@indigoai-us/hq-cli 5.345.46 → 5.345.48

package/dist/commands/install-global.js

@@ -27,6 +27,7 @@ import { trustCodexUserHooks } from '../utils/hook-trust.js';
 import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK, SYSTEM_UNIT_DIR } from '../lib/daemon/install.js';
 import { readDaemonConfig } from '../lib/daemon/config.js';
 import { daemonPaths } from '../lib/daemon/paths.js';
+import { assertProviderWrappersInstallable, installProviderWrappers, providerWrapperInstallPaths, removeProviderWrappers } from '../lib/install/provider-wrappers.js';
 import { addAgentsMdBlock, addCodexHooks, classifyLegacySkills, codexAdapterPath, codexCharterSource, codexHookTrustKeys, codexTargets, hasAllCodexHooks, HQ_OWNED_MARKER, LEGACY_BACKUP_NAME, LEGACY_SKILLS_NAME, removeAgentsMdBlock, removeCodexHooks, } from '../lib/install/codex-targets.js';
 import { addClaudeMdBlock, addHqHooks, charterPath, claudeTargets, hasAllHqHooks, HQ_ANYWHERE_PACK, HQ_MCP_SERVER_NAME, hqSkillsSource, lineDiff, masterHookPath, shimPath, MCP_SUBPROCESS_PATH, removeClaudeMdBlock, removeHqHooks, SKILL_LINK_PREFIX, } from '../lib/install/claude-targets.js';
 /** True when an hq daemon unit (launchd plist or systemd unit) exists. */
@@ -348,7 +349,14 @@ export function installGlobalClaude(opts) {
     const env = opts.env ?? process.env;
     const log = opts.log ?? ((l) => console.log(l));
     const hqRoot = opts.hqRoot;
+    const providerBin = path.join(home, '.hq', 'bin');
+    // The wrappers are /bin/sh scripts reached through POSIX startup files, so a
+    // Windows shell would never pick them up. Skip them until a native shim exists.
+    const providerWrappersEnabled = process.platform !== 'win32'
+        && (opts.installProviderWrappers ?? isAnywhereEnabled(home, env));
     assertHqRoot(hqRoot);
+    if (providerWrappersEnabled)
+        assertProviderWrappersInstallable(providerBin);
     const t = claudeTargets(home);
     const prior = readState(t);
     const pluginSource = opts.via === 'plugin' ? resolveClaudePluginSource(opts.marketplaceDir, env, opts.marketplaceRepository) : undefined;
@@ -429,6 +437,8 @@ export function installGlobalClaude(opts) {
     if (pluginSource)
         touched.push(t.settingsJson);
     touched.push(regFile, t.stateFile);
+    if (providerWrappersEnabled)
+        touched.push(...providerWrapperInstallPaths(home));
     if (opts.dryRun) {
         log(`hq install --global --runtime claude --dry-run (HQ root ${hqRoot})`);
         log('Would write:');
@@ -560,6 +570,8 @@ export function installGlobalClaude(opts) {
         seeded: [...new Set([...(prior?.seeded ?? []), ...ownedSeeded])].sort(),
     };
     writeFileAtomic(t.stateFile, `${JSON.stringify(state, null, 2)}\n`);
+    if (providerWrappersEnabled)
+        installProviderWrappers(providerBin, home);
     log(`HQ installed for Claude Code from ${hqRoot}.`);
     log(`  skills linked: ${skills.link.length} new, ${skills.already.length} already present, ${skills.skipped.length} skipped`);
     reportSkippedSkills(skills, log, false);
@@ -634,6 +646,9 @@ export function uninstallGlobalClaude(opts = {}) {
     }
     const pointer = readOrNull(t.hqPointer);
     const codexStillInstalled = fs.existsSync(codexTargets(home).stateFile);
+    const providerBin = path.join(home, '.hq', 'bin');
+    if (!codexStillInstalled)
+        touched.push(path.join(providerBin, 'claude'), path.join(providerBin, 'codex'));
     const pointerOwned = !codexStillInstalled && pointer !== null && pointer.trim() === hqRoot;
     if (pointerOwned)
         touched.push(t.hqPointer);
@@ -656,6 +671,8 @@ export function uninstallGlobalClaude(opts = {}) {
     if (pluginSource && state?.plugin?.marketplaceAdded) {
         runClaude(['marketplace', 'remove', '--scope', 'user', pluginSource.marketplaceName], home, env);
     }
+    if (!codexStillInstalled)
+        removeProviderWrappers(providerBin);
     unregisterClaudeServer({ name: HQ_MCP_SERVER_NAME, pack: HQ_ANYWHERE_PACK, env: { home } });
     if (fs.existsSync(t.settingsJson)) {
         writeConfigAtomic({
@@ -739,7 +756,14 @@ export function installGlobalCodex(opts) {
     const env = opts.env ?? process.env;
     const log = opts.log ?? ((l) => console.log(l));
     const hqRoot = opts.hqRoot;
+    const providerBin = path.join(home, '.hq', 'bin');
+    // The wrappers are /bin/sh scripts reached through POSIX startup files, so a
+    // Windows shell would never pick them up. Skip them until a native shim exists.
+    const providerWrappersEnabled = process.platform !== 'win32'
+        && (opts.installProviderWrappers ?? isAnywhereEnabled(home, env));
     assertCodexHqRoot(hqRoot);
+    if (providerWrappersEnabled)
+        assertProviderWrappersInstallable(providerBin);
     if (!isCodexInstalled({ home })) {
         throw Object.assign(new Error(`Codex is not installed (${path.join(home, '.codex')} is missing).`), {
             expected: true,
@@ -793,6 +817,8 @@ export function installGlobalCodex(opts) {
     if (tomlNext !== tomlDoc || legacyPackServerPresent)
         touched.push(t.configToml);
     touched.push(regFile, t.stateFile);
+    if (providerWrappersEnabled)
+        touched.push(...providerWrapperInstallPaths(home));
     if (opts.dryRun) {
         log(`hq install --global --runtime codex --dry-run (HQ root ${hqRoot})`);
         log('Would write:');
@@ -875,6 +901,8 @@ export function installGlobalCodex(opts) {
         seeded: [...new Set([...(prior?.seeded ?? []), ...ownedSeeded])].sort(),
     };
     writeFileAtomic(t.stateFile, `${JSON.stringify(state, null, 2)}\n`);
+    if (providerWrappersEnabled)
+        installProviderWrappers(providerBin, home);
     log(`HQ installed for Codex from ${hqRoot}.`);
     log(`  skills linked: ${skills.link.length} new, ${skills.already.length} already present, ${skills.skipped.length} skipped`);
     reportSkippedSkills(skills, log, false);
@@ -895,8 +923,11 @@ export function uninstallGlobalCodex(opts = {}) {
         throw new Error('No HQ global install found (no install state and no ~/.hq/root).');
     const regFile = opts.registryFile ?? registryFile(registryDir(home, env));
     const claudeStillInstalled = fs.existsSync(claudeTargets(home).stateFile);
+    const providerBin = path.join(home, '.hq', 'bin');
     const packStillInstalled = fs.existsSync(path.join(hqRoot, 'core', 'packages', 'hq-anywhere', 'package.yaml'));
     const touched = [];
+    if (!claudeStillInstalled)
+        touched.push(path.join(providerBin, 'claude'), path.join(providerBin, 'codex'));
     const tomlDoc = readConfigDoc(t.configToml, codexConfigFormat).doc;
     const servers = tomlDoc.value.mcp_servers;
     if (!packStillInstalled && servers?.[HQ_MCP_SERVER_NAME]?._hqPack === HQ_ANYWHERE_PACK)
@@ -954,6 +985,8 @@ export function uninstallGlobalCodex(opts = {}) {
     }
     if (!packStillInstalled)
         unregisterCodexServer({ name: HQ_MCP_SERVER_NAME, pack: HQ_ANYWHERE_PACK, env: { home } });
+    if (!claudeStillInstalled)
+        removeProviderWrappers(providerBin);
     // Removal re-serializes the TOML (dropping comments). When what is left equals
     // the pre-install document, put the original bytes back.
     const tomlOriginal = state?.configToml.original ?? null;
@@ -1059,11 +1092,11 @@ export function resolveInstallRoot(explicit, options = {}) {
 export async function runInstallGlobal(opts) {
     const runtime = assertRuntime(opts.runtime);
     const env = opts.env ?? process.env;
+    const enabled = await anywhereRuntimeAllowed(env, {
+        ...(opts.personSettingReader ? { readSetting: opts.personSettingReader } : {}),
+        onError: (name) => (opts.log ?? console.log)(`HQ Anywhere person setting unavailable (${name}); access remains off.`),
+    });
     if (runtime === 'chatgpt' || runtime === 'grok' || opts.dryRun) {
-        const enabled = await anywhereRuntimeAllowed(env, {
-            ...(opts.personSettingReader ? { readSetting: opts.personSettingReader } : {}),
-            onError: (name) => (opts.log ?? console.log)(`HQ Anywhere person setting unavailable (${name}); access remains off.`),
-        });
         if (!enabled)
             throw new AnywhereRuntimeDisabledError();
         if (runtime === 'chatgpt' || runtime === 'grok') {
@@ -1083,6 +1116,7 @@ export async function runInstallGlobal(opts) {
         via: opts.via,
         marketplaceDir: opts.marketplaceDir,
         marketplaceRepository: opts.marketplaceRepository,
+        installProviderWrappers: enabled,
         env,
         log: opts.log,
     });

package/dist/commands/secrets.d.ts

@@ -2,6 +2,11 @@ import type { Command } from "commander";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
 export type { SecretLoadResponse, SecretScriptLockMode, SecretTier, SecretUsage, SecretUsageChannel } from "../secrets-env-action.js";
 export type { SecretScriptUsage, SecretMetadata, SecretLoadSuccessRow } from "../secrets-env-action.js";
+type SessionCompanyLock = {
+    sessionId: string;
+    companies: string[];
+} | undefined;
+export declare function readSessionCompanyLock(env?: NodeJS.ProcessEnv): SessionCompanyLock;
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };

package/dist/commands/secrets.js

@@ -1,9 +1,153 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as yaml from "js-yaml";
 import { buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
+export function readSessionCompanyLock(env = process.env) {
+    const root = resolveDefaultHqRoot({ env });
+    const sessionId = resolveSessionId(root, env);
+    if (!sessionId)
+        return undefined;
+    const sessionDir = path.join(root, "workspace/sessions", sessionId);
+    const capabilityPath = path.join(sessionDir, "scope-capability.json");
+    const metaPath = path.join(sessionDir, "meta.yaml");
+    let primary;
+    let companies;
+    let hasCapability = false;
+    try {
+        fs.lstatSync(capabilityPath);
+        hasCapability = true;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT" && code !== "ENOTDIR")
+            throw new Error("Cannot verify this session's company lock because its scope capability is unreadable.");
+    }
+    if (hasCapability) {
+        let value;
+        try {
+            value = JSON.parse(fs.readFileSync(capabilityPath, "utf8"));
+        }
+        catch {
+            throw new Error("Cannot verify this session's company lock because its scope capability is unreadable.");
+        }
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
+        const cap = value;
+        if (cap.session_id !== sessionId)
+            throw new Error("Cannot verify this session's company lock because its scope capability does not match the active session.");
+        if (typeof cap.company_slug !== "string" || !/^[A-Za-z0-9_-]+$/.test(cap.company_slug))
+            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
+        primary = cap.company_slug;
+        if (cap.company_slugs === undefined)
+            companies = [primary];
+        else if (Array.isArray(cap.company_slugs)
+            && cap.company_slugs.length > 0
+            && cap.company_slugs.every((slug) => typeof slug === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(slug))
+            && cap.company_slugs[0] === primary
+            && new Set(cap.company_slugs).size === cap.company_slugs.length
+            && ((primary === "personal" && cap.company_slugs.length === 1)
+                || (primary !== "personal" && !cap.company_slugs.includes("personal"))))
+            companies = [...cap.company_slugs];
+        else
+            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
+    }
+    else {
+        try {
+            const meta = fs.readFileSync(metaPath, "utf8");
+            const read = (key) => meta.split(/\r?\n/).find((line) => new RegExp(`^\\s*${key}:`).test(line))?.replace(/^\s*[^:]+:\s*/, "").replace(/^"|"$/g, "") ?? "";
+            primary = read("company_slug");
+            const hasList = meta.split(/\r?\n/).some((line) => /^\s*company_slugs:/.test(line));
+            const listed = hasList ? read("company_slugs") : "";
+            if (hasList && (!listed || !primary))
+                throw new Error("invalid company lock");
+            companies = hasList ? listed.split(",") : primary ? [primary] : [];
+            if (companies.some((slug) => !/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(slug)))
+                throw new Error("invalid company lock");
+            if (new Set(companies).size !== companies.length)
+                throw new Error("invalid company lock");
+            if (primary && companies[0] !== primary)
+                throw new Error("invalid company lock");
+            if (companies.length > 1 && companies.includes("personal"))
+                throw new Error("invalid company lock");
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES")
+                return { sessionId, companies: [] };
+            throw new Error("Cannot verify this session's company lock because its metadata is invalid.");
+        }
+    }
+    const real = companies.filter((slug) => {
+        if (slug === "personal")
+            return true;
+        try {
+            const companyPath = path.join(root, "companies", slug);
+            const stat = fs.lstatSync(companyPath);
+            return stat.isDirectory() && !stat.isSymbolicLink();
+        }
+        catch {
+            return false;
+        }
+    });
+    if (primary && real[0] !== primary)
+        return { sessionId, companies: [] };
+    return { sessionId, companies: real };
+}
+function companyUidForSlug(root, slug) {
+    try {
+        const doc = yaml.load(fs.readFileSync(path.join(root, "companies", "manifest.yaml"), "utf8"));
+        const uid = doc.companies?.[slug]?.cloud_uid;
+        return typeof uid === "string" && looksLikeCompanyUid(uid) ? uid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function companySlugForUid(root, companies, uid) {
+    if (!looksLikeCompanyUid(uid))
+        return undefined;
+    try {
+        const doc = yaml.load(fs.readFileSync(path.join(root, "companies", "manifest.yaml"), "utf8"));
+        return companies.find((slug) => doc.companies?.[slug]?.cloud_uid === uid);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveApiKeyCompanyWithinLock(input) {
+    let candidates = input.companies;
+    if (input.requestedCompany) {
+        const companySlug = input.companies.includes(input.requestedCompany)
+            ? input.requestedCompany
+            : companySlugForUid(input.root, input.companies, input.requestedCompany);
+        if (!companySlug) {
+            throw new Error("HQ_API_KEY is not bound to a company in this session's locked company set.");
+        }
+        candidates = [companySlug];
+    }
+    for (const companySlug of candidates) {
+        const companyUid = companyUidForSlug(input.root, companySlug);
+        if (!companyUid)
+            continue;
+        const response = await vaultApiFetch({ token: input.token, path: `/v1/keys/secrets/${encodeURIComponent(companyUid)}` });
+        if (response.ok)
+            return { companyUid, companySlug };
+        if (response.status === 401)
+            throw new Error("HQ_API_KEY is invalid or no longer active.");
+        if (response.status !== 403)
+            throw new Error(`Could not verify HQ_API_KEY company scope (HTTP ${response.status}).`);
+    }
+    throw new Error("HQ_API_KEY is not bound to a company in this session's locked company set.");
+}
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { removeCacheEntry, clearAllCache } from "../utils/secrets-cache.js";
 import { isHqCliChild, releaseChildWrapperPackageUseLeaseAfterStart } from "../utils/child-wrapper-lease.js";
+import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
+import { fastFlagEnabled } from "../native-fast-route.js";
+import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
+import { resolveSessionId } from "../lib/core-utils/session-id.js";
 import { secretsExecChildExitCode } from "../utils/child-wrapper-exit.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
@@ -1085,6 +1229,7 @@ export function registerSecretsCommand(program) {
         .command("exec")
         .description("Run a command with secrets injected as env vars")
         .requiredOption("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--script <path>", "Attach local script identity for script-locked secrets")
         .option("--script-id <id>", "Stable script identifier approved by policy")
         .allowUnknownOption(true)
@@ -1104,10 +1249,44 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
+            const multiCompanyLockEnabled = await fastFlagEnabled(MULTI_COMPANY_SESSION_LOCK_FLAG);
+            const sessionLock = multiCompanyLockEnabled ? readSessionCompanyLock(process.env) : undefined;
+            const parentScope = secrets.opts();
+            const inheritedCompany = parentScope.company;
+            const requestedCompany = _opts.company ?? inheritedCompany;
+            const hasLockedCompanies = (sessionLock?.companies.length ?? 0) > 0;
+            const lockRoot = hasLockedCompanies ? resolveDefaultHqRoot({ env: process.env }) : undefined;
+            const selectedCompany = (hasLockedCompanies && requestedCompany && looksLikeCompanyUid(requestedCompany)
+                ? companySlugForUid(lockRoot, sessionLock.companies, requestedCompany) ?? requestedCompany
+                : requestedCompany)
+                ?? (multiCompanyLockEnabled && !parentScope.personal ? sessionLock?.companies[0] : undefined);
+            if (hasLockedCompanies && selectedCompany && !sessionLock.companies.includes(selectedCompany)) {
+                throw new Error(`Company '${selectedCompany}' is outside this session's locked company set.`);
+            }
+            if (hasLockedCompanies && parentScope.personal && !sessionLock.companies.includes("personal")) {
+                throw new Error("Personal scope is outside this session's locked company set.");
+            }
+            if (hasLockedCompanies && !selectedCompany && !parentScope.personal) {
+                throw new Error("This session has no locked company scope for secrets exec.");
+            }
+            if (hasLockedCompanies && !requestedCompany && sessionLock.companies.length > 1) {
+                console.error(`Using primary company ${sessionLock.companies[0]} from this session's lock; pass --company <slug> to choose another locked company.`);
+            }
+            const secretScope = selectedCompany === "personal"
+                ? scopeOpts({ personal: true })
+                : scopeOpts({ ...parentScope, ...(selectedCompany ? { company: selectedCompany } : {}) });
             const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets exec", secretsCredentialOptions());
+            const apiKeyCompany = cred.kind === "api-key" && hasLockedCompanies
+                ? await resolveApiKeyCompanyWithinLock({
+                    token: cred.token,
+                    root: lockRoot,
+                    companies: sessionLock.companies,
+                    ...(requestedCompany ? { requestedCompany } : {}),
+                })
+                : undefined;
             const companyUid = cred.kind === "api-key"
-                ? "__api_key__"
-                : await getEntityUid(cred.token, scopeOpts(secrets.opts()), { allowOfflineScopeFallback: true });
+                ? (apiKeyCompany?.companyUid ?? "__api_key__")
+                : await getEntityUid(cred.token, secretScope, { allowOfflineScopeFallback: true });
             const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
                 : undefined, { allowOfflineFallback: true });

package/dist/commands/workers.d.ts

@@ -6,12 +6,15 @@ import { type RegistryWorker } from "../lib/workers-registry/read.js";
  * company_slug. Undefined when no session context is set. Pure/read-only.
  */
 export declare function resolveActiveCompany(hqRoot: string): string | undefined;
+/** Resolve the active ordered lock set; default-off preserves primary-only access. */
+export declare function resolveActiveCompanies(hqRoot: string, multiCompanyLockEnabled: boolean): string[] | undefined;
+export declare function denyWorkerCompanyOutsideLock(company: string, lockedCompanies: string[] | undefined): boolean;
 /**
  * Membership-aware access filter for worker discovery: public workers always;
  * company workers only for the active company. Mirrors the /run skill and the
  * inject-worker-suggestion hook so all three surfaces agree.
  */
-export declare function filterAccessibleWorkers(workers: RegistryWorker[], activeCompany: string | undefined): RegistryWorker[];
+export declare function filterAccessibleWorkers(workers: RegistryWorker[], activeCompany: string | string[] | undefined): RegistryWorker[];
 /**
  * The company-relative vault prefix for a worker, e.g.
  * companies/indigo/workers/deal-brain/ -> workers/deal-brain/. Returns null for

package/dist/commands/workers.js

@@ -7,6 +7,9 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
 import { GROUP_ID_PATTERN, EMAIL_PATTERN, toSharedFolderGlob } from "./_patterns.js";
 import { findHqRoot } from "../utils/manifest.js";
+import { fastFlagEnabled } from "../native-fast-route.js";
+import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
+import { resolveSessionId } from "../lib/core-utils/session-id.js";
 export { readWorkerRegistry } from "../lib/workers-registry/read.js";
 import { readWorkerRegistry } from "../lib/workers-registry/read.js";
 /**
@@ -14,34 +17,68 @@ import { readWorkerRegistry } from "../lib/workers-registry/read.js";
  * company_slug. Undefined when no session context is set. Pure/read-only.
  */
 export function resolveActiveCompany(hqRoot) {
+    return resolveActiveCompanies(hqRoot, false)?.[0];
+}
+/** Resolve the active ordered lock set; default-off preserves primary-only access. */
+export function resolveActiveCompanies(hqRoot, multiCompanyLockEnabled) {
+    const current = resolveSessionId(hqRoot);
+    if (!current)
+        return undefined;
     try {
-        const currentFile = path.join(hqRoot, "workspace/sessions/.current");
-        const current = fs.readFileSync(currentFile, "utf8").trim();
-        if (!current)
-            return undefined;
         const metaPath = path.join(hqRoot, "workspace/sessions", current, "meta.yaml");
         if (!fs.existsSync(metaPath))
-            return undefined;
+            return multiCompanyLockEnabled ? [] : undefined;
         const meta = yaml.load(fs.readFileSync(metaPath, "utf8"));
-        const co = meta?.company_slug;
-        return typeof co === "string" && co ? co : undefined;
+        const primary = meta?.company_slug;
+        if (typeof primary !== "string" || !/^[A-Za-z0-9_-]+$/.test(primary))
+            return multiCompanyLockEnabled ? [] : undefined;
+        const rawListed = meta?.company_slugs;
+        const listed = multiCompanyLockEnabled && typeof rawListed === "string"
+            ? rawListed.split(",")
+            : [primary];
+        if (!multiCompanyLockEnabled)
+            return [primary];
+        const companies = [...new Set(listed.filter((slug) => {
+                if (typeof slug !== "string" || !/^[A-Za-z0-9_-]+$/.test(slug))
+                    return false;
+                if (slug === "personal")
+                    return true;
+                try {
+                    const stat = fs.lstatSync(path.join(hqRoot, "companies", slug));
+                    return stat.isDirectory() && !stat.isSymbolicLink();
+                }
+                catch {
+                    return false;
+                }
+            }))];
+        if (companies.length > 1 && companies.includes("personal"))
+            return [primary];
+        return companies[0] === primary ? companies : undefined;
     }
     catch {
-        return undefined;
+        return multiCompanyLockEnabled ? [] : undefined;
     }
 }
+export function denyWorkerCompanyOutsideLock(company, lockedCompanies) {
+    if (lockedCompanies === undefined || lockedCompanies.includes(company))
+        return false;
+    console.error(`Company '${company}' is outside this session's locked company set.`);
+    process.exitCode = 1;
+    return true;
+}
 /**
  * Membership-aware access filter for worker discovery: public workers always;
  * company workers only for the active company. Mirrors the /run skill and the
  * inject-worker-suggestion hook so all three surfaces agree.
  */
 export function filterAccessibleWorkers(workers, activeCompany) {
+    const allowed = new Set(Array.isArray(activeCompany) ? activeCompany : activeCompany ? [activeCompany] : []);
     return workers.filter((w) => {
         if (w.visibility === "public")
             return true;
         if (!w.company)
             return false;
-        return activeCompany !== undefined && w.company === activeCompany;
+        return allowed.has(w.company);
     });
 }
 /**
@@ -159,14 +196,18 @@ async function runWorkersShare(workerId, opts) {
     console.log(chalk.green("✓"), `Shared worker '${workerId}' with ${classified.label} (${permission}).`);
     console.log(chalk.dim(`  Vault prefix ${prefix} granted in company '${companySlug}'. It will sync to granted members and appear in their /run list.`));
 }
-function runWorkersList(opts) {
+async function runWorkersList(opts) {
     const hqRoot = findHqRoot();
-    const activeCompany = opts.company ?? resolveActiveCompany(hqRoot);
-    let workers = filterAccessibleWorkers(readWorkerRegistry(hqRoot), activeCompany);
+    const enabled = await fastFlagEnabled(MULTI_COMPANY_SESSION_LOCK_FLAG);
+    const lockedCompanies = resolveActiveCompanies(hqRoot, enabled);
+    if (enabled && opts.company && denyWorkerCompanyOutsideLock(opts.company, lockedCompanies))
+        return;
+    const activeCompanies = opts.company ? [opts.company] : lockedCompanies;
+    let workers = filterAccessibleWorkers(readWorkerRegistry(hqRoot), activeCompanies);
     if (opts.shared)
         workers = workers.filter((w) => Boolean(w.grants && w.grants.trim()));
     if (opts.mine)
-        workers = workers.filter((w) => Boolean(w.company) && w.company === activeCompany);
+        workers = workers.filter((w) => Boolean(w.company) && activeCompanies?.includes(w.company) === true);
     if (workers.length === 0) {
         console.log("No accessible workers.");
         return;
@@ -185,8 +226,9 @@ function runWorkersList(opts) {
         }
     };
     printGroup("Public", publicWorkers);
-    if (activeCompany)
-        printGroup(activeCompany, companyWorkers);
+    for (const company of activeCompanies ?? []) {
+        printGroup(company, companyWorkers.filter((worker) => worker.company === company));
+    }
     console.log(chalk.dim("\nUsage: hq run {worker-id} [skill] [args]"));
     console.log(chalk.dim("Share a company worker: hq workers share {worker-id} --with {grp_<name>|@all} --permission read"));
 }

package/dist/lib/cli-flag-keys.d.ts

@@ -1,3 +1,4 @@
 /** hq-flags keys used by CLI-wide routes. */
 export declare const CLI_COMMAND_HELP_CATALOG_FLAG = "cli.command-help-catalog";
+export declare const MULTI_COMPANY_SESSION_LOCK_FLAG = "hooks.multi-company-session-lock";
 //# sourceMappingURL=cli-flag-keys.d.ts.map

package/dist/lib/cli-flag-keys.js

@@ -1,3 +1,4 @@
 /** hq-flags keys used by CLI-wide routes. */
 export const CLI_COMMAND_HELP_CATALOG_FLAG = "cli.command-help-catalog";
+export const MULTI_COMPANY_SESSION_LOCK_FLAG = "hooks.multi-company-session-lock";
 //# sourceMappingURL=cli-flag-keys.js.map

package/dist/lib/core-utils/session-id.d.ts

@@ -0,0 +1,6 @@
+export declare const SESSION_ID_ENV_KEYS: readonly ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID", "GROK_SESSION_ID"];
+export declare function validSessionId(value: string): boolean;
+export declare function sessionIdFromEnv(env: NodeJS.ProcessEnv): string;
+/** Resolve the caller's session before using the global, last-writer-wins .current fallback. */
+export declare function resolveSessionId(root: string, env?: NodeJS.ProcessEnv, readFile?: (filePath: string, encoding: BufferEncoding) => string): string;
+//# sourceMappingURL=session-id.d.ts.map

package/dist/lib/core-utils/session-id.js

@@ -0,0 +1,35 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const SESSION_ID_ENV_KEYS = [
+    "HQ_SESSION_ID",
+    "CLAUDE_CODE_SESSION_ID",
+    "CLAUDE_SESSION_ID",
+    "CODEX_SESSION_ID",
+    "CODEX_THREAD_ID",
+    "GROK_SESSION_ID",
+];
+export function validSessionId(value) {
+    return Boolean(value) && value !== "." && value !== ".." && /^[A-Za-z0-9._-]+$/.test(value);
+}
+export function sessionIdFromEnv(env) {
+    for (const key of SESSION_ID_ENV_KEYS) {
+        const value = (env[key] ?? "").replace(/[\t\n\v\f\r ]/g, "");
+        if (validSessionId(value))
+            return value;
+    }
+    return "";
+}
+/** Resolve the caller's session before using the global, last-writer-wins .current fallback. */
+export function resolveSessionId(root, env = process.env, readFile = (filePath, encoding) => fs.readFileSync(filePath, encoding)) {
+    const fromEnv = sessionIdFromEnv(env);
+    if (fromEnv)
+        return fromEnv;
+    try {
+        const current = readFile(path.join(root, "workspace", "sessions", ".current"), "utf8").replace(/[\t\n\v\f\r ]/g, "");
+        return validSessionId(current) ? current : "";
+    }
+    catch {
+        return "";
+    }
+}
+//# sourceMappingURL=session-id.js.map

package/dist/lib/daemon/catalog.js

@@ -230,7 +230,7 @@ function planService(service, ctx) {
             return [
                 base(service, {
                     kind: "scheduled",
-                    // Polls every 15 s so keep-alive resumes are admitted on time (#1396).
+                    // Polls every 15 s so local keep-alive resumes are admitted on time (#1396).
                     // Each pass is a fresh `hq` node process (~1.8 s CPU, ~200 MB RSS), so
                     // desktops first check the lane store in-process
                     // (lanes-reconcile-guard.ts) and fall back to the pre-#1396 60 s

package/dist/lib/daemon/lanes-reconcile-guard.d.ts

@@ -7,12 +7,13 @@
  * JSON reads, no child process) and tells the supervisor how urgent the next
  * pass is:
  *
- * - `spawn`: something the 15-second cadence exists for may be due — lane
- *   admission, a running lane's heartbeat, or a keep-alive resume (#1396).
+ * - `spawn`: something the desktop's 15-second cadence exists for may be due —
+ *   local lane admission/heartbeat, a local keep-alive resume (#1396), or a
+ *   pending question.
  * - `idle`: only work that ran on the pre-#1396 60-second cadence remains
- *   (terminal lanes, worker-profile resumes, question aging, Codex rollout
- *   retention, lead-autopilot registry). The supervisor runs it at most once
- *   per `idleIntervalSec`.
+ *   (terminal lanes, worker-profile resumes, question aging, outpost mirror
+ *   refresh, Codex retention, lead-autopilot registry). The supervisor runs it
+ *   at most once per `idleIntervalSec`.
  * - `skip`: the store holds no lane or question records, no lead registry and
  *   no lanes config, so a reconcile pass has no input to act on.
  *

package/dist/lib/daemon/lanes-reconcile-guard.js

@@ -7,12 +7,13 @@
  * JSON reads, no child process) and tells the supervisor how urgent the next
  * pass is:
  *
- * - `spawn`: something the 15-second cadence exists for may be due — lane
- *   admission, a running lane's heartbeat, or a keep-alive resume (#1396).
+ * - `spawn`: something the desktop's 15-second cadence exists for may be due —
+ *   local lane admission/heartbeat, a local keep-alive resume (#1396), or a
+ *   pending question.
  * - `idle`: only work that ran on the pre-#1396 60-second cadence remains
- *   (terminal lanes, worker-profile resumes, question aging, Codex rollout
- *   retention, lead-autopilot registry). The supervisor runs it at most once
- *   per `idleIntervalSec`.
+ *   (terminal lanes, worker-profile resumes, question aging, outpost mirror
+ *   refresh, Codex retention, lead-autopilot registry). The supervisor runs it
+ *   at most once per `idleIntervalSec`.
  * - `skip`: the store holds no lane or question records, no lead registry and
  *   no lanes config, so a reconcile pass has no input to act on.
  *
@@ -38,6 +39,9 @@ export const LEAD_REGISTRY_FILE = path.join("workspace", "lane-briefs", "juniors
  * keep-alive, which is checked separately.
  */
 const QUIET_LANE_STATES = new Set(["done", "failed", "interrupted", "cancelled", "killed", "blocked"]);
+const KNOWN_LANE_STATES = new Set([
+    "queued", "running", "awaiting_input", "blocked", "done", "failed", "interrupted", "cancelled", "killed",
+]);
 const realFs = {
     readdirSync: (dir) => fs.readdirSync(dir),
     readFileSync: (file, encoding) => fs.readFileSync(file, encoding),
@@ -63,9 +67,24 @@ function readRecord(fsDeps, file) {
     }
     return parsed;
 }
-/** A lane that may need the 15-second cadence. Unknown shapes count as urgent. */
+/** A lane that may need the desktop's 15-second cadence. Unknown shapes count as urgent. */
 function laneIsUrgent(lane) {
-    if (typeof lane.state !== "string" || !QUIET_LANE_STATES.has(lane.state))
+    if (typeof lane.state !== "string" || !KNOWN_LANE_STATES.has(lane.state))
+        return true;
+    const host = lane.host;
+    if (typeof host !== "object" || host === null || Array.isArray(host))
+        return true;
+    const hostRecord = host;
+    if (typeof hostRecord.id !== "string" || hostRecord.id.length === 0)
+        return true;
+    // This guard is installed only on desktops. The outpost's own daemon keeps
+    // its 15-second cadence; the desktop's outpost mirror/registry refresh can
+    // use the 60-second idle cadence. Pending questions remain urgent below.
+    if (hostRecord.kind === "outpost")
+        return false;
+    if (hostRecord.kind !== "local")
+        return true;
+    if (!QUIET_LANE_STATES.has(lane.state))
         return true;
     if (lane.keep_alive === true)
         return true;