@indigoai-us/hq-cli 5.345.146 → 5.345.148

package/dist/lib/work-context/project.js

@@ -2,16 +2,24 @@
  * Project/task resolution for work-context (US-007B).
  *
  * Order:
- *   1. existing active binding (state bound / needs_task with projectId)
- *   2. trusted explicit (HQ_SPAWN_PROJECT/HQ_SPAWN_TASK, observation, meta.yaml)
- *   3. exactly one deterministic mapping (cwd under companies/{slug}/projects/{project}/
- *      or a registry resource that names exactly one project for the repo)
+ *   1. explicit trusted bind (observation authority "trusted"; shell alias
+ *      `project` / `task`). Beats an existing automatic binding and is not
+ *      refused because another session owns a lane. Refused when the project
+ *      directory is not under the resolved company.
+ *   2. existing active binding (state bound / needs_task with projectId).
+ *      Ambient HQ_SPAWN_PROJECT and meta.yaml do not override it.
+ *   3. trusted explicit (HQ_SPAWN_PROJECT/HQ_SPAWN_TASK, observation projectId,
+ *      meta.yaml). Meta and the bare `project` alias are refused when another
+ *      session owns an active lane for that project. Spawn is not.
+ *   4. exactly one deterministic mapping (cwd or registry), refused when
+ *      another session owns an active lane for that project.
  * Soft evidence never auto-binds — candidates are server-owned (GET .../candidates).
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { projectIdFromCwd } from "./company.js";
 import { normalizeTaskId } from "./contract.js";
+import { foreignSessionOwnsLane } from "./lane-bind.js";
 import { findEnclosingGitDir, normalizeRemoteOwnerName, readOriginRemoteUrl, } from "./repo-remote.js";
 const SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function normalizeSlug(value) {
@@ -120,6 +128,55 @@ export function projectIdFromRepoRegistry(input) {
         return [...matches][0];
     return null;
 }
+function readResolveMeta(input) {
+    if (input.metaProjectId !== undefined || input.metaTaskId !== undefined) {
+        return {
+            projectId: normalizeSlug(input.metaProjectId) ?? undefined,
+            taskId: normalizeSlug(input.metaTaskId) ?? undefined,
+        };
+    }
+    return readMetaProjectTask(input.sessionId, input.hqRoot);
+}
+function trustedTaskFrom(trusted, spawnTask) {
+    if (trusted?.taskId || trusted?.storyId) {
+        const norm = normalizeTaskId({
+            taskId: trusted.taskId,
+            storyId: trusted.storyId,
+        });
+        if (norm.ok)
+            return norm.taskId;
+    }
+    // Spawn wins over the bare `task` alias, matching the pre-authority order.
+    return spawnTask ?? normalizeSlug(trusted?.task);
+}
+/**
+ * A trusted project belongs to the resolved company only when that company's
+ * project directory exists. Missing company or root fails closed.
+ */
+function trustedProjectInResolvedCompany(input, projectId) {
+    const companySlug = input.resolvedCompanySlug?.trim();
+    const hqRoot = input.hqRoot?.trim();
+    if (!companySlug || !hqRoot)
+        return false;
+    try {
+        return fs.statSync(path.join(hqRoot, "companies", companySlug, "projects", projectId)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** Meta, cwd, and registry must not attach a project another session owns. */
+function automaticProjectBlocked(input, projectId) {
+    const companySlug = input.resolvedCompanySlug?.trim()
+        || input.existingState?.companySlug?.trim();
+    return foreignSessionOwnsLane({
+        hqRoot: input.hqRoot,
+        projectId,
+        sessionId: input.sessionId,
+        companySlug,
+        laneCache: input.laneCache,
+    });
+}
 /**
  * Resolve project and task. Never invents an adhoc target. Soft evidence is
  * out of scope here (server candidates only).
@@ -127,7 +184,30 @@ export function projectIdFromRepoRegistry(input) {
 export function resolveProjectTask(input) {
     const env = input.env ?? process.env;
     const state = input.existingState ?? null;
-    // 1. Existing active binding.
+    const trusted = input.trusted;
+    const spawnTask = normalizeSlug(env.HQ_SPAWN_TASK);
+    // 1. Explicit trusted bind. The shell writes `project`/`task` plus
+    // authority "trusted". That beats an existing automatic binding. Do not
+    // keep the previous project's task when the project changes.
+    const explicitTrusted = trusted?.authority === "trusted"
+        ? normalizeSlug(trusted.projectId ?? trusted.project)
+        : undefined;
+    if (explicitTrusted && trustedProjectInResolvedCompany(input, explicitTrusted)) {
+        const meta = readResolveMeta(input);
+        let taskId = trustedTaskFrom(trusted, undefined);
+        if (!taskId && state?.projectId === explicitTrusted)
+            taskId = state.taskId;
+        if (!taskId && meta.projectId === explicitTrusted)
+            taskId = meta.taskId;
+        return {
+            projectId: explicitTrusted,
+            taskId,
+            source: "trusted_explicit",
+            complete: Boolean(explicitTrusted && taskId),
+            authority: "trusted",
+        };
+    }
+    // 2. Existing active binding. Ambient spawn and meta do not override it.
     if (state) {
         const boundStatuses = new Set(["bound", "needs_task", "needs_project"]);
         if (boundStatuses.has(state.contextStatus) &&
@@ -154,40 +234,49 @@ export function resolveProjectTask(input) {
             };
         }
     }
-    // 2. Trusted explicit: env + observation + meta.yaml.
+    // 3. Trusted explicit: spawn + canonical observation projectId + meta.
+    // The bare `project` alias without authority is meta evidence.
     const spawnProject = normalizeSlug(env.HQ_SPAWN_PROJECT);
-    const spawnTask = normalizeSlug(env.HQ_SPAWN_TASK);
-    const trustedProject = normalizeSlug(input.trusted?.projectId ?? spawnProject);
-    let trustedTask = spawnTask;
-    if (input.trusted?.taskId || input.trusted?.storyId) {
-        const norm = normalizeTaskId({
-            taskId: input.trusted.taskId,
-            storyId: input.trusted.storyId,
-        });
-        if (norm.ok)
-            trustedTask = norm.taskId;
-    }
-    else if (spawnTask) {
-        trustedTask = spawnTask;
+    // A refused trusted project must not come back through the same observation's
+    // project alias or canonical projectId at a lower tier.
+    const canonicalTrustedProject = explicitTrusted
+        ? undefined
+        : normalizeSlug(trusted?.projectId);
+    const aliasProject = explicitTrusted
+        ? undefined
+        : normalizeSlug(trusted?.project);
+    // The refused observation's task is dropped with its project.
+    const trustedTask = explicitTrusted
+        ? spawnTask
+        : trustedTaskFrom(trusted, spawnTask);
+    const resolvedMeta = readResolveMeta(input);
+    // The bind script writes meta before reconcile, so a refused trusted bind
+    // also left its project in meta. When a trusted bind was refused, meta must
+    // pass the same company check before it can attach.
+    const meta = explicitTrusted
+        && resolvedMeta.projectId
+        && !trustedProjectInResolvedCompany(input, resolvedMeta.projectId)
+        ? {}
+        : resolvedMeta;
+    const explicitProject = canonicalTrustedProject ?? spawnProject;
+    if (explicitProject) {
+        const taskId = trustedTask ?? meta.taskId;
+        return {
+            projectId: explicitProject,
+            taskId,
+            source: "trusted_explicit",
+            complete: Boolean(explicitProject && taskId),
+        };
     }
-    const meta = input.metaProjectId !== undefined || input.metaTaskId !== undefined
-        ? {
-            projectId: normalizeSlug(input.metaProjectId) ?? undefined,
-            taskId: normalizeSlug(input.metaTaskId) ?? undefined,
-        }
-        : readMetaProjectTask(input.sessionId, input.hqRoot);
-    const explicitProject = trustedProject ?? meta.projectId;
-    const explicitTask = trustedTask ?? meta.taskId;
-    if (explicitProject || explicitTask) {
-        // Prefer spawn/trusted over meta; already merged above.
-        if (explicitProject) {
-            return {
-                projectId: explicitProject,
-                taskId: explicitTask,
-                source: "trusted_explicit",
-                complete: Boolean(explicitProject && explicitTask),
-            };
-        }
+    const metaProject = meta.projectId ?? aliasProject;
+    if (metaProject && !automaticProjectBlocked(input, metaProject)) {
+        const taskId = trustedTask ?? meta.taskId;
+        return {
+            projectId: metaProject,
+            taskId,
+            source: "trusted_explicit",
+            complete: Boolean(metaProject && taskId),
+        };
     }
     // Preserve existing project from needs_task without task (not a full bind).
     if (state?.projectId && state.contextStatus === "needs_task") {
@@ -198,9 +287,9 @@ export function resolveProjectTask(input) {
             complete: Boolean(state.taskId),
         };
     }
-    // 3. Exactly one deterministic mapping.
+    // 4. Exactly one deterministic mapping, unless another session owns it.
     const fromCwd = projectIdFromCwd(input.cwd, input.hqRoot);
-    if (fromCwd) {
+    if (fromCwd && !automaticProjectBlocked(input, fromCwd)) {
         return {
             projectId: fromCwd,
             source: "deterministic_cwd",
@@ -213,10 +302,10 @@ export function resolveProjectTask(input) {
             cwd: input.cwd,
             hqRoot: input.hqRoot,
             companySlug: state?.companySlug ??
-                input.trusted?.companySlug ??
+                trusted?.companySlug ??
                 normalizeSlug(env.HQ_SPAWN_COMPANY),
         });
-    if (fromRegistry) {
+    if (fromRegistry && !automaticProjectBlocked(input, fromRegistry)) {
         return {
             projectId: fromRegistry,
             source: "deterministic_registry",

package/dist/lib/work-context/reconcile.d.ts

@@ -18,10 +18,16 @@ export interface ReconcileObservation {
     clientOperationId: string;
     explicit?: TrustedExplicitContext & {
         companySlug?: string;
+        project?: string;
+        task?: string;
+        authority?: string;
     };
     /** Alias for explicit (dispatch envelope). */
     trustedContext?: TrustedExplicitContext & {
         companySlug?: string;
+        project?: string;
+        task?: string;
+        authority?: string;
     };
     untrackedOrigin?: "user";
     /** Structured untracked choice; only origin "user" is accepted. */

package/dist/lib/work-context/reconcile.js

@@ -11,6 +11,7 @@ import { WORK_CONTEXT_CONTRACT_VERSION, normalizeTaskId, } from "./contract.js";
 import { EXIT_INVALID_IDENTITY, EXIT_NOT_TRACKING, EXIT_OK, InvalidDecisionOriginError, NotTrackingError, } from "./errors.js";
 import { decisionFromCandidates, } from "./organize.js";
 import { refineProjectBinding } from "./bind-best.js";
+import { foreignSessionOwnsLane } from "./lane-bind.js";
 import { rebindNeedsProjectOnPrompt } from "./prompt-rebind.js";
 import { resolveProjectTask, shouldAskAfter } from "./project.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey } from "./repo-remote.js";
@@ -502,6 +503,8 @@ export async function reconcileObservation(obs, deps) {
             contextStatus: "needs_project",
         }
         : prior;
+    // Every lane check in this reconcile reads the lane files once.
+    const laneCache = new Map();
     let projectResolved = resolveProjectTask({
         sessionId,
         env,
@@ -509,6 +512,8 @@ export async function reconcileObservation(obs, deps) {
         cwd,
         hqRoot,
         existingState: projectPrior,
+        resolvedCompanySlug: resolvedCompany.slug,
+        laneCache,
     });
     // Deterministic cwd projects belong to the cwd company. A higher-precedence
     // identity UID must not adopt a project from an unrelated/unverified slug.
@@ -525,6 +530,7 @@ export async function reconcileObservation(obs, deps) {
     let projectGate;
     if (projectResolved &&
         projectId &&
+        projectResolved.authority !== "trusted" &&
         projectResolved.source !== "existing_binding" &&
         obs.source !== "transcript" &&
         hqRoot &&
@@ -539,11 +545,23 @@ export async function reconcileObservation(obs, deps) {
             nowMs: nowFn().getTime(),
         });
         if (refined.action === "bind") {
-            if (refined.projectId !== projectId)
-                taskId = undefined;
-            projectId = refined.projectId;
-            projectBindReason = refined.reason;
-            diagnostics.push(`project bind: ${refined.reason}`);
+            const switching = refined.projectId !== projectId;
+            const foreignSwitch = switching && foreignSessionOwnsLane({
+                hqRoot,
+                projectId: refined.projectId,
+                sessionId,
+                companySlug: resolvedCompany.slug,
+                laneCache,
+            });
+            // Confirming the already-allowed hint is fine. Do not follow a refine
+            // switch onto a lane another session owns.
+            if (!foreignSwitch) {
+                if (switching)
+                    taskId = undefined;
+                projectId = refined.projectId;
+                projectBindReason = refined.reason;
+                diagnostics.push(`project bind: ${refined.reason}`);
+            }
         }
         else if (refined.action === "create") {
             projectBindReason = refined.reason;
@@ -850,6 +868,7 @@ export async function reconcileObservation(obs, deps) {
             ...(decision ? { decision } : {}),
             ...(companyConfidence ? { companyConfidence } : {}),
             ...(presenceLeave ? { presenceLeave } : {}),
+            ...(projectResolved?.authority === "trusted" ? { projectBindAuthority: "trusted" } : {}),
             ...bindStateFields,
             ...transcriptFields,
         }, prior, companyRebind
@@ -936,6 +955,7 @@ export async function reconcileObservation(obs, deps) {
                 startedAt,
                 ...(typeof toolWrites === "number" ? { toolWrites } : {}),
                 ...(hasTurn ? { hasTurn: true } : {}),
+                ...(projectResolved?.authority === "trusted" ? { projectBindAuthority: "trusted" } : {}),
                 ...bindStateFields,
                 ...transcriptFields,
             }, 

package/dist/lib/work-context/state.d.ts

@@ -93,6 +93,12 @@ export interface SessionStateFile {
     companyConfidence?: "device_default";
     /** Why the current project was chosen, or why the session is asking. */
     projectBindReason?: string;
+    /**
+     * LOCAL-ONLY. "trusted" means an explicit trusted bind, operator
+     * bind-project, or organize receipt chose this project. Automatic rebind
+     * must not replace it until the next explicit choice.
+     */
+    projectBindAuthority?: "trusted";
     /** Ranked alternatives when the session is waiting for a project choice. */
     projectCandidates?: Array<{
         projectId: string;

package/dist/lib/work-context/state.js

@@ -207,6 +207,8 @@ function projectSessionState(state) {
         out.companyConfidence = state.companyConfidence;
     if (state.projectBindReason)
         out.projectBindReason = state.projectBindReason;
+    if (state.projectBindAuthority === "trusted")
+        out.projectBindAuthority = "trusted";
     if (state.projectCandidates?.length)
         out.projectCandidates = state.projectCandidates;
     if (state.projectGate)
@@ -299,6 +301,18 @@ export function mergeLocalSessionFields(next, prior, options = {}) {
         sameBinding) {
         out.bindingEpisodeId = prior.bindingEpisodeId;
     }
+    // A later hook that rewrites the same project in the same company must not
+    // drop an explicit trusted lock. A company change clears it even when the
+    // project slug matches. A different project keeps the lock only when the
+    // caller sets it again. A hook that omits company still counts as the same
+    // company, because preserveCompanyBinding copied the prior company above.
+    if (sameCompanyBinding &&
+        out.projectBindAuthority !== "trusted" &&
+        prior.projectBindAuthority === "trusted" &&
+        prior.projectId &&
+        out.projectId === prior.projectId) {
+        out.projectBindAuthority = "trusted";
+    }
     return out;
 }
 function acknowledgedStatus(binding) {
@@ -397,7 +411,20 @@ export function writeAcknowledgedRegisterBinding(binding, root, now = () => new
         }
         const acknowledgementStrength = acknowledged === "bound" ? 3 : acknowledged === "needs_task" ? 2 : 1;
         const priorStrength = bindingStrength(prior);
-        const preservePriorBinding = Boolean(prior.companyUid === binding.companyUid && priorStrength > acknowledgementStrength);
+        // Acked register ops are never pruned, and flush replays them on every
+        // cycle. An older ack for another project in the same company must not
+        // undo an explicit trusted bind, whatever its strength.
+        const sameCompanyAsPrior = prior.companyUid === binding.companyUid ||
+            Boolean(!prior.companyUid &&
+                prior.companySlug &&
+                binding.companySlug &&
+                prior.companySlug.toLowerCase() === binding.companySlug.toLowerCase());
+        const keepTrustedPrior = Boolean(sameCompanyAsPrior &&
+            prior.projectBindAuthority === "trusted" &&
+            prior.projectId &&
+            binding.projectId !== prior.projectId);
+        const preservePriorBinding = Boolean(keepTrustedPrior ||
+            (prior.companyUid === binding.companyUid && priorStrength > acknowledgementStrength));
         const sameBindingAsPrior = prior.companyUid === binding.companyUid &&
             prior.projectId === binding.projectId &&
             prior.taskId === binding.taskId;
@@ -474,6 +501,7 @@ export function applyOperatorProjectBinding(state, projectId, now = () => new Da
         projectGate: undefined,
         projectCandidates: undefined,
         projectBindReason: `operator selected ${projectId}`,
+        projectBindAuthority: "trusted",
         updatedAt: now().toISOString(),
     };
 }

package/dist/lib/workers-registry/index.d.ts

@@ -23,6 +23,12 @@ export interface GenerateWorkersRegistryResult {
  * own, and because duplicates resolve by path order — a tenant path sorts before
  * both `core` and `personal` — the checkout wins. The operator's actual worker
  * then silently vanishes from the registry every skill reads.
+ *
+ * Claude Code worktrees (`.claude/worktrees/<name>/`) and Codex worktrees
+ * (`.codex/worktrees/<name>/`) are the same trap in a different folder: a
+ * nested HQ root under a company project. Those copies land in the registry as
+ * `companies/<slug>/…/.claude/worktrees/…` or `.codex/worktrees/…` paths, so
+ * `hq lanes create` then fails with `worker_tenancy_unresolved`.
  */
 export declare function isExcludedWorkerDirectory(relativeDirectory: string): boolean;
 /**

package/dist/lib/workers-registry/index.js

@@ -157,9 +157,17 @@ function withoutTimestamp(content) {
  * own, and because duplicates resolve by path order — a tenant path sorts before
  * both `core` and `personal` — the checkout wins. The operator's actual worker
  * then silently vanishes from the registry every skill reads.
+ *
+ * Claude Code worktrees (`.claude/worktrees/<name>/`) and Codex worktrees
+ * (`.codex/worktrees/<name>/`) are the same trap in a different folder: a
+ * nested HQ root under a company project. Those copies land in the registry as
+ * `companies/<slug>/…/.claude/worktrees/…` or `.codex/worktrees/…` paths, so
+ * `hq lanes create` then fails with `worker_tenancy_unresolved`.
  */
 export function isExcludedWorkerDirectory(relativeDirectory) {
     const normalized = relativeDirectory.replaceAll('\\', '/');
+    if (/(?:^|\/)\.(?:claude|codex)\/worktrees(?:\/|$)/.test(normalized))
+        return true;
     const [root, tenant, nested] = normalized.split('/');
     if (root !== 'companies')
         return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);

package/dist/utils/copy-tree.d.ts

@@ -0,0 +1,61 @@
+/**
+ * copy-tree: portable replacement for the `rsync -a` copies on the pack
+ * install path.
+ *
+ * Pack installs used to shell out to `rsync`, which Windows does not ship, so
+ * every git-subpath or local-directory install failed there with
+ * `spawnSync rsync ENOENT`. This module does the same copy in Node on every
+ * platform:
+ *
+ *   - `copyTree(src, dest)` copies the CONTENTS of `src` into `dest` (the
+ *     `rsync -a src/ dest/` trailing-slash form). Directories recurse, regular
+ *     files keep their permission bits and mtimes, and symlinks are recreated
+ *     as symlinks with the identical target string. Links are never followed.
+ *     Optional `exclude` names match an entry's basename at any depth, like
+ *     `rsync --exclude=<name>`. Sockets, FIFOs and devices are skipped with a
+ *     warning, as a non-root `rsync -a` does.
+ *   - `removeTreeNoFollow(target)` deletes a tree without ever following a
+ *     symlink or junction inside it: each entry is lstat'd, links are removed
+ *     as links (unlink, or a non-recursive rmdir for a Windows junction), and
+ *     directories are emptied then removed with a non-recursive rmdir. A
+ *     Windows directory that is a reparse point but not a link (a volume mount
+ *     point, a cloud-synced placeholder folder) stops the removal with
+ *     `ReparsePointError`; its contents are never deleted.
+ *
+ * On Windows, creating a symlink needs Developer Mode or an elevated shell.
+ * When that fails with EPERM/EACCES and the link points at a directory inside
+ * the tree being copied, the copy falls back to a junction (no privilege
+ * needed). A junction needs an absolute target, so it points at the matching
+ * entry under `finalRoot`: the path the copy will live at once the caller has
+ * renamed it into place. Any other link target throws `CopyTreeLinkError` with
+ * a Developer Mode hint instead of silently dropping the link.
+ *
+ * TODO(windows-links): src/utils/safe-link.ts (PR 1967, branch
+ * fix/windows-install-path-daemon) adds its own junction fallback and
+ * link-only removal. Whichever of the two PRs merges second should reconcile
+ * these helpers into one module.
+ */
+export interface CopyTreeOptions {
+    /** Entry basenames to skip at any depth (`rsync --exclude=<name>`). */
+    exclude?: readonly string[];
+    /**
+     * Where `dest` will end up after the caller renames it (for example a
+     * staging dir that is renamed into `core/packages/<name>`). Junction
+     * fallbacks point under this path so they still resolve after the rename.
+     * Defaults to `dest`.
+     */
+    finalRoot?: string;
+}
+export declare class CopyTreeLinkError extends Error {
+    constructor(linkPath: string, target: string, cause: NodeJS.ErrnoException);
+}
+export declare class ReparsePointError extends Error {
+    constructor(dir: string);
+}
+export declare function copyTree(src: string, dest: string, opts?: CopyTreeOptions): void;
+/**
+ * Remove `target` and everything under it without following links. A missing
+ * target is not an error. If `target` itself is a link, only the link goes.
+ */
+export declare function removeTreeNoFollow(target: string): void;
+//# sourceMappingURL=copy-tree.d.ts.map