@indigoai-us/hq-cli 5.141.0 → 5.143.0

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [5.143.0] — 2026-09-23
+
+### Fixed
+
+- `hq dm` and report commands now reject non-recipient and non-company channel
+  requests locally, and report updates retry one fresh revision after a
+  conflict.
+- `hq mesh project register` now verifies the company's Board view before
+  registering and reports an actionable local error when the Board is missing.
+
+## [5.142.0] — 2026-09-23
+
+### Added
+
+- Added reusable personal worker profiles for `hq lanes create --worker`, with
+  strict `meta.yaml` validation, content hashes, profile-default precedence,
+  provider-specific prompt/settings carriers, and reapplication on every fresh,
+  resumed, moved, repaired, and compaction spawn.
+- Personal lanes can now use explicit `--mesh-company` attribution so their
+  project thread, presence, and lifecycle events appear in Work Mesh after
+  membership validation.
+
+### Fixed
+
+- Account login now reuses a registered account home when `--home` is omitted.
+  Codex account login also accepts `--device-auth` for remote boxes without a
+  localhost browser callback.
+- Checkpoint Stop-gate reply detection now uses the Stop payload when the
+  transcript has not flushed yet, and fails open with an ambiguity log when
+  neither reply source is reliable.
+
 ## [5.141.0] — 2026-09-23
 
 - `hq bot jobs` now checks the bot's configured agent ID against the machine credential before calling the jobs API. A mismatch reports both IDs and explains how to fix the bot configuration or re-mint its credentials.

package/assets/scaffold/core/scripts/checkpoint-stop-gate.sh

@@ -138,6 +138,19 @@ exec 3>&2
   }
 
   input="$(cat 2>/dev/null || printf '{}')"
+  input_reply_evidence="$(printf '%s' "$input" | jq -r '
+    if has("last_assistant_message") then
+      if (.last_assistant_message | type) == "string" then
+        "present:" + ((.last_assistant_message | gsub("\\s+"; "") | length) | tostring)
+      elif (.last_assistant_message | type) == "array" then
+        "present:" + (([.last_assistant_message[]? | (.text? // "")] | join("") | gsub("\\s+"; "") | length) | tostring)
+      else
+        "invalid"
+      end
+    else
+      "absent"
+    end
+  ' 2>/dev/null || printf 'invalid')"
   input_fields="$(printf '%s' "$input" | jq -r '[.transcript_path // "", .session_id // ""] | @tsv' 2>/dev/null)" || exit 0
   IFS=$'\t' read -r transcript_path session_id <<<"$input_fields" || exit 0
 
@@ -288,6 +301,15 @@ exec 3>&2
   session_key="$(hq_hook_safe_session_key "$session_id")"
   [ -n "$session_key" ] || exit 0
 
+  reply_ambiguity_log="$state_dir/checkpoint-stop-gate-ambiguity.log"
+  log_reply_ambiguity() {
+    local reason="$1"
+    local timestamp
+    timestamp="$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || printf 'unknown-time')"
+    printf '%s\t%s\treply-evidence-ambiguous\t%s\n' "$timestamp" "$session_key" "$reason" \
+      >>"$reply_ambiguity_log" 2>/dev/null || true
+  }
+
   # Parse only the recent JSONL tail. Claude and Codex persist different row
   # shapes, so normalize both to the same user/tool boundary before checking
   # whether the final action was the checkpoint command.
@@ -469,7 +491,12 @@ exec 3>&2
           else (if $seg_reply_chars > 0 then "0-replied" else "0-unreplied" end)
           end
       end
-  ' 2>/dev/null)" || exit 0
+  ' 2>/dev/null)"
+  parsed_status=$?
+  if [ "$parsed_status" -ne 0 ]; then
+    log_reply_ambiguity "transcript-parse-failed"
+    exit 0
+  fi
   # A Claude success verdict carries the satisfying checkpoint's tool id, the
   # count of non-whitespace assistant text characters delivered after the
   # genuine turn's last work tool (its user-facing reply, wherever it sits
@@ -494,6 +521,53 @@ exec 3>&2
     *) exit 0 ;;
   esac
 
+  # Claude's Stop payload carries the final assistant message independently of
+  # the transcript writer. Use the stronger of the two sources: the transcript
+  # can already contain a reply while the payload is empty, and the payload can
+  # arrive before the transcript writer flushes. If neither source can prove a
+  # reply, the evidence is ambiguous rather than proof that no reply exists.
+  # Fail open for the reply demand and record the ambiguity so a host-side
+  # flush regression remains observable without forcing a duplicate.
+  reply_evidence_ambiguous=0
+  case "$reply_chars" in
+    ''|*[!0-9]*) reply_chars=0 ;;
+  esac
+  case "$input_reply_evidence" in
+    present:*)
+      payload_reply_chars="${input_reply_evidence#present:}"
+      case "$payload_reply_chars" in
+        ''|*[!0-9]*) reply_evidence_ambiguous=1 ;;
+        *)
+          if [ "$runtime" = "claude" ]; then
+            if [ "$satisfied" = "1" ]; then
+              if [ "$payload_reply_chars" -gt "$reply_chars" ]; then
+                reply_chars="$payload_reply_chars"
+              fi
+            elif [ "$satisfied" = "0" ] && [ "$payload_reply_chars" -gt 0 ]; then
+              replied=1
+            fi
+          fi
+          ;;
+      esac
+      ;;
+    absent|invalid)
+      if [ "$runtime" = "claude" ] && [ "$reply_chars" -eq 0 ]; then
+        if [ "$satisfied" = "1" ] && [ "$reply_required" = "1" ]; then
+          reply_evidence_ambiguous=1
+        elif [ "$satisfied" = "0" ]; then
+          # A missing checkpoint plus an unflushed reply is also ambiguous;
+          # let the already-replied branch record the turn without asking the
+          # host to repeat text that may already be visible.
+          reply_evidence_ambiguous=1
+          replied=1
+        fi
+      fi
+      ;;
+  esac
+  if [ "$reply_evidence_ambiguous" = "1" ]; then
+    log_reply_ambiguity "payload=$input_reply_evidence;transcript-reply-chars=$reply_chars"
+  fi
+
   # Codex tool-result envelopes do not reliably expose a nested shell exit
   # status. The CLI writes this session-scoped stamp only after a successful
   # checkpoint, so require a fresh stamp in addition to the final command.
@@ -562,7 +636,8 @@ exec 3>&2
     # own delivery contract. HQ_CHECKPOINT_REPLY_MIN overrides the minimum
     # non-whitespace character threshold; 0 disables the enforcement.
     if [ "$satisfied" = "1" ] && [ "$runtime" = "claude" ] \
-      && [ "$reply_required" = "1" ] && [ -n "$reply_tool_id" ]; then
+      && [ "$reply_required" = "1" ] && [ -n "$reply_tool_id" ] \
+      && [ "$reply_evidence_ambiguous" != "1" ]; then
       reply_min="${HQ_CHECKPOINT_REPLY_MIN:-80}"
       case "$reply_min" in ''|*[!0-9]*) reply_min=80 ;; esac
       case "$reply_chars" in ''|*[!0-9]*) reply_chars=0 ;; esac

package/dist/command-catalog.generated.d.ts

@@ -5740,7 +5740,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly subcommands: readonly [];
         }, {
             readonly name: "register";
-            readonly description: "POST project registration to create or bind its project channel and Board";
+            readonly description: "Register an existing Board and bind its project channel; use project ensure to create or repair a Board";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly usage: "[options] <projectId>";
@@ -6743,6 +6743,9 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [{
             readonly flags: "--company <slug|uid>";
             readonly description: "Company slug or cloud uid; omit for a core/personal lane";
+        }, {
+            readonly flags: "--mesh-company <slug|uid>";
+            readonly description: "Explicit Work Mesh company for a personal lane; membership is verified";
         }, {
             readonly flags: "--project <slug>";
             readonly description: "HQ project slug";
@@ -7175,6 +7178,9 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [{
                 readonly flags: "--home <path>";
                 readonly description: "Account home directory";
+            }, {
+                readonly flags: "--device-auth";
+                readonly description: "Use Codex device authentication instead of localhost callback";
             }, {
                 readonly flags: "--json";
                 readonly description: "JSON on stdout (always)";

package/dist/command-catalog.generated.js

@@ -7409,7 +7409,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "name": "register",
-                        "description": "POST project registration to create or bind its project channel and Board",
+                        "description": "Register an existing Board and bind its project channel; use project ensure to create or repair a Board",
                         "aliases": [],
                         "hidden": false,
                         "usage": "[options] <projectId>",
@@ -8714,6 +8714,10 @@ export const COMMAND_CATALOG = [
                         "flags": "--company <slug|uid>",
                         "description": "Company slug or cloud uid; omit for a core/personal lane"
                     },
+                    {
+                        "flags": "--mesh-company <slug|uid>",
+                        "description": "Explicit Work Mesh company for a personal lane; membership is verified"
+                    },
                     {
                         "flags": "--project <slug>",
                         "description": "HQ project slug"
@@ -9278,6 +9282,10 @@ export const COMMAND_CATALOG = [
                                 "flags": "--home <path>",
                                 "description": "Account home directory"
                             },
+                            {
+                                "flags": "--device-auth",
+                                "description": "Use Codex device authentication instead of localhost callback"
+                            },
                             {
                                 "flags": "--json",
                                 "description": "JSON on stdout (always)"

package/dist/commands/agents.d.ts

@@ -336,6 +336,7 @@ export declare function formatJobsTable(jobs: AgentJobView[]): string;
 export declare function formatPauseResult(result: PauseJobResult): string;
 /** Human-readable "hot-applied to the running box" vs "saved for next launch". */
 export declare function appliedHint(applied: boolean): string;
+/** Agent uid shape (`agt_…`). */
 /** One message in a DM thread, as returned by `GET /v1/notify/thread`. */
 export interface DmThreadMessage {
     eventId: string;

package/dist/commands/agents.js

@@ -36,6 +36,7 @@ import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { launchSessionManagerPlugin, SessionManagerPluginLaunchError, TerminalSessionTimeoutError, waitForTerminalSession, } from "@indigoai-us/hq-cloud/outposts/node";
 import { peekIdToken } from "../utils/id-token.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
+import { AGENT_UID_PATTERN, isAgentUid } from "../lib/notify-recipient.js";
 import { confirmChargeOrExit, formatUsd, parseBillingPayload, surfaceBillingBlocked, } from "../utils/billing-gate.js";
 /** Reasoning-effort values hq-pro accepts on `runtime-config`. */
 export const VALID_EFFORTS = new Set([
@@ -807,14 +808,6 @@ export function appliedHint(applied) {
         ? "applied to the running box now"
         : "saved — takes effect on the agent's next launch";
 }
-// ---------------------------------------------------------------------------
-// Talking to agents (DM). Agents are members addressable over HQ's DM system:
-// a message rides `POST /v1/notify/dm` (the wire contract accepts `agt_*`), the
-// agent's box picks it up and replies over DM (a first-class agent reply
-// channel), and the two-way conversation is read back via `GET /v1/notify/thread`.
-// ---------------------------------------------------------------------------
-/** Agent uid shape (`agt_…`). */
-const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/;
 /**
  * Resolve an agent reference to its `agt_` uid. An `agt_…` value is used
  * directly; anything else is treated as a slug or display name and resolved
@@ -909,6 +902,9 @@ async function resolveJobsTargetOrExit(ref, company) {
 }
 /** Send a DM to an agent. Returns nothing meaningful beyond success. */
 export async function sendAgentDm(token, agentUid, message) {
+    if (!isAgentUid(agentUid)) {
+        throw new Error(`Invalid agent recipient '${agentUid}': expected an agt_ uid.`);
+    }
     await agentsRequest({
         token,
         path: "/v1/notify/dm",

package/dist/commands/dm.js

@@ -4,11 +4,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
-const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
-// People (prs_) and agents (agt_) are both first-class DM participants; the
-// server applies the same membership-overlap gate to either and delivers
-// agt_* recipients into the agent's durable box inbox.
-const RECIPIENT_UID_PATTERN = /^(prs|agt)_[A-Za-z0-9_-]+$/;
+import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN } from "../lib/notify-recipient.js";
 /**
  * Classify a recipient arg as an email or a person/agent uid. Mirrors the
  * email/uid heuristic used by `hq members`. Returns null for neither.

package/dist/commands/lanes.js

@@ -18,7 +18,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
 import { providerCompactAfterMs } from "../lib/lanes/config.js";
@@ -735,10 +735,13 @@ function assertSameTenant(laneCompany, senior, seniorCompany, extra = {}) {
         ...extra,
     });
 }
-function recordMatchesCompany(recordCompany, filter) {
-    if (!recordCompany)
-        return false;
-    return recordCompany.uid === filter.uid || recordCompany.slug === filter.slug;
+function recordMatchesCompany(lane, filter) {
+    return companyRefMatches(lane.company, filter) || companyRefMatches(lane.mesh_company, filter);
+}
+function companyRefMatches(recordCompany, filter) {
+    return (recordCompany !== null &&
+        recordCompany !== undefined &&
+        (recordCompany.uid === filter.uid || recordCompany.slug === filter.slug));
 }
 function walkHitsLane(hqRoot, start, laneId, ctx) {
     const seen = new Set();
@@ -828,7 +831,7 @@ function compareQueueOrder(a, b) {
     return a.created_at.localeCompare(b.created_at);
 }
 function admitCreate(input) {
-    const { hqRoot, provider, pinnedAccount, priority, createdAt, config } = input;
+    const { hqRoot, provider, pinnedAccount, profileId, profileMaxConcurrent, priority, createdAt, config, } = input;
     const providerCfg = config.providers[provider];
     const lanes = loadAllLanes(hqRoot).filter((lane) => lane.lane_id !== input.excludeLaneId);
     const runningProvider = lanes.filter((lane) => lane.provider === provider && lane.state === "running");
@@ -845,9 +848,13 @@ function admitCreate(input) {
     const providerRunning = runningProvider.length;
     const queuedCount = queuedSame.length;
     const maxQueued = providerCfg.max_queued;
+    const profileRunning = profileId === undefined
+        ? 0
+        : lanes.filter((lane) => lane.worker_profile === profileId && lane.state === "running").length;
     const atCap = providerRunning >= providerCfg.max_running ||
         (pinnedAccount !== undefined &&
-            runningCount >= accountMaxRunning(providerCfg, pinnedAccount));
+            runningCount >= accountMaxRunning(providerCfg, pinnedAccount)) ||
+        (profileMaxConcurrent !== undefined && profileRunning >= profileMaxConcurrent);
     const synthetic = {
         schema_version: "hq-lane.v1",
         lane_id: "__incoming__",
@@ -1116,6 +1123,15 @@ export function composeWorkerBrief(worker, taskBrief) {
         "",
         "## Knowledge",
         formatUnknownValue(yaml.knowledge) || "(none)",
+        ...(worker.profile
+            ? [
+                "",
+                "## Reusable worker profile",
+                `Profile id: ${worker.profile.id}`,
+                `Profile content hash: ${worker.profile.contentHash}`,
+                "The profile is re-read and applied for every fresh, resumed, moved, and repair spawn.",
+            ]
+            : []),
         "",
         "## Verification checkpoints",
         checkpoints || "(none)",
@@ -1356,6 +1372,7 @@ function mintMessageId() {
 async function runCreate(ctx, opts) {
     const hqRoot = ctx.hqRoot();
     const companyFlag = opts.company?.trim();
+    const meshCompanyFlag = opts.meshCompany?.trim();
     const project = opts.project?.trim();
     const story = opts.story?.trim();
     const briefFile = opts.briefFile?.trim();
@@ -1368,9 +1385,9 @@ async function runCreate(ctx, opts) {
     if (!briefFile) {
         throw new LanesError("missing_brief_file", "--brief-file is required", {});
     }
-    const provider = opts.provider
+    const explicitProvider = opts.provider
         ? parseLaneProvider(opts.provider)
-        : parseLaneProvider("codex");
+        : undefined;
     if (opts.outpost !== undefined && opts.outpost !== "") {
         const requested = opts.outpost.trim();
         let known;
@@ -1396,12 +1413,29 @@ async function runCreate(ctx, opts) {
     const company = companyFlag
         ? await ctx.resolveCompany(companyFlag)
         : null;
+    let meshCompany = company;
+    if (meshCompanyFlag) {
+        const resolvedMeshCompany = await ctx.resolveCompany(meshCompanyFlag);
+        if (company &&
+            (company.uid !== resolvedMeshCompany.uid || company.slug !== resolvedMeshCompany.slug)) {
+            throw new LanesError("mesh_company_mismatch", "--mesh-company must match --company when both are provided", {
+                company: company.slug,
+                mesh_company: resolvedMeshCompany.slug,
+            });
+        }
+        meshCompany = resolvedMeshCompany;
+    }
     const seniorCompany = companyOfSenior(hqRoot, senior, ctx);
     assertSameTenant(company, senior, seniorCompany);
     let resolvedWorker;
     if (opts.worker) {
         resolvedWorker = resolveLaneWorker(hqRoot, opts.worker, company?.slug);
     }
+    const profile = resolvedWorker?.profile;
+    const provider = explicitProvider ??
+        profile?.meta.provider ??
+        parseLaneProvider("codex");
+    const profileDefaultsApply = profile !== undefined && profile.meta.provider === provider;
     const briefAbs = resolveCallerPath(ctx.callerCwd(), briefFile);
     if (!ctx.existsSync(briefAbs)) {
         throw new LanesError("brief_not_found", `Brief file not found: ${briefAbs}`, {
@@ -1423,12 +1457,19 @@ async function runCreate(ctx, opts) {
     const cliModel = parseCliModel(opts.model);
     // Validated here because `claude --effort <unknown>` only warns and runs.
     const cliEffort = parseCliEffort(provider, opts.effort);
+    const profileModel = profileDefaultsApply ? profile?.meta.model : undefined;
+    const profileEffort = profileDefaultsApply ? profile?.meta.effort : undefined;
+    const profileAccount = profileDefaultsApply ? profile?.meta.account : undefined;
+    const profileAccounts = profileDefaultsApply ? profile?.meta.accounts : undefined;
     let pinnedAccount;
     const accountWasExplicit = Boolean(opts.account && opts.account.trim() !== "");
     if (outpostId) {
         if (accountWasExplicit) {
             pinnedAccount = opts.account.trim();
         }
+        else if (profileAccount !== undefined && profileAccounts === undefined) {
+            pinnedAccount = profileAccount;
+        }
     }
     else if (opts.account !== undefined) {
         const requested = opts.account.trim();
@@ -1438,9 +1479,27 @@ async function runCreate(ctx, opts) {
         const resolved = resolveAccount(provider, requested, config, {
             hqRoot,
             cliModel,
+            model: cliModel ?? profileModel,
         });
         pinnedAccount = resolved.id;
     }
+    else if (profileAccount !== undefined && profileAccounts === undefined) {
+        const resolved = resolveAccount(provider, profileAccount, config, {
+            hqRoot,
+            cliModel,
+            model: cliModel ?? profileModel,
+        });
+        pinnedAccount = resolved.id;
+    }
+    if (outpostId !== undefined && profile !== undefined) {
+        throw new LanesError("worker_profile_outpost_unsupported", `Worker profile ${JSON.stringify(profile.id)} cannot be used with --outpost; personal profiles are local-only`, {
+            worker: profile.id,
+            outpost: outpostId,
+            profile_account: profileAccount ?? null,
+            profile_accounts: profileAccounts ?? null,
+            pinned_account: pinnedAccount ?? null,
+        });
+    }
     const priority = parsePriority(opts.priority);
     let timeoutSecs = parseOptionalInt(opts.timeout, "--timeout");
     if (timeoutSecs === undefined && resolvedWorker) {
@@ -1478,6 +1537,9 @@ async function runCreate(ctx, opts) {
                 hqRoot,
                 existsSync: ctx.existsSync,
                 cliModel,
+                ...(profileAccounts !== undefined
+                    ? { allowedAccounts: profileAccounts }
+                    : {}),
             }).id;
         const toValidate = pinnedAccount !== undefined
             ? [candidate]
@@ -1486,6 +1548,7 @@ async function runCreate(ctx, opts) {
                 ...Object.keys(accounts)
                     .filter((id) => id !== candidate &&
                     accounts[id]?.enabled &&
+                    (profileAccounts === undefined || profileAccounts.includes(id)) &&
                     accountStatus(provider, id, config, { existsSync: ctx.existsSync }).logged_in === true)
                     .sort(),
             ];
@@ -1548,8 +1611,9 @@ async function runCreate(ctx, opts) {
             });
         }
     }
-    const threadId = company
-        ? await ctx.mesh.ensureProjectThread(company, project)
+    const allowedAccounts = validatedAccounts.size > 0 ? [...validatedAccounts] : profileAccounts;
+    const threadId = meshCompany
+        ? await ctx.mesh.ensureProjectThread(meshCompany, project)
         : undefined;
     const persist = async () => {
         let admission;
@@ -1559,7 +1623,7 @@ async function runCreate(ctx, opts) {
                 hqRoot,
                 existsSync: ctx.existsSync,
                 cliModel,
-                ...(validatedAccounts.size > 0 ? { allowedAccounts: [...validatedAccounts] } : {}),
+                ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
             }).id;
         }
         const accountCfg = pinnedAccount !== undefined
@@ -1567,6 +1631,7 @@ async function runCreate(ctx, opts) {
             : undefined;
         const model = resolveLaneModel({
             cliModel,
+            profileModel,
             accountModel: accountCfg?.model,
             providerModel: config.providers[provider].model,
         });
@@ -1574,6 +1639,7 @@ async function runCreate(ctx, opts) {
         // every source except `cli`.
         const effort = resolveLaneEffort({
             cliEffort,
+            profileEffort,
             accountEffort: accountCfg?.effort,
             providerEffort: config.providers[provider].effort,
             model,
@@ -1587,6 +1653,10 @@ async function runCreate(ctx, opts) {
                 hqRoot,
                 provider,
                 pinnedAccount,
+                ...(profile !== undefined ? { profileId: profile.id } : {}),
+                ...(profile?.meta.max_concurrent !== undefined
+                    ? { profileMaxConcurrent: profile.meta.max_concurrent }
+                    : {}),
                 priority,
                 createdAt,
                 config,
@@ -1605,6 +1675,9 @@ async function runCreate(ctx, opts) {
         const queuedReason = admission.action === "queue" ? admission.reason : undefined;
         const lane = createLane(hqRoot, {
             company,
+            ...(company === null && meshCompany
+                ? { mesh_company: meshCompany }
+                : {}),
             project_id: project,
             story_id: story,
             thread_id: threadId,
@@ -1617,9 +1690,25 @@ async function runCreate(ctx, opts) {
             worker: resolvedWorker?.id ?? opts.worker,
             ...(resolvedWorker ? { worker_path: resolvedWorker.path } : {}),
             ...(resolvedWorker?.pack ? { worker_pack: resolvedWorker.pack } : {}),
+            ...(profile
+                ? {
+                    worker_profile: profile.id,
+                    worker_profile_hash: profile.contentHash,
+                    worker_profile_ignored: ignoredWorkerProfileFields(provider),
+                }
+                : {}),
             provider,
             account: pinnedAccount,
             ...(model !== undefined ? { model } : {}),
+            model_source: cliModel !== undefined
+                ? "cli"
+                : profileModel !== undefined
+                    ? "profile"
+                    : accountCfg?.model !== undefined
+                        ? "account"
+                        : config.providers[provider].model !== undefined
+                            ? "provider"
+                            : "none",
             ...(effort.effort !== undefined ? { effort: effort.effort } : {}),
             effort_source: effort.source,
             host,
@@ -1668,13 +1757,13 @@ async function runCreate(ctx, opts) {
             runCompaction: ctx.runCompaction,
             locateTranscript: ctx.locateTranscript,
         });
-        if (company) {
-            await emitLaneMeshEvent(ctx, company, threadId, "lane_started", {
+        if (meshCompany) {
+            await emitLaneMeshEvent(ctx, meshCompany, threadId, "lane_started", {
                 lane_id: started.lane_id,
                 project_id: project,
                 story_id: story,
             });
-            await ctx.mesh.patchStoryStatus(company, project, story, "in_progress");
+            await ctx.mesh.patchStoryStatus(meshCompany, project, story, "in_progress");
         }
     }
     else if (outpostId) {
@@ -2012,7 +2101,7 @@ async function runList(ctx, opts) {
             return false;
         if (opts.story && lane.story_id !== opts.story)
             return false;
-        if (company && !recordMatchesCompany(lane.company, company)) {
+        if (company && !recordMatchesCompany(lane, company)) {
             return false;
         }
         if (senior && seniorKey(lane.senior) !== seniorKey(senior))
@@ -2195,7 +2284,9 @@ async function prepareAccountMove(ctx, lane, input) {
             const next = {
                 ...current,
                 account: target,
-                ...(input.cliModel !== undefined ? { model: input.cliModel } : {}),
+                ...(input.cliModel !== undefined
+                    ? { model: input.cliModel, model_source: "cli" }
+                    : {}),
                 account_history: appendCappedHistory(current.account_history ?? [], {
                     from,
                     to: target,
@@ -2751,14 +2842,14 @@ async function runAsk(ctx, opts) {
                 questionId,
             });
             questionId = withBody.question_id;
-            await emitLaneMeshEvent(ctx, lane.company, lane.thread_id, "lane_question", {
+            await emitLaneMeshEvent(ctx, lane.mesh_company ?? lane.company, lane.thread_id, "lane_question", {
                 lane_id: lane.lane_id,
                 question_id: withBody.question_id,
                 hop: withBody.hop,
             });
             const audience = resolveAudience(hqRoot, withBody, ctx);
             if (audience.kind === "user") {
-                await emitLaneMeshEvent(ctx, lane.company, lane.thread_id, "lane_question_at_user", {
+                await emitLaneMeshEvent(ctx, lane.mesh_company ?? lane.company, lane.thread_id, "lane_question_at_user", {
                     lane_id: lane.lane_id,
                     question_id: withBody.question_id,
                 });
@@ -2818,7 +2909,7 @@ async function runQuestionsList(ctx, opts) {
             return false;
         if (opts.story && q.story_id !== opts.story)
             return false;
-        if (company && !recordMatchesCompany(q.company, company)) {
+        if (company && !companyRefMatches(q.company, company)) {
             return false;
         }
         if (forFilter) {
@@ -2984,7 +3075,7 @@ async function runQuestionsEscalate(ctx, questionId, opts) {
     const nextAudience = resolveAudience(hqRoot, updated, ctx);
     if (nextAudience.kind === "user") {
         const lane = readLane(hqRoot, updated.lane_id);
-        await emitLaneMeshEvent(ctx, lane.company, lane.thread_id, "lane_question_at_user", { lane_id: lane.lane_id, question_id: updated.question_id });
+        await emitLaneMeshEvent(ctx, lane.mesh_company ?? lane.company, lane.thread_id, "lane_question_at_user", { lane_id: lane.lane_id, question_id: updated.question_id });
     }
     printJson({ ok: true, action: "questions.escalate", question: updated });
 }
@@ -3063,10 +3154,13 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     if (!id) {
         throw new LanesError("invalid_account", "account-id must be non-empty", {});
     }
+    if (opts.deviceAuth && provider !== "codex") {
+        throw new LanesError("device_auth_unsupported", "--device-auth is supported only for codex account login", { provider });
+    }
+    const registeredAccount = config.providers[provider].accounts[id];
     const homeRaw = opts.home?.trim() ||
-        (id === "a"
-            ? DEFAULT_ACCOUNT_HOMES[provider]
-            : `~/.${provider}-${id}`);
+        registeredAccount?.home ||
+        (id === "a" ? DEFAULT_ACCOUNT_HOMES[provider] : `~/.${provider}-${id}`);
     const homeResolved = homeRaw.startsWith("~") || path.isAbsolute(homeRaw)
         ? homeRaw
         : resolveCallerPath(callerCwd, homeRaw);
@@ -3098,14 +3192,17 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     installDrainHook(provider, home);
     const envVar = PROVIDER_HOME_ENV[provider];
     const login = VENDOR_LOGIN[provider];
+    const loginArgs = provider === "codex" && opts.deviceAuth
+        ? [...login.args, "--device-auth"]
+        : login.args;
     const result = await ctx.spawnLogin({
         command: login.command,
-        args: login.args,
+        args: loginArgs,
         env: { ...ctx.env, [envVar]: home },
         cwd: home,
     });
     if (result.status !== 0) {
-        throw new LanesError("login_failed", `${login.command} ${login.args.join(" ")} exited ${result.status}`, { provider, account: id, status: result.status });
+        throw new LanesError("login_failed", `${login.command} ${loginArgs.join(" ")} exited ${result.status}`, { provider, account: id, status: result.status });
     }
     const grokNeedsRails = provider === "grok";
     if ((grokNeedsRails || copied) && !railsPresent(home)) {
@@ -3300,6 +3397,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .command("create")
         .description("Register a lane, run admission, and return immediately")
         .option("--company <slug|uid>", "Company slug or cloud uid; omit for a core/personal lane")
+        .option("--mesh-company <slug|uid>", "Explicit Work Mesh company for a personal lane; membership is verified")
         .requiredOption("--project <slug>", "HQ project slug")
         .requiredOption("--story <id>", "Story id from the project's prd.json")
         .requiredOption("--brief-file <path>", "Path to the lane brief")
@@ -3472,6 +3570,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .argument("<provider>", "claude | codex | grok")
         .argument("<account-id>", "Open-ended account id")
         .option("--home <path>", "Account home directory")
+        .option("--device-auth", "Use Codex device authentication instead of localhost callback")
         .action(wrap(async (provider, accountId, opts) => {
         await runAccountsLogin(ctx, provider, accountId, opts);
     }));