@indigoai-us/hq-cli 5.126.0 → 5.127.0

package/dist/lib/lanes/spawn.js

@@ -0,0 +1,1363 @@
+/**
+ * Detached lane-worker spawn (spec §5, §5.1, §5.4, §5.5).
+ *
+ * The worker must leave the caller's process tree (`detached: true` / setsid)
+ * with stdio pointed at files in the run directory. Account selection is the
+ * provider home environment variable only. Provider credential files are
+ * probed for existence and never read. Identity in the child is `HQ_LANE_ID`;
+ * mutable fields are re-read from the lane record (spec §5.4).
+ */
+import { spawn, spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { PROVIDER_HOME_ENV, accountStatus, isLoggedOut, resolveAccount, } from "./accounts.js";
+import { COMPACTION_PROMPT, compactionAfterUsage, compactionDue, compactLaneSession, } from "./compaction.js";
+import { installDrainHook } from "./hooks-install.js";
+import { loadLanesConfig, providerCompactAfterMs } from "./config.js";
+import { appendEffortFlag, resolveLaneEffort } from "./effort.js";
+import { claimableStatesFor, planLaneLaunch, providerSupportsSessionResume, } from "./delivery.js";
+import { AccountResolutionError, LanesError } from "./errors.js";
+import { resolveMachineIdentity, } from "./machine-identity.js";
+import { readLane, retryUpdateLane } from "./store.js";
+import { LANE_ENVELOPE_JSON_SCHEMA, parseLaneProvider, } from "./types.js";
+export const LANES_RUNS_REL = path.join("workspace", "lanes-runs");
+/** Written by reconcile before a resume spawn; the worker prompt names this path. */
+export const ANSWERED_QUESTIONS_FILE = "answered-questions.json";
+export const SPAWN_TERMINAL_REASONS = [
+    "account_not_logged_in",
+    "unknown_account",
+    "account_disabled",
+    "no_enabled_account",
+    "spawn_failed",
+    "not_detached",
+    "watcher_not_armed",
+];
+const PROVIDER_COMMAND = {
+    claude: "claude",
+    codex: "codex",
+    grok: "grok",
+};
+export function providerCommandOnPath(command, pathEnv) {
+    // Test and embedded callers can intentionally omit PATH and delegate lookup
+    // to their spawn implementation. A present PATH is authoritative.
+    if (pathEnv === undefined)
+        return true;
+    if (!pathEnv)
+        return false;
+    return pathEnv.split(path.delimiter).some((dir) => {
+        if (!dir)
+            return false;
+        const candidate = path.join(dir, command);
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** Per-provider model flag. A missing entry means --model is refused. */
+export const PROVIDER_MODEL_FLAG = {
+    claude: "--model",
+    codex: "-m",
+    grok: "-m",
+};
+export function parseCliModel(raw) {
+    if (raw === undefined)
+        return undefined;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        throw new LanesError("empty_model", "--model is empty or whitespace-only", {
+            value: raw,
+        });
+    }
+    return trimmed;
+}
+export function resolveLaneModel(input) {
+    if (input.cliModel !== undefined)
+        return input.cliModel;
+    if (input.accountModel !== undefined && input.accountModel.trim().length > 0) {
+        return input.accountModel.trim();
+    }
+    if (input.providerModel !== undefined && input.providerModel.trim().length > 0) {
+        return input.providerModel.trim();
+    }
+    return undefined;
+}
+export function appendModelFlag(provider, args, model) {
+    if (model === undefined)
+        return args;
+    const flag = PROVIDER_MODEL_FLAG[provider];
+    if (flag === undefined) {
+        throw new LanesError("model_unsupported", `Provider ${provider} does not accept --model`, { provider, model });
+    }
+    if (provider === "codex") {
+        // `codex exec -- <prompt>`: an option after `--` is read as a positional.
+        const end = args.indexOf("--");
+        if (end !== -1)
+            return [...args.slice(0, end), flag, model, ...args.slice(end)];
+    }
+    return [...args, flag, model];
+}
+export const PID_LIVENESS_DECISIONS = [
+    "esrch",
+    "starttime_mismatch",
+    "eperm",
+    "starttime_match",
+    "no_recorded_starttime",
+    "starttime_unreadable",
+    "missing_pid_file",
+];
+export function missingPidProbe() {
+    return {
+        pid: null,
+        recorded_starttime: null,
+        live_starttime: null,
+        starttime_error: "ENOENT",
+        alive: false,
+        decided_by: "missing_pid_file",
+    };
+}
+export function defaultPidIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ESRCH")
+            return false;
+        if (code === "EPERM")
+            return true;
+        throw err;
+    }
+}
+export const STOP_TERM_WAIT_MS = 500;
+export const STOP_KILL_WAIT_MS = 200;
+const defaultSpawnProcess = (command, args, options) => spawn(command, args, options);
+function defaultKillProcess(pid, signal = "SIGTERM") {
+    process.kill(pid, signal);
+}
+export function parseSpawnTerminalReason(value) {
+    if (SPAWN_TERMINAL_REASONS.includes(value)) {
+        return value;
+    }
+    throw new LanesError("unknown_spawn_reason", `Unknown spawn terminal reason ${JSON.stringify(value)}. Accepted: ${SPAWN_TERMINAL_REASONS.join(", ")}`, { accepted: [...SPAWN_TERMINAL_REASONS], value });
+}
+export function laneRunDir(hqRoot, laneId) {
+    return path.join(hqRoot, LANES_RUNS_REL, laneId);
+}
+export function watcherMainPath() {
+    return fileURLToPath(new URL("./watcher-main.js", import.meta.url));
+}
+export function parseProcStat(text) {
+    const open = text.indexOf("(");
+    const close = text.lastIndexOf(")");
+    if (open <= 0 || close <= open) {
+        throw new LanesError("proc_stat_unreadable", "Could not parse /proc/<pid>/stat", { text: text.slice(0, 120) });
+    }
+    const pid = Number(text.slice(0, open).trim());
+    const rest = text.slice(close + 1).trim().split(/\s+/);
+    const ppid = Number(rest[1]);
+    const pgrp = Number(rest[2]);
+    const session = Number(rest[3]);
+    if (![pid, ppid, pgrp, session].every((n) => Number.isInteger(n))) {
+        throw new LanesError("proc_stat_unreadable", "Could not parse pid/ppid/pgrp/session from /proc/<pid>/stat", { text: text.slice(0, 120) });
+    }
+    // /proc/<pid>/stat fields are 1-indexed and `rest` begins at field 3 (state),
+    // so field N lives at rest[N - 3]. starttime is field 22 -> rest[19].
+    // rest[21] is field 24 (rss), which at spawn is a page count like 1 and grows
+    // as the process runs — recording it made every fresh lane look dead within
+    // seconds of starting.
+    const startRaw = rest[19];
+    const starttime = startRaw !== undefined ? Number(startRaw) : undefined;
+    return {
+        pid,
+        ppid,
+        pgrp,
+        session,
+        starttime: Number.isInteger(starttime) ? starttime : undefined,
+    };
+}
+export function readProcStarttimeDetailed(pid) {
+    const proc = path.join("/proc", String(pid), "stat");
+    try {
+        const starttime = parseProcStat(fs.readFileSync(proc, "utf8")).starttime;
+        if (starttime === undefined)
+            return { starttime: null, error: "missing_field" };
+        return { starttime, error: null };
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return { starttime: null, error: "ENOENT" };
+        process.stderr.write(`hq lanes: failed to read starttime for pid ${pid}: ${err instanceof Error ? err.message : String(err)}\n`);
+        return {
+            starttime: null,
+            error: typeof code === "string" ? code : "unreadable",
+        };
+    }
+}
+export function readProcStarttime(pid) {
+    return readProcStarttimeDetailed(pid).starttime;
+}
+export function formatPidRecord(rec) {
+    return rec.starttime !== undefined ? `${rec.pid} ${rec.starttime}\n` : `${rec.pid}\n`;
+}
+export function parsePidRecord(text) {
+    const tokens = text.trim().split(/\s+/);
+    const pid = Number(tokens[0]);
+    if (!Number.isInteger(pid) || pid <= 0)
+        return null;
+    const starttime = tokens[1] !== undefined ? Number(tokens[1]) : undefined;
+    return {
+        pid,
+        starttime: Number.isInteger(starttime) ? starttime : undefined,
+    };
+}
+export function readPidRecord(filePath) {
+    try {
+        return parsePidRecord(fs.readFileSync(filePath, "utf8"));
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return null;
+        process.stderr.write(`hq lanes: failed to read pid file ${filePath}: ${err instanceof Error ? err.message : String(err)}\n`);
+        throw err;
+    }
+}
+export function writePidRecord(filePath, rec) {
+    writeText(filePath, formatPidRecord(rec));
+}
+export function probePidRecord(rec, isAlive = defaultPidIsAlive, readStarttime = readProcStarttime) {
+    const recorded = rec.starttime ?? null;
+    const base = { pid: rec.pid, recorded_starttime: recorded };
+    let killAlive;
+    let killDecision = "starttime_match";
+    try {
+        killAlive = isAlive(rec.pid);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ESRCH") {
+            return {
+                ...base,
+                live_starttime: null,
+                starttime_error: null,
+                alive: false,
+                decided_by: "esrch",
+            };
+        }
+        if (code === "EPERM") {
+            killAlive = true;
+            killDecision = "eperm";
+        }
+        else {
+            throw err;
+        }
+    }
+    if (!killAlive) {
+        return {
+            ...base,
+            live_starttime: null,
+            starttime_error: null,
+            alive: false,
+            decided_by: "esrch",
+        };
+    }
+    if (recorded === null) {
+        return {
+            ...base,
+            live_starttime: null,
+            starttime_error: null,
+            alive: true,
+            decided_by: killDecision === "eperm" ? "eperm" : "no_recorded_starttime",
+        };
+    }
+    let live;
+    let starttime_error = null;
+    try {
+        live = readStarttime(rec.pid);
+        if (live === null)
+            starttime_error = "unreadable";
+    }
+    catch (err) {
+        const code = err.code;
+        live = null;
+        starttime_error = typeof code === "string" ? code : "unreadable";
+    }
+    if (live === null) {
+        return {
+            ...base,
+            live_starttime: null,
+            starttime_error,
+            alive: true,
+            decided_by: "starttime_unreadable",
+        };
+    }
+    if (live !== recorded) {
+        return {
+            ...base,
+            live_starttime: live,
+            starttime_error: null,
+            alive: false,
+            decided_by: "starttime_mismatch",
+        };
+    }
+    return {
+        ...base,
+        live_starttime: live,
+        starttime_error: null,
+        alive: true,
+        decided_by: killDecision === "eperm" ? "eperm" : "starttime_match",
+    };
+}
+export function isPidRecordAlive(rec, isAlive = defaultPidIsAlive, readStarttime = readProcStarttime) {
+    return probePidRecord(rec, isAlive, readStarttime).alive;
+}
+function blockingSleep(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+export function signalProcessGroup(pid, signal, killProcess) {
+    try {
+        killProcess(-pid, signal);
+        return;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ESRCH")
+            return;
+        if (code !== "EINVAL" && code !== "EPERM") {
+            process.stderr.write(`hq lanes: process-group ${signal} for pid ${pid} failed: ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+    }
+    try {
+        killProcess(pid, signal);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ESRCH")
+            return;
+        process.stderr.write(`hq lanes: ${signal} for pid ${pid} failed: ${err instanceof Error ? err.message : String(err)}\n`);
+        throw err;
+    }
+}
+export function stopLaneProcesses(hqRoot, laneId, deps = {}) {
+    const killProcess = deps.killProcess ?? defaultKillProcess;
+    const isAlive = deps.isAlive ??
+        ((pid) => {
+            try {
+                process.kill(pid, 0);
+                return true;
+            }
+            catch (err) {
+                const code = err.code;
+                if (code === "ESRCH")
+                    return false;
+                if (code === "EPERM")
+                    return true;
+                throw err;
+            }
+        });
+    const sleepMs = deps.sleepMs ?? blockingSleep;
+    const readStarttime = deps.readStarttime ?? readProcStarttime;
+    const runDir = laneRunDir(hqRoot, laneId);
+    const worker = readPidRecord(path.join(runDir, "worker.pid"));
+    const watcher = readPidRecord(path.join(runDir, "watcher.pid"));
+    const signals = [];
+    const targets = [worker, watcher].filter((rec) => rec !== null);
+    const fire = (rec, signal) => {
+        if (!isPidRecordAlive(rec, isAlive, readStarttime))
+            return;
+        signals.push({ pid: rec.pid, signal, group: true });
+        signalProcessGroup(rec.pid, signal, killProcess);
+    };
+    for (const rec of targets)
+        fire(rec, "SIGTERM");
+    if (targets.some((rec) => isPidRecordAlive(rec, isAlive, readStarttime))) {
+        sleepMs(STOP_TERM_WAIT_MS);
+    }
+    for (const rec of targets) {
+        if (isPidRecordAlive(rec, isAlive, readStarttime))
+            fire(rec, "SIGKILL");
+    }
+    return { worker, watcher, signals };
+}
+export function defaultProveDetached(pid, deps = {}) {
+    const proc = path.join("/proc", String(pid), "stat");
+    try {
+        const text = deps.readProcStatText
+            ? deps.readProcStatText(pid)
+            : fs.readFileSync(proc, "utf8");
+        const parsed = parseProcStat(text);
+        const leader = parsed.pid === pid && parsed.pgrp === parsed.pid && parsed.session === parsed.pgrp;
+        return {
+            detached: leader,
+            pid,
+            pgid: parsed.pgrp,
+            sid: parsed.session,
+            method: "proc_stat_session_leader",
+            reason: leader ? undefined : "not_session_leader",
+        };
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT") {
+            process.stderr.write(`hq lanes: failed to read ${proc}: ${err instanceof Error ? err.message : String(err)}\n`);
+            throw err;
+        }
+    }
+    try {
+        process.kill(pid, 0);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ESRCH") {
+            return { detached: false, pid, method: "pid_alive", reason: "pid_not_alive" };
+        }
+        if (code !== "EPERM") {
+            process.stderr.write(`hq lanes: liveness probe for pid ${pid} failed: ${err instanceof Error ? err.message : String(err)}\n`);
+            throw err;
+        }
+    }
+    const psProof = proveDetachedViaPs(pid);
+    if (psProof)
+        return psProof;
+    return {
+        detached: false,
+        pid,
+        method: "pid_alive_without_proc",
+        reason: "not_session_leader",
+    };
+}
+function proveDetachedViaPs(pid) {
+    try {
+        const result = spawnSync("ps", ["-p", String(pid), "-o", "pid=,pgid="], {
+            encoding: "utf8",
+            timeout: 500,
+        });
+        if (result.error || result.status !== 0)
+            return null;
+        const parts = (result.stdout ?? "").trim().split(/\s+/).map(Number);
+        if (parts.length < 2 || parts.some((n) => !Number.isInteger(n)))
+            return null;
+        const psPid = parts[0];
+        const pgid = parts[1];
+        const leader = psPid === pid && pgid === pid;
+        return {
+            detached: leader,
+            pid,
+            pgid,
+            method: "ps_session_leader",
+            reason: leader ? undefined : "not_session_leader",
+        };
+    }
+    catch (err) {
+        process.stderr.write(`hq lanes: ps detach proof failed for pid ${pid}: ${err instanceof Error ? err.message : String(err)}\n`);
+        return null;
+    }
+}
+export function nextEnvelopePath(runDir) {
+    const dir = path.join(runDir, "envelopes");
+    let n = 1;
+    while (true) {
+        const name = `${String(n).padStart(3, "0")}.json`;
+        const filePath = path.join(dir, name);
+        if (!fs.existsSync(filePath))
+            return filePath;
+        n += 1;
+        if (n > 999) {
+            throw new LanesError("envelope_sequence_exhausted", `No free envelope slot under ${dir}`, { dir });
+        }
+    }
+}
+export function envelopeInstruction(envelopePath) {
+    return (`When finished, write a JSON object to ${envelopePath} using these key names exactly: ` +
+        `schema_version, decision, summary, story_status, artifacts, story_complete, story_complete_reason, questions, blocked_reason. ` +
+        `schema_version must be the exact string "hq-lane-envelope.v1". ` +
+        `decision must be one of "done", "ask", "blocked". ` +
+        `summary is a string. ` +
+        `story_status must be one of "queued", "in_progress", "review", "done". ` +
+        `artifacts is an array. ` +
+        `story_complete is a boolean and story_complete_reason is a non-empty string. ` +
+        `story_complete true requires story_status done and a reason stating what was delivered and how it was verified. ` +
+        `story_complete false requires story_status other than done and a reason stating what is still missing. ` +
+        `questions is present and non-empty exactly when decision is "ask". ` +
+        `blocked_reason is present exactly when decision is "blocked".`);
+}
+/**
+ * Standing authorization carried by every brief and every resume turn. A
+ * lane that ends each turn asking "continue or stop" has asked the operator
+ * to re-grant what the brief already granted; the paragraph names that as
+ * out of bounds and says what a `decision: ask` envelope is for.
+ */
+export const STANDING_AUTHORIZATION = "STANDING AUTHORIZATION. This brief authorises completing every item it lists; " +
+    "you do not need to ask before finishing any of them. " +
+    'A "decision": "ask" envelope is only for a decision this brief does not settle, ' +
+    "and it must name that decision and its options. " +
+    'Do not raise a question whose options amount to "continue" or "stop" the work this brief describes; ' +
+    "continue that work until it is complete or you are blocked on something only the operator can supply.";
+/**
+ * Foreground-only rule carried next to the standing authorization. Two lanes
+ * ended `interrupted` after backgrounding a slow test suite and ending the
+ * turn while it was still running; nothing in the brief said not to.
+ */
+export const FOREGROUND_ONLY_RULE = "FOREGROUND ONLY. Run every command, test suite and check in the foreground and wait for it to finish. " +
+    "Never background a process and end the turn while it is still running. " +
+    "A turn that ends before the envelope is written is classified interrupted, " +
+    "and whatever the background process produces afterwards is not read.";
+/**
+ * The answers as written by the reconcile pass (`answered-questions.json`),
+ * reduced to id + choice. A malformed file reads as no inline answers; the
+ * path is still named so the worker can read it.
+ */
+export function readAnsweredQuestionLines(answersPath) {
+    let text;
+    try {
+        text = fs.readFileSync(answersPath, "utf8");
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return [];
+        process.stderr.write(`hq lanes: failed to read ${answersPath}: ${err instanceof Error ? err.message : String(err)}\n`);
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        process.stderr.write(`hq lanes: ${answersPath} is not JSON: ${err instanceof Error ? err.message : String(err)}\n`);
+        return [];
+    }
+    if (!Array.isArray(parsed))
+        return [];
+    const out = [];
+    for (const item of parsed) {
+        if (!item || typeof item !== "object")
+            continue;
+        const rec = item;
+        if (typeof rec.question_id !== "string")
+            continue;
+        const line = {
+            question_id: rec.question_id,
+            choice: typeof rec.choice === "string" ? rec.choice : JSON.stringify(rec.choice ?? null),
+        };
+        if (typeof rec.notes === "string" && rec.notes.length > 0)
+            line.notes = rec.notes;
+        out.push(line);
+    }
+    return out;
+}
+export function resumePrompt(input) {
+    const parts = [];
+    if (input.resumedFrom !== undefined) {
+        parts.push(`The operator resumed this lane from state ${input.resumedFrom}. ` +
+            (input.resumedFrom === "interrupted"
+                ? "The previous run ended without writing its envelope; continue the work from where it stopped."
+                : "Continue the work from where the previous run stopped."));
+    }
+    if (input.operatorMessage !== undefined) {
+        parts.push("OPERATOR INSTRUCTION (outranks the lane brief). " +
+            "The following message was sent to this lane by the operator. Treat it as an operator instruction that outranks the brief.\n\n" +
+            input.operatorMessage);
+    }
+    if (input.answersPath !== undefined) {
+        const lines = (input.answers ?? []).map((item) => item.notes !== undefined
+            ? `- ${item.question_id}: ${item.choice}\n  Operator notes: ${item.notes}`
+            : `- ${item.question_id}: ${item.choice}`);
+        parts.push([
+            `Previously answered questions are at ${input.answersPath}; treat those choices and the operator notes under them as operator decisions that outrank the brief. Continue the work.`,
+            ...(lines.length > 0 ? ["Answers:", ...lines] : []),
+        ].join("\n"));
+    }
+    // Every resume turn carries the authorization, including a textless
+    // `hq lanes resume`: a pre-upgrade session's brief never had the paragraph.
+    if (input.operatorMessage !== undefined ||
+        input.answersPath !== undefined ||
+        input.resumedFrom !== undefined) {
+        parts.push(STANDING_AUTHORIZATION);
+        parts.push(FOREGROUND_ONLY_RULE);
+    }
+    parts.push(envelopeInstruction(input.envelopePath));
+    return parts.join("\n\n");
+}
+/** Spec §4: the one repair turn. Schema, parser error, raw text, JSON only. */
+export function envelopeRepairPrompt(input) {
+    const maxRawTextChars = 24_000;
+    const rawText = input.rawText.length <= maxRawTextChars
+        ? input.rawText
+        : `${input.rawText.slice(0, 12_000)}\n\n[... raw envelope truncated; inspect ${input.envelopePath} for the complete file ...]\n\n${input.rawText.slice(-12_000)}`;
+    return [
+        `The file you wrote at ${input.envelopePath} is not a valid hq-lane-envelope.v1. ` +
+            `This is the single repair turn: rewrite that file so it validates, and do nothing else.`,
+        `Parser error: ${input.error}`,
+        "Schema:",
+        JSON.stringify(LANE_ENVELOPE_JSON_SCHEMA, null, 2),
+        "Your previous output was:",
+        rawText,
+        `Write the corrected JSON object to ${input.envelopePath}, overwriting it. ` +
+            `Output only that JSON. Do not add keys the schema does not name, and do not resume the task.`,
+    ].join("\n\n");
+}
+export function buildProviderCommand(provider, input) {
+    const parsed = parseLaneProvider(provider);
+    const command = PROVIDER_COMMAND[parsed];
+    if (input.resume && !providerSupportsSessionResume(parsed)) {
+        throw new LanesError("resume_unsupported", `Provider ${parsed} cannot resume an exited worker from a session id`, { provider: parsed });
+    }
+    if (input.resume && input.freshTurnPrompt !== undefined) {
+        throw new LanesError("invalid_launch", "resume and freshTurnPrompt cannot both be set on one launch", { provider: parsed });
+    }
+    let prompt;
+    if (input.freshTurnPrompt !== undefined) {
+        prompt = input.freshTurnPrompt;
+    }
+    else {
+        prompt = `Execute the lane brief at ${input.briefPath}. ${envelopeInstruction(input.envelopePath)}`;
+        if (input.extraPrompt)
+            prompt += ` ${input.extraPrompt}`;
+    }
+    let args;
+    if (input.resume && parsed === "codex") {
+        // `codex exec resume` (0.155.1) takes `[SESSION_ID] [PROMPT]` and has
+        // neither `-C` nor `--color`; the session keeps its recorded cwd. `--json`
+        // makes the resumed run re-emit `thread.started` with the same id.
+        args = [
+            "exec",
+            "resume",
+            "--dangerously-bypass-hook-trust",
+            "--skip-git-repo-check",
+            "--dangerously-bypass-approvals-and-sandbox",
+            "--json",
+            "--output-last-message",
+            input.lastMessagePath,
+            "--",
+            input.resume.session_id,
+            input.resume.prompt,
+        ];
+    }
+    else if (input.resume) {
+        args = [
+            "-p",
+            "--resume",
+            input.resume.session_id,
+            input.resume.prompt,
+            "--permission-mode",
+            "bypassPermissions",
+            "--output-format",
+            "json",
+        ];
+    }
+    else if (parsed === "codex") {
+        // `--json` puts the thread id on stdout (`thread.started`); that is the
+        // only place `codex exec` exposes the id a later resume needs.
+        args = [
+            "exec",
+            "--dangerously-bypass-hook-trust",
+            "--skip-git-repo-check",
+            "--dangerously-bypass-approvals-and-sandbox",
+            "--color",
+            "never",
+            "--json",
+            "-C",
+            input.hqRoot,
+            "--output-last-message",
+            input.lastMessagePath,
+            "--",
+            prompt,
+        ];
+    }
+    else if (parsed === "grok") {
+        args = [
+            "--single",
+            prompt,
+            "--permission-mode",
+            "bypassPermissions",
+            "--always-approve",
+            "--output-format",
+            "json",
+        ];
+    }
+    else {
+        args = [
+            "-p",
+            prompt,
+            "--permission-mode",
+            "bypassPermissions",
+            "--output-format",
+            "json",
+        ];
+    }
+    return {
+        command,
+        args: appendEffortFlag(parsed, appendModelFlag(parsed, args, input.model), input.effort),
+    };
+}
+export function workerEnv(base, resolved, laneId, hqRoot) {
+    const accepted = Object.values(PROVIDER_HOME_ENV);
+    if (!accepted.includes(resolved.envVar)) {
+        throw new LanesError("unknown_provider_home_env", `Unknown provider home variable ${JSON.stringify(resolved.envVar)}. Accepted: ${accepted.join(", ")}`, { accepted, value: resolved.envVar });
+    }
+    const env = { ...base };
+    delete env.HQ_PROJECT_ID;
+    delete env.HQ_STORY_ID;
+    env[resolved.envVar] = resolved.home;
+    env.HQ_LANE_ID = laneId;
+    env.HQ_ROOT = hqRoot;
+    return env;
+}
+function ensureDir(dir) {
+    fs.mkdirSync(dir, { recursive: true });
+}
+function fileSizeOrZero(filePath) {
+    try {
+        return fs.statSync(filePath).size;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return 0;
+        process.stderr.write(`hq lanes: failed to stat ${filePath}: ${err instanceof Error ? err.message : String(err)}\n`);
+        throw err;
+    }
+}
+function writeText(filePath, text) {
+    ensureDir(path.dirname(filePath));
+    fs.writeFileSync(filePath, text, "utf8");
+}
+function openLog(filePath) {
+    ensureDir(path.dirname(filePath));
+    return fs.openSync(filePath, "a");
+}
+function closeFd(fd, label) {
+    try {
+        fs.closeSync(fd);
+    }
+    catch (err) {
+        process.stderr.write(`hq lanes: failed to close ${label} fd ${fd}: ${err instanceof Error ? err.message : String(err)}\n`);
+        throw err;
+    }
+}
+function killQuietly(kill, pid, label) {
+    try {
+        signalProcessGroup(pid, "SIGTERM", kill);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ESRCH")
+            return;
+        process.stderr.write(`hq lanes: failed to stop ${label} pid ${pid}: ${err instanceof Error ? err.message : String(err)}\n`);
+        throw err;
+    }
+}
+export function markSpawnFailure(hqRoot, laneId, reasonRaw, details) {
+    const reason = parseSpawnTerminalReason(reasonRaw);
+    return retryUpdateLane(hqRoot, laneId, "spawn", (current) => {
+        const existing = current
+            .terminal_reason;
+        if (current.state === "failed" && existing === reason)
+            return current;
+        return {
+            ...current,
+            state: "failed",
+            queued_reason: undefined,
+            terminal_reason: reason,
+            terminal_details: details,
+        };
+    });
+}
+function spawnDetached(spawnProcess, command, args, env, cwd, stdoutPath, stderrPath) {
+    const outFd = openLog(stdoutPath);
+    let errFd;
+    try {
+        errFd = openLog(stderrPath);
+        const child = spawnProcess(command, args, {
+            detached: true,
+            stdio: ["ignore", outFd, errFd],
+            env,
+            cwd,
+        });
+        child.unref();
+        if (typeof child.pid !== "number" || child.pid <= 0) {
+            throw new LanesError("spawn_failed", `Failed to start ${command} (no pid)`, { command, args });
+        }
+        return child.pid;
+    }
+    catch (err) {
+        if (err instanceof LanesError)
+            throw err;
+        throw new LanesError("spawn_failed", `Failed to start ${command}: ${err instanceof Error ? err.message : String(err)}`, {
+            command,
+            args,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+    finally {
+        closeFd(outFd, stdoutPath);
+        if (errFd !== undefined)
+            closeFd(errFd, stderrPath);
+    }
+}
+function requireDetached(proveDetached, pid, kind) {
+    const proof = proveDetached(pid);
+    if (proof.detached)
+        return proof;
+    const error = kind === "watcher" ? "watcher_not_armed" : "not_detached";
+    throw new LanesError(error, `${kind} pid ${pid} was not proven detached`, { pid, kind, reason: proof.reason ?? error, method: proof.method });
+}
+function originHostOf(lane) {
+    const value = lane.origin_host;
+    return typeof value === "string" ? value : "";
+}
+function originHostSourceOf(lane) {
+    const value = lane.origin_host_source;
+    return value === "imds" || value === "hostname" ? value : "";
+}
+function markOutpostSelfTarget(hqRoot, laneId, details) {
+    return retryUpdateLane(hqRoot, laneId, "spawn", (current) => {
+        const existing = current
+            .terminal_reason;
+        if (current.state === "cancelled" && existing === "outpost_self_target") {
+            return current;
+        }
+        return {
+            ...current,
+            state: "cancelled",
+            queued_reason: undefined,
+            terminal_reason: "outpost_self_target",
+            terminal_details: details,
+        };
+    });
+}
+/**
+ * Spec §5.2 executing-side check. Compares this machine's identity to
+ * `origin_host` (never to `host.id`). Unresolvable identity is a cancel.
+ * Must run before the worker is spawned.
+ */
+export function refuseOutpostSelfTarget(hqRoot, lane, deps) {
+    const identity = (deps.resolveMachineIdentity ?? resolveMachineIdentity)();
+    const origin = originHostOf(lane);
+    const originSource = originHostSourceOf(lane);
+    let selfTargeted = origin === "" || identity.status !== "ok";
+    if (!selfTargeted && identity.status === "ok") {
+        if (originSource === "imds") {
+            const execImds = identity.imds ?? (identity.source === "imds" ? identity.id : null);
+            selfTargeted = execImds === null || execImds === origin;
+        }
+        else if (originSource === "hostname") {
+            const execHost = identity.hostname ??
+                (identity.source === "hostname" ? identity.id : null);
+            selfTargeted = execHost === null ? identity.id === origin : execHost === origin;
+        }
+        else {
+            selfTargeted = identity.id === origin;
+        }
+    }
+    if (!selfTargeted)
+        return;
+    const cancelled = markOutpostSelfTarget(hqRoot, lane.lane_id, {
+        origin_host: origin,
+        identity,
+    });
+    throw new LanesError("outpost_self_target", "Outpost exec came back to the caller; lane cancelled before work", {
+        origin_host: origin,
+        identity,
+        lane_id: lane.lane_id,
+        lane: cancelled,
+    });
+}
+function writeSpawnManifest(runDir, input) {
+    writeText(path.join(runDir, "spawn.json"), `${JSON.stringify({
+        command: input.command,
+        args: input.args,
+        env_var: input.envVar,
+        account: input.account,
+        worker_pid: input.workerPid,
+        watcher_pid: input.watcherPid,
+        detached: true,
+        envelope_path: input.envelopePath,
+        resume: input.resume,
+        worker_out_offset: input.workerOutOffset,
+    }, null, 2)}\n`);
+}
+/** Arm (or re-arm) the detached per-lane watcher. */
+export function armLaneWatcher(hqRoot, laneId, deps = {}) {
+    const env = deps.env ?? process.env;
+    const spawnProcess = deps.spawnProcess ?? defaultSpawnProcess;
+    const proveDetached = deps.proveDetached ?? defaultProveDetached;
+    const runDir = laneRunDir(hqRoot, laneId);
+    const logsDir = path.join(runDir, "logs");
+    ensureDir(logsDir);
+    const watcherPid = spawnDetached(spawnProcess, process.execPath, [watcherMainPath(), laneId], {
+        ...env,
+        HQ_ROOT: hqRoot,
+        HQ_LANE_ID: laneId,
+    }, hqRoot, path.join(logsDir, "watcher.out"), path.join(logsDir, "watcher.err"));
+    writePidRecord(path.join(runDir, "watcher.pid"), {
+        pid: watcherPid,
+        starttime: readProcStarttime(watcherPid) ?? undefined,
+    });
+    try {
+        requireDetached(proveDetached, watcherPid, "watcher");
+    }
+    catch (err) {
+        killQuietly(deps.killProcess ?? defaultKillProcess, watcherPid, "watcher");
+        throw err;
+    }
+    return watcherPid;
+}
+/** Read the per-run manifest. Missing file or field reads as absent. */
+export function readSpawnManifest(runDir) {
+    const filePath = path.join(runDir, "spawn.json");
+    let text;
+    try {
+        text = fs.readFileSync(filePath, "utf8");
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return {};
+        process.stderr.write(`hq lanes: failed to read ${filePath}: ${err instanceof Error ? err.message : String(err)}\n`);
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        process.stderr.write(`hq lanes: ${filePath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}\n`);
+        return {};
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return {};
+    const rec = parsed;
+    const out = {};
+    if (typeof rec.envelope_path === "string")
+        out.envelope_path = rec.envelope_path;
+    if (typeof rec.worker_out_offset === "number" &&
+        Number.isInteger(rec.worker_out_offset) &&
+        rec.worker_out_offset >= 0) {
+        out.worker_out_offset = rec.worker_out_offset;
+    }
+    if (rec.resume &&
+        typeof rec.resume === "object" &&
+        typeof rec.resume.session_id === "string") {
+        out.resume = { session_id: rec.resume.session_id };
+    }
+    else if (rec.resume === null) {
+        out.resume = null;
+    }
+    return out;
+}
+function inferTrigger(lane) {
+    if (lane.state === "awaiting_input")
+        return { kind: "answered_questions" };
+    return { kind: "admit" };
+}
+/**
+ * Bind the account, spawn the worker and its watcher outside the caller's
+ * tree, then CAS the record to `running`. A spawn that cannot be proven
+ * started and detached is a named terminal reason, never a bare `failed`.
+ *
+ * Fresh-vs-resume is decided by `planLaneLaunch` (delivery.ts), never here.
+ */
+export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
+    const env = deps.env ?? process.env;
+    const existsSync = deps.existsSync ?? ((p) => fs.existsSync(p));
+    const spawnProcess = deps.spawnProcess ?? defaultSpawnProcess;
+    const proveDetached = deps.proveDetached ?? defaultProveDetached;
+    const killProcess = deps.killProcess ?? defaultKillProcess;
+    const existing = readLane(hqRoot, lane.lane_id);
+    if (existing.state === "running") {
+        if (launch.trigger?.kind === "resume") {
+            throw new LanesError("lane_not_resumable", `Lane ${lane.lane_id} is already running`, { lane_id: lane.lane_id, state: existing.state });
+        }
+        return existing;
+    }
+    const trigger = launch.trigger ?? inferTrigger(existing);
+    // A message into a finished lane must not turn that lane `failed` when the
+    // account cannot be bound: nothing has started yet, so the record keeps its
+    // state and the caller sees the error. Admission and question resume keep
+    // today's behaviour of naming the terminal reason on the record.
+    const markPreSpawnFailure = trigger.kind !== "message" && trigger.kind !== "resume";
+    const plan = planLaneLaunch(existing, trigger);
+    if (existing.host.kind === "outpost") {
+        refuseOutpostSelfTarget(hqRoot, existing, deps);
+    }
+    const runDir = laneRunDir(hqRoot, lane.lane_id);
+    const logsDir = path.join(runDir, "logs");
+    ensureDir(logsDir);
+    ensureDir(path.join(runDir, "envelopes"));
+    const config = loadLanesConfig(hqRoot);
+    let resolved;
+    try {
+        resolved = resolveAccount(lane.provider, lane.account, config, {
+            hqRoot,
+            existsSync,
+            model: lane.model,
+        });
+    }
+    catch (err) {
+        if (err instanceof AccountResolutionError) {
+            if (markPreSpawnFailure) {
+                markSpawnFailure(hqRoot, lane.lane_id, err.error, err.details);
+            }
+            throw err;
+        }
+        process.stderr.write(`hq lanes: account bind failed for ${lane.lane_id}: ${err instanceof Error ? err.message : String(err)}\n`);
+        throw err;
+    }
+    const status = accountStatus(lane.provider, resolved.id, config, { existsSync });
+    if (isLoggedOut(status)) {
+        const failed = markPreSpawnFailure
+            ? markSpawnFailure(hqRoot, lane.lane_id, "account_not_logged_in", {
+                provider: lane.provider,
+                account: resolved.id,
+            })
+            : existing;
+        throw new LanesError("account_not_logged_in", `Account ${resolved.id} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: resolved.id, lane_id: lane.lane_id, lane: failed });
+    }
+    if (lane.account !== resolved.id) {
+        retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => {
+            if (current.account === resolved.id)
+                return current;
+            return { ...current, account: resolved.id };
+        });
+    }
+    try {
+        installDrainHook(lane.provider, resolved.home);
+    }
+    catch (err) {
+        process.stderr.write(`hq lanes: drain hook install failed for ${resolved.home}: ${err instanceof Error ? err.message : String(err)}\n`);
+        throw err;
+    }
+    const childEnv = workerEnv(env, { envVar: resolved.envVar, home: resolved.home }, lane.lane_id, hqRoot);
+    const briefPath = path.join(runDir, "brief.md");
+    const envelopePath = nextEnvelopePath(runDir);
+    const lastMessagePath = path.join(logsDir, "last-message.txt");
+    const answersPath = path.join(runDir, ANSWERED_QUESTIONS_FILE);
+    const extraPrompt = existsSync(answersPath)
+        ? `Previously answered questions are at ${answersPath}; treat those choices as operator decisions that outrank the brief.`
+        : undefined;
+    const accountCfg = config.providers[lane.provider].accounts[resolved.id];
+    const model = resolveLaneModel({
+        cliModel: lane.model,
+        accountModel: accountCfg?.model,
+        providerModel: config.providers[lane.provider].model,
+    });
+    const effort = resolveLaneEffort({
+        cliEffort: existing.effort_source === "cli" ? existing.effort : undefined,
+        accountEffort: accountCfg?.effort,
+        providerEffort: config.providers[lane.provider].effort,
+        model,
+    });
+    const resume = plan.mode === "resume"
+        ? {
+            session_id: plan.session_id,
+            prompt: resumePrompt({
+                envelopePath,
+                operatorMessage: trigger.kind === "message"
+                    ? trigger.text
+                    : trigger.kind === "resume"
+                        ? trigger.text
+                        : undefined,
+                resumedFrom: trigger.kind === "resume" ? trigger.from : undefined,
+                answersPath: trigger.kind === "answered_questions" && existsSync(answersPath)
+                    ? answersPath
+                    : undefined,
+                answers: trigger.kind === "answered_questions" && existsSync(answersPath)
+                    ? readAnsweredQuestionLines(answersPath)
+                    : undefined,
+            }),
+        }
+        : undefined;
+    const command = buildProviderCommand(lane.provider, {
+        hqRoot,
+        briefPath,
+        envelopePath,
+        lastMessagePath,
+        extraPrompt,
+        model,
+        effort: effort.effort,
+        resume,
+    });
+    // A systemd PATH mismatch is an environment defect, not a lane failure.
+    // Keep the lane eligible for a later reconcile after the installer repairs it.
+    if (!providerCommandOnPath(command.command, childEnv.PATH)) {
+        const searchedPath = childEnv.PATH ?? "";
+        // Only admission may re-queue. A resume (answered questions, operator
+        // message) must keep the recorded state so the next reconcile does not
+        // infer `admit` and start a fresh run in place of the recorded session;
+        // the caller keeps the message text and sees the named error.
+        if (trigger.kind !== "admit") {
+            throw new LanesError("provider_binary_missing", `Provider binary ${command.command} for ${lane.provider} is not executable on PATH ${JSON.stringify(searchedPath)}; lane ${lane.lane_id} keeps state ${existing.state}`, {
+                provider: lane.provider,
+                command: command.command,
+                searched_path: searchedPath,
+                lane_id: lane.lane_id,
+                state: existing.state,
+                trigger: trigger.kind,
+            });
+        }
+        return retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => ({
+            ...current,
+            state: "queued",
+            queued_reason: "provider_binary_missing",
+            terminal_reason: undefined,
+            terminal_details: {
+                provider: lane.provider,
+                command: command.command,
+                searched_path: searchedPath,
+            },
+        }));
+    }
+    // Resume-time compaction (compaction.ts). Runs before the claim so the
+    // lane is never `running` without a worker while `/compact` works.
+    let compaction;
+    if (resume && launch.compact !== false) {
+        const nowFn = deps.now ?? (() => new Date());
+        const decision = compactionDue(existing, nowFn().getTime(), providerCompactAfterMs(config.providers[lane.provider]));
+        if (decision.due) {
+            const compactCommand = buildProviderCommand(lane.provider, {
+                hqRoot,
+                briefPath,
+                envelopePath,
+                lastMessagePath,
+                model,
+                effort: effort.effort,
+                resume: { session_id: resume.session_id, prompt: COMPACTION_PROMPT },
+            });
+            compaction = compactLaneSession({
+                command: compactCommand.command,
+                args: compactCommand.args,
+                sessionId: resume.session_id,
+                accountHome: resolved.home,
+                env: childEnv,
+                cwd: hqRoot,
+                logsDir,
+                decision,
+                before: existing.last_run_usage ?? null,
+                now: nowFn,
+                run: deps.runCompaction,
+                locateTranscript: deps.locateTranscript,
+            });
+        }
+    }
+    // Claim running before spawning. Two callers that both observe queued must
+    // not both start processes; the CAS loser returns without spawn.
+    const claimable = claimableStatesFor(trigger);
+    const nowIso = (deps.now ?? (() => new Date()))().toISOString();
+    let claimed = false;
+    const claimedRecord = retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => {
+        claimed = false;
+        if (current.state === "running" && current.account === resolved.id) {
+            if (trigger.kind === "resume") {
+                throw new LanesError("lane_not_resumable", `Lane ${current.lane_id} is already running`, { lane_id: current.lane_id, state: current.state });
+            }
+            return current;
+        }
+        if (!claimable.includes(current.state)) {
+            throw new LanesError("spawn_state_mismatch", `Cannot mark ${current.lane_id} running from ${current.state}`, { lane_id: current.lane_id, state: current.state, trigger: trigger.kind });
+        }
+        claimed = true;
+        const next = {
+            ...current,
+            state: "running",
+            queued_reason: undefined,
+            account: resolved.id,
+            ...(model !== undefined ? { model } : {}),
+            effort_source: effort.source,
+            last_host_report_at: nowIso,
+        };
+        if (effort.effort !== undefined)
+            next.effort = effort.effort;
+        else
+            delete next.effort;
+        // Freeze the counters of the run that followed the previous compaction
+        // before this launch replaces last_resume.
+        if (current.last_compaction && current.last_compaction.after === null) {
+            const after = compactionAfterUsage(current);
+            if (after !== null)
+                next.last_compaction = { ...current.last_compaction, after };
+        }
+        if (compaction)
+            next.last_compaction = { ...compaction, resume_at: nowIso };
+        if (resume && trigger.kind !== "admit") {
+            next.last_resume = {
+                session_id: resume.session_id,
+                at: nowIso,
+                trigger: trigger.kind,
+                ...(trigger.kind === "message" ? { message_id: trigger.message_id } : {}),
+                ...(trigger.kind === "resume"
+                    ? {
+                        resumed_from: trigger.from,
+                        ...(trigger.text !== undefined ? { text: trigger.text } : {}),
+                        ...(trigger.message_id !== undefined ? { message_id: trigger.message_id } : {}),
+                    }
+                    : {}),
+            };
+        }
+        return next;
+    });
+    if (!claimed) {
+        if (compaction) {
+            const record = compaction;
+            return retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => ({
+                ...current,
+                last_compaction: record,
+            }));
+        }
+        return claimedRecord;
+    }
+    const workerOutPath = path.join(logsDir, "worker.out");
+    const workerOutOffset = fileSizeOrZero(workerOutPath);
+    let workerPid;
+    let watcherPid;
+    try {
+        workerPid = spawnDetached(spawnProcess, command.command, command.args, childEnv, hqRoot, path.join(logsDir, "worker.out"), path.join(logsDir, "worker.err"));
+        writePidRecord(path.join(runDir, "worker.pid"), {
+            pid: workerPid,
+            starttime: readProcStarttime(workerPid) ?? undefined,
+        });
+        requireDetached(proveDetached, workerPid, "worker");
+        watcherPid = armLaneWatcher(hqRoot, lane.lane_id, deps);
+        writeSpawnManifest(runDir, {
+            command: command.command,
+            args: command.args,
+            envVar: resolved.envVar,
+            account: resolved.id,
+            workerPid,
+            watcherPid,
+            envelopePath,
+            resume: resume ? { session_id: resume.session_id } : null,
+            workerOutOffset,
+        });
+    }
+    catch (err) {
+        if (workerPid !== undefined)
+            killQuietly(killProcess, workerPid, "worker");
+        if (watcherPid !== undefined)
+            killQuietly(killProcess, watcherPid, "watcher");
+        const reason = err instanceof LanesError &&
+            SPAWN_TERMINAL_REASONS.includes(err.error)
+            ? err.error
+            : "spawn_failed";
+        const failed = markSpawnFailure(hqRoot, lane.lane_id, reason, {
+            message: err instanceof Error ? err.message : String(err),
+            ...(err instanceof LanesError ? err.details : {}),
+        });
+        if (err instanceof LanesError) {
+            throw new LanesError(err.error, err.message, {
+                ...err.details,
+                lane_id: lane.lane_id,
+                lane: failed,
+            });
+        }
+        throw err;
+    }
+    return readLane(hqRoot, lane.lane_id);
+}
+/**
+ * `resume`: claude and codex continue the recorded session with the repair
+ * prompt. `fresh_turn`: grok has no session resume, so the repair is a new
+ * single-turn invocation of the same provider on the same account, whose
+ * prompt carries the schema, the parser error and the raw failed output.
+ */
+export function envelopeRepairMode(provider) {
+    return providerSupportsSessionResume(provider) ? "resume" : "fresh_turn";
+}
+/**
+ * Spec §4 repair turn. The lane is still `running` (the watcher has not
+ * written a terminal state), so this does not claim or transition the
+ * record. It resumes the recorded provider session with the repair prompt
+ * (`resume` mode), or for a provider with no session resume runs the repair
+ * prompt as a fresh single turn on the same account (`fresh_turn` mode). It
+ * replaces `worker.pid` and rewrites `spawn.json` so the watcher's next tick
+ * follows the new process. The account is the one already bound on the record.
+ */
+export function spawnEnvelopeRepair(hqRoot, lane, input, deps = {}) {
+    const env = deps.env ?? process.env;
+    const existsSync = deps.existsSync ?? ((p) => fs.existsSync(p));
+    const spawnProcess = deps.spawnProcess ?? defaultSpawnProcess;
+    const proveDetached = deps.proveDetached ?? defaultProveDetached;
+    const killProcess = deps.killProcess ?? defaultKillProcess;
+    const mode = envelopeRepairMode(lane.provider);
+    const sessionId = input.session_id ?? null;
+    if (mode === "resume" && sessionId === null) {
+        throw new LanesError("repair_session_missing", `Provider ${lane.provider} repairs by resuming its session, but no session id was given`, { provider: lane.provider });
+    }
+    const runDir = laneRunDir(hqRoot, lane.lane_id);
+    const logsDir = path.join(runDir, "logs");
+    ensureDir(logsDir);
+    const config = loadLanesConfig(hqRoot);
+    const resolved = resolveAccount(lane.provider, lane.account, config, {
+        hqRoot,
+        existsSync,
+        model: lane.model,
+    });
+    const childEnv = workerEnv(env, { envVar: resolved.envVar, home: resolved.home }, lane.lane_id, hqRoot);
+    const accountCfg = config.providers[lane.provider].accounts[resolved.id];
+    const model = resolveLaneModel({
+        cliModel: lane.model,
+        accountModel: accountCfg?.model,
+        providerModel: config.providers[lane.provider].model,
+    });
+    const effort = resolveLaneEffort({
+        cliEffort: lane.effort_source === "cli" ? lane.effort : undefined,
+        accountEffort: accountCfg?.effort,
+        providerEffort: config.providers[lane.provider].effort,
+        model,
+    });
+    const repairPrompt = envelopeRepairPrompt({
+        envelopePath: input.envelopePath,
+        error: input.error,
+        rawText: input.rawText,
+    });
+    const command = buildProviderCommand(lane.provider, {
+        hqRoot,
+        briefPath: path.join(runDir, "brief.md"),
+        envelopePath: input.envelopePath,
+        lastMessagePath: path.join(logsDir, "last-message.txt"),
+        model,
+        effort: effort.effort,
+        ...(mode === "resume" && sessionId !== null
+            ? { resume: { session_id: sessionId, prompt: repairPrompt } }
+            : { freshTurnPrompt: repairPrompt }),
+    });
+    const workerOutOffset = fileSizeOrZero(path.join(logsDir, "worker.out"));
+    const previous = readSpawnManifest(runDir);
+    let workerPid;
+    try {
+        workerPid = spawnDetached(spawnProcess, command.command, command.args, childEnv, hqRoot, path.join(logsDir, "worker.out"), path.join(logsDir, "worker.err"));
+        writePidRecord(path.join(runDir, "worker.pid"), {
+            pid: workerPid,
+            starttime: readProcStarttime(workerPid) ?? undefined,
+        });
+        requireDetached(proveDetached, workerPid, "worker");
+        const watcherPid = readPidRecord(path.join(runDir, "watcher.pid"))?.pid ?? 0;
+        writeSpawnManifest(runDir, {
+            command: command.command,
+            args: command.args,
+            envVar: resolved.envVar,
+            account: resolved.id,
+            workerPid,
+            watcherPid,
+            envelopePath: previous.envelope_path ?? input.envelopePath,
+            resume: mode === "resume" && sessionId !== null ? { session_id: sessionId } : null,
+            workerOutOffset,
+        });
+    }
+    catch (err) {
+        if (workerPid !== undefined)
+            killQuietly(killProcess, workerPid, "worker");
+        throw err;
+    }
+    return workerPid;
+}
+export { PROVIDER_HOME_ENV, PROVIDER_COMMAND };
+//# sourceMappingURL=spawn.js.map