@indigoai-us/hq-cli 5.188.0 → 5.189.0

package/dist/commands/lanes.js

@@ -13,12 +13,14 @@ import * as path from "node:path";
 import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
+import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
 export { LANE_HIRE_GRANTS_FLAG };
-import { buildOutpostCapacityCommand, buildOutpostBalanceMoveCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostMoveTargetCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
+import { buildOutpostCapacityCommand, buildOutpostBalanceMoveCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostMoveTargetCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, outpostRejectedEffortOption, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
 import { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "../lib/lanes/host-capacity.js";
 import { BALANCE_MOVABLE_STATES, CLAUDE_ACCOUNT_BALANCE_FLAG, accountLoadsForReport, assertBalanceApplyEnabled, planClaudeBalanceMoves, selectClaudeAccount, } from "../lib/lanes/claude-account-balance.js";
 import { parseUserYaml } from "../utils/user-yaml-error.js";
@@ -32,7 +34,7 @@ import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
 import { providerCompactAfterMs } from "../lib/lanes/config.js";
-import { parseCliEffort, resolveLaneEffort } from "../lib/lanes/effort.js";
+import { parseCliEffort, resolveLaneEffort, } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
 import { accountQuotaView, loadQuotaState, quotaBlockFor } from "../lib/lanes/quota.js";
 import { SESSION_MOVE_REASON } from "../lib/lanes/move-account.js";
@@ -81,7 +83,7 @@ function failJson(err) {
         if (err.error === "hire_grant_exhausted") {
             process.stderr.write(`hq lanes: ${err.message}\n`);
         }
-        printJson(err.toJSON());
+        printJson({ ...err.toJSON(), message: err.message });
         process.exit(1);
     }
     const message = err instanceof Error ? err.message : String(err);
@@ -255,6 +257,8 @@ function resolveDeps(deps = {}) {
         fetchText: deps.fetchText ?? defaultFetchText,
         lanePlacementEnabled: deps.lanePlacementEnabled ?? defaultLanePlacementEnabled,
         laneHireGrantsEnabled: deps.laneHireGrantsEnabled ?? defaultLaneHireGrantsEnabled,
+        isSsmOwnerDispatch: deps.isSsmOwnerDispatch ?? (() => isSsmRunCommandProcess()),
+        withGrantHireLocks: deps.withGrantHireLocks ?? withLaneHireLocks,
         laneClaudeAccountBalanceEnabled: deps.laneClaudeAccountBalanceEnabled ?? defaultLaneClaudeAccountBalanceEnabled,
     };
 }
@@ -451,6 +455,81 @@ function laneHireFields(lane, lanes) {
         hire_summary: hireSummary,
     };
 }
+function outpostCliOverride(ctx, outpostId) {
+    const envKey = `HQ_LANES_OUTPOST_CLI_${outpostId.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
+    const configured = ctx.env[envKey];
+    const hqBinary = configured === undefined ? undefined : configured.trim();
+    if (configured !== undefined &&
+        (!hqBinary ||
+            !path.posix.isAbsolute(hqBinary) ||
+            hqBinary.includes("\0") ||
+            hqBinary.includes("\r") ||
+            hqBinary.includes("\n"))) {
+        throw new LanesError("outpost_lane_cli_invalid", `${envKey} must be an absolute remote executable path`, { outpost_id: outpostId });
+    }
+    return hqBinary;
+}
+function safeOwnerErrorValue(value, key = "") {
+    if (/(?:env|environment|token|secret|password|credential|authorization|api[_-]?key|access[_-]?key|private[_-]?key)/i.test(key)) {
+        return undefined;
+    }
+    if (typeof value === "string") {
+        return value
+            .replace(/\b(Bearer|Basic)\s+[^\s,;]+/gi, "$1 [redacted]")
+            .replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16})\b/g, "[redacted]")
+            .replace(/\b["']?([A-Z][A-Z0-9_]{1,})["']?\s*[:=]\s*["']?([^\s"',;}]+)["']?/g, "$1=[redacted]");
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => safeOwnerErrorValue(item));
+    }
+    if (value === null || typeof value !== "object")
+        return value;
+    const safe = {};
+    for (const [childKey, childValue] of Object.entries(value)) {
+        const nested = safeOwnerErrorValue(childValue, childKey);
+        if (nested !== undefined)
+            safe[childKey] = nested;
+    }
+    return safe;
+}
+function ownerErrorFromOutput(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        process.stderr.write("hq lanes: Outpost lanes dispatch returned malformed JSON\n");
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const owner = parsed;
+    if (typeof owner.error !== "string" || !/^[a-z][a-z0-9_]{0,99}$/.test(owner.error)) {
+        return undefined;
+    }
+    if (safeOwnerErrorValue(owner.error) !== owner.error)
+        return undefined;
+    if (owner.error === "already_terminal" || owner.error === "outpost_self_target") {
+        return undefined;
+    }
+    const rawDetails = {};
+    for (const [key, value] of Object.entries(owner)) {
+        if (key !== "error" && key !== "message" && key !== "details")
+            rawDetails[key] = value;
+    }
+    if (owner.details !== null && typeof owner.details === "object" && !Array.isArray(owner.details)) {
+        Object.assign(rawDetails, owner.details);
+    }
+    const details = safeOwnerErrorValue(rawDetails);
+    const message = typeof owner.message === "string" && owner.message.trim()
+        ? String(safeOwnerErrorValue(owner.message))
+        : `Outpost owner returned ${owner.error}`;
+    return { error: owner.error, message, details };
+}
 async function ownerLaneHireFields(ctx, lane) {
     if (lane.host.kind !== "outpost") {
         throw new LanesError("outpost_lane_hire_summary_invalid", "Owner summary requires an Outpost-hosted lane", {
@@ -458,17 +537,7 @@ async function ownerLaneHireFields(ctx, lane) {
         });
     }
     const outpostId = lane.host.id;
-    const outpostCliEnvKey = `HQ_LANES_OUTPOST_CLI_${outpostId.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
-    const configuredHqBinary = ctx.env[outpostCliEnvKey];
-    const hqBinary = configuredHqBinary === undefined ? undefined : configuredHqBinary.trim();
-    if (configuredHqBinary !== undefined &&
-        (!hqBinary ||
-            !path.posix.isAbsolute(hqBinary) ||
-            hqBinary.includes("\0") ||
-            hqBinary.includes("\r") ||
-            hqBinary.includes("\n"))) {
-        throw new LanesError("outpost_lane_cli_invalid", `${outpostCliEnvKey} must be an absolute remote executable path`, { outpost_id: outpostId });
-    }
+    const hqBinary = outpostCliOverride(ctx, outpostId);
     let dispatched;
     try {
         dispatched = await ctx.dispatchOutpostExec({
@@ -2783,7 +2852,8 @@ async function dispatchCreatedOutpostLane(ctx, input) {
         const staged = await ctx.stageOutpostPayload(outpostId, bytes);
         const command = buildOutpostPickupCommand(staged.getUrl);
         const dispatched = await ctx.dispatchOutpostExec({ outpostId, command });
-        if (preserveQueuedOnFailure && dispatched.done !== true) {
+        const dispatchedOwnerError = ownerErrorFromOutput(dispatched.stdout);
+        if (preserveQueuedOnFailure && dispatched.done !== true && !dispatchedOwnerError) {
             throw new LanesError("outpost_dispatch_failed", "Outpost pickup exec has not finished; its outcome is unknown", {
                 outpost_id: outpostId,
                 lane_id: lane.lane_id,
@@ -2813,6 +2883,40 @@ async function dispatchCreatedOutpostLane(ctx, input) {
             await emitLaneTerminalStateSoft(ctx, cancelled);
             return cancelled;
         }
+        const ownerError = dispatchedOwnerError;
+        if (ownerError) {
+            if (preserveQueuedOnFailure) {
+                throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected lane pickup: ${ownerError.message}`, {
+                    outpost_id: outpostId,
+                    lane_id: lane.lane_id,
+                    command_id: dispatched.commandId,
+                    status: dispatched.status,
+                    done: dispatched.done ?? false,
+                    exit_code: dispatched.exitCode,
+                    ...(remote?.pickup_persisted === false ||
+                        ownerError.details.pickup_persisted === false
+                        ? { pickup_persisted: false }
+                        : {}),
+                    owner_error: ownerError,
+                });
+            }
+            const failed = markDispatchFailure(hqRoot, lane.lane_id, {
+                outpost_id: outpostId,
+                command_id: dispatched.commandId,
+                exit_code: dispatched.exitCode,
+                status: dispatched.status,
+                owner_error: ownerError,
+            });
+            await emitLaneTerminalStateSoft(ctx, failed);
+            throw new LanesError(DISPATCH_TERMINAL_REASON, `Outpost ${outpostId} rejected lane pickup: ${ownerError.message}`, {
+                outpost_id: outpostId,
+                lane_id: failed.lane_id,
+                state: failed.state,
+                terminal_reason: DISPATCH_TERMINAL_REASON,
+                command_id: dispatched.commandId,
+                owner_error: ownerError,
+            });
+        }
         if (preserveQueuedOnFailure && remote?.pickup_persisted === false) {
             throw new LanesError("outpost_dispatch_failed", "Outpost pickup finished and reported that it did not persist the lane", {
                 outpost_id: outpostId,
@@ -2980,19 +3084,26 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch to`, { lane_id: lane.lane_id });
     }
     const outpostId = lane.host.id;
+    const grantContext = action === "grant"
+        ? createOutpostHireGrantContext(lane, loadAllLanes(ctx.hqRoot()), await ctx.laneHireGrantsEnabled(lane.company))
+        : undefined;
     let dispatched;
     try {
         dispatched = await ctx.dispatchOutpostExec({
             outpostId,
             command: buildOutpostLaneCommand({
-                action,
+                action: action === "grant" ? "grant-target" : action,
                 laneId: lane.lane_id,
+                hqBinary: action === "grant" ? outpostCliOverride(ctx, outpostId) : undefined,
                 text: options.text,
                 project: options.project,
                 story: options.story,
                 account: options.account,
                 model: options.model,
+                effort: options.effort,
+                worker: options.worker,
                 hire: options.hire,
+                grantContext,
                 compact: options.compact,
             }),
         });
@@ -3000,6 +3111,30 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
     catch (err) {
         throw new LanesError("outpost_dispatch_failed", `Could not dispatch ${action} for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (options.effort !== undefined && outpostRejectedEffortOption(dispatched)) {
+        throw new LanesError("outpost_effort_unsupported", `Outpost ${outpostId} rejected --effort; update hq-cli on that Outpost before changing a lane's effort remotely`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: dispatched.commandId,
+            effort: options.effort,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the ${action} command: ${ownerError.message}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: dispatched.commandId,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
     if (dispatched.done !== true ||
         dispatched.status !== "Success" ||
         dispatched.exitCode !== 0) {
@@ -3014,13 +3149,11 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
     }
     const remote = parseRemoteJson(dispatched.stdout, "Outpost lane command");
     if (remote?.error !== undefined) {
-        throw new LanesError("outpost_remote_command_failed", typeof remote.message === "string"
-            ? remote.message
-            : `Outpost ${outpostId} rejected the ${action} command`, {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the ${action} command`, {
             lane_id: lane.lane_id,
             outpost_id: outpostId,
             command_id: dispatched.commandId,
-            remote_error: remote.error,
+            owner_error: ownerErrorFromOutput(dispatched.stdout),
         });
     }
     const resultConfirmed = remote !== null &&
@@ -3642,6 +3775,9 @@ async function commitLaneMove(ctx, laneId, target, account) {
                 outcome: "unknown",
                 ...(commandId !== undefined ? { command_id: commandId } : {}),
                 check_command: checkCommand,
+                ...(dispatchDetails.owner_error !== undefined
+                    ? { owner_error: dispatchDetails.owner_error }
+                    : {}),
             });
         }
         let restored = false;
@@ -3682,6 +3818,9 @@ async function commitLaneMove(ctx, laneId, target, account) {
             source_host: before.host,
             target_host: target,
             source_restored: restored,
+            ...(dispatchDetails.owner_error !== undefined
+                ? { owner_error: dispatchDetails.owner_error }
+                : {}),
             ...(rollbackError !== undefined
                 ? { rollback_error: dispatchErrorMessage(rollbackError) }
                 : {}),
@@ -3711,6 +3850,18 @@ async function dispatchRemoteLaneMove(ctx, source, target, account) {
     catch (err) {
         throw new LanesError("lane_move_dispatch_failed", `Could not ask Outpost ${source.host.id} to move lane ${source.lane_id}: ${dispatchErrorMessage(err)}`, { lane_id: source.lane_id, source_outpost: source.host.id });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${source.host.id} rejected the lane move: ${ownerError.message}`, {
+            lane_id: source.lane_id,
+            source_outpost: source.host.id,
+            command_id: dispatched.commandId,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
     if (dispatched.done !== true || dispatched.status !== "Success" || dispatched.exitCode !== 0) {
         throw new LanesError("lane_move_dispatch_failed", `Outpost ${source.host.id} did not confirm the lane move`, {
             lane_id: source.lane_id,
@@ -3830,40 +3981,54 @@ function callerMatchesSenior(ctx, seniorRef) {
 function forceAdmissionAuthorized(ctx, lane) {
     return callerMatchesSenior(ctx, lane.senior);
 }
-async function runGrant(ctx, laneId, opts) {
-    if (opts.hire === undefined) {
-        throw new LanesError("missing_hire_grant", "--hire is required", {});
-    }
-    const hireGrant = parseHireGrant(opts.hire);
+async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContext) {
     const hqRoot = ctx.hqRoot();
     const initial = readLane(hqRoot, laneId);
-    if (!callerMatchesSenior(ctx, initial.senior)) {
+    if (authorization === "senior" && !callerMatchesSenior(ctx, initial.senior)) {
         throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
     }
-    if (initial.host.kind === "outpost" && !laneRunsHere(initial, reconcileHostFromCtx(ctx))) {
-        await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) });
-        return;
+    if (authorization === "ssm-owner-dispatch" &&
+        (initial.host.kind !== "outpost" || !laneIsHostedHere(ctx, initial))) {
+        throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: initial.host });
     }
-    const enforce = await ctx.laneHireGrantsEnabled(initial.company);
+    if (authorization === "ssm-owner-dispatch" &&
+        (!grantContext || !sameHireGrantSenior(initial.senior, grantContext.expected_senior))) {
+        throw new LanesError("hire_grant_senior_changed", `Lane ${laneId}'s senior changed after the primary authorized its grant update`, { lane_id: laneId, current_senior: initial.senior });
+    }
+    const enforce = grantContext?.enforcement_enabled ??
+        await ctx.laneHireGrantsEnabled(initial.company);
     const lockedLaneIds = [
         laneId,
         ...(initial.senior.kind === "lane" && initial.senior.id
             ? [initial.senior.id]
             : []),
     ];
-    const updated = withLaneHireLocks(hqRoot, lockedLaneIds, () => {
+    const updated = ctx.withGrantHireLocks(hqRoot, lockedLaneIds, () => {
         const current = readLane(hqRoot, laneId);
-        if (!callerMatchesSenior(ctx, current.senior)) {
+        if (authorization === "senior" && !callerMatchesSenior(ctx, current.senior)) {
             throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(current.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: current.senior });
         }
-        const hierarchy = loadAllLanes(hqRoot);
+        if (authorization === "ssm-owner-dispatch" &&
+            (current.host.kind !== "outpost" || !laneIsHostedHere(ctx, current))) {
+            throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: current.host });
+        }
+        if (authorization === "ssm-owner-dispatch" &&
+            (!grantContext || !sameHireGrantSenior(current.senior, grantContext.expected_senior))) {
+            throw new LanesError("hire_grant_senior_changed", `Lane ${laneId}'s senior changed before the Outpost applied the grant update`, { lane_id: laneId, current_senior: current.senior });
+        }
+        const hierarchy = grantContext?.hierarchy ?? loadAllLanes(hqRoot);
         if (enforce && current.senior.kind === "lane") {
             if (!current.senior.id) {
                 throw new LanesError("hire_grant_senior_invalid", `Lane ${laneId} has a lane senior without an id`, {
                     lane_id: laneId,
                 });
             }
-            const parent = readLane(hqRoot, current.senior.id);
+            const parent = hierarchy.find((lane) => lane.lane_id === current.senior.id);
+            if (!parent) {
+                throw new LanesError(authorization === "ssm-owner-dispatch"
+                    ? "hire_grant_context_invalid"
+                    : "hire_grant_senior_invalid", `Lane ${laneId}'s senior lane is missing from the grant hierarchy`, { lane_id: laneId, senior_lane_id: current.senior.id });
+            }
             if (isTerminalLaneState(parent.state)) {
                 throw new LanesError("hire_grant_senior_inactive", `Senior lane ${parent.lane_id} is ${parent.state} and cannot change grants`, { senior_lane_id: parent.lane_id, state: parent.state });
             }
@@ -3901,9 +4066,44 @@ async function runGrant(ctx, laneId, opts) {
             hire_grant: hireGrant,
         }));
     });
-    const fields = laneHireFields(updated, loadAllLanes(hqRoot));
+    return updated;
+}
+function printGrantResult(hqRoot, updated, hierarchy) {
+    const fields = laneHireFields(updated, hierarchy ?? loadAllLanes(hqRoot));
     printJson({ ok: true, action: "grant", lane_id: updated.lane_id, lane: updated, ...fields });
 }
+async function runGrant(ctx, laneId, opts) {
+    if (opts.hire === undefined) {
+        throw new LanesError("missing_hire_grant", "--hire is required", {});
+    }
+    const hireGrant = parseHireGrant(opts.hire);
+    const hqRoot = ctx.hqRoot();
+    const initial = readLane(hqRoot, laneId);
+    if (!callerMatchesSenior(ctx, initial.senior)) {
+        throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
+    }
+    if (initial.host.kind === "outpost" && !laneRunsHere(initial, reconcileHostFromCtx(ctx))) {
+        await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) });
+        return;
+    }
+    const updated = await applyHireGrant(ctx, laneId, hireGrant, "senior");
+    printGrantResult(hqRoot, updated);
+}
+async function runGrantOwnerTarget(ctx, laneId, opts) {
+    if (!ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("hire_grant_dispatch_unauthorized", "The Outpost grant target is available only to an SSM Run Command dispatch", { lane_id: laneId });
+    }
+    if (opts.hire === undefined) {
+        throw new LanesError("missing_hire_grant", "--hire is required", {});
+    }
+    if (opts.grantContext === undefined) {
+        throw new LanesError("hire_grant_context_invalid", "--grant-context is required", { lane_id: laneId });
+    }
+    const hireGrant = parseHireGrant(opts.hire);
+    const grantContext = parseOutpostHireGrantContext(opts.grantContext, laneId);
+    const hqRoot = ctx.hqRoot();
+    printGrantResult(hqRoot, await applyHireGrant(ctx, laneId, hireGrant, "ssm-owner-dispatch", grantContext), grantContext.hierarchy);
+}
 async function runBackfillGrants(ctx, opts) {
     if (opts.apply && opts.dryRun) {
         throw new LanesError("hire_grant_backfill_mode_conflict", "Pass either --dry-run or --apply, not both", {});
@@ -4150,34 +4350,43 @@ function validateResumeProfileModel(ctx, lane, profile) {
         env: ctx.env,
     });
 }
+function applyResumeProfileAndEffort(current, next, input) {
+    if (input.profile !== undefined) {
+        const profile = input.profile.profile;
+        next.worker = input.profile.id;
+        next.worker_path = input.profile.path;
+        next.worker_pack = input.profile.pack;
+        next.worker_profile = profile.id;
+        next.worker_profile_hash = profile.contentHash;
+        next.worker_profile_ignored = ignoredWorkerProfileFields(current.provider);
+        next.worker_policy_delivery = undefined;
+        if (next.model_source !== "cli") {
+            if (profile.meta.provider === current.provider && profile.meta.model !== undefined) {
+                next.model = profile.meta.model;
+                next.model_source = "profile";
+            }
+            else if (profile.meta.provider === current.provider) {
+                next.model = undefined;
+                next.model_source = "none";
+            }
+        }
+    }
+    if (input.effort !== undefined) {
+        next.effort = input.effort.effort;
+        next.effort_source = input.effort.source;
+    }
+}
 function recordResumeSetup(ctx, lane, input) {
-    if (input.profile === undefined && input.meshCompany === undefined)
+    if (input.profile === undefined &&
+        input.effort === undefined &&
+        input.meshCompany === undefined)
         return lane;
     return casUpdateLane(ctx.hqRoot(), lane.lane_id, (current) => {
         if (current.version !== lane.version) {
             throw new LanesError("lane_resume_setup_conflict", `Lane ${lane.lane_id} changed while resume settings were prepared; run the resume again`, { lane_id: lane.lane_id, prepared_version: lane.version, version: current.version });
         }
         const next = { ...current };
-        if (input.profile !== undefined) {
-            const profile = input.profile.profile;
-            next.worker = input.profile.id;
-            next.worker_path = input.profile.path;
-            next.worker_pack = input.profile.pack;
-            next.worker_profile = profile.id;
-            next.worker_profile_hash = profile.contentHash;
-            next.worker_profile_ignored = ignoredWorkerProfileFields(current.provider);
-            next.worker_policy_delivery = undefined;
-            if (current.model_source !== "cli") {
-                if (profile.meta.provider === current.provider && profile.meta.model !== undefined) {
-                    next.model = profile.meta.model;
-                    next.model_source = "profile";
-                }
-                else if (profile.meta.provider === current.provider) {
-                    next.model = undefined;
-                    next.model_source = "none";
-                }
-            }
-        }
+        applyResumeProfileAndEffort(current, next, input);
         if (input.meshCompany !== undefined) {
             if (current.company === null)
                 next.mesh_company = input.meshCompany;
@@ -4187,6 +4396,40 @@ function recordResumeSetup(ctx, lane, input) {
         return next;
     });
 }
+/** Resolve an explicit resume override or newly attached profile like create does. */
+function resolveResumeEffort(ctx, lane, input) {
+    if (input.cliEffort === undefined && input.profile === undefined)
+        return undefined;
+    const config = loadLanesConfig(ctx.hqRoot());
+    const providerConfig = config.providers[lane.provider];
+    const accountId = input.account?.trim() || lane.account;
+    const accountConfig = accountId === undefined
+        ? undefined
+        : providerConfig.accounts[accountId];
+    const profileDefaultsApply = input.profile?.profile.meta.provider === lane.provider;
+    const pinnedModel = lane.model_source === undefined || lane.model_source === "cli"
+        ? lane.model
+        : undefined;
+    const model = resolveLaneModel({
+        cliModel: input.model?.trim() || pinnedModel,
+        profileModel: profileDefaultsApply ? input.profile?.profile.meta.model : undefined,
+        accountModel: accountConfig?.model,
+        providerModel: providerConfig.model,
+    });
+    return resolveLaneEffort({
+        cliEffort: input.cliEffort,
+        profileEffort: profileDefaultsApply ? input.profile?.profile.meta.effort : undefined,
+        accountEffort: accountConfig?.effort,
+        providerEffort: providerConfig.effort,
+        model,
+    });
+}
+function recordedResumeEffort(lane) {
+    return {
+        ...(lane.effort !== undefined ? { effort: lane.effort } : {}),
+        source: lane.effort_source ?? "none",
+    };
+}
 /**
  * US-023: move the lane's provider session to `--account` (same provider)
  * before a resume or a message resume. Every check runs before anything is
@@ -4254,7 +4497,7 @@ async function prepareAccountMove(ctx, lane, input) {
     }).logged_in !== true) {
         throw new LanesError("account_not_logged_in", `Account ${target} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: target, lane_id: laneId });
     }
-    const profile = input.workerProfile ?? (lane.worker_profile !== undefined
+    const profile = input.workerProfile?.profile ?? (lane.worker_profile !== undefined
         ? loadWorkerProfile(hqRoot, lane.worker_profile)
         : undefined);
     const profileDefaultsApply = profile !== undefined && profile.meta.provider === lane.provider;
@@ -4356,6 +4599,10 @@ async function prepareAccountMove(ctx, lane, input) {
                     ? undefined
                     : { session_id: sessionId, at, ...input.pending },
             };
+            applyResumeProfileAndEffort(current, next, {
+                ...(input.workerProfile !== undefined ? { profile: input.workerProfile } : {}),
+                ...(input.effort !== undefined ? { effort: input.effort } : {}),
+            });
             if (input.deferTurnStart) {
                 next.state = current.state;
             }
@@ -4432,6 +4679,10 @@ async function runMessage(ctx, laneId, opts) {
         return;
     }
     assertLaneRunsHereForOperatorMutation(ctx, lane, "message");
+    const cliEffort = parseCliEffort(lane.provider, opts.effort);
+    if (cliEffort !== undefined && !providerSupportsSessionResume(lane.provider)) {
+        throw new LanesError("effort_resume_unsupported", `Provider ${lane.provider} cannot change effort on a resumed session`, { lane_id: laneId, provider: lane.provider });
+    }
     // Check before transcript recovery, account probing, or message writes.
     // The final state transition repeats this check under the senior lock.
     await withResumeHireAdmission(ctx, lane, () => undefined);
@@ -4463,12 +4714,24 @@ async function runMessage(ctx, laneId, opts) {
     if (opts.worker !== undefined && mechanism === "dropbox") {
         throw new LanesError("worker_profile_requires_resume", `Lane ${laneId} is still running; --worker can only be applied when message starts a resumed provider turn`, { lane_id: laneId, state: lane.state });
     }
+    if (cliEffort !== undefined && mechanism === "dropbox") {
+        throw new LanesError("lane_effort_requires_resume", `Lane ${laneId} is still running; --effort can only be applied when message starts a resumed provider turn`, { lane_id: laneId, state: lane.state });
+    }
     const resumeProfile = opts.worker !== undefined
         ? resolveResumeProfile(ctx, lane, opts.worker)
         : undefined;
     if (opts.model !== undefined && opts.account === undefined) {
         throw new LanesError("model_requires_account", "--model on hq lanes message is only accepted together with --account", {});
     }
+    const automaticAccountSelection = opts.account === undefined && mechanism === "resume"
+        ? await selectAutomaticClaudeResumeAccount(ctx, lane)
+        : undefined;
+    const resumeEffort = resolveResumeEffort(ctx, lane, {
+        cliEffort,
+        profile: resumeProfile,
+        account: opts.account ?? automaticAccountSelection?.account,
+        model: opts.model,
+    });
     const messageId = mintMessageId();
     const at = ctx.now().toISOString();
     const projectId = opts.project?.trim() || lane.project_id;
@@ -4489,7 +4752,8 @@ async function runMessage(ctx, laneId, opts) {
         move = await prepareAccountMove(ctx, lane, {
             account: opts.account,
             cliModel: opts.model?.trim() || undefined,
-            ...(resumeProfile !== undefined ? { workerProfile: resumeProfile.profile } : {}),
+            ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
+            ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
             pending: { trigger: "message", text, message_id: messageId, compact: opts.compact !== false },
         });
         lane = move.lane;
@@ -4498,13 +4762,14 @@ async function runMessage(ctx, laneId, opts) {
         }
     }
     else if (mechanism === "resume") {
-        const selection = await selectAutomaticClaudeResumeAccount(ctx, lane);
+        const selection = automaticAccountSelection;
         if (selection !== undefined) {
             if (selection.account !== lane.account) {
                 move = await prepareAccountMove(ctx, lane, {
                     account: selection.account,
                     cliModel: undefined,
-                    ...(resumeProfile !== undefined ? { workerProfile: resumeProfile.profile } : {}),
+                    ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
+                    ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
                     pending: {
                         trigger: "message",
                         text,
@@ -4522,10 +4787,14 @@ async function runMessage(ctx, laneId, opts) {
             }
         }
     }
-    if (resumeProfile !== undefined) {
-        if (opts.account === undefined)
-            validateResumeProfileModel(ctx, lane, resumeProfile.profile);
-        lane = recordResumeSetup(ctx, lane, { profile: resumeProfile });
+    if (resumeProfile !== undefined && opts.account === undefined) {
+        validateResumeProfileModel(ctx, lane, resumeProfile.profile);
+    }
+    if (move === null && (resumeProfile !== undefined || resumeEffort !== undefined)) {
+        lane = recordResumeSetup(ctx, lane, {
+            ...(resumeProfile !== undefined ? { profile: resumeProfile } : {}),
+            ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
+        });
     }
     if (move?.queued) {
         // Parked at the target's cap: reconcile resumes the session there.
@@ -4599,6 +4868,7 @@ async function runMessage(ctx, laneId, opts) {
                 }, {
                     trigger: { kind: "message", text, message_id: messageId },
                     compact: opts.compact !== false,
+                    effort: resumeEffort ?? recordedResumeEffort(lane),
                 });
                 archiveResumeMessage(hqRoot, laneId, dropboxMessage);
                 return started;
@@ -4885,6 +5155,10 @@ async function runResume(ctx, laneId, opts) {
     // slot that its senior has already assigned elsewhere.
     await withResumeHireAdmission(ctx, lane, () => undefined);
     assertLaneRunsHereForOperatorMutation(ctx, lane, "resume");
+    const cliEffort = parseCliEffort(lane.provider, opts.effort);
+    if (cliEffort !== undefined && !providerSupportsSessionResume(lane.provider)) {
+        throw new LanesError("effort_resume_unsupported", `Provider ${lane.provider} cannot change effort on a resumed session`, { lane_id: laneId, provider: lane.provider });
+    }
     lane = laneWithRecoveredProviderSession(hqRoot, lane);
     if (opts.model !== undefined && opts.account === undefined) {
         throw new LanesError("model_requires_account", "--model on hq lanes resume is only accepted together with --account", {});
@@ -4941,12 +5215,19 @@ async function runResume(ctx, laneId, opts) {
     const automaticAccountSelection = opts.account === undefined
         ? await selectAutomaticClaudeResumeAccount(ctx, lane)
         : undefined;
+    const resumeEffort = resolveResumeEffort(ctx, lane, {
+        cliEffort,
+        profile: resumeProfile,
+        account: opts.account ?? automaticAccountSelection?.account,
+        model: opts.model,
+    });
     let move = null;
     if (opts.account !== undefined) {
         move = await prepareAccountMove(ctx, lane, {
             account: opts.account,
             cliModel: opts.model?.trim() || undefined,
-            ...(resumeProfile !== undefined ? { workerProfile: resumeProfile.profile } : {}),
+            ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
+            ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
             pending: {
                 trigger: "resume",
                 resumed_from: resumedFrom,
@@ -4962,7 +5243,8 @@ async function runResume(ctx, laneId, opts) {
             move = await prepareAccountMove(ctx, lane, {
                 account: automaticAccountSelection.account,
                 cliModel: undefined,
-                ...(resumeProfile !== undefined ? { workerProfile: resumeProfile.profile } : {}),
+                ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
+                ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
                 pending: {
                     trigger: "resume",
                     resumed_from: resumedFrom,
@@ -4979,7 +5261,8 @@ async function runResume(ctx, laneId, opts) {
         }
     }
     lane = recordResumeSetup(ctx, lane, {
-        ...(resumeProfile !== undefined ? { profile: resumeProfile } : {}),
+        ...(move === null && resumeProfile !== undefined ? { profile: resumeProfile } : {}),
+        ...(move === null && resumeEffort !== undefined ? { effort: resumeEffort } : {}),
         ...(requestedMeshCompany !== undefined
             ? { meshCompany: requestedMeshCompany, threadId: meshThreadId }
             : {}),
@@ -5053,6 +5336,7 @@ async function runResume(ctx, laneId, opts) {
                         ...(messageId !== undefined ? { message_id: messageId } : {}),
                     },
                     compact: opts.compact !== false,
+                    effort: resumeEffort ?? recordedResumeEffort(lane),
                 });
             });
         }, ctx.sleep);
@@ -5718,6 +6002,16 @@ async function readOutpostTerminalLane(ctx, laneId, outpostId, stopCommandId) {
         !commandId ||
         dispatched.status !== "Success" ||
         dispatched.exitCode !== 0) {
+        const ownerError = ownerErrorFromOutput(dispatched.stdout);
+        if (ownerError) {
+            throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the lane read after stop: ${ownerError.message}`, {
+                lane_id: laneId,
+                outpost_id: outpostId,
+                command_id: stopCommandId,
+                sync_command_id: commandId || null,
+                owner_error: ownerError,
+            });
+        }
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not confirm a lane read after stop ${laneId}`, {
             lane_id: laneId,
             outpost_id: outpostId,
@@ -5741,6 +6035,16 @@ async function readOutpostTerminalLane(ctx, laneId, outpostId, stopCommandId) {
             cause: err instanceof Error ? err.message : String(err),
         });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the lane read after stop: ${ownerError.message}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: commandId,
+            owner_error: ownerError,
+        });
+    }
     if (remote?.ok !== true || remote.action !== "show") {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return lane ${laneId} after stop`, {
             lane_id: laneId,
@@ -5771,6 +6075,18 @@ async function dispatchOutpostLaneStop(ctx, lane) {
     catch (err) {
         throw new LanesError("outpost_dispatch_failed", `Could not dispatch stop for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the stop command: ${ownerError.message}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: dispatched.commandId,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
     const commandId = dispatched.commandId?.trim();
     if (dispatched.done !== true || !commandId) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return a completed stop command for lane ${lane.lane_id}`, {
@@ -5814,13 +6130,13 @@ async function dispatchOutpostLaneStop(ctx, lane) {
         syncCommandId = owner.commandId;
     }
     else if (remote?.error !== undefined) {
-        throw new LanesError("outpost_remote_command_failed", typeof remote.message === "string"
+        throw new LanesError("outpost_dispatch_failed", typeof remote.message === "string"
             ? remote.message
             : `Outpost ${outpostId} rejected the stop command for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
             outpost_id: outpostId,
             command_id: commandId,
-            remote_error: remote.error,
+            owner_error: ownerErrorFromOutput(dispatched.stdout),
         });
     }
     else {
@@ -6661,6 +6977,14 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runCreate(ctx, opts);
     }));
+    lanes
+        .command("grant-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .option("--hire <n>", "Non-negative safe integer hire grant")
+        .option("--grant-context <base64url>", "Primary-authorized hire hierarchy and gate decision")
+        .action(wrap(async (laneId, opts) => {
+        await runGrantOwnerTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("grant")
         .description("Set a lane's alive child-lane grant as its senior")
@@ -6823,6 +7147,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--story <id>", "Re-point story attribution from this message")
         .option("--account <id>", "Move the lane's session to this account of its provider before the message resumes it")
         .option("--model <id>", "Model for the moved lane (with --account only)")
+        .option("--effort <level>", "Reasoning effort for the resumed provider turn")
         .option("--worker <profile>", "Attach a personal worker profile when this message resumes the lane")
         .option("--no-compact", "Skip the resume-time compaction check for this message")
         .action(wrap(async (laneId, opts) => {
@@ -6837,6 +7162,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--story <id>", "Re-point story attribution from this resume")
         .option("--account <id>", "Move the lane's session to this account of its provider before resuming")
         .option("--model <id>", "Model for the moved lane (with --account only)")
+        .option("--effort <level>", "Reasoning effort for the resumed provider turn")
         .option("--worker <profile>", "Attach a personal worker profile for the resumed turn")
         .option("--mesh-company <slug>", "Attach Work Mesh attribution after verifying company membership")
         .option("--no-compact", "Skip the resume-time compaction check for this resume")