company-skill 4.6.6 → 4.6.8

package/README.md

@@ -2,10 +2,27 @@
 
 [![npm](https://img.shields.io/npm/v/company-skill)](https://www.npmjs.com/package/company-skill) [![npm downloads](https://img.shields.io/npm/dw/company-skill)](https://www.npmjs.com/package/company-skill) [![CI](https://github.com/jagmarques/company-skill/actions/workflows/check.yml/badge.svg)](https://github.com/jagmarques/company-skill/actions/workflows/check.yml) [![license](https://img.shields.io/npm/l/company-skill)](LICENSE)
 
-**The agent company that can't stop until the work is verified done.**
+**The agent company that can't stop until the work is verified done**
 
 Your agent stops when it feels done. This makes it stop only when the work is actually done.
 
+company-skill is a Claude Code skill for multi-agent orchestration. It runs your agents as a company with a verification gate, so a `/company` run cannot stop until every acceptance criterion is reproduced.
+
+## What it is
+
+You give it a goal. It splits the work across sub-agents, runs them in dependency waves, and keeps going across cycles until the result is proven instead of just claimed. It runs unattended. Each cycle re-runs every check, a reviewer attacks anything marked passing, and a stop guard blocks exit while any criterion still fails. Sub-agents get scoped delegation contracts rather than the whole problem. A digest writer compresses each finished cycle so the orchestrator stays under its context window, and work is split across models to keep cost down. Nothing is done until it is verified.
+
+## Who it's for
+
+Reach for it when "looks done" is not good enough and you want the loop to finish the job on its own:
+
+- Build a REST API and prove the tests pass before it stops.
+- Run an overnight refactor that won't quit half-done.
+- Ship a feature where every acceptance criterion is reproduced, not asserted.
+- Hand off a long task and come back to verified output instead of a half-finished draft.
+
+Compared to a single agent or a plain prompt loop, the difference is the gate. A single agent stops when it decides it is finished. A company of agents keeps running, re-checking its own claims each cycle, until the evidence is there. It does not invent work outside the goal, and it tells you plainly when it is blocked.
+
 <p align="center">
   <img src="assets/dashboard.png" alt="Company dashboard showing org tree, context gauge, active agents, and criteria" width="900">
   <br>
@@ -33,12 +50,15 @@ Optionally define your team first in `COMPANY.md` (skip it and a minimal company
 
 Every criterion starts failing. Workers run in dependency waves under delegation contracts. At the end of each cycle, the Internal Reviewer re-runs every VERIFY-WITH command and the Devil's Advocate attacks everything marked passing. The stop guard physically blocks exit until every criterion has `passes: true` with reproduced evidence. Once done, `STATUS.md` and a `playbook.md` update are written for the next session.
 
-```
-GOAL -> THINK -> EXECUTE (parallel waves) -> VERIFY -> Done?
-                                                 |         |
-                                               COMPRESS  STATUS.md
-                                                 |
-                                               THINK (next cycle)
+```mermaid
+flowchart TD
+    GOAL --> THINK
+    THINK --> EXECUTE["EXECUTE (parallel waves)"]
+    EXECUTE --> VERIFY
+    VERIFY -->|all criteria pass| DONE["Done (STATUS.md + playbook)"]
+    VERIFY -->|not done| COMPRESS
+    COMPRESS --> NEXT["THINK (next cycle)"]
+    NEXT --> EXECUTE
 ```
 
 **Roles:** CEO orchestrator, Internal Reviewer, Devil's Advocate, Digest Writer. The orchestrator reads `COMPANY.md`, activates only the roles the goal needs, and writes delegation contracts in dependency order. Workers append FINDING + SOURCE lines to findings files. The Digest Writer compresses each finished cycle into the next cycle's briefing so the orchestrator never carries raw worker output in its own context.
@@ -52,43 +72,90 @@ The dashboard starts automatically when you run `/company` and prints its URL in
 http://127.0.0.1:7421   <- your session's link, printed at startup and in the status bar
 ```
 
+A per-session identity header sits at the top: the project, the session id, the active model, and an "All projects" link to the cross-project roll-up.
+
 What you see, panel by panel:
 
-**Context fill** - the live fill percentage, computed with the same formula the context-guard uses. When the session hits the restart threshold (default 50%), the bar shows "restart due" so you can see the gate before it fires. A toggle in the dashboard controls the auto-restart per session.
+**Context fill** - the live fill percentage, computed with the same formula the context-guard uses. When the session hits the restart threshold (default 50%), the gauge marks the gate before it fires. Next to it sits an Apple-style auto-restart pill, locked on - the restart block is always enforced and the toggle cannot turn it off.
 
-**Delegation tree** - SVG tree of orchestrator, department leads, and workers, with org-chart context filled from COMPANY.md. Click any node to expand its current task and status. Zoom with +/- buttons or the mouse wheel. Drag to pan. Fullscreen button expands it. Zero external JS libraries.
+**Delegation tree** - SVG tree of orchestrator, department leads, and workers, with org-chart context filled from COMPANY.md. Click any node to expand its current task and status. Zoom only with the pill-shaped +/- buttons, or use the expand button to blow the tree up to fill the screen and the contract button to bring it back. Drag to pan. A refresh resets the tree to its default view. Zero external JS libraries.
+
+**Cycles and memory** - a savings card that shows human cycle and memory counts plus the dollars saved by model tiering and prompt caching, each marked approximate.
 
 **Active agents** - centered live table of every agent the orchestrator has spawned this session, with model, status, and token count.
 
 **Criteria** - compact progress view with a click-to-expand toggle for the full pass/fail list and reproduced evidence.
 
+**All projects** - the "All projects" link near the session header opens `/all`, a cross-project roll-up. It reads `~/.claude/company-dashboards.json`, a small index every dashboard writes itself into, and shows aggregate cost, tokens, and cache reuse grouped by project. It lists only dashboards seen in the last 5 minutes, costs come from ccusage and are notional on a subscription plan, and a session whose usage row is missing shows `?` rather than zero. Each row links back to that session's own dashboard.
+
 The dashboard binds 127.0.0.1 only, reads local files, and sends nothing anywhere. Override the port with `COMPANY_DASHBOARD_PORT`.
 
+**You get this automatically.** Installing company-skill (npm or the install script) copies `dashboard.js` and `statusline.js` alongside the rest of the skill. Running `/company` then starts the dashboard for you and prints its localhost URL at startup and in the status line. No extra setup.
+
+### Status line
+
+`scripts/statusline.js` appends a labelled link to the per-session dashboard so the URL is one glance away on every turn. The appended segment is `📊 company dashboard <url>`.
+
+With no status line of your own configured, it also renders the model and context fill. The context fill draws as a progress bar using Claude's native used_percentage so the number matches the session indicator, so the full line reads:
+
+```
+Opus 4.8 (1M context)  |  [████░░░░░░] 25%  |  📊 company dashboard http://127.0.0.1:7421
+```
+
+If you already have a status line, the setup step stores your prior command in `.company/statusline-base.json` and runs it first. Your line leads, the script appends only the link, and it does not re-print model or context since your own line owns those:
+
+```
+<your status line>  |  📊 company dashboard http://127.0.0.1:7421
+```
+
+
+## Unattended auto-restart loop
+
+`scripts/company-autoloop.js` runs `/company` unattended across many sessions. It restarts into a fresh context automatically when a work session approaches the context threshold, so a long goal keeps going without a human pasting the restart prompt each time.
+
+A script is needed because a fully unattended fresh-context restart cannot be done with Claude Code native features alone. Hooks cannot run `/clear` or start a fresh turn, a Stop-hook block keeps the same context, and auto-compaction only summarizes. The supervisor is the external driver that owns the restart decision. This is the validated finding.
+
+Each turn runs a headless `claude -p` session while the supervisor watches the session context fill. At the threshold it drives `/company restart` to emit the `NEXT.md` continuation, then launches a fresh session seeded from it.
+
+```bash
+node scripts/company-autoloop.js --max-turns 100 "/company GOAL: <your goal>"
+```
+
+Key flags and env:
+
+- `--project-dir <path>` the project the run targets (default: current dir)
+- `--company-dir <path>` override the `.company` dir (default: `<project-dir>/.company`)
+- `--max-turns <n>` hard cap on work turns across all sessions (default: 100)
+- `--restart-timeout-secs <n>` max wait for the restart markers (default: 420)
+- `COMPANY_CONTEXT_THRESHOLD` fill fraction or percent that triggers a restart (default: 0.50, set a low value for testing)
+
+It runs with `--permission-mode bypassPermissions` for the autonomy an unattended loop needs. The threshold is configurable, so you can drop it low to exercise the restart path during testing.
+
 
 ## Cost and quality
 
 Multi-agent orchestration buys quality with tokens. /company's answer to the token cost: spend strong-model tokens only where they buy quality, and report the bill every cycle.
 
-**Tiered model delegation.** Each delegation contract carries a `MODEL: cheap|mid|strong` tag. The orchestrator maps the tag to a model at spawn time. Effort scales with both ROI and stakes - high-stakes or high-value work gets heavier spawn. Override every sub-agent with `CLAUDE_CODE_SUBAGENT_MODEL` at launch, or write `FORCE_BEST` into `.company/MODEL_POLICY` mid-run.
+**Tiered model delegation** - each delegation contract carries a `MODEL: cheap|mid|strong` tag. The orchestrator maps the tag to a model at spawn time. Effort scales with both ROI and stakes - high-stakes or high-value work gets heavier spawn. Override every sub-agent with `CLAUDE_CODE_SUBAGENT_MODEL` at launch, or write `FORCE_BEST` into `.company/MODEL_POLICY` mid-run.
 
-**Per-cycle cost reporting.** Every cycle produces a `COST:` line in the briefing and a `cycles/cycle-{N}-cost.json` artifact.
+**Per-cycle cost reporting** - every cycle produces a `COST:` line in the briefing and a `cycles/cycle-{N}-cost.json` artifact.
 
-**Prompt caching.** Agent prompts are laid out stable-first so repeated spawns hit a shared cache prefix.
+**Prompt caching** - agent prompts are laid out stable-first so repeated spawns hit a shared cache prefix.
 
-**Fable 5 / adaptive thinking.** On models that support adaptive thinking (Fable 5 and later), the orchestrator and verify layers run with thinking enabled. No `budget_tokens` param - reflection depth is model-controlled.
+**Fable 5 / adaptive thinking** - on models that support adaptive thinking (Fable 5 and later), the orchestrator and verify layers run with thinking enabled. No `budget_tokens` param - reflection depth is model-controlled.
 
 
 ## Key features
 
-**Stop guard** - blocks session exit until every criterion has `passes: true` and reproduced evidence. Malformed state blocks rather than fails open. Deleting a hard criterion blocks instead of unlocking. [34-check test](tests/stop-guard.test.js).
+**Stop guard** - blocks session exit until every criterion has `passes: true` and reproduced evidence. Malformed state blocks rather than fails open. Deleting a hard criterion blocks instead of unlocking. [42-check test](tests/stop-guard.test.js).
 
-**Context-fill guard** - a second Stop hook forces `/company restart` once context reaches the threshold (default 50%). Reads the model id from the transcript to detect the context window. Per-session auto-restart toggle in the dashboard. [37-check test](tests/context-guard.test.js).
+**Context-fill guard** - a second Stop hook forces `/company restart` once context reaches the threshold (default 50%). Reads the model id from the transcript to detect the context window. The restart block is always on and the dashboard shows it as a locked Apple-style pill toggle. [63-check test](tests/context-guard.test.js).
 
-**Delegation contracts** - a task does not exist without a filled contract. `check-contracts.js` rejects missing fields, vacuous VERIFY-WITH commands, invalid MODEL tiers, and cyclic dependencies. [17-check test](tests/check-contracts.test.js).
+**Delegation contracts** - a task does not exist without a filled contract. `check-contracts.js` rejects missing fields, vacuous VERIFY-WITH commands, invalid MODEL tiers, and cyclic dependencies. [29-check test](tests/check-contracts.test.js).
 
-**Multi-level verification.** The Internal Reviewer re-runs every VERIFY-WITH command independently. The Devil's Advocate attacks everything marked passing. For criteria tagged `stakes: "high"` in `criteria.json` (irreversible action, security surface, or public-facing claim), the critic runs in three fresh contexts with distinct lenses - correctness, security, reproducibility - and unanimous ACCEPT is required. Normal criteria keep the single critic. The completeness probe enumerates every surface the GOAL names and auto-rejects any unchecked one.
+**Multi-level verification** - the Internal Reviewer re-runs every VERIFY-WITH command independently. The Devil's Advocate attacks everything marked passing. For criteria tagged `stakes: "high"` in `criteria.json` (irreversible action, security surface, or public-facing claim), the critic runs in three fresh contexts with distinct lenses - correctness, security, reproducibility - and unanimous ACCEPT is required. Normal criteria keep the single critic. The completeness probe enumerates every surface the GOAL names and auto-rejects any unchecked one.
 
-**Design judge-panel.** For criteria tagged `kind: design`, the lead may emit up to three contracts from materially different angles plus one synthesis contract, reserved for genuine design forks.
+**Design judge-panel** - for criteria tagged `kind: design`, the lead may emit up to three contracts from materially different angles plus one synthesis contract, reserved for genuine design forks.
 
 **Git isolation** - workers never push to main and never merge. Every code change lands as a draft PR. The merge gate is yours.
 
@@ -96,7 +163,7 @@ Multi-agent orchestration buys quality with tokens. /company's answer to the tok
 
 **Codebase graph** - on repos with >200 tracked files, `scripts/codegraph.js` builds a commit-keyed ranked symbol map into `.company/codegraph/` for lead prompts.
 
-**Status-line link** - `scripts/statusline.js` appends the per-session dashboard URL to the Claude Code status bar, enforced idempotently on every `/company` run.
+**Status-line link** - `scripts/statusline.js` appends a labelled `📊 company dashboard <url>` segment to the Claude Code status bar, enforced idempotently on every `/company` run. The link resolves in any session through a cwd-independent global registry, with an `/all` fallback. It chains any status line you already have and never re-prints model or context when one is present. See [Status line](#status-line).
 
 
 ## Commands
@@ -128,7 +195,7 @@ State lives in `./.company/` (relocate with `COMPANY_DIR`):
 
 ## Examples
 
-[`startup.md`](examples/startup.md), [`research-lab.md`](examples/research-lab.md), [`dev-team.md`](examples/dev-team.md), [`nexusquant.md`](examples/nexusquant.md).
+[`startup.md`](examples/startup.md), [`research-lab.md`](examples/research-lab.md), [`dev-team.md`](examples/dev-team.md).
 
 
 ## Contributing

package/hooks/context-guard.js

@@ -48,7 +48,7 @@ function parseThreshold() {
   return v > 1 ? v / 100 : v;
 }
 
-// Hard ceiling: the toggle CANNOT suppress a block at or above this level.
+// Hard ceiling: a higher informational level that changes the block wording only.
 // Default 0.80. Overridable via COMPANY_CONTEXT_HARD_CEILING (fraction or percent).
 // If the parsed value is below the soft threshold, it is clamped up to the threshold.
 function parseHardCeiling(threshold) {
@@ -171,40 +171,30 @@ const fill = used / contextWindow;
 
 if (fill < threshold) process.exit(0);
 
-// Per-session toggle: read .company/context-guard-config.json for this session.
-// Shape: { "sessions": { "<id>": { "enforceRestart": true|false } } }
-// Default (no file, no entry, parse error) = enforceRestart: true (safe default).
-// If enforceRestart === false for this session, and fill is BELOW the hard ceiling,
-// the toggle suppresses the soft-threshold block. At or above the hard ceiling the
-// toggle has no effect and we fall through to block unconditionally.
-if (sessionId && fill < hardCeiling) {
-  const cfgPath = path.join(companyDir, 'context-guard-config.json');
-  try {
-    const cfgRaw = fs.readFileSync(cfgPath, 'utf8');
-    const cfg = JSON.parse(cfgRaw);
-    if (cfg && typeof cfg === 'object' &&
-        cfg.sessions && typeof cfg.sessions === 'object' &&
-        cfg.sessions[sessionId] && typeof cfg.sessions[sessionId] === 'object' &&
-        cfg.sessions[sessionId].enforceRestart === false) {
-      // Toggle is OFF and below the hard ceiling: allow through without blocking
-      process.exit(0);
-    }
-    // Any other value (true, missing, or unknown) falls through to block
-  } catch (e) {
-    // File missing or parse error: treat as enforceRestart=true (safe default)
-  }
-}
+// At or above the soft threshold the restart block is UNCONDITIONAL.
+// No per-session suppression exists: the enforceRestart toggle was removed because
+// a session at or above the threshold must always restart (founder-firm invariant).
+// The hard ceiling only changes the wording of the block, never whether it fires.
 
 // Fill is at or above threshold. Check the de-loop state file before blocking.
-// De-loop state is SESSION-SCOPED: stored as JSON { "sessionId": "<id>", "tokens": <n> }.
+// De-loop state is SESSION-SCOPED JSON { "sessionId", "tokens", "releasedAtTokens"? }.
 // A state file from a different session (or a legacy bare-number file) is treated as
 // no prior fire for this session (lastFiredTokens = -1). This prevents a prior
 // session's high-water mark from suppressing a first-fire in a fresh session.
 // Within a session: first fire blocks + writes { sessionId, tokens }; subsequent stops
 // with grown tokens require the debate artifact; a token DROP re-arms unconditionally.
+// Once a debate is honored the release is STICKY: releasedAtTokens records the fill at
+// which the restart was released so re-stops at the same fill stay quiet (no re-demand
+// loop), mirroring how CANCEL is persistent.
 const stateFile = path.join(companyDir, '.context-guard-state');
 
+// Margin (5% of the context window) of new accumulation past the released high-water
+// before a fresh restart demand is legitimate again. Below this, the session is treated
+// as already released at this fill and the guard stays quiet.
+const RELEASE_MARGIN_TOKENS = Math.round(contextWindow * 0.05);
+
 let lastFiredTokens = -1;
+let releasedAtTokens = -1;
 try {
   const raw = fs.readFileSync(stateFile, 'utf8').trim();
   // Attempt JSON parse first (session-scoped format).
@@ -219,10 +209,30 @@ try {
       typeof parsed.tokens === 'number') {
     // State belongs to the current session: honor it.
     lastFiredTokens = parsed.tokens;
+    if (typeof parsed.releasedAtTokens === 'number') releasedAtTokens = parsed.releasedAtTokens;
   }
   // Null sessionId either side, legacy bare-number, or different session: treat as fresh.
 } catch (e) {}
 
+// Sticky release: a restart already honored at releasedAtTokens silences the guard for
+// re-stops at the same-or-similar fill. Only a meaningful rise past the margin re-arms.
+if (releasedAtTokens >= 0) {
+  if (used <= releasedAtTokens + RELEASE_MARGIN_TOKENS) process.exit(0);
+  // Fill rose meaningfully above the released high-water: genuine new accumulation.
+  // Re-arm by recording a fresh first-fire at this fill and block once.
+  try { fs.writeFileSync(stateFile, JSON.stringify({ sessionId: sessionId, tokens: used })); } catch (e) {}
+  const sessionTagRearm = sessionId ? ' [session ' + sessionId + ']' : '';
+  const pctRearm = Math.round(fill * 100);
+  console.log(JSON.stringify({
+    decision: 'block',
+    reason: '[COMPANY] Context at ' + pctRearm + '% (grew past the prior restart point). ' +
+      'Run /company restart NOW: quiesce in-flight agents, commit their work as draft PRs, ' +
+      'refresh STATUS/NEXT, run the restart debate gate, and emit the verified continuation prompt. ' +
+      'This is enforced, not advisory - do not continue new work.' + sessionTagRearm,
+  }));
+  process.exit(0);
+}
+
 if (lastFiredTokens >= 0) {
   // Fired once already this session. Re-arm unconditionally when tokens dropped below
   // the fire count (a genuine context reset happened). Otherwise gate on the debate artifact.
@@ -253,8 +263,13 @@ if (lastFiredTokens >= 0) {
   } catch (e) {}
 
   if (artifactFresh) {
-    // Debate recorded. Allow the stop and re-arm for the next cycle.
-    try { fs.writeFileSync(stateFile, JSON.stringify({ sessionId: sessionId, tokens: -1 })); } catch (e) {}
+    // Debate recorded. Allow the stop and record a STICKY release at this fill so the
+    // next stop at the same-or-similar fill does not re-demand the debate in a loop.
+    try {
+      fs.writeFileSync(stateFile, JSON.stringify({
+        sessionId: sessionId, tokens: used, releasedAtTokens: used,
+      }));
+    } catch (e) {}
     // Best-effort: remove the consumed artifact so a stale one cannot release
     // a future fire. Failure is ignored (artifact absence is also safe).
     try { fs.unlinkSync(artifactPath); } catch (e) {}
@@ -287,7 +302,7 @@ const sessionTag = sessionId ? ' [session ' + sessionId + ']' : '';
 const atHardCeiling = fill >= hardCeiling;
 const reason = atHardCeiling
   ? '[COMPANY] Context at ' + pct + '% (>= ' + ceilPct + '% HARD CEILING). ' +
-    'The per-session enforceRestart toggle CANNOT suppress this restart. ' +
+    'This restart is always enforced and cannot be suppressed per-session. ' +
     'Run /company restart NOW: quiesce in-flight agents, commit their work as draft PRs, ' +
     'refresh STATUS/NEXT, run the restart debate gate, and emit the verified continuation prompt.' +
     sessionTag

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "company-skill",
-  "version": "4.6.6",
+  "version": "4.6.8",
   "description": "Goal-driven multi-employee company for Claude Code. Give it a goal, it runs until done.",
   "bin": {
     "company-skill": "./bin/install.js"
@@ -22,6 +22,7 @@
     "scripts/check-contracts.js",
     "scripts/check-findings.js",
     "scripts/restart-debate.js",
+    "scripts/company-autoloop.js",
     "scripts/dashboard.js",
     "scripts/secret-scan.js",
     "scripts/reset-company-guard.js",
@@ -35,7 +36,22 @@
     "README.md",
     "LICENSE"
   ],
-  "keywords": ["claude-code", "skill", "multi-agent", "company", "orchestration", "model-agnostic", "autonomous-agents", "stop-hook", "agent-orchestration", "ai-agents", "fable", "claude-fable", "mythos", "claude-mythos"],
+  "keywords": [
+    "claude-code",
+    "skill",
+    "multi-agent",
+    "company",
+    "orchestration",
+    "model-agnostic",
+    "autonomous-agents",
+    "stop-hook",
+    "agent-orchestration",
+    "ai-agents",
+    "fable",
+    "claude-fable",
+    "mythos",
+    "claude-mythos"
+  ],
   "author": "jagmarques",
   "license": "MIT",
   "repository": {