@indigoai-us/hq-cli 5.345.156 → 5.345.159

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.91","bundleSha256":"ea41f1765d5015a22304787abedc68a531393d601a349bb8bff3c5428413f3a3","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.97","bundleSha256":"7cb110257acf96c8d91c57f238f7f01be43620ed66ae28dfe74dcc972be64153","formatVersion":1}

package/dist/lib/agent-kit/run/inbox.js

@@ -15,6 +15,7 @@
  * item until the bot acks (`POST /v1/agents/{uid}/inbox/{id}/ack`), and the
  * poller dedupes by id so the same item is never mirrored twice.
  */
+import { createWakeSecretResolver } from "../wake-secrets.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { vaultApiFetch } from "../../../utils/vault-api.js";
@@ -247,7 +248,7 @@ async function maybeWake(deps, freshCount) {
         return;
     const notice = buildWakeNotice(deps.agentUid, reason, pending.map((e) => e.id), now);
     try {
-        await (deps.fireWake ?? fireWake)(config, notice, { paths: deps.paths, agentUid: deps.agentUid, log: deps.log, now: deps.now });
+        await (deps.fireWake ?? fireWake)(config, notice, { paths: deps.paths, agentUid: deps.agentUid, log: deps.log, now: deps.now, resolveHeaderSecrets: createWakeSecretResolver(deps.companySlug, deps.getToken, deps.apiBaseUrl) });
     }
     catch (err) {
         deps.log("warn", `wake failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/lib/agent-kit/wake-secrets.d.ts

@@ -0,0 +1,7 @@
+/** Wake-only vault reads: use the kit machine token, never cache plaintext. */
+import { getCompanyUid, vaultApiFetch } from "../../utils/vault-api.js";
+export declare function createWakeSecretResolver(companySlug: string | undefined, getToken: () => Promise<string>, baseUrl: string, deps?: {
+    getCompanyUid: typeof getCompanyUid;
+    vaultApiFetch: typeof vaultApiFetch;
+}): (names: string[]) => Promise<Map<string, string>>;
+//# sourceMappingURL=wake-secrets.d.ts.map

package/dist/lib/agent-kit/wake-secrets.js

@@ -0,0 +1,32 @@
+/** Wake-only vault reads: use the kit machine token, never cache plaintext. */
+import { getCompanyUid, vaultApiFetch } from "../../utils/vault-api.js";
+export function createWakeSecretResolver(companySlug, getToken, baseUrl, deps = { getCompanyUid, vaultApiFetch }) {
+    return async (names) => {
+        if (!companySlug)
+            throw new Error("Wake secrets require an enrolled company");
+        const token = await getToken();
+        const companyUid = await deps.getCompanyUid(token, companySlug, baseUrl);
+        const response = await deps.vaultApiFetch({
+            token, baseUrl, path: `/secrets/${encodeURIComponent(companyUid)}/load`, method: "POST",
+            body: { names, usage: { channel: "exec", reason: "agent kit webhook wake" } },
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok)
+            throw new Error("Wake secret authorization failed");
+        const data = await response.json();
+        if (!Array.isArray(data.secrets) || !Array.isArray(data.errors) || data.errors.length) {
+            throw new Error("Wake secret lookup failed");
+        }
+        const values = new Map();
+        for (const row of data.secrets) {
+            if (!row || typeof row.name !== "string" || !names.includes(row.name) || values.has(row.name) ||
+                typeof row.value !== "string" || row.revokedAt != null)
+                throw new Error("Invalid wake secret response");
+            values.set(row.name, row.value);
+        }
+        if (values.size !== new Set(names).size)
+            throw new Error("Wake secret missing");
+        return values;
+    };
+}
+//# sourceMappingURL=wake-secrets.js.map

package/dist/lib/agent-kit/wake.d.ts

@@ -30,12 +30,15 @@ export type WakeConfig = {
     kind: "url";
     url: string;
     retryMs: number;
+    headerSecrets?: Record<string, string>;
 } | {
     kind: "command";
     command: string[];
     timeoutMs: number;
     retryMs: number;
 };
+/** Store references only. Reject ambiguous and transport-controlled headers. */
+export declare function parseHeaderSecrets(specs: string[]): Record<string, string>;
 export interface WakeNotice {
     event: "hq.inbox.pending";
     agentUid: string;
@@ -59,6 +62,7 @@ export interface WakeDeps {
     agentUid: string;
     log: KitLogger;
     now?: () => Date;
+    resolveHeaderSecrets?: (names: string[]) => Promise<Map<string, string>>;
     fetchImpl?: typeof fetch;
     spawnImpl?: typeof spawn;
     pidAlive?: (pid: number | undefined) => boolean;

package/dist/lib/agent-kit/wake.js

@@ -18,6 +18,7 @@
  * The inbox poller fires the wake when new items are mirrored, and re-fires
  * every `retryMs` while items stay pending, so a missed webhook heals.
  */
+import { SECRET_NAME_PATTERN } from "../../commands/_patterns.js";
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -27,6 +28,33 @@ export const WAKE_STATE_NAME = "wake-state.json";
 export const DEFAULT_WAKE_RETRY_MS = 10 * 60_000;
 export const WAKE_URL_TIMEOUT_MS = 15_000;
 export const DEFAULT_WAKE_COMMAND_TIMEOUT_MS = 10 * 60_000;
+/** Store references only. Reject ambiguous and transport-controlled headers. */
+export function parseHeaderSecrets(specs) {
+    const result = {};
+    const seen = new Set();
+    for (const spec of specs) {
+        const at = spec.indexOf("=");
+        const header = spec.slice(0, at);
+        const name = spec.slice(at + 1);
+        const lower = header.toLowerCase();
+        if (at < 1 || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(header) || !SECRET_NAME_PATTERN.test(name) ||
+            ["host", "content-length", "transfer-encoding", "connection", "content-type", "user-agent", "__proto__"].includes(lower) || seen.has(lower)) {
+            throw new Error("Invalid --header-secret: use a unique Header-Name=VAULT_SECRET_NAME reference");
+        }
+        seen.add(lower);
+        result[header] = name;
+    }
+    return result;
+}
+function validateHeaderSecrets(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error("Invalid header secret references");
+    return parseHeaderSecrets(Object.entries(raw).map(([header, name]) => {
+        if (typeof name !== "string")
+            throw new Error("Invalid header secret reference");
+        return `${header}=${name}`;
+    }));
+}
 export const WAKE_INSTRUCTIONS = "New HQ messages are waiting. Run `hq agent inbox` (or the hq_inbox_read tool). Reply where each message " +
     "arrived: if it has a channelId, post in that channel with `hq dm <channelId> \"…\"`; otherwise reply to the " +
     "sender with `hq dm <sender-uid> \"…\"` (or hq_dm_send). Do not reply to another bot's greeting, thanks or " +
@@ -82,7 +110,7 @@ export function readWakeConfig(paths) {
     const retryMs = typeof raw.retryMs === "number" && raw.retryMs >= 60_000 ? raw.retryMs : DEFAULT_WAKE_RETRY_MS;
     if (raw.kind === "url" && typeof raw.url === "string") {
         try {
-            return { kind: "url", url: validateWakeUrl(raw.url), retryMs };
+            return { kind: "url", url: validateWakeUrl(raw.url), retryMs, ...(raw.headerSecrets === undefined ? {} : { headerSecrets: validateHeaderSecrets(raw.headerSecrets) }) };
         }
         catch {
             return null;
@@ -167,9 +195,27 @@ export async function fireWake(config, notice, deps) {
         const timer = setTimeout(() => controller.abort(), WAKE_URL_TIMEOUT_MS);
         const target = redactWakeUrl(config.url);
         try {
+            const headers = new Headers({ "content-type": "application/json", "user-agent": "hq-agent-kit" });
+            if (config.headerSecrets !== undefined) {
+                const refs = validateHeaderSecrets(config.headerSecrets);
+                const names = [...new Set(Object.values(refs))];
+                if (names.length) {
+                    if (!deps.resolveHeaderSecrets)
+                        throw new Error("Secret resolution unavailable");
+                    const values = await deps.resolveHeaderSecrets(names);
+                    for (const [header, name] of Object.entries(refs)) {
+                        const value = values.get(name);
+                        if (!value || /[\r\n\0]/.test(value))
+                            throw new Error("Invalid secret header value");
+                        headers.set(header, value);
+                    }
+                }
+            }
             const res = await doFetch(config.url, {
                 method: "POST",
-                headers: { "content-type": "application/json", "user-agent": "hq-agent-kit" },
+                headers,
+                // Custom authentication headers must never follow a redirect.
+                redirect: "error",
                 body: JSON.stringify(notice),
                 signal: controller.signal,
             });
@@ -180,7 +226,7 @@ export async function fireWake(config, notice, deps) {
             return { fired: true, ok, detail };
         }
         catch (err) {
-            const detail = `wake url ${target} failed: ${err instanceof Error ? err.name === "AbortError" ? "timeout" : err.message : String(err)}`;
+            const detail = `wake url ${target} failed: ${err instanceof Error ? err.name === "AbortError" ? "timeout" : ["ECONNREFUSED", "ENOTFOUND", "ETIMEDOUT", "ECONNRESET"].includes(err.message) ? err.message : "request or secret resolution failed" : "request or secret resolution failed"}`;
             deps.log("warn", detail);
             return { fired: true, ok: false, detail };
         }

package/dist/lib/bot/inflight.d.ts

@@ -15,6 +15,8 @@
  */
 export declare const BOT_INFLIGHT_NAME = "inflight.json";
 export interface InflightTurn {
+    /** Legacy delivery may be settled but must not enter a newly scoped model history. */
+    omitFromHistory?: boolean;
     v: 1;
     /** Inbox message id, or `kickoff` for the first-start kickoff turn. */
     messageId: string;
@@ -111,9 +113,13 @@ export interface InflightTurn {
 }
 export declare function botInflightPath(dir: string): string;
 /** Every turn that was in progress, oldest first. */
-export declare function readInflightTurns(dir: string): InflightTurn[];
+export declare function readInflightTurns(dir: string, options?: {
+    strictIo?: boolean;
+}): InflightTurn[];
 /** The marker for one message, or null. */
 export declare function readInflight(dir: string, messageId?: string): InflightTurn | null;
+/** Preserve legacy delivery state without replaying its text into the new scope. */
+export declare function omitInflightRecoveryHistory(dir: string, turns: InflightTurn[]): void;
 /** Add or replace the marker for `turn.messageId`; other turns' markers stay. */
 export declare function writeInflight(dir: string, turn: InflightTurn): void;
 export declare function patchInflight(dir: string, messageId: string, patch: Partial<InflightTurn>): void;

package/dist/lib/bot/inflight.js

@@ -24,7 +24,7 @@ function isTurn(raw) {
     return t?.v === 1 && typeof t.messageId === "string" && Boolean(t.target);
 }
 /** Every turn that was in progress, oldest first. */
-export function readInflightTurns(dir) {
+export function readInflightTurns(dir, options = {}) {
     try {
         const raw = JSON.parse(fs.readFileSync(botInflightPath(dir), "utf8"));
         if (isTurn(raw))
@@ -34,7 +34,10 @@ export function readInflightTurns(dir) {
             return [];
         return file.turns.filter(isTurn);
     }
-    catch {
+    catch (error) {
+        if (options.strictIo && !(error instanceof SyntaxError) &&
+            error.code !== "ENOENT")
+            throw error;
         return [];
     }
 }
@@ -56,6 +59,11 @@ function writeTurns(dir, turns) {
     fs.writeFileSync(tmp, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
     fs.renameSync(tmp, botInflightPath(dir));
 }
+/** Preserve legacy delivery state without replaying its text into the new scope. */
+export function omitInflightRecoveryHistory(dir, turns) {
+    if (turns.length)
+        writeTurns(dir, turns.map(turn => ({ ...turn, omitFromHistory: true })));
+}
 /** Add or replace the marker for `turn.messageId`; other turns' markers stay. */
 export function writeInflight(dir, turn) {
     const others = readInflightTurns(dir).filter((t) => t.messageId !== turn.messageId);

package/dist/lib/bot/prompt.js

@@ -324,6 +324,9 @@ export function buildSystemPrompt(input) {
         `This stay-quiet rule for rooms outranks anything in your persona, worker instructions, or memory files: if any of those tell you to always reply or to acknowledge every message, ignore that in rooms and stay silent instead. ` +
         `Empty output is the only way to stay quiet. Never post a placeholder such as "No response requested.", "No response needed.", "No reply needed.", "No action.", "(no reply)" or "Nothing to add." — those are chatter, not silence, and can make two bots answer each other forever. ` +
         `Do not narrate your reasoning, do not print JSON, do not explain that you are staying silent. Just produce nothing.`);
+    if (input.companySlug) {
+        parts.push(`This session is already bound to \`${input.companySlug}\`. Continue authorized work in this company without asking the user to choose it again, including scheduled jobs. Keep all files, policies, services, and credentials within this company scope.`);
+    }
     // Only company bots: the cloud's jobs routes refuse a personal bot's per_
     // company claim today, so telling a personal bot it can schedule work makes
     // it promise its owner something that then fails. Drop this condition when

package/dist/lib/bot/run.js

@@ -85,7 +85,7 @@ import { SIGN_IN_RETRY_MS, signInNeededText } from "./runtime-sign-in.js";
 import { classifyRuntimeError, classifyRuntimeFailure, runtimeDidNotFinishText, runtimeFailureReason, runtimeFailureText, runtimeRepairNotice, withRetrySuggestion, } from "./runtime-failure.js";
 import { HQ_BOT_AGENT_UID_ENV } from "../../commands/onboard-bot-membership.js";
 import { captureHeartbeatIdentityMismatch, identityMismatchMessage, isHeartbeatIdentityMismatch, } from "../heartbeat-identity.js";
-import { clearBotSession, readBotSession, writeBotSession } from "./session.js";
+import { clearBotSession, ensureBotCompanyScope, readBotSession, writeBotSession } from "./session.js";
 import { defaultBotStatus, patchBotStatus, readBotStatus } from "./status.js";
 import { CLI_VERSION } from "../../cli-version.js";
 import { CLI_UPDATE_RESTART_EXIT_CODE } from "./cli-update.js";
@@ -309,6 +309,8 @@ function defaultSleep(ms, signal) {
  * one did not: `delivered` is how many parts the person has, so a retry starts
  * where it stopped instead of repeating what they already read.
  */
+class CompanyBindingError extends Error {
+}
 class PartialPostError extends Error {
     parts;
     delivered;
@@ -453,6 +455,11 @@ export async function runBot(deps) {
     // Personal: every turn acts as the owner. Company: every turn acts as the bot.
     const kind = effectiveBotKind(config);
     const companies = effectiveBotCompanies(config);
+    // A single membership is unambiguous; personal and multi-company bots stay unbound.
+    const companySlug = config.companySlug ?? (kind === "company" && companies.length === 1 ? companies[0] : undefined);
+    const companyScopeKey = kind === "company" || companySlug !== undefined
+        ? JSON.stringify({ kind, companies: [...companies].sort(), companySlug: companySlug ?? null })
+        : undefined;
     const lockDeps = defaultPidLockDeps({
         pid,
         ...(deps.isProcessAlive ? { isProcessAlive: deps.isProcessAlive } : {}),
@@ -521,7 +528,7 @@ export async function runBot(deps) {
     // A restart is the owner's "try again" after signing in: start clean.
     setStatus({ ...fallback(), pid, state: "starting", canDrainForPromotion: false, runtimeSignIn: null, cliVersion });
     log("info", `starting ${config.name} on hq-cli ${cliVersion} (${config.runtime}, ${kind} bot${companies.length ? ` of ${companies.join(", ")}` : ""}) as ${config.agentUid} for ${config.ownerUid}`);
-    log("info", `${runtime.id} binary: ${describeRuntimeBinary(runtime, turnEnv(process.env, kind, config.agentUid, config.companySlug), turnCwd)}`);
+    log("info", `${runtime.id} binary: ${describeRuntimeBinary(runtime, turnEnv(process.env, kind, config.agentUid, companySlug), turnCwd)}`);
     deps.cliUpdate?.startup(log);
     try {
         const record = await api.getAgent(config.agentUid);
@@ -541,6 +548,15 @@ export async function runBot(deps) {
         await finish("failed", 0, `could not verify bot identity: ${err instanceof Error ? err.message : String(err)}`);
         return { stop: async () => { }, done, status: () => null, idle: () => true };
     }
+    try {
+        const scope = ensureBotCompanyScope(dir, companyScopeKey);
+        if (scope.reset)
+            log("info", "company scope changed or was unverified; archived prior conversations before starting fresh");
+    }
+    catch {
+        await finish("failed", 0, "could not isolate previous company conversations; settle any pending work under the previous settings and check workspace permissions before restarting");
+        return { stop: async () => { }, done, status: () => null, idle: () => true };
+    }
     // ── System prompt ──────────────────────────────────────────────────────────
     // A pack worker's bot gets the pack's "Pack setup" section (and the HQ setup
     // takeover when the pack asks for it and setup is unfinished).
@@ -563,14 +579,14 @@ export async function runBot(deps) {
             workerDir: config.workerDir,
             workerSource: config.workerSource,
             workerId: config.workerId,
-            companySlug: config.companySlug,
+            companySlug,
             kind,
             companies,
             memoryDir: config.memoryDir,
             sources: readPromptSources(config.hqRoot, config.workerDir, undefined, {
                 memoryDir: config.memoryDir,
                 workerSource: config.workerSource,
-                companySlug: config.companySlug,
+                companySlug,
             }),
         });
     const systemPromptFile = path.join(dir, "system-prompt.md");
@@ -878,8 +894,18 @@ export async function runBot(deps) {
      * A DM with no session (or whose resume id is gone) gets the recent thread
      * prepended so a one-word reply still has the question it answers.
      */
+    const bindingNotices = new Set();
     const executeTurn = async (prompt, sessionScope, tReceived, stream = {}, historyEventId) => {
-        const live = readBotConfig(dir) ?? config;
+        const fresh = readBotConfig(dir);
+        if (!fresh)
+            throw new CompanyBindingError(`I couldn't read my company settings. Please restart ${config.name} after restoring its configuration; this work is still pending.`);
+        const live = fresh;
+        const liveCompanies = effectiveBotCompanies(live);
+        const liveCompanySlug = live.companySlug ?? (effectiveBotKind(live) === "company" && liveCompanies.length === 1 ? liveCompanies[0] : undefined);
+        if (liveCompanySlug !== companySlug || effectiveBotKind(live) !== kind ||
+            JSON.stringify([...liveCompanies].sort()) !== JSON.stringify([...companies].sort())) {
+            throw new CompanyBindingError(`My company settings changed. Please restart ${config.name} to load them before I continue; this work is still pending.`);
+        }
         const remembered = readStatus()?.claudePermissionMode;
         const actsPurelyForOwner = sessionScope === "dm" || sessionScope.startsWith("job:");
         const composePrompt = async (session) => {
@@ -920,22 +946,22 @@ export async function runBot(deps) {
             return next;
         };
         const runAttempt = async (session, turnPrompt) => {
-            // Company bind (worker-sourced bots): HQ's company hooks key on
+            // Company bind (worker-sourced and single-company bots): HQ's company hooks key on
             // workspace/sessions/<sid>/meta.yaml, so the session id is fixed up front
             // and the meta file written before every turn (idempotent; covers session
             // resets). Claude gets the full hook set via its payload session id;
             // Codex/Grok only see HQ_SESSION_ID.
             const sid = session?.sessionId ?? randomUUID();
-            const env = turnEnv(process.env, kind, config.agentUid, config.companySlug);
+            const env = turnEnv(process.env, kind, config.agentUid, companySlug);
             let bind = { env };
-            if (config.companySlug) {
+            if (companySlug) {
                 try {
-                    ensureBotSessionMeta(config.hqRoot, sid, config.companySlug, undefined, now);
-                    bind = { newSessionId: sid, env: { ...env, HQ_SESSION_ID: sid } };
+                    ensureBotSessionMeta(config.hqRoot, sid, liveCompanySlug, undefined, now);
                 }
-                catch (err) {
-                    log("warn", `company bind failed for ${config.companySlug}: ${err instanceof Error ? err.message : String(err)}`);
+                catch {
+                    throw new CompanyBindingError(`I couldn't bind this session to ${companySlug}. Please check the bot's workspace permissions and retry; this work is still pending.`);
                 }
+                bind = { newSessionId: sid, env: { ...env, HQ_SESSION_ID: sid } };
             }
             const tTurnStart = now().getTime();
             // Model and thinking level are read fresh each turn, so a change from the
@@ -997,6 +1023,7 @@ export async function runBot(deps) {
                     v: 1,
                     runtime: config.runtime,
                     sessionId: turn.sessionId,
+                    ...(companyScopeKey !== undefined ? { companyScopeKey } : {}),
                     turns: (session?.turns ?? 0) + 1,
                     updatedAt: now().toISOString(),
                 }, sessionScope);
@@ -1143,7 +1170,18 @@ export async function runBot(deps) {
             await poster.abandon();
             const excerpt = err instanceof RuntimeError ? err.stderrExcerpt : err instanceof Error ? err.message : String(err);
             const aborted = (err instanceof RuntimeError && err.aborted) || controller.signal.aborted;
-            const started = !(err instanceof RuntimeError) || err.started;
+            if (err instanceof CompanyBindingError) {
+                setStatus({ lastError: err.message });
+                log("warn", err.message);
+                if (!bindingNotices.has(args.sessionScope)) {
+                    try {
+                        await args.sendToPerson(err.message);
+                        bindingNotices.add(args.sessionScope);
+                    }
+                    catch { /* Keep the notice retryable if delivery failed. */ }
+                }
+            }
+            const started = !(err instanceof CompanyBindingError) && (!(err instanceof RuntimeError) || err.started);
             return { outcome: { ok: false, started, aborted, excerpt, error: err }, poster };
         }
         finally {
@@ -1180,7 +1218,7 @@ export async function runBot(deps) {
         }
         await sendToTarget(target, notice.text, rootEventId, "human");
     };
-    const postOne = async (target, body, rootEventId, audience) => {
+    const postOne = async (target, body, rootEventId, audience, omitFromHistory = false) => {
         const root = rootEventId ? { rootEventId } : {};
         if (target.kind === "dm") {
             const posted = await api.sendDm({
@@ -1189,7 +1227,7 @@ export async function runBot(deps) {
                 ...root,
                 ...(audience ? { audience } : {}),
             });
-            if (audience !== "agent") {
+            if (audience !== "agent" && !omitFromHistory) {
                 const eventId = posted && typeof posted === "object" && "eventId" in posted && typeof posted.eventId === "string"
                     ? posted.eventId
                     : undefined;
@@ -1235,10 +1273,10 @@ export async function runBot(deps) {
      * PartialPostError naming how many parts got through, so the caller can save
      * exactly the remainder.
      */
-    const sendParts = async (target, parts, from, rootEventId, onDelivered, audience) => {
+    const sendParts = async (target, parts, from, rootEventId, onDelivered, audience, omitFromHistory = false) => {
         for (let i = Math.max(0, from); i < parts.length; i += 1) {
             try {
-                await postOne(target, parts[i], rootEventId, audience);
+                await postOne(target, parts[i], rootEventId, audience, omitFromHistory);
             }
             catch (err) {
                 throw new PartialPostError(parts, i, err);
@@ -1459,7 +1497,7 @@ export async function runBot(deps) {
         const parts = marker.replyParts ?? splitBody(recoveryBody(marker));
         const from = marker.replyParts ? Math.min(Math.max(0, marker.replyPartsDelivered ?? 0), parts.length) : 0;
         try {
-            await sendParts(marker.target, parts, from, marker.rootEventId, (count) => patchInflight(dir, marker.messageId, { replyParts: parts, replyPartsDelivered: count }));
+            await sendParts(marker.target, parts, from, marker.rootEventId, (count) => patchInflight(dir, marker.messageId, { replyParts: parts, replyPartsDelivered: count }), undefined, marker.omitFromHistory);
         }
         catch (err) {
             const reason = err instanceof Error ? err.message : String(err);
@@ -1471,12 +1509,12 @@ export async function runBot(deps) {
                     // no part of this run reached the chat yet.
                     const headerOut = (marker.progressPosted ?? 0) > 0 || (err instanceof PartialPostError ? err.delivered : from) > 0;
                     const text = marker.jobHeader && !headerOut ? `${marker.jobHeader}${UNDELIVERABLE_JOB_REPORT_TEXT}` : UNDELIVERABLE_JOB_REPORT_TEXT;
-                    await postOne(marker.target, text, marker.rootEventId).catch(() => undefined);
+                    await postOne(marker.target, text, marker.rootEventId, undefined, marker.omitFromHistory).catch(() => undefined);
                     // Giving up on DELIVERY is not giving up on the RUN: report it.
                     await reportRecoveredJobRun(marker);
                 }
                 else {
-                    await postOne(marker.target, UNDELIVERABLE_REPLY_TEXT, marker.rootEventId).catch(() => undefined);
+                    await postOne(marker.target, UNDELIVERABLE_REPLY_TEXT, marker.rootEventId, undefined, marker.omitFromHistory).catch(() => undefined);
                 }
                 await closeMarker(marker, isKickoff);
                 return true;
@@ -1592,6 +1630,10 @@ export async function runBot(deps) {
             workingNotice: false,
         });
         await clearThinking();
+        if (!outcome.ok && outcome.error instanceof CompanyBindingError) {
+            clearInflight(dir, KICKOFF_MESSAGE_ID);
+            return;
+        }
         if (outcome.ok) {
             // The kickoff never runs silenceable, so outcome.silent is never set here.
             if (poster.postedCount === 0) {
@@ -1758,6 +1800,11 @@ export async function runBot(deps) {
             workingNotice: false,
             ...(quietJob ? { suppressOutput: true } : {}),
         });
+        if (!outcome.ok && outcome.error instanceof CompanyBindingError) {
+            clearInflight(dir, id);
+            attempts.delete(id);
+            return;
+        }
         if (outcome.ok) {
             if (!quietJob && !reportDelivered(outcome.reply)) {
                 // The work finished but the REPORT did not fully reach the DM — even if
@@ -2076,6 +2123,11 @@ export async function runBot(deps) {
         });
         // The model saw the note once its turn ran. A turn that never started, or
         // one held for a coding-tool sign-in, runs again and keeps the note for it.
+        if (!outcome.ok && outcome.error instanceof CompanyBindingError) {
+            clearInflight(dir, id);
+            attempts.delete(id);
+            return;
+        }
         if (setupNote && !toolOffer && (outcome.ok || (outcome.started && !isSignInFailure(outcome.excerpt)))) {
             try {
                 patchSetupIntroState(dir, { notePending: false });

package/dist/lib/bot/session.d.ts

@@ -10,10 +10,24 @@ export interface BotSessionFile {
     v: 1;
     runtime: BotRuntimeId;
     sessionId: string;
+    /** Company/membership fingerprint under which this transcript was created. */
+    companyScopeKey?: string;
     turns: number;
     updatedAt: string;
 }
 export declare function readBotSession(dir: string, runtime: BotRuntimeId, scope?: BotSessionScope): BotSessionFile | null;
 export declare function writeBotSession(dir: string, session: BotSessionFile, scope?: BotSessionScope): void;
 export declare function clearBotSession(dir: string, scope?: BotSessionScope): void;
+/**
+ * Run once at startup, before reading or appending conversation state. A scope
+ * change must never resume a prior company's model session or replay its DM
+ * history. Preserve those files privately for recovery, then record the new
+ * scope. Filesystem failures propagate so callers cannot start a model turn.
+ * Legacy personal bots retain their existing history; company bots require
+ * positive scope evidence and archive legacy, unproven conversations once.
+ */
+export declare function ensureBotCompanyScope(dir: string, companyScopeKey: string | undefined): {
+    reset: boolean;
+    archiveDir?: string;
+};
 //# sourceMappingURL=session.d.ts.map

package/dist/lib/bot/session.js

@@ -6,6 +6,8 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { randomUUID } from "node:crypto";
+import { omitInflightRecoveryHistory, readInflightTurns } from "./inflight.js";
 import { botSessionPath } from "./paths.js";
 export function readBotSession(dir, runtime, scope = "dm") {
     const p = botSessionPath(dir, scope);
@@ -36,4 +38,72 @@ export function clearBotSession(dir, scope = "dm") {
         /* already gone */
     }
 }
+/**
+ * Run once at startup, before reading or appending conversation state. A scope
+ * change must never resume a prior company's model session or replay its DM
+ * history. Preserve those files privately for recovery, then record the new
+ * scope. Filesystem failures propagate so callers cannot start a model turn.
+ * Legacy personal bots retain their existing history; company bots require
+ * positive scope evidence and archive legacy, unproven conversations once.
+ */
+export function ensureBotCompanyScope(dir, companyScopeKey) {
+    const marker = path.join(dir, "company-scope.json");
+    const hasMarker = fs.existsSync(marker);
+    if (!hasMarker && companyScopeKey === undefined)
+        return { reset: false };
+    const expected = companyScopeKey ?? null;
+    let provenPreviousScope = false;
+    if (hasMarker) {
+        // Read errors fail closed. Invalid JSON is unproven provenance and resets.
+        const body = fs.readFileSync(marker, "utf8");
+        let parsed;
+        try {
+            parsed = JSON.parse(body);
+        }
+        catch {
+            parsed = null;
+        }
+        provenPreviousScope = Boolean(parsed && typeof parsed === "object" &&
+            parsed.v === 1 &&
+            (typeof parsed.companyScopeKey === "string" ||
+                parsed.companyScopeKey === null));
+        if (parsed && typeof parsed === "object" &&
+            parsed.v === 1 &&
+            parsed.companyScopeKey === expected) {
+            return { reset: false };
+        }
+    }
+    // A known company switch must settle recovery under its previous scope.
+    // Legacy bots have no scope evidence: isolate their model context below,
+    // but leave delivery/job markers intact for the existing recovery path.
+    // Recovery only settles saved work; it never resumes the old model session.
+    // Match recovery's tolerant parser so corrupt markers do not brick startup.
+    const pending = readInflightTurns(dir, { strictIo: true });
+    if (provenPreviousScope && pending.length > 0) {
+        throw new Error("Bot company settings changed with pending work. Restore the previous company settings and settle pending work before switching companies.");
+    }
+    if (!provenPreviousScope)
+        omitInflightRecoveryHistory(dir, pending);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const names = fs.readdirSync(dir).filter((name) => /^(?:session|dm-history)(?:-[A-Za-z0-9_-]+)?\.json$/.test(name));
+    let archiveDir;
+    if (names.length) {
+        const archiveRoot = path.join(dir, "company-scope-archives");
+        fs.mkdirSync(archiveRoot, { recursive: true, mode: 0o700 });
+        archiveDir = path.join(archiveRoot, randomUUID());
+        fs.mkdirSync(archiveDir, { mode: 0o700 });
+        for (const name of names)
+            fs.renameSync(path.join(dir, name), path.join(archiveDir, name));
+    }
+    // Commit the new provenance only after every old conversation was isolated.
+    const tmp = path.join(dir, `.company-scope.${randomUUID()}.tmp`);
+    try {
+        fs.writeFileSync(tmp, `${JSON.stringify({ v: 1, companyScopeKey: expected })}\n`, { mode: 0o600 });
+        fs.renameSync(tmp, marker);
+    }
+    finally {
+        fs.rmSync(tmp, { force: true });
+    }
+    return { reset: names.length > 0, ...(archiveDir ? { archiveDir } : {}) };
+}
 //# sourceMappingURL=session.js.map

package/dist/lib/capacity/collectors/claude-oauth.d.ts

@@ -287,6 +287,12 @@ export declare function tokenFingerprint(token: string): string;
 export declare function readClaudeRefreshLast(root: string, home: string): ClaudeRefreshLastEntry | null;
 /** @deprecated prefer {@link revokedMarkerForCurrentCredential}; this is the pre-fingerprint shim. */
 export declare function isAccountRevokedPersisted(root: string, accountId: string): boolean;
+/**
+ * True when the capacity collector has recorded this refresh token as
+ * revoked (by token fingerprint, under any account). Lanes use it to tell a
+ * dead sign-in from an access token that Claude Code will renew at startup.
+ */
+export declare function isRefreshTokenRevoked(root: string, refreshToken: string): boolean;
 /**
  * Compare the persisted revoked marker (if any) against the refresh token the
  * caller is about to use.

package/dist/lib/capacity/collectors/claude-oauth.js

@@ -1556,6 +1556,18 @@ export function isAccountRevokedPersisted(root, accountId) {
     const file = readRefreshLast(root);
     return Object.prototype.hasOwnProperty.call(file.revokedAccounts, accountId);
 }
+/**
+ * True when the capacity collector has recorded this refresh token as
+ * revoked (by token fingerprint, under any account). Lanes use it to tell a
+ * dead sign-in from an access token that Claude Code will renew at startup.
+ */
+export function isRefreshTokenRevoked(root, refreshToken) {
+    const file = readRefreshLast(root);
+    const fp = tokenFingerprint(refreshToken);
+    if (file.revokedTokens[fp] !== undefined)
+        return true;
+    return Object.values(file.revokedAccounts).some((entry) => entry.fingerprint === fp);
+}
 /**
  * Compare the persisted revoked marker (if any) against the refresh token the
  * caller is about to use.

package/dist/lib/capacity/lane-login.d.ts

@@ -20,6 +20,12 @@ export interface LaneLoginInput {
      * login confirms sign-in through this probe. Defaults to the lanes probe.
      */
     probeProvider?: Ctx["probeProvider"];
+    /**
+     * Claude access-token expiry check for the post-login status. Defaults to
+     * the real Keychain/file read when the default probe is used; a caller that
+     * injects a probe passes its own reader or gets no expiry check.
+     */
+    readClaudeCredential?: Ctx["readClaudeCredential"];
 }
 export interface LaneLoginResult {
     id: string;