@indigoai-us/hq-cli 5.188.0 → 5.189.0

package/dist/lib/lanes/hire-grant-dispatch.d.ts

@@ -0,0 +1,21 @@
+import { type LaneRecord, type LaneState, type SeniorRef } from "./types.js";
+declare const HIRE_GRANT_CONTEXT_SCHEMA: "hq-lane-hire-grant-context.v1";
+export interface HireGrantLaneSnapshot {
+    lane_id: string;
+    state: LaneState;
+    senior: SeniorRef;
+    hire_grant?: number;
+}
+export interface OutpostHireGrantContext {
+    schema_version: typeof HIRE_GRANT_CONTEXT_SCHEMA;
+    enforcement_enabled: boolean;
+    expected_senior: SeniorRef;
+    hierarchy: HireGrantLaneSnapshot[];
+}
+/** Encode only the owner-relevant hierarchy from the primary's complete store. */
+export declare function createOutpostHireGrantContext(target: LaneRecord, lanes: readonly LaneRecord[], enforcementEnabled: boolean): string;
+/** Decode and validate an owner grant context, binding it to the target lane. */
+export declare function parseOutpostHireGrantContext(encoded: string, targetLaneId: string): OutpostHireGrantContext;
+export declare function sameHireGrantSenior(a: SeniorRef, b: SeniorRef): boolean;
+export {};
+//# sourceMappingURL=hire-grant-dispatch.d.ts.map

package/dist/lib/lanes/hire-grant-dispatch.js

@@ -0,0 +1,167 @@
+import { aliveDirectChildren } from "./hire-grants.js";
+import { LanesError } from "./errors.js";
+import { isLaneState, isSeniorKind, } from "./types.js";
+const HIRE_GRANT_CONTEXT_SCHEMA = "hq-lane-hire-grant-context.v1";
+const MAX_CONTEXT_BYTES = 48 * 1024;
+const MAX_CONTEXT_LANES = 256;
+function contextError(message) {
+    return new LanesError("hire_grant_context_invalid", message, {});
+}
+function sameSenior(a, b) {
+    return a.kind === b.kind && a.id === b.id;
+}
+function copySenior(senior) {
+    return senior.id === undefined
+        ? { kind: senior.kind }
+        : { kind: senior.kind, id: senior.id };
+}
+function snapshot(lane) {
+    return {
+        lane_id: lane.lane_id,
+        state: lane.state,
+        senior: copySenior(lane.senior),
+        ...(lane.hire_grant === undefined ? {} : { hire_grant: lane.hire_grant }),
+    };
+}
+/** Encode only the owner-relevant hierarchy from the primary's complete store. */
+export function createOutpostHireGrantContext(target, lanes, enforcementEnabled) {
+    const current = lanes.find((lane) => lane.lane_id === target.lane_id);
+    if (!current || !sameSenior(current.senior, target.senior)) {
+        throw new LanesError("hire_grant_hierarchy_unavailable", `Cannot build an authoritative hire-grant hierarchy for lane ${target.lane_id}`, { lane_id: target.lane_id });
+    }
+    const relevant = new Map();
+    relevant.set(current.lane_id, current);
+    if (enforcementEnabled) {
+        if (current.senior.kind === "lane") {
+            const parentId = current.senior.id;
+            const parent = parentId ? lanes.find((lane) => lane.lane_id === parentId) : undefined;
+            if (!parent) {
+                throw new LanesError("hire_grant_senior_invalid", `Lane ${target.lane_id} has no senior lane in the primary hierarchy`, { lane_id: target.lane_id, senior_lane_id: parentId ?? null });
+            }
+            relevant.set(parent.lane_id, parent);
+            for (const sibling of aliveDirectChildren(lanes, parent.lane_id)) {
+                relevant.set(sibling.lane_id, sibling);
+            }
+        }
+        for (const child of aliveDirectChildren(lanes, current.lane_id)) {
+            relevant.set(child.lane_id, child);
+        }
+    }
+    const hierarchy = [...relevant.values()]
+        .map(snapshot)
+        .sort((a, b) => a.lane_id.localeCompare(b.lane_id));
+    if (hierarchy.length > MAX_CONTEXT_LANES) {
+        throw new LanesError("hire_grant_hierarchy_too_large", `Lane ${target.lane_id} has too many related lanes to dispatch a bounded grant check`, { lane_id: target.lane_id, related_lane_count: hierarchy.length });
+    }
+    const context = {
+        schema_version: HIRE_GRANT_CONTEXT_SCHEMA,
+        enforcement_enabled: enforcementEnabled,
+        expected_senior: copySenior(current.senior),
+        hierarchy,
+    };
+    const encoded = Buffer.from(JSON.stringify(context), "utf8").toString("base64url");
+    if (Buffer.byteLength(encoded, "utf8") > MAX_CONTEXT_BYTES) {
+        throw new LanesError("hire_grant_hierarchy_too_large", `Lane ${target.lane_id} has too much related state to dispatch a bounded grant check`, { lane_id: target.lane_id, encoded_bytes: Buffer.byteLength(encoded, "utf8") });
+    }
+    return encoded;
+}
+function parseSenior(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    if (Object.keys(record).some((key) => key !== "kind" && key !== "id"))
+        return null;
+    if (!isSeniorKind(record.kind))
+        return null;
+    if (record.id !== undefined &&
+        (typeof record.id !== "string" || !record.id.trim() || record.id.trim() !== record.id))
+        return null;
+    if ((record.kind === "session" || record.kind === "lane") && record.id === undefined)
+        return null;
+    if (record.kind === "user" && record.id !== undefined)
+        return null;
+    return record.id === undefined
+        ? { kind: record.kind }
+        : { kind: record.kind, id: record.id };
+}
+function parseLaneSnapshot(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    if (Object.keys(record).some((key) => !["lane_id", "state", "senior", "hire_grant"].includes(key)))
+        return null;
+    if (typeof record.lane_id !== "string" || !record.lane_id.trim())
+        return null;
+    if (!isLaneState(record.state))
+        return null;
+    const senior = parseSenior(record.senior);
+    if (!senior)
+        return null;
+    if (record.hire_grant !== undefined &&
+        (typeof record.hire_grant !== "number" || !Number.isSafeInteger(record.hire_grant) || record.hire_grant < 0)) {
+        return null;
+    }
+    return {
+        lane_id: record.lane_id,
+        state: record.state,
+        senior,
+        ...(record.hire_grant === undefined ? {} : { hire_grant: record.hire_grant }),
+    };
+}
+/** Decode and validate an owner grant context, binding it to the target lane. */
+export function parseOutpostHireGrantContext(encoded, targetLaneId) {
+    if (!encoded || !/^[A-Za-z0-9_-]+$/.test(encoded) ||
+        Buffer.byteLength(encoded, "utf8") > MAX_CONTEXT_BYTES ||
+        Buffer.from(encoded, "base64url").toString("base64url") !== encoded) {
+        throw contextError("Outpost grant context is not canonical base64url");
+    }
+    let raw;
+    try {
+        const decoded = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(encoded, "base64url"));
+        raw = JSON.parse(decoded);
+    }
+    catch {
+        throw contextError("Outpost grant context is not valid UTF-8 JSON");
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw contextError("Outpost grant context must be an object");
+    }
+    const record = raw;
+    if (Object.keys(record).some((key) => !["schema_version", "enforcement_enabled", "expected_senior", "hierarchy"].includes(key))) {
+        throw contextError("Outpost grant context contains unknown fields");
+    }
+    if (record.schema_version !== HIRE_GRANT_CONTEXT_SCHEMA ||
+        typeof record.enforcement_enabled !== "boolean" ||
+        !Array.isArray(record.hierarchy) ||
+        record.hierarchy.length === 0 || record.hierarchy.length > MAX_CONTEXT_LANES) {
+        throw contextError("Outpost grant context has an unsupported or incomplete shape");
+    }
+    const expectedSenior = parseSenior(record.expected_senior);
+    const hierarchy = record.hierarchy.map(parseLaneSnapshot);
+    if (!expectedSenior || hierarchy.some((lane) => lane === null)) {
+        throw contextError("Outpost grant context contains an invalid senior or lane snapshot");
+    }
+    const snapshots = hierarchy;
+    const byId = new Map(snapshots.map((lane) => [lane.lane_id, lane]));
+    if (byId.size !== snapshots.length) {
+        throw contextError("Outpost grant context contains duplicate lane snapshots");
+    }
+    const target = byId.get(targetLaneId);
+    if (!target || !sameSenior(target.senior, expectedSenior)) {
+        throw contextError("Outpost grant context does not match the target's expected senior");
+    }
+    if (record.enforcement_enabled && expectedSenior.kind === "lane" &&
+        (!expectedSenior.id || !byId.has(expectedSenior.id))) {
+        throw contextError("Outpost grant context is missing the target's senior lane");
+    }
+    return {
+        schema_version: HIRE_GRANT_CONTEXT_SCHEMA,
+        enforcement_enabled: record.enforcement_enabled,
+        expected_senior: expectedSenior,
+        hierarchy: snapshots,
+    };
+}
+export function sameHireGrantSenior(a, b) {
+    return sameSenior(a, b);
+}
+//# sourceMappingURL=hire-grant-dispatch.js.map

package/dist/lib/lanes/hire-grants.d.ts

@@ -1,7 +1,8 @@
 import { type LaneRecord } from "./types.js";
 export declare const LANE_HIRE_GRANTS_FLAG = "lanes.hire-grants";
-export declare function aliveDirectChildren(lanes: readonly LaneRecord[], parentLaneId: string): LaneRecord[];
-export declare function assignedChildHireGrants(children: readonly LaneRecord[], exceptLaneId?: string): number;
+export type LaneHireGrantRow = Pick<LaneRecord, "lane_id" | "state" | "senior" | "hire_grant">;
+export declare function aliveDirectChildren<T extends LaneHireGrantRow>(lanes: readonly T[], parentLaneId: string): T[];
+export declare function assignedChildHireGrants(children: readonly LaneHireGrantRow[], exceptLaneId?: string): number;
 export interface HireGrantAdmissionSnapshot {
     parent: LaneRecord;
     children: LaneRecord[];

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -27,7 +27,7 @@ export interface OutpostDispatchResult {
     stderr: string;
 }
 export interface OutpostLaneCommand {
-    action: "message" | "resume" | "stop" | "show" | "grant";
+    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target";
     laneId: string;
     hqBinary?: string;
     text?: string;
@@ -35,7 +35,10 @@ export interface OutpostLaneCommand {
     story?: string;
     account?: string;
     model?: string;
+    effort?: string;
+    worker?: string;
     hire?: string;
+    grantContext?: string;
     compact?: boolean;
 }
 export interface OutpostExecPort {
@@ -80,6 +83,8 @@ export declare function buildOutpostBalanceMoveCommand(input: {
 export declare function buildOutpostIdentityBackfillCommand(expectedId: string): string;
 /** Build the same `hq outposts exec` remote command used by lane pickup. */
 export declare function buildOutpostLaneCommand(input: OutpostLaneCommand): string;
+/** True when a remote CLI exited after rejecting the forwarded effort flag. */
+export declare function outpostRejectedEffortOption(result: Pick<OutpostDispatchResult, "exitCode" | "stdout" | "stderr">): boolean;
 export declare function stageOutpostPayload(port: Pick<OutpostExecPort, "stageExecInput">, outpostId: string, bytes: Uint8Array, put?: typeof fetch): Promise<{
     getUrl: string;
 }>;

package/dist/lib/lanes/outpost-dispatch.js

@@ -104,7 +104,10 @@ export function buildOutpostLaneCommand(input) {
         ["--story", input.story],
         ["--account", input.account],
         ["--model", input.model],
+        ["--effort", input.effort],
+        ["--worker", input.worker],
         ["--hire", input.hire],
+        ["--grant-context", input.grantContext],
     ]) {
         if (value !== undefined)
             args.push(flag, value);
@@ -113,6 +116,12 @@ export function buildOutpostLaneCommand(input) {
         args.push("--no-compact");
     return withRemoteHqDir(joinCommandParts(args));
 }
+/** True when a remote CLI exited after rejecting the forwarded effort flag. */
+export function outpostRejectedEffortOption(result) {
+    if (result.exitCode === 0)
+        return false;
+    return /(?:unknown|unrecognized) option[^\n]{0,120}--effort/i.test(`${result.stderr}\n${result.stdout}`);
+}
 export async function stageOutpostPayload(port, outpostId, bytes, put = fetch) {
     const staged = await port.stageExecInput(outpostId);
     const upload = await put(staged.putUrl, {

package/dist/lib/lanes/spawn.d.ts

@@ -9,6 +9,7 @@
  */
 import { PROVIDER_HOME_ENV } from "./accounts.js";
 import { type RunCompactionFn } from "./compaction.js";
+import { type ResolvedEffort } from "./effort.js";
 import { type KnownModelsDeps } from "./models.js";
 import { type LaunchTrigger } from "./delivery.js";
 import { type MachineIdentity } from "./machine-identity.js";
@@ -283,6 +284,8 @@ export interface SpawnLaunchOptions {
      * (`hq lanes message --no-compact`). Default true.
      */
     compact?: boolean;
+    /** Effort resolved by an explicit resume/message request, or pinned from its record. */
+    effort?: ResolvedEffort;
 }
 /**
  * Bind the account, spawn the worker and its watcher outside the caller's

package/dist/lib/lanes/spawn.js

@@ -15,7 +15,7 @@ import { PROVIDER_HOME_ENV, accountStatus, isLoggedOut, resolveAccount, selectBa
 import { COMPACTION_PROMPT, compactionAfterUsage, compactionDue, compactLaneSession, } from "./compaction.js";
 import { installDrainHook } from "./hooks-install.js";
 import { loadLanesConfig, providerAutoCompactTokens, providerCompactAfterMs, } from "./config.js";
-import { appendEffortFlag, resolveLaneEffort } from "./effort.js";
+import { appendEffortFlag, resolveLaneEffort, } from "./effort.js";
 import { defaultProbe, validateLaneModel, validateProfileLaneModel, } from "./models.js";
 import { claimableStatesFor, planLaneLaunch, providerSupportsSessionResume, } from "./delivery.js";
 import { AccountResolutionError, LanesError } from "./errors.js";
@@ -1719,7 +1719,13 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
         accountModel: accountCfg?.model,
         providerModel: config.providers[lane.provider].model,
     });
-    const effort = resolveLaneEffort({
+    const pendingResumeEffort = pendingResume !== undefined
+        ? {
+            ...(existing.effort !== undefined ? { effort: existing.effort } : {}),
+            source: existing.effort_source ?? "none",
+        }
+        : undefined;
+    const effort = launch.effort ?? pendingResumeEffort ?? resolveLaneEffort({
         cliEffort: existing.effort_source === "cli" ? existing.effort : undefined,
         profileEffort,
         accountEffort: accountCfg?.effort,

package/dist/lib/lanes/ssm-command-context.d.ts

@@ -0,0 +1,12 @@
+export interface SsmRunCommandContextDeps {
+    platform?: string;
+    parentPid?: number;
+    readFileSync?: (path: string, encoding: "utf8") => string;
+}
+/**
+ * True only for a Linux process descended from the root-owned SSM Run Command
+ * worker chain. Outpost owner-only lane mutations use this to distinguish an
+ * SSM dispatch from a normal local CLI invocation.
+ */
+export declare function isSsmRunCommandProcess(deps?: SsmRunCommandContextDeps): boolean;
+//# sourceMappingURL=ssm-command-context.d.ts.map

package/dist/lib/lanes/ssm-command-context.js

@@ -0,0 +1,52 @@
+import * as fs from "node:fs";
+const SSM_WORKER_CHAIN = [
+    "ssm-document-wo",
+    "ssm-agent-worke",
+    "amazon-ssm-agen",
+];
+/**
+ * True only for a Linux process descended from the root-owned SSM Run Command
+ * worker chain. Outpost owner-only lane mutations use this to distinguish an
+ * SSM dispatch from a normal local CLI invocation.
+ */
+export function isSsmRunCommandProcess(deps = {}) {
+    if ((deps.platform ?? process.platform) !== "linux")
+        return false;
+    const readFileSync = deps.readFileSync ?? ((filePath, encoding) => fs.readFileSync(filePath, encoding));
+    let pid = deps.parentPid ?? process.ppid;
+    const lineage = [];
+    for (let depth = 0; depth < 32 && pid > 1; depth += 1) {
+        let status;
+        let command;
+        try {
+            status = readFileSync(`/proc/${pid}/status`, "utf8");
+            command = readFileSync(`/proc/${pid}/comm`, "utf8").trim();
+        }
+        catch (err) {
+            const code = err !== null && typeof err === "object" && "code" in err
+                ? err.code
+                : undefined;
+            if (code === "ENOENT" || code === "EACCES" || code === "EPERM")
+                return false;
+            throw err;
+        }
+        const parentMatch = /^PPid:\s*(\d+)\s*$/m.exec(status);
+        const uidMatch = /^Uid:\s*\d+\s+(\d+)\s+\d+\s+\d+\s*$/m.exec(status);
+        if (!parentMatch || !uidMatch || !command)
+            return false;
+        const parentPid = Number(parentMatch[1]);
+        const effectiveUid = Number(uidMatch[1]);
+        if (!Number.isSafeInteger(parentPid) || !Number.isSafeInteger(effectiveUid))
+            return false;
+        lineage.push({ pid, parentPid, command, effectiveUid });
+        pid = parentPid;
+    }
+    for (let start = 0; start <= lineage.length - SSM_WORKER_CHAIN.length; start += 1) {
+        const chain = lineage.slice(start, start + SSM_WORKER_CHAIN.length);
+        if (chain.every((entry, index) => entry.effectiveUid === 0 && entry.command.startsWith(SSM_WORKER_CHAIN[index]))) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=ssm-command-context.js.map

package/dist/lib/lanes/types.js

@@ -226,7 +226,7 @@ export const LANE_FIELD_WRITERS = {
     priority: ["command"], worker: ["creator", "command"], worker_path: ["creator", "command"], worker_pack: ["creator", "command"], worker_profile: ["creator", "command"], worker_profile_hash: ["creator", "command", "spawn"], worker_profile_ignored: ["creator", "command", "spawn"], worker_policy_delivery: ["command", "spawn"],
     provider: ["creator"], account: ["creator", "spawn", "command", "watcher", "reconcile"], account_selection: ["creator", "command"], admission_accounts: ["creator", "command"], account_history: ["command", "spawn", "watcher", "reconcile"], pending_resume: ["command", "spawn", "watcher", "reconcile"], placement_default: ["creator"], host: ["creator", "command"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], attribution_history: ["command"],
-    last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn", "command"], model_source: ["creator", "spawn", "command"], effort: ["creator", "spawn"], effort_source: ["creator", "spawn"], fast_mode: ["spawn"],
+    last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn", "command"], model_source: ["creator", "spawn", "command"], effort: ["creator", "spawn", "command"], effort_source: ["creator", "spawn", "command"], fast_mode: ["spawn"],
     last_message_at: ["command"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],
     overdue: ["reconcile"], overdue_at: ["reconcile"], last_host_report_at: ["watcher", "spawn", "reconcile"], stalled: ["watcher"], stalled_at: ["watcher"], stalled_reason: ["watcher"],
     admitted_reason: ["command", "reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], terminal_details: ["command", "spawn", "watcher", "reconcile"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.188.0",
+  "version": "5.189.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {