@indigoai-us/hq-cli 5.345.169 → 5.345.170

package/dist/lib/daemon/run.js

@@ -22,6 +22,7 @@ import { readBotConfig } from "../bot/config.js";
 import { botsRoot } from "../bot/paths.js";
 import { CLAUDE_RUNNER_SCRIPT, CODEX_RUNNER_SCRIPT, enabledServices, planUnits } from "./catalog.js";
 import { effectiveSyncOwner, readDaemonConfig } from "./config.js";
+import { inspectSyncCoreCanary } from "./sync-core-canary.js";
 import { assertPersonalServiceSessionCapability, readRemoteControlPoolsConfig, remoteControlPoolSecretsEnv, } from "./remote-control-pools.js";
 import { loadLanesConfig } from "../lanes/config.js";
 import { daemonLanesReconcileHandler } from "../lanes/daemon-reconcile.js";
@@ -54,7 +55,7 @@ import { stageHqChildBootstrap } from "./hq-child-bootstrap-stage.js";
 import { runnerSessionName } from "./remote-control.js";
 import { adoptChild, createChildTracker, finishSuccession, handoffEligible, readProcStart, stopOrphans, successionPaths, systemdKillMode, takeSuccession, writeHandoff, } from "./succession.js";
 import { listSyncRunnerProcesses, readWatchRunnerOwnerStatus, syncHeartbeatTimeoutMs, syncRunnerNodeOptions, watchRunnerOwnerStatusPath, } from "./sync-runner.js";
-import { STOP_ESCALATION_MS, SYNC_RUNNER_PERSIST_GRACE_MS, createSupervisor, } from "./supervisor.js";
+import { STOP_ESCALATION_MS, SYNC_RUNNER_PERSIST_GRACE_MS, createSupervisor, planKey, } from "./supervisor.js";
 import { userToolDirs } from "./tools.js";
 import { logOffset, readLogSince, readUnitHolds, writeUnitHolds } from "./unit-holds.js";
 import { daemonRunGuard } from "./lanes-reconcile-guard.js";
@@ -63,6 +64,19 @@ export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 export const RESTART_EXIT_CODE = 75;
 const NON_SYNC_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + 5_000;
 const SYNC_RUNNER_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + SYNC_RUNNER_PERSIST_GRACE_MS + 5_000;
+export function planUnitsWithSyncCoreInterlock(services, context, supervisor) {
+    const syncCoreCanaryRunning = supervisor?.runningPlanKey("sync-core-canary") !== undefined;
+    const transitionContext = {
+        ...context,
+        syncCoreCanaryRunning,
+        legacySyncReadyForCore: false,
+    };
+    const waiting = planUnits(services, transitionContext);
+    const legacy = waiting.find((unit) => unit.id === "sync");
+    const legacySyncReadyForCore = legacy !== undefined
+        && supervisor?.runningPlanKey("sync") === planKey(legacy, CLI_VERSION);
+    return planUnits(services, { ...transitionContext, legacySyncReadyForCore });
+}
 /** A bounded shutdown deadline that can account for sync push persistence. */
 export function createShutdownCap() {
     const startedAt = Date.now();
@@ -939,7 +953,7 @@ export async function runDaemon(opts) {
             legacy,
             appRunning: () => desktopAppRunning(platform),
         });
-        const plans = planUnits(services, {
+        const context = {
             machineType,
             platform,
             home,
@@ -964,6 +978,11 @@ export async function runDaemon(opts) {
                 return switches;
             })(),
             syncOwner,
+            syncCoreCanary: config.syncCoreCanaryError
+                ? { blockedReason: config.syncCoreCanaryError }
+                : config.syncCoreCanary
+                    ? inspectSyncCoreCanary(home, hqRoot, config.syncCoreCanary, platform)
+                    : undefined,
             desktopAppManagesSync: appManagesSync,
             syncRunnerProcesses,
             syncRunnerOwnerPid,
@@ -991,7 +1010,8 @@ export async function runDaemon(opts) {
             invalidPoolServiceSessions,
             availablePoolFrontends,
             unverifiablePoolFrontends,
-        });
+        };
+        const plans = planUnitsWithSyncCoreInterlock(services, context, supervisor);
         if (startupPlanOpen) {
             const replaceablePackageRoots = cliPackageRoot ? [cliPackageRoot] : [];
             if (hqCloud?.source === "bundled")

package/dist/lib/daemon/supervisor.d.ts

@@ -179,6 +179,7 @@ export interface Supervisor {
     stop(): Promise<void>;
     reconcile(): void;
     state(): DaemonState;
+    runningPlanKey(unitId: string): string | undefined;
     /** True while a live sync runner has reported that it is persisting pushes. */
     hasStoppingSyncRunner(): boolean;
     /** Stop supervising without signalling any child; returns the long-running units left running. */

package/dist/lib/daemon/supervisor.js

@@ -1399,6 +1399,10 @@ export function createSupervisor(deps) {
         },
         reconcile,
         state: snapshot,
+        runningPlanKey(unitId) {
+            const slot = slots.get(unitId);
+            return slot?.child ? slot.childKey : undefined;
+        },
         hasStoppingSyncRunner: () => [...liveOwners.values()].some(syncRunnerIsStopping),
         release() {
             const released = [];

package/dist/lib/daemon/sync-core-canary.d.ts

@@ -0,0 +1,9 @@
+import type { SyncCoreCanaryConfig } from "./config.js";
+export interface SyncCoreCanaryPlan {
+    binaryPath?: string;
+    vaultUid?: string;
+    canaryPath?: string;
+    blockedReason?: string;
+}
+export declare function inspectSyncCoreCanary(home: string, hqRoot: string | undefined, config: SyncCoreCanaryConfig, platform: NodeJS.Platform): SyncCoreCanaryPlan;
+//# sourceMappingURL=sync-core-canary.d.ts.map

package/dist/lib/daemon/sync-core-canary.js

@@ -0,0 +1,56 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse as parseToml } from "smol-toml";
+function blocked(config, blockedReason) {
+    return { ...config, blockedReason };
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+export function inspectSyncCoreCanary(home, hqRoot, config, platform) {
+    if (platform !== "darwin" && platform !== "linux") {
+        return blocked(config, "the sync-core canary requires macOS or Linux");
+    }
+    try {
+        if (!fs.statSync(config.binaryPath).isFile())
+            return blocked(config, "the sync-core binary is missing");
+        fs.accessSync(config.binaryPath, fs.constants.X_OK);
+    }
+    catch {
+        return blocked(config, "the sync-core binary is missing or not executable");
+    }
+    const configPath = path.join(home, ".hq", "sync-core", "config.toml");
+    let sync;
+    try {
+        sync = record(record(parseToml(fs.readFileSync(configPath, "utf8")))?.sync);
+    }
+    catch {
+        return blocked(config, `the sync-core config at ${configPath} is missing or invalid`);
+    }
+    if (sync?.engine !== "rust-test" || sync.mode !== "full") {
+        return blocked(config, "the sync-core config must select engine rust-test in full mode");
+    }
+    const vaults = sync.vaults;
+    if (!Array.isArray(vaults) || vaults.length !== 1 || vaults[0] !== config.vaultUid) {
+        return blocked(config, `the sync-core config must name exactly ${config.vaultUid}`);
+    }
+    if (!hqRoot || typeof sync.hq_root !== "string" || path.resolve(sync.hq_root) !== path.resolve(hqRoot)) {
+        return blocked(config, "the sync-core config must use the daemon's HQ folder");
+    }
+    const canaryPath = typeof sync.canary_path === "string" ? sync.canary_path.trim() : "";
+    if (!canaryPath)
+        return blocked(config, "the sync-core config must name one canary path");
+    const ownedPath = path.join(home, ".hq", "sync-core", "owned", `${config.vaultUid}.json`);
+    try {
+        const owned = record(JSON.parse(fs.readFileSync(ownedPath, "utf8")));
+        if (owned?.vault !== config.vaultUid)
+            throw new Error("mismatch");
+    }
+    catch {
+        return blocked(config, `the sync-core ownership record for ${config.vaultUid} is missing or invalid`);
+    }
+    return { ...config, canaryPath };
+}
+//# sourceMappingURL=sync-core-canary.js.map

package/dist/lib/doctor/checks/sync-health.d.ts

@@ -61,7 +61,39 @@ export interface SyncManifestUploadStatus {
     baseUsable: boolean;
     /** Local company slug for company-scoped remediation; absent for personal. */
     companySlug?: string;
+    /**
+     * Last failed pass, from hq-cloud >= 6.18.102 (`readManifestUploadStatus`,
+     * hq-cloud #1050). Fixed tokens only. Absent on older hq-cloud and after a
+     * later pass succeeded.
+     */
+    lastAttemptAt?: string;
+    consecutiveFailures?: number;
+    lastFailureReason?: string;
+    lastFailureKind?: string;
+    lastFailureStatus?: number;
 }
+/**
+ * The last failed pass for a stale scope, when hq-cloud recorded one after the
+ * last successful upload. Undefined means "no evidence a pass ran", which is
+ * the only case where "the daily audit pass is not running" is accurate.
+ */
+export declare function manifestLastFailure(entry: SyncManifestUploadStatus): {
+    reason: string;
+    status?: number;
+    attempts: number;
+    at: string;
+} | undefined;
+/**
+ * Failures a fresh `hq sync manifest` from this machine cannot clear: the
+ * upload route is not deployed (404 soft skip), the server rejected this
+ * identity, or it refused access (403). A 401 is not listed: it can be an
+ * expired token that a fresh run refreshes. Offering `--fix` for these only makes the
+ * health hook report the same row as "repair did not clear" every day.
+ */
+export declare function manifestFailureNotFixable(failure: {
+    reason: string;
+    status?: number;
+}): boolean;
 /** Injectable dependencies — defaults are the real collectors. */
 export interface SyncHealthDeps {
     /** Runner log and conflict signals; omitted in unit tests of other checks. */

package/dist/lib/doctor/checks/sync-health.js

@@ -52,6 +52,45 @@ const SYNC_FAMILY_TITLE = "Versions & sync";
 export const STALE_JOURNAL_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1000;
 /** The offline update cache written by the check-hq-update SessionStart hook. */
 export const UPDATE_CACHE_RELPATH = path.join("workspace", ".hq-update-check", "last-check.json");
+/** Failure tokens hq-cloud stores, restricted the same way hq-cloud reads them. */
+const MANIFEST_FAILURE_TOKEN = /^[a-z][a-z0-9_]{0,39}$/;
+/**
+ * The last failed pass for a stale scope, when hq-cloud recorded one after the
+ * last successful upload. Undefined means "no evidence a pass ran", which is
+ * the only case where "the daily audit pass is not running" is accurate.
+ */
+export function manifestLastFailure(entry) {
+    const reason = entry.lastFailureReason;
+    const at = entry.lastAttemptAt;
+    if (!reason || !MANIFEST_FAILURE_TOKEN.test(reason) || !at)
+        return undefined;
+    const attempts = entry.consecutiveFailures ?? 0;
+    if (!Number.isFinite(attempts) || attempts < 1)
+        return undefined;
+    const atMs = Date.parse(at);
+    if (!Number.isFinite(atMs))
+        return undefined;
+    const uploadedMs = entry.lastUploadAt ? Date.parse(entry.lastUploadAt) : Number.NaN;
+    if (Number.isFinite(uploadedMs) && atMs <= uploadedMs)
+        return undefined;
+    const status = typeof entry.lastFailureStatus === "number" && Number.isInteger(entry.lastFailureStatus)
+        ? entry.lastFailureStatus
+        : undefined;
+    return { reason, attempts: Math.floor(attempts), at, ...(status !== undefined ? { status } : {}) };
+}
+/**
+ * Failures a fresh `hq sync manifest` from this machine cannot clear: the
+ * upload route is not deployed (404 soft skip), the server rejected this
+ * identity, or it refused access (403). A 401 is not listed: it can be an
+ * expired token that a fresh run refreshes. Offering `--fix` for these only makes the
+ * health hook report the same row as "repair did not clear" every day.
+ */
+export function manifestFailureNotFixable(failure) {
+    if (failure.reason === "soft_skip" || failure.reason === "rejected_identity")
+        return true;
+    // 401 is left fixable: an expired token is refreshed by the next run.
+    return failure.status === 403 || failure.status === 404;
+}
 /** Fill in the optional dependencies so call sites never branch on undefined. */
 function withDefaults(deps, hqRoot) {
     return {
@@ -782,7 +821,21 @@ function manifestResults(deps, journals) {
                 }
             }
             const command = `hq sync manifest${scope ? ` --scope ${scope}` : ""}`;
-            const message = `Scope '${entry.scopeKey}' last uploaded a sync manifest ${days} day${days === 1 ? "" : "s"} ago (${entry.lastUploadAt}) — the daily audit pass is not running.`;
+            const failure = manifestLastFailure(entry);
+            const age = `Scope '${entry.scopeKey}' last uploaded a sync manifest ${days} day${days === 1 ? "" : "s"} ago (${entry.lastUploadAt})`;
+            // A pass that ran and failed is not "not running": name the stored reason.
+            const message = failure
+                ? `${age}. The last pass (${failure.at}) failed with ${failure.reason}${failure.status !== undefined ? ` (HTTP ${failure.status})` : ""}, ${failure.attempts} failed pass${failure.attempts === 1 ? "" : "es"} in a row.`
+                : `${age} — the daily audit pass is not running.`;
+            if (failure && manifestFailureNotFixable(failure)) {
+                return {
+                    status: "WARN",
+                    checkId,
+                    reasonCode: "manifest-upload-rejected",
+                    message,
+                    remediation: `--fix cannot clear this from this machine. Check you are signed in to the right HQ account (/hq-whoami), then run \`${command}\` and read its error.`,
+                };
+            }
             // With the kill switch set the upload exits 0 and sends nothing, so the
             // row carries no `--fix` target and names the switch instead.
             if (deps.manifestUploadsDisabled()) {

package/dist/lib/doctor/fix/apply.d.ts

@@ -157,8 +157,13 @@ export interface RefreshManifestTarget {
 }
 /** Outcome of one {@link ApplyFixesOptions.refreshManifest} call. */
 export interface RefreshManifestResult {
-    /** Whether the upload command exited 0. The re-check is the real verdict. */
+    /**
+     * Whether the upload command exited 0 and, when it printed a `--json`
+     * outcome, that outcome was `uploaded`. The re-check is the real verdict.
+     */
     ok: boolean;
+    /** The `hq sync manifest --json` status token, when the pass did not upload. */
+    passStatus?: string;
     /** One-line summary. */
     message: string;
     /**
@@ -333,11 +338,28 @@ export interface RefreshSyncSpawnDeps {
 export declare const REFRESH_SYNC_LOCK_TIMEOUT_SEC = 30;
 /**
  * Default `refresh-manifest` repair: a bounded `hq sync manifest --scope <s>`
- * against the tree `--fix` is repairing. Exit 0 also covers throttled,
- * disabled, and skipped passes, so the post-fix re-check decides whether the
- * row cleared. A timeout or non-zero exit is reported, not thrown.
+ * against the tree `--fix` is repairing, with `--json` so a pass that exits 0
+ * without uploading (soft_skipped, throttled, disabled, locked,
+ * resend_full_scheduled) is reported as not uploaded. A `resend_full` answer
+ * is retried once with `--full`. The post-fix re-check still decides whether
+ * the row cleared. A timeout or non-zero exit is reported, not thrown.
  */
 export declare function defaultRefreshManifest(target: RefreshManifestTarget): Promise<RefreshManifestResult>;
+type ManifestSpawnResult = Pick<SpawnSyncReturns<string>, "error" | "status" | "signal"> & Partial<Pick<SpawnSyncReturns<string>, "stdout" | "stderr">>;
+/**
+ * Run one upload and, when the server answered `resend_full` (it dropped or
+ * refused the delta base), run it once more with `--full`. Without the retry
+ * the scope stays stale until the next day's --fix run, and the health hook
+ * reports it as unrepaired in between (feedback_84d7a862).
+ */
+export declare function refreshManifestWithRetry(scope: string, run: (full: boolean, json: boolean) => ManifestSpawnResult): RefreshManifestResult;
+/** Commander's rejection of `--json` by a binary that predates it. */
+export declare function manifestJsonUnsupported(result: ManifestSpawnResult): boolean;
+/**
+ * The status token from the `hq sync manifest --json` line, or undefined when
+ * the output has none (an older binary, or a pass that printed only a summary).
+ */
+export declare function manifestPassStatus(stdout: string | undefined): string | undefined;
 /**
  * Map one `hq sync manifest` spawn result to a {@link RefreshManifestResult}.
  * A spawn killed by the timeout has a null status, so it is reported as a

package/dist/lib/doctor/fix/apply.js

@@ -735,20 +735,95 @@ function defaultLocksDir() {
 export const REFRESH_SYNC_LOCK_TIMEOUT_SEC = 30;
 /**
  * Default `refresh-manifest` repair: a bounded `hq sync manifest --scope <s>`
- * against the tree `--fix` is repairing. Exit 0 also covers throttled,
- * disabled, and skipped passes, so the post-fix re-check decides whether the
- * row cleared. A timeout or non-zero exit is reported, not thrown.
+ * against the tree `--fix` is repairing, with `--json` so a pass that exits 0
+ * without uploading (soft_skipped, throttled, disabled, locked,
+ * resend_full_scheduled) is reported as not uploaded. A `resend_full` answer
+ * is retried once with `--full`. The post-fix re-check still decides whether
+ * the row cleared. A timeout or non-zero exit is reported, not thrown.
  */
 export function defaultRefreshManifest(target) {
-    const hqBin = process.argv[1];
-    const args = ["sync", "manifest", "--scope", target.scope, "--hq-root", target.hqRoot];
-    const result = spawnSync(hqBin ? process.execPath : "hq", hqBin ? [hqBin, ...args] : args, {
-        encoding: "utf8",
-        timeout: REFRESH_SYNC_TIMEOUT_MS,
-        cwd: target.hqRoot,
-    });
-    return Promise.resolve(manifestUploadResult(target.scope, result));
+    return Promise.resolve(refreshManifestWithRetry(target.scope, (full, json) => {
+        const hqBin = process.argv[1];
+        const args = [
+            "sync",
+            "manifest",
+            "--scope",
+            target.scope,
+            "--hq-root",
+            target.hqRoot,
+            ...(json ? ["--json"] : []),
+            ...(full ? ["--full"] : []),
+        ];
+        return spawnSync(hqBin ? process.execPath : "hq", hqBin ? [hqBin, ...args] : args, {
+            encoding: "utf8",
+            timeout: REFRESH_SYNC_TIMEOUT_MS,
+            cwd: target.hqRoot,
+        });
+    }));
+}
+/**
+ * Run one upload and, when the server answered `resend_full` (it dropped or
+ * refused the delta base), run it once more with `--full`. Without the retry
+ * the scope stays stale until the next day's --fix run, and the health hook
+ * reports it as unrepaired in between (feedback_84d7a862).
+ */
+export function refreshManifestWithRetry(scope, run) {
+    const firstRaw = run(false, true);
+    // `hq` from PATH can be an older binary without `--json`. Fall back to the
+    // exit-code handling it always had instead of reporting a failure.
+    if (manifestJsonUnsupported(firstRaw))
+        return manifestUploadResult(scope, run(false, false));
+    const first = manifestUploadResult(scope, firstRaw);
+    if (first.passStatus !== "resend_full_scheduled")
+        return first;
+    const retry = manifestUploadResult(scope, run(true, true));
+    if (retry.passStatus !== "resend_full_scheduled")
+        return retry;
+    return {
+        ...retry,
+        reason: "the server asked for a full manifest again after a --full retry; a full resend is queued, so run `hq sync` again later",
+    };
+}
+/** Commander's rejection of `--json` by a binary that predates it. */
+export function manifestJsonUnsupported(result) {
+    if (result.status === 0 || result.status === null)
+        return false;
+    return /unknown option ['"]?--json/i.test(`${result.stderr ?? ""}\n${result.stdout ?? ""}`);
+}
+/**
+ * The status token from the `hq sync manifest --json` line, or undefined when
+ * the output has none (an older binary, or a pass that printed only a summary).
+ */
+export function manifestPassStatus(stdout) {
+    const lines = (stdout ?? "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+        const line = lines[index];
+        if (!line.startsWith("{"))
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (typeof parsed.status === "string" && /^[a-z_]{1,40}$/.test(parsed.status)) {
+                return parsed.status;
+            }
+        }
+        catch {
+            // Not the outcome line.
+        }
+    }
+    return undefined;
 }
+/**
+ * Plain-words reason for a pass that exited 0 without uploading. Each one
+ * leaves `lastUploadAt` unchanged, so the stale row cannot clear.
+ */
+const MANIFEST_NOT_UPLOADED_REASONS = {
+    soft_skipped: "the sync service did not accept manifest uploads (the pass was skipped)",
+    throttled: "the pass was throttled and sent nothing",
+    disabled: "manifest uploads are turned off on this machine",
+    locked: "another manifest pass for this scope was already running",
+    resend_full_scheduled: "the server asked for a fresh full manifest and the upload did not finish",
+    printed: "the pass only printed the manifest",
+};
 /**
  * Map one `hq sync manifest` spawn result to a {@link RefreshManifestResult}.
  * A spawn killed by the timeout has a null status, so it is reported as a
@@ -778,6 +853,15 @@ export function manifestUploadResult(scope, result) {
                 : {}),
         };
     }
+    const passStatus = manifestPassStatus(result.stdout);
+    if (passStatus && passStatus !== "uploaded") {
+        return {
+            ok: false,
+            passStatus,
+            reason: MANIFEST_NOT_UPLOADED_REASONS[passStatus] ?? `the pass ended '${passStatus}' without uploading`,
+            message: `manifest upload for '${scope}' did not upload (${passStatus})`,
+        };
+    }
     return { ok: true, message: `uploaded the manifest for '${scope}'` };
 }
 /** `hq sync manifest` output for a company this identity is not a member of. */

package/dist/lib/doctor/types.d.ts

@@ -19,7 +19,7 @@ export declare const DOCTOR_STATUSES: readonly ["PASS", "FAIL", "WARN", "UNTESTE
  */
 export type DoctorStatus = (typeof DOCTOR_STATUSES)[number];
 /** Stable, privacy-safe diagnostics emitted by the sync health family. */
-export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "company-not-resolved", "legacy-personal-journal", "never-synced", "invalid-last-sync", "stale-threshold", "refresh-in-progress", "refresh-lock-held", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "pull-access-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
+export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "company-not-resolved", "legacy-personal-journal", "never-synced", "invalid-last-sync", "stale-threshold", "refresh-in-progress", "refresh-lock-held", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "manifest-upload-rejected", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "pull-access-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
 export type SyncReasonCode = (typeof SYNC_REASON_CODES)[number];
 /** Runtime type guard: true only for a member of the fixed vocabulary. */
 export declare function isDoctorStatus(value: unknown): value is DoctorStatus;

package/dist/lib/doctor/types.js

@@ -38,6 +38,7 @@ export const SYNC_REASON_CODES = [
     "no-manifest-scopes",
     "never-uploaded",
     "invalid-upload-time",
+    "manifest-upload-rejected",
     "unresolved-company-uid",
     "realtime-lag-stuck",
     "receiver-permission-denied",

package/dist/lib/mesh/live/daemon/work-subscribe.js

@@ -12,6 +12,33 @@ import { backoffDelayMs, RECONNECT_MIN_DELAY_MS } from "./presence.js";
 import { AGENT_INBOX_PUSH_STATE_BASENAME, SYNC_WAKE_STATE_BASENAME } from "../paths.js";
 export { AGENT_INBOX_PUSH_STATE_BASENAME, SYNC_WAKE_STATE_BASENAME } from "../paths.js";
 const INBOX_PUSH_HEARTBEAT_MS = 5_000;
+const SYNC_WAKE_KEYS = new Set(["v", "type", "vault", "head", "rootId"]);
+const SYNC_WAKE_VAULT = /^(?:prs|cmp|agt)_[0-9A-Za-z]+$/;
+const SYNC_WAKE_ROOT = /^[0-9a-f]{64}$/i;
+function isSyncWakeEnvelope(payload) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.isBuffer(payload) ? payload.toString("utf8") : payload);
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    const message = parsed;
+    const keys = Object.keys(message);
+    if (keys.length !== SYNC_WAKE_KEYS.size || keys.some((key) => !SYNC_WAKE_KEYS.has(key))) {
+        return false;
+    }
+    return message.v === 1 &&
+        message.type === "vault.head" &&
+        typeof message.vault === "string" &&
+        SYNC_WAKE_VAULT.test(message.vault) &&
+        Number.isSafeInteger(message.head) &&
+        Number(message.head) > 0 &&
+        (message.rootId === null ||
+            (typeof message.rootId === "string" && SYNC_WAKE_ROOT.test(message.rootId)));
+}
 function readWakeSequence(meshRoot, basename, label, onInfo) {
     const target = path.join(meshRoot, basename);
     try {
@@ -260,6 +287,10 @@ export async function startWorkCacheSubscriber(opts) {
                 return;
             }
             if (syncTopic && _topic === syncTopic && syncSubscribed) {
+                if (!isSyncWakeEnvelope(payload)) {
+                    opts.onInfo?.("sync wake ignored (invalid envelope)");
+                    return;
+                }
                 syncWakeSequence += 1;
                 persistSyncState(true);
                 return;

package/dist/lib/work-context/organize.d.ts

@@ -91,6 +91,13 @@ export declare function prepareOrganizeDecision(input: {
     fetchCandidates?: FetchCandidatesFn;
     /** Skip network; leave unresolved without candidates. */
     offline?: boolean;
+    /**
+     * Membership-validated slug -> companyUid. Reconcile can persist a session
+     * with only `companySlug` (for example a local-only project bound while the
+     * membership lookup was offline or failed). Online organize uses this to
+     * recover the uid instead of reporting `candidates_unavailable`.
+     */
+    resolveCompanyUid?: (companySlug: string) => Promise<string | null | undefined>;
 }): Promise<OrganizeListResult>;
 /** True when a local decision's server window has passed (or is unparsable). */
 export declare function isLocalDecisionExpired(expiresAt: string | undefined, now?: Date): boolean;

package/dist/lib/work-context/organize.js

@@ -76,7 +76,7 @@ export function decisionFromCandidates(sessionId, response) {
  */
 export async function prepareOrganizeDecision(input) {
     const nowFn = input.now ?? (() => new Date());
-    const state = readSessionState(input.sessionId, input.root);
+    let state = readSessionState(input.sessionId, input.root);
     if (!state) {
         return {
             sessionId: input.sessionId,
@@ -114,6 +114,26 @@ export async function prepareOrganizeDecision(input) {
             reason: state.contextStatus,
         };
     }
+    // Recover the uid after the status gates, before refreshExpired and the
+    // candidates_unavailable gate both read it.
+    if (!state.companyUid &&
+        state.companySlug &&
+        !input.offline &&
+        input.fetchCandidates &&
+        input.resolveCompanyUid) {
+        let recovered;
+        try {
+            recovered = await input.resolveCompanyUid(state.companySlug);
+        }
+        catch {
+            recovered = undefined;
+        }
+        if (typeof recovered === "string" && recovered.startsWith("cmp_")) {
+            const withUid = mergeLocalSessionFields({ ...state, companyUid: recovered, updatedAt: nowFn().toISOString() }, state);
+            writeSessionState(withUid, input.root);
+            state = withUid;
+        }
+    }
     // Ask-once: an existing decision is never replaced or re-armed — unless its
     // server decision window has expired. The server stamps a fresh window only
     // when candidates are listed, so returning the stale decision would make

package/dist/sentry-before-send.js

@@ -215,6 +215,7 @@ export function beforeSend(event, _hint) {
             "no-manifest-scopes",
             "never-uploaded",
             "invalid-upload-time",
+            "manifest-upload-rejected",
             "unresolved-company-uid",
         ]);
         const platforms = new Set([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.169",
+  "version": "5.345.170",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.169",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.169",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.169",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.169",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.169",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.169"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.170",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.170",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.170",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.170",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.170",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.170"
   }
 }