@indigoai-us/hq-cli 5.131.0 → 5.133.0

package/dist/lib/lanes/index.js

@@ -2,8 +2,9 @@
  * Library layer for `hq lanes`. The command module should import from here.
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
+export { MAX_LANE_DEPTH } from "./constants.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";
-export { DEFAULT_ACCOUNT_HOMES, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, writeLanesConfig, } from "./config.js";
+export { DEFAULT_ACCOUNT_HOMES, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";
 export { resolveLanesHqRoot } from "./hq-root.js";
 export { buildOutpostPickupCommand, parseOutpostPickupPayload, } from "./outpost-dispatch.js";
 export { LANES_STORE_REL, LANE_RECORDS_DIR, PENDING_INDEX_DIR, QUESTION_RECORDS_DIR, appendCappedHistory, appendLaneAttribution, appendLaneSeniorHistory, appendQuestionRouting, createLane, createQuestion, isConflictSidecarName, laneRecordPath, lanesStoreRoot, listLaneIds, listQuestionIds, mergeLaneRecords, mergeQuestionRecords, mintLaneId, mintQuestionId, parseLaneRecord, parseQuestionRecord, pendingMarkerPath, questionRecordPath, readLane, readQuestion, resolveStoreHqRoot, sanitizeHostComponent, tryReadLane, tryReadQuestion, retryUpdateLane, retryUpdateQuestion, updateLane, updateQuestion, } from "./store.js";
@@ -17,6 +18,10 @@ export { AUTH_JSON_NAME, CLAUDE_CREDENTIALS_NAME, PROVIDER_CREDENTIAL_FILES, PRO
 export { LIVE_WITHIN_MS, LIVENESS_EVENT_KINDS, SILENT_LOST_MS, TURN_START_LOST_MS, buildLivenessIndexFromSpool, classifySessionLiveness, defaultLivenessDeps, defaultSpoolPath, ingestSpoolLine, listSessionLiveness, livenessIndexPath, loadLivenessIndex, readDaemonPresenceConnected, readLivenessIndex, rebuildLivenessIndex, sessionLiveness, } from "./liveness.js";
 export { DEAD_HOST_MS, MAX_AGED_ADVANCES, QUESTION_AGE_MS, RECONCILE_TIMER_NAME, RECONCILE_UNIT_NAME, agedAdvanceCount, currentHopStartedAtMs, isDeadlinePassed, laneRunsHere, readTimeoutDeadline, reconcileHeartbeatPath, resolveQuestionAudience, runReconcilePass, shouldAdvanceAudienceEnded, shouldAgeQuestion, timeoutPath, } from "./reconcile.js";
 export { RECONCILE_TIMER_INTERVAL, defaultSystemdUserDir, installReconcileTimer, providerPathEnv, renderReconcileService, renderReconcileTimer, uninstallReconcileTimer, } from "./reconcile-install.js";
+export { unitPathEnv } from "./reconcile-install.js";
+export { PROVIDER_REJECTED_REASON, PROVIDER_REJECTION_MESSAGE_CAP, parseClaudeResultRejection, parseCodexTurnFailed, parseGrokErrorOutput, parseProviderRejection, readProviderRejection, retryableFromStatus, } from "./provider-rejection.js";
+export { CODEX_MODELS_CACHE_NAME, MODEL_PROBE_TIMEOUT_MS, claudeKnownModels, codexKnownModels, defaultProbe, grokKnownModels, knownModels, modelIsKnown, parseClaudeHelpModels, parseGrokModelsOutput, validateLaneModel, } from "./models.js";
+export { SESSION_MOVE_REASON, copySessionFiles, encodeClaudeProjectDir, findCodexRollout, planClaudeSessionCopy, planCodexSessionCopy, planSessionCopy, } from "./move-account.js";
 export { WORKER_REGISTRY_REL, personalWorkerDir, personalWorkerExists, readWorkerRegistryFile, registryPath, resolveContextBasePaths, resolveLaneWorker, resolveSkillFiles, tenancyFromRegistryPath, } from "./registry.js";
 export { bodyStoreForLane, envelopeQuestionId, parseQuestionBodyStore, questionBodyAbsPath, questionBodyRef, raiseEnvelopeQuestions, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "./questions.js";
 export { LANE_DELIVERY_MECHANISMS, LAUNCH_TRIGGERS, PROVIDER_SESSION_RESUME, RESUMABLE_LANE_STATES, RESUME_COMMAND_STATES, SESSION_ID_ABSENT_REASONS, claimableStatesFor, deliveryRefusalReason, hasRecordedSessionId, isResumableLaneState, isResumeCommandState, laneDeliveryMechanism, parseClaudeResultOutput, parseCodexEventOutput, parseWorkerRunOutput, planLaneLaunch, providerSupportsSessionResume, readWorkerRunResult, resumeCommandRefusal, } from "./delivery.js";

package/dist/lib/lanes/mesh-events.js

@@ -191,10 +191,14 @@ export function laneCanEmit(lane) {
     return lane.company !== null && lane.company !== undefined && !!lane.thread_id;
 }
 function baseIdentity(lane) {
+    const lastMove = lane.account_history?.[lane.account_history.length - 1];
     return {
         lane_id: lane.lane_id,
         project_id: lane.project_id,
         story_id: lane.story_id,
+        ...(lane.account !== undefined ? { account: lane.account } : {}),
+        // A moved lane names the move on every event its run emits (US-023 §8).
+        ...(lastMove !== undefined ? { account_move: { from: lastMove.from, to: lastMove.to, at: lastMove.at } } : {}),
     };
 }
 /**

package/dist/lib/lanes/models.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Per-provider known model ids, for validating `hq lanes create --model`.
+ *
+ * No provider adapter in this package carries a model list, so each id set
+ * is read from where the provider itself keeps it, the way the accounts
+ * probes read provider state: from the account home or the provider CLI,
+ * never from a list written into this package.
+ *
+ * - codex: `<CODEX_HOME>/models_cache.json`, the model catalog the codex CLI
+ *   fetches and caches per home. Every `models[].slug` is accepted.
+ * - grok: `grok models` (run with `GROK_HOME` set to the account home),
+ *   which prints `Available models:` followed by one id per line. It lists
+ *   models even when the home is not logged in.
+ * - claude: `claude --help`, whose `--model` text names the accepted aliases
+ *   (`'fable', 'opus', or 'sonnet'`) and says a full name is accepted too.
+ *   An alias from that text or any `claude-` full name passes.
+ *
+ * A source that cannot be read (no cache yet, CLI missing, probe failed)
+ * returns null and the caller skips validation: the provider's own
+ * rejection at run time is still classified `provider_rejected`.
+ */
+import type { LaneProvider } from "./types.js";
+export declare const CODEX_MODELS_CACHE_NAME = "models_cache.json";
+export declare const MODEL_PROBE_TIMEOUT_MS = 10000;
+export interface ProbeResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+export type ProbeCommand = (command: string, args: string[], env: NodeJS.ProcessEnv) => ProbeResult;
+export interface KnownModelsDeps {
+    readFileSync?: (p: string, encoding: "utf8") => string;
+    probe?: ProbeCommand;
+    env?: NodeJS.ProcessEnv;
+}
+export interface KnownModels {
+    provider: LaneProvider;
+    /** Exact ids the provider accepts. */
+    ids: string[];
+    /** Prefixes accepted in addition to `ids` (claude full names). */
+    prefixes: string[];
+    /** Where the list came from, for the refusal and the report. */
+    source: string;
+}
+export declare function defaultProbe(command: string, args: string[], env: NodeJS.ProcessEnv): ProbeResult;
+/** Read `models[].slug` from the codex catalog cache in `home`. Null when absent or unreadable. */
+export declare function codexKnownModels(home: string, readFileSync?: NonNullable<KnownModelsDeps["readFileSync"]>): KnownModels | null;
+/**
+ * Parse `grok models` output:
+ *
+ *     Available models:
+ *       * grok-4.7 (default)
+ *       - grok-4.7-build-fast
+ */
+export declare function parseGrokModelsOutput(text: string): string[];
+export declare function grokKnownModels(home: string, probe?: ProbeCommand, env?: NodeJS.ProcessEnv): KnownModels | null;
+/**
+ * Parse the `--model` option text of `claude --help`:
+ *
+ *     --model <model>   Model for the current session. Provide an alias for
+ *                       the latest model (e.g. 'fable', 'opus', or 'sonnet')
+ *                       or a model's full name (e.g. 'claude-fable-5').
+ *
+ * Returns the quoted aliases and the prefix of the quoted full-name example.
+ */
+export declare function parseClaudeHelpModels(text: string): {
+    aliases: string[];
+    prefixes: string[];
+};
+export declare function claudeKnownModels(probe?: ProbeCommand, env?: NodeJS.ProcessEnv): KnownModels | null;
+export declare function knownModels(provider: LaneProvider, home: string, deps?: KnownModelsDeps): KnownModels | null;
+export declare function modelIsKnown(known: KnownModels, model: string): boolean;
+/**
+ * Refuse a `--model` the provider does not know. Returns the source used, or
+ * null when no source was readable and the value passed unvalidated.
+ */
+export declare function validateLaneModel(provider: LaneProvider, model: string, home: string, deps?: KnownModelsDeps): string | null;
+//# sourceMappingURL=models.d.ts.map

package/dist/lib/lanes/models.js

@@ -0,0 +1,205 @@
+/**
+ * Per-provider known model ids, for validating `hq lanes create --model`.
+ *
+ * No provider adapter in this package carries a model list, so each id set
+ * is read from where the provider itself keeps it, the way the accounts
+ * probes read provider state: from the account home or the provider CLI,
+ * never from a list written into this package.
+ *
+ * - codex: `<CODEX_HOME>/models_cache.json`, the model catalog the codex CLI
+ *   fetches and caches per home. Every `models[].slug` is accepted.
+ * - grok: `grok models` (run with `GROK_HOME` set to the account home),
+ *   which prints `Available models:` followed by one id per line. It lists
+ *   models even when the home is not logged in.
+ * - claude: `claude --help`, whose `--model` text names the accepted aliases
+ *   (`'fable', 'opus', or 'sonnet'`) and says a full name is accepted too.
+ *   An alias from that text or any `claude-` full name passes.
+ *
+ * A source that cannot be read (no cache yet, CLI missing, probe failed)
+ * returns null and the caller skips validation: the provider's own
+ * rejection at run time is still classified `provider_rejected`.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { LanesError } from "./errors.js";
+import { PROVIDER_HOME_ENV } from "./accounts.js";
+export const CODEX_MODELS_CACHE_NAME = "models_cache.json";
+export const MODEL_PROBE_TIMEOUT_MS = 10_000;
+export function defaultProbe(command, args, env) {
+    const result = spawnSync(command, args, {
+        env,
+        encoding: "utf8",
+        timeout: MODEL_PROBE_TIMEOUT_MS,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.error) {
+        return { status: null, stdout: "", stderr: result.error.message };
+    }
+    return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+}
+function isPlainObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Read `models[].slug` from the codex catalog cache in `home`. Null when absent or unreadable. */
+export function codexKnownModels(home, readFileSync = (p, enc) => fs.readFileSync(p, enc)) {
+    const source = path.join(home, CODEX_MODELS_CACHE_NAME);
+    let text;
+    try {
+        text = readFileSync(source, "utf8");
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return null;
+        // EACCES, EISDIR, EIO: the list cannot be read, which is the same
+        // contract as a missing or corrupt cache. Reported, never an internal failure.
+        process.stderr.write(`hq lanes: cannot read ${source} (${err instanceof Error ? err.message : String(err)}); --model is not validated for codex\n`);
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        process.stderr.write(`hq lanes: ${source} is not JSON (${err instanceof Error ? err.message : String(err)}); --model is not validated for codex\n`);
+        return null;
+    }
+    if (!isPlainObject(parsed) || !Array.isArray(parsed.models))
+        return null;
+    const ids = [];
+    for (const entry of parsed.models) {
+        if (isPlainObject(entry) && typeof entry.slug === "string" && entry.slug.trim().length > 0) {
+            ids.push(entry.slug.trim());
+        }
+    }
+    if (ids.length === 0)
+        return null;
+    return { provider: "codex", ids, prefixes: [], source };
+}
+/**
+ * Parse `grok models` output:
+ *
+ *     Available models:
+ *       * grok-4.7 (default)
+ *       - grok-4.7-build-fast
+ */
+export function parseGrokModelsOutput(text) {
+    const ids = [];
+    let inList = false;
+    for (const raw of text.split("\n")) {
+        const line = raw.trim();
+        if (/^available models:/i.test(line)) {
+            inList = true;
+            continue;
+        }
+        if (!inList)
+            continue;
+        const match = /^[*-]\s+(\S+)/.exec(line);
+        if (match) {
+            ids.push(match[1]);
+        }
+        else if (line.length === 0 && ids.length > 0) {
+            break;
+        }
+    }
+    return ids;
+}
+export function grokKnownModels(home, probe = defaultProbe, env = process.env) {
+    const source = "grok models";
+    const result = probe("grok", ["models"], { ...env, [PROVIDER_HOME_ENV.grok]: home });
+    // Only a probe that exited 0 is a catalog. A wrapper or auth check can
+    // print a partial list and then fail; an id missing from that output must
+    // not refuse the model, so a failed probe skips validation.
+    if (result.status !== 0) {
+        process.stderr.write(`hq lanes: \`${source}\` failed (exit ${result.status ?? "spawn error"}${result.stderr.trim() ? `: ${result.stderr.trim().split("\n")[0]}` : ""}); --model is not validated for grok\n`);
+        return null;
+    }
+    const ids = parseGrokModelsOutput(result.stdout);
+    if (ids.length === 0) {
+        process.stderr.write(`hq lanes: \`${source}\` listed no models (exit ${result.status ?? "spawn error"}${result.stderr.trim() ? `: ${result.stderr.trim().split("\n")[0]}` : ""}); --model is not validated for grok\n`);
+        return null;
+    }
+    return { provider: "grok", ids, prefixes: [], source };
+}
+/**
+ * Parse the `--model` option text of `claude --help`:
+ *
+ *     --model <model>   Model for the current session. Provide an alias for
+ *                       the latest model (e.g. 'fable', 'opus', or 'sonnet')
+ *                       or a model's full name (e.g. 'claude-fable-5').
+ *
+ * Returns the quoted aliases and the prefix of the quoted full-name example.
+ */
+export function parseClaudeHelpModels(text) {
+    const start = text.indexOf("--model");
+    if (start === -1)
+        return { aliases: [], prefixes: [] };
+    const rest = text.slice(start);
+    const end = rest.search(/\n\s*-{1,2}[A-Za-z]/);
+    const block = end === -1 ? rest : rest.slice(0, end);
+    const aliases = [];
+    const prefixes = new Set();
+    // Only quoted tokens shaped like an id: the possessive in "model's" also
+    // opens a quote, and must not be read as one.
+    for (const match of block.matchAll(/'([A-Za-z0-9][A-Za-z0-9._[\]-]*)'/g)) {
+        const value = match[1];
+        const dash = value.indexOf("-");
+        if (dash > 0) {
+            prefixes.add(value.slice(0, dash + 1));
+        }
+        else {
+            aliases.push(value);
+        }
+    }
+    return { aliases, prefixes: [...prefixes] };
+}
+export function claudeKnownModels(probe = defaultProbe, env = process.env) {
+    const source = "claude --help";
+    const result = probe("claude", ["--help"], env);
+    if (result.status !== 0) {
+        process.stderr.write(`hq lanes: \`${source}\` failed (exit ${result.status ?? "spawn error"}${result.stderr.trim() ? `: ${result.stderr.trim().split("\n")[0]}` : ""}); --model is not validated for claude\n`);
+        return null;
+    }
+    const parsed = parseClaudeHelpModels(result.stdout);
+    if (parsed.aliases.length === 0 && parsed.prefixes.length === 0) {
+        process.stderr.write(`hq lanes: \`${source}\` named no --model aliases (exit ${result.status ?? "spawn error"}); --model is not validated for claude\n`);
+        return null;
+    }
+    return { provider: "claude", ids: parsed.aliases, prefixes: parsed.prefixes, source };
+}
+export function knownModels(provider, home, deps = {}) {
+    switch (provider) {
+        case "codex":
+            return codexKnownModels(home, deps.readFileSync);
+        case "grok":
+            return grokKnownModels(home, deps.probe, deps.env);
+        case "claude":
+            return claudeKnownModels(deps.probe, deps.env);
+        default: {
+            const _exhaustive = provider;
+            return _exhaustive;
+        }
+    }
+}
+export function modelIsKnown(known, model) {
+    if (known.ids.includes(model))
+        return true;
+    return known.prefixes.some((prefix) => model.startsWith(prefix) && model.length > prefix.length);
+}
+/**
+ * Refuse a `--model` the provider does not know. Returns the source used, or
+ * null when no source was readable and the value passed unvalidated.
+ */
+export function validateLaneModel(provider, model, home, deps = {}) {
+    const known = knownModels(provider, home, deps);
+    if (known === null)
+        return null;
+    if (modelIsKnown(known, model))
+        return known.source;
+    const accepted = [...known.ids, ...known.prefixes.map((prefix) => `${prefix}*`)];
+    const message = `Provider ${provider} does not know model ${JSON.stringify(model)} (source: ${known.source}). Accepted: ${accepted.join(", ")}`;
+    // `message` is in details too: LanesError.toJSON prints details only.
+    throw new LanesError("model_unsupported", message, { provider, model, accepted, source: known.source, message });
+}
+//# sourceMappingURL=models.js.map

package/dist/lib/lanes/move-account.d.ts

@@ -0,0 +1,56 @@
+/**
+ * US-023: move a lane's provider session to another account of the same
+ * provider. A provider CLI only resumes sessions stored under its own home
+ * (`CLAUDE_CONFIG_DIR/projects/<encoded cwd>/<id>.jsonl`,
+ * `CODEX_HOME/sessions/YYYY/MM/DD/rollout-*-<id>.jsonl`), so the session
+ * files are copied into the target home first. The source copy is never
+ * moved or deleted, so the lane can be moved back. Only session transcripts
+ * are copied: a credential file name is refused by name, whatever path it
+ * arrives on.
+ */
+import type { LaneProvider } from "./types.js";
+export declare const SESSION_MOVE_REASON: "operator_move";
+export interface SessionCopyPlan {
+    provider: LaneProvider;
+    /** Source files, absolute. */
+    sources: string[];
+    /** Target files, absolute, in the same order as `sources`. */
+    targets: string[];
+    /** Source directory copied as a tree (claude subagent transcripts), or null. */
+    source_dir: string | null;
+    target_dir: string | null;
+}
+export interface SessionCopyResult extends SessionCopyPlan {
+    /** Target paths that were written by this call (already-present ones are not listed). */
+    copied: string[];
+}
+/** `claude` keys a project directory by its cwd with every non-alphanumeric character as `-`. */
+export declare function encodeClaudeProjectDir(cwd: string): string;
+/**
+ * Locate the claude transcript `<sessionId>.jsonl` and its optional sibling
+ * `<sessionId>/` directory under `<home>/projects/<encoded cwd>/`.
+ */
+export declare function planClaudeSessionCopy(sourceHome: string, targetHome: string, cwd: string, sessionId: string): SessionCopyPlan;
+/** Walk `<home>/sessions/YYYY/MM/DD/` for `rollout-*-<sessionId>.jsonl`. */
+export declare function findCodexRollout(home: string, sessionId: string): string | null;
+export declare function planCodexSessionCopy(sourceHome: string, targetHome: string, sessionId: string): SessionCopyPlan;
+export declare function planSessionCopy(provider: LaneProvider, input: {
+    sourceHome: string;
+    targetHome: string;
+    cwd: string;
+    sessionId: string;
+}): SessionCopyPlan;
+/** Every file a plan would write, transcript(s) first, then the subagent tree. */
+export declare function planFiles(plan: SessionCopyPlan): Array<{
+    from: string;
+    to: string;
+}>;
+/**
+ * Execute a plan: copy the transcript(s) and the subagent tree into the
+ * target home. Every path is checked against the credential file names
+ * before the first byte is copied, so a refusal writes nothing. A file
+ * already present in the target with the same content is left alone; one
+ * that differs is replaced by the source copy. The source is never touched.
+ */
+export declare function copySessionFiles(plan: SessionCopyPlan): SessionCopyResult;
+//# sourceMappingURL=move-account.d.ts.map

package/dist/lib/lanes/move-account.js

@@ -0,0 +1,193 @@
+/**
+ * US-023: move a lane's provider session to another account of the same
+ * provider. A provider CLI only resumes sessions stored under its own home
+ * (`CLAUDE_CONFIG_DIR/projects/<encoded cwd>/<id>.jsonl`,
+ * `CODEX_HOME/sessions/YYYY/MM/DD/rollout-*-<id>.jsonl`), so the session
+ * files are copied into the target home first. The source copy is never
+ * moved or deleted, so the lane can be moved back. Only session transcripts
+ * are copied: a credential file name is refused by name, whatever path it
+ * arrives on.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { PROVIDER_CREDENTIAL_FILES } from "./accounts.js";
+import { LanesError } from "./errors.js";
+export const SESSION_MOVE_REASON = "operator_move";
+/** `claude` keys a project directory by its cwd with every non-alphanumeric character as `-`. */
+export function encodeClaudeProjectDir(cwd) {
+    return cwd.replace(/[^A-Za-z0-9]/g, "-");
+}
+function credentialName(provider, file) {
+    const base = path.basename(file);
+    return Object.values(PROVIDER_CREDENTIAL_FILES).some((names) => names.includes(base)) ||
+        PROVIDER_CREDENTIAL_FILES[provider].includes(base);
+}
+function isDirectory(p) {
+    try {
+        return fs.statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function isFile(p) {
+    try {
+        return fs.statSync(p).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function sessionMissing(provider, sessionId, searched) {
+    return new LanesError("provider_session_missing", `No ${provider} session ${sessionId} under the source account home. Searched: ${searched.join(", ")}`, { provider, session_id: sessionId, searched });
+}
+/**
+ * Locate the claude transcript `<sessionId>.jsonl` and its optional sibling
+ * `<sessionId>/` directory under `<home>/projects/<encoded cwd>/`.
+ */
+export function planClaudeSessionCopy(sourceHome, targetHome, cwd, sessionId) {
+    const rel = path.join("projects", encodeClaudeProjectDir(cwd));
+    const transcript = path.join(sourceHome, rel, `${sessionId}.jsonl`);
+    if (!isFile(transcript))
+        throw sessionMissing("claude", sessionId, [transcript]);
+    const subagents = path.join(sourceHome, rel, sessionId);
+    const hasSubagents = isDirectory(subagents);
+    return {
+        provider: "claude",
+        sources: [transcript],
+        targets: [path.join(targetHome, rel, `${sessionId}.jsonl`)],
+        source_dir: hasSubagents ? subagents : null,
+        target_dir: hasSubagents ? path.join(targetHome, rel, sessionId) : null,
+    };
+}
+/** Walk `<home>/sessions/YYYY/MM/DD/` for `rollout-*-<sessionId>.jsonl`. */
+export function findCodexRollout(home, sessionId) {
+    const root = path.join(home, "sessions");
+    if (!isDirectory(root))
+        return null;
+    const suffix = `-${sessionId}.jsonl`;
+    const stack = [{ dir: root, depth: 0 }];
+    while (stack.length > 0) {
+        const { dir, depth } = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (depth < 3)
+                    stack.push({ dir: full, depth: depth + 1 });
+            }
+            else if (entry.isFile() && entry.name.startsWith("rollout-") && entry.name.endsWith(suffix)) {
+                return full;
+            }
+        }
+    }
+    return null;
+}
+export function planCodexSessionCopy(sourceHome, targetHome, sessionId) {
+    const rollout = findCodexRollout(sourceHome, sessionId);
+    if (rollout === null) {
+        throw sessionMissing("codex", sessionId, [path.join(sourceHome, "sessions", "**", `rollout-*-${sessionId}.jsonl`)]);
+    }
+    const rel = path.relative(sourceHome, rollout);
+    return {
+        provider: "codex",
+        sources: [rollout],
+        targets: [path.join(targetHome, rel)],
+        source_dir: null,
+        target_dir: null,
+    };
+}
+export function planSessionCopy(provider, input) {
+    switch (provider) {
+        case "claude":
+            return planClaudeSessionCopy(input.sourceHome, input.targetHome, input.cwd, input.sessionId);
+        case "codex":
+            return planCodexSessionCopy(input.sourceHome, input.targetHome, input.sessionId);
+        case "grok":
+            throw new LanesError("provider_session_not_portable", "Provider grok has no session resume, so a lane cannot move between grok accounts", { provider });
+        default: {
+            const _exhaustive = provider;
+            return _exhaustive;
+        }
+    }
+}
+function refuseCredential(provider, file) {
+    if (credentialName(provider, file)) {
+        throw new LanesError("credential_copy_refused", `Refusing to copy ${path.basename(file)}: only session transcripts move between accounts`, { provider, file: path.basename(file) });
+    }
+}
+function sameContent(a, b) {
+    try {
+        const sa = fs.statSync(a);
+        const sb = fs.statSync(b);
+        if (sa.size !== sb.size)
+            return false;
+        return fs.readFileSync(a).equals(fs.readFileSync(b));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Copy one file via a temp name and rename, so a partial copy is never a
+ * visible transcript. A target that already exists is refreshed when its
+ * content differs: the lane last ran on the source account, so the source
+ * copy is the newer one (a lane moved A→B and back to A must not resume A's
+ * pre-move transcript). Returns false when the target already matched.
+ */
+function copyFileAtomic(source, target) {
+    if (fs.existsSync(target) && sameContent(source, target))
+        return false;
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    const tmp = `${target}.partial.${process.pid}`;
+    fs.copyFileSync(source, tmp);
+    fs.renameSync(tmp, target);
+    return true;
+}
+function listTree(sourceDir, targetDir, out) {
+    for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true })) {
+        const from = path.join(sourceDir, entry.name);
+        const to = path.join(targetDir, entry.name);
+        if (entry.isDirectory()) {
+            listTree(from, to, out);
+        }
+        else if (entry.isFile()) {
+            out.push({ from, to });
+        }
+    }
+}
+/** Every file a plan would write, transcript(s) first, then the subagent tree. */
+export function planFiles(plan) {
+    const files = plan.sources.map((from, i) => ({ from, to: plan.targets[i] }));
+    if (plan.source_dir !== null && plan.target_dir !== null) {
+        listTree(plan.source_dir, plan.target_dir, files);
+    }
+    return files;
+}
+/**
+ * Execute a plan: copy the transcript(s) and the subagent tree into the
+ * target home. Every path is checked against the credential file names
+ * before the first byte is copied, so a refusal writes nothing. A file
+ * already present in the target with the same content is left alone; one
+ * that differs is replaced by the source copy. The source is never touched.
+ */
+export function copySessionFiles(plan) {
+    const files = planFiles(plan);
+    for (const file of files) {
+        refuseCredential(plan.provider, file.from);
+        refuseCredential(plan.provider, file.to);
+    }
+    const copied = [];
+    for (const file of files) {
+        if (copyFileAtomic(file.from, file.to))
+            copied.push(file.to);
+    }
+    return { ...plan, copied };
+}
+//# sourceMappingURL=move-account.js.map

package/dist/lib/lanes/provider-rejection.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Provider-level turn failures read off the worker's own stdout.
+ *
+ * A worker whose turn the provider refused (a 400 for a model the account
+ * cannot use, a 402 for an exhausted balance, a 5xx) exits with partial
+ * output and no envelope. Without this module the watcher classifies that
+ * `interrupted` with `exited_with_partial_output`, and the operator has to
+ * read the raw log to learn why. Here the failure is named: the lane is
+ * `failed` with `terminal_reason: provider_rejected` and the provider's own
+ * message on `terminal_details`.
+ *
+ * A 429 is parsed here like any other status so that a codex or grok 429,
+ * which the claude-shaped quota reader cannot see, still reaches the quota
+ * path: the watcher routes a `status === QUOTA_STATUS` failure to quota.ts
+ * (reset time, account hold) and everything else to `provider_rejected`.
+ *
+ * Only the fields named below are read out of the payload. The prompt, the
+ * response body and everything else stay on disk. Nothing here logs.
+ */
+import type { LaneProvider } from "./types.js";
+export declare const PROVIDER_REJECTED_REASON: "provider_rejected";
+/** Bytes of the provider message kept on the record. The log keeps the rest. */
+export declare const PROVIDER_REJECTION_MESSAGE_CAP = 2000;
+/** Status the watcher routes to the quota path instead of `provider_rejected`. */
+export declare const QUOTA_STATUS = 429;
+export interface ProviderRejection {
+    reason: typeof PROVIDER_REJECTED_REASON;
+    provider: LaneProvider;
+    /** The provider's error message, verbatim, capped at PROVIDER_REJECTION_MESSAGE_CAP. */
+    message: string;
+    /** HTTP status the provider reported; null when the payload named none. */
+    status: number | null;
+    /** Provider error class, e.g. `invalid_request_error`; null when absent. */
+    error_type: string | null;
+    /** Derived from the status: a transient class (408, 425, 5xx) is retryable; a 4xx is not. */
+    retryable: boolean;
+    /** Which event on the stream carried the failure. */
+    event: "codex.turn.failed" | "claude.result.is_error" | "grok.error";
+}
+export declare function capMessage(message: string): string;
+/**
+ * Whether a later run could succeed without the operator changing anything.
+ * A 400 model rejection cannot; a request timeout, a too-early, or a server
+ * error can. An unknown status is not retryable: guessing "try again" on a
+ * failure we cannot classify would loop the lane.
+ */
+export declare function retryableFromStatus(status: number | null): boolean;
+/**
+ * Codex `exec --json`: `{"type":"turn.failed","error":{"message":"<text>"}}`.
+ * Measured 2026-09-22 (lane 01M34HCCP1ZDN3H68ESCRZE7RZ): the message is
+ * itself a JSON string, `{"type":"error","status":400,"error":{"type":
+ * "invalid_request_error","message":"The 'terra' model is not supported when
+ * using Codex with a ChatGPT account."}}`. The inner message and status are
+ * read when it parses; otherwise the outer text is the message.
+ */
+export declare function parseCodexTurnFailed(text: string): ProviderRejection | null;
+/**
+ * Claude `-p --output-format json`: the last `type: "result"` object with
+ * `is_error: true` and a numeric `api_error_status`. A result that is an
+ * error with no status is not a provider rejection: it is either the quota
+ * text shape quota.ts reads, or the worker's own failure, and keeps the
+ * existing classification.
+ */
+export declare function parseClaudeResultRejection(text: string): ProviderRejection | null;
+/**
+ * Grok `--output-format json` prints one object. Measured 2026-09-22 (lane
+ * 01M33X586J18J1B6GK0E6M4Y07): `{"type":"error","message":"Internal error:
+ * {\n  \"message\": \"API error (status 402 Payment Required): Grok Build
+ * usage balance exhausted\",\n  \"http_status\": 402, ...}", ...}`. The
+ * inner object carries `message` and `http_status`; when it does not parse,
+ * the status is read from `(status NNN` in the text.
+ */
+export declare function parseGrokErrorOutput(text: string): ProviderRejection | null;
+/** The `terminal_details` record both the watcher and the reconcile pass write for a rejection. */
+export declare function providerRejectionDetails(rejection: ProviderRejection, lane: {
+    model?: string;
+    account?: string;
+}): Record<string, unknown>;
+export declare function parseProviderRejection(provider: LaneProvider, text: string): ProviderRejection | null;
+/**
+ * Read this run's bytes of `logs/worker.out` (past `workerOutOffset`, the
+ * same cut delivery.ts uses) and return the provider rejection they carry,
+ * or null. A missing file is null; any other read error propagates.
+ */
+export declare function readProviderRejection(runDir: string, provider: LaneProvider, workerOutOffset?: number): ProviderRejection | null;
+//# sourceMappingURL=provider-rejection.d.ts.map