@indigoai-us/hq-cli 5.345.199 → 5.345.201

package/dist/lib/bot/legacy-provider-login.js

@@ -0,0 +1,144 @@
+/**
+ * Is the provider sign-in a legacy Codex or Grok bot needs readable on this
+ * computer, the way HQ Fleet Local imports it (`hq-fleet-local auth login`)?
+ *
+ * - Codex: the Codex CLI login file `<CODEX_HOME>/auth.json` (else
+ *   ~/.codex/auth.json) with a refreshable, unexpired token. A bot with its
+ *   own Codex login (hq bot login) or a capacity account imports from that
+ *   home instead, so the account it answered with comes along.
+ * - Grok: the runtime only copies another Fleet bot's Grok login (its own
+ *   device-code sign-in needs a browser), so the probe asks the helper of
+ *   every other Fleet bot on this computer whether it holds one.
+ *
+ * Nothing here reads, prints or copies a credential value: the Codex check
+ * decodes only the token's expiry claim, and the Grok check asks the helper
+ * for a yes or no.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fleetLocalProviderAuthStatus, listFleetLocalProfiles } from "./fleet-local.js";
+import { botOwnAuthHome, botRuntimeAuth, capacityAccountHome } from "./runtime-auth.js";
+export function codexCliAuthPath(home) {
+    return path.join(home, "auth.json");
+}
+/** The `exp` claim of a JWT, in seconds, or null when the token has none that reads. */
+export function jwtExpiry(token) {
+    const parts = token.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        return typeof claims.exp === "number" && Number.isFinite(claims.exp) ? claims.exp : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Mirrors the runtime's `_import_codex_cli_tokens`: a refreshable, unexpired login in `<home>/auth.json`. */
+export function codexCliLoginReadable(home, now = Date.now()) {
+    const file = codexCliAuthPath(home);
+    if (!fs.existsSync(file))
+        return { readable: false, detail: `no Codex CLI login at ${file}` };
+    let tokens;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8").replace(/^\uFEFF/, ""));
+        tokens = parsed.tokens && typeof parsed.tokens === "object" ? parsed.tokens : undefined;
+    }
+    catch {
+        return { readable: false, detail: `${file} could not be read` };
+    }
+    const access = typeof tokens?.access_token === "string" ? tokens.access_token.trim() : "";
+    const refresh = typeof tokens?.refresh_token === "string" ? tokens.refresh_token.trim() : "";
+    if (!access || !refresh)
+        return { readable: false, detail: `${file} holds no refreshable Codex login` };
+    const exp = jwtExpiry(access);
+    if (exp !== null && exp * 1000 <= now)
+        return { readable: false, detail: `the Codex login at ${file} has expired` };
+    return { readable: true, detail: `Codex CLI login at ${file}` };
+}
+/**
+ * Where a legacy bot's Codex login lives: its own folder, a capacity account,
+ * or the owner's (CODEX_HOME, else ~/.codex). `env` is set when the import
+ * must look somewhere other than the owner's default.
+ */
+export function legacyCodexHome(dir, config, env = process.env, homedir = os.homedir()) {
+    const auth = botRuntimeAuth(config, "codex");
+    if (!auth) {
+        if (config.runtimeAuth?.codex !== undefined)
+            return { error: `${config.name}'s saved codex login setting is not readable` };
+        return { home: env.CODEX_HOME?.trim() || path.join(homedir, ".codex") };
+    }
+    if (auth.mode === "own") {
+        const home = botOwnAuthHome(dir, "codex");
+        return { home, env: { CODEX_HOME: home } };
+    }
+    try {
+        const home = capacityAccountHome(config.hqRoot, "codex", auth.account);
+        return { home, env: { CODEX_HOME: home } };
+    }
+    catch (err) {
+        return { error: err instanceof Error ? err.message : String(err) };
+    }
+}
+/** The helper asks the keychain per profile, so one list of bots shares a scan this long. */
+export const GROK_HOLDER_SCAN_TTL_MS = 30_000;
+let grokHolderScan = null;
+export function resetGrokHolderScan() {
+    grokHolderScan = null;
+}
+/** Every Fleet bot here with a Grok OAuth login, scanned at most once per TTL in this process (live deps are never cached). */
+function grokHolders(deps, now) {
+    const live = !deps.profiles && !deps.status;
+    if (live && grokHolderScan && now - grokHolderScan.at < GROK_HOLDER_SCAN_TTL_MS)
+        return grokHolderScan;
+    const profiles = (deps.profiles ?? listFleetLocalProfiles)();
+    const status = deps.status ?? ((agentUid) => fleetLocalProviderAuthStatus(agentUid, "xai-oauth"));
+    const holders = [];
+    const unanswered = [];
+    for (const profile of profiles) {
+        const found = status(profile.agentUid);
+        if (found === null)
+            unanswered.push(profile.agentUid);
+        else if (found.authenticated && found.authType === "oauth")
+            holders.push(profile.agentUid);
+    }
+    const scan = { at: now, holders, uids: profiles.map((profile) => profile.agentUid), unanswered };
+    // A scan that found nothing or got no answer may be a passing failure: ask again next time.
+    if (live && profiles.length > 0 && unanswered.length < profiles.length)
+        grokHolderScan = scan;
+    return scan;
+}
+/** Mirrors the helper's `_existing_machine_oauth`: another Fleet bot here holds a Grok OAuth login. */
+export function grokLoginReadableHere(exclude, deps = {}, now = Date.now()) {
+    const scan = grokHolders(deps, now);
+    const other = (agentUid) => agentUid.toLowerCase() !== exclude.toLowerCase();
+    const holder = scan.holders.find(other);
+    if (holder)
+        return { readable: true, detail: `the Grok sign-in of HQ Fleet bot ${holder} on this computer` };
+    const others = scan.uids.filter(other);
+    const unanswered = scan.unanswered.filter(other);
+    if (others.length && unanswered.length === others.length) {
+        return { readable: false, detail: `the HQ Fleet helper could not say whether any of the ${others.length} other Fleet bot(s) on this computer is signed in to Grok` };
+    }
+    return {
+        readable: false,
+        detail: others.length ? `none of the ${others.length} other HQ Fleet bot(s) on this computer is signed in to Grok` : "no other HQ Fleet bot on this computer is signed in to Grok",
+    };
+}
+/** The live probe for a bot: Codex from its login home, Grok from the other Fleet bots here. */
+export function legacyProviderLoginProbe(dir, config) {
+    return (runtime) => {
+        if (runtime === "grok") {
+            if (config.runtimeAuth?.grok !== undefined)
+                return { readable: false, detail: "it uses its own Grok login, which HQ Fleet Local cannot import" };
+            return grokLoginReadableHere(config.agentUid);
+        }
+        const home = legacyCodexHome(dir, config);
+        if ("error" in home)
+            return { readable: false, detail: home.error };
+        const login = codexCliLoginReadable(home.home);
+        return home.env && login.readable ? { ...login, env: home.env } : login;
+    };
+}
+//# sourceMappingURL=legacy-provider-login.js.map

package/dist/lib/bot/run.js

@@ -1,3 +1,4 @@
+import { createSourceReporter, ensureSourceReportJobs, SOURCE_REPORT_JOB_KIND } from "./jobs/source-report.js";
 import { ensureSignalToLaneJobs, runSignalToLane, SIGNAL_TO_LANE_JOB_KIND } from "./jobs/signal-to-lane.js";
 /**
  * The resident bot process: `hq bot run <name>` (local-bots US-003/US-004).
@@ -424,7 +425,13 @@ export async function runBot(deps) {
     const meetingRider = createMeetingRider(defaultMeetingRiderDeps(config, dir, (message) => log("info", message)));
     const meetingDetectDeps = defaultMeetingDetectDeps(config, dir, (message) => log("info", message));
     const meetingDetect = createMeetingDetect(meetingDetectDeps);
+    const sourceReporter = createSourceReporter({ config, api, now, botsDir: path.dirname(dir) });
     const eventHandlers = Object.create(builtinEventHandlers);
+    eventHandlers[SOURCE_REPORT_JOB_KIND] = async ({ item }) => {
+        const context = typeof item.context === "object" ? item.context : undefined;
+        const event = context?.event;
+        return sourceReporter.handle(event?.event, context?.payload, context?.company);
+    };
     eventHandlers[MEETING_RIDER_JOB_KIND] = async ({ item }) => {
         if (!isExecutiveBot(config))
             return { status: "skipped-precondition", output: "Not the Executive" };
@@ -2060,7 +2067,7 @@ export async function runBot(deps) {
         if (eventHandler) {
             // Recoverable built-ins persist intent before acknowledging the event.
             // Signal lane creation is idempotent, so a pre-ack crash can replay.
-            const durableEvent = typeof job.context === "object" && (job.context?.jobKind === MEETING_RIDER_JOB_KIND || job.context?.jobKind === SIGNAL_TO_LANE_JOB_KIND);
+            const durableEvent = typeof job.context === "object" && (job.context?.jobKind === SOURCE_REPORT_JOB_KIND || job.context?.jobKind === MEETING_RIDER_JOB_KIND || job.context?.jobKind === SIGNAL_TO_LANE_JOB_KIND);
             if (!durableEvent)
                 markProcessed(dir, id, now().toISOString());
             let completion;
@@ -2884,6 +2891,12 @@ export async function runBot(deps) {
     // up below: end here, before the kickoff can send a "needs a sign-in" DM.
     if (stopping)
         return await stoppedDuringStartup();
+    try {
+        ensureSourceReportJobs(dir, config);
+    }
+    catch {
+        log("warn", "Source report registration failed");
+    }
     try {
         ensureSignalToLaneJobs(dir, config);
     }
@@ -3016,6 +3029,12 @@ export async function runBot(deps) {
             // A failed signals run's automatic retry, once due (no model turn).
             enqueueDueSignalsRetries();
             if (isExecutiveBot(config)) {
+                try {
+                    await sourceReporter.recover();
+                }
+                catch {
+                    log("warn", "Source report recovery deferred");
+                }
                 try {
                     meetingDetect.tick();
                 }

package/dist/lib/doctor/checks/bots.d.ts

@@ -1,5 +1,7 @@
+import { type BotConfig } from "../../bot/config.js";
 import { type ClaudeLoginCheck } from "../../bot/claude-login.js";
 import { type BotStatusFile } from "../../bot/status.js";
+import { type LegacyMoveState } from "../../bot/legacy-convert.js";
 import { type NodeBinaryIo } from "../../node-binary.js";
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 export declare const BOTS_FAMILY_ID = "bots";
@@ -11,6 +13,8 @@ export interface BotsDoctorDeps {
     nodeIo?: NodeBinaryIo;
     /** The Claude Code login read the way the HQ Fleet Runtime reads it (tests). */
     claudeLogin?: () => ClaudeLoginCheck;
+    /** Whether and why a legacy bot moves to the HQ Fleet Runtime at its next start (tests). */
+    legacyMove?: (dir: string, config: BotConfig) => LegacyMoveState;
 }
 /** The last reported failure, unless a later turn worked. */
 export declare function unresolvedLastFailure(status: BotStatusFile | null): BotStatusFile["lastFailure"] | null;

package/dist/lib/doctor/checks/bots.js

@@ -10,10 +10,39 @@ import { botsRoot, botDir, launchdLabel } from "../../bot/paths.js";
 import { HQ_FLEET_RUNTIME_ENGINE_ID, readBotConfig } from "../../bot/config.js";
 import { checkClaudeCodeLogin, claudeLoginFix, describeClaudeLoginSources, } from "../../bot/claude-login.js";
 import { isPidAlive, readBotStatus } from "../../bot/status.js";
+import { legacyMoveState } from "../../bot/legacy-convert.js";
+import { legacyProviderLoginProbe } from "../../bot/legacy-provider-login.js";
+import { runtimeDisplayName } from "../../bot/runtime-sign-in.js";
 import { nodeBinaryProblem } from "../../node-binary.js";
 import { launchdPlistProgramArguments, parseLaunchdCommand } from "../../service-manager/launchd.js";
 export const BOTS_FAMILY_ID = "bots";
 export const BOTS_FAMILY_TITLE = "Local bots";
+function isLegacyBot(config) {
+    return config.engine?.id !== HQ_FLEET_RUNTIME_ENGINE_ID;
+}
+/** A bot still on its legacy runner: one WARN when it moves at its next start, one FAIL when it is held. */
+function legacyRuntimeCheck(name, dir, config, state) {
+    const tool = runtimeDisplayName(config.runtime);
+    const failure = state.lastFailure;
+    const lastMove = failure ? ` Its last move failed at ${failure.at}${failure.step ? ` (could not ${failure.step})` : ""}${failure.error ? `: ${failure.error}` : ""}.` : "";
+    if (state.decision.convert) {
+        return {
+            status: "WARN",
+            checkId: `bots.${name}.legacy-runtime`,
+            target: dir,
+            message: `${name} still runs on its older ${tool} runner and moves to the HQ Fleet Runtime at its next start.${lastMove}`,
+            remediation: `hq bot start ${name}`,
+        };
+    }
+    return {
+        // The env opt-out is the owner's choice (and read from this shell, not the bot's); a sign-in hold is a bot that cannot work.
+        status: state.decision.reason === "kept-by-env" ? "WARN" : "FAIL",
+        checkId: `bots.${name}.legacy-runtime`,
+        target: dir,
+        message: `${name} still runs on its older ${tool} runner (${state.decision.reason}): ${state.notice?.cause ?? state.decision.detail}${lastMove}`,
+        remediation: `${state.notice?.fix ?? ""} Details: hq bot status ${name}`.trim(),
+    };
+}
 const DEFAULT_DEPS = {
     home: () => os.homedir(),
     root: (home) => botsRoot(home ?? os.homedir()),
@@ -89,6 +118,10 @@ function runChecks(deps) {
             continue;
         const status = readBotStatus(dir);
         const alive = !!status && status.state === "running" && isPidAlive(status.pid);
+        if (isLegacyBot(config)) {
+            const state = (deps.legacyMove ?? ((d, c) => legacyMoveState(d, c, legacyProviderLoginProbe(d, c))))(dir, config);
+            results.push(legacyRuntimeCheck(name, dir, config, state));
+        }
         if (isClaudeFleetBot(config)) {
             claudeLogin ??= (deps.claudeLogin ?? (() => checkClaudeCodeLogin({ home })))();
             if (claudeLogin.signedIn) {

package/dist/lib/lanes/mesh-events.js

@@ -45,6 +45,7 @@
 import { appendThreadEvent, clamp, ensureLaneMeshThread, ensureProjectThread, getProjectView, patchStoryStatus, putProjectView, requireToken, registerMeshProject, resolveMeshCompany, } from "../mesh/api.js";
 import { LanesError } from "./errors.js";
 import { terminalEnvelopeStoryStatus } from "./stories.js";
+import { gatedInteractiveLogin } from "../../utils/interactive-caller.js";
 export const LANE_MESH_EVENTS = [
     "lane_started",
     "lane_progress",
@@ -309,7 +310,8 @@ async function repairProjectView(input) {
 }
 export function createLaneMesh(opts = {}) {
     const interactive = opts.interactive ?? true;
-    const token = opts.token ?? (() => requireToken({ interactive }));
+    // Gated per call: the same mesh can serve a terminal and a detached watcher.
+    const token = opts.token ?? (() => requireToken({ interactive: gatedInteractiveLogin(interactive) }));
     const repair = opts.repairProjectView ?? repairProjectView;
     return {
         async ensureProjectThread(company, projectId) {

package/dist/lib/lanes/store.js

@@ -495,6 +495,9 @@ export function parseLaneRecord(raw, filePath) {
     const schema_version = requireString(raw.schema_version, "schema_version");
     parseMajorSchema(schema_version, "hq-lane", 1);
     requireString(raw.lane_id, "lane_id");
+    if (raw.source_report_pending !== undefined && typeof raw.source_report_pending !== "boolean") {
+        throw new LaneSchemaError("source_report_pending must be boolean", { field: "source_report_pending" });
+    }
     if (raw.signal !== undefined) {
         if (!raw.signal || typeof raw.signal !== "object" || Array.isArray(raw.signal)) {
             throw new LaneSchemaError("signal must be an object", { field: "signal" });
@@ -1818,6 +1821,10 @@ export function updateLane(hqRoot, laneId, expectedVersion, writer, updater, dep
             }
         }
         if (!isTerminalLaneState(current.state) && isTerminalLaneState(updated.state)) {
+            // Couple the report-event intent to the terminal commit. The resident
+            // Executive can publish it even if the watcher dies before appending.
+            if (updated.signal && updated.company)
+                updated.source_report_pending = true;
             const releasedGrant = updated.hire_grant ?? current.hire_grant ?? 0;
             return withoutStaleQueuedDetails({
                 ...updated,

package/dist/lib/lanes/types.d.ts

@@ -654,6 +654,8 @@ export interface LaneSignal {
 export interface LaneRecord {
     signal?: LaneSignal;
     signal_link?: string;
+    /** Event outbox bit, persisted atomically with a signaled lane's terminal transition. */
+    source_report_pending?: boolean;
     schema_version: typeof LANE_SCHEMA_VERSION | string;
     lane_id: string;
     /** CLI release that most recently wrote this lane record. Absent on legacy rows. */

package/dist/lib/lanes/types.js

@@ -255,6 +255,7 @@ export const LANE_WRITERS = ["creator", "command", "watcher", "reconcile", "spaw
 /** Field ownership at the durable-record mutation boundary (spec §10.1). */
 export const LANE_FIELD_WRITERS = {
     signal: ["creator"], signal_link: ["creator"],
+    source_report_pending: ["watcher"],
     schema_version: ["creator"], lane_id: ["creator"], written_by_version: [], owner_written_by_version: [], company: ["creator", "command"], company_history: ["command"],
     project_id: ["command"], story_id: ["command"], no_story_reason: ["creator", "command"], focus_overrides: ["command"], ledger_sync_error: ["story-ledger"], pending_question_ids: ["story-ledger"], stories: ["creator", "command", "watcher", "reconcile", "spawn"], thread_id: ["creator", "command", "spawn"], mesh_company: ["creator", "command"],
     depth: ["command"], senior: ["command"], senior_history: ["command"],

package/dist/lib/lanes/watcher.d.ts

@@ -1,36 +1,3 @@
-/**
- * Per-lane watcher (spec §5.7).
- *
- * Armed at spawn, detached from the caller. Emits on progress, terminal, and
- * silence (20 minutes with the process still alive). Terminal classification
- * follows spec §5: an envelope decides done/ask/blocked; a process that exits
- * with partial output and no envelope is `interrupted`; silence is never
- * success.
- *
- * Progress has two sources. Output files (worker.out, worker.err,
- * last-message.txt) cover codex and grok, which stream as they work. They do
- * not cover Claude: `claude -p --output-format json` writes nothing until it
- * exits, so a healthy Claude lane used to hit the silence deadline at exactly
- * 20 minutes every time, and a hung one looked identical. The second source
- * is logs/tool-activity.json, which the drain hook rewrites on every
- * PreToolUse call (dropbox.ts). A worker that is working calls tools; a
- * worker that has not called a tool or written output for the whole window
- * is `stalled`, and the watcher says so on the lane record.
- *
- * What this cannot tell apart: a worker hung inside one tool call from a
- * worker running one legitimately long tool call (a 25-minute build); a
- * worker looping on tool calls without making progress from a working one;
- * a model stuck mid-generation with no tool call from one that is writing a
- * long answer. It also depends on the drain hook being registered in the
- * provider home (hooks-install.ts): with no hook there is no touch, and the
- * lane reads as stalled every window, which is the pre-existing behaviour.
- * Distinguishing a hung tool from a slow one needs the provider to report
- * per-call state, which none of the three CLIs expose today. `stalled` is
- * therefore a flag for the senior to look at, never a kill.
- *
- * Queue admission of the next lane when a slot frees is owned by the
- * periodic reconcile pass and is out of scope here.
- */
 import { ENVELOPE_INVALID_REASON, type LaneEnvelope, type LaneCompanyRef, type LaneRecord, type LaneState } from "./types.js";
 import { type QuotaSignal } from "./quota.js";
 import { type ProviderRejection } from "./provider-rejection.js";

package/dist/lib/lanes/watcher.js

@@ -1,3 +1,4 @@
+import { emitExecutiveLaneFinished } from "../bot/jobs/source-report.js";
 /**
  * Per-lane watcher (spec §5.7).
  *
@@ -561,6 +562,12 @@ function applyTerminalToLaneWithResult(hqRoot, laneId, classification, opts = {}
         updated.model) {
         clearAccountQuotaAfterSuccessfulTurnBestEffort(hqRoot, updated.provider, updated.account, updated.model, new Date(at));
     }
+    try {
+        emitExecutiveLaneFinished(hqRoot, updated);
+    }
+    catch (error) {
+        process.stderr.write(`hq lanes watcher: source report event failed: ${error instanceof Error ? error.message : String(error)}\n`);
+    }
     notifySlotFreed({
         hqRoot,
         provider: updated.provider,

package/dist/lib/mesh/api.js

@@ -9,6 +9,7 @@ import { ensureCognitoToken, isMachineIdentity } from "../../utils/cognito-sessi
 import { peekIdToken } from "../../utils/id-token.js";
 import { getCompanyUid, vaultApiFetch } from "../../utils/vault-api.js";
 import { meshCacheRoot, removeSessionFallbackFiles, writeMeshCacheFile, } from "./cache.js";
+import { gatedInteractiveLogin } from "../../utils/interactive-caller.js";
 const PRINCIPAL_UID = /^(prs|agt)_/;
 export const STORY_STATUSES = new Set([
     "queued",
@@ -183,7 +184,7 @@ export async function requireToken(opts = {}) {
     // hard policy indigo-agent-caller-resolution-id-token, agent claims ride
     // the ID token only; the server is correct to require it. Humans keep the
     // person access token (unchanged).
-    const interactive = opts.interactive ?? true;
+    const interactive = gatedInteractiveLogin(opts.interactive ?? true);
     if (isMachineIdentity()) {
         return ensureCognitoToken({ tokenSource: "machine", interactive });
     }

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -1,13 +1,3 @@
-/**
- * hq mesh daemon run — single-instance resident process.
- *
- * - pid lock at ~/.hq/work-mesh/daemon/pid
- * - fs.watch spool + 2s debounce; flush at least every 10s (US-008 path)
- * - replay context outbox
- * - board.md refresh for bound sessions ≤ every 60s
- * - MQTT presence (contract-3)
- * - SIGTERM/SIGINT: flush once more, MQTT DISCONNECT (server derives offline), exit
- */
 import { type DeliverFn } from "../../../work-context/outbox.js";
 import { type SessionEventsPoster } from "../session-events-client.js";
 import { type FlushSummary } from "../flush.js";

package/dist/lib/mesh/live/daemon/run.js

@@ -1,3 +1,4 @@
+import { reportingRuntimeAllowed } from "../reporting-privacy.js";
 /**
  * hq mesh daemon run — single-instance resident process.
  *
@@ -380,6 +381,8 @@ export async function runMeshDaemon(deps = {}) {
                 baseUrl: resolveVaultApiBase(env),
             });
             return flushSessionEvents({
+                env,
+                reportingAllowed: () => reportingRuntimeAllowed(machineIdentity, env),
                 workMeshRoot: meshRoot,
                 workContextRoot: ctxRoot,
                 poster,

package/dist/lib/mesh/live/emit.d.ts

@@ -1,14 +1,3 @@
-/**
- * Direct-emit orchestration (owner decision 2026-09-08). One invocation:
- *   1. drains the local retry file (prior failures),
- *   2. appends the new event(s),
- *   3. POSTs /v1/mesh/events in batches with a short bounded retry,
- *   4. keeps only network/5xx/429-failed or unaccounted events for next time,
- *   5. records lastPostAt + per-event status counts for `hq mesh doctor`.
- *
- * accepted / unassigned / rejected are all terminal (rejected is dropped with a
- * count — never re-posted). No long-lived process, spool, or held queue.
- */
 import { type EmitPoster, type EmitEventStatus } from "./emit-client.js";
 import { type RandomFn, type SleepFn } from "./backoff.js";
 export interface EmitStateFile {
@@ -23,6 +12,8 @@ export interface EmitStateFile {
 export declare function emitStatePath(workMeshRoot: string): string;
 export declare function readEmitState(workMeshRoot: string): EmitStateFile | null;
 export interface EmitEventsDeps {
+    env?: NodeJS.ProcessEnv;
+    reportingAllowed?: () => Promise<boolean>;
     workMeshRoot: string;
     poster: EmitPoster;
     /** New events to emit this invocation (may be empty — just drain retry). */

package/dist/lib/mesh/live/emit.js

@@ -1,3 +1,4 @@
+import { reportingLocallyDisabled, mayEmitConversation } from "./reporting-privacy.js";
 /**
  * Direct-emit orchestration (owner decision 2026-09-08). One invocation:
  *   1. drains the local retry file (prior failures),
@@ -90,10 +91,27 @@ export async function emitEvents(deps) {
         statuses: { accepted: 0, unassigned: 0, rejected: 0 },
         rejections: [],
     };
+    const env = deps.env ?? process.env;
+    if (reportingLocallyDisabled(env) || (deps.reportingAllowed && !(await deps.reportingAllowed()))) {
+        const written = writeEmitRetry(deps.workMeshRoot, combined, retryMax);
+        return { ...summary, attempted: 0, retained: written.written,
+            retryDepth: written.written, droppedOverflow: written.dropped };
+    }
+    const allowed = combined.filter(event => {
+        if (mayEmitConversation(event, env))
+            return true;
+        summary.rejected += 1;
+        summary.statuses.rejected += 1;
+        const eventId = eventIdOf(event);
+        if (eventId)
+            summary.rejections.push({ eventId, code: "PERSONAL_OR_UNATTRIBUTED" });
+        return false;
+    });
+    summary.attempted = allowed.length;
     const keep = [];
     let anyPosted = false;
-    for (let i = 0; i < combined.length; i += MESH_EVENTS_BATCH_MAX) {
-        const chunk = combined.slice(i, i + MESH_EVENTS_BATCH_MAX);
+    for (let i = 0; i < allowed.length; i += MESH_EVENTS_BATCH_MAX) {
+        const chunk = allowed.slice(i, i + MESH_EVENTS_BATCH_MAX);
         summary.batches += 1;
         let result = await deps.poster(chunk);
         for (let attempt = 1; attempt < maxAttempts && !result.ok && result.retryable; attempt += 1) {

package/dist/lib/mesh/live/flush.d.ts

@@ -24,6 +24,8 @@ export declare const HELD_MAX_LINES = 20000;
 export declare const PROJECT_REBIND_INTERVAL_MS = 60000;
 export type HeldReason = "STATE_ABSENT" | "NEEDS_COMPANY" | "COMPANY_CONFLICT" | "NEEDS_PROJECT" | "HELD_EXPIRED" | "HELD_OVERFLOW";
 export interface FlushDeps {
+    /** Production callers re-read the shared person preference before each flush. */
+    reportingAllowed?: () => Promise<boolean>;
     workMeshRoot: string;
     workContextRoot: string;
     poster: SessionEventsPoster;

package/dist/lib/mesh/live/flush.js

@@ -9,9 +9,10 @@
  * 2xx responses are accounted per eventId (accepted / duplicates / rejected).
  */
 import * as fs from "node:fs";
+import { reportingLocallyDisabled } from "./reporting-privacy.js";
 import * as path from "node:path";
 import { readMetaCompanySlug, resolveCompany } from "../../work-context/company.js";
-import { companyBindingChanged, reboundSessionProjection, } from "../../work-context/company-rebind.js";
+import { companyBindingChanged, isNonCloudCompanySlug, reboundSessionProjection, } from "../../work-context/company-rebind.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
 import { rebindNeedsProjectOnPrompt } from "../../work-context/prompt-rebind.js";
 import { readSessionState, updateSessionState, writeSessionState } from "../../work-context/state.js";
@@ -172,6 +173,12 @@ async function postBatchWithRetries(poster, body, deps) {
  * Recovers orphan `*.claimed` files first; restores unprocessed lines on throw.
  */
 export async function flushSessionEvents(inputDeps) {
+    const env = inputDeps.env ?? process.env;
+    if (reportingLocallyDisabled(env) ||
+        (inputDeps.reportingAllowed && !(await inputDeps.reportingAllowed()))) {
+        return { claimed: 0, posted: 0, held: 0, dropped: 0, deadLettered: 0,
+            restored: 0, batches: 0, heldClaimed: false, heldOverflow: 0 };
+    }
     // One resolver per flush: git lookups are cached per cwd for this flush only.
     const deps = {
         ...inputDeps,
@@ -268,6 +275,30 @@ export async function flushSessionEvents(inputDeps) {
                 break sessionLoop;
             let state = readSessionState(sessionId, deps.workContextRoot);
             state = applySessionMetaCompanyRebind(sessionId, items, state, deps, now);
+            // Personal is the documented non-cloud scope, even if an old projection
+            // still contains a company UID or a pending presence leave.
+            if (isNonCloudCompanySlug(state?.companySlug) || items.some(item => isNonCloudCompanySlug(eventText(item.event, "companySlug")))) {
+                summary.dropped += items.length;
+                for (const item of items)
+                    markDisposed(item.event);
+                continue;
+            }
+            if (state?.companyConfidence === "device_default" && deps.authorizeDeviceDefaultTenant) {
+                await deps.authorizeDeviceDefaultTenant(state);
+                state = readSessionState(sessionId, deps.workContextRoot) ?? state;
+            }
+            if (state?.companyConfidence === "device_default") {
+                summary.held += appendHeldLinesIfAbsent(items.map(item => heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? now().toISOString())), deps.workMeshRoot);
+                for (const item of items)
+                    markDisposed(item.event);
+                continue;
+            }
+            if (isNonCloudCompanySlug(state?.companySlug)) {
+                summary.dropped += items.length;
+                for (const item of items)
+                    markDisposed(item.event);
+                continue;
+            }
             const leaveResult = await postPresenceLeaveIfNeeded({
                 sessionId,
                 items,
@@ -726,7 +757,7 @@ function bindHeldCompanyIfResolved(sessionId, items, state, deps, now, uidCache)
     // Stay synchronous unless a uid lookup is needed: the flush loop's
     // microtask ordering is relied on by retry/back-pressure timing.
     const company = resolveHeldCompany(sessionId, items, state, deps);
-    if (!company)
+    if (!company || isNonCloudCompanySlug(company.slug))
         return state;
     if (company.uid) {
         return writeHeldCompanyBinding(sessionId, state, { uid: company.uid, slug: company.slug, source: company.source }, deps, now);
@@ -996,7 +1027,7 @@ function classifySession(state) {
         state.companyUid === state.ownerMismatch.companyUid) {
         return { action: "drop", reason: "owner_mismatch" };
     }
-    if (state.contextStatus === "needs_company") {
+    if (state.companyConfidence === "device_default" || state.contextStatus === "needs_company") {
         return { action: "hold", heldReason: "NEEDS_COMPANY" };
     }
     if (state.contextStatus === "company_conflict") {

package/dist/lib/mesh/live/reporting-privacy.d.ts

@@ -0,0 +1,7 @@
+/** Match the off controls used by the hook and handoff command. */
+export declare function reportingLocallyDisabled(env?: NodeJS.ProcessEnv): boolean;
+/** Legacy emit must not let the server infer a company for conversation text. */
+export declare function mayEmitConversation(event: Record<string, unknown>, env?: NodeJS.ProcessEnv): boolean;
+/** Fleet identities have no person preference; operator and local controls still apply. */
+export declare function reportingRuntimeAllowed(machine: boolean, env?: NodeJS.ProcessEnv): Promise<boolean>;
+//# sourceMappingURL=reporting-privacy.d.ts.map

package/dist/lib/mesh/live/reporting-privacy.js

@@ -0,0 +1,47 @@
+import { anywhereRuntimeAllowed } from "../../anywhere-person-setting.js";
+import { anywhereRuntimeEnabledFromSnapshot } from "../../anywhere-runtime-fast-flag.js";
+import { hqAnywhereRuntimeLocallyDisabled } from "../../anywhere-runtime-flag-key.js";
+import { isNonCloudCompanySlug } from "../../work-context/company-rebind.js";
+import { readMetaCompanySlug, resolveCompany } from "../../work-context/company.js";
+import { deriveRemoteOwnerSlug, deriveRepoIdentityKey } from "../../work-context/repo-remote.js";
+import { workContextRoot } from "../../work-context/paths.js";
+import { readSessionState } from "../../work-context/state.js";
+/** Match the off controls used by the hook and handoff command. */
+export function reportingLocallyDisabled(env = process.env) {
+    const hooks = (env.HQ_DISABLED_HOOKS ?? "").split(",").map(value => value.trim());
+    return ["1", "true", "TRUE", "yes", "YES", "on", "ON"].includes(env.HQ_WORK_MESH_DISABLED ?? "") ||
+        hooks.some(value => ["*", "work-mesh", "work-mesh-live"].includes(value)) ||
+        hqAnywhereRuntimeLocallyDisabled(env);
+}
+/** Legacy emit must not let the server infer a company for conversation text. */
+export function mayEmitConversation(event, env = process.env) {
+    if (event.kind !== "session_end" && typeof event.summary !== "string")
+        return true;
+    if (typeof event.sessionId !== "string" || !event.sessionId.trim())
+        return false;
+    const evidence = event.evidence && typeof event.evidence === "object"
+        ? event.evidence : {};
+    const text = (key) => typeof evidence[key] === "string" ? evidence[key] : undefined;
+    const root = workContextRoot(undefined, env);
+    const state = readSessionState(event.sessionId, root);
+    const meta = readMetaCompanySlug(event.sessionId, text("hqRoot"));
+    if (isNonCloudCompanySlug(meta) || isNonCloudCompanySlug(state?.companySlug) || isNonCloudCompanySlug(text("companySlug")) ||
+        state?.companyConfidence === "device_default" || state?.contextStatus === "untracked")
+        return false;
+    // The flushing process is not the originating session. Its spawn/company
+    // identity cannot authorize historical conversation text.
+    const resolved = resolveCompany({ root, sessionId: event.sessionId,
+        env: { HQ_AGENT_IDENTITY_FILE: "" },
+        cwd: text("cwd"), hqRoot: text("hqRoot"),
+        remoteOwnerSlug: deriveRemoteOwnerSlug({ cwd: text("cwd"), hqRoot: text("hqRoot") }) ?? undefined,
+        repoIdentityKey: text("cwd") ? deriveRepoIdentityKey({ cwd: text("cwd") }) ?? undefined : undefined,
+        trusted: { companySlug: text("companySlug") }, existingState: state });
+    return resolved.status === "resolved" && !isNonCloudCompanySlug(resolved.company.slug);
+}
+/** Fleet identities have no person preference; operator and local controls still apply. */
+export async function reportingRuntimeAllowed(machine, env = process.env) {
+    if (reportingLocallyDisabled(env))
+        return false;
+    return machine ? anywhereRuntimeEnabledFromSnapshot(env) : anywhereRuntimeAllowed(env);
+}
+//# sourceMappingURL=reporting-privacy.js.map

package/dist/lib/work-context/company.d.ts

@@ -12,11 +12,10 @@
  *   4b. persisted per-repo company map (gap 4 — person "always ask per repo",
  *      remembered by repoIdentityKey; above the git-remote heuristic + device
  *      default, below the identity file so an agent box always wins)
- *   5. enabled device default
- *   6. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
+ *   5. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
  *
  * Prompt-text matching is never used.
- * Device default + conflicting deterministic evidence → company_conflict.
+ * Device defaults never attribute a session; explicit evidence is required.
  */
 import type { TrustedExplicitContext } from "./contract.js";
 import { type SessionStateFile } from "./state.js";