@indigoai-us/hq-cli 5.153.0 → 5.155.0

package/dist/lib/lanes/types.d.ts

@@ -166,7 +166,7 @@ export declare const TERMINAL_LANE_STATES: readonly ["done", "failed", "interrup
 export type TerminalLaneState = (typeof TERMINAL_LANE_STATES)[number];
 export declare const LANE_PROVIDERS: readonly ["claude", "codex", "grok"];
 export type LaneProvider = (typeof LANE_PROVIDERS)[number];
-export declare const QUEUED_REASONS: readonly ["cap", "provider_cap", "account_cap", "profile_cap", "queue_position", "throttle", "provider_binary_missing"];
+export declare const QUEUED_REASONS: readonly ["cap", "provider_cap", "account_cap", "profile_cap", "queue_position", "throttle", "provider_binary_missing", "account_retry"];
 export type QueuedReason = (typeof QUEUED_REASONS)[number];
 export declare function isQueuedReason(value: unknown): value is QueuedReason;
 export declare const HOST_KINDS: readonly ["local", "outpost"];
@@ -436,11 +436,11 @@ export interface AccountHistoryEntry {
     from: string | null;
     to: string;
     at: string;
-    reason: "operator_move";
+    reason: "first_assignment" | "model_change" | "usage_limit" | "account_unavailable" | "operator_move";
 }
 export interface PendingResume {
     session_id: string;
-    trigger: "message" | "resume";
+    trigger: "answered_questions" | "message" | "resume";
     resumed_from?: "interrupted" | "done" | "blocked";
     text?: string;
     message_id?: string;
@@ -461,6 +461,8 @@ export interface LaneResumeRecord {
      */
     resumed_from?: "interrupted" | "done" | "blocked";
     text?: string;
+    /** False when the continued turn explicitly skipped compaction. */
+    compact?: boolean;
 }
 export interface LaneRunUsage {
     cache_read_input_tokens: number | null;
@@ -575,6 +577,8 @@ export interface ProviderConfig {
      * Account pick is least-loaded among enabled, logged-in accounts.
      */
     default_account?: string;
+    /** Ordered account preferences used only for a lane's first assignment. */
+    preferred_accounts?: string[];
     /** Default model for this provider when the account does not set one. */
     model?: string;
     /** Default effort for this provider when the account does not set one. */

package/dist/lib/lanes/types.js

@@ -103,6 +103,7 @@ export const QUEUED_REASONS = [
     "queue_position",
     "throttle",
     "provider_binary_missing",
+    "account_retry",
 ];
 export function isQueuedReason(value) {
     return typeof value === "string" && QUEUED_REASONS.includes(value);
@@ -215,11 +216,11 @@ export const LANE_FIELD_WRITERS = {
     schema_version: ["creator"], lane_id: ["creator"], company: ["creator"],
     project_id: ["command"], story_id: ["command"], stories: ["creator", "command", "watcher", "reconcile", "spawn"], thread_id: ["creator", "command", "spawn"], mesh_company: ["creator"],
     depth: ["command"], senior: ["command"], senior_history: ["command"],
-    state: ["creator", "command", "watcher", "reconcile", "spawn"], queued_reason: ["creator", "command", "spawn", "reconcile"], queued_at: ["creator", "command", "spawn"], admission_reserved_at: ["creator", "command", "reconcile", "spawn"],
+    state: ["creator", "command", "watcher", "reconcile", "spawn"], queued_reason: ["creator", "command", "spawn", "watcher", "reconcile"], queued_at: ["creator", "command", "spawn", "watcher", "reconcile"], admission_reserved_at: ["creator", "command", "reconcile", "spawn", "watcher"],
     pickup_validation_pending: ["creator", "command", "spawn", "reconcile"],
     pickup_validation_pending_since: ["creator", "command", "spawn", "reconcile"],
     priority: ["command"], worker: ["creator"], worker_path: ["creator"], worker_pack: ["creator"], worker_profile: ["creator"], worker_profile_hash: ["creator", "spawn"], worker_profile_ignored: ["creator", "spawn"],
-    provider: ["creator"], account: ["creator", "spawn", "command", "reconcile"], admission_accounts: ["creator", "command"], account_history: ["command"], pending_resume: ["command", "spawn"], host: ["creator"], origin_host: ["creator"], origin_host_source: ["creator"],
+    provider: ["creator"], account: ["creator", "spawn", "command", "watcher", "reconcile"], admission_accounts: ["creator", "command"], account_history: ["command", "spawn", "watcher", "reconcile"], pending_resume: ["command", "spawn", "watcher", "reconcile"], host: ["creator"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], attribution_history: ["command"],
     last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn", "command"], model_source: ["creator", "spawn", "command"], effort: ["creator", "spawn"], effort_source: ["creator", "spawn"], fast_mode: ["spawn"],
     last_message_at: ["command"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],

package/dist/lib/lanes/watcher.d.ts

@@ -34,8 +34,9 @@
 import { type LaneEnvelope, type LaneRecord, type LaneState } from "./types.js";
 import { type QuotaSignal } from "./quota.js";
 import { type ProviderRejection } from "./provider-rejection.js";
+import type { AdmissionHost } from "./admission.js";
 import { type LaneMesh } from "./mesh-events.js";
-import { type EnvelopeRepairSpawnInput } from "./spawn.js";
+import { type EnvelopeRepairSpawnInput, type SpawnLaneDeps } from "./spawn.js";
 /** Spec §5.7: no signal for 20 minutes while the process is still alive. */
 export declare const SILENCE_MS: number;
 export declare const WATCHER_POLL_MS = 5000;
@@ -206,6 +207,12 @@ export interface WatcherLoopDeps {
     meshRequestTimeoutMs?: number;
     /** Spec §4 repair spawn. Default: `spawnEnvelopeRepair`. */
     spawnRepair?: (hqRoot: string, lane: LaneRecord, input: EnvelopeRepairSpawnInput) => number;
+    /** Rebind and respawn after a provider quota or authentication refusal. */
+    retryAccount?: (hqRoot: string, lane: LaneRecord, reason: "usage_limit" | "account_unavailable") => LaneRecord | Promise<LaneRecord>;
+    /** Shared process/Outpost identity used by command admission and watcher retries. */
+    resolveAdmissionHost?: () => AdmissionHost;
+    /** Spawn seams for account retry; host scope is supplied by the resolver above. */
+    retrySpawnDeps?: Omit<SpawnLaneDeps, "admissionHost">;
 }
 /**
  * Wrap one mesh call. A failed emit is logged as `mesh_event_failed` with

package/dist/lib/lanes/watcher.js

@@ -40,12 +40,13 @@ import { laneStories, storyStatusForEnvelope } from "./stories.js";
 import { readLane, retryUpdateLane } from "./store.js";
 import { readWorkerRunResult } from "./delivery.js";
 import { applyDefaultQuotaHold, quotaSignalFromFields, readQuotaSignal, recordAccountQuota, } from "./quota.js";
-import { PROVIDER_REJECTED_REASON, QUOTA_STATUS, providerRejectionDetails, readProviderRejection, } from "./provider-rejection.js";
+import { PROVIDER_REJECTED_REASON, QUOTA_STATUS, isProviderLoginFailure, providerRejectionDetails, readProviderRejection, } from "./provider-rejection.js";
 import { readToolActivity, toolActivityPath } from "./dropbox.js";
 import { loadLanesConfig, providerProgressEventMinIntervalMs, providerQuotaDefaultHoldMs } from "./config.js";
+import { resolveAdmissionHost as resolveProcessAdmissionHost } from "./admission-host.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneProgressEvent, progressEventDue, } from "./mesh-events.js";
 import { envelopeQuestionId } from "./questions.js";
-import { laneRunDir, missingPidProbe, probePidRecord, readPidRecord, readProcStarttime, readSpawnManifest, envelopeRepairMode, spawnEnvelopeRepair, } from "./spawn.js";
+import { laneRunDir, missingPidProbe, probePidRecord, readPidRecord, readProcStarttime, readSpawnManifest, envelopeRepairMode, spawnEnvelopeRepair, retryLaneOnAlternateAccount, } from "./spawn.js";
 /** Spec §5.7: no signal for 20 minutes while the process is still alive. */
 export const SILENCE_MS = 20 * 60 * 1000;
 export const WATCHER_POLL_MS = 5_000;
@@ -89,7 +90,12 @@ export function classifyLaneExit(input) {
         throw new LanesError("unknown_envelope_decision", `Unknown envelope decision ${JSON.stringify(input.envelope.decision)}. Accepted: done, ask, blocked`, { accepted: ["done", "ask", "blocked"], value: input.envelope.decision });
     }
     if (input.providerRejection) {
-        return { state: "failed", reason: PROVIDER_REJECTED_REASON };
+        return {
+            state: "failed",
+            reason: isProviderLoginFailure(input.providerRejection)
+                ? "account_not_logged_in"
+                : PROVIDER_REJECTED_REASON,
+        };
     }
     if (input.invalidEnvelope) {
         return { state: "failed", reason: ENVELOPE_INVALID_REASON };
@@ -613,6 +619,10 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
     }
     const progressIntervalMs = deps.progressEventMinIntervalMs ?? readProgressIntervalMs(hqRoot, readLaneSoft(hqRoot, laneId));
     const spawnRepair = deps.spawnRepair ?? spawnEnvelopeRepair;
+    const retryAccount = deps.retryAccount ?? ((root, lane, reason) => retryLaneOnAlternateAccount(root, lane, reason, "watcher", {
+        ...deps.retrySpawnDeps,
+        admissionHost: (deps.resolveAdmissionHost ?? resolveProcessAdmissionHost)(),
+    }));
     let lastSignalMs = now();
     let lastSeenMtime = 0;
     let lastAlive = null;
@@ -836,6 +846,32 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
                         process.stderr.write(`hq lanes watcher: quota record failed for ${laneId}: ${err instanceof Error ? err.message : String(err)}\n`);
                     }
                 }
+                const accountRetryReason = quota
+                    ? "usage_limit"
+                    : isProviderLoginFailure(providerRejection)
+                        ? "account_unavailable"
+                        : null;
+                if (accountRetryReason && quotaLane?.account) {
+                    try {
+                        const retry = await retryAccount(hqRoot, quotaLane, accountRetryReason);
+                        logDecision({
+                            event: "account_failover",
+                            at: tick.emit.at,
+                            from: quotaLane.account,
+                            to: retry.account ?? null,
+                            reason: accountRetryReason,
+                            state: retry.state,
+                        });
+                        return;
+                    }
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        process.stderr.write(`hq lanes watcher: account failover failed for ${laneId}: ${message}\n`);
+                        logDecision({ event: "account_failover_failed", at: tick.emit.at, reason: accountRetryReason, error: message });
+                        if (readLane(hqRoot, laneId).state !== "running")
+                            return;
+                    }
+                }
                 const terminalWrite = applyTerminalToLaneWithResult(hqRoot, laneId, classification, {
                     envelope,
                     envelopeRef: latest?.ref,

package/dist/utils/vault-api.d.ts

@@ -61,7 +61,13 @@ export declare function vaultApiFetchPublic(opts: {
 }): Promise<Response>;
 export declare function looksLikeCompanyUid(ref: string): boolean;
 export declare function looksLikePersonVaultUid(ref: string): boolean;
-export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
+export declare function getCompanyUid(token: string, companySlug: string | undefined, 
+/**
+ * Control-plane origin for the lookups. Defaults to DEFAULT_VAULT_API_URL;
+ * pass it when the caller is bound to another API (an enrolled agent's
+ * `apiBaseUrl`) so its token never goes to the default host.
+ */
+baseUrl?: string): Promise<string>;
 export declare function resolveCallerPersonUid(token: string, baseUrl?: string): Promise<string>;
 export declare function getEntityUid(token: string, opts: {
     personal?: boolean;

package/dist/utils/vault-api.js

@@ -314,10 +314,11 @@ function raiseIfUnauthorized(res) {
     if (res.status === 401)
         throw new AuthError();
 }
-async function resolveCompanyByUid(token, uid) {
+async function resolveCompanyByUid(token, uid, baseUrl) {
     const res = await vaultApiFetch({
         token,
         path: `/entity/${encodeURIComponent(uid)}`,
+        baseUrl,
         signal: AbortSignal.timeout(identityLookupTimeoutMs()),
     });
     if (!res.ok) {
@@ -370,11 +371,12 @@ function isTransientSlugLookupStatus(status) {
  * stranger's same-slug company is correctly invisible to resolution. This is
  * the same primitive hq-cloud's `context.ts` already resolves slugs through.
  */
-async function resolveSlugInCallerNamespace(token, slug) {
+async function resolveSlugInCallerNamespace(token, slug, baseUrl) {
     const attempt = async () => {
         const res = await vaultApiFetch({
             token,
             path: "/entity/check-slug/me",
+            baseUrl,
             query: { type: "company", slug },
             signal: AbortSignal.timeout(identityLookupTimeoutMs()),
         });
@@ -411,10 +413,11 @@ async function resolveSlugInCallerNamespace(token, slug) {
         return first;
     return run();
 }
-async function fetchGlobalCompanyBySlug(token, ref) {
+async function fetchGlobalCompanyBySlug(token, ref, baseUrl) {
     const attempt = () => vaultApiFetch({
         token,
         path: `/entity/by-slug/company/${encodeURIComponent(ref)}`,
+        baseUrl,
         signal: AbortSignal.timeout(identityLookupTimeoutMs()),
     });
     try {
@@ -429,10 +432,10 @@ async function fetchGlobalCompanyBySlug(token, ref) {
     }
     return attempt();
 }
-async function resolveCompanyUid(token, ref) {
+async function resolveCompanyUid(token, ref, baseUrl) {
     // Silent escape hatch: a `cmp_` ref is a uid, not a slug — resolve directly.
     if (looksLikeCompanyUid(ref)) {
-        return resolveCompanyByUid(token, ref);
+        return resolveCompanyByUid(token, ref, baseUrl);
     }
     // A `prs_` ref names a person's vault (DM attachments). There is no slug to
     // resolve and no company lookup that could succeed; pass it through as the
@@ -453,7 +456,7 @@ async function resolveCompanyUid(token, ref) {
     // hq-cli defect still throws, and the 401 AuthError that
     // `raiseIfUnauthorized` throws still short-circuits before any fallback
     // (Sentry HQ-CLI-1P / issue 7716090679).
-    const mine = await resolveSlugInCallerNamespace(token, ref);
+    const mine = await resolveSlugInCallerNamespace(token, ref, baseUrl);
     if (mine.kind === "hit") {
         return mine.uid;
     }
@@ -462,7 +465,7 @@ async function resolveCompanyUid(token, ref) {
     // cross-company / admin resolutions that intentionally target a company the
     // caller isn't a member of (e.g. a group-grant target). A single global
     // match resolves cleanly.
-    const res = await fetchGlobalCompanyBySlug(token, ref);
+    const res = await fetchGlobalCompanyBySlug(token, ref, baseUrl);
     if (!res.ok) {
         raiseIfUnauthorized(res);
         const body = (await res.json().catch(() => ({})));
@@ -494,10 +497,11 @@ async function resolveCompanyUid(token, ref) {
     const data = (await res.json());
     return data.entity.uid;
 }
-async function resolveCompanyFromMemberships(token) {
+async function resolveCompanyFromMemberships(token, baseUrl) {
     const res = await vaultApiFetch({
         token,
         path: '/membership/me',
+        baseUrl,
         signal: AbortSignal.timeout(identityLookupTimeoutMs()),
     });
     if (!res.ok) {
@@ -519,7 +523,13 @@ async function resolveCompanyFromMemberships(token) {
         `pick one:\n` +
         picks.join('\n'));
 }
-export async function getCompanyUid(token, companySlug) {
+export async function getCompanyUid(token, companySlug, 
+/**
+ * Control-plane origin for the lookups. Defaults to DEFAULT_VAULT_API_URL;
+ * pass it when the caller is bound to another API (an enrolled agent's
+ * `apiBaseUrl`) so its token never goes to the default host.
+ */
+baseUrl) {
     // Vault API keys are company-bound. Entity slug resolution has no keyed
     // route, so under hqk_ we accept an explicit cmp_ uid (or HQ_COMPANY_UID)
     // and otherwise fall through to keyed GET /v1/keys/membership/me.
@@ -532,12 +542,12 @@ export async function getCompanyUid(token, companySlug) {
             }
             return ref;
         }
-        return resolveCompanyFromMemberships(token);
+        return resolveCompanyFromMemberships(token, baseUrl);
     }
     if (companySlug) {
-        return resolveCompanyUid(token, companySlug);
+        return resolveCompanyUid(token, companySlug, baseUrl);
     }
-    return resolveCompanyFromMemberships(token);
+    return resolveCompanyFromMemberships(token, baseUrl);
 }
 // Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
 // createdAt, tie-break by uid ascending. Returns the `prs_*` UID.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.153.0",
+  "version": "5.155.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {