Array.isArray(p.tasks)
-                    ? p.tasks
-                    : [];
-            const stories = [];
-            for (const s of storiesRaw) {
-                if (!s || typeof s !== "object" || Array.isArray(s))
-                    continue;
-                const row = s;
-                const sid = typeof row.id === "string"
-                    ? row.id
-                    : typeof row.storyId === "string"
-                        ? row.storyId
-                        : typeof row.taskId === "string"
-                            ? row.taskId
-                            : "";
-                if (!sid)
-                    continue;
-                stories.push({
-                    id: sid,
-                    title: typeof row.title === "string"
-                        ? row.title.slice(0, 120)
-                        : typeof row.name === "string"
-                            ? row.name.slice(0, 120)
-                            : undefined,
-                    status: typeof row.status === "string" ? row.status : undefined,
-                });
-            }
+            const stories = storiesFromProject({
+                ...p,
+                stories: Array.isArray(p.stories) ? p.stories : p.tasks,
+            });
             return {
                 projectId,
                 projectName: typeof p.name === "string"

package/dist/lib/mesh/live/daemon/config.d.ts

@@ -0,0 +1,36 @@
+export interface DaemonConfig {
+    trustedHqRoots: string[];
+}
+export declare function daemonConfigPath(daemonDirectory: string): string;
+export declare function verifyHqRoot(candidate: string | undefined): string | null;
+/**
+ * A directory the daemon may be installed for: it must carry
+ * companies/manifest.yaml (what verifyHqRoot demands at runtime) and one of
+ * the tree markers utils/hq-roots.ts accepts (core/, .claude/, personal/).
+ * A bare .claude/ directory — every repo with Claude settings has one — is
+ * not an HQ root and must never be persisted or passed as --hq-root.
+ */
+export declare function isInstallableHqRoot(dir: string): boolean;
+/** Nearest ancestor of startDir (inclusive) that is an installable HQ root, realpath'd; null if none. */
+export declare function findAncestorHqRoot(startDir: string): string | null;
+export interface InstallHqRootResolution {
+    root: string;
+    source: "flag" | "env" | "ancestor";
+}
+/**
+ * Resolve the HQ root `hq mesh daemon install` records and passes to the
+ * service. Precedence: --hq-root, then HQ_ROOT, then the nearest ancestor of
+ * cwd that is an installable HQ root. An explicit value that is not an HQ
+ * root is an error rather than a silent fallback, and with nothing
+ * qualifying the install is refused: an unverified root would be persisted
+ * and trusted by the daemon for company attribution.
+ */
+export declare function resolveInstallHqRoot(opts?: {
+    explicit?: string;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+}): InstallHqRootResolution;
+export declare function readDaemonConfig(daemonDirectory: string): DaemonConfig;
+/** Record a verified local HQ checkout without trusting a caller-supplied path at runtime. */
+export declare function registerTrustedHqRoot(daemonDirectory: string, candidate: string | undefined): DaemonConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/lib/mesh/live/daemon/config.js

@@ -0,0 +1,120 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+export function daemonConfigPath(daemonDirectory) {
+    return path.join(daemonDirectory, "config.json");
+}
+export function verifyHqRoot(candidate) {
+    if (!candidate?.trim())
+        return null;
+    try {
+        const root = fs.realpathSync(candidate);
+        return fs.statSync(path.join(root, "companies", "manifest.yaml")).isFile()
+            ? root
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A directory the daemon may be installed for: it must carry
+ * companies/manifest.yaml (what verifyHqRoot demands at runtime) and one of
+ * the tree markers utils/hq-roots.ts accepts (core/, .claude/, personal/).
+ * A bare .claude/ directory — every repo with Claude settings has one — is
+ * not an HQ root and must never be persisted or passed as --hq-root.
+ */
+export function isInstallableHqRoot(dir) {
+    if (verifyHqRoot(dir) === null)
+        return false;
+    return ["core", ".claude", "personal"].some((marker) => {
+        try {
+            return fs.statSync(path.join(dir, marker)).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** Nearest ancestor of startDir (inclusive) that is an installable HQ root, realpath'd; null if none. */
+export function findAncestorHqRoot(startDir) {
+    let dir;
+    try {
+        dir = fs.realpathSync(startDir);
+    }
+    catch {
+        dir = path.resolve(startDir);
+    }
+    for (;;) {
+        if (isInstallableHqRoot(dir))
+            return fs.realpathSync(dir);
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Resolve the HQ root `hq mesh daemon install` records and passes to the
+ * service. Precedence: --hq-root, then HQ_ROOT, then the nearest ancestor of
+ * cwd that is an installable HQ root. An explicit value that is not an HQ
+ * root is an error rather than a silent fallback, and with nothing
+ * qualifying the install is refused: an unverified root would be persisted
+ * and trusted by the daemon for company attribution.
+ */
+export function resolveInstallHqRoot(opts = {}) {
+    const env = opts.env ?? process.env;
+    const cwd = opts.cwd ?? process.cwd();
+    const explicit = opts.explicit?.trim();
+    if (explicit) {
+        if (!isInstallableHqRoot(explicit)) {
+            throw expectedError(`--hq-root ${explicit} is not an HQ root (needs companies/manifest.yaml plus core/, .claude/, or personal/).`);
+        }
+        return { root: fs.realpathSync(explicit), source: "flag" };
+    }
+    const fromEnv = env.HQ_ROOT?.trim();
+    if (fromEnv) {
+        if (!isInstallableHqRoot(fromEnv)) {
+            throw expectedError(`HQ_ROOT=${fromEnv} is not an HQ root (needs companies/manifest.yaml plus core/, .claude/, or personal/). ` +
+                `Fix HQ_ROOT or pass --hq-root <path>.`);
+        }
+        return { root: fs.realpathSync(fromEnv), source: "env" };
+    }
+    const ancestor = findAncestorHqRoot(cwd);
+    if (!ancestor) {
+        throw expectedError(`No HQ root found above ${cwd} (a directory with companies/manifest.yaml plus core/, .claude/, or personal/). ` +
+            `Run from inside your HQ tree or pass --hq-root <path>.`);
+    }
+    return { root: ancestor, source: "ancestor" };
+}
+function expectedError(message) {
+    const err = new Error(message);
+    err.expected = true;
+    return err;
+}
+export function readDaemonConfig(daemonDirectory) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(daemonConfigPath(daemonDirectory), "utf8"));
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return { trustedHqRoots: [] };
+        const roots = raw.trustedHqRoots;
+        if (!Array.isArray(roots))
+            return { trustedHqRoots: [] };
+        return { trustedHqRoots: roots.filter((root) => typeof root === "string")
+                .map(verifyHqRoot).filter((root) => Boolean(root)) };
+    }
+    catch {
+        return { trustedHqRoots: [] };
+    }
+}
+/** Record a verified local HQ checkout without trusting a caller-supplied path at runtime. */
+export function registerTrustedHqRoot(daemonDirectory, candidate) {
+    const root = verifyHqRoot(candidate);
+    const current = readDaemonConfig(daemonDirectory);
+    if (!root || current.trustedHqRoots.includes(root))
+        return current;
+    const next = { trustedHqRoots: [...current.trustedHqRoots, root] };
+    fs.mkdirSync(daemonDirectory, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(daemonConfigPath(daemonDirectory), `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    return next;
+}
+//# sourceMappingURL=config.js.map

package/dist/lib/mesh/live/daemon/credentials.d.ts

@@ -3,14 +3,7 @@
  * Never logs or persists credential material.
  */
 import type { IotCredentials } from "./presign.js";
-export declare const REALTIME_CREDENTIALS_PATH = "/v1/realtime/credentials";
 export declare const MQTT_KEEPALIVE_SECONDS = 15;
-/** Renew at 80% of credential lifetime. */
-export declare const CREDENTIAL_RENEWAL_FRACTION = 0.8;
-export declare const MIN_RENEWAL_DELAY_MS = 5000;
-/** Long retry when the server refuses credentials (disabled / unsupported). */
-export declare const DEFAULT_REFUSED_RETRY_MS: number;
-export declare const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 /**
  * Node's setTimeout treats delays above this as ~1ms (signed 32-bit overflow).
  * Always schedule long waits via {@link scheduleBoundedTimeout}.
@@ -18,6 +11,8 @@ export declare const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 export declare const MAX_TIMER_DELAY_MS = 2147483647;
 /** Cap any single retry so a bogus Retry-After cannot park the daemon. */
 export declare const MAX_RETRY_DELAY_MS: number;
+/** Preferred-set changes re-vend at most this often. */
+export declare const PREFERRED_REVEND_MIN_MS = 60000;
 export type CredentialVendFailureKind = "refused" | "transient";
 /**
  * Typed vend failure. `refused` = server will not vend right now
@@ -38,17 +33,23 @@ export declare class CredentialVendError extends Error {
     });
 }
 export declare function parseRetryAfterMs(value: string | null | undefined, nowMs?: number): number | undefined;
-export declare function extractVendErrorCode(body: unknown): string | undefined;
 /** True for server "not now" responses that should use the long retry. */
 export declare function isCredentialVendRefused(status: number, code: string | undefined): boolean;
 export declare function classifyCredentialVendFailure(status: number, body: unknown, retryAfterHeader?: string | null, nowMs?: number): CredentialVendError;
 export declare function defaultRefusedRetryMs(env?: NodeJS.ProcessEnv): number;
 /** ±20% jitter around the refused-retry base interval. */
 export declare function refusedRetryDelayMs(baseMs: number, random: () => number): number;
-export interface PresenceCompany {
+interface PresenceCompany {
     companyUid: string;
     presenceTopic: string;
 }
+export interface DroppedPresenceCompany {
+    companyUid: string;
+    /** Short name for doctor text when the server sent one. */
+    label?: string;
+    /** Server-supplied cause when available; otherwise a deliberately neutral label. */
+    reason: string;
+}
 export interface Contract3Bundle {
     contractVersion: 3;
     credentials: IotCredentials;
@@ -58,7 +59,7 @@ export interface Contract3Bundle {
     actorUid: string;
     actorType: "human" | "agent";
     companies: PresenceCompany[];
-    droppedCompanies: string[];
+    droppedCompanies: DroppedPresenceCompany[];
     expiresAt: string;
 }
 export type CredentialsFetcher = () => Promise<Contract3Bundle>;
@@ -93,6 +94,26 @@ export declare function normalizeContract3Bundle(raw: unknown): Contract3Bundle;
  * No identity file → return the bundle unchanged (person laptop).
  */
 export declare function scopeBundleToAgentIdentity(bundle: Contract3Bundle, env?: NodeJS.ProcessEnv): Contract3Bundle;
+/**
+ * Device default first, then distinct company uids from session files updated
+ * in the last 24 hours, newest first, max 5. Any read error returns undefined
+ * so the vend body omits the field.
+ */
+export declare function readPreferredCompanyUids(input: {
+    workContextRoot: string;
+    nowMs?: number;
+}): string[] | undefined;
+export declare function preferredCompanyKey(uids: readonly string[] | undefined): string;
+/** True when a new preferred set should force a vend, at most once per minute. */
+export declare function shouldRevendPreferredCompanies(input: {
+    previous: readonly string[] | undefined;
+    next: readonly string[] | undefined;
+    lastVendMs: number;
+    nowMs: number;
+    minIntervalMs?: number;
+}): boolean;
+/** Plain doctor line for one company the vend left out. */
+export declare function formatDroppedPresenceCompany(company: DroppedPresenceCompany): string;
 export type CredentialVendPostResult = {
     status: number;
     body: unknown;
@@ -105,6 +126,8 @@ export declare function createContract3Fetcher(opts: {
     post?: (path: string, body: unknown) => Promise<CredentialVendPostResult>;
     /** Process env for identity-file scoping (tests). */
     env?: NodeJS.ProcessEnv;
+    /** Companies to ask for. Undefined (read error) omits the field. */
+    readPreferredCompanyUids?: () => string[] | undefined;
 }): CredentialsFetcher;
 export interface CredentialRenewalErrorInfo {
     /** Absolute ISO timestamp when the renewal retry is scheduled to fire. */
@@ -125,10 +148,41 @@ export declare class CredentialRenewalManager {
     private readonly random;
     private handle;
     private stopped;
+    private inflight;
     constructor(fetchCredentials: CredentialsFetcher, onRenewed: (bundle: Contract3Bundle) => void, onError?: (err: unknown, info?: CredentialRenewalErrorInfo) => void, timers?: TimerHost, retryDelayMs?: number, refusedRetryMs?: number, random?: () => number);
     schedule(bundle: Contract3Bundle): void;
+    /** Vend now (preferred companies changed). No-op while a vend is in flight. */
+    renewNow(): void;
     private renew;
     stop(): void;
     private clear;
 }
+/**
+ * Contract-2 (personal) realtime vend. Backed server-side by the personal
+ * session policy, which grants Subscribe/Receive on the caller's own
+ * `hq/{principalUid}/{dm,sessions,work,notifications,meeting,sync}` topics —
+ * unlike contract 3, whose policy only covers company presence and the thread
+ * directory. Doorbell listeners on personal topics MUST use this contract;
+ * subscribing to personal topics with a contract-3 session makes AWS IoT drop
+ * the connection before SUBACK.
+ */
+export interface PersonalRealtimeBundle {
+    contractVersion: 2;
+    credentials: IotCredentials;
+    iotEndpoint: string;
+    region: string;
+    clientId: string;
+    actorUid: string;
+    /** Advertised personal topics keyed by kind (dm, sessions, work, notifications, …). */
+    topics: Record<string, string>;
+    expiresAt: string;
+}
+export type PersonalCredentialsFetcher = () => Promise<PersonalRealtimeBundle>;
+export declare function normalizePersonalRealtimeBundle(raw: unknown): PersonalRealtimeBundle;
+export declare function createPersonalRealtimeFetcher(opts: {
+    token: string;
+    baseUrl?: string;
+    post?: (path: string, body: unknown) => Promise<CredentialVendPostResult>;
+}): PersonalCredentialsFetcher;
+export {};
 //# sourceMappingURL=credentials.d.ts.map