@indigoai-us/hq-cli 5.131.0 → 5.133.0

package/CHANGELOG.md

@@ -2,6 +2,115 @@
 
 ## [Unreleased]
 
+## [5.133.0] — 2026-09-22
+
+### Fixed
+
+- Lane follow-ups now probe all enabled, logged-in accounts for an unpinned
+  model, preserve the later quota reset and its source, expire abandoned pickup
+  validation markers with a terminal reason, and parse Codex's ordinal
+  `try again at` reset time.
+
+- `hq sync push` no longer fails every file when the target vault was
+  provisioned on or after 2026-09-19. Those vaults carry an S3 Object Lock
+  default retention rule, and S3 refuses a PutObject into them unless the
+  request carries a content checksum; the CLI's declared `@indigoai-us/hq-cloud`
+  range still allowed a client that sends none, so an affected push reported
+  `400 InvalidRequest: Content-MD5 OR x-amz-checksum- HTTP header is required
+  for Put Object requests with Object Lock parameters` on every file. The
+  dependency floor now starts at the release that attaches the checksum, so no
+  install can resolve a client that cannot write to a locked vault. A CI guard
+  holds the floor.
+
+- Lane creation and re-parenting now allow depth 3. A depth-3 caller and any
+  derived depth 4 lane are refused with `max_lane_depth`.
+
+- Question ageing now derives its two-advance cap from the depth-3 lane cap, so
+  an unanswered worker-lane question reaches the user after two hourly hops.
+
+## [5.132.0] — 2026-09-22
+
+### Added
+
+- `hq lanes resume <lane-id> --account <id>` and `hq lanes message <lane-id>
+  --account <id>` move a lane's provider session to another account of the
+  same provider and continue it there, with its full history. The claude
+  transcript (`projects/<encoded cwd>/<session>.jsonl`, plus the session's
+  subagent directory) or the codex rollout
+  (`sessions/YYYY/MM/DD/rollout-*-<session>.jsonl`) is copied into the target
+  account's home; the source copy stays, and a copy the target already holds
+  is refreshed when it differs, so a lane moved back resumes the turns it ran
+  elsewhere. Every check runs before anything is copied or written: the lane must not be running (`lane_running`), the
+  target must be an account of the lane's provider
+  (`account_provider_mismatch`), exist, be enabled, be logged in, hold no
+  quota hold (`account_quota_held`), and know the lane's model; a target that
+  pins a different model needs `--model <id>` (new on both commands, accepted
+  only with `--account`). Grok lanes are refused with
+  `provider_session_not_portable`; a missing transcript or rollout with
+  `provider_session_missing`, naming the path searched. The record's
+  `account` moves, `account_history` gains an `operator_move` entry,
+  `last_resume.account` names the account the run started on, and
+  `hq lanes show` prints them; a record that changed after the move was
+  prepared is refused with `account_move_conflict`. The capacity decision
+  runs under the target account's admission lock, and a moved lane holds its
+  slot (`pending_resume`) until its spawn claims it, so two moves cannot share
+  one free slot. A target at its running cap queues the lane there with
+  `pending_resume`, and the reconcile pass resumes the session on the target,
+  honouring `--no-compact`. Mesh events for a moved lane carry `account` and
+  `account_move`. Credential files are never copied.
+
+- A provider-level turn failure is a named lane failure. When the worker's
+  stdout carries a codex `turn.failed` event, a Claude error result with an
+  HTTP status, or a grok error object, the watcher classifies the lane
+  `failed` with `terminal_reason: provider_rejected` and writes the
+  provider's message (capped), status, error class, `retryable`, and the
+  model and account the run used to `terminal_details`. Such an exit is never
+  `interrupted` and never spawns the envelope repair turn. A 429 stays on the
+  quota path. `hq lanes show` prints `terminal_reason` and
+  `terminal_details`.
+- `hq lanes create --model` is validated against the provider's own model
+  list before anything is written: codex from the account home's
+  `models_cache.json`, grok from `grok models`, claude from the aliases and
+  full-name prefix in `claude --help`. An unknown id is refused with
+  `model_unsupported` naming the provider, the value, the source and the
+  accepted ids. A provider whose list cannot be read (missing, corrupt, or
+  unreadable cache; failed probe) is not validated. Validation runs before
+  the mesh thread is ensured and before the admission lock is taken, so a
+  refusal leaves nothing behind and a slow provider probe never holds the
+  lock. An unpinned create reads the list of every enabled account the
+  balanced choice could land on before the lock; the account is still chosen
+  under the lock, restricted to the accounts whose list accepted the model,
+  so nothing is refused once the mesh thread exists and no probe or catalog
+  read runs while the lock is held. A `grok models` or `claude --help` probe that exits nonzero
+  is not a catalog, whatever it printed, and skips validation. Every outpost
+  lane is validated at pickup on the executing host, after its account
+  binds, and fails with `model_unsupported` there; a lane cancelled during
+  the pickup probe stays cancelled and is not spawned. A picked-up lane is
+  stored ineligible for admission (`pickup_validation_pending`) until its
+  account binds, so the reconcile pass cannot spawn it while the probe is
+  out, and the failure write refuses an already-terminal or running record
+  inside its compare-and-swap.
+- A codex `turn.failed` or grok error with status 429, or with no status and
+  a usage-limit or rate-limit message, now reaches the quota path (reset time
+  and account hold recorded) instead of ending `interrupted`, and skips the
+  envelope repair turn so the hold applies at once; an explicit non-429
+  status wins over quota-sounding text. The reconcile pass applies the same
+  routing when it recovers a lane whose worker and watcher both died. The
+  provider's output is scanned from the tail one line at a time, so a long
+  run's events are never all parsed and held at once. A 429 whose message
+  names no reset time holds the account for the provider's
+  `quota_default_hold_ms` (fifteen minutes unless configured), recorded with
+  `reset_source: default_hold`; a message with a reset time keeps that time.
+
+### Fixed
+
+- `hq lanes reconcile install` no longer copies the installing shell's PATH
+  into the systemd unit. The unit PATH is, per resolved provider, the
+  directory holding the command name and the real binary's directory when a
+  symlink points elsewhere, then the hq binary's directory, then the node
+  binary's directory, then `/usr/local/bin:/usr/bin:/bin`, deduplicated; directories synced from
+  another machine's profile are left out.
+
 ## [5.131.0] — 2026-09-22
 
 ### Added
@@ -19,6 +128,36 @@
 
 ### Fixed
 
+## [Unreleased]
+
+- `hq mesh daemon install` and `hq mesh daemon run` unload and remove the
+  legacy `ai.getindigo.hq-work-mesh-listen` unit (LaunchAgent, systemd user
+  unit, or Scheduled Task) so only the daemon subscribes. The daemon writes
+  `~/.hq/work-mesh/live-cache.json` and bumps its cursor once per project-view
+  push. MQTT reconnect logs once per transition into reconnecting instead of
+  on every close. `hq mesh daemon doctor` reports "legacy listener still
+  installed" while that unit remains (US-006).
+
+## [Unreleased]
+
+- Held-event repair no longer treats a later event timestamp as proof that
+  metadata belongs to the current session instance. A reused session id stays
+  unresolved when the held event's binding episode does not match the current
+  one. A CLI self-update now records the verified HQ root and rewrites a
+  legacy daemon unit (no `HQ_ROOT`, or `Restart=on-failure`) before restarting
+  it, so the new process does not come up with an empty root allowlist.
+
+## [Unreleased]
+
+- A machine credential (fleet box or local bot) no longer posts mesh events
+  with no company. `HQ_SPAWN_COMPANY`, the bot's company, or the identity
+  file is sent with the event. When none of those is set, the event is held
+  as `needs_company` and `hq mesh daemon doctor` shows the held count.
+  A membership probe that a machine token cannot answer leaves the company
+  in place and retries, instead of clearing it.
+
+## [Unreleased]
+
 - Expected caller errors from company resolution, membership, and qmd lookups
   no longer create Sentry issues. Windows filesystem failures remain visible
   and now include redacted path context plus a sync-aware diagnostic.
@@ -41,6 +180,14 @@
   active `cognito-tokens.json` is left unchanged. `hq mesh daemon doctor`
   prints the whoami subject and the subject the daemon is using.
 
+### Changed
+
+- Local bots can reply to other people and bots in direct messages and in
+  connected rooms without an owner-only sender restriction. Each DM
+  correspondent has a separate conversation, and the owner's private context
+  stays out of other people's conversations. Bots retain their configured
+  owner and check suspicious requests before taking sensitive actions.
+
 ## [5.130.0] — 2026-09-22
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -6780,6 +6780,12 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--story <id>";
             readonly description: "Re-point story attribution from this message";
+        }, {
+            readonly flags: "--account <id>";
+            readonly description: "Move the lane's session to this account of its provider before the message resumes it";
+        }, {
+            readonly flags: "--model <id>";
+            readonly description: "Model for the moved lane (with --account only)";
         }, {
             readonly flags: "--no-compact";
             readonly description: "Skip the resume-time compaction check for this message";
@@ -6808,6 +6814,12 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--story <id>";
             readonly description: "Re-point story attribution from this resume";
+        }, {
+            readonly flags: "--account <id>";
+            readonly description: "Move the lane's session to this account of its provider before resuming";
+        }, {
+            readonly flags: "--model <id>";
+            readonly description: "Model for the moved lane (with --account only)";
         }, {
             readonly flags: "--no-compact";
             readonly description: "Skip the resume-time compaction check for this resume";

package/dist/command-catalog.generated.js

@@ -8763,6 +8763,14 @@ export const COMMAND_CATALOG = [
                         "flags": "--story <id>",
                         "description": "Re-point story attribution from this message"
                     },
+                    {
+                        "flags": "--account <id>",
+                        "description": "Move the lane's session to this account of its provider before the message resumes it"
+                    },
+                    {
+                        "flags": "--model <id>",
+                        "description": "Model for the moved lane (with --account only)"
+                    },
                     {
                         "flags": "--no-compact",
                         "description": "Skip the resume-time compaction check for this message"
@@ -8800,6 +8808,14 @@ export const COMMAND_CATALOG = [
                         "flags": "--story <id>",
                         "description": "Re-point story attribution from this resume"
                     },
+                    {
+                        "flags": "--account <id>",
+                        "description": "Move the lane's session to this account of its provider before resuming"
+                    },
+                    {
+                        "flags": "--model <id>",
+                        "description": "Model for the moved lane (with --account only)"
+                    },
                     {
                         "flags": "--no-compact",
                         "description": "Skip the resume-time compaction check for this resume"

package/dist/commands/lanes.d.ts

@@ -7,13 +7,14 @@
 import { Command } from "commander";
 import { type OutpostDispatchResult } from "../lib/lanes/outpost-dispatch.js";
 import { emitLaneDecisionEvents, type LaneMesh } from "../lib/lanes/mesh-events.js";
-import { type LaneCompanyRef, type LaneRecord, type QuestionRecord, type ResolvedLaneWorker, type SeniorRef, type LivenessDeps, type MachineIdentity, type RunCommand, type ThrottleDeps } from "../lib/lanes/index.js";
+import { MAX_LANE_DEPTH, type LaneCompanyRef, type LaneRecord, type QuestionRecord, type ResolvedLaneWorker, type SeniorRef, type LivenessDeps, type MachineIdentity, type RunCommand, type ThrottleDeps } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { type RunCompactionFn } from "../lib/lanes/compaction.js";
+import { type KnownModelsDeps, type ProbeCommand } from "../lib/lanes/models.js";
 import { spawnLaneWorker, type KillProcessFn, type ProveDetachedFn, type SpawnProcessFn } from "../lib/lanes/spawn.js";
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
-export declare const MAX_LANE_DEPTH = 2;
+export { MAX_LANE_DEPTH };
 export declare const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
 export declare const OUTPOST_DIR = "/etc/outpost";
 export declare const LANES_RUNS_REL: string;
@@ -62,6 +63,8 @@ export interface LanesCommandDeps {
     presenceConnected?: boolean;
     systemdRoot?: string;
     runSystemctl?: RunCommand;
+    /** Provider CLI probe for --model validation; tests inject a fake. */
+    probeProvider?: ProbeCommand;
     resolveMachineIdentity?: () => MachineIdentity;
     stageOutpostPayload?: (outpostId: string, bytes: Uint8Array) => Promise<{
         getUrl: string;
@@ -100,14 +103,22 @@ export declare function composeWorkerBrief(worker: ResolvedLaneWorker, taskBrief
  */
 export declare function composeGeneralBrief(taskBrief: string): string;
 export declare function parseMaxRuntimeSeconds(raw: unknown, workerId: string): number | undefined;
-export declare const PICKUP_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled"];
+export declare const PICKUP_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "model_unsupported"];
 export declare const DISPATCH_TERMINAL_REASON: "outpost_dispatch_failed";
 export type PickupTerminalReason = (typeof PICKUP_TERMINAL_REASONS)[number];
+/**
+ * The CAS updater a pickup failure applies. A lane that is already terminal
+ * for any reason (a cancel that landed after the caller's last read, an
+ * earlier pickup failure) is returned unchanged: the guard lives inside the
+ * same compare-and-swap that writes the failure, so no read-then-write gap
+ * can overwrite another writer's terminal decision.
+ */
+export declare function pickupFailureUpdater(reasonRaw: string, details: Record<string, unknown>): (current: LaneRecord) => LaneRecord;
 /**
  * Outpost-side account bind (spec §5.2). Writes a named terminal reason,
  * never a plain `failed`.
  */
-export declare function applyOutpostAccountPickup(hqRoot: string, laneId: string): LaneRecord;
+export declare function applyOutpostAccountPickup(hqRoot: string, laneId: string, modelDeps?: KnownModelsDeps): LaneRecord;
 export declare function cancelPendingQuestionsForLane(hqRoot: string, laneId: string, nowIso: string, operatorReason?: string): QuestionRecord[];
 export declare function stopCommittedState(state: LaneRecord["state"]): "cancelled" | "killed";
 export declare function registerLanesCommand(parent: Command, deps?: LanesCommandDeps): Command;