@indigoai-us/hq-cli 5.345.151 → 5.345.153

package/dist/lib/lanes/imported-question.js

@@ -0,0 +1,17 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { createHash } from "node:crypto";
+import { LanesError } from "./errors.js";
+export function importedQuestionMarker(root, id) {
+    return path.join(root, "workspace", "decisions", "legacy-read-only", `${createHash("sha256").update(id).digest("hex")}.json`);
+}
+/** A pending transfer is also read-only: its remote POST may already have succeeded. */
+export function assertQuestionNotImported(root, id) {
+    if (isQuestionImported(root, id)) {
+        throw new LanesError("question_imported_read_only", "This question was transferred to hq decide and is read-only in hq lanes. Use hq decide list to find and answer the decision.", { question_id: id });
+    }
+}
+export function isQuestionImported(root, id) {
+    return fs.existsSync(importedQuestionMarker(root, id));
+}
+//# sourceMappingURL=imported-question.js.map

package/dist/lib/lanes/questions.d.ts

@@ -1,8 +1,3 @@
-/**
- * Raise a lane question (spec §6.1). One function for the CLI `hq lanes ask`
- * path and for envelope `decision: "ask"` ingestion. Two writers here would
- * drift on hop, origin, raised_via, body store, and routing_history.
- */
 import { type LaneEnvelope, type LaneRecord, type LaneCompanyRef, type QuestionBodyStore, type QuestionKind, type QuestionPriority, type QuestionRecord, type RaisedVia } from "./types.js";
 export interface QuestionBody {
     question: string;

package/dist/lib/lanes/questions.js

@@ -1,3 +1,4 @@
+import { assertQuestionNotImported } from "./imported-question.js";
 /**
  * Raise a lane question (spec §6.1). One function for the CLI `hq lanes ask`
  * path and for envelope `decision: "ask"` ingestion. Two writers here would
@@ -143,6 +144,7 @@ export function questionBodyAbsPath(hqRoot, question) {
     return path.join(hqRoot, "personal", "lanes", "questions", `${question.question_id}.json`);
 }
 export function writeQuestionBody(hqRoot, question, body) {
+    assertQuestionNotImported(hqRoot, question.question_id);
     assertQuestionBodySecretSafe(body);
     const store = parseQuestionBodyStore(question.body.store);
     const filePath = questionBodyAbsPath(hqRoot, question);

package/dist/lib/lanes/reconcile.js

@@ -17,6 +17,7 @@ import { loadLanesConfig, providerQuotaDefaultHoldMs } from "./config.js";
 import { MAX_LANE_DEPTH } from "./constants.js";
 import { laneDepthCap } from "./depth-cap.js";
 import { AccountResolutionError, LanesError, isLaneVersionConflict } from "./errors.js";
+import { isQuestionImported } from "./imported-question.js";
 import { loadWorkerProfile } from "./profile.js";
 import { terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
 import { classifySessionLiveness, defaultLivenessDeps, loadLivenessIndex, readDaemonPresenceConnected, unindexedClaudeSessionLiveness, } from "./liveness.js";
@@ -650,16 +651,26 @@ async function closeInterruptedDoneStoryWorkers(hqRoot, lanes, questions, summar
             for (const question of questions) {
                 if (question.origin.id !== lane.lane_id || question.status !== "pending")
                     continue;
-                casQuestionIf(hqRoot, question.question_id, (current) => current.status === "pending", (current) => ({
-                    ...current,
-                    status: "cancelled",
-                    routing_history: appendCappedHistory(current.routing_history, {
-                        hop: current.hop,
-                        audience: { kind: "user" },
-                        at,
-                        reason: "cancelled",
-                    }),
-                }), false);
+                if (isQuestionImported(hqRoot, question.question_id))
+                    continue;
+                try {
+                    casQuestionIf(hqRoot, question.question_id, (current) => current.status === "pending", (current) => ({
+                        ...current,
+                        status: "cancelled",
+                        routing_history: appendCappedHistory(current.routing_history, {
+                            hop: current.hop,
+                            audience: { kind: "user" },
+                            at,
+                            reason: "cancelled",
+                        }),
+                    }), false);
+                }
+                catch (error) {
+                    // Import may acquire the record lock after our initial check. The
+                    // decision service owns that question; continue closing this lane.
+                    if (!(error instanceof LanesError) || error.error !== "question_imported_read_only")
+                        throw error;
+                }
             }
             appendWatcherEvent(watcherEventsPath(hqRoot, lane.lane_id), {
                 event: "story_closed",

package/dist/lib/lanes/store.d.ts

@@ -1,11 +1,3 @@
-/**
- * File-backed lane / question record store (spec §10, §10.1).
- *
- * Root: workspace/lanes/ under the HQ root. One stable path per record;
- * `status` is the pending/answered discriminator — files are never moved
- * between directories. Every mutation is temp-file-plus-rename and a
- * compare-and-set on `version`. Histories are capped at 50 at the append site.
- */
 import * as fs from "node:fs";
 import { type OutpostIdentity } from "./admission-host.js";
 import { type AttributionHistoryEntry, type LaneRecord, type LaneWriter, type QuestionRecord, type RoutingHistoryEntry, type SeniorHistoryEntry } from "./types.js";

package/dist/lib/lanes/store.js

@@ -1,3 +1,4 @@
+import { assertQuestionNotImported } from "./imported-question.js";
 /**
  * File-backed lane / question record store (spec §10, §10.1).
  *
@@ -2013,7 +2014,7 @@ export function createQuestion(hqRoot, init, deps = defaultStoreDeps()) {
     return created;
 }
 export function updateQuestion(hqRoot, questionId, expectedVersion, updater, deps = defaultStoreDeps()) {
-    const next = casWrite(questionRecordPath(hqRoot, questionId), expectedVersion, parseQuestionRecord, mergeQuestionRecords, updater, deps);
+    const next = casWrite(questionRecordPath(hqRoot, questionId), expectedVersion, parseQuestionRecord, mergeQuestionRecords, (current) => { assertQuestionNotImported(hqRoot, questionId); return updater(current); }, deps);
     syncPendingMarker(hqRoot, next, deps);
     syncLaneQuestionReference(hqRoot, next, deps);
     return next;

package/dist/lib/lanes/stories.d.ts

@@ -20,4 +20,19 @@ export declare function storyStatusForEnvelope(status: string): "in_progress" |
  * and explicit story commands own those transitions.
  */
 export declare function terminalEnvelopeStoryStatus(lane: LaneRecord, decision: "done" | "blocked" | "ask", envelopeStatus?: string): LaneStoryStatus | undefined;
+/**
+ * The stories array after attributing a lane to projectId/storyId.
+ *
+ * A lane with no story (empty story_id plus no_story_reason) carries no story
+ * rows, so attributing it to another project without a story keeps the rows
+ * unchanged. This is the single write site for attribution-driven appends:
+ * it never produces a row with an empty story_id, which the lane schema
+ * rejects (and which would roll back the whole write).
+ */
+export declare function storiesAfterAttribution(lane: LaneRecord, projectId: string, storyId: string, at: string): LaneStory[];
+/**
+ * The row attribution would append, or undefined when nothing is appended
+ * (the story is already carried, or there is no story id).
+ */
+export declare function attributedStoryRow(lane: LaneRecord, projectId: string, storyId: string, at: string): LaneStory | undefined;
 //# sourceMappingURL=stories.d.ts.map

package/dist/lib/lanes/stories.js

@@ -89,4 +89,29 @@ export function terminalEnvelopeStoryStatus(lane, decision, envelopeStatus = "in
         return "review";
     return storyStatusForEnvelope(envelopeStatus);
 }
+/**
+ * The stories array after attributing a lane to projectId/storyId.
+ *
+ * A lane with no story (empty story_id plus no_story_reason) carries no story
+ * rows, so attributing it to another project without a story keeps the rows
+ * unchanged. This is the single write site for attribution-driven appends:
+ * it never produces a row with an empty story_id, which the lane schema
+ * rejects (and which would roll back the whole write).
+ */
+export function storiesAfterAttribution(lane, projectId, storyId, at) {
+    const current = laneStories(lane);
+    const added = attributedStoryRow(lane, projectId, storyId, at);
+    return added ? [...current, added] : current;
+}
+/**
+ * The row attribution would append, or undefined when nothing is appended
+ * (the story is already carried, or there is no story id).
+ */
+export function attributedStoryRow(lane, projectId, storyId, at) {
+    if (!storyId.trim())
+        return undefined;
+    if (laneStory(lane, projectId, storyId))
+        return undefined;
+    return { project_id: projectId, story_id: storyId, status: "in_progress", added_at: at, updated_at: at };
+}
 //# sourceMappingURL=stories.js.map

package/dist/lib/mesh/client.d.ts

@@ -54,6 +54,14 @@ export declare function createWorkSessionDeliverer(opts: {
         body: unknown;
     }>;
 }): DeliverFn;
+/**
+ * Outbox error code for a 401/403 register refusal. Only real auth / identity
+ * refusals are AUTH_DENIED. A company whose work registry is off
+ * (WORK_REGISTRY_DISABLED) or an unknown company (INVALID_COMPANY) is not an
+ * auth problem, so those keep their own code and doctor does not point at
+ * login (Shepherd issue 2726, feedback_6a792ab4).
+ */
+export declare function registerDenialOutboxCode(serverCode: string | undefined): string;
 /**
  * Probe whether the server advertises migration capability (US-017A).
  * Failures return false (default-company stays locked).

package/dist/lib/mesh/client.js

@@ -4,7 +4,7 @@
  * vault HTTP + receipt-shaped responses (US-007A / US-007B).
  */
 import { listActiveMembershipCompanies, meshJson, requireToken, resolveMeshCompany, } from "./api.js";
-import { isWorkSessionDenialCode } from "./denial-codes.js";
+import { isWorkSessionDenialCode, WORK_SESSION_DENIAL_CODES, } from "./denial-codes.js";
 export { meshJson, requireToken, resolveMeshCompany, listActiveMembershipCompanies };
 export async function openMeshTransport(opts) {
     const token = await requireToken();
@@ -63,11 +63,11 @@ export function createWorkSessionDeliverer(opts) {
             if (status === 401 || status === 403) {
                 const serverCode = isWorkSessionDenialCode(errorFields.code)
                     ? errorFields.code
-                    : undefined;
+                    : denialCodeFromMessage(message);
                 return {
                     ok: false,
                     retryable: false,
-                    code: "AUTH_DENIED",
+                    code: registerDenialOutboxCode(serverCode),
                     httpStatus: status,
                     ...(serverCode ? { serverCode } : {}),
                 };
@@ -98,6 +98,15 @@ export function createWorkSessionDeliverer(opts) {
                     return { ok: false, retryable: false, code: `HTTP_${status}` };
                 }
             }
+            const messageCode = denialCodeFromMessage(message);
+            if (messageCode && registerDenialOutboxCode(messageCode) !== "AUTH_DENIED") {
+                return {
+                    ok: false,
+                    retryable: false,
+                    code: registerDenialOutboxCode(messageCode),
+                    serverCode: messageCode,
+                };
+            }
             if (/unauthorized|forbidden|auth/i.test(message)) {
                 return { ok: false, retryable: false, code: "AUTH_DENIED" };
             }
@@ -112,6 +121,27 @@ export function createWorkSessionDeliverer(opts) {
         }
     };
 }
+/**
+ * Outbox error code for a 401/403 register refusal. Only real auth / identity
+ * refusals are AUTH_DENIED. A company whose work registry is off
+ * (WORK_REGISTRY_DISABLED) or an unknown company (INVALID_COMPANY) is not an
+ * auth problem, so those keep their own code and doctor does not point at
+ * login (Shepherd issue 2726, feedback_6a792ab4).
+ */
+export function registerDenialOutboxCode(serverCode) {
+    if (serverCode === "WORK_REGISTRY_DISABLED" || serverCode === "INVALID_COMPANY") {
+        return serverCode;
+    }
+    return "AUTH_DENIED";
+}
+/** Find an allowlisted denial code in an error message when the error has no code field. */
+function denialCodeFromMessage(message) {
+    for (const code of WORK_SESSION_DENIAL_CODES) {
+        if (new RegExp(`\\b${code}\\b`).test(message))
+            return code;
+    }
+    return undefined;
+}
 function mapRegisterResponse(status, body, operationId) {
     if (status >= 200 && status < 300) {
         const rec = body && typeof body === "object" ? body : {};
@@ -124,6 +154,17 @@ function mapRegisterResponse(status, body, operationId) {
     if (status >= 500 || status === 429) {
         return { ok: false, retryable: true, code: `HTTP_${status}` };
     }
+    if (status === 401 || status === 403) {
+        const rec = body && typeof body === "object" ? body : {};
+        const serverCode = isWorkSessionDenialCode(rec.code) ? rec.code : undefined;
+        return {
+            ok: false,
+            retryable: false,
+            code: registerDenialOutboxCode(serverCode),
+            httpStatus: status,
+            ...(serverCode ? { serverCode } : {}),
+        };
+    }
     if (status >= 400 && status < 500) {
         return { ok: false, retryable: false, code: `HTTP_${status}` };
     }

package/dist/lib/mesh/denial-codes.js

@@ -26,7 +26,7 @@ export function isWorkSessionDenialCode(value) {
 }
 /** Plain-language reasons for denial codes the user can act on. */
 const WORK_SESSION_DENIAL_REASONS = {
-    WORK_REGISTRY_DISABLED: "Work tracking is turned off for this company. The company owner can turn it on with: hq company --company <slug> settings set --work-registry-enabled true",
+    WORK_REGISTRY_DISABLED: "Work registry is disabled for this company; ask a company admin to enable it with: hq company --company <slug> settings set --work-registry-enabled true. This is not a login problem.",
     FEATURE_DISABLED: "Live work tracking is turned off for this company. The company owner can turn it on with: hq company --company <slug> settings set --work-mesh-live-enabled true",
 };
 /** Plain reason for a server denial code, or undefined when there is none. */

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -24,6 +24,12 @@ export declare const SPOOL_DEBOUNCE_MS = 2000;
 export declare const FLUSH_INTERVAL_MS = 10000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export declare const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
+/**
+ * A long-running daemon re-runs the held backfill this often while held
+ * events remain, so a backlog larger than one batch keeps draining after a
+ * reinstall instead of waiting for the next daemon start (Shepherd 2361).
+ */
+export declare const HELD_BACKFILL_INTERVAL_MS: number;
 export declare const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2000;
 /** Skip further membership probes after a transport failure so a network drop
  *  cannot fan out one hanging lookup per held session. */
@@ -60,10 +66,12 @@ export interface DaemonRunDeps {
         quarantined: number;
         skipped?: number;
     }>;
-    /** Injected held-session recovery (tests). Runs once before the startup flush. */
+    /** Injected held-session recovery (tests). Runs before the startup flush and then periodically while held events remain. */
     backfillHeld?: () => Promise<BackfillHeldResult>;
     /** Maximum distinct held sessions reconciled during one daemon startup. */
     heldBackfillBatchSize?: number;
+    /** Minimum gap between periodic held backfills. Default HELD_BACKFILL_INTERVAL_MS. */
+    heldBackfillIntervalMs?: number;
     /** Injected board refresh (tests). */
     refreshBoards?: () => Promise<{
         refreshed: number;

package/dist/lib/mesh/live/daemon/run.js

@@ -46,6 +46,12 @@ export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
+/**
+ * A long-running daemon re-runs the held backfill this often while held
+ * events remain, so a backlog larger than one batch keeps draining after a
+ * reinstall instead of waiting for the next daemon start (Shepherd 2361).
+ */
+export const HELD_BACKFILL_INTERVAL_MS = 15 * 60 * 1_000;
 export const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2_000;
 /** Skip further membership probes after a transport failure so a network drop
  *  cannot fan out one hanging lookup per held session. */
@@ -350,6 +356,19 @@ export async function runMeshDaemon(deps = {}) {
     };
     /** In-memory held re-attempt throttle (survives watch-triggered flushes). */
     let lastHeldRetryAtMs = 0;
+    /** Epoch ms of the last held backfill (startup or periodic). */
+    let lastHeldBackfillAtMs = 0;
+    const heldBackfillIntervalMs = deps.heldBackfillIntervalMs ?? HELD_BACKFILL_INTERVAL_MS;
+    const heldBackfillDue = (atMs) => {
+        if (atMs - lastHeldBackfillAtMs < heldBackfillIntervalMs)
+            return false;
+        try {
+            return fs.statSync(workMeshHeldPath(meshRoot)).size > 0;
+        }
+        catch {
+            return false;
+        }
+    };
     const shutdownController = new AbortController();
     const flushFn = deps.flush ??
         (async (signal) => {
@@ -380,6 +399,12 @@ export async function runMeshDaemon(deps = {}) {
                         return "unavailable";
                     return authorization.status === "authorized";
                 },
+                // Held sessions whose local evidence only names a slug need the
+                // membership slug -> uid lookup, or they stay NEEDS_COMPANY forever.
+                resolveCompanyUid: async (slug) => {
+                    const authorization = await tenantGate.authorize({ companySlug: slug, deviceDefault: false });
+                    return authorization.status === "authorized" ? authorization.uid : null;
+                },
             });
         });
     const replayFn = deps.replayOutbox ??
@@ -674,7 +699,11 @@ export async function runMeshDaemon(deps = {}) {
                 // A held session has already ended, so no later hook will naturally
                 // revisit its context. Repair a bounded batch before the first flush;
                 // recovered state is then retried immediately in this same cycle.
-                if (reason === "start") {
+                // A long-running daemon repeats the bounded batch on an interval
+                // while held events remain, so the cursor keeps rotating through a
+                // backlog larger than one batch.
+                if (reason === "start" || heldBackfillDue(now().getTime())) {
+                    lastHeldBackfillAtMs = now().getTime();
                     try {
                         const recovered = await backfillFn();
                         if (recovered.reconciled > 0 ||

package/dist/lib/mesh/live/flush.d.ts

@@ -58,6 +58,13 @@ export interface FlushDeps {
      * stripped. Defaults to a per-flush cached git resolver (tests inject).
      */
     resolveWorkLocation?: WorkLocationResolver;
+    /**
+     * Membership-validated slug -> companyUid lookup for held sessions whose
+     * local evidence names a company slug but no uid. Return the uid, or null
+     * when the caller is not a member or the lookup is unavailable (the events
+     * stay held and are retried). Called at most once per slug per flush.
+     */
+    resolveCompanyUid?: (slug: string) => Promise<string | null>;
 }
 export interface FlushSummary {
     claimed: number;

package/dist/lib/mesh/live/flush.js

@@ -262,6 +262,7 @@ export async function flushSessionEvents(inputDeps) {
             pendingRestore.delete(event);
         };
         const loggedProject404 = new Set();
+        const heldUidCache = new Map();
         sessionLoop: for (const [sessionId, items] of bySession) {
             if (deps.signal?.aborted)
                 break sessionLoop;
@@ -283,7 +284,8 @@ export async function flushSessionEvents(inputDeps) {
             if (leaveResult.abort)
                 continue;
             const remainingItems = leaveResult.items;
-            state = bindHeldCompanyIfResolved(sessionId, remainingItems, state, deps, now);
+            const heldBinding = bindHeldCompanyIfResolved(sessionId, remainingItems, state, deps, now, heldUidCache);
+            state = heldBinding instanceof Promise ? await heldBinding : heldBinding;
             if (state?.companyConfidence === "device_default" &&
                 deps.authorizeDeviceDefaultTenant) {
                 const allowed = await deps.authorizeDeviceDefaultTenant(state);
@@ -646,12 +648,12 @@ const SESSION_EVENT_HARNESSES = new Set([
     "agent-box",
     "agents-v2",
 ]);
-function bindHeldCompanyIfResolved(sessionId, items, state, deps, now) {
+function resolveHeldCompany(sessionId, items, state, deps) {
     if (state?.companyUid)
-        return state;
+        return null;
     const sample = items[0]?.event;
     if (!sample)
-        return state;
+        return null;
     const cwd = eventText(sample, "cwd");
     const hqRoot = eventText(sample, "hqRoot");
     const remoteOwnerSlug = cwd
@@ -675,14 +677,16 @@ function bindHeldCompanyIfResolved(sessionId, items, state, deps, now) {
         remoteOwnerSlug,
         repoIdentityKey,
     });
-    if (resolution.status !== "resolved" || !resolution.company.uid)
-        return state;
+    if (resolution.status !== "resolved")
+        return null;
     if (resolution.company.source === "trusted_explicit" &&
         !eventText(sample, "companySlug")) {
-        return state;
+        return null;
     }
-    const uid = resolution.company.uid;
-    const slug = resolution.company.slug;
+    return resolution.company;
+}
+function writeHeldCompanyBinding(sessionId, state, company, deps, now) {
+    const { uid, slug } = company;
     const nowIso = now().toISOString();
     const next = updateSessionState(sessionId, deps.workContextRoot, (current) => {
         const base = current ?? state;
@@ -703,7 +707,7 @@ function bindHeldCompanyIfResolved(sessionId, items, state, deps, now) {
             contractVersion: base.contractVersion ?? 1,
             companyUid: uid,
             ...(slug ? { companySlug: slug } : {}),
-            ...(resolution.company.source === "device_default"
+            ...(company.source === "device_default"
                 ? { companyConfidence: "device_default" }
                 : {}),
             contextStatus,
@@ -712,6 +716,45 @@ function bindHeldCompanyIfResolved(sessionId, items, state, deps, now) {
     });
     return next ?? readSessionState(sessionId, deps.workContextRoot) ?? state;
 }
+/**
+ * Bind a held session to a company. Local evidence with a uid binds directly.
+ * Local evidence that only names a slug (session meta, cwd, git remote) needs
+ * a membership-validated slug -> uid lookup; without it the session would stay
+ * NEEDS_COMPANY on every retry (Shepherd 2361).
+ */
+function bindHeldCompanyIfResolved(sessionId, items, state, deps, now, uidCache) {
+    // Stay synchronous unless a uid lookup is needed: the flush loop's
+    // microtask ordering is relied on by retry/back-pressure timing.
+    const company = resolveHeldCompany(sessionId, items, state, deps);
+    if (!company)
+        return state;
+    if (company.uid) {
+        return writeHeldCompanyBinding(sessionId, state, { uid: company.uid, slug: company.slug, source: company.source }, deps, now);
+    }
+    const slug = company.slug?.trim().toLowerCase();
+    if (!slug || !deps.resolveCompanyUid || company.source === "device_default")
+        return state;
+    let pending = uidCache.get(slug);
+    if (!pending) {
+        const resolver = deps.resolveCompanyUid;
+        pending = (async () => {
+            try {
+                const uid = await resolver(slug);
+                return typeof uid === "string" && uid.trim() ? uid.trim() : null;
+            }
+            catch (err) {
+                deps.log?.(`held company uid lookup failed for slug=${slug}: ${(err instanceof Error ? err.message : String(err)).slice(0, 120)}`);
+                return null;
+            }
+        })();
+        uidCache.set(slug, pending);
+    }
+    return pending.then((uid) => {
+        if (!uid)
+            return state;
+        return writeHeldCompanyBinding(sessionId, state, { uid, slug: company.slug, source: company.source }, deps, now);
+    });
+}
 function applySessionMetaCompanyRebind(sessionId, items, state, deps, now) {
     if (!state)
         return state;

package/dist/lib/registry/registry.js

@@ -90,6 +90,12 @@ export function pathKey(dir) {
 export function canonicalDir(dir) {
     const abs = path.resolve(dir);
     try {
+        // macOS volumes are case-insensitive by default: /x/CaseRepo and
+        // /x/caserepo are one folder, but the JS realpath keeps the caller's
+        // spelling, so the same repo produced two registry keys. realpath(3)
+        // returns the on-disk spelling. Other platforms keep the JS realpath.
+        if (process.platform === "darwin")
+            return fs.realpathSync.native(abs);
         return fs.realpathSync(abs);
     }
     catch {

package/dist/lib/scan-packages/index.js

@@ -4,7 +4,7 @@ import * as path from 'node:path';
 import * as yaml from 'js-yaml';
 import { contributionLinks } from '../../utils/pack-contribution-links.js';
 import { CONTRIBUTION_TABLE } from '../../utils/contribution-table.js';
-import { isExcludedWorkerDirectory } from '../workers-registry/index.js';
+import { isExcludedWorkerDirectory, isNestedWorkerCheckout } from '../workers-registry/index.js';
 function isDirectory(target) { try {
     return fs.statSync(target).isDirectory();
 }
@@ -77,8 +77,9 @@ function allWorkerYamlFiles(root, relative) {
     const output = [];
     const walk = (next, seen) => {
         // Prune exactly what the worker registry prunes (tenant repos/ checkouts,
-        // _template, _overrides). A worker.yaml the registry never indexes cannot
-        // collide with a pack worker, and walking source checkouts is slow.
+        // nested git checkouts, _template, _overrides). A worker.yaml the registry
+        // never indexes cannot collide with a pack worker, and walking source
+        // checkouts is slow.
         if (isExcludedWorkerDirectory(next))
             return;
         const absolute = path.join(root, next);
@@ -101,7 +102,10 @@ function allWorkerYamlFiles(root, relative) {
         catch {
             return;
         }
+        const checkout = isNestedWorkerCheckout(relative, next, names);
         for (const name of names) {
+            if (checkout && name !== 'worker.yaml')
+                continue;
             const child = path.join(next, name);
             const childAbsolute = path.join(root, child);
             if (name === 'worker.yaml' && (() => { try {

package/dist/lib/work-context/organize.d.ts

@@ -92,6 +92,8 @@ export declare function prepareOrganizeDecision(input: {
     /** Skip network; leave unresolved without candidates. */
     offline?: boolean;
 }): Promise<OrganizeListResult>;
+/** True when a local decision's server window has passed (or is unparsable). */
+export declare function isLocalDecisionExpired(expiresAt: string | undefined, now?: Date): boolean;
 export declare function formatOrganizeList(result: OrganizeListResult): string[];
 /**
  * Mark that the ask was cancelled / timed out / surface incapable.

package/dist/lib/work-context/organize.js

@@ -114,8 +114,17 @@ export async function prepareOrganizeDecision(input) {
             reason: state.contextStatus,
         };
     }
-    // Ask-once: an existing decision is never replaced or re-armed.
-    if (state.decision?.decisionId) {
+    // Ask-once: an existing decision is never replaced or re-armed — unless its
+    // server decision window has expired. The server stamps a fresh window only
+    // when candidates are listed, so returning the stale decision would make
+    // every later organize fail with DECISION_EXPIRED / DECISION_WINDOW_MISSING.
+    const refreshExpired = Boolean(state.decision?.decisionId) &&
+        state.decision?.askAfter === true &&
+        isLocalDecisionExpired(state.decision?.expiresAt, nowFn()) &&
+        Boolean(state.companyUid) &&
+        !input.offline &&
+        Boolean(input.fetchCandidates);
+    if (state.decision?.decisionId && !refreshExpired) {
         return {
             sessionId: input.sessionId,
             contextStatus: state.contextStatus,
@@ -124,7 +133,7 @@ export async function prepareOrganizeDecision(input) {
             reason: state.decision.askAfter ? "pending_ask" : "ask_already_settled",
         };
     }
-    const ready = shouldAskAfter({
+    const ready = refreshExpired || shouldAskAfter({
         toolWrites: state.toolWrites,
         startedAt: state.startedAt,
         hasTurn: state.hasTurn,
@@ -168,9 +177,18 @@ export async function prepareOrganizeDecision(input) {
         contextStatus: next.contextStatus,
         pending: true,
         decision,
-        reason: "ask_prepared",
+        reason: refreshExpired ? "ask_refreshed" : "ask_prepared",
     };
 }
+/** True when a local decision's server window has passed (or is unparsable). */
+export function isLocalDecisionExpired(expiresAt, now = new Date()) {
+    if (!expiresAt)
+        return false;
+    const ms = Date.parse(expiresAt);
+    if (!Number.isFinite(ms))
+        return true;
+    return now.getTime() >= ms;
+}
 export function formatOrganizeList(result) {
     const lines = [
         `session ${result.sessionId} status=${result.contextStatus}` +

package/dist/lib/workers-registry/index.d.ts

@@ -28,9 +28,20 @@ export interface GenerateWorkersRegistryResult {
  * (`.codex/worktrees/<name>/`) are the same trap in a different folder: a
  * nested HQ root under a company project. Those copies land in the registry as
  * `companies/<slug>/…/.claude/worktrees/…` or `.codex/worktrees/…` paths, so
- * `hq lanes create` then fails with `worker_tenancy_unresolved`.
+ * `hq lanes create` then fails with `worker_tenancy_unresolved`. HQ's own
+ * `workspace/worktrees/<name>/` is the same shape.
+ *
+ * `node_modules` and `.git` never hold workers and are large, so they are
+ * skipped wherever they appear. Any other checkout (a directory holding `.git`)
+ * is caught by the walk itself, because only the filesystem can tell.
  */
 export declare function isExcludedWorkerDirectory(relativeDirectory: string): boolean;
+/**
+ * True when `relativeDirectory`, found while walking `scanRoot`, is a separate
+ * git checkout (its listing `names` holds `.git`). The caller may still take a
+ * `worker.yaml` directly inside it, but must not descend any further.
+ */
+export declare function isNestedWorkerCheckout(scanRoot: string, relativeDirectory: string, names: readonly string[]): boolean;
 /**
  * Generate core/workers/registry.yaml from worker.yaml files. Invalid workers
  * are quarantined but do not prevent all valid workers from being registered.