@indigoai-us/hq-cli 5.342.18 → 5.343.0

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [5.343.0] — 2026-10-04
+- `hq company --company <slug> settings set --work-registry-enabled <true|false>` and `--work-mesh-live-enabled <true|false>` let a company owner turn work tracking on or off. Work tracking needs both switches; after either is set the command says whether work tracking is on and prints the exact command for the switch that is still off. `hq company --company <slug> settings get` now also shows both switches for an owner or admin.
+- `hq mesh context requeue` now also re-sends, by default, sessions that were refused while work tracking was off. `hq doctor` and `hq mesh daemon doctor` explain those refusals in plain words.
+- Release the hq-cli package-use lease before the secrets sandbox poll and bounded package downloads after preloading their lazy runtime imports.
+
 ## [5.342.18] — 2026-10-04
 - Preserve confirmed remote lane-message responses for in-process monitor delivery.
 - Use native TypeScript renderers for `hq core rebuild-index` commands.

package/dist/command-catalog.generated.d.ts

@@ -5334,7 +5334,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [];
         readonly subcommands: readonly [{
             readonly name: "set";
-            readonly description: "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled.";
+            readonly description: "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled / --work-registry-enabled / --work-mesh-live-enabled.";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly helpOption: true;
@@ -5358,11 +5358,19 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly flags: "--checkpoint-gate-enabled <true|false>";
                 readonly description: "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn";
                 readonly hidden: false;
+            }, {
+                readonly flags: "--work-registry-enabled <true|false>";
+                readonly description: "Turn work-session registration on or off for this company (default off). Work tracking needs this and --work-mesh-live-enabled";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--work-mesh-live-enabled <true|false>";
+                readonly description: "Turn live work tracking on or off for this company (default off). Work tracking needs this and --work-registry-enabled";
+                readonly hidden: false;
             }];
             readonly subcommands: readonly [];
         }, {
             readonly name: "get";
-            readonly description: "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it).";
+            readonly description: "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it) and, for an owner or admin, the two work tracking switches (GET /company-settings).";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly helpOption: true;
@@ -9635,7 +9643,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly subcommands: readonly [];
         }, {
             readonly name: "requeue";
-            readonly description: "Requeue quarantined outbox operations (default: only AUTH_DENIED — work-mesh-live gap 10 recovery)";
+            readonly description: "Requeue quarantined outbox operations (default: AUTH_DENIED - work-mesh-live gap 10 recovery - plus sessions refused while work tracking was off). Run once after the company owner turns work tracking on";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly helpOption: true;

package/dist/command-catalog.generated.js

@@ -6478,7 +6478,7 @@ export const COMMAND_CATALOG = [
                 "subcommands": [
                     {
                         "name": "set",
-                        "description": "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled.",
+                        "description": "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled / --work-registry-enabled / --work-mesh-live-enabled.",
                         "aliases": [],
                         "hidden": false,
                         "helpOption": true,
@@ -6506,13 +6506,23 @@ export const COMMAND_CATALOG = [
                                 "flags": "--checkpoint-gate-enabled <true|false>",
                                 "description": "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn",
                                 "hidden": false
+                            },
+                            {
+                                "flags": "--work-registry-enabled <true|false>",
+                                "description": "Turn work-session registration on or off for this company (default off). Work tracking needs this and --work-mesh-live-enabled",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--work-mesh-live-enabled <true|false>",
+                                "description": "Turn live work tracking on or off for this company (default off). Work tracking needs this and --work-registry-enabled",
+                                "hidden": false
                             }
                         ],
                         "subcommands": []
                     },
                     {
                         "name": "get",
-                        "description": "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it).",
+                        "description": "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it) and, for an owner or admin, the two work tracking switches (GET /company-settings).",
                         "aliases": [],
                         "hidden": false,
                         "helpOption": true,
@@ -11686,7 +11696,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "name": "requeue",
-                        "description": "Requeue quarantined outbox operations (default: only AUTH_DENIED — work-mesh-live gap 10 recovery)",
+                        "description": "Requeue quarantined outbox operations (default: AUTH_DENIED - work-mesh-live gap 10 recovery - plus sessions refused while work tracking was off). Run once after the company owner turns work tracking on",
                         "aliases": [],
                         "hidden": false,
                         "helpOption": true,

package/dist/commands/company.d.ts

@@ -1,3 +1,15 @@
 import { Command } from "commander";
+/**
+ * The two per-company switches that together turn work tracking on. The server
+ * refuses work-session registration unless both are true. `null` means the
+ * values could not be read.
+ */
+interface WorkTrackingSettings {
+    workRegistryEnabled: boolean;
+    workMeshLiveEnabled: boolean;
+}
+/** Plain next steps after a work tracking switch was set, from the effective settings. */
+export declare function workTrackingNextSteps(companySlug: string, settings: WorkTrackingSettings | null): string[];
 export declare function registerCompanyCommand(program: Command): void;
+export {};
 //# sourceMappingURL=company.d.ts.map

package/dist/commands/company.js

@@ -4,6 +4,64 @@ import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
 import { registerCompanyTransferCommand } from "./company-transfer.js";
 import { registerCompanyRenameCommand } from "./company-rename.js";
 import { describeRefreshOutcome, refreshCheckpointGateSetting, } from "./core-checkpoint-gate-setting.js";
+/** Both switches from a settings response body, or null unless both are booleans. */
+function workTrackingFromBody(body) {
+    const { workRegistryEnabled, workMeshLiveEnabled } = body;
+    return typeof workRegistryEnabled === "boolean" && typeof workMeshLiveEnabled === "boolean"
+        ? { workRegistryEnabled, workMeshLiveEnabled }
+        : null;
+}
+/**
+ * Read both switches from GET /company-settings (owner or admin only). The
+ * server returns effective values, so an absent field means the default (off).
+ * A refused or failed read returns null rather than a guess.
+ */
+async function readWorkTrackingSettings(token, companyUid) {
+    try {
+        const res = await vaultApiFetch({
+            token,
+            path: "/company-settings",
+            query: { companyUid },
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json().catch(() => ({})));
+        return {
+            workRegistryEnabled: body.workRegistryEnabled === true,
+            workMeshLiveEnabled: body.workMeshLiveEnabled === true,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Plain next steps after a work tracking switch was set, from the effective settings. */
+export function workTrackingNextSteps(companySlug, settings) {
+    const command = `hq company --company ${companySlug} settings`;
+    if (!settings) {
+        return [`Could not read the settings back. Check both switches with: ${command} get`];
+    }
+    if (settings.workRegistryEnabled && settings.workMeshLiveEnabled) {
+        return [
+            "Work tracking is on.",
+            "Sessions refused while it was off are held on each machine. " +
+                "Each person should run once: hq mesh context requeue",
+        ];
+    }
+    if (settings.workRegistryEnabled) {
+        return [
+            "Work tracking is not on yet. Sessions will still be refused until live tracking is also on. " +
+                `Run: ${command} set --work-mesh-live-enabled true`,
+        ];
+    }
+    if (settings.workMeshLiveEnabled) {
+        return [
+            "Work tracking is not on yet. Sessions will still be refused until the work registry is also on. " +
+                `Run: ${command} set --work-registry-enabled true`,
+        ];
+    }
+    return [`Work tracking is off for ${companySlug}.`];
+}
 /**
  * Parse a `--flag <true|false>` string into a boolean, or throw. Commander
  * passes the raw string; we validate strictly so a typo never silently writes
@@ -32,11 +90,14 @@ export function registerCompanyCommand(program) {
         .command("set")
         .description("Set per-company settings (PUT /company-settings). Require at least one " +
         "of --crm-enabled / --ontology-enabled / --accounting-enabled / " +
-        "--checkpoint-gate-enabled.")
+        "--checkpoint-gate-enabled / --work-registry-enabled / " +
+        "--work-mesh-live-enabled.")
         .option("--crm-enabled <true|false>", "Enable/disable the native CRM for this company")
         .option("--ontology-enabled <true|false>", "Enable/disable the ontology gardener for this company")
         .option("--accounting-enabled <true|false>", "Enable/disable the accounting pack for this company")
         .option("--checkpoint-gate-enabled <true|false>", "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn")
+        .option("--work-registry-enabled <true|false>", "Turn work-session registration on or off for this company (default off). Work tracking needs this and --work-mesh-live-enabled")
+        .option("--work-mesh-live-enabled <true|false>", "Turn live work tracking on or off for this company (default off). Work tracking needs this and --work-registry-enabled")
         .action(async (opts) => {
         try {
             const companySlug = company.opts().company;
@@ -47,8 +108,10 @@ export function registerCompanyCommand(program) {
             if (opts.crmEnabled === undefined &&
                 opts.ontologyEnabled === undefined &&
                 opts.accountingEnabled === undefined &&
-                opts.checkpointGateEnabled === undefined) {
-                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled."));
+                opts.checkpointGateEnabled === undefined &&
+                opts.workRegistryEnabled === undefined &&
+                opts.workMeshLiveEnabled === undefined) {
+                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled / --work-registry-enabled / --work-mesh-live-enabled."));
                 process.exit(1);
             }
             const body = {};
@@ -64,6 +127,14 @@ export function registerCompanyCommand(program) {
             if (opts.checkpointGateEnabled !== undefined) {
                 body.checkpointGateEnabled = parseBoolFlag(opts.checkpointGateEnabled, "--checkpoint-gate-enabled");
             }
+            if (opts.workRegistryEnabled !== undefined) {
+                body.workRegistryEnabled = parseBoolFlag(opts.workRegistryEnabled, "--work-registry-enabled");
+            }
+            if (opts.workMeshLiveEnabled !== undefined) {
+                body.workMeshLiveEnabled = parseBoolFlag(opts.workMeshLiveEnabled, "--work-mesh-live-enabled");
+            }
+            const setsWorkTracking = body.workRegistryEnabled !== undefined ||
+                body.workMeshLiveEnabled !== undefined;
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, { companySlug });
             body.companyUid = companyUid;
@@ -76,7 +147,9 @@ export function registerCompanyCommand(program) {
             if (!res.ok) {
                 const errBody = (await res.json().catch(() => ({})));
                 if (res.status === 403) {
-                    console.error(chalk.red("Requires owner role on this company to change its settings."));
+                    console.error(chalk.red(setsWorkTracking
+                        ? "Only the company owner can change this setting."
+                        : "Requires owner role on this company to change its settings."));
                     process.exit(1);
                 }
                 console.error(chalk.red(`Failed to update company settings: ${errBody.error ?? res.statusText}`));
@@ -98,6 +171,16 @@ export function registerCompanyCommand(program) {
                     // The setting is saved; the cache refreshes on the next Stop.
                 }
             }
+            if (setsWorkTracking) {
+                // Registration needs both switches, so report the effective pair:
+                // from the PUT response when it echoes both, otherwise from a GET.
+                const resBody = (await res.json().catch(() => ({})));
+                const effective = workTrackingFromBody(resBody) ??
+                    (await readWorkTrackingSettings(token, companyUid));
+                for (const line of workTrackingNextSteps(companySlug, effective)) {
+                    console.log(line);
+                }
+            }
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -107,7 +190,8 @@ export function registerCompanyCommand(program) {
     settings
         .command("get")
         .description("Show whether the checkpoint Stop gate is on for this company " +
-        "(GET /company-settings/checkpoint-gate; any member may read it).")
+        "(GET /company-settings/checkpoint-gate; any member may read it) and, " +
+        "for an owner or admin, the two work tracking switches (GET /company-settings).")
         .option("--json", "Print the result as JSON")
         .action(async (opts) => {
         try {
@@ -137,11 +221,24 @@ export function registerCompanyCommand(program) {
                 console.error(chalk.red("Failed to read company settings: no checkpointGateEnabled in the response."));
                 process.exit(1);
             }
+            // The work tracking switches are only on the owner/admin settings
+            // route. A refused or failed read is reported as unknown, not guessed.
+            const workTracking = await readWorkTrackingSettings(token, companyUid);
             if (opts.json) {
-                console.log(JSON.stringify({ company: companySlug, checkpointGateEnabled: enabled }));
+                console.log(JSON.stringify({
+                    company: companySlug,
+                    checkpointGateEnabled: enabled,
+                    workRegistryEnabled: workTracking?.workRegistryEnabled ?? null,
+                    workMeshLiveEnabled: workTracking?.workMeshLiveEnabled ?? null,
+                }));
             }
             else {
                 console.log(`checkpointGateEnabled=${enabled}`);
+                for (const key of ["workRegistryEnabled", "workMeshLiveEnabled"]) {
+                    console.log(workTracking
+                        ? `${key}=${workTracking[key]}`
+                        : `${key}=unknown (only the company owner or an admin can read this setting)`);
+                }
             }
         }
         catch (err) {

package/dist/commands/mesh.js

@@ -1424,7 +1424,9 @@ async function runContextRequeue(opts) {
     }
     const scope = errorCode === null
         ? "all quarantine reasons"
-        : `lastErrorCode=${errorCode === undefined ? "AUTH_DENIED" : errorCode}`;
+        : errorCode === undefined
+            ? "lastErrorCode=AUTH_DENIED or refused while work tracking was off"
+            : `lastErrorCode=${errorCode}`;
     console.log(`Requeued ${requeued.length} quarantined outbox operation${requeued.length === 1 ? "" : "s"} (${scope}). The mesh daemon will retry them on its next replay.`);
 }
 async function runContextUntracked(sessionId, opts) {
@@ -2016,7 +2018,9 @@ export function registerMeshCommand(program) {
         .action((opts) => wrap(() => runContextCorrect(opts))());
     context
         .command("requeue")
-        .description("Requeue quarantined outbox operations (default: only AUTH_DENIED — work-mesh-live gap 10 recovery)")
+        .description("Requeue quarantined outbox operations (default: AUTH_DENIED - work-mesh-live gap 10 recovery - " +
+        "plus sessions refused while work tracking was off). " +
+        "Run once after the company owner turns work tracking on")
         .option("--all", "Requeue every quarantined op regardless of lastErrorCode")
         .option("--error-code <code>", "Requeue quarantined ops with this lastErrorCode")
         .option("--json", "Print machine-readable JSON")

package/dist/commands/pack-install.d.ts

@@ -34,6 +34,7 @@
  * from each pack's package.yaml; rationale lives in the layout-fix PR.)
  */
 import { type KeyObject } from 'node:crypto';
+import { type ResidentCommandLeaseOptions } from '../utils/resident-package-preload.js';
 import { type SecretResolver } from './mcp-registration.js';
 import type { PackManifest } from '../types.js';
 export interface ResolveLatestOptions {
@@ -447,6 +448,7 @@ export interface InstallPackOptions {
      */
     requireSignature?: boolean;
 }
+export declare function runPackInstallWithLease<T>(run: () => Promise<T>, leaseOptions?: ResidentCommandLeaseOptions): Promise<T>;
 export declare function installPack(source: string, opts?: InstallPackOptions): Promise<void>;
 export {};
 //# sourceMappingURL=pack-install.d.ts.map

package/dist/commands/pack-install.js

@@ -50,6 +50,7 @@ import { codexTargets } from '../lib/install/codex-targets.js';
 import { readHqVersion, routeContribution, listInstalledPacks, mcpServerNameForContribution } from '../utils/pack-contributions.js';
 import { CONTRIBUTION_TABLE, payloadFor } from '../utils/contribution-table.js';
 import { safeExtractTarball } from './safe-extract.js';
+import { runResidentCommandWithPackageLease } from '../utils/resident-package-preload.js';
 import { getCompanyUid, vaultApiFetch, vaultApiFetchPublic, } from '../utils/vault-api.js';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
 import { formatApiKeyCapabilityDenial, peekHqApiKey, } from '../utils/resolve-vault-credential.js';
@@ -1677,7 +1678,13 @@ export function runScanPackages(hqRoot, opts = {}) {
         console.log(chalk.yellow('  scan-packages.sh exited non-zero; see output above.'));
     }
 }
+export function runPackInstallWithLease(run, leaseOptions) {
+    return runResidentCommandWithPackageLease("pack-install", run, leaseOptions);
+}
 export async function installPack(source, opts = {}) {
+    return runPackInstallWithLease(() => installPackWithoutLease(source, opts));
+}
+async function installPackWithoutLease(source, opts) {
     // NOTE: the HQ_API_KEY fail-closed gate is NOT enforced here. `installPack`
     // is a shared primitive called both by the top-level `hq install` CLI route
     // (where Cognito-only is the right gate — checked there instead) AND by

package/dist/commands/pkg-update.d.ts

@@ -5,5 +5,7 @@
  * If slug given: update only that package.
  */
 import { Command } from 'commander';
+import { type ResidentCommandLeaseOptions } from '../utils/resident-package-preload.js';
 export declare function registerPackageUpdateCommand(parent: Command): void;
+export declare function runPackageUpdateWithLease<T>(run: () => Promise<T>, leaseOptions?: ResidentCommandLeaseOptions): Promise<T>;
 //# sourceMappingURL=pkg-update.d.ts.map

package/dist/commands/pkg-update.js

@@ -9,6 +9,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { parseUserYaml } from '../utils/user-yaml-error.js';
 import { execSync } from 'child_process';
+import { runResidentCommandWithPackageLease } from '../utils/resident-package-preload.js';
 import chalk from 'chalk';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
 import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
@@ -21,7 +22,7 @@ export function registerPackageUpdateCommand(parent) {
         .description('Check for and apply package updates')
         .action(async (slug) => {
         try {
-            await updatePackages(slug);
+            await runPackageUpdateWithLease(() => updatePackages(slug));
         }
         catch (error) {
             console.error(chalk.red('Update failed:'), error instanceof Error ? error.message : 'Unknown error');
@@ -29,6 +30,9 @@ export function registerPackageUpdateCommand(parent) {
         }
     });
 }
+export function runPackageUpdateWithLease(run, leaseOptions) {
+    return runResidentCommandWithPackageLease("pkg-update", run, leaseOptions);
+}
 async function updatePackages(slug) {
     const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
     const entries = readRegistry(hqRoot);

package/dist/commands/secrets.js

@@ -10,6 +10,7 @@ import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_pattern
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
+import { runSandboxJobAfterSubmission } from "../utils/secrets-sandbox-resident.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 /**
  * Mirrors `RESOURCE_SURFACES` in hq-pro
@@ -1061,9 +1062,7 @@ export function registerSecretsCommand(program) {
                 secretNames: keys,
                 command,
             });
-            const job = started.status === "succeeded" || started.status === "failed"
-                ? await client.getJob(token, started.jobId)
-                : await client.pollJob(token, started.jobId);
+            const job = await runSandboxJobAfterSubmission(client, token, started);
             renderSandboxJobResult(job, keys);
             const exitCode = typeof job.exitCode === "number" ? job.exitCode : undefined;
             if (job.success === false || (exitCode !== undefined && exitCode !== 0) || job.status === "failed") {

package/dist/lib/doctor/checks/work-context.js

@@ -13,6 +13,7 @@ import { workContextRoot, workContextSessionsDir } from "../../work-context/path
 import { countDistinctHeldEvents, countJsonlLines, deadLetterNonEmpty, } from "../../mesh/live/spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../../mesh/live/paths.js";
 import { collectDaemonDoctor, formatDaemonDoctor, } from "../../mesh/live/daemon/doctor.js";
+import { workSessionDenialReason } from "../../mesh/denial-codes.js";
 export const WORK_CONTEXT_FAMILY_ID = "work-context";
 export const WORK_CONTEXT_FAMILY_TITLE = "Work context";
 const DEFAULT_DEPS = {
@@ -97,6 +98,9 @@ function runChecks(deps) {
     ]
         .filter(Boolean)
         .join(" ");
+    const quarantineDenialReason = showQuarantineReason
+        ? workSessionDenialReason(stats.lastQuarantineServerCode)
+        : undefined;
     results.push({
         status: stats.quarantined > 0 ? "WARN" : "PASS",
         checkId: "work-context.outbox-quarantined",
@@ -104,6 +108,7 @@ function runChecks(deps) {
         message: `Outbox quarantined count=${stats.quarantined}${showQuarantineReason
             ? ` (last reason=${stats.lastQuarantineReason ?? "unknown"}${quarantineDetails ? `; ${quarantineDetails}` : ""})`
             : ""}.`,
+        ...(quarantineDenialReason ? { remediation: quarantineDenialReason } : {}),
     });
     // Default-company mode + migration capability (US-017B)
     try {

package/dist/lib/mesh/client.js

@@ -79,6 +79,17 @@ export function createWorkSessionDeliverer(opts) {
                 if (status === 429 || (status >= 500 && status <= 599)) {
                     return { ok: false, retryable: true, code: `HTTP_${status}` };
                 }
+                if (status === 404 && isWorkSessionDenialCode(errorFields.code)) {
+                    // Keep the allowlisted code (FEATURE_DISABLED) so the refusal can be
+                    // explained and picked up by the default requeue filter.
+                    return {
+                        ok: false,
+                        retryable: false,
+                        code: "HTTP_404",
+                        httpStatus: 404,
+                        serverCode: errorFields.code,
+                    };
+                }
                 if (status === 404 ||
                     status === 409 ||
                     status === 410 ||

package/dist/lib/mesh/denial-codes.d.ts

@@ -1,5 +1,16 @@
-/** Explicit 401/403 codes returned by hq-pro's work-session registration path. */
-export declare const WORK_SESSION_DENIAL_CODES: readonly ["AUTH_REQUIRED", "AGENT_IDENTITY_UNVERIFIED", "IMPERSONATION_FORBIDDEN", "NO_PERSON_ENTITY", "INVALID_COMPANY", "WORK_REGISTRY_DISABLED"];
+/**
+ * Explicit refusal codes returned by hq-pro's work-session registration path:
+ * the 401/403 denials, plus the 404 FEATURE_DISABLED answer given while the
+ * company's Work Mesh Live setting is off.
+ */
+export declare const WORK_SESSION_DENIAL_CODES: readonly ["AUTH_REQUIRED", "AGENT_IDENTITY_UNVERIFIED", "IMPERSONATION_FORBIDDEN", "NO_PERSON_ENTITY", "INVALID_COMPANY", "WORK_REGISTRY_DISABLED", "FEATURE_DISABLED"];
+/**
+ * Refusals that end once the company owner turns a setting on. The default
+ * `hq mesh context requeue` filter re-sends operations stored with these.
+ */
+export declare const WORK_TRACKING_OFF_DENIAL_CODES: readonly WorkSessionDenialCode[];
 export type WorkSessionDenialCode = (typeof WORK_SESSION_DENIAL_CODES)[number];
 export declare function isWorkSessionDenialCode(value: unknown): value is WorkSessionDenialCode;
+/** Plain reason for a server denial code, or undefined when there is none. */
+export declare function workSessionDenialReason(value: unknown): string | undefined;
 //# sourceMappingURL=denial-codes.d.ts.map

package/dist/lib/mesh/denial-codes.js

@@ -1,4 +1,8 @@
-/** Explicit 401/403 codes returned by hq-pro's work-session registration path. */
+/**
+ * Explicit refusal codes returned by hq-pro's work-session registration path:
+ * the 401/403 denials, plus the 404 FEATURE_DISABLED answer given while the
+ * company's Work Mesh Live setting is off.
+ */
 export const WORK_SESSION_DENIAL_CODES = [
     "AUTH_REQUIRED",
     "AGENT_IDENTITY_UNVERIFIED",
@@ -6,9 +10,29 @@ export const WORK_SESSION_DENIAL_CODES = [
     "NO_PERSON_ENTITY",
     "INVALID_COMPANY",
     "WORK_REGISTRY_DISABLED",
+    "FEATURE_DISABLED",
+];
+/**
+ * Refusals that end once the company owner turns a setting on. The default
+ * `hq mesh context requeue` filter re-sends operations stored with these.
+ */
+export const WORK_TRACKING_OFF_DENIAL_CODES = [
+    "WORK_REGISTRY_DISABLED",
+    "FEATURE_DISABLED",
 ];
 export function isWorkSessionDenialCode(value) {
     return typeof value === "string" &&
         WORK_SESSION_DENIAL_CODES.includes(value);
 }
+/** Plain-language reasons for denial codes the user can act on. */
+const WORK_SESSION_DENIAL_REASONS = {
+    WORK_REGISTRY_DISABLED: "Work tracking is turned off for this company. The company owner can turn it on with: hq company --company <slug> settings set --work-registry-enabled true",
+    FEATURE_DISABLED: "Live work tracking is turned off for this company. The company owner can turn it on with: hq company --company <slug> settings set --work-mesh-live-enabled true",
+};
+/** Plain reason for a server denial code, or undefined when there is none. */
+export function workSessionDenialReason(value) {
+    return isWorkSessionDenialCode(value)
+        ? WORK_SESSION_DENIAL_REASONS[value]
+        : undefined;
+}
 //# sourceMappingURL=denial-codes.js.map

package/dist/lib/mesh/live/daemon/doctor.js

@@ -23,6 +23,7 @@ import { readDaemonState } from "./state.js";
 import { CLI_VERSION } from "../../../../cli-version.js";
 import { resolveRunningCliEntry } from "./install.js";
 import { readInstalledCliVersion } from "./version-drift.js";
+import { workSessionDenialReason } from "../../denial-codes.js";
 import { LEGACY_LISTENER_DOCTOR_LINE, legacyListenInstalled, } from "./legacy-listen.js";
 export const UNHEALTHY_SPOOL_AGE_MS = 60_000;
 function oldestJsonlAgeMs(filePath, nowMs) {
@@ -321,6 +322,9 @@ export function formatDaemonDoctor(report) {
             .filter(Boolean)
             .join(" ");
         lines.push(`outbox quarantined: ${report.outboxQuarantined} (last reason=${report.outboxLastQuarantineReason ?? "unknown"}${quarantineDetails ? `; ${quarantineDetails}` : ""})`);
+        const denialReason = workSessionDenialReason(report.outboxLastQuarantineServerCode);
+        if (denialReason)
+            lines.push(denialReason);
     }
     if (report.emitMode !== "legacy" && report.heldCount > 0) {
         lines.push(`held: ${report.heldCount} (needs_company; not sent as NONE)`);

package/dist/lib/work-context/outbox.js

@@ -8,7 +8,7 @@ import * as path from "node:path";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 import { atomicWriteJson, ensureOwnerDir } from "./atomic.js";
 import { NotTrackingError } from "./errors.js";
-import { isWorkSessionDenialCode } from "../mesh/denial-codes.js";
+import { isWorkSessionDenialCode, WORK_TRACKING_OFF_DENIAL_CODES, } from "../mesh/denial-codes.js";
 import { readSessionState, stripRegisterReceiptEpisodes, updateSessionState, writeAcknowledgedRegisterBinding, } from "./state.js";
 import { isSafeWorkContextSegment, workContextOutboxDir, workContextOutboxPath, } from "./paths.js";
 /** Base delay for outbox retry backoff (attempt 1 → 30s). */
@@ -390,8 +390,14 @@ export function requeueQuarantinedOutbox(root, opts = {}) {
     for (const op of listOutboxOperations(root)) {
         if (op.delivery !== "quarantined")
             continue;
-        if (errorCode !== null && op.lastErrorCode !== errorCode)
+        // Default filter: AUTH_DENIED, plus refusals stored with a server code
+        // that means work tracking was off for the company (a 404 FEATURE_DISABLED
+        // is stored as HTTP_404). An explicit errorCode matches lastErrorCode only.
+        const workTrackingWasOff = opts.errorCode === undefined &&
+            WORK_TRACKING_OFF_DENIAL_CODES.includes(op.lastServerErrorCode ?? "");
+        if (errorCode !== null && op.lastErrorCode !== errorCode && !workTrackingWasOff) {
             continue;
+        }
         op.delivery = "queued";
         op.attemptCount = 0;
         op.lastErrorCode = undefined;

package/dist/utils/resident-package-preload.d.ts

@@ -1,4 +1,4 @@
-export type ResidentPackagePath = "agent-kit" | "agent-mcp" | "auth-login" | "agents-terminal" | "bot" | "bot-logs-follow" | "childWrapper" | "coreJobRun" | "login" | "mcp" | "daemon" | "daemon-logs-follow" | "mesh-daemon" | "lanes-watch" | "monitor-wait" | "monitor-run" | "agents-message-wait" | "integrations-oauth-wait";
+export type ResidentPackagePath = "agent-kit" | "agent-mcp" | "auth-login" | "agents-terminal" | "bot" | "bot-logs-follow" | "childWrapper" | "coreJobRun" | "login" | "mcp" | "daemon" | "daemon-logs-follow" | "mesh-daemon" | "lanes-watch" | "monitor-wait" | "monitor-run" | "agents-message-wait" | "integrations-oauth-wait" | "secrets-sandbox" | "pkg-update" | "pack-install";
 /** Runtime modules that resident commands may need after a wait starts. */
 export declare const RESIDENT_PACKAGE_MODULES: Record<ResidentPackagePath, readonly string[]>;
 export declare class ResidentPackagePreloadError extends Error {

package/dist/utils/resident-package-preload.js

@@ -63,6 +63,23 @@ export const RESIDENT_PACKAGE_MODULES = {
     "monitor-run": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
     "agents-message-wait": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
     "integrations-oauth-wait": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
+    "secrets-sandbox": [],
+    "pkg-update": ["../sentry.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud"],
+    "pack-install": [
+        "../sentry.js",
+        "../lib/plan-limit-nag.js",
+        "../utils/plan-gate-error.js",
+        "open",
+        "../commands/mcp-serve.js",
+        "../lib/daemon/mcp-oauth.js",
+        "../lib/mcp/tools.js",
+        "../lib/mcp/prompts.js",
+        "../utils/sandbox-runner-client.js",
+        "../utils/cli-telemetry.js",
+        "../utils/cognito-session.js",
+        "../lib/first-sync-next-step.js",
+        "@indigoai-us/hq-cloud",
+    ],
 };
 const LOADERS = {
     "agent-kit": [
@@ -248,6 +265,33 @@ const LOADERS = {
         () => import("../lib/first-sync-next-step.js"),
         () => import("@indigoai-us/hq-cloud"),
     ],
+    "secrets-sandbox": [],
+    "pkg-update": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../utils/cognito-session.js"),
+        () => import("@indigoai-us/hq-cloud"),
+    ],
+    "pack-install": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+        () => import("../commands/mcp-serve.js"),
+        () => import("../lib/daemon/mcp-oauth.js"),
+        () => import("../lib/mcp/tools.js"),
+        () => import("../lib/mcp/prompts.js"),
+        () => import("../utils/sandbox-runner-client.js"),
+        () => import("../utils/cli-telemetry.js"),
+        () => import("../utils/cognito-session.js"),
+        () => import("../lib/first-sync-next-step.js"),
+        () => import("@indigoai-us/hq-cloud"),
+    ],
 };
 export class ResidentPackagePreloadError extends Error {
     moduleSpecifier;

package/dist/utils/secrets-sandbox-resident.d.ts

@@ -0,0 +1,5 @@
+import type { SandboxRunnerClient, SandboxRunnerJob, SandboxRunnerStartResponse } from "./sandbox-runner-client.js";
+import { type ResidentCommandLeaseOptions } from "./resident-package-preload.js";
+/** Poll a submitted remote job after loading local result and error-path modules. */
+export declare function runSandboxJobAfterSubmission(client: Pick<SandboxRunnerClient, "getJob" | "pollJob">, token: string, started: SandboxRunnerStartResponse, leaseOptions?: ResidentCommandLeaseOptions): Promise<SandboxRunnerJob>;
+//# sourceMappingURL=secrets-sandbox-resident.d.ts.map

package/dist/utils/secrets-sandbox-resident.js

@@ -0,0 +1,8 @@
+import { runResidentCommandWithPackageLease } from "./resident-package-preload.js";
+/** Poll a submitted remote job after loading local result and error-path modules. */
+export function runSandboxJobAfterSubmission(client, token, started, leaseOptions) {
+    return runResidentCommandWithPackageLease("secrets-sandbox", () => started.status === "succeeded" || started.status === "failed"
+        ? client.getJob(token, started.jobId)
+        : client.pollJob(token, started.jobId), leaseOptions);
+}
+//# sourceMappingURL=secrets-sandbox-resident.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.18",
+  "version": "5.343.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {