@indigoai-us/hq-cli 5.131.0 → 5.132.0

package/dist/commands/lanes.js

@@ -17,13 +17,15 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, isLoggedOut, runReconcilePass, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, isLoggedOut, runReconcilePass, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
 import { providerCompactAfterMs } from "../lib/lanes/config.js";
 import { parseCliEffort, resolveLaneEffort } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
-import { accountQuotaView, loadQuotaState } from "../lib/lanes/quota.js";
+import { accountQuotaView, loadQuotaState, quotaBlockFor } from "../lib/lanes/quota.js";
+import { SESSION_MOVE_REASON, copySessionFiles, planSessionCopy } from "../lib/lanes/move-account.js";
+import { defaultProbe, validateLaneModel, } from "../lib/lanes/models.js";
 import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ONLY_RULE, STANDING_AUTHORIZATION, spawnLaneWorker, stopLaneProcesses, } from "../lib/lanes/spawn.js";
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
@@ -201,6 +203,7 @@ function resolveDeps(deps = {}) {
                 };
             }),
         resolveMachineIdentity: deps.resolveMachineIdentity ?? lookupMachineIdentity,
+        probeProvider: deps.probeProvider ?? defaultProbe,
         runCompaction: deps.runCompaction,
         locateTranscript: deps.locateTranscript,
         stageOutpostPayload: deps.stageOutpostPayload ?? defaultStageOutpostPayload,
@@ -1047,6 +1050,7 @@ export const PICKUP_TERMINAL_REASONS = [
     "account_not_logged_in",
     "unknown_account",
     "account_disabled",
+    "model_unsupported",
 ];
 export const DISPATCH_TERMINAL_REASON = "outpost_dispatch_failed";
 function parsePickupTerminalReason(value) {
@@ -1069,28 +1073,38 @@ function markDispatchFailure(hqRoot, laneId, details) {
         };
     });
 }
-function markPickupFailure(hqRoot, laneId, reasonRaw, details) {
+/**
+ * The CAS updater a pickup failure applies. A lane that is already terminal
+ * for any reason (a cancel that landed after the caller's last read, an
+ * earlier pickup failure) is returned unchanged: the guard lives inside the
+ * same compare-and-swap that writes the failure, so no read-then-write gap
+ * can overwrite another writer's terminal decision.
+ */
+export function pickupFailureUpdater(reasonRaw, details) {
     const reason = parsePickupTerminalReason(reasonRaw);
-    return casUpdateLane(hqRoot, laneId, (current) => {
-        const existing = current
-            .terminal_reason;
-        if (isTerminalLaneState(current.state) && existing === reason) {
+    return (current) => {
+        // A running record is never overwritten either: a worker that was
+        // admitted meanwhile keeps its lane, and the watcher classifies it.
+        if (isTerminalLaneState(current.state) || current.state === "running")
             return current;
-        }
         return {
             ...current,
             state: "failed",
             queued_reason: undefined,
+            pickup_validation_pending: undefined,
             terminal_reason: reason,
             terminal_details: details,
         };
-    });
+    };
+}
+function markPickupFailure(hqRoot, laneId, reasonRaw, details) {
+    return casUpdateLane(hqRoot, laneId, pickupFailureUpdater(reasonRaw, details));
 }
 /**
  * Outpost-side account bind (spec §5.2). Writes a named terminal reason,
  * never a plain `failed`.
  */
-export function applyOutpostAccountPickup(hqRoot, laneId) {
+export function applyOutpostAccountPickup(hqRoot, laneId, modelDeps = {}) {
     const lane = readLane(hqRoot, laneId);
     const config = loadLanesConfig(hqRoot);
     try {
@@ -1104,16 +1118,55 @@ export function applyOutpostAccountPickup(hqRoot, laneId) {
                 account: resolved.id,
             });
         }
-        if (lane.account === resolved.id)
-            return lane;
+        // The executing host is the first place the model can be checked
+        // against this account's provider list: an outpost create without
+        // --account has no local account home to validate against.
+        // The probe can block for up to MODEL_PROBE_TIMEOUT_MS. A cancel or any
+        // other terminal decision taken meanwhile is final: after every probe
+        // result the lane is re-read and a terminal lane is returned as it is
+        // (so runPickup never proceeds into admission for it). The failure
+        // write itself refuses a terminal record inside its CAS
+        // (pickupFailureUpdater), so a cancel landing between this re-read and
+        // that write is kept too.
+        let current = lane;
+        if (lane.model !== undefined) {
+            let unsupported = null;
+            try {
+                validateLaneModel(lane.provider, lane.model, resolved.home, modelDeps);
+            }
+            catch (err) {
+                if (isLanesError(err) && err.error === "model_unsupported") {
+                    unsupported = err;
+                }
+                else {
+                    throw err;
+                }
+            }
+            current = readLane(hqRoot, laneId);
+            if (isTerminalLaneState(current.state) || current.state === "running")
+                return current;
+            if (unsupported) {
+                return markPickupFailure(hqRoot, laneId, "model_unsupported", {
+                    ...unsupported.details,
+                    account: resolved.id,
+                });
+            }
+        }
+        if (current.account === resolved.id && current.pickup_validation_pending === undefined) {
+            return current;
+        }
         // The bind is the executing host's pre-spawn account resolution, the same
         // write spawnLaneWorker makes for a local lane, so it carries the spawn
         // writer. `account` stays closed to `command`: an operator command never
-        // re-pins the account of a lane it does not execute.
+        // re-pins the account of a lane it does not execute. The bind also
+        // clears the pickup marker: from here the reconcile pass may admit it.
         return retryUpdateLane(hqRoot, laneId, "spawn", (current) => {
-            if (current.account === resolved.id)
+            if (isTerminalLaneState(current.state) || current.state === "running")
+                return current;
+            if (current.account === resolved.id && current.pickup_validation_pending === undefined) {
                 return current;
-            return { ...current, account: resolved.id };
+            }
+            return { ...current, account: resolved.id, pickup_validation_pending: undefined };
         });
     }
     catch (err) {
@@ -1255,6 +1308,64 @@ async function runCreate(ctx, opts) {
     }
     const now = ctx.now();
     const createdAt = now.toISOString();
+    // `--model` is validated against the provider's own model list (models.ts)
+    // before anything is written or posted: ahead of the mesh thread, so a
+    // refusal leaves no orphan thread, and ahead of the admission lock, so a
+    // slow `grok models` / `claude --help` probe never holds the lock other
+    // creates wait on. A pinned create checks the pinned account's home. An
+    // unpinned create is not bound to an account here (persist re-resolves the
+    // balanced account under the lock, so overlapping creates still spread),
+    // so it checks the balanced candidate first and then every other enabled
+    // account the locked selection could land on (codex catalogs are per home
+    // and can differ). `validatedAccounts` records which accepted the model
+    // or had no readable list, and the balanced pick under the lock is
+    // restricted to that set (resolveAccount's allowedAccounts): an account
+    // whose list refused the model is never selected, so nothing has to be
+    // refused after the mesh thread exists, and no probe or catalog read runs
+    // while the lock is held. Every outpost create,
+    // pinned or not, is validated at pickup on the executing host instead:
+    // its provider list and CLI are the ones that run the lane.
+    const modelDeps = {
+        readFileSync: ctx.readFileSync,
+        probe: ctx.probeProvider,
+        env: ctx.env,
+    };
+    const validatedAccounts = new Set();
+    if (cliModel !== undefined && !outpostId) {
+        const accounts = config.providers[provider].accounts;
+        const candidate = pinnedAccount ??
+            resolveAccount(provider, undefined, config, {
+                hqRoot,
+                existsSync: ctx.existsSync,
+                cliModel,
+            }).id;
+        const toValidate = pinnedAccount !== undefined
+            ? [candidate]
+            : [
+                candidate,
+                ...Object.keys(accounts)
+                    .filter((id) => id !== candidate && accounts[id]?.enabled)
+                    .sort(),
+            ];
+        for (const id of toValidate) {
+            const home = accounts[id]?.home;
+            if (home === undefined)
+                continue;
+            try {
+                validateLaneModel(provider, cliModel, home, modelDeps);
+                validatedAccounts.add(id);
+            }
+            catch (err) {
+                if (!(isLanesError(err) && err.error === "model_unsupported"))
+                    throw err;
+                // The account that would run the lane refuses it: refuse now, before
+                // the other lists are read. Another account's refusal only drops it
+                // from the locked selection.
+                if (id === candidate)
+                    throw err;
+            }
+        }
+    }
     const threadId = company
         ? await ctx.mesh.ensureProjectThread(company, project)
         : undefined;
@@ -1266,6 +1377,7 @@ async function runCreate(ctx, opts) {
                 hqRoot,
                 existsSync: ctx.existsSync,
                 cliModel,
+                ...(validatedAccounts.size > 0 ? { allowedAccounts: [...validatedAccounts] } : {}),
             }).id;
         }
         const accountCfg = pinnedAccount !== undefined
@@ -1531,7 +1643,13 @@ function ingestPickupPayload(hqRoot, payload) {
         throw new LanesError("outpost_payload_invalid", "Pickup payload lane.lane_id is required", {});
     }
     const existing = tryReadLane(hqRoot, laneId);
-    const lane = existing ?? createLane(hqRoot, payload.lane);
+    // The lane is stored ineligible for admission until the account bind
+    // clears the marker (see LaneRecord.pickup_validation_pending).
+    const lane = existing === null
+        ? createLane(hqRoot, { ...payload.lane, pickup_validation_pending: true })
+        : existing.state === "queued" && existing.pickup_validation_pending === undefined
+            ? retryUpdateLane(hqRoot, laneId, "command", (current) => current.state === "queued" ? { ...current, pickup_validation_pending: true } : current)
+            : existing;
     const dest = runDir(hqRoot, lane.lane_id);
     ensureDir(path.join(dest, "logs"));
     ensureDir(path.join(dest, "envelopes"));
@@ -1599,7 +1717,11 @@ async function runPickup(ctx, opts) {
             throw err;
         }
     }
-    const afterAccount = applyOutpostAccountPickup(hqRoot, ingested.lane_id);
+    const afterAccount = applyOutpostAccountPickup(hqRoot, ingested.lane_id, {
+        readFileSync: ctx.readFileSync,
+        probe: ctx.probeProvider,
+        env: ctx.env,
+    });
     if (isTerminalLaneState(afterAccount.state)) {
         printJson({
             ok: true,
@@ -1741,23 +1863,182 @@ async function runShow(ctx, laneId) {
         provider_session_id_absent: lane.provider_session_id_absent ?? null,
         envelope_repair_mode: lane.envelope_repair?.mode ?? null,
         last_resume: lane.last_resume ?? null,
+        account: lane.account ?? null,
+        account_history: lane.account_history ?? [],
+        pending_resume: lane.pending_resume ?? null,
         last_run_usage: lane.last_run_usage ?? null,
         model: lane.model ?? null,
         effort: lane.effort ?? null,
         effort_source: lane.effort_source ?? null,
+        terminal_reason: lane.terminal_reason ?? null,
+        terminal_details: lane.terminal_details ?? null,
         last_message_at: lane.last_message_at ?? null,
         last_compaction: lane.last_compaction
             ? { ...lane.last_compaction, after: compactionAfterUsage(lane) }
             : null,
     });
 }
+/**
+ * US-023: move the lane's provider session to `--account` (same provider)
+ * before a resume or a message resume. Every check runs before anything is
+ * copied or written; the copy runs before the record changes, so a failed
+ * copy leaves the lane on its source account. The turn is started by the
+ * caller, or parked as `pending_resume` when the target is at its cap so the
+ * reconcile pass resumes it there.
+ */
+async function prepareAccountMove(ctx, lane, input) {
+    const hqRoot = ctx.hqRoot();
+    const now = ctx.now();
+    const laneId = lane.lane_id;
+    if (lane.state === "running") {
+        throw new LanesError("lane_running", `Lane ${laneId} is running; stop it or wait for it to exit before moving its session`, {
+            lane_id: laneId,
+            state: lane.state,
+        });
+    }
+    // `--account <id>` or `--account <provider>:<id>`: a provider prefix that
+    // is not the lane's is a cross-provider move, which no session survives.
+    const raw = input.account.trim();
+    const colon = raw.indexOf(":");
+    const requestedProvider = colon > 0 ? raw.slice(0, colon) : undefined;
+    const target = colon > 0 ? raw.slice(colon + 1) : raw;
+    if (requestedProvider !== undefined && requestedProvider !== lane.provider) {
+        throw new LanesError("account_provider_mismatch", `Lane ${laneId} runs on ${lane.provider}; account ${JSON.stringify(raw)} names provider ${requestedProvider}. Sessions do not move between providers`, { lane_id: laneId, provider: lane.provider, requested_provider: requestedProvider, account: target });
+    }
+    if (!target) {
+        throw new AccountResolutionError("unknown_account", `Unknown account ${JSON.stringify(input.account)} for ${lane.provider}`, {
+            provider: lane.provider,
+            account: input.account,
+            enabled: [],
+        });
+    }
+    if (target === lane.account) {
+        throw new LanesError("account_unchanged", `Lane ${laneId} already runs on account ${target}`, {
+            lane_id: laneId,
+            account: target,
+        });
+    }
+    if (!providerSupportsSessionResume(lane.provider)) {
+        throw new LanesError("provider_session_not_portable", `Provider ${lane.provider} has no session resume, so a lane cannot move between its accounts`, { lane_id: laneId, provider: lane.provider });
+    }
+    if (!hasRecordedSessionId(lane)) {
+        throw new LanesError("no_provider_session", `Lane ${laneId} has no recorded provider session id, so there is no session to move`, { lane_id: laneId, provider: lane.provider });
+    }
+    const sessionId = lane.provider_session_id;
+    const config = loadLanesConfig(hqRoot);
+    const providerCfg = config.providers[lane.provider];
+    const targetCfg = providerCfg.accounts[target];
+    if (targetCfg === undefined) {
+        throw new AccountResolutionError("unknown_account", `Unknown account ${JSON.stringify(target)} for ${lane.provider}. Configured: ${Object.keys(providerCfg.accounts).join(", ") || "(none)"}`, { provider: lane.provider, account: target, enabled: Object.keys(providerCfg.accounts).filter((id) => providerCfg.accounts[id]?.enabled) });
+    }
+    if (!targetCfg.enabled) {
+        throw new AccountResolutionError("account_disabled", `Account ${JSON.stringify(target)} is disabled${targetCfg.disabled_reason ? `: ${targetCfg.disabled_reason}` : ""}`, { provider: lane.provider, account: target, reason: targetCfg.disabled_reason ?? "" });
+    }
+    if (isLoggedOut(accountStatus(lane.provider, target, config, { existsSync: ctx.existsSync }))) {
+        throw new LanesError("account_not_logged_in", `Account ${target} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: target, lane_id: laneId });
+    }
+    // The model the moved run would use, resolved the way spawn resolves it:
+    // the operator's --model, else the lane's own, else the target account's
+    // default, else the provider's. The quota and validation checks use this
+    // effective model so a per-model hold on the target's default is seen
+    // here, before anything is copied. A target that pins a different model
+    // refuses the lane's model unless the operator names one for the move.
+    const model = resolveLaneModel({
+        cliModel: input.cliModel ?? lane.model,
+        accountModel: targetCfg.model,
+        providerModel: providerCfg.model,
+    });
+    if (input.cliModel === undefined && lane.model !== undefined && targetCfg.model !== undefined && targetCfg.model !== lane.model) {
+        throw new LanesError("model_unsupported", `Account ${target} pins model ${targetCfg.model}; lane ${laneId} runs ${lane.model}. Pass --model ${targetCfg.model} to move it onto that model`, { provider: lane.provider, account: target, model: lane.model, account_model: targetCfg.model, lane_id: laneId });
+    }
+    const block = quotaBlockFor(loadQuotaState(hqRoot), lane.provider, target, model, now);
+    if (block.blocked) {
+        throw new LanesError("account_quota_held", `Account ${target} for ${lane.provider} is held${block.quota_reset_at ? ` until ${block.quota_reset_at}` : ""}${block.marker ? ` (${block.marker})` : ""}`, { provider: lane.provider, account: target, quota_reset_at: block.quota_reset_at ?? null, marker: block.marker ?? null, model: model ?? null });
+    }
+    if (model !== undefined) {
+        validateLaneModel(lane.provider, model, targetCfg.home, {
+            readFileSync: ctx.readFileSync,
+            probe: ctx.probeProvider,
+            env: ctx.env,
+        });
+    }
+    const sourceCfg = lane.account !== undefined ? providerCfg.accounts[lane.account] : undefined;
+    if (sourceCfg === undefined) {
+        throw new AccountResolutionError("unknown_account", `Lane ${laneId} records account ${JSON.stringify(lane.account)} which is not configured for ${lane.provider}`, { provider: lane.provider, account: lane.account ?? "", enabled: [] });
+    }
+    // Checks done. Copy the session files, then write the record.
+    const copy = copySessionFiles(planSessionCopy(lane.provider, {
+        sourceHome: sourceCfg.home,
+        targetHome: targetCfg.home,
+        cwd: hqRoot,
+        sessionId,
+    }));
+    const at = now.toISOString();
+    const from = lane.account ?? null;
+    // The capacity decision and the record write run under the target
+    // account's admission lock, the same serialization lane creation uses. A
+    // slot is taken by a running lane or by a lane another move has already
+    // pointed at the account whose spawn has not claimed it yet
+    // (`pending_resume` set by this write, cleared by the claim), so two moves
+    // into one free slot cannot both start.
+    return withAdmissionLock(admissionLockPath(hqRoot, lane.provider, target), async () => {
+        const lanes = loadAllLanes(hqRoot);
+        // A queued lane with a pending resume waits for admission and holds
+        // no slot; one in any other state with a pending resume is a move
+        // whose spawn is about to claim, and holds the slot it was granted.
+        const occupies = (row) => row.lane_id !== laneId &&
+            (row.state === "running" || (row.pending_resume !== undefined && row.state !== "queued"));
+        const onProvider = lanes.filter((row) => row.provider === lane.provider && occupies(row));
+        const atCap = onProvider.length >= providerCfg.max_running ||
+            onProvider.filter((row) => row.account === target).length >= accountMaxRunning(providerCfg, target);
+        const moved = casUpdateLane(hqRoot, laneId, (current) => {
+            // The copy and every check above were made from `lane`; a record
+            // that moved on since (another move, a spawn, a cancel) invalidates
+            // them, so the write is refused rather than applied to a state it
+            // was not prepared for.
+            if (current.version !== lane.version) {
+                throw new LanesError("account_move_conflict", `Lane ${laneId} changed while the move was prepared (version ${lane.version} → ${current.version}, state ${current.state}, account ${current.account ?? "(none)"}); run the move again`, { lane_id: laneId, prepared_version: lane.version, version: current.version, state: current.state, account: current.account ?? null });
+            }
+            const next = {
+                ...current,
+                account: target,
+                ...(input.cliModel !== undefined ? { model: input.cliModel } : {}),
+                account_history: appendCappedHistory(current.account_history ?? [], {
+                    from,
+                    to: target,
+                    at,
+                    reason: SESSION_MOVE_REASON,
+                }),
+                pending_resume: { session_id: sessionId, at, ...input.pending },
+            };
+            if (atCap) {
+                next.state = "queued";
+                next.queued_reason = "cap";
+            }
+            return next;
+        });
+        return { lane: moved, from, to: target, copy, queued: atCap };
+    }, ctx.sleep);
+}
 async function runMessage(ctx, laneId, opts) {
     const hqRoot = ctx.hqRoot();
     const text = opts.text;
     if (!text) {
         throw new LanesError("missing_text", "--text is required", {});
     }
-    const lane = readLane(hqRoot, laneId);
+    let lane = readLane(hqRoot, laneId);
+    // An account move is refused on its own terms first: a running lane and a
+    // provider without session resume get the move's named errors, not the
+    // generic delivery refusal below.
+    if (opts.account !== undefined && lane.state === "running") {
+        throw new LanesError("lane_running", `Lane ${laneId} is running; stop it or wait for it to exit before moving its session`, {
+            lane_id: laneId,
+            state: lane.state,
+        });
+    }
+    if (opts.account !== undefined && !providerSupportsSessionResume(lane.provider)) {
+        throw new LanesError("provider_session_not_portable", `Provider ${lane.provider} has no session resume, so a lane cannot move between its accounts`, { lane_id: laneId, provider: lane.provider });
+    }
     // One decision point for how a follow-up reaches this lane (delivery.ts).
     // `none` refuses before anything is written: no inbox append, no spawn.
     const mechanism = laneDeliveryMechanism(lane);
@@ -1770,6 +2051,9 @@ async function runMessage(ctx, laneId, opts) {
             message,
         });
     }
+    if (opts.model !== undefined && opts.account === undefined) {
+        throw new LanesError("model_requires_account", "--model on hq lanes message is only accepted together with --account", {});
+    }
     const messageId = mintMessageId();
     const at = ctx.now().toISOString();
     const projectId = opts.project?.trim() || lane.project_id;
@@ -1782,7 +2066,24 @@ async function runMessage(ctx, laneId, opts) {
         story_id: storyId,
     };
     let resumed = null;
-    if (mechanism === "dropbox") {
+    let move = null;
+    if (opts.account !== undefined) {
+        // A moved message is always a resume on the target account: a running
+        // lane (the dropbox mechanism) is refused inside prepareAccountMove.
+        move = await prepareAccountMove(ctx, lane, {
+            account: opts.account,
+            cliModel: opts.model?.trim() || undefined,
+            pending: { trigger: "message", text, message_id: messageId, compact: opts.compact !== false },
+        });
+        lane = move.lane;
+        if (move.queued) {
+            archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+        }
+    }
+    if (move?.queued) {
+        // Parked at the target's cap: reconcile resumes the session there.
+    }
+    else if (mechanism === "dropbox") {
         // Live (or about-to-be-live) process: the PreToolUse drain delivers it.
         if (!laneAcceptsOperatorMessage(lane)) {
             throw new LanesError("lane_not_accepting_messages", operatorMessageRefusalReason(lane.state), { lane_id: laneId, state: lane.state });
@@ -1841,7 +2142,11 @@ async function runMessage(ctx, laneId, opts) {
     // started from; `resume` has started a new worker with the message as its
     // prompt. Neither is "delivered", so the response never says so.
     const drainHook = drainHookStatusFor(ctx, next);
-    const deliveryStatus = mechanism === "dropbox" ? "awaiting_next_tool_call" : "worker_spawned";
+    const deliveryStatus = move?.queued
+        ? "queued_on_target_account"
+        : mechanism === "dropbox"
+            ? "awaiting_next_tool_call"
+            : "worker_spawned";
     const warning = mechanism === "dropbox" && drainHook !== null && !drainHook.registered
         ? `The drain hook is not registered in ${drainHook.path}; the running worker will not receive this message. It stays in the inbox and is delivered on the lane's next start.`
         : mechanism === "dropbox" && next.stalled === true
@@ -1863,11 +2168,24 @@ async function runMessage(ctx, laneId, opts) {
         compaction: resumed?.last_compaction && resumed.last_compaction.resume_at === resumed.last_resume?.at
             ? resumed.last_compaction
             : null,
+        account_move: move ? accountMoveSummary(move) : null,
         project_id: next.project_id,
         story_id: next.story_id,
         lane: next,
     });
 }
+function accountMoveSummary(move) {
+    return {
+        from: move.from,
+        to: move.to,
+        queued: move.queued,
+        copied: move.copy.copied,
+        sources: move.copy.sources,
+        targets: move.copy.targets,
+        source_dir: move.copy.source_dir,
+        target_dir: move.copy.target_dir,
+    };
+}
 /**
  * `hq lanes resume <lane-id> [--text <msg>]`: the explicit opt-in that
  * continues a lane in `interrupted`, `done` or `blocked` on its recorded
@@ -1879,7 +2197,19 @@ async function runMessage(ctx, laneId, opts) {
  */
 async function runResume(ctx, laneId, opts) {
     const hqRoot = ctx.hqRoot();
-    const lane = readLane(hqRoot, laneId);
+    let lane = readLane(hqRoot, laneId);
+    if (opts.model !== undefined && opts.account === undefined) {
+        throw new LanesError("model_requires_account", "--model on hq lanes resume is only accepted together with --account", {});
+    }
+    if (opts.account !== undefined && lane.state === "running") {
+        throw new LanesError("lane_running", `Lane ${laneId} is running; stop it or wait for it to exit before moving its session`, {
+            lane_id: laneId,
+            state: lane.state,
+        });
+    }
+    if (opts.account !== undefined && !providerSupportsSessionResume(lane.provider)) {
+        throw new LanesError("provider_session_not_portable", `Provider ${lane.provider} has no session resume, so a lane cannot move between its accounts`, { lane_id: laneId, provider: lane.provider });
+    }
     const refusal = resumeCommandRefusal(lane);
     if (refusal !== null) {
         throw new LanesError(refusal.error, refusal.message, {
@@ -1896,25 +2226,42 @@ async function runResume(ctx, laneId, opts) {
     const storyId = opts.story?.trim() || lane.story_id;
     const attributionChanged = projectId !== lane.project_id || storyId !== lane.story_id;
     const messageId = text !== undefined || attributionChanged ? mintMessageId() : undefined;
-    const resumed = spawnLaneWorker(hqRoot, lane, {
-        env: ctx.env,
-        existsSync: ctx.existsSync,
-        spawnProcess: ctx.spawnProcess,
-        proveDetached: ctx.proveDetached,
-        killProcess: ctx.killProcess,
-        now: ctx.now,
-        resolveMachineIdentity: ctx.resolveMachineIdentity,
-        runCompaction: ctx.runCompaction,
-        locateTranscript: ctx.locateTranscript,
-    }, {
-        trigger: {
-            kind: "resume",
-            from: resumedFrom,
-            ...(text !== undefined ? { text } : {}),
-            ...(messageId !== undefined ? { message_id: messageId } : {}),
-        },
-        compact: opts.compact !== false,
-    });
+    let move = null;
+    if (opts.account !== undefined) {
+        move = await prepareAccountMove(ctx, lane, {
+            account: opts.account,
+            cliModel: opts.model?.trim() || undefined,
+            pending: {
+                trigger: "resume",
+                resumed_from: resumedFrom,
+                ...(text !== undefined ? { text } : {}),
+                ...(messageId !== undefined ? { message_id: messageId } : {}),
+                compact: opts.compact !== false,
+            },
+        });
+        lane = move.lane;
+    }
+    const resumed = move?.queued
+        ? lane
+        : spawnLaneWorker(hqRoot, lane, {
+            env: ctx.env,
+            existsSync: ctx.existsSync,
+            spawnProcess: ctx.spawnProcess,
+            proveDetached: ctx.proveDetached,
+            killProcess: ctx.killProcess,
+            now: ctx.now,
+            resolveMachineIdentity: ctx.resolveMachineIdentity,
+            runCompaction: ctx.runCompaction,
+            locateTranscript: ctx.locateTranscript,
+        }, {
+            trigger: {
+                kind: "resume",
+                from: resumedFrom,
+                ...(text !== undefined ? { text } : {}),
+                ...(messageId !== undefined ? { message_id: messageId } : {}),
+            },
+            compact: opts.compact !== false,
+        });
     if (text !== undefined && messageId !== undefined) {
         // Same audit copy a message resume leaves; nothing drains it. Archive only
         // after a successful spawn so a concurrent resume cannot leave a phantom.
@@ -1961,7 +2308,8 @@ async function runResume(ctx, laneId, opts) {
         message_id: messageId ?? null,
         text: text ?? null,
         delivery: "resume",
-        delivery_status: "worker_spawned",
+        delivery_status: move?.queued ? "queued_on_target_account" : "worker_spawned",
+        account_move: move ? accountMoveSummary(move) : null,
         resumed_session_id: resumed.last_resume?.session_id ?? null,
         last_resume: next.last_resume ?? null,
         compaction: resumed.last_compaction && resumed.last_compaction.resume_at === resumed.last_resume?.at
@@ -2692,7 +3040,7 @@ async function runReconcileInstall(ctx, opts) {
         hqRoot: ctx.hqRoot(),
         enable: Boolean(opts.enable),
         runCommand: opts.enable ? ctx.runSystemctl : undefined,
-        pathEnv: providerPath.path,
+        providerDirs: providerPath.resolved_dirs,
     });
     printJson({
         ...result,
@@ -2781,6 +3129,8 @@ export function registerLanesCommand(parent, deps = {}) {
         .requiredOption("--text <msg>", "Message text")
         .option("--project <slug>", "Re-point project attribution from this message")
         .option("--story <id>", "Re-point story attribution from this message")
+        .option("--account <id>", "Move the lane's session to this account of its provider before the message resumes it")
+        .option("--model <id>", "Model for the moved lane (with --account only)")
         .option("--no-compact", "Skip the resume-time compaction check for this message")
         .action(wrap(async (laneId, opts) => {
         await runMessage(ctx, laneId, opts);
@@ -2792,6 +3142,8 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--text <msg>", "Operator message for the resumed turn")
         .option("--project <slug>", "Re-point project attribution from this resume")
         .option("--story <id>", "Re-point story attribution from this resume")
+        .option("--account <id>", "Move the lane's session to this account of its provider before resuming")
+        .option("--model <id>", "Model for the moved lane (with --account only)")
         .option("--no-compact", "Skip the resume-time compaction check for this resume")
         .action(wrap(async (laneId, opts) => {
         await runResume(ctx, laneId, opts);

package/dist/commands/mesh.js

@@ -23,7 +23,8 @@ import { flushSessionEvents } from "../lib/mesh/live/flush.js";
 import { backfillHeldSessions } from "../lib/mesh/live/backfill-held.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/live/session-events-client.js";
 const MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
-import { buildEmitEvidence } from "../lib/mesh/live/emit-evidence.js";
+import { buildEmitEvidence, machineEmitDisposition } from "../lib/mesh/live/emit-evidence.js";
+import { appendHeldLine } from "../lib/mesh/live/spool.js";
 import { createEmitPoster, buildMeshEmitEvent } from "../lib/mesh/live/emit-client.js";
 import { emitEvents, formatEmitRejectionLines } from "../lib/mesh/live/emit.js";
 import { readEmitRetry, writeEmitRetry } from "../lib/mesh/live/emit-retry.js";
@@ -1070,6 +1071,7 @@ async function runSessionEnqueue(cliKind, opts) {
         companySlug: opts.companySlug,
         project: opts.project,
         task: opts.task,
+        env: process.env,
     });
     const event = buildMeshEmitEvent({
         eventId: opts.eventId?.trim() || generateUlid(Date.now()),
@@ -1088,6 +1090,23 @@ async function runSessionEnqueue(cliKind, opts) {
         evidence,
     });
     const meshRoot = workMeshHomeRoot();
+    // A machine credential with no company must not be posted. The server files
+    // that as company NONE. Hold it and say why.
+    if (machineEmitDisposition({ machine: isMachineIdentity(), companySlug: evidence.companySlug }) === "hold") {
+        appendHeldLine(JSON.stringify({
+            event,
+            heldReason: "NEEDS_COMPANY",
+            heldAt: new Date().toISOString(),
+            reason: "machine session has no company; event was not sent",
+        }), meshRoot);
+        const heldMessage = `work-mesh: held ${kind}; needs_company (machine session has no company; not sent)`;
+        if (opts.json) {
+            console.log(JSON.stringify({ ok: true, action: "emit", kind, held: true, reason: "needs_company" }, null, 2));
+            return;
+        }
+        console.error(heldMessage);
+        return;
+    }
     // Resolve a token non-interactively (same path as every CLI call). If the box
     // is not logged in, retain the event locally for the next invocation to drain.
     let token;