@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/lib/work-context/company.js

@@ -3,8 +3,9 @@
  *
  * Order:
  *   1. trusted explicit (HQ_SPAWN_COMPANY env or observation.trustedContext/explicit)
- *   2. existing authoritative session scope
- *   3. session meta.yaml company_slug (/startwork)
+ *   2. existing authoritative session scope — unless session meta.yaml
+ *      names a different company (hq-session.sh rebind, US-047)
+ *   3. session meta.yaml company_slug (/startwork / hq-session.sh)
  *   4. agent-box identity file (HQ_AGENT_IDENTITY_FILE → companyUid; source
  *      trusted_explicit — never "default company mode"; below HQ_SPAWN_COMPANY,
  *      above device default)
@@ -22,7 +23,7 @@ import * as path from "node:path";
 import { getDefaultCompany, getRepoCompany } from "./config.js";
 import { authoritativeCompanyFromState, readSessionState, } from "./state.js";
 /** Pointer to the US-017B correction client (never auto-switches). */
-export const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
+const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
 export function companyCorrectionPath(sessionId) {
     return `${COMPANY_CORRECTION_PATH_PREFIX} ${sessionId}`;
 }
@@ -38,13 +39,7 @@ function normalizeSlug(value) {
         return undefined;
     return s;
 }
-/**
- * Read `companyUid` from the agent identity file when
- * `HQ_AGENT_IDENTITY_FILE` is set, or the conventional fleet path otherwise.
- * Missing/unreadable/malformed → undefined
- * (never throws; never logs file contents).
- */
-export function readAgentIdentityCompanyUid(env = process.env) {
+function readAgentIdentityRecord(env) {
     // An explicit override (including empty/missing paths) never falls back to
     // another identity. This prevents accidental attribution to a different box.
     const file = (env[HQ_AGENT_IDENTITY_FILE_ENV] ?? DEFAULT_AGENT_IDENTITY_FILE).trim();
@@ -54,15 +49,66 @@ export function readAgentIdentityCompanyUid(env = process.env) {
         if (!fs.existsSync(file))
             return undefined;
         const raw = JSON.parse(fs.readFileSync(file, "utf8"));
-        const uid = raw.companyUid;
-        return typeof uid === "string" && uid.trim().length > 0
-            ? uid.trim()
-            : undefined;
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return undefined;
+        return raw;
     }
     catch {
         return undefined;
     }
 }
+/** Company uid and slug from the fleet identity file. Missing file → undefined. */
+function readAgentIdentityCompany(env = process.env) {
+    const raw = readAgentIdentityRecord(env);
+    if (!raw)
+        return undefined;
+    const uid = typeof raw.companyUid === "string" ? raw.companyUid.trim() : "";
+    const slug = normalizeSlug(typeof raw.companySlug === "string" ? raw.companySlug : undefined);
+    if (!uid && !slug)
+        return undefined;
+    return {
+        ...(uid ? { uid } : {}),
+        ...(slug ? { slug } : {}),
+    };
+}
+export function readAgentIdentityCompanyUid(env = process.env) {
+    return readAgentIdentityCompany(env)?.uid;
+}
+/**
+ * Company named for a machine session.
+ * Order: HQ_SPAWN_COMPANY, identity-file slug, identity-file uid.
+ * Session meta is not included; callers place it between spawn and the file.
+ * No company → undefined. Never invents NONE.
+ */
+export function readMachineCompanyBinding(env = process.env) {
+    const spawn = normalizeSlug(env.HQ_SPAWN_COMPANY);
+    const identity = readAgentIdentityCompany(env);
+    if (spawn)
+        return { slug: spawn, ...(identity?.uid ? { uid: identity.uid } : {}) };
+    if (!identity?.slug && !identity?.uid)
+        return undefined;
+    return {
+        ...(identity?.slug ? { slug: identity.slug } : {}),
+        ...(identity?.uid ? { uid: identity.uid } : {}),
+    };
+}
+/**
+ * Agent boxes must never infer a human device default. The file itself is the
+ * machine marker; legacy identity files do not necessarily contain a company
+ * UID, so parsing for that field is not an eligibility check.
+ */
+export function hasAgentIdentityFile(env = process.env) {
+    const configured = env[HQ_AGENT_IDENTITY_FILE_ENV];
+    const identityPath = configured === undefined ? DEFAULT_AGENT_IDENTITY_FILE : configured.trim();
+    if (!identityPath)
+        return false;
+    try {
+        return fs.existsSync(identityPath);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Compare companies: UIDs when both sides have them; otherwise normalized
  * slugs when both have slugs. Never treat uid+slug vs slug-only as a
@@ -163,7 +209,7 @@ export function readMetaCompanySlug(sessionId, hqRoot) {
  * Multiple distinct signals that disagree → no deterministic mapping (needs_company
  * unless a higher-precedence source exists). Matching signals collapse to one.
  */
-export function resolveDeterministicCompany(input) {
+function resolveDeterministicCompany(input) {
     const fromCwd = companySlugFromCwd(input.cwd, input.hqRoot);
     const fromRemote = normalizeSlug(input.remoteOwnerSlug ?? undefined);
     if (fromCwd && fromRemote && fromCwd.toLowerCase() !== fromRemote.toLowerCase()) {
@@ -178,6 +224,16 @@ export function resolveDeterministicCompany(input) {
     }
     return null;
 }
+function conflictingDeterministicEvidence(input) {
+    const cwd = companySlugFromCwd(input.cwd, input.hqRoot);
+    const remote = normalizeSlug(input.remoteOwnerSlug ?? undefined);
+    if (!cwd || !remote || cwd.toLowerCase() === remote.toLowerCase())
+        return null;
+    return {
+        cwd: { slug: cwd, source: "deterministic_cwd" },
+        remote: { slug: remote, source: "deterministic_remote" },
+    };
+}
 export function resolveCompany(input) {
     const env = input.env ?? process.env;
     // 1. Trusted explicit: HQ_SPAWN_COMPANY or observation trusted/explicit.
@@ -199,41 +255,51 @@ export function resolveCompany(input) {
         ? input.existingState
         : readSessionState(input.sessionId, input.root);
     const prior = authoritativeCompanyFromState(state);
+    // 3. session meta.yaml company_slug — read before existing_scope so an
+    // operator rebind via hq-session.sh can replace a stale Work Mesh company.
+    const metaSlug = input.metaCompanySlug !== undefined
+        ? normalizeSlug(input.metaCompanySlug)
+        : readMetaCompanySlug(input.sessionId, input.hqRoot);
     if (prior) {
         const scoped = {
             slug: prior.slug,
             uid: prior.uid,
             source: "existing_scope",
         };
-        // After a binding exists, a suspected other-company mismatch cannot
-        // auto-switch — return company_conflict with the US-017B correction path.
+        if (metaSlug && !sameCompany(scoped, { slug: metaSlug })) {
+            return {
+                status: "resolved",
+                company: { slug: metaSlug, source: "session_meta" },
+            };
+        }
+        // Deterministic evidence from another company never silently replaces a
+        // scoped session, even before it has a project binding. Preserve the
+        // original scope and surface a conflict before tenant I/O.
         const hadBinding = Boolean(state &&
             (state.contextStatus === "bound" ||
                 state.contextStatus === "needs_task" ||
                 state.contextStatus === "needs_project") &&
             (state.projectId || state.bindingEpisodeId));
-        if (hadBinding) {
-            const deterministic = resolveDeterministicCompany({
-                cwd: input.cwd,
-                hqRoot: input.hqRoot,
-                remoteOwnerSlug: input.remoteOwnerSlug,
-            });
-            if (deterministic && !sameCompany(scoped, deterministic)) {
-                return {
-                    status: "company_conflict",
-                    defaultCompany: scoped,
-                    evidenceCompany: deterministic,
-                    afterBinding: true,
-                    correctionPath: companyCorrectionPath(input.sessionId),
-                };
-            }
+        const deterministic = resolveDeterministicCompany({
+            cwd: input.cwd,
+            hqRoot: input.hqRoot,
+            remoteOwnerSlug: input.remoteOwnerSlug,
+        });
+        if (deterministic && !sameCompany(scoped, deterministic)) {
+            return {
+                status: "company_conflict",
+                defaultCompany: scoped,
+                evidenceCompany: deterministic,
+                ...(hadBinding
+                    ? {
+                        afterBinding: true,
+                        correctionPath: companyCorrectionPath(input.sessionId),
+                    }
+                    : {}),
+            };
         }
         return { status: "resolved", company: scoped };
     }
-    // 3. session meta.yaml company_slug
-    const metaSlug = input.metaCompanySlug !== undefined
-        ? normalizeSlug(input.metaCompanySlug)
-        : readMetaCompanySlug(input.sessionId, input.hqRoot);
     if (metaSlug) {
         return {
             status: "resolved",
@@ -243,11 +309,15 @@ export function resolveCompany(input) {
     // 4. Agent-box identity file (HQ_AGENT_IDENTITY_FILE). Prefer as the
     // device-default role with source trusted_explicit — never device_default /
     // "default company mode". Below HQ_SPAWN_COMPANY; above device default.
-    const identityUid = readAgentIdentityCompanyUid(env);
-    if (identityUid) {
+    const identity = readAgentIdentityCompany(env);
+    if (identity?.uid || identity?.slug) {
         return {
             status: "resolved",
-            company: { uid: identityUid, source: "trusted_explicit" },
+            company: {
+                ...(identity.slug ? { slug: identity.slug } : {}),
+                ...(identity.uid ? { uid: identity.uid } : {}),
+                source: "trusted_explicit",
+            },
         };
     }
     // 4b. Persisted per-repo company map (gap 4). A person answered once for this
@@ -264,12 +334,26 @@ export function resolveCompany(input) {
         }
     }
     // 5 + 6. Device default vs deterministic evidence.
-    const deviceDefault = getDefaultCompany({ root: input.root });
+    const deviceDefault = input.allowDeviceDefault === false ? null : getDefaultCompany({ root: input.root });
     const deterministic = resolveDeterministicCompany({
         cwd: input.cwd,
         hqRoot: input.hqRoot,
         remoteOwnerSlug: input.remoteOwnerSlug,
     });
+    const deterministicConflict = conflictingDeterministicEvidence({
+        cwd: input.cwd,
+        hqRoot: input.hqRoot,
+        remoteOwnerSlug: input.remoteOwnerSlug,
+    });
+    // Cwd and remote are both deterministic evidence. Their disagreement is
+    // never permission to fall through to a weaker device preference.
+    if (deterministicConflict) {
+        return {
+            status: "company_conflict",
+            defaultCompany: deterministicConflict.cwd,
+            evidenceCompany: deterministicConflict.remote,
+        };
+    }
     if (deviceDefault?.enabled && deviceDefault.slug) {
         const def = {
             slug: deviceDefault.slug,

package/dist/lib/work-context/config.d.ts

@@ -1,14 +1,25 @@
 /**
  * Device-local default company preference (~/.hq/work-context/config.json).
  * Preference only — never authority. activeCompany is never treated as default.
- * Default-company mode ships dark until migrationCapability (US-017A).
  */
-import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
-export declare const DEVICE_CONFIG_SCHEMA_VERSION: 1;
+import * as fs from "node:fs";
+import { type WindowsAclCheckOptions } from "./windows-acl.js";
+declare const DEVICE_CONFIG_SCHEMA_VERSION: 1;
 export interface DeviceDefaultCompany {
     slug: string;
     uid?: string;
     enabled: boolean;
+    /** Whether this device chose the value or safely inferred its only membership. */
+    source?: "auto_single" | "chosen" | "disabled";
+}
+export interface DefaultCompanyMembership {
+    slug: string;
+    uid: string;
+}
+/** Cached active memberships. This avoids a network lookup for each hook. */
+export interface DefaultCompanyMembershipSnapshot {
+    checkedAt: string;
+    memberships: DefaultCompanyMembership[];
 }
 /** Last probe of GET /v1/work-mesh/capabilities across memberships (US-017B). */
 export interface MigrationCapabilitySnapshot {
@@ -32,15 +43,21 @@ export interface RepoCompanyMapping {
     uid?: string;
     updatedAt: string;
 }
-export type RepoCompanyMap = Record<string, RepoCompanyMapping>;
+type RepoCompanyMap = Record<string, RepoCompanyMapping>;
 export interface WorkContextDeviceConfig {
     schemaVersion: typeof DEVICE_CONFIG_SCHEMA_VERSION;
     /** Explicit device default. Never copied from activeCompany. */
     defaultCompany?: DeviceDefaultCompany | null;
+    /** Marks a null default written by the automatic-activation implementation. */
+    defaultCompanyAutomaticEligible?: true;
     /** Last-known migration capability across memberships (doctor reports this). */
     migrationCapability?: MigrationCapabilitySnapshot | null;
     /** Per-repo company map (gap 4). Remembers each repo's filed-under company. */
     repoCompanyMap?: RepoCompanyMap | null;
+    /** Membership cache used to activate an unconfigured device default. */
+    defaultCompanyMemberships?: DefaultCompanyMembershipSnapshot | null;
+    /** Historical held-session repair stays opt-in because a default is weak evidence. */
+    repairHeldWithDefault?: boolean;
     updatedAt: string;
 }
 /** true / { uid } = member; false = not a member. */
@@ -59,11 +76,34 @@ export interface DeviceConfigDeps {
     validateMembership?: (slug: string) => Promise<MembershipValidationResult> | MembershipValidationResult;
     now?: () => Date;
 }
+/** Acquire an interprocess config lock; exported for direct lock regression tests. */
+export declare function acquireDeviceConfigLock(root: string, options?: {
+    timeoutMs?: number;
+    staleMs?: number;
+}): () => void;
+/** Injection points for assertSafeConfigPath (tests only). */
+export interface SafeConfigPathIo {
+    platform?: NodeJS.Platform;
+    existsSync?: (p: string) => boolean;
+    lstatSync?: (p: string) => Pick<fs.Stats, "mode" | "isSymbolicLink">;
+    windowsAcl?: WindowsAclCheckOptions;
+}
+/**
+ * Refuse a config path that is a symlink (every platform) or writable by
+ * anyone other than the owner.
+ *
+ * - POSIX (darwin/linux/...): `mode & 0o022` must be clear. Unchanged.
+ * - win32: NTFS has no POSIX mode bits; Node reports 0666 for every regular
+ *   file, so the mode test would reject every config (US-018). We read the
+ *   real DACL instead (see windows-acl.ts). Unreadable DACL → documented
+ *   reduced-guarantee path: one diagnostic line, no throw.
+ */
+export declare function assertSafeConfigPath(configPath: string, io?: SafeConfigPathIo): void;
 export declare function readDeviceConfig(deps: Pick<DeviceConfigDeps, "root">): WorkContextDeviceConfig;
 export declare function getDefaultCompany(deps: Pick<DeviceConfigDeps, "root">): DeviceDefaultCompany | null;
-export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps & {
-    allowWithoutMigration?: boolean;
-}): Promise<WorkContextDeviceConfig>;
+/** A clear is a durable opt-out, not an invitation for automatic reactivation. */
+export declare function isDefaultCompanyDisabled(deps: Pick<DeviceConfigDeps, "root">): boolean;
+export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps): Promise<WorkContextDeviceConfig>;
 export declare function clearDefaultCompany(deps: DeviceConfigDeps): WorkContextDeviceConfig;
 /**
  * Read the persisted company mapping for a repo identity key (gap 4).
@@ -80,8 +120,15 @@ export declare function setRepoCompany(key: string, mapping: {
 }, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
 /** Persist the last memberships-wide migration capability probe (US-017B). */
 export declare function recordMigrationCapabilitySnapshot(snapshot: MigrationCapabilitySnapshot, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
-/** Convenience: build deps from HOME / injectable root. */
-export declare function deviceConfigDepsFromHome(home?: string, extras?: Partial<DeviceConfigDeps>): DeviceConfigDeps;
-/** Re-export for callers that stamp contractVersion on related state. */
-export { WORK_CONTEXT_CONTRACT_VERSION };
+export declare function recordDefaultCompanyMemberships(snapshot: DefaultCompanyMembershipSnapshot, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
+/** Drop cached membership evidence immediately after an authoritative denial. */
+export declare function invalidateDefaultCompanyMemberships(deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
+/** Persist a default only after the complete active-membership list verified it. */
+export declare function setAutoDefaultCompany(membership: DefaultCompanyMembership, deps: Pick<DeviceConfigDeps, "root" | "now"> & {
+    expectedUpdatedAt?: string;
+    /** Test seam: runs after the guarded read while the config lock is held. */
+    afterCompareAndSwap?: () => void;
+}): WorkContextDeviceConfig;
+export declare function setRepairHeldWithDefault(enabled: boolean, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
+export {};
 //# sourceMappingURL=config.d.ts.map