@indigoai-us/hq-cli 5.345.199 → 5.345.200

package/dist/lib/mesh/live/flush.js

@@ -9,9 +9,10 @@
  * 2xx responses are accounted per eventId (accepted / duplicates / rejected).
  */
 import * as fs from "node:fs";
+import { reportingLocallyDisabled } from "./reporting-privacy.js";
 import * as path from "node:path";
 import { readMetaCompanySlug, resolveCompany } from "../../work-context/company.js";
-import { companyBindingChanged, reboundSessionProjection, } from "../../work-context/company-rebind.js";
+import { companyBindingChanged, isNonCloudCompanySlug, reboundSessionProjection, } from "../../work-context/company-rebind.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
 import { rebindNeedsProjectOnPrompt } from "../../work-context/prompt-rebind.js";
 import { readSessionState, updateSessionState, writeSessionState } from "../../work-context/state.js";
@@ -172,6 +173,12 @@ async function postBatchWithRetries(poster, body, deps) {
  * Recovers orphan `*.claimed` files first; restores unprocessed lines on throw.
  */
 export async function flushSessionEvents(inputDeps) {
+    const env = inputDeps.env ?? process.env;
+    if (reportingLocallyDisabled(env) ||
+        (inputDeps.reportingAllowed && !(await inputDeps.reportingAllowed()))) {
+        return { claimed: 0, posted: 0, held: 0, dropped: 0, deadLettered: 0,
+            restored: 0, batches: 0, heldClaimed: false, heldOverflow: 0 };
+    }
     // One resolver per flush: git lookups are cached per cwd for this flush only.
     const deps = {
         ...inputDeps,
@@ -268,6 +275,30 @@ export async function flushSessionEvents(inputDeps) {
                 break sessionLoop;
             let state = readSessionState(sessionId, deps.workContextRoot);
             state = applySessionMetaCompanyRebind(sessionId, items, state, deps, now);
+            // Personal is the documented non-cloud scope, even if an old projection
+            // still contains a company UID or a pending presence leave.
+            if (isNonCloudCompanySlug(state?.companySlug) || items.some(item => isNonCloudCompanySlug(eventText(item.event, "companySlug")))) {
+                summary.dropped += items.length;
+                for (const item of items)
+                    markDisposed(item.event);
+                continue;
+            }
+            if (state?.companyConfidence === "device_default" && deps.authorizeDeviceDefaultTenant) {
+                await deps.authorizeDeviceDefaultTenant(state);
+                state = readSessionState(sessionId, deps.workContextRoot) ?? state;
+            }
+            if (state?.companyConfidence === "device_default") {
+                summary.held += appendHeldLinesIfAbsent(items.map(item => heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? now().toISOString())), deps.workMeshRoot);
+                for (const item of items)
+                    markDisposed(item.event);
+                continue;
+            }
+            if (isNonCloudCompanySlug(state?.companySlug)) {
+                summary.dropped += items.length;
+                for (const item of items)
+                    markDisposed(item.event);
+                continue;
+            }
             const leaveResult = await postPresenceLeaveIfNeeded({
                 sessionId,
                 items,
@@ -726,7 +757,7 @@ function bindHeldCompanyIfResolved(sessionId, items, state, deps, now, uidCache)
     // Stay synchronous unless a uid lookup is needed: the flush loop's
     // microtask ordering is relied on by retry/back-pressure timing.
     const company = resolveHeldCompany(sessionId, items, state, deps);
-    if (!company)
+    if (!company || isNonCloudCompanySlug(company.slug))
         return state;
     if (company.uid) {
         return writeHeldCompanyBinding(sessionId, state, { uid: company.uid, slug: company.slug, source: company.source }, deps, now);
@@ -996,7 +1027,7 @@ function classifySession(state) {
         state.companyUid === state.ownerMismatch.companyUid) {
         return { action: "drop", reason: "owner_mismatch" };
     }
-    if (state.contextStatus === "needs_company") {
+    if (state.companyConfidence === "device_default" || state.contextStatus === "needs_company") {
         return { action: "hold", heldReason: "NEEDS_COMPANY" };
     }
     if (state.contextStatus === "company_conflict") {

package/dist/lib/mesh/live/reporting-privacy.d.ts

@@ -0,0 +1,7 @@
+/** Match the off controls used by the hook and handoff command. */
+export declare function reportingLocallyDisabled(env?: NodeJS.ProcessEnv): boolean;
+/** Legacy emit must not let the server infer a company for conversation text. */
+export declare function mayEmitConversation(event: Record<string, unknown>, env?: NodeJS.ProcessEnv): boolean;
+/** Fleet identities have no person preference; operator and local controls still apply. */
+export declare function reportingRuntimeAllowed(machine: boolean, env?: NodeJS.ProcessEnv): Promise<boolean>;
+//# sourceMappingURL=reporting-privacy.d.ts.map

package/dist/lib/mesh/live/reporting-privacy.js

@@ -0,0 +1,47 @@
+import { anywhereRuntimeAllowed } from "../../anywhere-person-setting.js";
+import { anywhereRuntimeEnabledFromSnapshot } from "../../anywhere-runtime-fast-flag.js";
+import { hqAnywhereRuntimeLocallyDisabled } from "../../anywhere-runtime-flag-key.js";
+import { isNonCloudCompanySlug } from "../../work-context/company-rebind.js";
+import { readMetaCompanySlug, resolveCompany } from "../../work-context/company.js";
+import { deriveRemoteOwnerSlug, deriveRepoIdentityKey } from "../../work-context/repo-remote.js";
+import { workContextRoot } from "../../work-context/paths.js";
+import { readSessionState } from "../../work-context/state.js";
+/** Match the off controls used by the hook and handoff command. */
+export function reportingLocallyDisabled(env = process.env) {
+    const hooks = (env.HQ_DISABLED_HOOKS ?? "").split(",").map(value => value.trim());
+    return ["1", "true", "TRUE", "yes", "YES", "on", "ON"].includes(env.HQ_WORK_MESH_DISABLED ?? "") ||
+        hooks.some(value => ["*", "work-mesh", "work-mesh-live"].includes(value)) ||
+        hqAnywhereRuntimeLocallyDisabled(env);
+}
+/** Legacy emit must not let the server infer a company for conversation text. */
+export function mayEmitConversation(event, env = process.env) {
+    if (event.kind !== "session_end" && typeof event.summary !== "string")
+        return true;
+    if (typeof event.sessionId !== "string" || !event.sessionId.trim())
+        return false;
+    const evidence = event.evidence && typeof event.evidence === "object"
+        ? event.evidence : {};
+    const text = (key) => typeof evidence[key] === "string" ? evidence[key] : undefined;
+    const root = workContextRoot(undefined, env);
+    const state = readSessionState(event.sessionId, root);
+    const meta = readMetaCompanySlug(event.sessionId, text("hqRoot"));
+    if (isNonCloudCompanySlug(meta) || isNonCloudCompanySlug(state?.companySlug) || isNonCloudCompanySlug(text("companySlug")) ||
+        state?.companyConfidence === "device_default" || state?.contextStatus === "untracked")
+        return false;
+    // The flushing process is not the originating session. Its spawn/company
+    // identity cannot authorize historical conversation text.
+    const resolved = resolveCompany({ root, sessionId: event.sessionId,
+        env: { HQ_AGENT_IDENTITY_FILE: "" },
+        cwd: text("cwd"), hqRoot: text("hqRoot"),
+        remoteOwnerSlug: deriveRemoteOwnerSlug({ cwd: text("cwd"), hqRoot: text("hqRoot") }) ?? undefined,
+        repoIdentityKey: text("cwd") ? deriveRepoIdentityKey({ cwd: text("cwd") }) ?? undefined : undefined,
+        trusted: { companySlug: text("companySlug") }, existingState: state });
+    return resolved.status === "resolved" && !isNonCloudCompanySlug(resolved.company.slug);
+}
+/** Fleet identities have no person preference; operator and local controls still apply. */
+export async function reportingRuntimeAllowed(machine, env = process.env) {
+    if (reportingLocallyDisabled(env))
+        return false;
+    return machine ? anywhereRuntimeEnabledFromSnapshot(env) : anywhereRuntimeAllowed(env);
+}
+//# sourceMappingURL=reporting-privacy.js.map

package/dist/lib/work-context/company.d.ts

@@ -12,11 +12,10 @@
  *   4b. persisted per-repo company map (gap 4 — person "always ask per repo",
  *      remembered by repoIdentityKey; above the git-remote heuristic + device
  *      default, below the identity file so an agent box always wins)
- *   5. enabled device default
- *   6. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
+ *   5. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
  *
  * Prompt-text matching is never used.
- * Device default + conflicting deterministic evidence → company_conflict.
+ * Device defaults never attribute a session; explicit evidence is required.
  */
 import type { TrustedExplicitContext } from "./contract.js";
 import { type SessionStateFile } from "./state.js";

package/dist/lib/work-context/company.js

@@ -12,15 +12,14 @@
  *   4b. persisted per-repo company map (gap 4 — person "always ask per repo",
  *      remembered by repoIdentityKey; above the git-remote heuristic + device
  *      default, below the identity file so an agent box always wins)
- *   5. enabled device default
- *   6. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
+ *   5. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
  *
  * Prompt-text matching is never used.
- * Device default + conflicting deterministic evidence → company_conflict.
+ * Device defaults never attribute a session; explicit evidence is required.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getDefaultCompany, getRepoCompany } from "./config.js";
+import { getRepoCompany } from "./config.js";
 import { authoritativeCompanyFromState, readSessionState, } from "./state.js";
 /** Pointer to the US-017B correction client (never auto-switches). */
 const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
@@ -333,8 +332,7 @@ export function resolveCompany(input) {
             };
         }
     }
-    // 5 + 6. Device default vs deterministic evidence.
-    const deviceDefault = input.allowDeviceDefault === false ? null : getDefaultCompany({ root: input.root });
+    // Membership and device preferences are not session attribution evidence.
     const deterministic = resolveDeterministicCompany({
         cwd: input.cwd,
         hqRoot: input.hqRoot,
@@ -354,22 +352,6 @@ export function resolveCompany(input) {
             evidenceCompany: deterministicConflict.remote,
         };
     }
-    if (deviceDefault?.enabled && deviceDefault.slug) {
-        const def = {
-            slug: deviceDefault.slug,
-            uid: deviceDefault.uid,
-            source: "device_default",
-        };
-        if (deterministic &&
-            !sameCompany(def, deterministic)) {
-            return {
-                status: "company_conflict",
-                defaultCompany: def,
-                evidenceCompany: deterministic,
-            };
-        }
-        return { status: "resolved", company: def };
-    }
     if (deterministic) {
         return { status: "resolved", company: deterministic };
     }

package/dist/secrets-env-action.js

@@ -2,6 +2,7 @@ import chalk from "chalk";
 import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
 import { cognitoCachePrincipalUid } from "./utils/cognito-session.js";
+import { gatedInteractiveLogin } from "./utils/interactive-caller.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntry, writeCache, } from "./utils/secrets-cache.js";
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
@@ -21,10 +22,12 @@ const SECRET_LOAD_TIMEOUT_MS = 30_000;
  * stdin and stderr must be TTYs, and CI is always non-interactive.
  */
 export function secretsCredentialOptions() {
+    // The shared gate also refuses lanes, daemons, bot runtimes, launchd
+    // tasks, and HQ_NO_BROWSER_LOGIN children that happen to hold a TTY.
     return {
-        interactive: process.stdin.isTTY === true &&
+        interactive: gatedInteractiveLogin(process.stdin.isTTY === true &&
             process.stderr.isTTY === true &&
-            !process.env.CI,
+            !process.env.CI),
     };
 }
 export function scopeOpts(opts) {

package/dist/utils/cognito-callback-port.d.ts

@@ -4,6 +4,8 @@ export declare const DEFAULT_COGNITO_CALLBACK_PORT = 8765;
 /** Ports registered as callback URLs on the HQ CLI Cognito app client. */
 export declare const REGISTERED_COGNITO_CALLBACK_PORTS: readonly number[];
 export type PortWarn = (message: string) => void;
+/** Test hook: forget that the stray-port warning was printed. */
+export declare function resetStrayPortWarningForTests(): void;
 /**
  * Resolve a callback port value, a string from the environment or a number,
  * to a registered port. Unset resolves to 8765 silently; an unregistered value

package/dist/utils/cognito-callback-port.js

@@ -11,18 +11,23 @@
 export const DEFAULT_COGNITO_CALLBACK_PORT = 8765;
 /** Ports registered as callback URLs on the HQ CLI Cognito app client. */
 export const REGISTERED_COGNITO_CALLBACK_PORTS = [8765, 3000, 53682];
-const warned = new Set();
+/** One stray-port warning per process: config and session both resolve the env value. */
+let warnedStrayPort = false;
 function defaultWarn(message) {
     console.error(message);
 }
-function warnOnce(key, message, warn) {
+function warnOnce(message, warn) {
     if (warn === defaultWarn) {
-        if (warned.has(key))
+        if (warnedStrayPort)
             return;
-        warned.add(key);
+        warnedStrayPort = true;
     }
     warn(message);
 }
+/** Test hook: forget that the stray-port warning was printed. */
+export function resetStrayPortWarningForTests() {
+    warnedStrayPort = false;
+}
 /**
  * Resolve a callback port value, a string from the environment or a number,
  * to a registered port. Unset resolves to 8765 silently; an unregistered value
@@ -35,7 +40,7 @@ export function resolveCognitoCallbackPort(raw, warn = defaultWarn) {
     const port = typeof raw === "number" ? raw : Number(raw.trim());
     if (REGISTERED_COGNITO_CALLBACK_PORTS.includes(port))
         return port;
-    warnOnce(String(raw), `hq: ignoring callback port ${String(raw)}: it is not a registered Cognito callback ` +
+    warnOnce(`hq: ignoring callback port ${String(raw)}: it is not a registered Cognito callback ` +
         `(${REGISTERED_COGNITO_CALLBACK_PORTS.join(", ")}). Using ${DEFAULT_COGNITO_CALLBACK_PORT}. ` +
         "Unset HQ_COGNITO_CALLBACK_PORT or set it to a registered port.", warn);
     return DEFAULT_COGNITO_CALLBACK_PORT;

package/dist/utils/cognito-config.js

@@ -4,7 +4,12 @@ export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
     clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
-    port: resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT),
+    // Resolved on read, not at module load: main.ts imports this for every
+    // command, and a stray HQ_COGNITO_CALLBACK_PORT should warn only when a
+    // sign-in actually reads the port.
+    get port() {
+        return resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT);
+    },
     identityProvider: process.env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined
         ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
         : "Google",

package/dist/utils/cognito-session.js

@@ -51,7 +51,12 @@ export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
     clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
-    port: resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT),
+    // Resolved on read, not at module load: main.ts imports this for every
+    // command, and a stray HQ_COGNITO_CALLBACK_PORT should warn only when a
+    // sign-in actually reads the port.
+    get port() {
+        return resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT);
+    },
     // Skip Cognito's Hosted UI — go straight to Google OAuth. The Cognito
     // /oauth2/authorize endpoint honors `identity_provider` and performs an
     // internal redirect, so the user never sees the (un-styleable) Hosted UI.

package/dist/utils/interactive-caller.d.ts

@@ -12,4 +12,12 @@ export type InteractiveCallerInput = {
 export declare function nonInteractiveReason(input?: InteractiveCallerInput): string | null;
 /** True only when a person is at a terminal and may complete a browser sign-in. */
 export declare function isInteractiveCaller(input?: InteractiveCallerInput): boolean;
+/**
+ * Gate a call site's request for an implicit browser sign-in. A command that
+ * asks for `interactive: true` gets it only when a person is at a terminal, so
+ * the same command run from a lane, daemon, bot, launchd task, or piped child
+ * fails with the `hq login` remedy instead of opening a sign-in tab. Explicit
+ * `false` stays false. `hq login` calls browserLogin directly and is not gated.
+ */
+export declare function gatedInteractiveLogin(requested?: boolean, input?: InteractiveCallerInput): boolean;
 //# sourceMappingURL=interactive-caller.d.ts.map

package/dist/utils/interactive-caller.js

@@ -67,4 +67,14 @@ export function nonInteractiveReason(input = {}) {
 export function isInteractiveCaller(input = {}) {
     return nonInteractiveReason(input) === null;
 }
+/**
+ * Gate a call site's request for an implicit browser sign-in. A command that
+ * asks for `interactive: true` gets it only when a person is at a terminal, so
+ * the same command run from a lane, daemon, bot, launchd task, or piped child
+ * fails with the `hq login` remedy instead of opening a sign-in tab. Explicit
+ * `false` stays false. `hq login` calls browserLogin directly and is not gated.
+ */
+export function gatedInteractiveLogin(requested = true, input = {}) {
+    return requested && isInteractiveCaller(input);
+}
 //# sourceMappingURL=interactive-caller.js.map

package/dist/utils/login-browser.js

@@ -15,7 +15,8 @@ export async function loginWithBrowserPreference(config, browser = true) {
     if (browser && !isHeadless())
         return browserLogin(withRegisteredCallbackPort(config));
     assertHumanLoginAllowed();
-    const port = config.port ?? 3000;
+    // The manual URL path builds the same redirect_uri, so it needs the same guard.
+    const port = withRegisteredCallbackPort(config).port ?? 3000;
     const redirectUri = `http://localhost:${port}/callback`;
     const base = `https://${config.userPoolDomain}.auth.${config.region}.amazoncognito.com`;
     const verifier = randomBytes(32).toString("base64url");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.199",
+  "version": "5.345.200",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -116,11 +116,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.199",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.199",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.199",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.199",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.199",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.199"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.200",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.200",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.200",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.200",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.200",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.200"
   }
 }