@indigoai-us/hq-cli 5.166.0 → 5.167.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.167.0] — 2026-09-24
+
+### Fixed
+
+- `hq lanes stop` sends Outpost-hosted stops to the owning host and updates the
+  local record after confirmation. If the Outpost already finished the lane,
+  the CLI syncs its terminal state.
+- Story updates, reparenting, admission, question creation, and active answer
+  delivery return `lane_remote` when another host owns the lane. Message, resume,
+  and move keep their Outpost dispatch paths.
+
 ## [5.166.0] — 2026-09-24
 
 ### Changed

package/dist/commands/lanes.js

@@ -23,7 +23,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, withLaneAdmissionLock, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, withLaneAdmissionLock, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
@@ -1119,7 +1119,7 @@ async function assessLaneAdmission(ctx, lane, options) {
     return admission;
 }
 function assertLaneRunsHereForAdmission(ctx, lane) {
-    if (laneRunsHere(lane, reconcileHostFromCtx(ctx)))
+    if (laneRunsHereForOperatorMutation(ctx, lane))
         return;
     throw new LanesError("lane_remote", `Lane ${lane.lane_id} is hosted remotely; run the admission command on its Outpost`, { lane_id: lane.lane_id, host: lane.host });
 }
@@ -2382,6 +2382,16 @@ function laneIsHostedHere(ctx, lane) {
     }
     return identity.kind === "id" && identity.id === lane.host.id;
 }
+function laneRunsHereForOperatorMutation(ctx, lane) {
+    if (lane.host.kind === "outpost")
+        return laneIsHostedHere(ctx, lane);
+    return laneRunsHere(lane, reconcileHostFromCtx(ctx));
+}
+function assertLaneRunsHereForOperatorMutation(ctx, lane, action) {
+    if (laneRunsHereForOperatorMutation(ctx, lane))
+        return;
+    throw new LanesError("lane_remote", `Cannot ${action} lane ${lane.lane_id} from this host; its state is owned by ${lane.host.kind}:${lane.host.id}`, { lane_id: lane.lane_id, host: lane.host, action });
+}
 async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
     if (lane.host.kind !== "outpost") {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch to`, { lane_id: lane.lane_id });
@@ -2896,8 +2906,7 @@ async function runMove(ctx, laneId, opts) {
         moved = await dispatchRemoteLaneMove(ctx, source, choice.host, choice.account);
     }
     else {
-        const currentHost = laneHostFromCtx(ctx);
-        throw new LanesError("lane_move_wrong_host", `Move lane ${laneId} from its current host (${source.host.kind}:${source.host.id})`, { lane_id: laneId, lane_host: source.host, current_host: currentHost });
+        throw new LanesError("lane_remote", `Cannot move lane ${laneId} from this host; its state is owned by ${source.host.kind}:${source.host.id}`, { lane_id: laneId, host: source.host, action: "move" });
     }
     printJson({
         ok: true,
@@ -2912,12 +2921,8 @@ async function runMove(ctx, laneId, opts) {
 async function commitLaneMove(ctx, laneId, target, account) {
     assertPlacementEnabled(ctx);
     const hqRoot = ctx.hqRoot();
-    const sourceHost = laneHostFromCtx(ctx);
-    const admissionHost = reconcileHostFromCtx(ctx);
     const before = readLane(hqRoot, laneId);
-    if (!laneRunsHere(before, admissionHost)) {
-        throw new LanesError("lane_move_wrong_host", `Move lane ${laneId} from its current host (${before.host.kind}:${before.host.id})`, { lane_id: laneId, lane_host: before.host, current_host: sourceHost });
-    }
+    assertLaneRunsHereForOperatorMutation(ctx, before, "move-target");
     if (before.host.kind === target.kind && before.host.id === target.id) {
         throw new LanesError("lane_move_same_host", `Lane ${laneId} is already on ${target.kind}:${target.id}`, {
             lane_id: laneId,
@@ -2971,12 +2976,7 @@ async function commitLaneMove(ctx, laneId, target, account) {
     const timeout = target.kind === "outpost" ? readLaneTimeout(hqRoot, laneId) : undefined;
     const moved = await withLaneAdmissionLock(hqRoot, before.provider, async () => {
         const current = readLane(hqRoot, laneId);
-        if (!laneRunsHere(current, admissionHost)) {
-            throw new LanesError("lane_move_conflict", `Lane ${laneId} changed hosts before the move`, {
-                lane_id: laneId,
-                host: current.host,
-            });
-        }
+        assertLaneRunsHereForOperatorMutation(ctx, current, "move-target");
         if (!laneCanMoveBeforeStart(current)) {
             throw new LanesError(current.state === "queued" ? "lane_move_started" : "lane_not_queued", `Lane ${laneId} started before the move could commit`, { lane_id: laneId, state: current.state });
         }
@@ -3216,17 +3216,15 @@ async function runAdmit(ctx, laneId, opts) {
             state: lane.state,
         });
     }
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "admit");
     const host = reconcileHostFromCtx(ctx);
-    if (!laneRunsHere(lane, host)) {
-        printJson({ ok: true, action: "admit", lane_id: laneId, admitted: false, blocked_by: "remote", lane });
-        return;
-    }
     if (lane.pickup_validation_pending === true) {
         printJson({ ok: true, action: "admit", lane_id: laneId, admitted: false, blocked_by: "pickup_validation", lane });
         return;
     }
     await withLaneAdmissionLock(hqRoot, lane.provider, async () => {
         lane = readLane(hqRoot, laneId);
+        assertLaneRunsHereForOperatorMutation(ctx, lane, "admit");
         if (lane.state !== "queued") {
             throw new LanesError("lane_not_queued", `Lane ${laneId} changed to ${lane.state} before admission`, {
                 lane_id: laneId,
@@ -3572,6 +3570,7 @@ async function runMessage(ctx, laneId, opts) {
         await dispatchOutpostLaneCommand(ctx, lane, "message", opts);
         return;
     }
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "message");
     lane = laneWithRecoveredProviderSession(hqRoot, lane);
     // An account move is refused on its own terms first: a running lane and a
     // provider without session resume get the move's named errors, not the
@@ -3847,6 +3846,7 @@ async function runResume(ctx, laneId, opts) {
         await dispatchOutpostLaneCommand(ctx, lane, "resume", opts);
         return;
     }
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "resume");
     lane = laneWithRecoveredProviderSession(hqRoot, lane);
     if (opts.model !== undefined && opts.account === undefined) {
         throw new LanesError("model_requires_account", "--model on hq lanes resume is only accepted together with --account", {});
@@ -4223,6 +4223,7 @@ async function runStoryList(ctx, laneId) {
 async function runStoryAdd(ctx, laneId, storyId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "update story status for");
     const projectId = opts.project?.trim() || lane.project_id;
     if (!projectId)
         throw new LanesError("missing_project", "--project is required", {});
@@ -4232,7 +4233,10 @@ async function runStoryAdd(ctx, laneId, storyId, opts) {
     const at = ctx.now().toISOString();
     lane = await ensureStoryThread(ctx, lane, projectId);
     const before = lane;
-    const next = casUpdateLane(hqRoot, laneId, (current) => addCarriedStory(current, projectId, normalizedStoryId, at));
+    const next = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "update story status for");
+        return addCarriedStory(current, projectId, normalizedStoryId, at);
+    });
     await commitStoryTransition(ctx, before, next, projectId, normalizedStoryId, "lane_started", "in_progress");
     const finalLane = readLane(hqRoot, laneId);
     printJson({
@@ -4249,6 +4253,7 @@ async function runStoryAdd(ctx, laneId, storyId, opts) {
 async function runStoryStart(ctx, laneId, storyId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "update story status for");
     const target = storyCommandTarget(lane, storyId, opts.project);
     if (target.story.status === "done") {
         throw new LanesError("story_already_done", `Story ${target.projectId}/${target.storyId} is done and cannot be started again`, {
@@ -4260,7 +4265,10 @@ async function runStoryStart(ctx, laneId, storyId, opts) {
     const at = ctx.now().toISOString();
     lane = await ensureStoryThread(ctx, lane, target.projectId);
     const before = lane;
-    const next = casUpdateLane(hqRoot, laneId, (current) => updateCarriedStory(current, target.projectId, target.storyId, "in_progress", at));
+    const next = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "update story status for");
+        return updateCarriedStory(current, target.projectId, target.storyId, "in_progress", at);
+    });
     await commitStoryTransition(ctx, before, next, target.projectId, target.storyId, "lane_started", "in_progress");
     const finalLane = readLane(hqRoot, laneId);
     printJson({ ok: true, action: "story.start", lane_id: laneId, project_id: target.projectId, story_id: target.storyId, status: "in_progress", story_warning: storyWarning(finalLane) ?? null, lane: finalLane });
@@ -4268,6 +4276,7 @@ async function runStoryStart(ctx, laneId, storyId, opts) {
 async function runStoryBlock(ctx, laneId, storyId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "update story status for");
     const target = storyCommandTarget(lane, storyId, opts.project);
     if (target.story.status === "done") {
         throw new LanesError("story_already_done", `Story ${target.projectId}/${target.storyId} is done and cannot be blocked again`, {
@@ -4282,7 +4291,10 @@ async function runStoryBlock(ctx, laneId, storyId, opts) {
     const at = ctx.now().toISOString();
     lane = await ensureStoryThread(ctx, lane, target.projectId);
     const before = lane;
-    const next = casUpdateLane(hqRoot, laneId, (current) => updateCarriedStory(current, target.projectId, target.storyId, "blocked", at, { blocked_reason: reason }));
+    const next = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "update story status for");
+        return updateCarriedStory(current, target.projectId, target.storyId, "blocked", at, { blocked_reason: reason });
+    });
     await commitStoryTransition(ctx, before, next, target.projectId, target.storyId, "lane_blocked", "blocked", { blocked_reason: reason });
     const finalLane = readLane(hqRoot, laneId);
     printJson({ ok: true, action: "story.block", lane_id: laneId, project_id: target.projectId, story_id: target.storyId, status: "blocked", blocked_reason: reason, story_warning: storyWarning(finalLane) ?? null, lane: finalLane });
@@ -4290,6 +4302,7 @@ async function runStoryBlock(ctx, laneId, storyId, opts) {
 async function runStoryDone(ctx, laneId, storyId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "update story status for");
     if (!opts.verified) {
         throw new LanesError("senior_verification_required", "Only a senior may mark a story done; pass --verified after reviewing or merging it", { lane_id: laneId });
     }
@@ -4311,10 +4324,13 @@ async function runStoryDone(ctx, laneId, storyId, opts) {
     const at = ctx.now().toISOString();
     lane = await ensureStoryThread(ctx, lane, target.projectId);
     const before = lane;
-    const next = casUpdateLane(hqRoot, laneId, (current) => updateCarriedStory(current, target.projectId, target.storyId, "done", at, {
-        verified_at: at,
-        verified_by: current.senior,
-    }));
+    const next = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "update story status for");
+        return updateCarriedStory(current, target.projectId, target.storyId, "done", at, {
+            verified_at: at,
+            verified_by: current.senior,
+        });
+    });
     await commitStoryTransition(ctx, before, next, target.projectId, target.storyId, "lane_done", "done", { summary: "Senior verification complete" });
     const finalLane = readLane(hqRoot, laneId);
     printJson({ ok: true, action: "story.done", lane_id: laneId, project_id: target.projectId, story_id: target.storyId, status: "done", verified: true, story_warning: storyWarning(finalLane) ?? null, lane: finalLane });
@@ -4354,6 +4370,7 @@ async function runReparent(ctx, laneId, opts) {
     const nextSenior = parseSeniorRef(opts.senior);
     assertSeniorExists(hqRoot, nextSenior, ctx);
     const lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "reparent");
     if (isTerminalLaneState(lane.state)) {
         throw new LanesError("lane_terminal", `Cannot re-parent a lane in terminal state ${lane.state}`, { lane_id: laneId, state: lane.state });
     }
@@ -4378,6 +4395,7 @@ async function runReparent(ctx, laneId, opts) {
             continue;
         if (!walkHitsLane(hqRoot, other.senior, laneId, ctx))
             continue;
+        assertLaneRunsHereForOperatorMutation(ctx, other, "reparent descendant of");
         const oldDescendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx);
         const descendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx, override);
         if (descendantDepth > MAX_LANE_DEPTH) {
@@ -4395,6 +4413,7 @@ async function runReparent(ctx, laneId, opts) {
     }
     const at = ctx.now().toISOString();
     const updated = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "reparent");
         const already = current.senior_history.some((entry) => entry.at === at && entry.reason === (opts.reason ?? "reparent"));
         if (already && current.depth === newDepth)
             return current;
@@ -4413,6 +4432,7 @@ async function runReparent(ctx, laneId, opts) {
     });
     for (const descendant of descendants) {
         casUpdateLane(hqRoot, descendant.laneId, (current) => {
+            assertLaneRunsHereForOperatorMutation(ctx, current, "reparent descendant of");
             if (current.depth === descendant.depth)
                 return current;
             return { ...current, depth: descendant.depth };
@@ -4487,14 +4507,226 @@ async function runLogs(ctx, laneId, opts) {
 export function stopCommittedState(state) {
     return state === "queued" ? "cancelled" : "killed";
 }
+function parseConfirmedOutpostStopLane(raw, laneId, outpostId, commandId) {
+    let remoteLane;
+    try {
+        remoteLane = parseLaneRecord(raw);
+    }
+    catch (err) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned an invalid lane snapshot for stop ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: commandId,
+            cause: err instanceof Error ? err.message : String(err),
+        });
+    }
+    if (remoteLane.lane_id !== laneId ||
+        remoteLane.host.kind !== "outpost" ||
+        remoteLane.host.id !== outpostId ||
+        !isTerminalLaneState(remoteLane.state)) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return its terminal lane ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: commandId,
+            owner_lane_id: remoteLane.lane_id,
+            owner_host: remoteLane.host,
+            owner_state: remoteLane.state,
+        });
+    }
+    return remoteLane;
+}
+function parseRemoteCancelledQuestionIds(value, laneId, outpostId, commandId) {
+    if (!Array.isArray(value) ||
+        value.some((id) => typeof id !== "string" || id.trim() === "") ||
+        new Set(value).size !== value.length) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned invalid cancelled question ids for lane ${laneId}`, { lane_id: laneId, outpost_id: outpostId, command_id: commandId });
+    }
+    return value;
+}
+async function readOutpostTerminalLane(ctx, laneId, outpostId, stopCommandId) {
+    let dispatched;
+    try {
+        dispatched = await ctx.dispatchOutpostExec({
+            outpostId,
+            command: buildOutpostLaneCommand({ action: "show", laneId }),
+            timeoutSeconds: 120,
+            waitMs: 120_000,
+        });
+    }
+    catch (err) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Could not read terminal lane ${laneId} from Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: null,
+        });
+    }
+    const commandId = dispatched.commandId?.trim();
+    if (dispatched.done !== true ||
+        !commandId ||
+        dispatched.status !== "Success" ||
+        dispatched.exitCode !== 0) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not confirm a lane read after stop ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: commandId || null,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+        });
+    }
+    let remote;
+    try {
+        remote = parseRemoteJson(dispatched.stdout, "Outpost lane show");
+    }
+    catch (err) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned an invalid lane read after stop ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: commandId,
+            cause: err instanceof Error ? err.message : String(err),
+        });
+    }
+    if (remote?.ok !== true || remote.action !== "show") {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return lane ${laneId} after stop`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: commandId,
+        });
+    }
+    return {
+        lane: parseConfirmedOutpostStopLane(remote.lane, laneId, outpostId, commandId),
+        commandId,
+    };
+}
+async function dispatchOutpostLaneStop(ctx, lane) {
+    if (lane.host.kind !== "outpost") {
+        throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch stop to`, { lane_id: lane.lane_id });
+    }
+    const outpostId = lane.host.id;
+    let dispatched;
+    try {
+        dispatched = await ctx.dispatchOutpostExec({
+            outpostId,
+            command: buildOutpostLaneCommand({ action: "stop", laneId: lane.lane_id }),
+            timeoutSeconds: 120,
+            waitMs: 120_000,
+        });
+    }
+    catch (err) {
+        throw new LanesError("outpost_dispatch_failed", `Could not dispatch stop for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
+    }
+    const commandId = dispatched.commandId?.trim();
+    if (dispatched.done !== true || !commandId) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return a completed stop command for lane ${lane.lane_id}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: commandId || null,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+        });
+    }
+    const remote = parseRemoteJson(dispatched.stdout, "Outpost lane stop");
+    let state;
+    let alreadyTerminal = false;
+    let ownerLane;
+    let cancelledQuestions;
+    let syncCommandId;
+    if (remote?.error === "already_terminal") {
+        if (remote.lane_id !== lane.lane_id ||
+            !isTerminalLaneState(remote.state) ||
+            (dispatched.status !== "Success" && dispatched.status !== "Failed") ||
+            dispatched.exitCode === null ||
+            dispatched.exitCode === 0) {
+            throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned an invalid already-terminal result for lane ${lane.lane_id}`, { lane_id: lane.lane_id, outpost_id: outpostId, command_id: commandId });
+        }
+        state = remote.state;
+        alreadyTerminal = true;
+        const owner = await readOutpostTerminalLane(ctx, lane.lane_id, outpostId, commandId);
+        if (owner.lane.state !== state) {
+            throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned a different terminal state for lane ${lane.lane_id}`, {
+                lane_id: lane.lane_id,
+                outpost_id: outpostId,
+                command_id: commandId,
+                sync_command_id: owner.commandId,
+                stop_state: state,
+                owner_state: owner.lane.state,
+            });
+        }
+        ownerLane = owner.lane;
+        cancelledQuestions = [];
+        syncCommandId = owner.commandId;
+    }
+    else if (remote?.error !== undefined) {
+        throw new LanesError("outpost_remote_command_failed", typeof remote.message === "string"
+            ? remote.message
+            : `Outpost ${outpostId} rejected the stop command for lane ${lane.lane_id}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: commandId,
+            remote_error: remote.error,
+        });
+    }
+    else {
+        const remoteLane = remote?.lane;
+        const remoteLaneRecord = remoteLane !== null &&
+            typeof remoteLane === "object" &&
+            !Array.isArray(remoteLane)
+            ? remoteLane
+            : null;
+        if (dispatched.status !== "Success" ||
+            dispatched.exitCode !== 0 ||
+            remote?.ok !== true ||
+            remote.action !== "stop" ||
+            remoteLaneRecord?.lane_id !== lane.lane_id ||
+            (remoteLaneRecord.state !== "cancelled" && remoteLaneRecord.state !== "killed")) {
+            throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without confirming the stop for lane ${lane.lane_id}`, {
+                lane_id: lane.lane_id,
+                outpost_id: outpostId,
+                command_id: commandId,
+                status: dispatched.status,
+                exit_code: dispatched.exitCode,
+            });
+        }
+        ownerLane = parseConfirmedOutpostStopLane(remoteLaneRecord, lane.lane_id, outpostId, commandId);
+        state = ownerLane.state;
+        cancelledQuestions = parseRemoteCancelledQuestionIds(remote.cancelled_questions, lane.lane_id, outpostId, commandId);
+    }
+    const updated = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, ownerLane);
+    printJson({
+        ok: true,
+        action: "stop",
+        lane: updated,
+        cancelled_questions: cancelledQuestions,
+        outpost_id: outpostId,
+        outpost_command_id: commandId,
+        ...(syncCommandId ? { outpost_sync_command_id: syncCommandId } : {}),
+        outpost_result: {
+            state,
+            already_terminal: alreadyTerminal,
+            status: dispatched.status,
+            exit_code: dispatched.exitCode,
+        },
+    });
+}
 async function runStop(ctx, laneId) {
     const hqRoot = ctx.hqRoot();
     const lane = readLane(hqRoot, laneId);
+    if (lane.host.kind === "outpost" && !laneRunsHereForOperatorMutation(ctx, lane)) {
+        await dispatchOutpostLaneStop(ctx, lane);
+        return;
+    }
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "stop");
     if (isTerminalLaneState(lane.state)) {
         throw new LanesError("already_terminal", `Lane ${laneId} is already ${lane.state}`, { lane_id: laneId, state: lane.state });
     }
     const at = ctx.now().toISOString();
     const updated = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "stop");
         if (isTerminalLaneState(current.state)) {
             throw new LanesError("already_terminal", `Lane ${laneId} is already ${current.state}`, { lane_id: laneId, state: current.state });
         }
@@ -4531,6 +4763,7 @@ async function runAsk(ctx, opts) {
         throw new LanesError("missing_question", "--question is required", {});
     }
     const lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "ask");
     const optionList = Array.isArray(opts.option)
         ? opts.option
         : opts.option
@@ -4659,6 +4892,10 @@ async function runQuestionsAnswer(ctx, questionId, opts) {
     const question = readQuestion(hqRoot, questionId);
     throwIfQuestionNotPending(question);
     await yieldEventLoop();
+    const askingLane = readLane(hqRoot, laneIdForAnswerDelivery(question));
+    if (laneAcceptsDropboxDelivery(askingLane)) {
+        assertLaneRunsHereForOperatorMutation(ctx, askingLane, "deliver an answer to");
+    }
     const body = requireQuestionBody(hqRoot, question);
     // A trimmed-empty --freeform is absent: it must not win over --choice and
     // must not become a freeform answer of "".
@@ -4700,7 +4937,7 @@ async function runQuestionsAnswer(ctx, questionId, opts) {
             },
         };
     });
-    const delivery = deliverAnswerToAskingLane(hqRoot, updated, choice, at);
+    const delivery = deliverAnswerToAskingLane(ctx, updated, choice, at);
     printJson({
         ok: true,
         action: "questions.answer",
@@ -4729,13 +4966,15 @@ function writeAnswerDeliveryFailed(hqRoot, laneId, questionId, err, at) {
  * Record is already durable. Delivery is best-effort onto the asking lane's
  * drop box (spec §6.5). Target is question.lane_id, never a project/story lookup.
  */
-function deliverAnswerToAskingLane(hqRoot, question, choice, at) {
+function deliverAnswerToAskingLane(ctx, question, choice, at) {
+    const hqRoot = ctx.hqRoot();
     const laneId = laneIdForAnswerDelivery(question);
     try {
         const lane = readLane(hqRoot, laneId);
         if (!laneAcceptsDropboxDelivery(lane)) {
             return { status: "recorded_only" };
         }
+        assertLaneRunsHereForOperatorMutation(ctx, lane, "deliver an answer to");
         appendDropboxMessage(hqRoot, laneId, answerDropboxMessage(question, choice, at, mintMessageId()));
         return { status: "dropped" };
     }

package/dist/lib/lanes/index.d.ts

@@ -16,7 +16,7 @@ export { resolveLanesHqRoot } from "./hq-root.js";
 export type { LanesHqRootOpts } from "./hq-root.js";
 export { buildOutpostPickupCommand, parseOutpostPickupPayload, } from "./outpost-dispatch.js";
 export type { OutpostDispatchResult, OutpostPickupPayload, } from "./outpost-dispatch.js";
-export { LANES_STORE_REL, LANE_RECORDS_DIR, PENDING_INDEX_DIR, QUESTION_RECORDS_DIR, appendCappedHistory, appendLaneAttribution, appendLaneSeniorHistory, appendQuestionRouting, createLane, createQuestion, isConflictSidecarName, laneRecordPath, lanesStoreRoot, listLaneIds, listQuestionIds, mergeLaneRecords, mergeQuestionRecords, mintLaneId, mintQuestionId, parseLaneRecord, parseQuestionRecord, pendingMarkerPath, questionRecordPath, readLane, readQuestion, resolveStoreHqRoot, sanitizeHostComponent, tryReadLane, tryReadQuestion, retryUpdateLane, retryUpdateQuestion, updateLane, updateQuestion, } from "./store.js";
+export { LANES_STORE_REL, LANE_RECORDS_DIR, PENDING_INDEX_DIR, QUESTION_RECORDS_DIR, appendCappedHistory, appendLaneAttribution, appendLaneSeniorHistory, appendQuestionRouting, createLane, createQuestion, isConflictSidecarName, laneRecordPath, lanesStoreRoot, listLaneIds, listQuestionIds, mergeLaneRecords, mergeQuestionRecords, mintLaneId, mintQuestionId, parseLaneRecord, parseQuestionRecord, pendingMarkerPath, questionRecordPath, readLane, readQuestion, resolveStoreHqRoot, sanitizeHostComponent, tryReadLane, tryReadQuestion, retryUpdateLane, retryUpdateQuestion, syncLaneRecordFromOwner, updateLane, updateQuestion, } from "./store.js";
 export type { StoreDeps } from "./store.js";
 export { DEFAULT_LANE_WATCH_INTERVAL_MS, MAX_LANE_WATCH_INTERVAL_MS, MAX_WATCHED_LANES, MAX_WATCH_OUTPUT_LINES, runLaneWatch, } from "./watch.js";
 export type { LaneWatchDeps, LaneWatchResult } from "./watch.js";

package/dist/lib/lanes/index.js

@@ -10,7 +10,7 @@ export { ACTIVE_LANE_STORY_STATUSES, activeLaneStories, laneStories, laneStory,
 export { DEFAULT_ACCOUNT_HOMES, DEFAULT_AUTO_COMPACT_TOKENS, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerAutoCompactTokens, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";
 export { resolveLanesHqRoot } from "./hq-root.js";
 export { buildOutpostPickupCommand, parseOutpostPickupPayload, } from "./outpost-dispatch.js";
-export { LANES_STORE_REL, LANE_RECORDS_DIR, PENDING_INDEX_DIR, QUESTION_RECORDS_DIR, appendCappedHistory, appendLaneAttribution, appendLaneSeniorHistory, appendQuestionRouting, createLane, createQuestion, isConflictSidecarName, laneRecordPath, lanesStoreRoot, listLaneIds, listQuestionIds, mergeLaneRecords, mergeQuestionRecords, mintLaneId, mintQuestionId, parseLaneRecord, parseQuestionRecord, pendingMarkerPath, questionRecordPath, readLane, readQuestion, resolveStoreHqRoot, sanitizeHostComponent, tryReadLane, tryReadQuestion, retryUpdateLane, retryUpdateQuestion, updateLane, updateQuestion, } from "./store.js";
+export { LANES_STORE_REL, LANE_RECORDS_DIR, PENDING_INDEX_DIR, QUESTION_RECORDS_DIR, appendCappedHistory, appendLaneAttribution, appendLaneSeniorHistory, appendQuestionRouting, createLane, createQuestion, isConflictSidecarName, laneRecordPath, lanesStoreRoot, listLaneIds, listQuestionIds, mergeLaneRecords, mergeQuestionRecords, mintLaneId, mintQuestionId, parseLaneRecord, parseQuestionRecord, pendingMarkerPath, questionRecordPath, readLane, readQuestion, resolveStoreHqRoot, sanitizeHostComponent, tryReadLane, tryReadQuestion, retryUpdateLane, retryUpdateQuestion, syncLaneRecordFromOwner, updateLane, updateQuestion, } from "./store.js";
 export { DEFAULT_LANE_WATCH_INTERVAL_MS, MAX_LANE_WATCH_INTERVAL_MS, MAX_WATCHED_LANES, MAX_WATCH_OUTPUT_LINES, runLaneWatch, } from "./watch.js";
 export { MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_TASK_OUTPUT_MAX_BYTES, MONITOR_TRANSCRIPT_MAX_BYTES, MONITOR_UNCOVERED_EXIT_CODE, coveredLaneIds, isMonitorTaskLive, monitorReminderText, parseCanonicalWatchCommand, parseMonitorTranscript, readLiveMonitorEvidence, } from "./monitor.js";
 export { IMDS_HOST, IMDS_INSTANCE_ID_URL, IMDS_TIMEOUT_MS, IMDS_TOKEN_URL, defaultReadImdsInstanceId, resolveMachineIdentity, } from "./machine-identity.js";

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -27,7 +27,7 @@ export interface OutpostDispatchResult {
     stderr: string;
 }
 export interface OutpostLaneCommand {
-    action: "message" | "resume";
+    action: "message" | "resume" | "stop" | "show";
     laneId: string;
     text?: string;
     project?: string;

package/dist/lib/lanes/store.d.ts

@@ -54,6 +54,12 @@ export declare function tryReadQuestion(hqRoot: string, questionId: string, deps
 export declare function readQuestion(hqRoot: string, questionId: string, deps?: StoreDeps): QuestionRecord;
 export declare function createLane(hqRoot: string, init: Omit<LaneRecord, "schema_version" | "lane_id" | "version" | "created_at" | "updated_at"> & Partial<Pick<LaneRecord, "schema_version" | "lane_id" | "version" | "created_at" | "updated_at">>, deps?: StoreDeps): LaneRecord;
 export declare function updateLane(hqRoot: string, laneId: string, expectedVersion: number, writer: LaneWriter, updater: (current: LaneRecord) => LaneRecord, deps?: StoreDeps): LaneRecord;
+/**
+ * Replace the primary copy with a terminal snapshot returned by the Outpost
+ * that owns the lane. The owner is authoritative on equal versions; a newer
+ * primary version is a conflict and must not be overwritten.
+ */
+export declare function syncLaneRecordFromOwner(hqRoot: string, laneId: string, outpostId: string, rawOwnerLane: unknown, deps?: StoreDeps): LaneRecord;
 /** Compare-and-set with conflict retry. Callers that race a concurrent writer re-read. */
 export declare function retryUpdateLane(hqRoot: string, laneId: string, writer: LaneWriter, updater: (current: LaneRecord) => LaneRecord, deps?: StoreDeps, attempts?: number): LaneRecord;
 /** Compare-and-set with conflict retry for question records (spec §6.2). */

package/dist/lib/lanes/store.js

@@ -13,7 +13,7 @@ import * as path from "node:path";
 import { generateUlid } from "../mesh/live/ulid.js";
 import { resolveLanesHqRoot } from "./hq-root.js";
 import { LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesError, isLaneVersionConflict, } from "./errors.js";
-import { HISTORY_CAP, HOST_KINDS, LANE_STORY_STATUSES, LANE_SCHEMA_VERSION, QUESTION_SCHEMA_VERSION, SENIOR_KINDS, isHostKind, isLaneProvider, isQueuedReason, isLaneState, isQuestionStatus, isSeniorKind, parseMajorSchema, REQUIRED_LANE_RECORD_FIELDS, LANE_FIELD_WRITERS, LANE_WRITERS, } from "./types.js";
+import { HISTORY_CAP, HOST_KINDS, LANE_STORY_STATUSES, LANE_SCHEMA_VERSION, QUESTION_SCHEMA_VERSION, SENIOR_KINDS, isHostKind, isLaneProvider, isQueuedReason, isLaneState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseMajorSchema, REQUIRED_LANE_RECORD_FIELDS, LANE_FIELD_WRITERS, LANE_WRITERS, } from "./types.js";
 import { laneStories } from "./stories.js";
 export const LANES_STORE_REL = path.join("workspace", "lanes");
 export const LANE_RECORDS_DIR = "lanes";
@@ -810,6 +810,71 @@ export function updateLane(hqRoot, laneId, expectedVersion, writer, updater, dep
         return updated;
     }, deps);
 }
+/**
+ * Replace the primary copy with a terminal snapshot returned by the Outpost
+ * that owns the lane. The owner is authoritative on equal versions; a newer
+ * primary version is a conflict and must not be overwritten.
+ */
+export function syncLaneRecordFromOwner(hqRoot, laneId, outpostId, rawOwnerLane, deps = defaultStoreDeps()) {
+    let ownerLane;
+    try {
+        ownerLane = parseLaneRecord(rawOwnerLane);
+    }
+    catch (err) {
+        throw new LanesError("outpost_lane_sync_invalid", `Outpost ${outpostId} returned an invalid lane snapshot for ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            cause: err instanceof Error ? err.message : String(err),
+        });
+    }
+    if (ownerLane.lane_id !== laneId ||
+        ownerLane.host.kind !== "outpost" ||
+        ownerLane.host.id !== outpostId ||
+        !isTerminalLaneState(ownerLane.state)) {
+        throw new LanesError("outpost_lane_sync_invalid", `Outpost ${outpostId} did not return its terminal record for lane ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            owner_lane_id: ownerLane.lane_id,
+            owner_host: ownerLane.host,
+            owner_state: ownerLane.state,
+        });
+    }
+    const filePath = laneRecordPath(hqRoot, laneId);
+    return withRecordLock(filePath, deps, () => {
+        const current = readMergedRecord(filePath, parseLaneRecord, mergeLaneRecords, deps);
+        if (current === null) {
+            throw new LaneSchemaError(`Record disappeared under lock: ${filePath}`, {
+                path: filePath,
+            });
+        }
+        if (current.lane_id !== laneId ||
+            current.host.kind !== "outpost" ||
+            current.host.id !== outpostId) {
+            throw new LanesError("outpost_lane_sync_conflict", `Primary lane ${laneId} is no longer owned by Outpost ${outpostId}`, {
+                lane_id: laneId,
+                outpost_id: outpostId,
+                current_lane_id: current.lane_id,
+                current_host: current.host,
+            });
+        }
+        if (ownerLane.version < current.version) {
+            throw new LanesError("outpost_lane_sync_conflict", `Outpost ${outpostId} returned lane ${laneId} at version ${ownerLane.version}, behind primary version ${current.version}`, {
+                lane_id: laneId,
+                outpost_id: outpostId,
+                owner_version: ownerLane.version,
+                primary_version: current.version,
+            });
+        }
+        const ownerSnapshot = ownerLane.outpost_command_id === undefined &&
+            current.outpost_command_id !== undefined
+            ? { ...ownerLane, outpost_command_id: current.outpost_command_id }
+            : ownerLane;
+        const synced = mergeLaneRecords(ownerSnapshot, [current]);
+        parseLaneRecord(synced, filePath);
+        atomicWriteJson(filePath, synced, deps);
+        return synced;
+    });
+}
 /** Compare-and-set with conflict retry. Callers that race a concurrent writer re-read. */
 export function retryUpdateLane(hqRoot, laneId, writer, updater, deps = defaultStoreDeps(), attempts = 5) {
     let last;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.166.0",
+  "version": "5.167.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {