@indigoai-us/hq-cli 5.326.0 → 5.328.0

package/dist/lib/daemon/mcp-oauth.js

@@ -0,0 +1,298 @@
+import { createHash, randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import * as http from "node:http";
+import * as os from "node:os";
+import * as path from "node:path";
+import open from "open";
+import { resolveCognitoTokenSource } from "../../utils/cognito-session.js";
+import { anywhereRuntimeEnabled } from "../../commands/anywhere-runtime-flag.js";
+import { resolveHqMcpOAuthOrigin } from "./mcp-endpoint.js";
+const MCP_SCOPE = "openid email profile hq-mcp/use";
+const EXPIRY_SKEW_MS = 60_000;
+const DEFAULT_CALLBACK_TIMEOUT_MS = 5 * 60_000;
+const MAX_RESPONSE_BYTES = 64 * 1024;
+export class McpOAuthError extends Error {
+    code = "hq_mcp_auth_required";
+    constructor(message) {
+        super(message);
+        this.name = "McpOAuthError";
+    }
+}
+function cacheFile(env, home, origin) {
+    const stateDir = env.HQ_STATE_DIR?.trim() || path.join(home, ".hq");
+    const originHash = createHash("sha256").update(origin.origin).digest("hex").slice(0, 16);
+    return path.join(path.resolve(stateDir), `mcp-oauth-tokens-${originHash}.json`);
+}
+function readCache(file) {
+    try {
+        const value = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (!value || typeof value !== "object")
+            return undefined;
+        const cache = value;
+        if (cache.version !== 1 || typeof cache.origin !== "string" || !cache.origin ||
+            typeof cache.clientId !== "string" || !cache.clientId ||
+            typeof cache.accessToken !== "string" || !cache.accessToken ||
+            typeof cache.refreshToken !== "string" || !cache.refreshToken ||
+            typeof cache.expiresAt !== "number" || !Number.isFinite(cache.expiresAt))
+            return undefined;
+        return cache;
+    }
+    catch (error) {
+        if (error.code === "ENOENT" || error instanceof SyntaxError)
+            return undefined;
+        throw new McpOAuthError("The hosted MCP token cache could not be read. Check its permissions or run `hq mcp login` again.");
+    }
+}
+function writeCache(file, cache) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = `${file}.tmp-${process.pid}-${randomBytes(6).toString("hex")}`;
+    const fd = fs.openSync(temporary, "wx", 0o600);
+    try {
+        fs.writeFileSync(fd, JSON.stringify(cache));
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    try {
+        fs.renameSync(temporary, file);
+        fs.chmodSync(file, 0o600);
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { /* retain the original write error */ }
+        throw error;
+    }
+}
+function asObject(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+async function postForm(url, form, fetchImpl) {
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: form.toString(),
+            signal: AbortSignal.timeout(30_000),
+        });
+    }
+    catch {
+        throw new McpOAuthError("Hosted MCP sign-in could not reach the OAuth service. Retry `hq mcp login`.");
+    }
+    if (!response.ok) {
+        throw new McpOAuthError("Hosted MCP OAuth request failed (HTTP " + response.status + "). Retry `hq mcp login`.");
+    }
+    let data;
+    try {
+        const raw = await response.text();
+        if (raw.length > MAX_RESPONSE_BYTES)
+            throw new Error("response too large");
+        data = JSON.parse(raw);
+    }
+    catch {
+        throw new McpOAuthError("Hosted MCP OAuth returned an invalid response. Retry `hq mcp login`.");
+    }
+    const result = asObject(data);
+    if (!result)
+        throw new McpOAuthError("Hosted MCP OAuth returned an invalid response. Retry `hq mcp login`.");
+    return result;
+}
+function validTokens(data, now, previous) {
+    if (typeof data.access_token !== "string" || !data.access_token ||
+        typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0)
+        throw new McpOAuthError("Hosted MCP OAuth did not return a usable access token.");
+    const refreshToken = typeof data.refresh_token === "string" && data.refresh_token
+        ? data.refresh_token
+        : previous?.refreshToken;
+    if (!refreshToken)
+        throw new McpOAuthError("Hosted MCP OAuth did not return a refresh token. Run `hq mcp login` again.");
+    return {
+        version: 1,
+        origin: previous?.origin ?? "",
+        clientId: previous?.clientId ?? "",
+        accessToken: data.access_token,
+        refreshToken,
+        expiresAt: now + data.expires_in * 1000,
+    };
+}
+function oauthUrl(origin, endpoint) {
+    return new URL(endpoint, origin);
+}
+function newPkce() {
+    const verifier = randomBytes(32).toString("base64url");
+    return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
+}
+async function runLogin(options) {
+    const env = options.env ?? process.env;
+    if (!(options.isEnabled ?? (() => anywhereRuntimeEnabled(env)))()) {
+        throw new McpOAuthError("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use `hq mcp login`.");
+    }
+    if ((options.isMachine ?? (() => resolveCognitoTokenSource(env) === "machine"))()) {
+        throw new McpOAuthError("`hq mcp login` is for person accounts; this box uses machine credentials.");
+    }
+    const origin = options.oauthOrigin ?? resolveHqMcpOAuthOrigin(env);
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const output = options.writeOutput ?? ((message) => process.stdout.write(`${message}\n`));
+    const pkce = newPkce();
+    const state = randomBytes(24).toString("base64url");
+    let authorizationCode;
+    let callbackError;
+    let resolveCallback;
+    const callback = new Promise((resolve) => { resolveCallback = resolve; });
+    const server = http.createServer((request, response) => {
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        if (request.method !== "GET" || url.pathname !== "/oauth/callback") {
+            response.writeHead(404).end("Not found");
+            return;
+        }
+        if (url.searchParams.get("state") !== state) {
+            callbackError = new Error("state");
+        }
+        else if (url.searchParams.has("error")) {
+            callbackError = new Error("authorization");
+        }
+        else {
+            authorizationCode = url.searchParams.get("code") ?? undefined;
+            if (!authorizationCode)
+                callbackError = new Error("code");
+        }
+        response.writeHead(callbackError ? 400 : 200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+        response.end(callbackError ? "Sign-in failed. Return to the HQ CLI." : "Sign-in complete. Return to the HQ CLI.");
+        resolveCallback();
+    });
+    let timeout;
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", resolve);
+        });
+        const address = server.address();
+        if (!address || typeof address === "string")
+            throw new McpOAuthError("Could not start the local OAuth callback listener.");
+        const redirectUri = `http://127.0.0.1:${address.port}/oauth/callback`;
+        let registrationResponse;
+        try {
+            registrationResponse = await fetchImpl(oauthUrl(origin, "/oauth/register"), {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({
+                    redirect_uris: [redirectUri], token_endpoint_auth_method: "none",
+                    grant_types: ["authorization_code", "refresh_token"], response_types: ["code"],
+                    client_name: "HQ CLI",
+                }),
+                signal: AbortSignal.timeout(30_000),
+            });
+        }
+        catch {
+            throw new McpOAuthError("Hosted MCP client registration failed. Retry `hq mcp login`.");
+        }
+        if (!registrationResponse.ok)
+            throw new McpOAuthError(`Hosted MCP client registration failed (HTTP ${registrationResponse.status}).`);
+        let registration;
+        try {
+            registration = asObject(await registrationResponse.json());
+        }
+        catch { /* handled below */ }
+        if (!registration || typeof registration.client_id !== "string" || !registration.client_id.startsWith("dcr_")) {
+            throw new McpOAuthError("Hosted MCP returned an invalid client registration.");
+        }
+        const clientId = registration.client_id;
+        const authorize = oauthUrl(origin, "/oauth/authorize");
+        authorize.search = new URLSearchParams({
+            response_type: "code", client_id: clientId, redirect_uri: redirectUri,
+            code_challenge: pkce.challenge, code_challenge_method: "S256", state, scope: MCP_SCOPE,
+        }).toString();
+        const remoteShell = Boolean(env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY);
+        if (remoteShell) {
+            output(`Open this URL on your workstation to sign in to hosted hq-mcp:\n${authorize.toString()}\nForward the callback port first with: ssh -L ${address.port}:127.0.0.1:${address.port} <this-host>`);
+            if (options.openBrowser)
+                await options.openBrowser(authorize.toString());
+        }
+        else
+            try {
+                await (options.openBrowser ?? ((url) => open(url)))(authorize.toString());
+            }
+            catch {
+                output(`Open this URL to sign in to hosted hq-mcp:\n${authorize.toString()}`);
+            }
+        timeout = setTimeout(() => {
+            callbackError = new Error("timeout");
+            resolveCallback();
+        }, options.callbackTimeoutMs ?? DEFAULT_CALLBACK_TIMEOUT_MS);
+        await callback;
+        if (callbackError || !authorizationCode)
+            throw new McpOAuthError("Hosted MCP sign-in did not complete. Retry `hq mcp login`.");
+        const tokens = await postForm(oauthUrl(origin, "/oauth/token"), new URLSearchParams({
+            grant_type: "authorization_code", client_id: clientId, code: authorizationCode,
+            redirect_uri: redirectUri, code_verifier: pkce.verifier,
+        }), fetchImpl);
+        const now = (options.now ?? Date.now)();
+        const cache = validTokens(tokens, now);
+        cache.origin = origin.origin;
+        cache.clientId = clientId;
+        return cache;
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+        await new Promise((resolve) => server.close(() => resolve()));
+    }
+}
+export function mcpOAuthCacheFile(options = {}) {
+    const env = options.env ?? process.env;
+    return cacheFile(env, options.home ?? os.homedir(), options.oauthOrigin ?? resolveHqMcpOAuthOrigin(env));
+}
+/** Perform hosted DCR + PKCE login and cache only the hq-mcp audience tokens. */
+export async function loginHostedMcp(options = {}) {
+    const cache = await runLogin(options);
+    writeCache(mcpOAuthCacheFile(options), cache);
+    const writeOutput = options.writeOutput ?? ((message) => process.stdout.write(`${message}\n`));
+    writeOutput("Signed in to hosted hq-mcp. The MCP audience token is stored in the private HQ token cache.");
+}
+/** Load or refresh a person's hosted MCP token without printing token material. */
+export async function getMcpAudienceToken(options = {}) {
+    const file = mcpOAuthCacheFile(options);
+    const cache = readCache(file);
+    const now = (options.now ?? Date.now)();
+    if (!cache || cache.origin !== (options.oauthOrigin ?? resolveHqMcpOAuthOrigin(options.env ?? process.env)).origin)
+        throw new McpOAuthError("Sign in to hosted hq-mcp with `hq mcp login` first.");
+    if (cache.expiresAt > now + EXPIRY_SKEW_MS)
+        return cache.accessToken;
+    const origin = options.oauthOrigin ?? resolveHqMcpOAuthOrigin(options.env ?? process.env);
+    const tokens = await postForm(oauthUrl(origin, "/oauth/token"), new URLSearchParams({
+        grant_type: "refresh_token", client_id: cache.clientId, refresh_token: cache.refreshToken,
+    }), options.fetchImpl ?? fetch);
+    const refreshed = validTokens(tokens, now, cache);
+    refreshed.clientId = cache.clientId;
+    writeCache(file, refreshed);
+    return refreshed.accessToken;
+}
+/** Remove all per-origin hosted MCP OAuth caches during either HQ logout flow. */
+export function clearMcpOAuthCaches(options = {}) {
+    const env = options.env ?? process.env;
+    const stateDir = path.resolve(env.HQ_STATE_DIR?.trim() || path.join(options.home ?? os.homedir(), ".hq"));
+    let entries;
+    try {
+        entries = fs.readdirSync(stateDir);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw new McpOAuthError("The hosted MCP token cache could not be cleared. Check its directory permissions.");
+    }
+    for (const entry of entries) {
+        if (entry !== "mcp-oauth-tokens.json" && !/^mcp-oauth-tokens-[a-f0-9]{16}\.json$/.test(entry))
+            continue;
+        try {
+            fs.unlinkSync(path.join(stateDir, entry));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw new McpOAuthError("The hosted MCP token cache could not be cleared. Check its file permissions.");
+        }
+    }
+}
+//# sourceMappingURL=mcp-oauth.js.map

package/dist/lib/daemon/ops/mcp.d.ts

@@ -13,7 +13,6 @@ export interface McpToolResult {
 }
 export declare function jsonResult(value: unknown): McpToolResult;
 export declare const HQ_MCP_HTTP_TIMEOUT_MS = 30000;
-/** Derive the hosted MCP sibling from the same hq-pro URL used by hq-cli. */
 export declare function resolveHqMcpEndpoint(env?: NodeJS.ProcessEnv): URL;
 export interface HqMcpBridgeOptions {
     endpoint?: URL;

package/dist/lib/daemon/ops/mcp.js

@@ -2,10 +2,7 @@
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { ensureCognitoToken, isMachineIdentity } from "../../../utils/cognito-session.js";
-import { DEFAULT_VAULT_API_URL } from "../../../utils/cognito-session.js";
+import { McpEndpointError, resolveHqMcpEndpoint as resolveEndpoint } from "../mcp-endpoint.js";
 import { ensurePrivateDir, openPrivateAppend } from "../paths.js";
 export class McpOpError extends Error {
     code;
@@ -20,28 +17,28 @@ export function jsonResult(value) {
     return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }], structuredContent: structured };
 }
 export const HQ_MCP_HTTP_TIMEOUT_MS = 30_000;
-/** Derive the hosted MCP sibling from the same hq-pro URL used by hq-cli. */
 export function resolveHqMcpEndpoint(env = process.env) {
-    const apiUrl = env.HQ_VAULT_API_URL?.trim() || DEFAULT_VAULT_API_URL;
-    let api;
     try {
-        api = new URL(apiUrl);
+        return resolveEndpoint(env);
     }
-    catch {
-        throw new McpOpError("hq_mcp_config_error", "HQ's configured API URL is invalid; check HQ_VAULT_API_URL.");
-    }
-    if (api.protocol !== "https:" || !api.hostname.startsWith("hqapi.")) {
-        throw new McpOpError("hq_mcp_config_error", "Hosted hq-mcp requires an HTTPS hqapi host in HQ_VAULT_API_URL.");
+    catch (error) {
+        if (error instanceof McpEndpointError)
+            throw new McpOpError(error.code, error.message);
+        throw error;
     }
-    api.hostname = `hq-mcp.${api.hostname.slice("hqapi.".length)}`;
-    api.pathname = "/mcp";
-    api.search = "";
-    api.hash = "";
-    return api;
 }
 async function defaultMcpToken() {
-    if (!isMachineIdentity()) {
-        throw new McpOpError("hq_mcp_auth_required", "This HQ login is not an hq-mcp audience token. Sign in to the hosted connector with its DCR plus PKCE flow; hq login tokens cannot call hq-mcp yet.");
+    const { ensureCognitoToken, resolveCognitoTokenSource } = await import("../../../utils/cognito-session.js");
+    if (resolveCognitoTokenSource() !== "machine") {
+        const { getMcpAudienceToken, McpOAuthError } = await import("../mcp-oauth.js");
+        try {
+            return await getMcpAudienceToken();
+        }
+        catch (error) {
+            if (error instanceof McpOAuthError)
+                throw new McpOpError(error.code, error.message);
+            throw new McpOpError("hq_mcp_auth_required", "Hosted MCP sign-in is required. Run `hq mcp login` and retry.");
+        }
     }
     try {
         // Send this box's existing machine token. The hosted hq-mcp audience check
@@ -82,12 +79,7 @@ export class HqMcpBridge {
             if (!tools.some((tool) => tool.name === name)) {
                 throw new McpOpError("hq_mcp_tool_unavailable", `Hosted hq-mcp does not expose ${name}.`);
             }
-            try {
-                return await client.callTool({ name, arguments: args });
-            }
-            catch (error) {
-                throw this.toSafeError(error, token);
-            }
+            return await client.callTool({ name, arguments: args });
         }, timeoutMs);
     }
     close() {
@@ -104,11 +96,17 @@ export class HqMcpBridge {
         let timeout;
         let timedOut = false;
         const abortController = new AbortController();
+        let httpErrorClass;
         try {
+            const [clientModule, httpModule] = await Promise.all([
+                import("@modelcontextprotocol/sdk/client/index.js"),
+                import("@modelcontextprotocol/sdk/client/streamableHttp.js"),
+            ]);
+            httpErrorClass = httpModule.StreamableHTTPError;
             token = await this.getToken();
             if (!token.trim())
                 throw new McpOpError("hq_mcp_auth_required", "An hq-mcp audience token is required.");
-            transport = new StreamableHTTPClientTransport(this.endpoint, {
+            transport = new httpModule.StreamableHTTPClientTransport(this.endpoint, {
                 requestInit: {
                     headers: { Authorization: `Bearer ${token}` },
                 },
@@ -117,7 +115,7 @@ export class HqMcpBridge {
                     signal: init?.signal ? AbortSignal.any([abortController.signal, init.signal]) : abortController.signal,
                 }),
             });
-            client = new Client({ name: "hqd", version: "1" }, { capabilities: {} });
+            client = new clientModule.Client({ name: "hqd", version: "1" }, { capabilities: {} });
             this.activeClients.add(client);
             timeout = setTimeout(() => {
                 timedOut = true;
@@ -133,7 +131,7 @@ export class HqMcpBridge {
             if (timedOut) {
                 throw new McpOpError("hq_mcp_timeout", `Hosted hq-mcp request did not finish within ${timeoutMs}ms.`);
             }
-            throw this.toSafeError(error, token);
+            throw this.toSafeError(error, token, httpErrorClass);
         }
         finally {
             if (timeout)
@@ -157,10 +155,12 @@ export class HqMcpBridge {
             }
         }
     }
-    toSafeError(error, token) {
+    toSafeError(error, token, StreamableHTTPErrorClass) {
         if (error instanceof McpOpError)
             return error;
-        const status = error instanceof StreamableHTTPError ? error.code : undefined;
+        if (error instanceof McpEndpointError)
+            return new McpOpError(error.code, error.message);
+        const status = StreamableHTTPErrorClass && error instanceof StreamableHTTPErrorClass ? error.code : undefined;
         if (status === 401 || status === 403) {
             return new McpOpError("hq_mcp_auth_required", "Hosted hq-mcp rejected this token. Use the DCR plus PKCE person flow or configure the hq-mcp machine client ID on this box.");
         }

package/dist/lib/process-flag-company-context-fast.d.ts

@@ -0,0 +1,4 @@
+/** Fast scope resolver; it loads manifest and HQ-root code only for slug scopes. */
+import { type ProcessFlagCompanyContext } from "./process-flag-company-context-light.js";
+export declare function resolveFastProcessFlagCompanyContext(env?: NodeJS.ProcessEnv): Promise<ProcessFlagCompanyContext>;
+//# sourceMappingURL=process-flag-company-context-fast.d.ts.map

package/dist/lib/process-flag-company-context-fast.js

@@ -0,0 +1,20 @@
+/** Fast scope resolver; it loads manifest and HQ-root code only for slug scopes. */
+import { normalizedCompanyUid, resolveLightProcessFlagCompanyContext, } from "./process-flag-company-context-light.js";
+export async function resolveFastProcessFlagCompanyContext(env = process.env) {
+    const context = resolveLightProcessFlagCompanyContext(env);
+    let companyUid = context.companyUid;
+    if (!companyUid && context.companySlug) {
+        const [{ resolveDefaultHqRoot }, { readCompaniesManifestMap }] = await Promise.all([
+            import("../utils/hq-root-resolver.js"),
+            import("./work-context/repo-remote.js"),
+        ]);
+        const hqRoot = resolveDefaultHqRoot({ env });
+        const manifestUid = readCompaniesManifestMap(hqRoot)?.[context.companySlug]?.cloud_uid;
+        companyUid = typeof manifestUid === "string" ? normalizedCompanyUid(manifestUid) : undefined;
+    }
+    return {
+        ...(companyUid ? { companyUid } : {}),
+        ...(context.companySlug ? { companySlug: context.companySlug } : {}),
+    };
+}
+//# sourceMappingURL=process-flag-company-context-fast.js.map

package/dist/lib/process-flag-company-context-light.d.ts

@@ -0,0 +1,9 @@
+/** Lightweight process company context shared by full and fast flag readers. */
+export interface ProcessFlagCompanyContext {
+    companyUid?: string;
+    companySlug?: string;
+}
+export declare function normalizedCompanyUid(value: string | undefined): string | undefined;
+/** Resolve explicit, machine, or bound-session company scope without defaults. */
+export declare function resolveLightProcessFlagCompanyContext(env?: NodeJS.ProcessEnv): ProcessFlagCompanyContext;
+//# sourceMappingURL=process-flag-company-context-light.d.ts.map

package/dist/lib/process-flag-company-context-light.js

@@ -0,0 +1,81 @@
+/** Lightweight process company context shared by full and fast flag readers. */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
+const COMPANY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const DEFAULT_AGENT_IDENTITY_FILE = "/var/lib/hq-agent/identity.json";
+export function normalizedCompanyUid(value) {
+    const candidate = value?.trim() ?? "";
+    return COMPANY_UID_RE.test(candidate) ? candidate : undefined;
+}
+function normalizedCompanySlug(value) {
+    const candidate = value?.trim() ?? "";
+    return COMPANY_SLUG_RE.test(candidate) ? candidate : undefined;
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function readAgentIdentity(env) {
+    const configured = env.HQ_AGENT_IDENTITY_FILE;
+    const file = configured === undefined ? DEFAULT_AGENT_IDENTITY_FILE : configured.trim();
+    if (!file)
+        return undefined;
+    try {
+        const identity = record(JSON.parse(fs.readFileSync(file, "utf8")));
+        const companyUid = normalizedCompanyUid(typeof identity?.companyUid === "string" ? identity.companyUid : undefined);
+        const companySlug = normalizedCompanySlug(typeof identity?.companySlug === "string" ? identity.companySlug : undefined);
+        return companyUid || companySlug ? {
+            ...(companyUid ? { companyUid } : {}),
+            ...(companySlug ? { companySlug } : {}),
+        } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readSessionCompany(env) {
+    const sessionId = env.HQ_SESSION_ID?.trim();
+    if (!sessionId || sessionId.includes("..") || !SESSION_ID_RE.test(sessionId))
+        return undefined;
+    const contextRoot = env.HQ_WORK_CONTEXT_ROOT?.trim() || path.join(os.homedir(), ".hq", "work-context");
+    try {
+        const sessionPath = path.join(contextRoot, "sessions", sessionId + ".json");
+        const session = record(JSON.parse(fs.readFileSync(sessionPath, "utf8")));
+        if (session?.sessionId !== sessionId ||
+            session.contextStatus !== "bound" ||
+            session.companyConfidence === "device_default")
+            return undefined;
+        const companyUid = normalizedCompanyUid(typeof session.companyUid === "string" ? session.companyUid : undefined);
+        const companySlug = normalizedCompanySlug(typeof session.companySlug === "string" ? session.companySlug : undefined);
+        return companyUid || companySlug ? {
+            ...(companyUid ? { companyUid } : {}),
+            ...(companySlug ? { companySlug } : {}),
+        } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Resolve explicit, machine, or bound-session company scope without defaults. */
+export function resolveLightProcessFlagCompanyContext(env = process.env) {
+    const explicitUid = normalizedCompanyUid(env.HQ_COMPANY_UID);
+    const explicitSlug = normalizedCompanySlug(env.HQ_COMPANY_SLUG);
+    if (explicitUid || explicitSlug) {
+        return { companyUid: explicitUid, companySlug: explicitSlug };
+    }
+    const spawnValue = env.HQ_SPAWN_COMPANY?.trim();
+    if (spawnValue && COMPANY_UID_RE.test(spawnValue))
+        return { companyUid: spawnValue };
+    const spawnSlug = normalizedCompanySlug(spawnValue);
+    if (spawnSlug)
+        return { companySlug: spawnSlug };
+    const identity = readAgentIdentity(env);
+    if (identity)
+        return identity;
+    return readSessionCompany(env) ?? {};
+}
+//# sourceMappingURL=process-flag-company-context-light.js.map

package/dist/lib/process-flag-company-context.d.ts

@@ -1,8 +1,6 @@
 /** Company scope shared by the full flag registry and its fast-path reader. */
-export interface ProcessFlagCompanyContext {
-    companyUid?: string;
-    companySlug?: string;
-}
+import { type ProcessFlagCompanyContext } from "./process-flag-company-context-light.js";
+export type { ProcessFlagCompanyContext } from "./process-flag-company-context-light.js";
 /** Resolve the same company identity the process-wide flag reader uses. */
 export declare function resolveProcessFlagCompanyContext(env?: NodeJS.ProcessEnv): ProcessFlagCompanyContext;
 //# sourceMappingURL=process-flag-company-context.d.ts.map

package/dist/lib/process-flag-company-context.js

@@ -1,51 +1,7 @@
 /** Company scope shared by the full flag registry and its fast-path reader. */
-import { readMachineCompanyBinding } from "./work-context/company.js";
-import { readSessionState } from "./work-context/state.js";
-import { workContextRoot } from "./work-context/paths.js";
 import { readCompaniesManifestMap } from "./work-context/repo-remote.js";
 import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
-const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
-const COMPANY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-function normalizedCompanyUid(value) {
-    const candidate = value?.trim() ?? "";
-    return COMPANY_UID_RE.test(candidate) ? candidate : undefined;
-}
-function normalizedCompanySlug(value) {
-    const candidate = value?.trim() ?? "";
-    return COMPANY_SLUG_RE.test(candidate) ? candidate : undefined;
-}
-/** Resolve explicit, machine, or bound-session company scope without defaults. */
-function processCompanyContext(env = process.env) {
-    const explicitUid = normalizedCompanyUid(env.HQ_COMPANY_UID);
-    const explicitSlug = normalizedCompanySlug(env.HQ_COMPANY_SLUG);
-    if (explicitUid || explicitSlug) {
-        return { companyUid: explicitUid, companySlug: explicitSlug };
-    }
-    const machine = readMachineCompanyBinding(env);
-    const spawnValue = env.HQ_SPAWN_COMPANY?.trim();
-    const spawnSlug = normalizedCompanySlug(spawnValue);
-    const machineContext = spawnValue && COMPANY_UID_RE.test(spawnValue)
-        ? { companyUid: spawnValue }
-        : spawnSlug
-            ? { companySlug: spawnSlug }
-            : {
-                companyUid: normalizedCompanyUid(machine?.uid),
-                companySlug: normalizedCompanySlug(machine?.slug),
-            };
-    if (machineContext.companyUid || machineContext.companySlug)
-        return machineContext;
-    const sessionId = env.HQ_SESSION_ID?.trim();
-    if (!sessionId)
-        return {};
-    const session = readSessionState(sessionId, workContextRoot(undefined, env));
-    if (session?.contextStatus !== "bound" || session.companyConfidence === "device_default") {
-        return {};
-    }
-    return {
-        companyUid: normalizedCompanyUid(session.companyUid),
-        companySlug: normalizedCompanySlug(session.companySlug),
-    };
-}
+import { normalizedCompanyUid, resolveLightProcessFlagCompanyContext, } from "./process-flag-company-context-light.js";
 function companyUidForContext(context, env = process.env) {
     if (context.companyUid)
         return context.companyUid;
@@ -57,7 +13,7 @@ function companyUidForContext(context, env = process.env) {
 }
 /** Resolve the same company identity the process-wide flag reader uses. */
 export function resolveProcessFlagCompanyContext(env = process.env) {
-    const context = processCompanyContext(env);
+    const context = resolveLightProcessFlagCompanyContext(env);
     const companyUid = companyUidForContext(context, env);
     return {
         ...(companyUid ? { companyUid } : {}),

package/dist/node-network-compat-fast.js

@@ -11,6 +11,10 @@ export function shouldConfigureNodeNetworkCompatibility(argv) {
     const fastCore = parseFastCore(argv);
     if (fastCore)
         return fastCore.entry.requiresNodeNetworkCompatibility === true;
+    // The MCP shim only forwards over the local hqd socket; it does not make
+    // outbound network requests and does not need the network-family patch.
+    if (argv.length === 4 && argv[2] === "mcp" && argv[3] === "serve")
+        return false;
     // The lightweight secrets route still makes vault API requests.
     if (parseSecretsEnvFastRequest(argv))
         return true;