@indigoai-us/hq-cli 5.142.0 → 5.144.0

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+## [5.144.0] — 2026-09-23
+
+- Worker-profile models now use the same provider catalog validation as
+  `--model` during creation and before every later provider launch. The error
+  names the profile when its model is unsupported.
+- Worker resolution continues to use the existing personal, core, installed
+  package, and company worker sources. hq-cli does not ship starter profiles.
+
+## [5.143.0] — 2026-09-23
+
+### Fixed
+
+- `hq dm` and report commands now reject non-recipient and non-company channel
+  requests locally, and report updates retry one fresh revision after a
+  conflict.
+- `hq mesh project register` now verifies the company's Board view before
+  registering and reports an actionable local error when the Board is missing.
+
 ## [5.142.0] — 2026-09-23
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -5740,7 +5740,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly subcommands: readonly [];
         }, {
             readonly name: "register";
-            readonly description: "POST project registration to create or bind its project channel and Board";
+            readonly description: "Register an existing Board and bind its project channel; use project ensure to create or repair a Board";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly usage: "[options] <projectId>";

package/dist/command-catalog.generated.js

@@ -7409,7 +7409,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "name": "register",
-                        "description": "POST project registration to create or bind its project channel and Board",
+                        "description": "Register an existing Board and bind its project channel; use project ensure to create or repair a Board",
                         "aliases": [],
                         "hidden": false,
                         "usage": "[options] <projectId>",

package/dist/commands/agents.d.ts

@@ -336,6 +336,7 @@ export declare function formatJobsTable(jobs: AgentJobView[]): string;
 export declare function formatPauseResult(result: PauseJobResult): string;
 /** Human-readable "hot-applied to the running box" vs "saved for next launch". */
 export declare function appliedHint(applied: boolean): string;
+/** Agent uid shape (`agt_…`). */
 /** One message in a DM thread, as returned by `GET /v1/notify/thread`. */
 export interface DmThreadMessage {
     eventId: string;

package/dist/commands/agents.js

@@ -36,6 +36,7 @@ import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { launchSessionManagerPlugin, SessionManagerPluginLaunchError, TerminalSessionTimeoutError, waitForTerminalSession, } from "@indigoai-us/hq-cloud/outposts/node";
 import { peekIdToken } from "../utils/id-token.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
+import { AGENT_UID_PATTERN, isAgentUid } from "../lib/notify-recipient.js";
 import { confirmChargeOrExit, formatUsd, parseBillingPayload, surfaceBillingBlocked, } from "../utils/billing-gate.js";
 /** Reasoning-effort values hq-pro accepts on `runtime-config`. */
 export const VALID_EFFORTS = new Set([
@@ -807,14 +808,6 @@ export function appliedHint(applied) {
         ? "applied to the running box now"
         : "saved — takes effect on the agent's next launch";
 }
-// ---------------------------------------------------------------------------
-// Talking to agents (DM). Agents are members addressable over HQ's DM system:
-// a message rides `POST /v1/notify/dm` (the wire contract accepts `agt_*`), the
-// agent's box picks it up and replies over DM (a first-class agent reply
-// channel), and the two-way conversation is read back via `GET /v1/notify/thread`.
-// ---------------------------------------------------------------------------
-/** Agent uid shape (`agt_…`). */
-const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/;
 /**
  * Resolve an agent reference to its `agt_` uid. An `agt_…` value is used
  * directly; anything else is treated as a slug or display name and resolved
@@ -909,6 +902,9 @@ async function resolveJobsTargetOrExit(ref, company) {
 }
 /** Send a DM to an agent. Returns nothing meaningful beyond success. */
 export async function sendAgentDm(token, agentUid, message) {
+    if (!isAgentUid(agentUid)) {
+        throw new Error(`Invalid agent recipient '${agentUid}': expected an agt_ uid.`);
+    }
     await agentsRequest({
         token,
         path: "/v1/notify/dm",

package/dist/commands/dm.js

@@ -4,11 +4,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
-const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
-// People (prs_) and agents (agt_) are both first-class DM participants; the
-// server applies the same membership-overlap gate to either and delivers
-// agt_* recipients into the agent's durable box inbox.
-const RECIPIENT_UID_PATTERN = /^(prs|agt)_[A-Za-z0-9_-]+$/;
+import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN } from "../lib/notify-recipient.js";
 /**
  * Classify a recipient arg as an email or a person/agent uid. Mirrors the
  * email/uid heuristic used by `hq members`. Returns null for neither.

package/dist/commands/lanes.js

@@ -18,7 +18,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
 import { providerCompactAfterMs } from "../lib/lanes/config.js";
@@ -26,7 +26,7 @@ import { parseCliEffort, resolveLaneEffort } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
 import { accountQuotaView, loadQuotaState, quotaBlockFor } from "../lib/lanes/quota.js";
 import { SESSION_MOVE_REASON, copySessionFiles, planSessionCopy } from "../lib/lanes/move-account.js";
-import { defaultProbe, validateLaneModel, } from "../lib/lanes/models.js";
+import { defaultProbe, validateProfileLaneModel, validateLaneModel, } from "../lib/lanes/models.js";
 import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ONLY_RULE, STANDING_AUTHORIZATION, spawnLaneWorker, stopLaneProcesses, } from "../lib/lanes/spawn.js";
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
@@ -1530,13 +1530,16 @@ async function runCreate(ctx, opts) {
         env: ctx.env,
     };
     const validatedAccounts = new Set();
-    if (cliModel !== undefined && !outpostId) {
+    const modelToValidate = cliModel ?? profileModel;
+    const profileModelToValidate = cliModel === undefined && profileModel !== undefined ? profile : undefined;
+    if (modelToValidate !== undefined && !outpostId) {
         const accounts = config.providers[provider].accounts;
         const candidate = pinnedAccount ??
             resolveAccount(provider, undefined, config, {
                 hqRoot,
                 existsSync: ctx.existsSync,
                 cliModel,
+                model: modelToValidate,
                 ...(profileAccounts !== undefined
                     ? { allowedAccounts: profileAccounts }
                     : {}),
@@ -1562,7 +1565,12 @@ async function runCreate(ctx, opts) {
                 continue;
             checkedAccounts.push(id);
             try {
-                validateLaneModel(provider, cliModel, home, modelDeps);
+                if (profileModelToValidate !== undefined) {
+                    validateProfileLaneModel(provider, modelToValidate, home, profileModelToValidate.id, modelDeps);
+                }
+                else {
+                    validateLaneModel(provider, modelToValidate, home, modelDeps);
+                }
             }
             catch (err) {
                 if (!(isLanesError(err) && err.error === "model_unsupported"))
@@ -1570,7 +1578,7 @@ async function runCreate(ctx, opts) {
                 unsupported.push({ account: id, error: err });
                 continue;
             }
-            const block = quotaBlockFor(quota, provider, id, cliModel, now);
+            const block = quotaBlockFor(quota, provider, id, modelToValidate, now);
             if (block.blocked) {
                 quotaBlocked.push({ account: id, block });
                 continue;
@@ -1579,7 +1587,7 @@ async function runCreate(ctx, opts) {
         }
         if (validatedAccounts.size === 0 && quotaBlocked.length > 0) {
             const blocked = quotaBlocked[0];
-            const model = blocked.block.model ?? cliModel;
+            const model = blocked.block.model ?? modelToValidate;
             const checkedSuffix = ` Checked accounts: ${checkedAccounts.join(", ")}`;
             if (blocked.block.reason === "account_model_unavailable") {
                 throw new AccountResolutionError("account_model_unavailable", `Account ${JSON.stringify(blocked.account)} cannot run model ${model ?? "(no model)"}: ${blocked.block.marker ?? "needs credits"}${checkedSuffix}`, {
@@ -1623,6 +1631,7 @@ async function runCreate(ctx, opts) {
                 hqRoot,
                 existsSync: ctx.existsSync,
                 cliModel,
+                model: cliModel ?? profileModel,
                 ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
             }).id;
         }
@@ -1748,6 +1757,11 @@ async function runCreate(ctx, opts) {
     if (admission.action === "start") {
         started = spawnLaneWorker(hqRoot, lane, {
             env: ctx.env,
+            modelDeps: {
+                readFileSync: ctx.readFileSync,
+                probe: ctx.probeProvider,
+                env: ctx.env,
+            },
             existsSync: ctx.existsSync,
             spawnProcess: ctx.spawnProcess,
             proveDetached: ctx.proveDetached,
@@ -2049,6 +2063,11 @@ async function runPickup(ctx, opts) {
         try {
             started = spawnLaneWorker(hqRoot, afterAccount, {
                 env: ctx.env,
+                modelDeps: {
+                    readFileSync: ctx.readFileSync,
+                    probe: ctx.probeProvider,
+                    env: ctx.env,
+                },
                 existsSync: ctx.existsSync,
                 spawnProcess: ctx.spawnProcess,
                 proveDetached: ctx.proveDetached,
@@ -2219,6 +2238,20 @@ async function prepareAccountMove(ctx, lane, input) {
     if (isLoggedOut(accountStatus(lane.provider, target, config, { existsSync: ctx.existsSync }))) {
         throw new LanesError("account_not_logged_in", `Account ${target} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: target, lane_id: laneId });
     }
+    const profile = lane.worker_profile !== undefined
+        ? loadWorkerProfile(hqRoot, lane.worker_profile)
+        : undefined;
+    const profileDefaultsApply = profile !== undefined && profile.meta.provider === lane.provider;
+    const pinnedModel = lane.model_source === undefined || lane.model_source === "cli"
+        ? lane.model
+        : undefined;
+    if (input.cliModel === undefined && profileDefaultsApply && pinnedModel === undefined) {
+        validateProfileLaneModel(lane.provider, profile.meta.model, targetCfg.home, profile.id, {
+            readFileSync: ctx.readFileSync,
+            probe: ctx.probeProvider,
+            env: ctx.env,
+        });
+    }
     // The model the moved run would use, resolved the way spawn resolves it:
     // the operator's --model, else the lane's own, else the target account's
     // default, else the provider's. The quota and validation checks use this
@@ -2383,6 +2416,11 @@ async function runMessage(ctx, laneId, opts) {
         archiveResumeMessage(hqRoot, laneId, dropboxMessage);
         resumed = spawnLaneWorker(hqRoot, lane, {
             env: ctx.env,
+            modelDeps: {
+                readFileSync: ctx.readFileSync,
+                probe: ctx.probeProvider,
+                env: ctx.env,
+            },
             existsSync: ctx.existsSync,
             spawnProcess: ctx.spawnProcess,
             proveDetached: ctx.proveDetached,
@@ -2529,6 +2567,11 @@ async function runResume(ctx, laneId, opts) {
         ? lane
         : spawnLaneWorker(hqRoot, lane, {
             env: ctx.env,
+            modelDeps: {
+                readFileSync: ctx.readFileSync,
+                probe: ctx.probeProvider,
+                env: ctx.env,
+            },
             existsSync: ctx.existsSync,
             spawnProcess: ctx.spawnProcess,
             proveDetached: ctx.proveDetached,

package/dist/commands/mesh.js

@@ -400,7 +400,30 @@ async function runProjectRegister(projectId, opts) {
     }
     const { token, company } = await withCompany(opts);
     const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
-    const registration = await registerMeshProject(token, company.companyUid, projectId);
+    const companyRef = company.companySlug || company.companyUid;
+    try {
+        const board = await getProjectView(token, company.companyUid, projectId);
+        if (board.companyUid !== company.companyUid || board.projectId !== projectId) {
+            fail(`Work mesh project ${projectId} has no Board view in company ${companyRef}. Create the Board before registering it.`);
+        }
+    }
+    catch (err) {
+        if (httpStatus(err) === 404) {
+            fail(`Work mesh project ${projectId} has no Board view in company ${companyRef}. Create the Board before registering it.`);
+        }
+        throw err;
+    }
+    let registration;
+    try {
+        registration = await registerMeshProject(token, company.companyUid, projectId);
+    }
+    catch (err) {
+        const failure = err;
+        if (failure.status === 403 && failure.code === "PROJECT_NOT_IN_COMPANY") {
+            fail(`Work mesh project ${projectId} could not be registered in company ${companyRef}: the Board or its genesis thread is missing. Run "hq mesh project ensure ${projectId} --company ${companyRef} --stories-file <prd.json>" to create or restore them.`);
+        }
+        throw err;
+    }
     const boardState = "registered";
     if (opts.json) {
         console.log(JSON.stringify({ ok: true, action: "project.register", principalUid, boardState, ...registration }, null, 2));
@@ -1601,7 +1624,7 @@ export function registerMeshCommand(program) {
         .action((projectId, opts) => wrap(() => runProjectEnsure(projectId, opts))());
     project
         .command("register <projectId>")
-        .description("POST project registration to create or bind its project channel and Board")
+        .description("Register an existing Board and bind its project channel; use project ensure to create or repair a Board")
         .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
         .option("--channel <channelId>", "Reserved: the current server chooses the project channel")
         .option("--json", "Print machine-readable JSON")

package/dist/commands/report.d.ts

@@ -1,8 +1,9 @@
 import { Command } from "commander";
 import { buildReportTarball, deployOrgContext, type ChannelReport, type DeployAccessPolicy, type ReportDeployment, type ReportPatch } from "../lib/report-publish.js";
+type ReportPatchInput = ReportPatch | ((current: ChannelReport) => ReportPatch);
 /** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
 export declare function resolveReport(token: string, reportId: string, requestedChannelId?: string): Promise<ChannelReport>;
-export declare function patchReport(token: string, report: ChannelReport, patch: ReportPatch): Promise<ChannelReport>;
+export declare function patchReport(token: string, report: ChannelReport, patch: ReportPatchInput): Promise<ChannelReport>;
 export declare function resolveCompanySlug(token: string, companyUid: string): Promise<string>;
 export declare function deployReportStatic(token: string, input: {
     slug: string;
@@ -12,4 +13,5 @@ export declare function deployReportStatic(token: string, input: {
 }): Promise<ReportDeployment>;
 export declare function registerReportCommand(program: Command): void;
 export declare function runReportCommand(action: () => Promise<void>): Promise<void>;
+export {};
 //# sourceMappingURL=report.d.ts.map

package/dist/commands/report.js

@@ -86,10 +86,39 @@ function print(value, json) {
     else
         console.log(typeof value === "string" ? value : JSON.stringify(value, null, 2));
 }
+async function listReportChannels(token) {
+    const channels = await vaultApiFetch({ token, path: "/v1/notify/channels" });
+    if (!channels.ok)
+        throw new ReportPublishError("Could not resolve the report channel.");
+    const listed = await channels.json();
+    return Array.isArray(listed.channels) ? listed.channels : [];
+}
+function isCompanyReportChannel(channel) {
+    return channel.scope === "company"
+        || (typeof channel.scope !== "string" && Boolean(channel.companyUid));
+}
+function requireCompanyReportChannel(channels, channelId) {
+    const channel = channels.find((row) => row.channelId === channelId);
+    if (!channel)
+        throw new ReportPublishError("Report channel was not found in your channels.");
+    if (!isCompanyReportChannel(channel))
+        throw new ReportPublishError("Channel reports require a company channel.");
+}
+async function readReportInChannel(token, channelId, reportId) {
+    const res = await vaultApiFetch({ token, path: reportPath(channelId, reportId) });
+    if (!res.ok)
+        return undefined;
+    const body = await res.json();
+    if (!body.report)
+        throw new ReportPublishError("Report response was incomplete.");
+    return body.report;
+}
 /** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
 export async function resolveReport(token, reportId, requestedChannelId) {
     const explicit = requestedChannelId ?? process.env.HQ_REPORT_CHANNEL_ID;
+    const channels = await listReportChannels(token);
     if (explicit) {
+        requireCompanyReportChannel(channels, explicit);
         const res = await vaultApiFetch({ token, path: reportPath(explicit, reportId) });
         if (!res.ok)
             throw new ReportPublishError("Report was not found in the supplied channel context.");
@@ -100,24 +129,20 @@ export async function resolveReport(token, reportId, requestedChannelId) {
     }
     const recordedChannel = locallyRecordedChannel(reportId);
     if (recordedChannel) {
-        const res = await vaultApiFetch({ token, path: reportPath(recordedChannel, reportId) });
-        if (res.ok) {
-            const body = await res.json();
-            if (body.report)
-                return body.report;
-        }
+        requireCompanyReportChannel(channels, recordedChannel);
+        const recorded = await readReportInChannel(token, recordedChannel, reportId);
+        if (recorded)
+            return recorded;
     }
     // The report API is intentionally channel-scoped. Discover only among the
     // caller's existing channels, using list endpoints so missing reports never
     // become one server-side 404 per channel.
-    const channels = await vaultApiFetch({ token, path: "/v1/notify/channels" });
-    if (!channels.ok)
-        throw new ReportPublishError("Could not resolve the report channel.");
-    const listed = await channels.json();
     let scannedChannels = 0;
-    for (const row of listed.channels ?? []) {
+    for (const row of channels) {
         if (!row.channelId)
             continue;
+        if (!isCompanyReportChannel(row))
+            continue;
         if (scannedChannels >= MAX_REPORT_DISCOVERY_CHANNELS)
             break;
         scannedChannels += 1;
@@ -125,19 +150,45 @@ export async function resolveReport(token, reportId, requestedChannelId) {
         if (!res.ok)
             continue;
         const body = await res.json();
-        const match = body.reports?.find((report) => report.reportId === reportId);
+        const reports = Array.isArray(body.reports) ? body.reports : [];
+        const match = reports.find((report) => report.reportId === reportId);
         if (match)
             return match;
     }
     throw new ReportPublishError(notFoundMessage(scannedChannels));
 }
 export async function patchReport(token, report, patch) {
-    const res = await vaultApiFetch({ token, path: reportPath(report.channelId, report.reportId), method: "PATCH", body: patch });
+    if (!report.companyUid)
+        throw new ReportPublishError("Channel reports require a company channel.");
+    const patchOnce = (current) => vaultApiFetch({
+        token,
+        path: reportPath(current.channelId, current.reportId),
+        method: "PATCH",
+        body: {
+            ...(typeof patch === "function" ? patch(current) : patch),
+            revision: current.revision,
+        },
+    });
+    let res = await patchOnce(report);
     if (res.status === 409) {
         const body = await res.json().catch(() => ({}));
         if (body.error === "already-running")
             throw new ReportPublishError("already running", "already-running");
-        throw new ReportPublishError("Report changed while it was being updated.");
+        if (body.error !== "revision-mismatch")
+            throw new ReportPublishError("Report changed while it was being updated.", "revision-conflict");
+        const latest = await readReportInChannel(token, report.channelId, report.reportId);
+        if (!latest)
+            throw new ReportPublishError("Could not reread the report after it changed.", "revision-conflict");
+        if (typeof patch !== "function") {
+            throw new ReportPublishError("Report changed while it was being updated; refresh and retry.", "revision-conflict");
+        }
+        res = await patchOnce(latest);
+        if (res.status === 409) {
+            const retryBody = await res.json().catch(() => ({}));
+            if (retryBody.error === "already-running")
+                throw new ReportPublishError("already running", "already-running");
+            throw new ReportPublishError("Report changed while it was being updated; refresh and retry.", "revision-conflict");
+        }
     }
     if (!res.ok)
         throw new ReportPublishError("Could not update the report record.");
@@ -267,7 +318,10 @@ async function discardDraftAction(reportId, options) {
         if (!res.ok && res.status !== 404)
             throw new ReportPublishError("Could not remove the draft deployment.");
     }
-    const updated = await patchReport(token, report, { draft: null, state: report.url ? "live" : "draft-pending" });
+    const updated = await patchReport(token, report, (current) => ({
+        draft: null,
+        state: current.url ? "live" : "draft-pending",
+    }));
     print(updated, options.json === true);
 }
 async function accessAction(reportId, options) {

package/dist/lib/agent-kit/mcp/tools.js

@@ -17,6 +17,7 @@
  */
 import { CLI_VERSION } from "../../../cli-version.js";
 import { peekIdToken } from "../../../utils/id-token.js";
+import { isRecipientUid } from "../../../lib/notify-recipient.js";
 import { markInboxDone, mergeAgentInbox, readDoneIds, summarizeInboxEntry } from "../inbox-state.js";
 import { errorResult, McpToolInputError, textResult } from "./jsonrpc.js";
 export const MAX_TOOL_OUTPUT_CHARS = 40_000;
@@ -222,7 +223,7 @@ export function buildAgentMcpTools(clients) {
                 const message = str(args, "message", { required: true, max: 20_000 }).trim();
                 const body = /^[^\s]+@[^\s]+$/.test(to)
                     ? { toEmail: to.toLowerCase(), body: message }
-                    : /^(prs|agt)_[A-Za-z0-9_-]+$/.test(to)
+                    : isRecipientUid(to)
                         ? { toPersonUid: to, body: message }
                         : (() => {
                             throw new McpToolInputError('"to" must be an email, prs_… or agt_… uid');

package/dist/lib/bot/api.d.ts

@@ -143,6 +143,10 @@ export declare class BotApiError extends Error {
     readonly tokenAgentUid?: string | undefined;
     constructor(status: number, path: string, code?: string | undefined, detail?: string | undefined, retryAfterMs?: number | undefined, tokenAgentUid?: string | undefined);
 }
+export declare class InvalidDmRecipientError extends Error {
+    readonly recipient: string;
+    constructor(recipient: string);
+}
 /** Parse a Retry-After header (delta-seconds or HTTP-date) to milliseconds. */
 export declare function retryAfterHeaderMs(value: string | null | undefined, nowMs?: number): number | undefined;
 export interface BotApiOptions {

package/dist/lib/bot/api.js

@@ -8,6 +8,7 @@
 import { vaultApiFetch } from "../../utils/vault-api.js";
 import { tokenAgentUid } from "../heartbeat-identity.js";
 import { assertNoSecretKeys } from "./local-config.js";
+import { isRecipientUid } from "../notify-recipient.js";
 export class BotApiError extends Error {
     status;
     path;
@@ -26,6 +27,14 @@ export class BotApiError extends Error {
         this.name = "BotApiError";
     }
 }
+export class InvalidDmRecipientError extends Error {
+    recipient;
+    constructor(recipient) {
+        super(`Invalid DM recipient '${recipient}': expected a prs_ or agt_ uid.`);
+        this.recipient = recipient;
+        this.name = "InvalidDmRecipientError";
+    }
+}
 /** Parse a Retry-After header (delta-seconds or HTTP-date) to milliseconds. */
 export function retryAfterHeaderMs(value, nowMs = Date.now()) {
     if (!value)
@@ -141,7 +150,10 @@ export class BotApi {
     }
     /** POST /v1/notify/dm — send as the bot (agent identity). */
     async sendDm(input) {
-        const payload = { toPersonUid: input.toPersonUid, body: input.body };
+        const recipient = input.toPersonUid.trim();
+        if (!isRecipientUid(recipient))
+            throw new InvalidDmRecipientError(input.toPersonUid);
+        const payload = { toPersonUid: recipient, body: input.body };
         if (input.rootEventId)
             payload.rootEventId = input.rootEventId;
         const { body } = await this.call("/v1/notify/dm", { method: "POST", body: payload });

package/dist/lib/lanes/models.d.ts

@@ -75,4 +75,10 @@ export declare function modelIsKnown(known: KnownModels, model: string): boolean
  * null when no source was readable and the value passed unvalidated.
  */
 export declare function validateLaneModel(provider: LaneProvider, model: string, home: string, deps?: KnownModelsDeps): string | null;
+/**
+ * Validate a model supplied by a reusable worker profile. Keep the provider
+ * catalog and refusal semantics identical to `--model`, while making the
+ * profile origin visible to callers and JSON error consumers.
+ */
+export declare function validateProfileLaneModel(provider: LaneProvider, model: string, home: string, profileId: string, deps?: KnownModelsDeps): string | null;
 //# sourceMappingURL=models.d.ts.map

package/dist/lib/lanes/models.js

@@ -202,4 +202,28 @@ export function validateLaneModel(provider, model, home, deps = {}) {
     // `message` is in details too: LanesError.toJSON prints details only.
     throw new LanesError("model_unsupported", message, { provider, model, accepted, source: known.source, message });
 }
+/**
+ * Validate a model supplied by a reusable worker profile. Keep the provider
+ * catalog and refusal semantics identical to `--model`, while making the
+ * profile origin visible to callers and JSON error consumers.
+ */
+export function validateProfileLaneModel(provider, model, home, profileId, deps = {}) {
+    try {
+        return validateLaneModel(provider, model, home, deps);
+    }
+    catch (err) {
+        if (!(err instanceof LanesError) || err.error !== "model_unsupported") {
+            throw err;
+        }
+        const message = `Worker profile ${JSON.stringify(profileId)} supplied model ${JSON.stringify(model)}; ` +
+            `the model came from the profile. ${err.message}`;
+        throw new LanesError("model_unsupported", message, {
+            ...err.details,
+            profile_id: profileId,
+            worker_profile: profileId,
+            model_source: "profile",
+            message,
+        });
+    }
+}
 //# sourceMappingURL=models.js.map

package/dist/lib/lanes/reconcile.js

@@ -13,7 +13,7 @@ import { MAX_LANE_DEPTH } from "./constants.js";
 import { LanesError, isLaneVersionConflict } from "./errors.js";
 import { loadWorkerProfile } from "./profile.js";
 import { classifySessionLiveness, defaultLivenessDeps, loadLivenessIndex, readDaemonPresenceConnected, } from "./liveness.js";
-import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, isPidRecordAlive, laneRunDir, readPidRecord, readSpawnManifest, spawnEnvelopeRepair, spawnLaneWorker, } from "./spawn.js";
+import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, isPidRecordAlive, laneRunDir, readPidRecord, readSpawnManifest, markSpawnFailure, spawnEnvelopeRepair, spawnLaneWorker, } from "./spawn.js";
 import { appendCappedHistory, lanesStoreRoot, parseLaneRecord, parseQuestionRecord, readLane, readQuestion, updateLane, updateQuestion, } from "./store.js";
 import { applyThrottleDecision, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, isCpuCheckEnabled, readAvailableMemMb, readThrottleState, resolveCpuBusyFraction, throttleStatePath, writeThrottleState, } from "./throttle.js";
 import { applyDefaultQuotaHold, readQuotaSignal, recordAccountQuota } from "./quota.js";
@@ -60,6 +60,19 @@ function markDirty(summary, skip) {
     summary.ok = false;
     logSkip(skip);
 }
+function terminalizeModelUnsupported(hqRoot, lane, err) {
+    if (!(err instanceof LanesError) || err.error !== "model_unsupported")
+        return;
+    try {
+        markSpawnFailure(hqRoot, lane.lane_id, err.error, {
+            ...err.details,
+            message: err.message,
+        });
+    }
+    catch (writeErr) {
+        process.stderr.write(`hq lanes reconcile: failed to terminalize ${lane.lane_id} after model validation: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}\n`);
+    }
+}
 function markError(summary, err) {
     const message = err instanceof Error ? err.message : String(err);
     const code = err instanceof LanesError ? err.error : undefined;
@@ -843,7 +856,9 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     !quota &&
                     rawLatest &&
                     rawLatest.envelope === null) {
-                    const repair = decideEnvelopeRepair(hqRoot, lane.lane_id, rawLatest, nowMs, deps.spawnRepair ?? spawnEnvelopeRepair, () => undefined);
+                    const spawnRepair = deps.spawnRepair ??
+                        ((root, repairLane, input) => spawnEnvelopeRepair(root, repairLane, input, deps.spawnLaneDeps));
+                    const repair = decideEnvelopeRepair(hqRoot, lane.lane_id, rawLatest, nowMs, spawnRepair, () => undefined);
                     if (repair.action === "spawned") {
                         armLaneWatcher(hqRoot, lane.lane_id, deps.spawnLaneDeps);
                         summary.heartbeats.push(`${lane.lane_id}:envelope-repair`);
@@ -1067,6 +1082,7 @@ async function admitQueued(hqRoot, lanes, summary, deps, now) {
                 break;
         }
         catch (err) {
+            terminalizeModelUnsupported(hqRoot, lane, err);
             markDirty(summary, {
                 kind: "lane",
                 id: lane.lane_id,
@@ -1110,6 +1126,7 @@ async function resumeAwaiting(hqRoot, lanes, questions, summary, deps) {
             });
         }
         catch (err) {
+            terminalizeModelUnsupported(hqRoot, lane, err);
             markDirty(summary, {
                 kind: "lane",
                 id: lane.lane_id,

package/dist/lib/lanes/spawn.d.ts

@@ -9,13 +9,14 @@
  */
 import { PROVIDER_HOME_ENV } from "./accounts.js";
 import { type RunCompactionFn } from "./compaction.js";
+import { type KnownModelsDeps } from "./models.js";
 import { type LaunchTrigger } from "./delivery.js";
 import { type MachineIdentity } from "./machine-identity.js";
 import { type LaneCompanyRef, type LaneProvider, type LaneRecord } from "./types.js";
 export declare const LANES_RUNS_REL: string;
 /** Written by reconcile before a resume spawn; the worker prompt names this path. */
 export declare const ANSWERED_QUESTIONS_FILE = "answered-questions.json";
-export declare const SPAWN_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "no_enabled_account", "spawn_failed", "not_detached", "watcher_not_armed"];
+export declare const SPAWN_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "no_enabled_account", "spawn_failed", "not_detached", "watcher_not_armed", "model_unsupported"];
 export type SpawnTerminalReason = (typeof SPAWN_TERMINAL_REASONS)[number];
 declare const PROVIDER_COMMAND: Record<LaneProvider, string>;
 export declare function providerCommandOnPath(command: string, pathEnv: string | undefined): boolean;
@@ -62,6 +63,8 @@ export type ProveDetachedFn = (pid: number) => DetachProof;
 export type KillProcessFn = (pid: number, signal?: NodeJS.Signals) => void;
 export interface SpawnLaneDeps {
     env?: NodeJS.ProcessEnv;
+    /** Provider model catalog dependencies, shared with create in tests. */
+    modelDeps?: KnownModelsDeps;
     existsSync?: (p: string) => boolean;
     spawnProcess?: SpawnProcessFn;
     proveDetached?: ProveDetachedFn;

package/dist/lib/lanes/spawn.js

@@ -16,6 +16,7 @@ import { COMPACTION_PROMPT, compactionAfterUsage, compactionDue, compactLaneSess
 import { installDrainHook } from "./hooks-install.js";
 import { loadLanesConfig, providerAutoCompactTokens, providerCompactAfterMs, } from "./config.js";
 import { appendEffortFlag, resolveLaneEffort } from "./effort.js";
+import { validateProfileLaneModel, } from "./models.js";
 import { claimableStatesFor, planLaneLaunch, providerSupportsSessionResume, } from "./delivery.js";
 import { AccountResolutionError, LanesError } from "./errors.js";
 import { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, workerProfilePrompt, } from "./profile.js";
@@ -33,6 +34,7 @@ export const SPAWN_TERMINAL_REASONS = [
     "spawn_failed",
     "not_detached",
     "watcher_not_armed",
+    "model_unsupported",
 ];
 const PROVIDER_COMMAND = {
     claude: "claude",
@@ -1065,6 +1067,10 @@ function inferTrigger(lane) {
  */
 export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
     const env = deps.env ?? process.env;
+    const modelDeps = {
+        ...deps.modelDeps,
+        env: deps.modelDeps?.env ?? env,
+    };
     const existsSync = deps.existsSync ?? ((p) => fs.existsSync(p));
     const spawnProcess = deps.spawnProcess ?? defaultSpawnProcess;
     const proveDetached = deps.proveDetached ?? defaultProveDetached;
@@ -1150,6 +1156,9 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
             : existing;
         throw new LanesError("account_not_logged_in", `Account ${resolved.id} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: resolved.id, lane_id: lane.lane_id, lane: failed });
     }
+    if (profileDefaultsApply && profileModel !== undefined && pinnedModel === undefined) {
+        validateProfileLaneModel(existing.provider, profileModel, resolved.home, profile.id, modelDeps);
+    }
     if (lane.account !== resolved.id) {
         retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => {
             if (current.account === resolved.id)
@@ -1532,6 +1541,12 @@ export function spawnEnvelopeRepair(hqRoot, lane, input, deps = {}) {
         existsSync,
         model: pinnedModel ?? profileModel,
     });
+    if (profileDefaultsApply && profileModel !== undefined && pinnedModel === undefined) {
+        validateProfileLaneModel(lane.provider, profileModel, resolved.home, profile.id, {
+            ...deps.modelDeps,
+            env: deps.modelDeps?.env ?? env,
+        });
+    }
     const autoCompactTokens = lane.provider === "claude"
         ? providerAutoCompactTokens(config.providers.claude)
         : undefined;

package/dist/lib/notify-recipient.d.ts

@@ -0,0 +1,7 @@
+/** Canonical recipients accepted by the notify DM wire contract. */
+export declare const RECIPIENT_UID_PATTERN: RegExp;
+export declare const AGENT_UID_PATTERN: RegExp;
+export declare const EMAIL_PATTERN: RegExp;
+export declare function isRecipientUid(value: string): boolean;
+export declare function isAgentUid(value: string): boolean;
+//# sourceMappingURL=notify-recipient.d.ts.map

package/dist/lib/notify-recipient.js

@@ -0,0 +1,11 @@
+/** Canonical recipients accepted by the notify DM wire contract. */
+export const RECIPIENT_UID_PATTERN = /^(prs|agt)_[A-Za-z0-9_-]+$/;
+export const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/;
+export const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
+export function isRecipientUid(value) {
+    return RECIPIENT_UID_PATTERN.test(value.trim());
+}
+export function isAgentUid(value) {
+    return AGENT_UID_PATTERN.test(value.trim());
+}
+//# sourceMappingURL=notify-recipient.js.map

package/dist/lib/report-publish.d.ts

@@ -124,8 +124,8 @@ export interface ReportAdoptDependencies {
     patch(report: ChannelReport, patch: ReportPatch): Promise<ChannelReport>;
 }
 export declare class ReportPublishError extends Error {
-    readonly code: "already-running" | "source-invalid" | "deploy-failed" | "job-failed";
-    constructor(message: string, code?: "already-running" | "source-invalid" | "deploy-failed" | "job-failed");
+    readonly code: "already-running" | "source-invalid" | "deploy-failed" | "job-failed" | "revision-conflict";
+    constructor(message: string, code?: "already-running" | "source-invalid" | "deploy-failed" | "job-failed" | "revision-conflict");
 }
 /** A deliberately boring, token-safe failure reason stored on the report. */
 export declare function plainFailureReason(error: unknown): string;

package/dist/lib/report-publish.js

@@ -41,7 +41,7 @@ export class ReportPublishError extends Error {
 /** A deliberately boring, token-safe failure reason stored on the report. */
 export function plainFailureReason(error) {
     if (error instanceof ReportPublishError) {
-        if (error.code === "source-invalid" || error.code === "job-failed")
+        if (error.code === "source-invalid" || error.code === "job-failed" || error.code === "revision-conflict")
             return error.message.slice(0, 240);
         if (error.code === "already-running")
             return "already running";
@@ -264,9 +264,10 @@ export async function adoptReport(report, deps) {
 export async function publishReport(report, directory, draft, deps) {
     const startedAt = deps.now();
     let locked = false;
+    let current = report;
     try {
         try {
-            await deps.patch(report, { lastRun: { at: startedAt, status: "running" } });
+            current = await deps.patch(current, { lastRun: { at: startedAt, status: "running" } });
             locked = true;
         }
         catch (error) {
@@ -276,9 +277,9 @@ export async function publishReport(report, directory, draft, deps) {
         }
         const source = loadReportSource(directory);
         const deployment = await deps.deploy({
-            slug: reportDeploySlug(report, draft),
+            slug: reportDeploySlug(current, draft),
             files: source.files,
-            access: defaultAccessPolicy(report),
+            access: defaultAccessPolicy(current),
         });
         const completedAt = deps.now();
         const patch = {
@@ -295,13 +296,13 @@ export async function publishReport(report, directory, draft, deps) {
             patch.url = deployment.url;
             patch.deployAppId = deployment.appId;
         }
-        return await deps.patch(report, patch);
+        return await deps.patch(current, patch);
     }
     catch (error) {
         if (locked) {
             const reason = plainFailureReason(error);
             try {
-                await deps.patch(report, {
+                await deps.patch(current, {
                     lastRun: { at: deps.now(), status: "failed", reason },
                 });
             }
@@ -312,8 +313,8 @@ export async function publishReport(report, directory, draft, deps) {
             const notice = ownerFailureNotice({
                 code: error instanceof ReportPublishError ? error.code : undefined,
                 reason,
-                reportUrl: report.url,
-                ownerPersonUid: report.createdBy,
+                reportUrl: current.url,
+                ownerPersonUid: current.createdBy,
             });
             if (notice && deps.notifyOwner) {
                 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.142.0",
+  "version": "5.144.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {