@indigoai-us/hq-cli 5.154.0 → 5.155.0

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [5.155.0] — 2026-09-24
+
+### Fixed
+
+- Lane respawns keep their recorded account to preserve provider sessions and
+  prompt caches. Automatic moves now record why they happened and are limited
+  to model changes, usage limits, and unavailable or logged-out accounts.
+- Account retries share the provider admission lock and the host-scoped provider,
+  account, and profile checks used by normal admission. Active reservations and
+  earlier eligible queue entries keep their place; blocked retries remain queued
+  for normal admission. Retries skip accounts already rejected for login and
+  retain message, resume, and answer context when queued.
+- Watcher retries resolve the current process hostname and Outpost identity, so
+  local-kind and Outpost-kind lanes on one Outpost share admission caps.
+- Account enable and registration now require a positive login check. Provider
+  startup messages for logged-out accounts trigger failover to another eligible
+  account or a named `account_not_logged_in` failure.
+
+### Added
+
+- Provider config can list accounts in preference order for a lane's first
+  assignment. Disabled, logged-out, usage-limited, and capped accounts are
+  skipped. If no preferred account is eligible, hq-cli chooses the least-loaded
+  eligible account. Running and resumed lanes keep their recorded account.
+
 ## [5.154.0] — 2026-09-24
 
 ### Fixed

package/dist/commands/lanes.d.ts

@@ -6,6 +6,9 @@
  * `watch` and the monitor reminder are the line-oriented text surfaces.
  */
 import { Command } from "commander";
+import type { OutpostIdentity } from "../lib/lanes/admission-host.js";
+export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
+export type { OutpostIdentity } from "../lib/lanes/admission-host.js";
 import { type OutpostDispatchResult } from "../lib/lanes/outpost-dispatch.js";
 import { emitLaneDecisionEvents, type LaneMesh } from "../lib/lanes/mesh-events.js";
 import { MAX_LANE_DEPTH, type LaneCompanyRef, type LaneRecord, type QuestionRecord, type ResolvedLaneWorker, type SeniorRef, type LivenessDeps, type MachineIdentity, type MonitorEvidenceReader, type RunCommand, type ThrottleDeps } from "../lib/lanes/index.js";
@@ -16,17 +19,7 @@ import { spawnLaneWorker, type KillProcessFn, type ProveDetachedFn, type SpawnPr
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
 export { MAX_LANE_DEPTH };
-export declare const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
-export declare const OUTPOST_DIR = "/etc/outpost";
 export declare const LANES_RUNS_REL: string;
-export type OutpostIdentity = {
-    kind: "id";
-    id: string;
-} | {
-    kind: "unknown";
-} | {
-    kind: "not_outpost";
-};
 export interface SpawnLoginResult {
     status: number;
 }
@@ -79,7 +72,6 @@ export interface LanesCommandDeps {
     locateTranscript?: (home: string, sessionId: string) => string | null;
     monitorEvidence?: MonitorEvidenceReader;
 }
-export declare function readOutpostIdentity(existsSync?: (p: string) => boolean, readFileSync?: (p: string) => string): OutpostIdentity;
 export declare function parseSeniorRef(raw: string): SeniorRef;
 export declare function resolveAnswerChoice(choice: string, options: string[], freeform: boolean): string;
 /**

package/dist/commands/lanes.js

@@ -12,13 +12,15 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
+import { readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
+export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
 import { buildOutpostLaneCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
 import { parseUserYaml } from "../utils/user-yaml-error.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, withLaneAdmissionLock, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, withLaneAdmissionLock, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
@@ -33,8 +35,6 @@ import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ON
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
 export { MAX_LANE_DEPTH };
-export const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
-export const OUTPOST_DIR = "/etc/outpost";
 export const LANES_RUNS_REL = path.join("workspace", "lanes-runs");
 const VENDOR_LOGIN = {
     claude: { command: "claude", args: ["auth", "login"] },
@@ -133,27 +133,6 @@ async function defaultFetchText(url) {
     }
     return res.text();
 }
-export function readOutpostIdentity(existsSync = (p) => fs.existsSync(p), readFileSync = (p) => fs.readFileSync(p, "utf8")) {
-    const hasMarker = existsSync(OUTPOST_ID_PATH);
-    const hasDir = existsSync(OUTPOST_DIR);
-    if (hasMarker) {
-        let text;
-        try {
-            text = readFileSync(OUTPOST_ID_PATH);
-        }
-        catch (err) {
-            process.stderr.write(`hq lanes: failed to read ${OUTPOST_ID_PATH}: ${err instanceof Error ? err.message : String(err)}\n`);
-            throw err;
-        }
-        const id = text.trim();
-        if (!id)
-            return hasDir ? { kind: "unknown" } : { kind: "not_outpost" };
-        return { kind: "id", id };
-    }
-    if (hasDir)
-        return { kind: "unknown" };
-    return { kind: "not_outpost" };
-}
 function defaultSpawnLogin(opts) {
     return new Promise((resolve, reject) => {
         const child = spawn(opts.command, opts.args, {
@@ -263,11 +242,10 @@ function livenessDepsFromCtx(ctx) {
     };
 }
 function reconcileHostFromCtx(ctx) {
-    const identity = ctx.readOutpostIdentity();
-    return {
-        hostname: ctx.hostname(),
-        outpostId: identity.kind === "id" ? identity.id : null,
-    };
+    return resolveAdmissionHost({
+        hostname: ctx.hostname,
+        readOutpostIdentity: ctx.readOutpostIdentity,
+    });
 }
 export function parseSeniorRef(raw) {
     const trimmed = raw.trim();
@@ -1261,9 +1239,17 @@ export function applyOutpostAccountPickup(hqRoot, laneId, modelDeps = {}) {
     try {
         const resolved = resolveAccount(lane.provider, lane.account, config, {
             hqRoot,
+            accountDeps: {
+                probe: modelDeps.probe,
+                env: modelDeps.env,
+            },
+        });
+        const status = accountStatus(lane.provider, resolved.id, config, {
+            existsSync: (p) => fs.existsSync(p),
+            probe: modelDeps.probe,
+            env: modelDeps.env,
         });
-        const status = accountStatus(lane.provider, resolved.id, config);
-        if (isLoggedOut(status)) {
+        if (status.logged_in !== true) {
             return markPickupFailure(hqRoot, laneId, "account_not_logged_in", {
                 provider: lane.provider,
                 account: resolved.id,
@@ -1549,8 +1535,10 @@ async function runCreate(ctx, opts) {
             resolveAccount(provider, undefined, config, {
                 hqRoot,
                 existsSync: ctx.existsSync,
+                accountDeps: { probe: ctx.probeProvider, env: ctx.env },
                 cliModel,
                 model: modelToValidate,
+                preferredAccounts: config.providers[provider].preferred_accounts ?? [],
                 ...(profileAccounts !== undefined
                     ? { allowedAccounts: profileAccounts }
                     : {}),
@@ -1563,7 +1551,11 @@ async function runCreate(ctx, opts) {
                     .filter((id) => id !== candidate &&
                     accounts[id]?.enabled &&
                     (profileAccounts === undefined || profileAccounts.includes(id)) &&
-                    accountStatus(provider, id, config, { existsSync: ctx.existsSync }).logged_in === true)
+                    accountStatus(provider, id, config, {
+                        existsSync: ctx.existsSync,
+                        probe: ctx.probeProvider,
+                        env: ctx.env,
+                    }).logged_in === true)
                     .sort(),
             ];
         const checkedAccounts = [];
@@ -1648,8 +1640,10 @@ async function runCreate(ctx, opts) {
             pinnedAccount = resolveAccount(provider, undefined, config, {
                 hqRoot,
                 existsSync: ctx.existsSync,
+                accountDeps: { probe: ctx.probeProvider, env: ctx.env },
                 cliModel,
                 model: cliModel ?? profileModel,
+                preferredAccounts: config.providers[provider].preferred_accounts ?? [],
                 ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
             }).id;
         }
@@ -1797,6 +1791,7 @@ async function runCreate(ctx, opts) {
                 probe: ctx.probeProvider,
                 env: ctx.env,
             },
+            currentModelValidated: !outpostId && modelToValidate !== undefined,
             existsSync: ctx.existsSync,
             spawnProcess: ctx.spawnProcess,
             proveDetached: ctx.proveDetached,
@@ -2196,6 +2191,7 @@ async function runPickup(ctx, opts) {
                     probe: ctx.probeProvider,
                     env: ctx.env,
                 },
+                currentModelValidated: afterAccount.model !== undefined,
                 existsSync: ctx.existsSync,
                 spawnProcess: ctx.spawnProcess,
                 proveDetached: ctx.proveDetached,
@@ -2512,7 +2508,11 @@ async function prepareAccountMove(ctx, lane, input) {
     if (!targetCfg.enabled) {
         throw new AccountResolutionError("account_disabled", `Account ${JSON.stringify(target)} is disabled${targetCfg.disabled_reason ? `: ${targetCfg.disabled_reason}` : ""}`, { provider: lane.provider, account: target, reason: targetCfg.disabled_reason ?? "" });
     }
-    if (isLoggedOut(accountStatus(lane.provider, target, config, { existsSync: ctx.existsSync }))) {
+    if (accountStatus(lane.provider, target, config, {
+        existsSync: ctx.existsSync,
+        probe: ctx.probeProvider,
+        env: ctx.env,
+    }).logged_in !== true) {
         throw new LanesError("account_not_logged_in", `Account ${target} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: target, lane_id: laneId });
     }
     const profile = lane.worker_profile !== undefined
@@ -3829,7 +3829,11 @@ async function runAccountsList(ctx, opts) {
     // model and effort are what a spawn on each account would start from
     // (spec: --model/--effort, then the account, then the provider).
     const quota = loadQuotaState(hqRoot);
-    const accounts = providers.flatMap((provider) => listAccountStatuses(provider, config).map((status) => {
+    const accounts = providers.flatMap((provider) => listAccountStatuses(provider, config, {
+        existsSync: ctx.existsSync,
+        probe: ctx.probeProvider,
+        env: ctx.env,
+    }).map((status) => {
         const accountCfg = config.providers[provider].accounts[status.id];
         const model = resolveLaneModel({
             accountModel: accountCfg?.model,
@@ -3930,8 +3934,17 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
         home,
         enabled: true,
     };
+    const status = accountStatus(provider, id, config, {
+        existsSync: ctx.existsSync,
+        probe: ctx.probeProvider,
+        env: ctx.env,
+    });
+    if (status.logged_in !== true) {
+        throw new LanesError(status.logged_in === false ? "account_not_logged_in" : "account_login_status_unknown", status.logged_in === false
+            ? `Account ${id} for ${provider} is not logged in`
+            : `Could not verify that account ${id} for ${provider} is logged in`, { provider, account: id, home });
+    }
     writeLanesConfig(hqRoot, config);
-    const status = accountStatus(provider, id, loadLanesConfig(hqRoot));
     printJson({ ok: true, action: "accounts.login", account: status });
 }
 async function runAccountsEnable(ctx, providerRaw, accountId) {
@@ -3948,13 +3961,27 @@ async function runAccountsEnable(ctx, providerRaw, accountId) {
                 .map(([id]) => id),
         });
     }
+    const status = accountStatus(provider, accountId, config, {
+        existsSync: ctx.existsSync,
+        probe: ctx.probeProvider,
+        env: ctx.env,
+    });
+    if (status.logged_in !== true) {
+        throw new LanesError(status.logged_in === false ? "account_not_logged_in" : "account_login_status_unknown", status.logged_in === false
+            ? `Account ${accountId} for ${provider} is not logged in`
+            : `Could not verify that account ${accountId} for ${provider} is logged in`, { provider, account: accountId });
+    }
     account.enabled = true;
     delete account.disabled_reason;
     writeLanesConfig(hqRoot, config);
     printJson({
         ok: true,
         action: "accounts.enable",
-        account: accountStatus(provider, accountId, loadLanesConfig(hqRoot)),
+        account: accountStatus(provider, accountId, loadLanesConfig(hqRoot), {
+            existsSync: ctx.existsSync,
+            probe: ctx.probeProvider,
+            env: ctx.env,
+        }),
     });
 }
 async function runAccountsDisable(ctx, providerRaw, accountId, opts) {
@@ -3978,7 +4005,11 @@ async function runAccountsDisable(ctx, providerRaw, accountId, opts) {
     printJson({
         ok: true,
         action: "accounts.disable",
-        account: accountStatus(provider, accountId, loadLanesConfig(hqRoot)),
+        account: accountStatus(provider, accountId, loadLanesConfig(hqRoot), {
+            existsSync: ctx.existsSync,
+            probe: ctx.probeProvider,
+            env: ctx.env,
+        }),
     });
 }
 async function runSessionsList(ctx, opts) {

package/dist/lib/lanes/accounts.d.ts

@@ -4,8 +4,8 @@
  * Naming an account and omitting one mean different things: an explicit
  * disabled id is refused; omitting picks the least-loaded eligible account.
  * Status reports `configured` and `logged_in` separately. logged_in is
- * derived from whether a provider credential file EXISTS — this module
- * never reads, prints, copies, or hashes that file.
+ * derived from credential-file existence or a provider status command; this
+ * module never reads, prints, copies, or hashes credential files.
  */
 import { type LaneRecord, type LaneProvider } from "./types.js";
 import type { LanesConfig } from "./types.js";
@@ -19,13 +19,22 @@ export declare const CLAUDE_CREDENTIALS_NAME = ".credentials.json";
  * file here at all.
  */
 export declare const PROVIDER_CREDENTIAL_FILES: Record<LaneProvider, readonly string[]>;
-export type AuthState = "file" | "absent" | "unknown";
+export type AuthState = "file" | "status" | "absent" | "unknown";
+export interface AccountStatusProbeResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
 export interface AccountDeps {
     existsSync: (p: string) => boolean;
+    /** Provider status output is parsed for a boolean only; it is never printed. */
+    probe?: (command: string, args: string[], env: NodeJS.ProcessEnv) => AccountStatusProbeResult;
+    env?: NodeJS.ProcessEnv;
 }
 export interface AccountResolveContext {
     hqRoot?: string;
     existsSync?: (p: string) => boolean;
+    accountDeps?: Omit<AccountDeps, "existsSync">;
     loadLanes?: (hqRoot: string) => LaneRecord[];
     /** Already-resolved model for this lane. Beats cliModel and account defaults. */
     model?: string;
@@ -38,6 +47,8 @@ export interface AccountResolveContext {
      * set is never selected, so no refusal has to be decided under the lock.
      */
     allowedAccounts?: readonly string[];
+    /** Ordered preferences; callers pass these only for a new lane's first assignment. */
+    preferredAccounts?: readonly string[];
 }
 export interface ResolvedAccount {
     provider: LaneProvider;
@@ -54,13 +65,7 @@ export interface AccountStatus {
     disabled_reason?: string;
     /** Present in personal/lanes/config.json. */
     configured: boolean;
-    /**
-     * True when a provider credential file exists. False only when every
-     * candidate is absent AND absence is conclusive for that provider
-     * (Codex, Grok). Null for Claude when no candidate exists: Claude can
-     * authenticate via keychain, so a missing file is not logged-out.
-     * Never inspects file contents.
-     */
+    /** True/false comes from file existence or the provider status command. */
     logged_in: boolean | null;
     auth_state: AuthState;
     envVar: string;
@@ -79,7 +84,7 @@ export declare function authStateFor(provider: LaneProvider, present: boolean):
 export declare function loggedInFromAuthState(state: AuthState): boolean | null;
 /** Admission and listing share this: refuse only a conclusive logged-out. */
 export declare function isLoggedOut(status: Pick<AccountStatus, "logged_in">): boolean;
-/** Auto-select requires a proven credential file, not Claude-unknown. */
+/** Auto-select requires a positive file or provider-status login result. */
 export declare function isCredentialProven(status: Pick<AccountStatus, "logged_in">): boolean;
 /**
  * Occupying states hold a slot: running / awaiting_input / blocked have a

package/dist/lib/lanes/accounts.js

@@ -4,8 +4,8 @@
  * Naming an account and omitting one mean different things: an explicit
  * disabled id is refused; omitting picks the least-loaded eligible account.
  * Status reports `configured` and `logged_in` separately. logged_in is
- * derived from whether a provider credential file EXISTS — this module
- * never reads, prints, copies, or hashes that file.
+ * derived from credential-file existence or a provider status command; this
+ * module never reads, prints, copies, or hashes credential files.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -76,7 +76,7 @@ export function loggedInFromAuthState(state) {
 export function isLoggedOut(status) {
     return status.logged_in === false;
 }
-/** Auto-select requires a proven credential file, not Claude-unknown. */
+/** Auto-select requires a positive file or provider-status login result. */
 export function isCredentialProven(status) {
     return status.logged_in === true;
 }
@@ -205,8 +205,12 @@ export function selectBalancedAccount(provider, config, ctx = {}) {
     }
     const proven = [];
     for (const id of enabled) {
-        const account = providerCfg.accounts[id];
-        if (hasCredentialFile(provider, account.home, existsSync))
+        const status = accountStatus(provider, id, config, {
+            existsSync,
+            ...(ctx.accountDeps?.probe ? { probe: ctx.accountDeps.probe } : {}),
+            ...(ctx.accountDeps?.env ? { env: ctx.accountDeps.env } : {}),
+        });
+        if (status.logged_in === true)
             proven.push(id);
     }
     if (proven.length === 0) {
@@ -235,6 +239,9 @@ export function selectBalancedAccount(provider, config, ctx = {}) {
         const cap = accountMaxRunning(providerCfg, id);
         return runningLaneCount(lanes, provider, id) < cap;
     });
+    const preferred = underCap.length > 0
+        ? ctx.preferredAccounts?.find((id) => underCap.includes(id))
+        : undefined;
     const pool = underCap.length > 0 ? underCap : runnable;
     const ranked = pool
         .map((id) => ({
@@ -243,7 +250,7 @@ export function selectBalancedAccount(provider, config, ctx = {}) {
         lastStarted: lastStartedAt(lanes, provider, id),
     }))
         .sort(compareEligible);
-    const chosen = ranked[0].id;
+    const chosen = preferred ?? ranked[0].id;
     return boundAccount(provider, chosen, providerCfg.accounts[chosen]);
 }
 export function resolveAccount(provider, requestedId, config, ctx = {}) {
@@ -293,14 +300,28 @@ export function accountStatus(provider, accountId, config, deps = defaultAccount
         };
     }
     const present = hasCredentialFile(provider, account.home, deps.existsSync);
-    const auth_state = authStateFor(provider, present);
+    let auth_state = authStateFor(provider, present);
+    let logged_in = loggedInFromAuthState(auth_state);
+    if (!present && provider === "claude" && deps.probe !== undefined) {
+        try {
+            const result = deps.probe("claude", ["auth", "status"], { ...(deps.env ?? process.env), CLAUDE_CONFIG_DIR: account.home });
+            const providerStatus = claudeLoginStatus(result);
+            if (providerStatus !== null) {
+                auth_state = "status";
+                logged_in = providerStatus;
+            }
+        }
+        catch {
+            process.stderr.write(`hq lanes: Claude auth status probe failed for account ${accountId}\n`);
+        }
+    }
     const status = {
         provider,
         id: accountId,
         home: account.home,
         enabled: account.enabled,
         configured: true,
-        logged_in: loggedInFromAuthState(auth_state),
+        logged_in,
         auth_state,
         envVar,
     };
@@ -312,6 +333,27 @@ export function accountStatus(provider, accountId, config, deps = defaultAccount
 export function listAccountStatuses(provider, config, deps = defaultAccountDeps()) {
     return Object.keys(config.providers[provider].accounts).map((id) => accountStatus(provider, id, config, deps));
 }
+function claudeLoginStatus(result) {
+    const text = result.stdout.trim();
+    if (text.startsWith("{")) {
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed !== null &&
+                typeof parsed === "object" &&
+                !Array.isArray(parsed) &&
+                typeof parsed.loggedIn === "boolean") {
+                return parsed.loggedIn;
+            }
+        }
+        catch (err) {
+            process.stderr.write(`hq lanes: Claude auth status returned invalid JSON: ${err instanceof Error ? err.message : String(err)}\n`);
+            return null;
+        }
+    }
+    if (/\bnot logged in\b/i.test(`${result.stdout}\n${result.stderr}`))
+        return false;
+    return null;
+}
 /** Environment assignment the worker process should receive. */
 export function accountEnv(resolved) {
     return { [resolved.envVar]: resolved.home };

package/dist/lib/lanes/admission-host.d.ts

@@ -0,0 +1,19 @@
+import type { AdmissionHost } from "./admission.js";
+export declare const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
+export declare const OUTPOST_DIR = "/etc/outpost";
+export type OutpostIdentity = {
+    kind: "id";
+    id: string;
+} | {
+    kind: "unknown";
+} | {
+    kind: "not_outpost";
+};
+export declare function readOutpostIdentity(existsSync?: (p: string) => boolean, readFileSync?: (p: string) => string): OutpostIdentity;
+export declare function resolveAdmissionHost(deps?: {
+    hostname?: () => string;
+    readOutpostIdentity?: () => OutpostIdentity;
+    existsSync?: (p: string) => boolean;
+    readFileSync?: (p: string) => string;
+}): AdmissionHost;
+//# sourceMappingURL=admission-host.d.ts.map

package/dist/lib/lanes/admission-host.js

@@ -0,0 +1,33 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+export const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
+export const OUTPOST_DIR = "/etc/outpost";
+export function readOutpostIdentity(existsSync = (p) => fs.existsSync(p), readFileSync = (p) => fs.readFileSync(p, "utf8")) {
+    const hasMarker = existsSync(OUTPOST_ID_PATH);
+    const hasDir = existsSync(OUTPOST_DIR);
+    if (hasMarker) {
+        let text;
+        try {
+            text = readFileSync(OUTPOST_ID_PATH);
+        }
+        catch (err) {
+            process.stderr.write(`hq lanes: failed to read ${OUTPOST_ID_PATH}: ${err instanceof Error ? err.message : String(err)}\n`);
+            throw err;
+        }
+        const id = text.trim();
+        if (!id)
+            return hasDir ? { kind: "unknown" } : { kind: "not_outpost" };
+        return { kind: "id", id };
+    }
+    if (hasDir)
+        return { kind: "unknown" };
+    return { kind: "not_outpost" };
+}
+export function resolveAdmissionHost(deps = {}) {
+    const identity = deps.readOutpostIdentity?.() ?? readOutpostIdentity(deps.existsSync, deps.readFileSync);
+    return {
+        hostname: (deps.hostname ?? os.hostname)(),
+        outpostId: identity.kind === "id" ? identity.id : null,
+    };
+}
+//# sourceMappingURL=admission-host.js.map

package/dist/lib/lanes/config.js

@@ -173,6 +173,29 @@ function parseFastModeModels(value, field) {
     }
     return value.map((model) => model.trim());
 }
+function parsePreferredAccounts(provider, value, accounts) {
+    const field = `providers.${provider}.preferred_accounts`;
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) ||
+        value.some((id) => typeof id !== "string" ||
+            id.trim().length === 0 ||
+            id.trim() !== id)) {
+        throw new LanesConfigError("invalid_preferred_accounts", `${field} must be an array of non-empty account ids without surrounding whitespace`, { provider, field });
+    }
+    const preferred = value;
+    const seen = new Set();
+    for (const id of preferred) {
+        if (seen.has(id)) {
+            throw new LanesConfigError("invalid_preferred_accounts", `${field} contains duplicate account ${JSON.stringify(id)}`, { provider, field, account: id });
+        }
+        if (accounts[id] === undefined) {
+            throw new LanesConfigError("preferred_account_unconfigured", `${field} names unconfigured account ${JSON.stringify(id)}`, { provider, field, account: id, accounts: Object.keys(accounts) });
+        }
+        seen.add(id);
+    }
+    return [...preferred];
+}
 function rejectDuplicateHomes(provider, accounts) {
     const seen = new Map();
     for (const [id, account] of Object.entries(accounts)) {
@@ -232,6 +255,7 @@ function parseProvider(provider, raw, deps) {
         max_running: positiveInt(raw.max_running, `providers.${provider}.max_running`, DEFAULT_PROVIDER_MAX_RUNNING[provider]),
         max_queued: positiveInt(raw.max_queued, `providers.${provider}.max_queued`, DEFAULT_MAX_QUEUED),
         accounts,
+        preferred_accounts: parsePreferredAccounts(provider, raw.preferred_accounts, accounts),
     };
     if (provider === "codex") {
         parsed.fast_mode_models = parseFastModeModels(raw.fast_mode_models, `providers.${provider}.fast_mode_models`);
@@ -301,6 +325,7 @@ export function documentedDefaultConfig(deps = defaultDeps()) {
             max_running: DEFAULT_PROVIDER_MAX_RUNNING[provider],
             max_queued: DEFAULT_MAX_QUEUED,
             accounts: defaultAccountMap(provider, deps),
+            preferred_accounts: [],
         };
         if (provider === "codex")
             providerConfig.fast_mode_models = [];

package/dist/lib/lanes/provider-rejection.d.ts

@@ -37,6 +37,7 @@ export interface ProviderRejection {
     /** Which event on the stream carried the failure. */
     event: "codex.turn.failed" | "claude.result.is_error" | "grok.error";
 }
+export declare function isProviderLoginFailure(failure: ProviderRejection | null): boolean;
 export declare function capMessage(message: string): string;
 /**
  * Whether a later run could succeed without the operator changing anything.
@@ -56,10 +57,9 @@ export declare function retryableFromStatus(status: number | null): boolean;
 export declare function parseCodexTurnFailed(text: string): ProviderRejection | null;
 /**
  * Claude `-p --output-format json`: the last `type: "result"` object with
- * `is_error: true` and a numeric `api_error_status`. A result that is an
- * error with no status is not a provider rejection: it is either the quota
- * text shape quota.ts reads, or the worker's own failure, and keeps the
- * existing classification.
+ * `is_error: true` and a numeric `api_error_status`, or the CLI's explicit
+ * unauthenticated message. Other status-less errors keep the existing
+ * classification because they may be quota text or a worker failure.
  */
 export declare function parseClaudeResultRejection(text: string): ProviderRejection | null;
 /**

package/dist/lib/lanes/provider-rejection.js

@@ -24,6 +24,25 @@ export const PROVIDER_REJECTED_REASON = "provider_rejected";
 export const PROVIDER_REJECTION_MESSAGE_CAP = 2000;
 /** Status the watcher routes to the quota path instead of `provider_rejected`. */
 export const QUOTA_STATUS = 429;
+/** Exact auth failures observed from each installed CLI in an empty home. */
+function isProviderLoginMessage(provider, message) {
+    switch (provider) {
+        case "claude":
+            return /\bnot logged in\b/i.test(message);
+        case "codex":
+            return /\bnot logged in\b/i.test(message) ||
+                /\bmissing bearer or basic authentication in header\b/i.test(message);
+        case "grok":
+            return /^\s*not signed in\b/i.test(message);
+        default: {
+            const _exhaustive = provider;
+            return _exhaustive;
+        }
+    }
+}
+export function isProviderLoginFailure(failure) {
+    return failure !== null && isProviderLoginMessage(failure.provider, failure.message);
+}
 function isPlainObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -134,10 +153,9 @@ export function parseCodexTurnFailed(text) {
 }
 /**
  * Claude `-p --output-format json`: the last `type: "result"` object with
- * `is_error: true` and a numeric `api_error_status`. A result that is an
- * error with no status is not a provider rejection: it is either the quota
- * text shape quota.ts reads, or the worker's own failure, and keeps the
- * existing classification.
+ * `is_error: true` and a numeric `api_error_status`, or the CLI's explicit
+ * unauthenticated message. Other status-less errors keep the existing
+ * classification because they may be quota text or a worker failure.
  */
 export function parseClaudeResultRejection(text) {
     // The last `result` decides: a success or a status-less error there is
@@ -148,9 +166,9 @@ export function parseClaudeResultRejection(text) {
         if (rec.is_error !== true)
             return NOT_REJECTED;
         const status = statusOf(rec.api_error_status);
-        if (status === null)
-            return NOT_REJECTED;
         const message = typeof rec.result === "string" ? rec.result : "";
+        if (status === null && !isProviderLoginMessage("claude", message))
+            return NOT_REJECTED;
         return {
             reason: PROVIDER_REJECTED_REASON,
             provider: "claude",