@indigoai-us/hq-cli 5.158.0 → 5.160.0

package/CHANGELOG.md

@@ -2,6 +2,39 @@
 
 ## [Unreleased]
 
+## [5.160.0] — 2026-09-24
+
+### Added
+
+- Worker profiles can deliver validated policy files through an installed HQ
+  hook or include them in the prompt when the hook is unavailable. Resume and
+  message can attach a profile, and resume can attach a mesh company. Bot-owned
+  Claude profiles may rely on provider configuration for optional model,
+  account, effort, and fast-mode values.
+
+- Added `hq agents login-code`, which submits a Claude subscription code from
+  an argument or stdin. Provisioning help shows the Agents v2 command and
+  account requirement. Claude subscription creates print the console URL and
+  login-code command.
+
+### Fixed
+
+- If a Codex or Claude worker exits without writing this run's envelope, hq lanes
+  gives its session one resume turn to write the expected file. The watcher and
+  dead-host recovery ignore earlier envelopes. If the repair still writes no
+  valid envelope, the lane remains interrupted.
+
+## [5.159.0] — 2026-09-24
+
+### Fixed
+
+- Hook timeout reports now identify the slow child hook and group concurrent
+  session-wide slowness together. Update checks have bounded network calls, and
+  the core-write guard avoids repeated subprocess work.
+- Machine-wide hook warnings and exceeded timeouts now keep separate Sentry
+  groups, and per-script rate limits no longer suppress a later machine-wide
+  report from the same session.
+
 ## [5.158.0] — 2026-09-24
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -3933,10 +3933,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Agent slug (defaults to a slug of <name>)";
         }, {
             readonly flags: "--provider <provider>";
-            readonly description: "Runtime: agents-v2 (recommended) | codex | grok | claude (legacy). A --model selects agents-v2 by default";
+            readonly description: "Runtime: agents-v2 (recommended) | codex | grok | claude (accepted for script compatibility; use agents-v2 for new Claude agents)";
         }, {
             readonly flags: "--model <model>";
-            readonly description: "Brain model, for example gpt-5.5 or grok-4.6";
+            readonly description: "Brain model, for example claude-opus-5-5, gpt-5.5, or grok-4.6";
         }, {
             readonly flags: "--auth-mode <mode>";
             readonly description: "Auth: subscription | apiKey (default subscription)";
@@ -3969,6 +3969,23 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Emit machine-readable output and never open a browser";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "login-code";
+        readonly description: "Submit a Claude subscription sign-in code for an agent";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <agentUid> [code]";
+        readonly arguments: readonly [{
+            readonly name: "agentUid";
+            readonly required: true;
+            readonly variadic: false;
+        }, {
+            readonly name: "code";
+            readonly required: false;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "list";
         readonly description: "List the company's agents";
@@ -6784,7 +6801,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Path to the lane brief";
         }, {
             readonly flags: "--worker <name>";
-            readonly description: "HQ worker id from the registry";
+            readonly description: "HQ worker or reusable profile id";
         }, {
             readonly flags: "--provider <name>";
             readonly description: "claude | codex | grok";
@@ -7166,6 +7183,9 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--model <id>";
             readonly description: "Model for the moved lane (with --account only)";
+        }, {
+            readonly flags: "--worker <profile>";
+            readonly description: "Attach a personal worker profile when this message resumes the lane";
         }, {
             readonly flags: "--no-compact";
             readonly description: "Skip the resume-time compaction check for this message";
@@ -7200,6 +7220,12 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--model <id>";
             readonly description: "Model for the moved lane (with --account only)";
+        }, {
+            readonly flags: "--worker <profile>";
+            readonly description: "Attach a personal worker profile for the resumed turn";
+        }, {
+            readonly flags: "--mesh-company <slug>";
+            readonly description: "Attach Work Mesh attribution after verifying company membership";
         }, {
             readonly flags: "--no-compact";
             readonly description: "Skip the resume-time compaction check for this resume";

package/dist/command-catalog.generated.js

@@ -5084,11 +5084,11 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--provider <provider>",
-                        "description": "Runtime: agents-v2 (recommended) | codex | grok | claude (legacy). A --model selects agents-v2 by default"
+                        "description": "Runtime: agents-v2 (recommended) | codex | grok | claude (accepted for script compatibility; use agents-v2 for new Claude agents)"
                     },
                     {
                         "flags": "--model <model>",
-                        "description": "Brain model, for example gpt-5.5 or grok-4.6"
+                        "description": "Brain model, for example claude-opus-5-5, gpt-5.5, or grok-4.6"
                     },
                     {
                         "flags": "--auth-mode <mode>",
@@ -5133,6 +5133,27 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "login-code",
+                "description": "Submit a Claude subscription sign-in code for an agent",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <agentUid> [code]",
+                "arguments": [
+                    {
+                        "name": "agentUid",
+                        "required": true,
+                        "variadic": false
+                    },
+                    {
+                        "name": "code",
+                        "required": false,
+                        "variadic": false
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "list",
                 "description": "List the company's agents",
@@ -8767,7 +8788,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--worker <name>",
-                        "description": "HQ worker id from the registry"
+                        "description": "HQ worker or reusable profile id"
                     },
                     {
                         "flags": "--provider <name>",
@@ -9265,6 +9286,10 @@ export const COMMAND_CATALOG = [
                         "flags": "--model <id>",
                         "description": "Model for the moved lane (with --account only)"
                     },
+                    {
+                        "flags": "--worker <profile>",
+                        "description": "Attach a personal worker profile when this message resumes the lane"
+                    },
                     {
                         "flags": "--no-compact",
                         "description": "Skip the resume-time compaction check for this message"
@@ -9310,6 +9335,14 @@ export const COMMAND_CATALOG = [
                         "flags": "--model <id>",
                         "description": "Model for the moved lane (with --account only)"
                     },
+                    {
+                        "flags": "--worker <profile>",
+                        "description": "Attach a personal worker profile for the resumed turn"
+                    },
+                    {
+                        "flags": "--mesh-company <slug>",
+                        "description": "Attach Work Mesh attribution after verifying company membership"
+                    },
                     {
                         "flags": "--no-compact",
                         "description": "Skip the resume-time compaction check for this resume"

package/dist/commands/agents.d.ts

@@ -275,6 +275,11 @@ export declare function startStopAgent(token: string, agentUid: string, action:
     uid: string;
     runtime?: Record<string, unknown>;
 }>;
+/** Submit a human-provided Claude subscription code through hq-pro's route. */
+export declare function submitAgentLoginCode(token: string, agentUid: string, code: string): Promise<{
+    uid: string;
+    ok: boolean;
+}>;
 /** `POST /v1/agents/{uid}/terminal` wire shape: vended session or 202 starting. */
 export type AgentTerminalResponse = ({
     ok: true;

package/dist/commands/agents.js

@@ -31,8 +31,10 @@ import open from "open";
 import { randomUUID } from "node:crypto";
 import * as readline from "node:readline";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
+import { DEFAULT_VAULT_API_URL } from "../utils/cognito-session.js";
 import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { consoleOrigin } from "./integrations-connect.js";
 import { launchSessionManagerPlugin, SessionManagerPluginLaunchError, TerminalSessionTimeoutError, waitForTerminalSession, } from "@indigoai-us/hq-cloud/outposts/node";
 import { peekIdToken } from "../utils/id-token.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
@@ -54,6 +56,16 @@ export const VALID_PROVIDERS = new Set(["codex", "grok", "claude", "agents-v2"])
 export const VALID_AUTH_MODES = new Set(["subscription", "apiKey"]);
 /** Customer-facing agent size keys served by hq-pro's authoritative catalog. */
 export const VALID_AGENT_SIZE_KEYS = new Set(["basic", "power", "dev"]);
+const CLAUDE_PROVISION_COMMAND = "hq agents provision <name> --provider agents-v2 --model claude-opus-5-5";
+const CLAUDE_API_KEY_ARGS = "--auth-mode apiKey --api-key-env <VAR>";
+function claudeProvisionGuidance() {
+    return [
+        "The account must be enabled for Claude. Subscription auth is the default.",
+        `Create an agent with: ${CLAUDE_PROVISION_COMMAND}`,
+        `For API-key auth, add: ${CLAUDE_API_KEY_ARGS}`,
+        "The CLI accepts --provider claude for script compatibility, but the server rejects new agents that use it.",
+    ].join("\n");
+}
 /**
  * `hq agents create` exits with this distinct status when payment is required.
  * Scripts can distinguish the expected upgrade state from an ordinary command
@@ -693,6 +705,54 @@ export async function startStopAgent(token, agentUid, action) {
         method: "POST",
     });
 }
+/** Submit a human-provided Claude subscription code through hq-pro's route. */
+export async function submitAgentLoginCode(token, agentUid, code) {
+    return agentsRequest({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}/login-code`,
+        method: "POST",
+        body: { code },
+    });
+}
+async function readLoginCode(code) {
+    let value = code;
+    if (value === undefined) {
+        if (process.stdin.isTTY) {
+            console.error("Enter the Claude sign-in code, then press Enter:");
+        }
+        const rl = readline.createInterface({ input: process.stdin });
+        try {
+            value = await new Promise((resolve, reject) => {
+                rl.once("error", reject);
+                rl.once("close", () => resolve(""));
+                rl.question("", resolve);
+            });
+        }
+        finally {
+            rl.close();
+        }
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        throw new Error("Claude sign-in code required. Pass it as an argument or provide it on stdin.");
+    }
+    return trimmed;
+}
+function redactLoginCode(message, code) {
+    return code ? message.split(code).join("[redacted]") : message;
+}
+function agentConsoleResolveUrl(agentUid) {
+    const apiUrl = process.env.HQ_VAULT_API_URL?.trim() || DEFAULT_VAULT_API_URL;
+    const origin = consoleOrigin(apiUrl);
+    if (!origin)
+        return undefined;
+    // Keep the owner's canonical production sign-in URL while honoring an
+    // explicit console override or deriving the console for another API host.
+    const consoleBase = !process.env.HQ_CONSOLE_URL?.trim() && origin === "https://hq.computer"
+        ? "https://hq.getindigo.ai"
+        : origin;
+    return `${consoleBase}/resolve/agents/${encodeURIComponent(agentUid)}`;
+}
 export async function openAgentTerminal(token, agentUid, body) {
     return agentsRequest({
         token,
@@ -1213,8 +1273,8 @@ export function registerAgentsCommand(program) {
         .description("Provision a new cloud agent (company-specific monthly price shown before creation)")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--slug <slug>", "Agent slug (defaults to a slug of <name>)")
-        .option("--provider <provider>", "Runtime: agents-v2 (recommended) | codex | grok | claude (legacy). A --model selects agents-v2 by default")
-        .option("--model <model>", "Brain model, for example gpt-5.5 or grok-4.6")
+        .option("--provider <provider>", "Runtime: agents-v2 (recommended) | codex | grok | claude (accepted for script compatibility; use agents-v2 for new Claude agents)")
+        .option("--model <model>", "Brain model, for example claude-opus-5-5, gpt-5.5, or grok-4.6")
         .option("--auth-mode <mode>", "Auth: subscription | apiKey (default subscription)", "subscription")
         .option("--api-key-env <VAR>", "Env var holding the API key for --auth-mode apiKey (never pass the key as a flag)")
         .option("--slack-bot-token <xoxb-token>", "Reuse an existing Slack bot token; HQ_SLACK_BOT_TOKEN or --slack-tokens-stdin avoid shell history")
@@ -1225,6 +1285,7 @@ export function registerAgentsCommand(program) {
         .option("--size <size>", "Agent box size: basic | power | dev (omitted keeps the current default)")
         .option("--yes", "Confirm the quoted monthly cost and provision the agent")
         .option("--json", "Emit machine-readable output and never open a browser")
+        .addHelpText("after", `\n${claudeProvisionGuidance()}\n`)
         .action(async function (name, opts) {
         try {
             // Both of these previously fell back to their default on an
@@ -1251,7 +1312,7 @@ export function registerAgentsCommand(program) {
             // AFTER clearing the charge gate. The server stays authoritative; this is
             // only a friendlier, earlier copy of the same rule.
             if (provider === "claude" && authMode === "apiKey") {
-                console.error(chalk.red("The claude provider is subscription-only — drop --auth-mode apiKey."));
+                console.error(chalk.red(`Use agents-v2 for new Claude agents. The claude provider remains accepted for script compatibility.\n${claudeProvisionGuidance()}`));
                 process.exit(1);
             }
             // Resolve the API key from the environment (never from a flag value) when
@@ -1317,6 +1378,15 @@ export function registerAgentsCommand(program) {
                     surface: CLI_AGENT_CREATE_SURFACE,
                 });
                 const identity = provisionedAgentIdentity(result);
+                const claudeSignIn = provider === "agents-v2" &&
+                    authMode === "subscription" &&
+                    opts.model?.toLowerCase().startsWith("claude-") &&
+                    identity
+                    ? {
+                        consoleUrl: agentConsoleResolveUrl(identity.uid) ?? null,
+                        loginCodeCommand: `hq agents login-code ${identity.uid}`,
+                    }
+                    : undefined;
                 const status = identity
                     ? await getAgentStatus(token, identity.uid)
                     : null;
@@ -1336,10 +1406,20 @@ export function registerAgentsCommand(program) {
                                 slackInstallUrl: slackInstall.url,
                             }
                             : {}),
+                        ...(claudeSignIn ? { claudeSignIn } : {}),
                     }));
                 }
                 else {
                     console.log(chalk.green(`Provisioning started for agent "${name}".`));
+                    if (claudeSignIn) {
+                        if (claudeSignIn.consoleUrl) {
+                            console.log(chalk.yellow(`To sign in, open ${claudeSignIn.consoleUrl}, authorize Claude, then paste the code on that page.`));
+                        }
+                        else {
+                            console.log(chalk.yellow("The console URL for this control plane is unknown. Set HQ_CONSOLE_URL to configure it."));
+                        }
+                        console.log(chalk.dim(`A human CLI session can also submit the code with: ${claudeSignIn.loginCodeCommand}`));
+                    }
                     if (actions.length > 0) {
                         printPendingOperatorActions(identity?.slug ?? null, actions);
                     }
@@ -1349,6 +1429,11 @@ export function registerAgentsCommand(program) {
                 }
             }
             catch (err) {
+                if (provider === "claude" &&
+                    err instanceof AgentsHttpError &&
+                    err.code === "LEGACY_MANAGED_PROVIDER_RETIRED") {
+                    throw new Error(`${err.message}\n\n${claudeProvisionGuidance()}`);
+                }
                 if (err instanceof AgentsHttpError &&
                     err.status === 403 &&
                     err.code === "AGENT_PLAN_LIMIT") {
@@ -1377,6 +1462,32 @@ export function registerAgentsCommand(program) {
             fail(err);
         }
     });
+    agents
+        .command("login-code <agentUid> [code]")
+        .description("Submit a Claude subscription sign-in code for an agent")
+        .action(async (agentUid, codeArg) => {
+        let code = "";
+        try {
+            code = await readLoginCode(codeArg);
+            const token = (await resolveVaultCredential()).token;
+            await submitAgentLoginCode(token, agentUid, code);
+            console.log(chalk.green(`Sent the Claude sign-in code to agent ${agentUid}.`));
+        }
+        catch (err) {
+            if (err instanceof AgentsHttpError &&
+                err.status === 403 &&
+                err.code === "OUTPOST_ACCOUNT_MANAGEMENT_FORBIDDEN") {
+                const consoleUrl = agentConsoleResolveUrl(agentUid);
+                console.error(chalk.yellow(consoleUrl
+                    ? `A person must paste this code in the agent console: ${consoleUrl}`
+                    : "A person must paste this code in the agent console. Set HQ_CONSOLE_URL to configure it for this control plane."));
+                process.exit(1);
+            }
+            const detail = err instanceof Error ? err.message : String(err);
+            console.error(chalk.red(`Could not submit Claude sign-in code: ${redactLoginCode(detail, code)}`));
+            process.exit(1);
+        }
+    });
     agents
         .command("list")
         .description("List the company's agents")

package/dist/commands/lanes.js

@@ -3312,6 +3312,77 @@ async function runAdmit(ctx, laneId, opts) {
         });
     }, ctx.sleep);
 }
+function resolveResumeProfile(ctx, lane, workerId) {
+    const worker = resolveLaneWorker(ctx.hqRoot(), workerId.trim(), lane.company?.slug ?? lane.mesh_company?.slug);
+    if (worker.profile === undefined) {
+        throw new LanesError("worker_profile_required", `Worker ${JSON.stringify(workerId)} resolves to a registry worker, not a reusable provider profile; resume --worker requires personal/workers/<id>/meta.yaml`, { worker: workerId, path: worker.path });
+    }
+    if (worker.profile.meta.provider !== lane.provider) {
+        throw new LanesError("worker_profile_provider_mismatch", `Worker profile ${JSON.stringify(workerId)} uses provider ${worker.profile.meta.provider}, but lane ${lane.lane_id} uses ${lane.provider}; resume cannot change a lane's provider`, {
+            worker: workerId,
+            lane_id: lane.lane_id,
+            lane_provider: lane.provider,
+            profile_provider: worker.profile.meta.provider,
+        });
+    }
+    return worker;
+}
+function validateResumeProfileModel(ctx, lane, profile) {
+    if (profile.meta.provider !== lane.provider ||
+        profile.meta.model === undefined ||
+        lane.model_source === "cli") {
+        return;
+    }
+    const hqRoot = ctx.hqRoot();
+    const config = loadLanesConfig(hqRoot);
+    const account = resolveAccount(lane.provider, lane.account, config, {
+        hqRoot,
+        existsSync: ctx.existsSync,
+        model: profile.meta.model,
+    });
+    validateProfileLaneModel(lane.provider, profile.meta.model, account.home, profile.id, {
+        readFileSync: ctx.readFileSync,
+        probe: ctx.probeProvider,
+        env: ctx.env,
+    });
+}
+function recordResumeSetup(ctx, lane, input) {
+    if (input.profile === undefined && input.meshCompany === undefined)
+        return lane;
+    return casUpdateLane(ctx.hqRoot(), lane.lane_id, (current) => {
+        if (current.version !== lane.version) {
+            throw new LanesError("lane_resume_setup_conflict", `Lane ${lane.lane_id} changed while resume settings were prepared; run the resume again`, { lane_id: lane.lane_id, prepared_version: lane.version, version: current.version });
+        }
+        const next = { ...current };
+        if (input.profile !== undefined) {
+            const profile = input.profile.profile;
+            next.worker = input.profile.id;
+            next.worker_path = input.profile.path;
+            next.worker_pack = input.profile.pack;
+            next.worker_profile = profile.id;
+            next.worker_profile_hash = profile.contentHash;
+            next.worker_profile_ignored = ignoredWorkerProfileFields(current.provider);
+            next.worker_policy_delivery = undefined;
+            if (current.model_source !== "cli") {
+                if (profile.meta.provider === current.provider && profile.meta.model !== undefined) {
+                    next.model = profile.meta.model;
+                    next.model_source = "profile";
+                }
+                else if (profile.meta.provider === current.provider) {
+                    next.model = undefined;
+                    next.model_source = "none";
+                }
+            }
+        }
+        if (input.meshCompany !== undefined) {
+            if (current.company === null)
+                next.mesh_company = input.meshCompany;
+            if (input.threadId !== undefined)
+                next.thread_id = input.threadId;
+        }
+        return next;
+    });
+}
 /**
  * US-023: move the lane's provider session to `--account` (same provider)
  * before a resume or a message resume. Every check runs before anything is
@@ -3379,15 +3450,18 @@ async function prepareAccountMove(ctx, lane, input) {
     }).logged_in !== true) {
         throw new LanesError("account_not_logged_in", `Account ${target} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: target, lane_id: laneId });
     }
-    const profile = lane.worker_profile !== undefined
+    const profile = input.workerProfile ?? (lane.worker_profile !== undefined
         ? loadWorkerProfile(hqRoot, lane.worker_profile)
-        : undefined;
+        : undefined);
     const profileDefaultsApply = profile !== undefined && profile.meta.provider === lane.provider;
-    const pinnedModel = lane.model_source === undefined || lane.model_source === "cli"
-        ? lane.model
-        : undefined;
-    if (input.cliModel === undefined && profileDefaultsApply && pinnedModel === undefined) {
-        validateProfileLaneModel(lane.provider, profile.meta.model, targetCfg.home, profile.id, {
+    const pinnedModel = input.workerProfile !== undefined
+        ? lane.model_source === "cli" ? lane.model : undefined
+        : lane.model_source === undefined || lane.model_source === "cli"
+            ? lane.model
+            : undefined;
+    const profileModel = profileDefaultsApply ? profile?.meta.model : undefined;
+    if (input.cliModel === undefined && profileDefaultsApply && profileModel !== undefined && pinnedModel === undefined) {
+        validateProfileLaneModel(lane.provider, profileModel, targetCfg.home, profile.id, {
             readFileSync: ctx.readFileSync,
             probe: ctx.probeProvider,
             env: ctx.env,
@@ -3400,12 +3474,13 @@ async function prepareAccountMove(ctx, lane, input) {
     // here, before anything is copied. A target that pins a different model
     // refuses the lane's model unless the operator names one for the move.
     const model = resolveLaneModel({
-        cliModel: input.cliModel ?? lane.model,
+        cliModel: input.cliModel ?? pinnedModel,
+        profileModel,
         accountModel: targetCfg.model,
         providerModel: providerCfg.model,
     });
-    if (input.cliModel === undefined && lane.model !== undefined && targetCfg.model !== undefined && targetCfg.model !== lane.model) {
-        throw new LanesError("model_unsupported", `Account ${target} pins model ${targetCfg.model}; lane ${laneId} runs ${lane.model}. Pass --model ${targetCfg.model} to move it onto that model`, { provider: lane.provider, account: target, model: lane.model, account_model: targetCfg.model, lane_id: laneId });
+    if (input.cliModel === undefined && lane.model !== undefined && targetCfg.model !== undefined && model !== targetCfg.model) {
+        throw new LanesError("model_unsupported", `Account ${target} pins model ${targetCfg.model}; lane ${laneId} resolves to ${model ?? lane.model}. Pass --model ${targetCfg.model} to move it onto that model`, { provider: lane.provider, account: target, model: model ?? lane.model, account_model: targetCfg.model, lane_id: laneId });
     }
     const block = quotaBlockFor(loadQuotaState(hqRoot), lane.provider, target, model, now);
     if (block.blocked) {
@@ -3521,6 +3596,12 @@ async function runMessage(ctx, laneId, opts) {
             message,
         });
     }
+    if (opts.worker !== undefined && mechanism === "dropbox") {
+        throw new LanesError("worker_profile_requires_resume", `Lane ${laneId} is still running; --worker can only be applied when message starts a resumed provider turn`, { lane_id: laneId, state: lane.state });
+    }
+    const resumeProfile = opts.worker !== undefined
+        ? resolveResumeProfile(ctx, lane, opts.worker)
+        : undefined;
     if (opts.model !== undefined && opts.account === undefined) {
         throw new LanesError("model_requires_account", "--model on hq lanes message is only accepted together with --account", {});
     }
@@ -3544,6 +3625,7 @@ async function runMessage(ctx, laneId, opts) {
         move = await prepareAccountMove(ctx, lane, {
             account: opts.account,
             cliModel: opts.model?.trim() || undefined,
+            ...(resumeProfile !== undefined ? { workerProfile: resumeProfile.profile } : {}),
             pending: { trigger: "message", text, message_id: messageId, compact: opts.compact !== false },
         });
         lane = move.lane;
@@ -3551,6 +3633,11 @@ async function runMessage(ctx, laneId, opts) {
             archiveResumeMessage(hqRoot, laneId, dropboxMessage);
         }
     }
+    if (resumeProfile !== undefined) {
+        if (opts.account === undefined)
+            validateResumeProfileModel(ctx, lane, resumeProfile.profile);
+        lane = recordResumeSetup(ctx, lane, { profile: resumeProfile });
+    }
     if (move?.queued) {
         // Parked at the target's cap: reconcile resumes the session there.
     }
@@ -3790,11 +3877,32 @@ async function runResume(ctx, laneId, opts) {
     const storyId = opts.story?.trim() || lane.story_id;
     const attributionChanged = projectId !== lane.project_id || storyId !== lane.story_id;
     const messageId = text !== undefined || attributionChanged ? mintMessageId() : undefined;
+    let requestedMeshCompany;
+    let meshThreadId;
+    if (opts.meshCompany !== undefined) {
+        const meshCompanySlug = opts.meshCompany.trim();
+        if (!meshCompanySlug) {
+            throw new LanesError("missing_mesh_company", "--mesh-company must be a non-empty company slug", {});
+        }
+        requestedMeshCompany = await ctx.resolveCompany(meshCompanySlug);
+        if (lane.company !== null &&
+            (lane.company.uid !== requestedMeshCompany.uid || lane.company.slug !== requestedMeshCompany.slug)) {
+            throw new LanesError("mesh_company_mismatch", "--mesh-company must match the lane's company when the lane is company-owned", { company: lane.company.slug, mesh_company: requestedMeshCompany.slug });
+        }
+        meshThreadId = await ctx.mesh.ensureProjectThread(requestedMeshCompany, projectId);
+    }
+    const resumeProfile = opts.worker !== undefined
+        ? resolveResumeProfile(ctx, lane, opts.worker)
+        : undefined;
+    if (resumeProfile !== undefined && opts.account === undefined) {
+        validateResumeProfileModel(ctx, lane, resumeProfile.profile);
+    }
     let move = null;
     if (opts.account !== undefined) {
         move = await prepareAccountMove(ctx, lane, {
             account: opts.account,
             cliModel: opts.model?.trim() || undefined,
+            ...(resumeProfile !== undefined ? { workerProfile: resumeProfile.profile } : {}),
             pending: {
                 trigger: "resume",
                 resumed_from: resumedFrom,
@@ -3805,6 +3913,12 @@ async function runResume(ctx, laneId, opts) {
         });
         lane = move.lane;
     }
+    lane = recordResumeSetup(ctx, lane, {
+        ...(resumeProfile !== undefined ? { profile: resumeProfile } : {}),
+        ...(requestedMeshCompany !== undefined
+            ? { meshCompany: requestedMeshCompany, threadId: meshThreadId }
+            : {}),
+    });
     let queuedOnAdmission = false;
     let resumed;
     if (move?.queued) {
@@ -5032,7 +5146,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .requiredOption("--story <id>", "Story id from the project's prd.json")
         .option("--additional-story <id>", "Additional story carried by this lane; repeatable and discouraged when active", collectRepeatable)
         .requiredOption("--brief-file <path>", "Path to the lane brief")
-        .option("--worker <name>", "HQ worker id from the registry")
+        .option("--worker <name>", "HQ worker or reusable profile id")
         .option("--provider <name>", "claude | codex | grok")
         .option("--account <id>", "Provider account id")
         .option("--model <id>", "Model id for the provider CLI")
@@ -5183,6 +5297,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--story <id>", "Re-point story attribution from this message")
         .option("--account <id>", "Move the lane's session to this account of its provider before the message resumes it")
         .option("--model <id>", "Model for the moved lane (with --account only)")
+        .option("--worker <profile>", "Attach a personal worker profile when this message resumes the lane")
         .option("--no-compact", "Skip the resume-time compaction check for this message")
         .action(wrap(async (laneId, opts) => {
         await runMessage(ctx, laneId, opts);
@@ -5196,6 +5311,8 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--story <id>", "Re-point story attribution from this resume")
         .option("--account <id>", "Move the lane's session to this account of its provider before resuming")
         .option("--model <id>", "Model for the moved lane (with --account only)")
+        .option("--worker <profile>", "Attach a personal worker profile for the resumed turn")
+        .option("--mesh-company <slug>", "Attach Work Mesh attribution after verifying company membership")
         .option("--no-compact", "Skip the resume-time compaction check for this resume")
         .action(wrap(async (laneId, opts) => {
         await runResume(ctx, laneId, opts);

package/dist/lib/core-utils/sentry-report.d.ts

@@ -27,7 +27,7 @@ export declare const MAX_SENTRY_REPORT_METADATA_VALUE_BYTES = 256;
  * is owner-approved telemetry for the exact hook script and may include a
  * company directory; it is never a substitute for hook input or a transcript.
  */
-export declare const ALLOWED_SENTRY_REPORT_METADATA_KEYS: readonly ["hook_name", "hook_path", "hook_event", "hook_script", "tool_name", "session_id", "declared_timeout_ms", "elapsed_ms", "remaining_ms", "watchdog_timeout_ms", "hook_timeout_ms", "hq_version", "platform", "load_average", "exit_code", "final_elapsed_ms", "bash_env_set", "cwd_kind", "shell", "nproc", "hook_sequence"];
+export declare const ALLOWED_SENTRY_REPORT_METADATA_KEYS: readonly ["hook_name", "hook_path", "hook_event", "hook_script", "tool_name", "session_id", "declared_timeout_ms", "elapsed_ms", "remaining_ms", "watchdog_timeout_ms", "hook_timeout_ms", "hq_version", "platform", "load_average", "spawn_ms", "slow_child", "slow_child_ms", "exit_code", "final_elapsed_ms", "bash_env_set", "cwd_kind", "shell", "nproc", "hook_sequence"];
 export declare const MAX_SENTRY_REPORT_METADATA_KEYS: number;
 export type HookSequenceEntry = {
     script: string;