@indigoai-us/hq-cli 5.345.147 → 5.345.149

package/dist/commands/core-refresh-vault-access-native.js

@@ -1,6 +1,8 @@
 /** Native local manifest refresh for core/scripts/refresh-vault-access.sh. */
 import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
@@ -36,22 +38,152 @@ export const REFRESH_VAULT_ACCESS_HELP = `# hq-core: public
 # the authoritative security boundary — this manifest only powers the local
 # early-warning block for read-only shares.
 #
+# Scope: with no --company the roll-up rewrites the whole manifest. With
+# --company, only the named companies' entries are replaced; every other
+# company's entry is kept as it was. Writes are atomic and serialized by a
+# lock file next to the manifest.
+#
 # Usage:
 #   bash core/scripts/refresh-vault-access.sh [--company <slug>]... [--root <hqRoot>]
 #
 `.replace(/^# ?/gm, "");
-function defaultHq(args, cwd, env) {
-    const spawnPlan = planHqSpawn(args, env, cwd);
+/**
+ * Per-call ceiling for each child `hq` call. SessionStart runs this helper, so
+ * a stalled vault request must not outlive the session that started it.
+ */
+export const DEFAULT_HQ_CALL_TIMEOUT_MS = 30_000;
+function hqCallTimeoutMs(env) {
+    const parsed = Number(env.HQ_VAULT_ACCESS_TIMEOUT_MS);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_HQ_CALL_TIMEOUT_MS;
+}
+/**
+ * Supervisor for one child call when the whole process tree must die on
+ * timeout. On Windows `hq` is a cmd.exe shim around node, and spawnSync's
+ * timeout ends only cmd.exe: the node child keeps running and keeps the
+ * output pipes open. The supervisor runs the call asynchronously, kills the
+ * tree on timeout (`taskkill /T /F` on Windows, the process group elsewhere),
+ * and writes the result as JSON. It exits without waiting for pipes still
+ * held by a grandchild, so the parent's spawnSync returns.
+ */
+const TREE_KILL_SUPERVISOR = String.raw `
+const { spawn, spawnSync } = require("node:child_process");
+const path = require("node:path");
+const plan = JSON.parse(process.env.HQ_TREE_KILL_PLAN);
+delete process.env.HQ_TREE_KILL_PLAN;
+const win = process.platform === "win32";
+let done = false;
+const finish = (result) => {
+  if (done) return;
+  done = true;
+  process.stdout.write(JSON.stringify(result), () => process.exit(0));
+};
+const out = [];
+const err = [];
+let child;
+try {
+  child = spawn(plan.cmd, plan.args, {
+    cwd: plan.cwd,
+    env: process.env,
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: plan.shell,
+    windowsHide: true,
+    windowsVerbatimArguments: plan.verbatim,
+    detached: !win,
+  });
+} catch (error) {
+  finish({ error: String(error && error.message), errorCode: error && error.code });
+}
+if (child) {
+  const killTree = () => {
+    if (child.pid === undefined) return;
+    if (win) {
+      const taskkill = process.env.SystemRoot ? path.join(process.env.SystemRoot, "System32", "taskkill.exe") : "taskkill";
+      spawnSync(taskkill, ["/T", "/F", "/PID", String(child.pid)], { stdio: "ignore", windowsHide: true, timeout: 10000 });
+    } else {
+      try { process.kill(-child.pid, "SIGKILL"); } catch {}
+    }
+  };
+  const timer = setTimeout(() => { killTree(); finish({ timedOut: true }); }, plan.timeoutMs);
+  child.stdout.on("data", (chunk) => out.push(chunk));
+  child.stderr.on("data", (chunk) => err.push(chunk));
+  const result = (code) => ({ code, stdout: Buffer.concat(out).toString("utf8"), stderr: Buffer.concat(err).toString("utf8") });
+  child.on("error", (error) => { clearTimeout(timer); finish({ error: error.message, errorCode: error.code }); });
+  child.on("close", (code) => { clearTimeout(timer); finish(result(code ?? 128)); });
+  // A grandchild that outlives the call can hold the pipes open. Report once
+  // the direct child has exited and the pipes have had a moment to drain.
+  child.on("exit", (code) => { setTimeout(() => { clearTimeout(timer); finish(result(code ?? 128)); }, 500).unref(); });
+}
+`;
+/** Extra time the parent allows the supervisor beyond the call timeout, for taskkill and startup. */
+const SUPERVISOR_GRACE_MS = 15_000;
+/**
+ * Run one child `hq` call with a timeout and with browser sign-in disabled.
+ * Without `HQ_NO_BROWSER_LOGIN` (read by cognito-session's
+ * resolveInteractiveLogin) a signed-out child opens a browser login and
+ * waits on it indefinitely. On Windows the call runs under a supervisor so a
+ * timeout ends the cmd.exe shim and every process under it.
+ */
+/** Windows npm shims run hq under cmd.exe, so only there does a plain kill leave the real hq running. */
+export function usesTreeKillByDefault(platform = process.platform) {
+    return platform === "win32";
+}
+export function runHqChild(args, cwd, env, killTree = usesTreeKillByDefault()) {
+    const childEnv = { ...env, HQ_NO_BROWSER_LOGIN: "1" };
+    const timeoutMs = hqCallTimeoutMs(env);
+    const timedOut = () => ({ code: 124, stdout: "", stderr: `hq ${args.join(" ")} timed out after ${timeoutMs}ms`, timedOut: true });
+    const failed = (message, code) => ({ code: 127, stdout: "", stderr: message, missing: code === "ENOENT" });
+    const spawnPlan = planHqSpawn(args, childEnv, cwd);
+    if (killTree) {
+        const plan = JSON.stringify({
+            cmd: spawnPlan.cmd,
+            args: spawnPlan.args,
+            cwd,
+            shell: spawnPlan.shell,
+            verbatim: Boolean(spawnPlan.windowsVerbatimArguments),
+            timeoutMs,
+        });
+        const supervised = spawnSync(process.execPath, ["-e", TREE_KILL_SUPERVISOR], {
+            cwd,
+            env: { ...childEnv, HQ_TREE_KILL_PLAN: plan },
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: timeoutMs + SUPERVISOR_GRACE_MS,
+            killSignal: "SIGKILL",
+            maxBuffer: 64 * 1024 * 1024,
+            windowsHide: true,
+        });
+        if (supervised.error) {
+            const code = supervised.error.code;
+            return code === "ETIMEDOUT" ? timedOut() : failed(supervised.error.message, code);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(String(supervised.stdout ?? ""));
+        }
+        catch {
+            return { code: supervised.status ?? 128, stdout: "", stderr: String(supervised.stderr ?? "") };
+        }
+        if (parsed.timedOut)
+            return timedOut();
+        if (parsed.error !== undefined)
+            return failed(parsed.error, parsed.errorCode);
+        return { code: parsed.code ?? 128, stdout: parsed.stdout ?? "", stderr: parsed.stderr ?? "" };
+    }
     const result = spawnSync(spawnPlan.cmd, spawnPlan.args, {
         cwd,
-        env,
+        env: childEnv,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
         shell: spawnPlan.shell,
+        timeout: timeoutMs,
+        killSignal: "SIGKILL",
+        windowsHide: true,
         ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
     });
-    if (result.error)
-        return { code: 127, stdout: "", stderr: result.error.message, missing: result.error.code === "ENOENT" };
+    if (result.error) {
+        const code = result.error.code;
+        return code === "ETIMEDOUT" ? timedOut() : failed(result.error.message, code);
+    }
     return { code: result.status ?? 128, stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? "") };
 }
 function executableOnPath(name, value) {
@@ -78,7 +210,7 @@ export function createRefreshVaultAccessDependencies(cwd, env, now) {
         env,
         now,
         hqAvailable: executableOnPath("hq", env.PATH),
-        runHq: (args, directory) => defaultHq(args, directory, env),
+        runHq: (args, directory) => runHqChild(args, directory, env),
     };
 }
 function isHqRoot(root) {
@@ -167,13 +299,18 @@ function roleFromTable(output, email) {
     }
     return "unknown";
 }
+/** `hq whoami` prints this when no person session is cached. */
+const SIGNED_OUT_PATTERN = /^Not logged in\b/m;
 function resolveEmail(deps, runHq) {
     const override = deps.env.HQ_VAULT_ACCESS_EMAIL ?? "";
     if (override)
-        return { email: override, stderr: "" };
+        return { email: override, stderr: "", signedOut: false };
     const result = runHq(["whoami"], deps.cwd);
     const email = getEmail(result.stdout);
-    return { email, stderr: email ? "" : log("could not determine caller email — roles will be 'unknown' (hook will not enforce)") };
+    // An API key reaches the vault without a person session, so only a
+    // key-less caller whose whoami reports no session is treated as signed out.
+    const signedOut = !email && !deps.env.HQ_API_KEY?.trim() && SIGNED_OUT_PATTERN.test(cleanAnsi(result.stdout));
+    return { email, signedOut, stderr: email ? "" : log("could not determine caller email — roles will be 'unknown' (hook will not enforce)") };
 }
 export function runRefreshVaultAccess(args, deps) {
     const parsed = parseOptions(args);
@@ -186,11 +323,19 @@ export function runRefreshVaultAccess(args, deps) {
         return { code: 1, stdout: "", stderr: log("could not resolve the HQ root (pass --root <hqRoot>)") };
     if (!deps.hqAvailable)
         return { code: 0, stdout: "", stderr: log("hq CLI not found — nothing refreshed (the write-access hook stays fail-open without a manifest)") };
-    const runHq = deps.runHq ?? ((hqArgs, cwd) => defaultHq(hqArgs, cwd, deps.env));
+    const runHq = deps.runHq ?? ((hqArgs, cwd) => runHqChild(hqArgs, cwd, deps.env));
     const identity = resolveEmail(deps, runHq);
+    if (identity.signedOut) {
+        return { code: 0, stdout: "", stderr: log("not signed in to HQ — nothing refreshed (run `hq login`; the write-access hook stays fail-open without a manifest)") };
+    }
     let stderr = identity.stderr;
-    const explicit = parsed.slugs;
+    const explicit = [...new Set(parsed.slugs)];
     const allGrants = new Map();
+    // Companies whose entry this run replaces. A scoped run (--company) owns only
+    // the companies it queried successfully; every other company already in the
+    // manifest is carried over untouched. The unscoped roll-up owns the whole
+    // manifest, so a company that lost all its grants drops out of it.
+    const refreshed = new Set();
     if (explicit.length > 0) {
         for (const slug of explicit) {
             const result = runHq(["files", "shared-with-me", "--company", slug], deps.cwd);
@@ -198,45 +343,228 @@ export function runRefreshVaultAccess(args, deps) {
                 stderr += log(`skipping ${slug} — shared-with-me query failed`);
                 continue;
             }
-            const rows = parseGrantTable(result.stdout);
-            for (const [company, grants] of rows)
-                allGrants.set(company, [...(allGrants.get(company) ?? []), ...grants]);
+            refreshed.add(slug);
+            const grants = parseGrantTable(result.stdout).get(slug) ?? [];
+            allGrants.set(slug, [...(allGrants.get(slug) ?? []), ...grants]);
         }
     }
     else {
         const result = runHq(["files", "shared-with-me"], deps.cwd);
         if (result.code !== 0)
             return { code: 0, stdout: "", stderr: `${stderr}${log("shared-with-me roll-up failed — nothing refreshed")}` };
-        for (const [company, grants] of parseGrantTable(result.stdout))
+        for (const [company, grants] of parseGrantTable(result.stdout)) {
             allGrants.set(company, grants);
+            refreshed.add(company);
+        }
     }
-    const companies = new Set(allGrants.keys());
-    for (const slug of explicit)
-        companies.add(slug);
-    const sortedSlugs = [...companies].sort();
-    if (sortedSlugs.length === 0)
+    if (explicit.length > 0 && refreshed.size === 0)
+        return { code: 0, stdout: "", stderr: `${stderr}${log("no requested company could be queried — nothing refreshed")}` };
+    if (explicit.length === 0 && refreshed.size === 0)
         stderr += log("no explicit grants found — writing an empty manifest (hook stays fail-open everywhere)");
-    const companyData = {};
-    for (const slug of sortedSlugs) {
+    const fresh = new Map();
+    for (const slug of [...refreshed].sort()) {
         let role = "unknown";
         if (identity.email) {
             const result = runHq(["members", "--company", slug, "list"], deps.cwd);
             role = result.code === 0 ? roleFromTable(result.stdout, identity.email) : "unknown";
         }
         const grants = (allGrants.get(slug) ?? []).map((grant) => ({ path: grant.path, permission: grant.permission }));
-        companyData[slug] = { role, grants };
+        fresh.set(slug, { role, grants });
     }
-    const manifest = { version: 1, generatedAt: deps.now().toISOString().replace(/\.\d{3}Z$/, "Z"), companies: companyData };
     const directory = path.join(root, ".hq");
     fs.mkdirSync(directory, { recursive: true });
     const target = path.join(directory, "vault-access.json");
-    const temp = `${target}.${process.pid}.${Math.random().toString(16).slice(2)}`;
-    fs.writeFileSync(temp, serializeJqJson(manifest, "pretty"), { encoding: "utf8", mode: 0o600, flag: "wx" });
-    fs.chmodSync(temp, 0o600);
-    fs.renameSync(temp, target);
-    stderr += log(`wrote .hq/vault-access.json (${sortedSlugs.length} companies, identity: ${identity.email || "unknown"})`);
+    // Read the current manifest only once the lock is held, after the slow hq
+    // queries, so a refresh for another company that finished meanwhile is kept.
+    const written = withManifestLock(target, deps.lockWaitMs ?? LOCK_WAIT_MS, (stillOwned) => {
+        // Company slugs come from --company and from the manifest, so they are
+        // kept in a Map and a null-prototype object; "__proto__" stays a plain key.
+        const companyData = new Map();
+        if (explicit.length > 0) {
+            const existing = readCompanies(target);
+            stderr += existing.warning;
+            for (const [slug, entry] of Object.entries(existing.companies))
+                if (!refreshed.has(slug))
+                    companyData.set(slug, entry);
+        }
+        for (const [slug, entry] of fresh)
+            companyData.set(slug, entry);
+        const sorted = Object.create(null);
+        for (const slug of [...companyData.keys()].sort())
+            sorted[slug] = companyData.get(slug);
+        const manifest = { version: 1, generatedAt: deps.now().toISOString().replace(/\.\d{3}Z$/, "Z"), companies: sorted };
+        const temp = `${target}.${process.pid}.${randomBytes(8).toString("hex")}`;
+        fs.writeFileSync(temp, serializeJqJson(manifest, "pretty"), { encoding: "utf8", mode: 0o600, flag: "wx" });
+        try {
+            fs.chmodSync(temp, 0o600);
+            // A refresh that held the lock past the stale threshold may have been
+            // taken over; it must not overwrite the new holder's merge.
+            if (!stillOwned()) {
+                fs.rmSync(temp, { force: true });
+                return undefined;
+            }
+            fs.renameSync(temp, target);
+        }
+        catch (err) {
+            fs.rmSync(temp, { force: true });
+            throw err;
+        }
+        return companyData.size;
+    });
+    if (written === undefined)
+        return { code: 0, stdout: "", stderr: `${stderr}${log("another refresh is still writing .hq/vault-access.json — nothing refreshed")}` };
+    const scope = explicit.length > 0 ? `, refreshed: ${[...refreshed].sort().join(", ")}` : "";
+    stderr += log(`wrote .hq/vault-access.json (${written} companies${scope}, identity: ${identity.email || "unknown"})`);
     return { code: 0, stdout: "", stderr };
 }
+/** Company entries already in the manifest; empty, with a warning, when it is missing or unreadable. */
+function readCompanies(target) {
+    let text;
+    try {
+        text = fs.readFileSync(target, "utf8");
+    }
+    catch (err) {
+        const code = err.code;
+        return { companies: {}, warning: code === "ENOENT" ? "" : log(`could not read the existing manifest (${code ?? "error"}) — other companies' entries are not carried over`) };
+    }
+    try {
+        const companies = JSON.parse(text)?.companies;
+        if (companies && typeof companies === "object" && !Array.isArray(companies))
+            return { companies: companies, warning: "" };
+    }
+    catch { /* reported below */ }
+    return { companies: {}, warning: log("the existing manifest is not valid — other companies' entries are not carried over") };
+}
+/** A lock older than this belongs to a refresh that died holding it. */
+const LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 5_000;
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function readLockToken(lock) {
+    try {
+        return fs.readFileSync(lock, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/** True when the token names a process on this host that no longer exists. */
+function holderIsGone(token) {
+    const match = /^(\d+):(.*):[0-9a-f]+$/.exec(token);
+    if (!match || match[2] !== os.hostname())
+        return false;
+    const pid = Number(match[1]);
+    if (pid === process.pid)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (err) {
+        return err.code === "ESRCH";
+    }
+}
+/**
+ * Remove the lock only if it still carries `expected`. The lock is first
+ * renamed to a name private to this caller, which only one process can do for
+ * a given lock file. If the moved file is not the expected lock (another
+ * process replaced it in the meantime), it is linked back under the lock name
+ * unchanged.
+ */
+function removeLockIf(lock, expected, id) {
+    const moved = `${lock}.${id}.moved`;
+    try {
+        fs.renameSync(lock, moved);
+    }
+    catch {
+        return false;
+    }
+    const ours = readLockToken(moved) === expected;
+    if (!ours) {
+        try {
+            fs.linkSync(moved, lock);
+        }
+        catch { /* a newer lock already exists; leave it */ }
+    }
+    fs.rmSync(moved, { force: true });
+    return ours;
+}
+/**
+ * Take the manifest lock and return its owner token, or undefined when the
+ * lock stays busy past `waitMs`. The lock file is created by hard-linking a
+ * file that already holds the token, so it never exists without an owner. A
+ * stale lock (older than LOCK_STALE_MS, or whose holder on this host has
+ * exited) is taken over through removeLockIf, so two waiters that both judge
+ * it stale cannot remove each other's new lock.
+ */
+export function acquireManifestLock(lock, waitMs, hooks = {}) {
+    const nonce = randomBytes(8).toString("hex");
+    const id = `${process.pid}.${nonce}`;
+    const token = `${process.pid}:${os.hostname()}:${nonce}`;
+    const pending = `${lock}.${id}.new`;
+    const deadline = Date.now() + Math.max(0, waitMs);
+    fs.writeFileSync(pending, token, { flag: "wx", mode: 0o600 });
+    try {
+        for (;;) {
+            try {
+                fs.linkSync(pending, lock);
+                return token;
+            }
+            catch (err) {
+                if (err.code !== "EEXIST")
+                    throw err;
+            }
+            const held = readLockToken(lock);
+            let age;
+            // lstat, so a lock name that is a dangling link still counts as held.
+            try {
+                age = Date.now() - fs.lstatSync(lock).mtimeMs;
+            }
+            catch {
+                continue;
+            }
+            if (held !== undefined && (age > LOCK_STALE_MS || holderIsGone(held))) {
+                hooks.afterStaleCheck?.();
+                if (removeLockIf(lock, held, id))
+                    continue;
+            }
+            // Every path that did not just free the lock waits and honours the
+            // deadline, so a lock that cannot be read or taken over never spins.
+            if (Date.now() >= deadline)
+                return undefined;
+            sleepSync(25);
+        }
+    }
+    finally {
+        fs.rmSync(pending, { force: true });
+    }
+}
+/** Release the lock if `token` still owns it. Returns false when another process has taken it over. */
+export function releaseManifestLock(lock, token) {
+    if (readLockToken(lock) !== token)
+        return false;
+    return removeLockIf(lock, token, `${process.pid}.${randomBytes(8).toString("hex")}`);
+}
+/**
+ * Serialize the read-merge-write of the manifest across processes. Without it
+ * two scoped refreshes for different companies can each read the old file and
+ * the second rename drops the first one's company. `fn` gets a check that the
+ * lock is still held, to call just before it commits. Returns undefined when
+ * the lock stays busy past `waitMs`.
+ */
+function withManifestLock(target, waitMs, fn) {
+    const lock = `${target}.lock`;
+    const token = acquireManifestLock(lock, waitMs);
+    if (token === undefined)
+        return undefined;
+    try {
+        return fn(() => readLockToken(lock) === token);
+    }
+    finally {
+        releaseManifestLock(lock, token);
+    }
+}
 export function registerCoreRefreshVaultAccessNative(core) {
     registerNativeUtility(core, {
         name: "refresh-vault-access", root: "cwd", summary: "Refresh the local vault access manifest",

package/dist/commands/core-work-mesh-bind-trusted-native.d.ts

@@ -45,6 +45,15 @@ type DetachedSpawnOptions = {
     };
 };
 export declare function spawnWorkMeshHqDetached(args: string[], options: DetachedSpawnOptions): void;
+/**
+ * Resolve the bind session. Only a session id the caller owns (the process env)
+ * is trusted; workspace/sessions/.current is last-writer-wins and can name
+ * another session, so it is a fallback that never carries trusted authority.
+ */
+export declare function resolveWorkMeshBindSession(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): {
+    sid: string;
+    trusted: boolean;
+};
 export declare function resolveWorkMeshBindSessionId(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): string;
 export declare function runWorkMeshBindTrusted(args: string[], deps: WorkMeshBindDeps): UtilityOutput;
 export declare function registerCoreWorkMeshBindTrustedNative(core: Command): void;

package/dist/commands/core-work-mesh-bind-trusted-native.js

@@ -3,6 +3,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { sessionIdFromEnv, validSessionId } from "../lib/core-utils/session-id.js";
 import { generateUlid } from "../lib/mesh/live/ulid.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { planResolvedCommandSpawn } from "../utils/windows-spawn.js";
@@ -72,20 +73,26 @@ export function spawnWorkMeshHqDetached(args, options) {
     });
     child.unref();
 }
-export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
-    for (const key of ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID"]) {
-        const value = (env[key] ?? "").replace(/\s/g, "");
-        if (value)
-            return value;
-    }
+/**
+ * Resolve the bind session. Only a session id the caller owns (the process env)
+ * is trusted; workspace/sessions/.current is last-writer-wins and can name
+ * another session, so it is a fallback that never carries trusted authority.
+ */
+export function resolveWorkMeshBindSession(root, env, fileSystem = fs) {
+    const fromEnv = sessionIdFromEnv(env);
+    if (fromEnv)
+        return { sid: fromEnv, trusted: true };
     try {
-        const value = fileSystem.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
-        return value;
+        const value = fileSystem.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/[\t\n\v\f\r ]/g, "");
+        return { sid: validSessionId(value) ? value : "", trusted: false };
     }
     catch {
-        return "";
+        return { sid: "", trusted: false };
     }
 }
+export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
+    return resolveWorkMeshBindSession(root, env, fileSystem).sid;
+}
 function hasExecutable(deps, command) {
     if (process.platform === "win32") {
         return Boolean(resolveWindowsExecutable(command, deps.env, (candidate) => {
@@ -158,17 +165,15 @@ export function runWorkMeshBindTrusted(args, deps) {
         else
             i += 1;
     }
-    if (!sid) {
-        sid = resolveWorkMeshBindSessionId(root, deps.env, deps.fs);
-        if (!sid) {
-            try {
-                sid = deps.fs.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
-            }
-            catch {
-                sid = "";
-            }
-        }
+    // Trusted authority needs a session id the caller owns: --session or the
+    // process env. An invalid --session stops the bind, so it cannot fall back to
+    // whichever session .current names.
+    if (sid && !validSessionId(sid)) {
+        return { code: 2, stdout: "", stderr: "work-mesh-live-bind-trusted: invalid --session id\n" };
     }
+    let sessionTrusted = Boolean(sid);
+    if (!sid)
+        ({ sid, trusted: sessionTrusted } = resolveWorkMeshBindSession(root, deps.env, deps.fs));
     const childEnv = { ...deps.env, HQ_ROOT: root };
     const pin = sid ? ["--session-id", sid] : [];
     let stderr = "";
@@ -207,6 +212,8 @@ export function runWorkMeshBindTrusted(args, deps) {
             trusted.project = project;
         if (task)
             trusted.task = task;
+        if (project && sessionTrusted)
+            trusted.authority = "trusted";
         observation.trustedContext = trusted;
     }
     const directory = path.join(deps.tmpDir, "hq-work-mesh-obs");

package/dist/commands/core.js

@@ -30,6 +30,7 @@
  */
 import { Option } from "commander";
 import { registerCoreCheckpointCommand } from "./core-checkpoint.js";
+import { runHookEnginePath } from '../hook-engine-path.js';
 import { registerCoreDelegateCommand } from "./core-delegate.js";
 import { registerCoreDelegateW1b } from "./core-delegate-w1b.js";
 import { registerCoreHandoffCommand } from "./core-handoff.js";
@@ -439,6 +440,14 @@ export function registerCoreCommands(program) {
     // This group primarily hosts manifest-driven bundled assets, but it also
     // hosts native TypeScript plumbing when a scaffold contract needs it.
     registerCoreCheckpointCommand(core);
+    const hookEnginePath = core.command('hook-engine-path')
+        .description('Print the offline, version-pinned native hook engine path')
+        .option('--repair', 'Repair the pinned copy after closing running hook processes')
+        .option('--for-registration', 'Print a path only when the offline launcher flag is enabled')
+        .action((options) => runHookEnginePath([
+        ...(options.repair ? ['--repair'] : []), ...(options.forRegistration ? ['--for-registration'] : []),
+    ]));
+    describeCoreCommand(hookEnginePath, { execution: 'native', root: 'cwd' });
     registerCoreOntologyCommand(core);
     registerCoreCheckpointGateSettingCommand(core);
     registerCoreDelegateCommand(core, registerCoreDelegateW1b);

package/dist/commands/daemon.d.ts

@@ -45,6 +45,13 @@ export interface DaemonCommandDeps {
     userHome: (user: string) => string;
     /** The pid is a live `hq daemon run`. */
     daemonAlive: (pid: number) => boolean;
+    /** Blocking sleep for install's wait for the Windows task to start (tests inject). */
+    sleep?: (ms: number) => void;
+    /**
+     * Windows: this user has an active signed-in session, so the logon task
+     * can start now. Null when the sessions cannot be listed.
+     */
+    interactiveSession?: () => boolean | null | "unavailable";
     /** Test seam for the combined hq-flags and person-setting gate. */
     runtimeAllowed?: () => boolean | Promise<boolean>;
     /** Test seam for the company sync-mode commands. */