@indigoai-us/hq-cli 5.345.47 → 5.345.48

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [5.345.48] — 2026-10-08
+- Add default-off multi-company session locks with ordered `hq-session add/remove company` updates and scope-capability enforcement.
+- Give a sync runner that reports stopping 60 seconds to persist pending pushes before SIGKILL. The daemon shutdown deadline includes that grace; other services remain capped at 15 seconds.
+- The desktop now uses the 60-second idle cadence when only outpost-hosted lanes need reconciliation.
+
 ## [5.345.47] — 2026-10-08
 - `hq files share` now shows the server's reason when a private folder conflicts with its shared folder glob, for example that the glob still has grants or that only its creator or a company admin can replace it.
 - After `hq install --global`, unauthenticated `claude` and `codex` commands show provider-specific sign-in instructions; Codex HTTP 401 transport text is kept in the HQ log.

package/assets/scaffold/core/scripts/hq-session.sh

@@ -7,6 +7,9 @@
 #   core/scripts/hq-session.sh path                  # print path to current meta.yaml
 #   core/scripts/hq-session.sh get <key>             # read a key from meta.yaml
 #   core/scripts/hq-session.sh set <key> <value>     # set/replace a top-level key
+#   add company <slug>          # add a company to the session lock set
+#   remove company <slug>       # remove a company from the session lock set
+#   get company_slugs           # print locked companies, primary first
 #
 # Reserved value:
 #   set company_slug personal   # bind the session to no-company (personal) work
@@ -125,7 +128,7 @@ hq_session_has_case_alias() {
 SESSION_ID_OVERRIDE=""
 
 usage() {
-  sed -n '2,15p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+  sed -n '2,18p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
 }
 
 current_id() {
@@ -160,6 +163,12 @@ cmd_get() {
   # Unreadable meta.yaml: awk fails and this function exits non-zero under
   # set -e. Those two are not the same case — do not default either.
   [ -n "$meta" ] && [ -f "$meta" ] || return 0
+  if [ "$key" = company_slugs ]; then
+    local lock_set primary
+    lock_set="$(awk '$1 == "company_slugs:" {sub(/^[^:]+:[[:space:]]*/, ""); gsub(/^"|"$/, ""); print; exit}' "$meta")"
+    if [ -n "$lock_set" ]; then printf '%s' "$lock_set"; else cmd_get company_slug; fi
+    return 0
+  fi
   # Absent key: print nothing. For `senior`, a record written before that
   # field existed has no line; that is a successful read of a file that does
   # not contain the key, not a failed read. §3.1 defaults `senior` to `user`
@@ -179,6 +188,90 @@ cmd_get() {
   ' "$meta"
 }
 
+multi_company_enabled() {
+  local primary="${1:-}"
+  [ -n "$primary" ] || primary="$(cmd_get company_slug)"
+  session_scope_multi_company_enabled "$REPO_ROOT" "$primary"
+}
+
+validate_company_slug() {
+  local slug="${1:-}"
+  case "$slug" in ''|*[!a-zA-Z0-9_-]*) echo "hq-session: invalid company_slug: '$slug' (allowed characters: A-Z a-z 0-9 - _)" >&2; return 1 ;; esac
+  [ "$slug" != personal ] || { echo "hq-session: personal cannot be combined with a company" >&2; return 1; }
+  if [ -L "$REPO_ROOT/companies/$slug" ] || ! hq_session_has_exact_company_dir "$REPO_ROOT" "$slug" || hq_session_has_case_alias "$REPO_ROOT" "$slug"; then
+    echo "hq-session: company_slug must use the exact real directory name: '$slug'" >&2
+    return 1
+  fi
+}
+
+write_company_lock_set() {
+  local meta="$1" set="$2" primary="$3" tmp
+  tmp="$(mktemp)"
+  awk -v primary="$primary" -v slugs="$set" '
+    BEGIN { has_primary=0; has_slugs=0 }
+    $1 == "company_slug:" { if (!has_primary) print "company_slug: " primary; has_primary=1; next }
+    $1 == "company_slugs:" { if (!has_slugs) print "company_slugs: " slugs; has_slugs=1; next }
+    { print }
+    END { if (!has_primary) print "company_slug: " primary; if (!has_slugs) print "company_slugs: " slugs }
+  ' "$meta" >"$tmp"
+  mv "$tmp" "$meta"
+}
+
+emit_lock_set_context() {
+  local sid="$1" slugs="$2" slug
+  IFS=, read -r -a __session_slugs <<< "$slugs"
+  for slug in "${__session_slugs[@]}"; do
+    [ "$slug" = personal ] && continue
+    emit_company_hard_policies "$slug"
+  done
+  spawn_work_mesh_register "$sid" || true
+}
+
+cmd_add_company() {
+  local slug="${1:-}" id meta current slugs next
+  [ -n "$slug" ] || { echo "usage: hq-session.sh add company <slug>" >&2; exit 1; }
+  if ! multi_company_enabled; then
+    echo "hq-session: add company is disabled; hooks.multi-company-session-lock is off" >&2
+    exit 1
+  fi
+  validate_company_slug "$slug" || exit 1
+  id="$(current_id)"
+  [ -n "$id" ] || { echo "hq-session: no current session" >&2; exit 1; }
+  meta="$SESSIONS_DIR/$id/meta.yaml"
+  [ -f "$meta" ] || { echo "hq-session: session is not company-bound" >&2; exit 1; }
+  current="$(cmd_get company_slug)"
+  [ -n "$current" ] || { echo "hq-session: session is not company-bound" >&2; exit 1; }
+  slugs="$(cmd_get company_slugs)"
+  if [ "$current" = personal ]; then next="$slug"; else
+    case ",$slugs," in *",$slug,"*) next="$slugs" ;; *) next="$slugs,$slug" ;; esac
+  fi
+  write_company_lock_set "$meta" "$next" "${next%%,*}"
+  session_scope_mint_set "$REPO_ROOT" "$id" "$next" || { echo "hq-session: failed to mint scope-capability for session $id" >&2; exit 1; }
+  emit_lock_set_context "$id" "$next"
+}
+
+cmd_remove_company() {
+  local slug="${1:-}" id meta current slugs next out entry removed=0
+  [ -n "$slug" ] || { echo "usage: hq-session.sh remove company <slug>" >&2; exit 1; }
+  id="$(current_id)"
+  [ -n "$id" ] || { echo "hq-session: no current session" >&2; exit 1; }
+  meta="$SESSIONS_DIR/$id/meta.yaml"
+  current="$(cmd_get company_slug)"
+  slugs="$(cmd_get company_slugs)"
+  [ -n "$slugs" ] || { echo "hq-session: session has no company lock" >&2; exit 1; }
+  out=""
+  IFS=, read -r -a __session_slugs <<< "$slugs"
+  for entry in "${__session_slugs[@]}"; do
+    if [ "$entry" = "$slug" ]; then removed=1; else out="${out:+$out,}$entry"; fi
+  done
+  [ "$removed" = 1 ] || { echo "hq-session: company is not locked: $slug" >&2; exit 1; }
+  [ -n "$out" ] || { echo "hq-session: cannot remove the last company; use set company_slug" >&2; exit 1; }
+  next="$out"
+  write_company_lock_set "$meta" "$next" "${next%%,*}"
+  session_scope_mint_set "$REPO_ROOT" "$id" "$next" || { echo "hq-session: failed to mint scope-capability for session $id" >&2; exit 1; }
+  emit_lock_set_context "$id" "$next"
+}
+
 cmd_set() {
   local key="${1:-}" value="${2:-}"
   [ -n "$key" ] && [ $# -ge 2 ] || { echo "usage: hq-session.sh set <key> <value>" >&2; exit 1; }
@@ -254,15 +347,26 @@ cmd_set() {
   local prev=""
   prev="$(cmd_get "$key" 2>/dev/null || true)"
 
+  # A company switch invalidates the old project/task; clear both in the same
+  # metadata rewrite before the company bind can register with Work Mesh.
+  local clear_project_task=0
+  if [ "$key" = "company_slug" ] && [ -n "$prev" ] && [ "$value" != "$prev" ]; then
+    clear_project_task=1
+  fi
+
   local tmp
   tmp="$(mktemp)"
-  awk -v k="$key" -v v="$value" '
+  awk -v clear_project_task="$clear_project_task" -v k="$key" -v v="$value" '
     BEGIN { found = 0 }
+    clear_project_task && ($1 == "project:" || $1 == "task:") { next }
     $1 == k":" { print k": " v; found = 1; next }
     { print }
     END { if (!found) print k": " v }
   ' "$meta" > "$tmp"
   mv "$tmp" "$meta"
+  if [ "$key" = company_slug ]; then
+    write_company_lock_set "$meta" "$value" "$value"
+  fi
 
   # When a company is bound (or rebound) mid-session, surface that company's
   # hard-enforcement policies into this Bash tool result. SessionStart only
@@ -271,7 +375,7 @@ cmd_set() {
   # do company infra/deploy/credential work blind to hard rules. This closes
   # that gap. Emits policy text only — never secrets.
   if [ "$key" = "company_slug" ] && [ -n "$value" ] && [ "$value" != "$prev" ]; then
-    session_scope_mint "$REPO_ROOT" "$id" "$value" || {
+    session_scope_mint_set "$REPO_ROOT" "$id" "$value" || {
       echo "hq-session: failed to mint scope-capability for session $id" >&2
       exit 1
     }
@@ -285,7 +389,7 @@ cmd_set() {
       # Fire-and-forget: register this company bind with the Work Mesh (US-003).
       # Fully silent (all output → the hook's own bounded log) and guarded so it
       # can neither fail cmd_set under `set -euo pipefail` nor delay its return.
-      spawn_work_mesh_register "$id" || true
+      spawn_work_mesh_register "$id" "$value" || true
     fi
   fi
 
@@ -318,13 +422,13 @@ cmd_set() {
 # tests copy only hq-session.sh). Never blocks: the hook itself is fire-and-forget
 # and this backgrounds even its fast foreground path off cmd_set's return path.
 spawn_work_mesh_register() {
-  local sid="$1"
+  local sid="$1" company="${2:-}"
   local hook="$REPO_ROOT/core/hooks/SessionStart/35-work-mesh-session-start.sh"
   local logf="$REPO_ROOT/workspace/logs/work-mesh-hook.log"
   [ -f "$hook" ] || return 0
   command -v jq >/dev/null 2>&1 || return 0
   local ev
-  ev="$(jq -nc --arg sid "$sid" --arg cwd "${PWD:-}" '{session_id:$sid,cwd:$cwd}' 2>/dev/null)" || return 0
+  ev="$(jq -nc --arg sid "$sid" --arg company "$company" --arg cwd "${PWD:-}" '{session_id:$sid,cwd:$cwd} + (if $company == "" then {} else {company_slug:$company} end)' 2>/dev/null)" || return 0
   [ -n "$ev" ] || return 0
   mkdir -p "$(dirname "$logf")" 2>/dev/null || true
   HQ_ROOT="$REPO_ROOT" CLAUDE_CODE_SESSION_ID="$sid" \
@@ -373,7 +477,7 @@ emit_company_hard_policies() {
     /^---[ \t]*$/ { d++; next }
     d==1 && /^id:/          { s=$0; sub(/^id:[ \t]*/,"",s); gsub(/^["'"'"']|["'"'"']$/,"",s); id=s; next }
     d==1 && /^enforcement:/ { s=$0; sub(/^enforcement:[ \t]*/,"",s); gsub(/[ \t]/,"",s); enf=s; next }
-    d==1 && /^status:[ \t]*retired/ { retired=1; next }
+    d==1 && /^status:[ \t]*retired/ { retired=1 ; next }
     d>=2 && /^## Rule[ \t]*$/ { rsec=1; next }
     d>=2 && rsec && /^## / { rsec=0 }
     d>=2 && rsec && !rcap && NF { line=$0; gsub(/\*\*/,"",line); if(length(line)>160)line=substr(line,1,157)"..."; rule=line; rcap=1 }
@@ -438,6 +542,8 @@ case "$sub" in
   path)    cmd_path "$@" ;;
   get)     cmd_get "$@" ;;
   set)     cmd_set "$@" ;;
+  add)     [ "${1:-}" = company ] || { echo "usage: hq-session.sh add company <slug>" >&2; exit 1; }; shift; cmd_add_company "$@" ;;
+  remove)  [ "${1:-}" = company ] || { echo "usage: hq-session.sh remove company <slug>" >&2; exit 1; }; shift; cmd_remove_company "$@" ;;
   ""|-h|--help|help) usage ;;
   *) echo "hq-session: unknown subcommand '$sub'" >&2; usage >&2; exit 1 ;;
 esac

package/assets/scaffold/core/scripts/lib/session-scope-capability.sh

@@ -5,6 +5,24 @@
 # Sourced by core/scripts/hq-session.sh and .claude/hooks/mandatory-scope-authorizer.sh.
 # Never execute directly.
 
+session_scope_multi_company_enabled() {
+  local root="${1:-}" primary="${2:-}" flag_script
+  flag_script="$root/.codex/hooks/codex-explicit-path-flag.cjs"
+  if ! command -v hqd_hook_flag_enabled_for >/dev/null 2>&1 && [ -f "$root/core/scripts/hqd-hook-flag-cache-lib.sh" ]; then
+    # shellcheck source=../hqd-hook-flag-cache-lib.sh
+    . "$root/core/scripts/hqd-hook-flag-cache-lib.sh"
+  fi
+  if command -v hqd_hook_flag_enabled_for >/dev/null 2>&1; then
+    hqd_hook_flag_enabled_for multi-company-session-lock hooks.multi-company-session-lock \
+      "$flag_script" "$root" "$primary"
+    [ "${HQD_FLAG_ENABLED:-false}" = true ]
+    return $?
+  fi
+  # The cache library is part of the live HQ tree. Missing it is a lookup error,
+  # so keep the gate off instead of introducing uncached Node work on a hook.
+  return 1
+}
+
 # session_scope_identity_is_valid <identity>
 #   Identities become path segments; accept only a conservative portable set.
 session_scope_identity_is_valid() {
@@ -40,6 +58,55 @@ session_scope_read() {
     "$cap" 2>/dev/null || true
 }
 
+# session_scope_read_companies <root> <session_id> [agent_id]
+# Print the ordered, validated lock set. Legacy capabilities remain singleton
+# locks; malformed company_slugs fail closed instead of falling back to primary.
+session_scope_read_companies() {
+  local root="${1:-}" sid="${2:-}" aid="${3:-}" cap lock_info primary has_set result slug out=""
+  local -a slugs
+  cap="$(session_scope_capability_path "$root" "$sid" "$aid")" || return 0
+  [ -f "$cap" ] || return 0
+  lock_info="$(jq -er --arg sid "$sid" --arg aid "$aid" '
+    select(.session_id == $sid and (.agent_id // "") == $aid)
+    | if (.company_slug | type) != "string" or (.company_slug | test("^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$") | not) then error("invalid primary")
+      elif has("company_slugs") then
+        if (.company_slugs | type) == "array" and all(.company_slugs[]; type == "string" and test("^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$"))
+          and (.company_slugs | length) > 0 and .company_slugs[0] == .company_slug
+          and ((.company_slugs | unique | length) == (.company_slugs | length))
+          and ((.company_slug == "personal" and (.company_slugs | length) == 1)
+            or (.company_slugs | all(. != "personal"))) then
+          [.company_slug, "true", (.company_slugs | join(","))] | @tsv
+        else error("invalid company_slugs") end
+      else [.company_slug, "false", .company_slug] | @tsv end
+  ' "$cap" 2>/dev/null)" || return 0
+  IFS="$(printf '\t')" read -r primary has_set result <<EOF
+$lock_info
+EOF
+  case "$primary" in ''|*[!A-Za-z0-9_-]*) return 0 ;; esac
+  IFS=, read -r -a slugs <<< "$result"
+  # A singleton is identical whether the gate is on or off; skip the flag
+  # client on the session-start hot path.
+  if [ "${#slugs[@]}" -le 1 ]; then
+    if [ "$primary" = personal ] || { [ -d "$root/companies/$primary" ] && [ ! -L "$root/companies/$primary" ]; }; then
+      printf '%s\n' "$primary"
+    fi
+    return 0
+  fi
+  if [ "$has_set" != true ] || ! session_scope_multi_company_enabled "$root" "$primary"; then
+    if [ "$primary" = personal ] || { [ -d "$root/companies/$primary" ] && [ ! -L "$root/companies/$primary" ]; }; then
+      printf '%s\n' "$primary"
+    fi
+    return 0
+  fi
+  for slug in "${slugs[@]}"; do
+    case "$slug" in ''|*[!a-zA-Z0-9_-]*) return 0 ;; esac
+    if [ "$slug" = personal ] || { [ -d "$root/companies/$slug" ] && [ ! -L "$root/companies/$slug" ]; }; then
+      case ",$out," in *",$slug,"*) ;; *) out="${out:+$out,}$slug" ;; esac
+    fi
+  done
+  [ -n "$out" ] && printf '%s\n' "$out" | tr ',' '\n'
+}
+
 # session_scope_resolve_agent_company <root> <session_id> <agent_id> <session_company> <event>
 #   Existing tuple bindings always win. Session metadata may bind a caller only
 #   on SessionStart, when that agent has not been bound before.
@@ -53,6 +120,16 @@ session_scope_resolve_agent_company() {
   fi
 }
 
+session_scope_resolve_agent_companies() {
+  local root="${1:-}" sid="${2:-}" aid="${3:-}" session_companies="${4:-}" event="${5:-}" bound=""
+  bound="$(session_scope_read_companies "$root" "$sid" "$aid" 2>/dev/null || true)"
+  if [ -n "$bound" ]; then
+    printf '%s\n' "$bound"
+  elif [ "$event" = "SessionStart" ] && [ -n "$session_companies" ]; then
+    printf '%s\n' "$session_companies" | tr ',' '\n' | awk 'NF && !seen[$0]++'
+  fi
+}
+
 # session_scope_mint <root> <session_id> <company_slug> [agent_id]
 #   Write scope-capability.json for the exact caller. Main-thread writes retain
 #   the legacy shape/path for one-restart compatibility.
@@ -89,3 +166,27 @@ session_scope_mint() {
     || { rm -f "$tmp"; return 1; }
   mv "$tmp" "$cap"
 }
+
+# session_scope_mint_set <root> <session_id> <comma-separated-slugs> [agent_id]
+session_scope_mint_set() {
+  local root="${1:-}" sid="${2:-}" slugs="${3:-}" aid="${4:-}" first rest slug json
+  [ -n "$slugs" ] || return 1
+  first="${slugs%%,*}"
+  case "$first" in ''|*[!a-zA-Z0-9_-]*) return 1 ;; esac
+  rest="${slugs#"$first"}"
+  while [ -n "$rest" ]; do
+    case "$rest" in ,*) rest="${rest#,}" ;; *) return 1 ;; esac
+    slug="${rest%%,*}"
+    case "$slug" in ''|*[!a-zA-Z0-9_-]*) return 1 ;; esac
+    rest="${rest#"$slug"}"
+    [ "$rest" = "$slug" ] && break
+  done
+  json="$(jq -nc --arg slugs "$slugs" '$slugs | split(",") | reduce .[] as $slug ([]; if index($slug) == null then . + [$slug] else . end)')" || return 1
+  session_scope_mint "$root" "$sid" "$first" "$aid" || return 1
+  local cap tmp minted_at
+  cap="$(session_scope_capability_path "$root" "$sid" "$aid")" || return 1
+  minted_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  tmp="$(mktemp)"
+  jq --argjson slugs "$json" --arg minted_at "$minted_at" '.company_slugs=$slugs | .minted_at=$minted_at' "$cap" >"$tmp" || { rm -f "$tmp"; return 1; }
+  mv "$tmp" "$cap"
+}

package/dist/command-catalog.generated.d.ts

@@ -1723,6 +1723,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--only <keys>";
             readonly description: "Secret names to inject (comma-separated; may be repeated) (required)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--company <slug>";
+            readonly description: "Company slug (resolves to companyUid)";
+            readonly hidden: false;
         }, {
             readonly flags: "--script <path>";
             readonly description: "Attach local script identity for script-locked secrets";

package/dist/command-catalog.generated.js

@@ -2065,6 +2065,11 @@ export const COMMAND_CATALOG = [
                         "description": "Secret names to inject (comma-separated; may be repeated) (required)",
                         "hidden": false
                     },
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Company slug (resolves to companyUid)",
+                        "hidden": false
+                    },
                     {
                         "flags": "--script <path>",
                         "description": "Attach local script identity for script-locked secrets",

package/dist/commands/core-hq-session-native.d.ts

@@ -28,7 +28,9 @@ export type HqSessionDependencies = {
         stderr: string;
         error?: Error;
     };
+    multiCompanyLockEnabled: boolean;
 };
+export { validSessionId } from "../lib/core-utils/session-id.js";
 /** In-process command body, with injectable file access for parity tests. */
 export declare function executeHqSession(argv: readonly string[], context: {
     cwd: string;