@indigoai-us/hq-cli 5.140.0 → 5.142.0

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [5.142.0] — 2026-09-23
+
+### Added
+
+- Added reusable personal worker profiles for `hq lanes create --worker`, with
+  strict `meta.yaml` validation, content hashes, profile-default precedence,
+  provider-specific prompt/settings carriers, and reapplication on every fresh,
+  resumed, moved, repaired, and compaction spawn.
+- Personal lanes can now use explicit `--mesh-company` attribution so their
+  project thread, presence, and lifecycle events appear in Work Mesh after
+  membership validation.
+
+### Fixed
+
+- Account login now reuses a registered account home when `--home` is omitted.
+  Codex account login also accepts `--device-auth` for remote boxes without a
+  localhost browser callback.
+- Checkpoint Stop-gate reply detection now uses the Stop payload when the
+  transcript has not flushed yet, and fails open with an ambiguity log when
+  neither reply source is reliable.
+
+## [5.141.0] — 2026-09-23
+
+- `hq bot jobs` now checks the bot's configured agent ID against the machine credential before calling the jobs API. A mismatch reports both IDs and explains how to fix the bot configuration or re-mint its credentials.
+
 ## [5.140.0] — 2026-09-23
 
 ### Fixed

package/assets/scaffold/core/scripts/checkpoint-stop-gate.sh

@@ -138,6 +138,19 @@ exec 3>&2
   }
 
   input="$(cat 2>/dev/null || printf '{}')"
+  input_reply_evidence="$(printf '%s' "$input" | jq -r '
+    if has("last_assistant_message") then
+      if (.last_assistant_message | type) == "string" then
+        "present:" + ((.last_assistant_message | gsub("\\s+"; "") | length) | tostring)
+      elif (.last_assistant_message | type) == "array" then
+        "present:" + (([.last_assistant_message[]? | (.text? // "")] | join("") | gsub("\\s+"; "") | length) | tostring)
+      else
+        "invalid"
+      end
+    else
+      "absent"
+    end
+  ' 2>/dev/null || printf 'invalid')"
   input_fields="$(printf '%s' "$input" | jq -r '[.transcript_path // "", .session_id // ""] | @tsv' 2>/dev/null)" || exit 0
   IFS=$'\t' read -r transcript_path session_id <<<"$input_fields" || exit 0
 
@@ -288,6 +301,15 @@ exec 3>&2
   session_key="$(hq_hook_safe_session_key "$session_id")"
   [ -n "$session_key" ] || exit 0
 
+  reply_ambiguity_log="$state_dir/checkpoint-stop-gate-ambiguity.log"
+  log_reply_ambiguity() {
+    local reason="$1"
+    local timestamp
+    timestamp="$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || printf 'unknown-time')"
+    printf '%s\t%s\treply-evidence-ambiguous\t%s\n' "$timestamp" "$session_key" "$reason" \
+      >>"$reply_ambiguity_log" 2>/dev/null || true
+  }
+
   # Parse only the recent JSONL tail. Claude and Codex persist different row
   # shapes, so normalize both to the same user/tool boundary before checking
   # whether the final action was the checkpoint command.
@@ -469,7 +491,12 @@ exec 3>&2
           else (if $seg_reply_chars > 0 then "0-replied" else "0-unreplied" end)
           end
       end
-  ' 2>/dev/null)" || exit 0
+  ' 2>/dev/null)"
+  parsed_status=$?
+  if [ "$parsed_status" -ne 0 ]; then
+    log_reply_ambiguity "transcript-parse-failed"
+    exit 0
+  fi
   # A Claude success verdict carries the satisfying checkpoint's tool id, the
   # count of non-whitespace assistant text characters delivered after the
   # genuine turn's last work tool (its user-facing reply, wherever it sits
@@ -494,6 +521,53 @@ exec 3>&2
     *) exit 0 ;;
   esac
 
+  # Claude's Stop payload carries the final assistant message independently of
+  # the transcript writer. Use the stronger of the two sources: the transcript
+  # can already contain a reply while the payload is empty, and the payload can
+  # arrive before the transcript writer flushes. If neither source can prove a
+  # reply, the evidence is ambiguous rather than proof that no reply exists.
+  # Fail open for the reply demand and record the ambiguity so a host-side
+  # flush regression remains observable without forcing a duplicate.
+  reply_evidence_ambiguous=0
+  case "$reply_chars" in
+    ''|*[!0-9]*) reply_chars=0 ;;
+  esac
+  case "$input_reply_evidence" in
+    present:*)
+      payload_reply_chars="${input_reply_evidence#present:}"
+      case "$payload_reply_chars" in
+        ''|*[!0-9]*) reply_evidence_ambiguous=1 ;;
+        *)
+          if [ "$runtime" = "claude" ]; then
+            if [ "$satisfied" = "1" ]; then
+              if [ "$payload_reply_chars" -gt "$reply_chars" ]; then
+                reply_chars="$payload_reply_chars"
+              fi
+            elif [ "$satisfied" = "0" ] && [ "$payload_reply_chars" -gt 0 ]; then
+              replied=1
+            fi
+          fi
+          ;;
+      esac
+      ;;
+    absent|invalid)
+      if [ "$runtime" = "claude" ] && [ "$reply_chars" -eq 0 ]; then
+        if [ "$satisfied" = "1" ] && [ "$reply_required" = "1" ]; then
+          reply_evidence_ambiguous=1
+        elif [ "$satisfied" = "0" ]; then
+          # A missing checkpoint plus an unflushed reply is also ambiguous;
+          # let the already-replied branch record the turn without asking the
+          # host to repeat text that may already be visible.
+          reply_evidence_ambiguous=1
+          replied=1
+        fi
+      fi
+      ;;
+  esac
+  if [ "$reply_evidence_ambiguous" = "1" ]; then
+    log_reply_ambiguity "payload=$input_reply_evidence;transcript-reply-chars=$reply_chars"
+  fi
+
   # Codex tool-result envelopes do not reliably expose a nested shell exit
   # status. The CLI writes this session-scoped stamp only after a successful
   # checkpoint, so require a fresh stamp in addition to the final command.
@@ -562,7 +636,8 @@ exec 3>&2
     # own delivery contract. HQ_CHECKPOINT_REPLY_MIN overrides the minimum
     # non-whitespace character threshold; 0 disables the enforcement.
     if [ "$satisfied" = "1" ] && [ "$runtime" = "claude" ] \
-      && [ "$reply_required" = "1" ] && [ -n "$reply_tool_id" ]; then
+      && [ "$reply_required" = "1" ] && [ -n "$reply_tool_id" ] \
+      && [ "$reply_evidence_ambiguous" != "1" ]; then
       reply_min="${HQ_CHECKPOINT_REPLY_MIN:-80}"
       case "$reply_min" in ''|*[!0-9]*) reply_min=80 ;; esac
       case "$reply_chars" in ''|*[!0-9]*) reply_chars=0 ;; esac

package/dist/command-catalog.generated.d.ts

@@ -6743,6 +6743,9 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [{
             readonly flags: "--company <slug|uid>";
             readonly description: "Company slug or cloud uid; omit for a core/personal lane";
+        }, {
+            readonly flags: "--mesh-company <slug|uid>";
+            readonly description: "Explicit Work Mesh company for a personal lane; membership is verified";
         }, {
             readonly flags: "--project <slug>";
             readonly description: "HQ project slug";
@@ -7175,6 +7178,9 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [{
                 readonly flags: "--home <path>";
                 readonly description: "Account home directory";
+            }, {
+                readonly flags: "--device-auth";
+                readonly description: "Use Codex device authentication instead of localhost callback";
             }, {
                 readonly flags: "--json";
                 readonly description: "JSON on stdout (always)";

package/dist/command-catalog.generated.js

@@ -8714,6 +8714,10 @@ export const COMMAND_CATALOG = [
                         "flags": "--company <slug|uid>",
                         "description": "Company slug or cloud uid; omit for a core/personal lane"
                     },
+                    {
+                        "flags": "--mesh-company <slug|uid>",
+                        "description": "Explicit Work Mesh company for a personal lane; membership is verified"
+                    },
                     {
                         "flags": "--project <slug>",
                         "description": "HQ project slug"
@@ -9278,6 +9282,10 @@ export const COMMAND_CATALOG = [
                                 "flags": "--home <path>",
                                 "description": "Account home directory"
                             },
+                            {
+                                "flags": "--device-auth",
+                                "description": "Use Codex device authentication instead of localhost callback"
+                            },
                             {
                                 "flags": "--json",
                                 "description": "JSON on stdout (always)"

package/dist/commands/bot-jobs.js

@@ -20,6 +20,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { BotApi, BotApiError } from "../lib/bot/api.js";
 import { effectiveBotKind } from "../lib/bot/config.js";
+import { identityMismatchMessage, tokenAgentUid } from "../lib/heartbeat-identity.js";
 // ─── Schedule translation ────────────────────────────────────────────────────
 /** Mirrors hq-pro-agents `MIN_RECURRING_INTERVAL_SECONDS`. */
 export const MIN_RECURRING_INTERVAL_SECONDS = 5 * 60;
@@ -363,10 +364,19 @@ export async function runBotJobs(nameArg, opts, deps) {
     const { name, dir, config } = deps.requireBot(nameArg);
     const kind = effectiveBotKind(config);
     const out = deps.out ?? ((line) => console.log(line));
-    const api = deps.apiFor
-        ? deps.apiFor(dir)
-        : new BotApi({ token: deps.botTokenSupplier(dir) });
     const ctx = { botName: name, kind };
+    let client;
+    const jobsApi = async () => {
+        if (client)
+            return client;
+        const token = await deps.botTokenSupplier(dir)();
+        const tokenUid = tokenAgentUid(token);
+        if (tokenUid && tokenUid !== config.agentUid) {
+            refuse(identityMismatchMessage("bot jobs", config.agentUid, tokenUid));
+        }
+        client = deps.apiFor ? deps.apiFor(dir) : new BotApi({ token: async () => token });
+        return client;
+    };
     if (opts.add !== undefined && opts.rm !== undefined) {
         refuse("Add a job or remove one, not both in the same command.");
     }
@@ -374,6 +384,7 @@ export async function runBotJobs(nameArg, opts, deps) {
         const jobId = opts.rm.trim();
         if (!jobId)
             refuse("Say which job to remove: --rm <jobId>");
+        const api = await jobsApi();
         try {
             await api.cancelJob(config.agentUid, jobId);
         }
@@ -395,6 +406,7 @@ export async function runBotJobs(nameArg, opts, deps) {
             ? parse(opts.every, { hqRoot: config.hqRoot, timezone })
             : { cron: opts.cron, timezone };
         const body = buildCreateJobBody({ prompt: opts.add, cron: schedule.cron, timezone: schedule.timezone });
+        const api = await jobsApi();
         let created;
         try {
             created = await api.createJob(config.agentUid, body);
@@ -414,6 +426,7 @@ export async function runBotJobs(nameArg, opts, deps) {
         return;
     }
     let jobs;
+    const api = await jobsApi();
     try {
         jobs = await api.listJobs(config.agentUid);
     }

package/dist/commands/lanes.js

@@ -18,7 +18,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
 import { providerCompactAfterMs } from "../lib/lanes/config.js";
@@ -735,10 +735,13 @@ function assertSameTenant(laneCompany, senior, seniorCompany, extra = {}) {
         ...extra,
     });
 }
-function recordMatchesCompany(recordCompany, filter) {
-    if (!recordCompany)
-        return false;
-    return recordCompany.uid === filter.uid || recordCompany.slug === filter.slug;
+function recordMatchesCompany(lane, filter) {
+    return companyRefMatches(lane.company, filter) || companyRefMatches(lane.mesh_company, filter);
+}
+function companyRefMatches(recordCompany, filter) {
+    return (recordCompany !== null &&
+        recordCompany !== undefined &&
+        (recordCompany.uid === filter.uid || recordCompany.slug === filter.slug));
 }
 function walkHitsLane(hqRoot, start, laneId, ctx) {
     const seen = new Set();
@@ -828,7 +831,7 @@ function compareQueueOrder(a, b) {
     return a.created_at.localeCompare(b.created_at);
 }
 function admitCreate(input) {
-    const { hqRoot, provider, pinnedAccount, priority, createdAt, config } = input;
+    const { hqRoot, provider, pinnedAccount, profileId, profileMaxConcurrent, priority, createdAt, config, } = input;
     const providerCfg = config.providers[provider];
     const lanes = loadAllLanes(hqRoot).filter((lane) => lane.lane_id !== input.excludeLaneId);
     const runningProvider = lanes.filter((lane) => lane.provider === provider && lane.state === "running");
@@ -845,9 +848,13 @@ function admitCreate(input) {
     const providerRunning = runningProvider.length;
     const queuedCount = queuedSame.length;
     const maxQueued = providerCfg.max_queued;
+    const profileRunning = profileId === undefined
+        ? 0
+        : lanes.filter((lane) => lane.worker_profile === profileId && lane.state === "running").length;
     const atCap = providerRunning >= providerCfg.max_running ||
         (pinnedAccount !== undefined &&
-            runningCount >= accountMaxRunning(providerCfg, pinnedAccount));
+            runningCount >= accountMaxRunning(providerCfg, pinnedAccount)) ||
+        (profileMaxConcurrent !== undefined && profileRunning >= profileMaxConcurrent);
     const synthetic = {
         schema_version: "hq-lane.v1",
         lane_id: "__incoming__",
@@ -1116,6 +1123,15 @@ export function composeWorkerBrief(worker, taskBrief) {
         "",
         "## Knowledge",
         formatUnknownValue(yaml.knowledge) || "(none)",
+        ...(worker.profile
+            ? [
+                "",
+                "## Reusable worker profile",
+                `Profile id: ${worker.profile.id}`,
+                `Profile content hash: ${worker.profile.contentHash}`,
+                "The profile is re-read and applied for every fresh, resumed, moved, and repair spawn.",
+            ]
+            : []),
         "",
         "## Verification checkpoints",
         checkpoints || "(none)",
@@ -1356,6 +1372,7 @@ function mintMessageId() {
 async function runCreate(ctx, opts) {
     const hqRoot = ctx.hqRoot();
     const companyFlag = opts.company?.trim();
+    const meshCompanyFlag = opts.meshCompany?.trim();
     const project = opts.project?.trim();
     const story = opts.story?.trim();
     const briefFile = opts.briefFile?.trim();
@@ -1368,9 +1385,9 @@ async function runCreate(ctx, opts) {
     if (!briefFile) {
         throw new LanesError("missing_brief_file", "--brief-file is required", {});
     }
-    const provider = opts.provider
+    const explicitProvider = opts.provider
         ? parseLaneProvider(opts.provider)
-        : parseLaneProvider("codex");
+        : undefined;
     if (opts.outpost !== undefined && opts.outpost !== "") {
         const requested = opts.outpost.trim();
         let known;
@@ -1396,12 +1413,29 @@ async function runCreate(ctx, opts) {
     const company = companyFlag
         ? await ctx.resolveCompany(companyFlag)
         : null;
+    let meshCompany = company;
+    if (meshCompanyFlag) {
+        const resolvedMeshCompany = await ctx.resolveCompany(meshCompanyFlag);
+        if (company &&
+            (company.uid !== resolvedMeshCompany.uid || company.slug !== resolvedMeshCompany.slug)) {
+            throw new LanesError("mesh_company_mismatch", "--mesh-company must match --company when both are provided", {
+                company: company.slug,
+                mesh_company: resolvedMeshCompany.slug,
+            });
+        }
+        meshCompany = resolvedMeshCompany;
+    }
     const seniorCompany = companyOfSenior(hqRoot, senior, ctx);
     assertSameTenant(company, senior, seniorCompany);
     let resolvedWorker;
     if (opts.worker) {
         resolvedWorker = resolveLaneWorker(hqRoot, opts.worker, company?.slug);
     }
+    const profile = resolvedWorker?.profile;
+    const provider = explicitProvider ??
+        profile?.meta.provider ??
+        parseLaneProvider("codex");
+    const profileDefaultsApply = profile !== undefined && profile.meta.provider === provider;
     const briefAbs = resolveCallerPath(ctx.callerCwd(), briefFile);
     if (!ctx.existsSync(briefAbs)) {
         throw new LanesError("brief_not_found", `Brief file not found: ${briefAbs}`, {
@@ -1423,12 +1457,19 @@ async function runCreate(ctx, opts) {
     const cliModel = parseCliModel(opts.model);
     // Validated here because `claude --effort <unknown>` only warns and runs.
     const cliEffort = parseCliEffort(provider, opts.effort);
+    const profileModel = profileDefaultsApply ? profile?.meta.model : undefined;
+    const profileEffort = profileDefaultsApply ? profile?.meta.effort : undefined;
+    const profileAccount = profileDefaultsApply ? profile?.meta.account : undefined;
+    const profileAccounts = profileDefaultsApply ? profile?.meta.accounts : undefined;
     let pinnedAccount;
     const accountWasExplicit = Boolean(opts.account && opts.account.trim() !== "");
     if (outpostId) {
         if (accountWasExplicit) {
             pinnedAccount = opts.account.trim();
         }
+        else if (profileAccount !== undefined && profileAccounts === undefined) {
+            pinnedAccount = profileAccount;
+        }
     }
     else if (opts.account !== undefined) {
         const requested = opts.account.trim();
@@ -1438,9 +1479,27 @@ async function runCreate(ctx, opts) {
         const resolved = resolveAccount(provider, requested, config, {
             hqRoot,
             cliModel,
+            model: cliModel ?? profileModel,
         });
         pinnedAccount = resolved.id;
     }
+    else if (profileAccount !== undefined && profileAccounts === undefined) {
+        const resolved = resolveAccount(provider, profileAccount, config, {
+            hqRoot,
+            cliModel,
+            model: cliModel ?? profileModel,
+        });
+        pinnedAccount = resolved.id;
+    }
+    if (outpostId !== undefined && profile !== undefined) {
+        throw new LanesError("worker_profile_outpost_unsupported", `Worker profile ${JSON.stringify(profile.id)} cannot be used with --outpost; personal profiles are local-only`, {
+            worker: profile.id,
+            outpost: outpostId,
+            profile_account: profileAccount ?? null,
+            profile_accounts: profileAccounts ?? null,
+            pinned_account: pinnedAccount ?? null,
+        });
+    }
     const priority = parsePriority(opts.priority);
     let timeoutSecs = parseOptionalInt(opts.timeout, "--timeout");
     if (timeoutSecs === undefined && resolvedWorker) {
@@ -1478,6 +1537,9 @@ async function runCreate(ctx, opts) {
                 hqRoot,
                 existsSync: ctx.existsSync,
                 cliModel,
+                ...(profileAccounts !== undefined
+                    ? { allowedAccounts: profileAccounts }
+                    : {}),
             }).id;
         const toValidate = pinnedAccount !== undefined
             ? [candidate]
@@ -1486,6 +1548,7 @@ async function runCreate(ctx, opts) {
                 ...Object.keys(accounts)
                     .filter((id) => id !== candidate &&
                     accounts[id]?.enabled &&
+                    (profileAccounts === undefined || profileAccounts.includes(id)) &&
                     accountStatus(provider, id, config, { existsSync: ctx.existsSync }).logged_in === true)
                     .sort(),
             ];
@@ -1548,8 +1611,9 @@ async function runCreate(ctx, opts) {
             });
         }
     }
-    const threadId = company
-        ? await ctx.mesh.ensureProjectThread(company, project)
+    const allowedAccounts = validatedAccounts.size > 0 ? [...validatedAccounts] : profileAccounts;
+    const threadId = meshCompany
+        ? await ctx.mesh.ensureProjectThread(meshCompany, project)
         : undefined;
     const persist = async () => {
         let admission;
@@ -1559,7 +1623,7 @@ async function runCreate(ctx, opts) {
                 hqRoot,
                 existsSync: ctx.existsSync,
                 cliModel,
-                ...(validatedAccounts.size > 0 ? { allowedAccounts: [...validatedAccounts] } : {}),
+                ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
             }).id;
         }
         const accountCfg = pinnedAccount !== undefined
@@ -1567,6 +1631,7 @@ async function runCreate(ctx, opts) {
             : undefined;
         const model = resolveLaneModel({
             cliModel,
+            profileModel,
             accountModel: accountCfg?.model,
             providerModel: config.providers[provider].model,
         });
@@ -1574,6 +1639,7 @@ async function runCreate(ctx, opts) {
         // every source except `cli`.
         const effort = resolveLaneEffort({
             cliEffort,
+            profileEffort,
             accountEffort: accountCfg?.effort,
             providerEffort: config.providers[provider].effort,
             model,
@@ -1587,6 +1653,10 @@ async function runCreate(ctx, opts) {
                 hqRoot,
                 provider,
                 pinnedAccount,
+                ...(profile !== undefined ? { profileId: profile.id } : {}),
+                ...(profile?.meta.max_concurrent !== undefined
+                    ? { profileMaxConcurrent: profile.meta.max_concurrent }
+                    : {}),
                 priority,
                 createdAt,
                 config,
@@ -1605,6 +1675,9 @@ async function runCreate(ctx, opts) {
         const queuedReason = admission.action === "queue" ? admission.reason : undefined;
         const lane = createLane(hqRoot, {
             company,
+            ...(company === null && meshCompany
+                ? { mesh_company: meshCompany }
+                : {}),
             project_id: project,
             story_id: story,
             thread_id: threadId,
@@ -1617,9 +1690,25 @@ async function runCreate(ctx, opts) {
             worker: resolvedWorker?.id ?? opts.worker,
             ...(resolvedWorker ? { worker_path: resolvedWorker.path } : {}),
             ...(resolvedWorker?.pack ? { worker_pack: resolvedWorker.pack } : {}),
+            ...(profile
+                ? {
+                    worker_profile: profile.id,
+                    worker_profile_hash: profile.contentHash,
+                    worker_profile_ignored: ignoredWorkerProfileFields(provider),
+                }
+                : {}),
             provider,
             account: pinnedAccount,
             ...(model !== undefined ? { model } : {}),
+            model_source: cliModel !== undefined
+                ? "cli"
+                : profileModel !== undefined
+                    ? "profile"
+                    : accountCfg?.model !== undefined
+                        ? "account"
+                        : config.providers[provider].model !== undefined
+                            ? "provider"
+                            : "none",
             ...(effort.effort !== undefined ? { effort: effort.effort } : {}),
             effort_source: effort.source,
             host,
@@ -1668,13 +1757,13 @@ async function runCreate(ctx, opts) {
             runCompaction: ctx.runCompaction,
             locateTranscript: ctx.locateTranscript,
         });
-        if (company) {
-            await emitLaneMeshEvent(ctx, company, threadId, "lane_started", {
+        if (meshCompany) {
+            await emitLaneMeshEvent(ctx, meshCompany, threadId, "lane_started", {
                 lane_id: started.lane_id,
                 project_id: project,
                 story_id: story,
             });
-            await ctx.mesh.patchStoryStatus(company, project, story, "in_progress");
+            await ctx.mesh.patchStoryStatus(meshCompany, project, story, "in_progress");
         }
     }
     else if (outpostId) {
@@ -2012,7 +2101,7 @@ async function runList(ctx, opts) {
             return false;
         if (opts.story && lane.story_id !== opts.story)
             return false;
-        if (company && !recordMatchesCompany(lane.company, company)) {
+        if (company && !recordMatchesCompany(lane, company)) {
             return false;
         }
         if (senior && seniorKey(lane.senior) !== seniorKey(senior))
@@ -2195,7 +2284,9 @@ async function prepareAccountMove(ctx, lane, input) {
             const next = {
                 ...current,
                 account: target,
-                ...(input.cliModel !== undefined ? { model: input.cliModel } : {}),
+                ...(input.cliModel !== undefined
+                    ? { model: input.cliModel, model_source: "cli" }
+                    : {}),
                 account_history: appendCappedHistory(current.account_history ?? [], {
                     from,
                     to: target,
@@ -2751,14 +2842,14 @@ async function runAsk(ctx, opts) {
                 questionId,
             });
             questionId = withBody.question_id;
-            await emitLaneMeshEvent(ctx, lane.company, lane.thread_id, "lane_question", {
+            await emitLaneMeshEvent(ctx, lane.mesh_company ?? lane.company, lane.thread_id, "lane_question", {
                 lane_id: lane.lane_id,
                 question_id: withBody.question_id,
                 hop: withBody.hop,
             });
             const audience = resolveAudience(hqRoot, withBody, ctx);
             if (audience.kind === "user") {
-                await emitLaneMeshEvent(ctx, lane.company, lane.thread_id, "lane_question_at_user", {
+                await emitLaneMeshEvent(ctx, lane.mesh_company ?? lane.company, lane.thread_id, "lane_question_at_user", {
                     lane_id: lane.lane_id,
                     question_id: withBody.question_id,
                 });
@@ -2818,7 +2909,7 @@ async function runQuestionsList(ctx, opts) {
             return false;
         if (opts.story && q.story_id !== opts.story)
             return false;
-        if (company && !recordMatchesCompany(q.company, company)) {
+        if (company && !companyRefMatches(q.company, company)) {
             return false;
         }
         if (forFilter) {
@@ -2984,7 +3075,7 @@ async function runQuestionsEscalate(ctx, questionId, opts) {
     const nextAudience = resolveAudience(hqRoot, updated, ctx);
     if (nextAudience.kind === "user") {
         const lane = readLane(hqRoot, updated.lane_id);
-        await emitLaneMeshEvent(ctx, lane.company, lane.thread_id, "lane_question_at_user", { lane_id: lane.lane_id, question_id: updated.question_id });
+        await emitLaneMeshEvent(ctx, lane.mesh_company ?? lane.company, lane.thread_id, "lane_question_at_user", { lane_id: lane.lane_id, question_id: updated.question_id });
     }
     printJson({ ok: true, action: "questions.escalate", question: updated });
 }
@@ -3063,10 +3154,13 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     if (!id) {
         throw new LanesError("invalid_account", "account-id must be non-empty", {});
     }
+    if (opts.deviceAuth && provider !== "codex") {
+        throw new LanesError("device_auth_unsupported", "--device-auth is supported only for codex account login", { provider });
+    }
+    const registeredAccount = config.providers[provider].accounts[id];
     const homeRaw = opts.home?.trim() ||
-        (id === "a"
-            ? DEFAULT_ACCOUNT_HOMES[provider]
-            : `~/.${provider}-${id}`);
+        registeredAccount?.home ||
+        (id === "a" ? DEFAULT_ACCOUNT_HOMES[provider] : `~/.${provider}-${id}`);
     const homeResolved = homeRaw.startsWith("~") || path.isAbsolute(homeRaw)
         ? homeRaw
         : resolveCallerPath(callerCwd, homeRaw);
@@ -3098,14 +3192,17 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     installDrainHook(provider, home);
     const envVar = PROVIDER_HOME_ENV[provider];
     const login = VENDOR_LOGIN[provider];
+    const loginArgs = provider === "codex" && opts.deviceAuth
+        ? [...login.args, "--device-auth"]
+        : login.args;
     const result = await ctx.spawnLogin({
         command: login.command,
-        args: login.args,
+        args: loginArgs,
         env: { ...ctx.env, [envVar]: home },
         cwd: home,
     });
     if (result.status !== 0) {
-        throw new LanesError("login_failed", `${login.command} ${login.args.join(" ")} exited ${result.status}`, { provider, account: id, status: result.status });
+        throw new LanesError("login_failed", `${login.command} ${loginArgs.join(" ")} exited ${result.status}`, { provider, account: id, status: result.status });
     }
     const grokNeedsRails = provider === "grok";
     if ((grokNeedsRails || copied) && !railsPresent(home)) {
@@ -3300,6 +3397,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .command("create")
         .description("Register a lane, run admission, and return immediately")
         .option("--company <slug|uid>", "Company slug or cloud uid; omit for a core/personal lane")
+        .option("--mesh-company <slug|uid>", "Explicit Work Mesh company for a personal lane; membership is verified")
         .requiredOption("--project <slug>", "HQ project slug")
         .requiredOption("--story <id>", "Story id from the project's prd.json")
         .requiredOption("--brief-file <path>", "Path to the lane brief")
@@ -3472,6 +3570,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .argument("<provider>", "claude | codex | grok")
         .argument("<account-id>", "Open-ended account id")
         .option("--home <path>", "Account home directory")
+        .option("--device-auth", "Use Codex device authentication instead of localhost callback")
         .action(wrap(async (provider, accountId, opts) => {
         await runAccountsLogin(ctx, provider, accountId, opts);
     }));

package/dist/lib/agent-kit/run/heartbeat.js

@@ -14,7 +14,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import { CLI_VERSION } from "../../../cli-version.js";
-import { captureHeartbeatIdentityMismatch, isHeartbeatIdentityMismatch, parseHeartbeatFailureBody, tokenAgentUid, } from "../../heartbeat-identity.js";
+import { captureHeartbeatIdentityMismatch, identityMismatchMessage, isHeartbeatIdentityMismatch, parseHeartbeatFailureBody, tokenAgentUid, } from "../../heartbeat-identity.js";
 import { vaultApiFetch } from "../../../utils/vault-api.js";
 import { readComponentStatus } from "../creds.js";
 import { KIT_COMPONENTS } from "../paths.js";
@@ -90,7 +90,7 @@ async function beatOnceResult(deps) {
                     ...(tokenUid ? { tokenAgentUid: tokenUid } : {}),
                 });
                 const tokenLabel = tokenUid ?? "unknown";
-                deps.log("warn", `heartbeat stopped: identity mismatch configured agentUid=${deps.agentUid} token agentUid=${tokenLabel}`);
+                deps.log("warn", identityMismatchMessage("heartbeat", deps.agentUid, tokenLabel));
                 (deps.reportIdentityMismatch ?? captureHeartbeatIdentityMismatch)({
                     runner: "agent-kit",
                     configuredAgentUid: deps.agentUid,