@indigoai-us/hq-cli 5.143.0 → 5.144.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.144.0] — 2026-09-23
+
+- Worker-profile models now use the same provider catalog validation as
+  `--model` during creation and before every later provider launch. The error
+  names the profile when its model is unsupported.
+- Worker resolution continues to use the existing personal, core, installed
+  package, and company worker sources. hq-cli does not ship starter profiles.
+
 ## [5.143.0] — 2026-09-23
 
 ### Fixed

package/dist/commands/lanes.js

@@ -18,7 +18,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
 import { providerCompactAfterMs } from "../lib/lanes/config.js";
@@ -26,7 +26,7 @@ import { parseCliEffort, resolveLaneEffort } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
 import { accountQuotaView, loadQuotaState, quotaBlockFor } from "../lib/lanes/quota.js";
 import { SESSION_MOVE_REASON, copySessionFiles, planSessionCopy } from "../lib/lanes/move-account.js";
-import { defaultProbe, validateLaneModel, } from "../lib/lanes/models.js";
+import { defaultProbe, validateProfileLaneModel, validateLaneModel, } from "../lib/lanes/models.js";
 import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ONLY_RULE, STANDING_AUTHORIZATION, spawnLaneWorker, stopLaneProcesses, } from "../lib/lanes/spawn.js";
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
@@ -1530,13 +1530,16 @@ async function runCreate(ctx, opts) {
         env: ctx.env,
     };
     const validatedAccounts = new Set();
-    if (cliModel !== undefined && !outpostId) {
+    const modelToValidate = cliModel ?? profileModel;
+    const profileModelToValidate = cliModel === undefined && profileModel !== undefined ? profile : undefined;
+    if (modelToValidate !== undefined && !outpostId) {
         const accounts = config.providers[provider].accounts;
         const candidate = pinnedAccount ??
             resolveAccount(provider, undefined, config, {
                 hqRoot,
                 existsSync: ctx.existsSync,
                 cliModel,
+                model: modelToValidate,
                 ...(profileAccounts !== undefined
                     ? { allowedAccounts: profileAccounts }
                     : {}),
@@ -1562,7 +1565,12 @@ async function runCreate(ctx, opts) {
                 continue;
             checkedAccounts.push(id);
             try {
-                validateLaneModel(provider, cliModel, home, modelDeps);
+                if (profileModelToValidate !== undefined) {
+                    validateProfileLaneModel(provider, modelToValidate, home, profileModelToValidate.id, modelDeps);
+                }
+                else {
+                    validateLaneModel(provider, modelToValidate, home, modelDeps);
+                }
             }
             catch (err) {
                 if (!(isLanesError(err) && err.error === "model_unsupported"))
@@ -1570,7 +1578,7 @@ async function runCreate(ctx, opts) {
                 unsupported.push({ account: id, error: err });
                 continue;
             }
-            const block = quotaBlockFor(quota, provider, id, cliModel, now);
+            const block = quotaBlockFor(quota, provider, id, modelToValidate, now);
             if (block.blocked) {
                 quotaBlocked.push({ account: id, block });
                 continue;
@@ -1579,7 +1587,7 @@ async function runCreate(ctx, opts) {
         }
         if (validatedAccounts.size === 0 && quotaBlocked.length > 0) {
             const blocked = quotaBlocked[0];
-            const model = blocked.block.model ?? cliModel;
+            const model = blocked.block.model ?? modelToValidate;
             const checkedSuffix = ` Checked accounts: ${checkedAccounts.join(", ")}`;
             if (blocked.block.reason === "account_model_unavailable") {
                 throw new AccountResolutionError("account_model_unavailable", `Account ${JSON.stringify(blocked.account)} cannot run model ${model ?? "(no model)"}: ${blocked.block.marker ?? "needs credits"}${checkedSuffix}`, {
@@ -1623,6 +1631,7 @@ async function runCreate(ctx, opts) {
                 hqRoot,
                 existsSync: ctx.existsSync,
                 cliModel,
+                model: cliModel ?? profileModel,
                 ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
             }).id;
         }
@@ -1748,6 +1757,11 @@ async function runCreate(ctx, opts) {
     if (admission.action === "start") {
         started = spawnLaneWorker(hqRoot, lane, {
             env: ctx.env,
+            modelDeps: {
+                readFileSync: ctx.readFileSync,
+                probe: ctx.probeProvider,
+                env: ctx.env,
+            },
             existsSync: ctx.existsSync,
             spawnProcess: ctx.spawnProcess,
             proveDetached: ctx.proveDetached,
@@ -2049,6 +2063,11 @@ async function runPickup(ctx, opts) {
         try {
             started = spawnLaneWorker(hqRoot, afterAccount, {
                 env: ctx.env,
+                modelDeps: {
+                    readFileSync: ctx.readFileSync,
+                    probe: ctx.probeProvider,
+                    env: ctx.env,
+                },
                 existsSync: ctx.existsSync,
                 spawnProcess: ctx.spawnProcess,
                 proveDetached: ctx.proveDetached,
@@ -2219,6 +2238,20 @@ async function prepareAccountMove(ctx, lane, input) {
     if (isLoggedOut(accountStatus(lane.provider, target, config, { existsSync: ctx.existsSync }))) {
         throw new LanesError("account_not_logged_in", `Account ${target} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: target, lane_id: laneId });
     }
+    const profile = lane.worker_profile !== undefined
+        ? loadWorkerProfile(hqRoot, lane.worker_profile)
+        : undefined;
+    const profileDefaultsApply = profile !== undefined && profile.meta.provider === lane.provider;
+    const pinnedModel = lane.model_source === undefined || lane.model_source === "cli"
+        ? lane.model
+        : undefined;
+    if (input.cliModel === undefined && profileDefaultsApply && pinnedModel === undefined) {
+        validateProfileLaneModel(lane.provider, profile.meta.model, targetCfg.home, profile.id, {
+            readFileSync: ctx.readFileSync,
+            probe: ctx.probeProvider,
+            env: ctx.env,
+        });
+    }
     // The model the moved run would use, resolved the way spawn resolves it:
     // the operator's --model, else the lane's own, else the target account's
     // default, else the provider's. The quota and validation checks use this
@@ -2383,6 +2416,11 @@ async function runMessage(ctx, laneId, opts) {
         archiveResumeMessage(hqRoot, laneId, dropboxMessage);
         resumed = spawnLaneWorker(hqRoot, lane, {
             env: ctx.env,
+            modelDeps: {
+                readFileSync: ctx.readFileSync,
+                probe: ctx.probeProvider,
+                env: ctx.env,
+            },
             existsSync: ctx.existsSync,
             spawnProcess: ctx.spawnProcess,
             proveDetached: ctx.proveDetached,
@@ -2529,6 +2567,11 @@ async function runResume(ctx, laneId, opts) {
         ? lane
         : spawnLaneWorker(hqRoot, lane, {
             env: ctx.env,
+            modelDeps: {
+                readFileSync: ctx.readFileSync,
+                probe: ctx.probeProvider,
+                env: ctx.env,
+            },
             existsSync: ctx.existsSync,
             spawnProcess: ctx.spawnProcess,
             proveDetached: ctx.proveDetached,

package/dist/lib/lanes/models.d.ts

@@ -75,4 +75,10 @@ export declare function modelIsKnown(known: KnownModels, model: string): boolean
  * null when no source was readable and the value passed unvalidated.
  */
 export declare function validateLaneModel(provider: LaneProvider, model: string, home: string, deps?: KnownModelsDeps): string | null;
+/**
+ * Validate a model supplied by a reusable worker profile. Keep the provider
+ * catalog and refusal semantics identical to `--model`, while making the
+ * profile origin visible to callers and JSON error consumers.
+ */
+export declare function validateProfileLaneModel(provider: LaneProvider, model: string, home: string, profileId: string, deps?: KnownModelsDeps): string | null;
 //# sourceMappingURL=models.d.ts.map

package/dist/lib/lanes/models.js

@@ -202,4 +202,28 @@ export function validateLaneModel(provider, model, home, deps = {}) {
     // `message` is in details too: LanesError.toJSON prints details only.
     throw new LanesError("model_unsupported", message, { provider, model, accepted, source: known.source, message });
 }
+/**
+ * Validate a model supplied by a reusable worker profile. Keep the provider
+ * catalog and refusal semantics identical to `--model`, while making the
+ * profile origin visible to callers and JSON error consumers.
+ */
+export function validateProfileLaneModel(provider, model, home, profileId, deps = {}) {
+    try {
+        return validateLaneModel(provider, model, home, deps);
+    }
+    catch (err) {
+        if (!(err instanceof LanesError) || err.error !== "model_unsupported") {
+            throw err;
+        }
+        const message = `Worker profile ${JSON.stringify(profileId)} supplied model ${JSON.stringify(model)}; ` +
+            `the model came from the profile. ${err.message}`;
+        throw new LanesError("model_unsupported", message, {
+            ...err.details,
+            profile_id: profileId,
+            worker_profile: profileId,
+            model_source: "profile",
+            message,
+        });
+    }
+}
 //# sourceMappingURL=models.js.map

package/dist/lib/lanes/reconcile.js

@@ -13,7 +13,7 @@ import { MAX_LANE_DEPTH } from "./constants.js";
 import { LanesError, isLaneVersionConflict } from "./errors.js";
 import { loadWorkerProfile } from "./profile.js";
 import { classifySessionLiveness, defaultLivenessDeps, loadLivenessIndex, readDaemonPresenceConnected, } from "./liveness.js";
-import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, isPidRecordAlive, laneRunDir, readPidRecord, readSpawnManifest, spawnEnvelopeRepair, spawnLaneWorker, } from "./spawn.js";
+import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, isPidRecordAlive, laneRunDir, readPidRecord, readSpawnManifest, markSpawnFailure, spawnEnvelopeRepair, spawnLaneWorker, } from "./spawn.js";
 import { appendCappedHistory, lanesStoreRoot, parseLaneRecord, parseQuestionRecord, readLane, readQuestion, updateLane, updateQuestion, } from "./store.js";
 import { applyThrottleDecision, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, isCpuCheckEnabled, readAvailableMemMb, readThrottleState, resolveCpuBusyFraction, throttleStatePath, writeThrottleState, } from "./throttle.js";
 import { applyDefaultQuotaHold, readQuotaSignal, recordAccountQuota } from "./quota.js";
@@ -60,6 +60,19 @@ function markDirty(summary, skip) {
     summary.ok = false;
     logSkip(skip);
 }
+function terminalizeModelUnsupported(hqRoot, lane, err) {
+    if (!(err instanceof LanesError) || err.error !== "model_unsupported")
+        return;
+    try {
+        markSpawnFailure(hqRoot, lane.lane_id, err.error, {
+            ...err.details,
+            message: err.message,
+        });
+    }
+    catch (writeErr) {
+        process.stderr.write(`hq lanes reconcile: failed to terminalize ${lane.lane_id} after model validation: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}\n`);
+    }
+}
 function markError(summary, err) {
     const message = err instanceof Error ? err.message : String(err);
     const code = err instanceof LanesError ? err.error : undefined;
@@ -843,7 +856,9 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     !quota &&
                     rawLatest &&
                     rawLatest.envelope === null) {
-                    const repair = decideEnvelopeRepair(hqRoot, lane.lane_id, rawLatest, nowMs, deps.spawnRepair ?? spawnEnvelopeRepair, () => undefined);
+                    const spawnRepair = deps.spawnRepair ??
+                        ((root, repairLane, input) => spawnEnvelopeRepair(root, repairLane, input, deps.spawnLaneDeps));
+                    const repair = decideEnvelopeRepair(hqRoot, lane.lane_id, rawLatest, nowMs, spawnRepair, () => undefined);
                     if (repair.action === "spawned") {
                         armLaneWatcher(hqRoot, lane.lane_id, deps.spawnLaneDeps);
                         summary.heartbeats.push(`${lane.lane_id}:envelope-repair`);
@@ -1067,6 +1082,7 @@ async function admitQueued(hqRoot, lanes, summary, deps, now) {
                 break;
         }
         catch (err) {
+            terminalizeModelUnsupported(hqRoot, lane, err);
             markDirty(summary, {
                 kind: "lane",
                 id: lane.lane_id,
@@ -1110,6 +1126,7 @@ async function resumeAwaiting(hqRoot, lanes, questions, summary, deps) {
             });
         }
         catch (err) {
+            terminalizeModelUnsupported(hqRoot, lane, err);
             markDirty(summary, {
                 kind: "lane",
                 id: lane.lane_id,

package/dist/lib/lanes/spawn.d.ts

@@ -9,13 +9,14 @@
  */
 import { PROVIDER_HOME_ENV } from "./accounts.js";
 import { type RunCompactionFn } from "./compaction.js";
+import { type KnownModelsDeps } from "./models.js";
 import { type LaunchTrigger } from "./delivery.js";
 import { type MachineIdentity } from "./machine-identity.js";
 import { type LaneCompanyRef, type LaneProvider, type LaneRecord } from "./types.js";
 export declare const LANES_RUNS_REL: string;
 /** Written by reconcile before a resume spawn; the worker prompt names this path. */
 export declare const ANSWERED_QUESTIONS_FILE = "answered-questions.json";
-export declare const SPAWN_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "no_enabled_account", "spawn_failed", "not_detached", "watcher_not_armed"];
+export declare const SPAWN_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "no_enabled_account", "spawn_failed", "not_detached", "watcher_not_armed", "model_unsupported"];
 export type SpawnTerminalReason = (typeof SPAWN_TERMINAL_REASONS)[number];
 declare const PROVIDER_COMMAND: Record<LaneProvider, string>;
 export declare function providerCommandOnPath(command: string, pathEnv: string | undefined): boolean;
@@ -62,6 +63,8 @@ export type ProveDetachedFn = (pid: number) => DetachProof;
 export type KillProcessFn = (pid: number, signal?: NodeJS.Signals) => void;
 export interface SpawnLaneDeps {
     env?: NodeJS.ProcessEnv;
+    /** Provider model catalog dependencies, shared with create in tests. */
+    modelDeps?: KnownModelsDeps;
     existsSync?: (p: string) => boolean;
     spawnProcess?: SpawnProcessFn;
     proveDetached?: ProveDetachedFn;

package/dist/lib/lanes/spawn.js

@@ -16,6 +16,7 @@ import { COMPACTION_PROMPT, compactionAfterUsage, compactionDue, compactLaneSess
 import { installDrainHook } from "./hooks-install.js";
 import { loadLanesConfig, providerAutoCompactTokens, providerCompactAfterMs, } from "./config.js";
 import { appendEffortFlag, resolveLaneEffort } from "./effort.js";
+import { validateProfileLaneModel, } from "./models.js";
 import { claimableStatesFor, planLaneLaunch, providerSupportsSessionResume, } from "./delivery.js";
 import { AccountResolutionError, LanesError } from "./errors.js";
 import { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, workerProfilePrompt, } from "./profile.js";
@@ -33,6 +34,7 @@ export const SPAWN_TERMINAL_REASONS = [
     "spawn_failed",
     "not_detached",
     "watcher_not_armed",
+    "model_unsupported",
 ];
 const PROVIDER_COMMAND = {
     claude: "claude",
@@ -1065,6 +1067,10 @@ function inferTrigger(lane) {
  */
 export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
     const env = deps.env ?? process.env;
+    const modelDeps = {
+        ...deps.modelDeps,
+        env: deps.modelDeps?.env ?? env,
+    };
     const existsSync = deps.existsSync ?? ((p) => fs.existsSync(p));
     const spawnProcess = deps.spawnProcess ?? defaultSpawnProcess;
     const proveDetached = deps.proveDetached ?? defaultProveDetached;
@@ -1150,6 +1156,9 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
             : existing;
         throw new LanesError("account_not_logged_in", `Account ${resolved.id} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: resolved.id, lane_id: lane.lane_id, lane: failed });
     }
+    if (profileDefaultsApply && profileModel !== undefined && pinnedModel === undefined) {
+        validateProfileLaneModel(existing.provider, profileModel, resolved.home, profile.id, modelDeps);
+    }
     if (lane.account !== resolved.id) {
         retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => {
             if (current.account === resolved.id)
@@ -1532,6 +1541,12 @@ export function spawnEnvelopeRepair(hqRoot, lane, input, deps = {}) {
         existsSync,
         model: pinnedModel ?? profileModel,
     });
+    if (profileDefaultsApply && profileModel !== undefined && pinnedModel === undefined) {
+        validateProfileLaneModel(lane.provider, profileModel, resolved.home, profile.id, {
+            ...deps.modelDeps,
+            env: deps.modelDeps?.env ?? env,
+        });
+    }
     const autoCompactTokens = lane.provider === "claude"
         ? providerAutoCompactTokens(config.providers.claude)
         : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.143.0",
+  "version": "5.144.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {