@indigoai-us/hq-cli 5.203.0 → 5.204.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.204.0] — 2026-09-26
+
+### Added
+
+- `hq lanes accounts set-home` adds a host-specific home to the synced lane
+  account registry. Account status and Claude balancing now distinguish a
+  missing home from a signed-out account.
+
 ## [5.203.0] — 2026-09-26
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -8135,6 +8135,33 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "JSON on stdout (always)";
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "set-home";
+            readonly description: "Set the host-specific home for an existing provider account";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <provider> <account-id> <path>";
+            readonly arguments: readonly [{
+                readonly name: "provider";
+                readonly required: true;
+                readonly variadic: false;
+            }, {
+                readonly name: "account-id";
+                readonly required: true;
+                readonly variadic: false;
+            }, {
+                readonly name: "path";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--host <hostname>";
+                readonly description: "Host key (defaults to this host's hostname)";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "login";
             readonly description: "Create a home, run the vendor login, and register the account";

package/dist/command-catalog.generated.js

@@ -10523,6 +10523,41 @@ export const COMMAND_CATALOG = [
                         ],
                         "subcommands": []
                     },
+                    {
+                        "name": "set-home",
+                        "description": "Set the host-specific home for an existing provider account",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <provider> <account-id> <path>",
+                        "arguments": [
+                            {
+                                "name": "provider",
+                                "required": true,
+                                "variadic": false
+                            },
+                            {
+                                "name": "account-id",
+                                "required": true,
+                                "variadic": false
+                            },
+                            {
+                                "name": "path",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--host <hostname>",
+                                "description": "Host key (defaults to this host's hostname)"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
                     {
                         "name": "login",
                         "description": "Create a home, run the vendor login, and register the account",

package/dist/commands/lanes.d.ts

@@ -95,11 +95,14 @@ export interface LanesCommandDeps {
     laneTrackerEnabled?: (company: LaneCompanyRef) => boolean | Promise<boolean>;
     /** The local-only PR 2 implementation refuses if mesh storage is enabled. */
     laneTrackerMeshEnabled?: (company: LaneCompanyRef) => boolean | Promise<boolean>;
+    /** Test seam for the default-off host-scoped account-home writer gate. */
+    laneHostScopedAccountHomesEnabled?: (company?: LaneCompanyRef | null) => boolean | Promise<boolean>;
     /** Test seam for recording approvals against the active identity. */
     trackerActor?: () => string | null;
 }
 export declare const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
 export declare const LANE_OUTPOST_QUESTION_VISIBILITY_FLAG = "lanes.outpost-question-visibility";
+export declare const LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG = "lanes.host-scoped-account-homes";
 export declare function parseSeniorRef(raw: string): SeniorRef;
 export declare function resolveAnswerChoice(choice: string, options: string[], freeform: boolean): string;
 /**

package/dist/commands/lanes.js

@@ -10,6 +10,7 @@ import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { readLocalOverride } from "@indigoai-us/hq-flags-client";
 import { Option } from "commander";
 import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
@@ -32,11 +33,12 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
+import { effectiveAccountHome } from "../lib/lanes/account-home.js";
 import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, createQuestion, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, LANE_HIRE_GRANTS_FLAG, planHireGrantBackfill, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionRecord, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, wakeAnsweredLaneNow, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withLaneHireLocks, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
-import { providerCompactAfterMs } from "../lib/lanes/config.js";
+import { assertUniqueAccountHomes, providerCompactAfterMs } from "../lib/lanes/config.js";
 import { parseCliEffort, resolveLaneEffort, } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
 import { dispatchLaneDelivery } from "../lib/lanes/delivery-core.js";
@@ -59,6 +61,7 @@ const VENDOR_LOGIN = {
 export { emitLaneDecisionEvents };
 export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
 export const LANE_OUTPOST_QUESTION_VISIBILITY_FLAG = "lanes.outpost-question-visibility";
+export const LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG = "lanes.host-scoped-account-homes";
 function defaultLanePlacementEnabled() {
     return resolveProcessFlagGate(LANE_OUTPOST_LOAD_BALANCING_FLAG, { fallback: false }, () => false);
 }
@@ -82,6 +85,15 @@ function defaultLaneOutpostQuestionVisibilityEnabled(company, env) {
         env,
     });
 }
+function defaultLaneHostScopedAccountHomesEnabled(company, env) {
+    return readLanesRegistryFlag(LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG, { company, env });
+}
+async function hostScopedAccountHomesEnabled(ctx) {
+    const localOverride = readLocalOverride(LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG, ctx.env);
+    if (localOverride !== null)
+        return localOverride;
+    return ctx.laneHostScopedAccountHomesEnabled(await ctx.resolveCompany());
+}
 function withoutProviderHome(value) {
     if (Array.isArray(value))
         return value.map(withoutProviderHome);
@@ -286,6 +298,8 @@ function resolveDeps(deps = {}) {
             ((company) => defaultLaneOutpostQuestionVisibilityEnabled(company, env)),
         laneTrackerEnabled: deps.laneTrackerEnabled ?? defaultLaneTrackerEnabled,
         laneTrackerMeshEnabled: deps.laneTrackerMeshEnabled ?? defaultLaneTrackerMeshEnabled,
+        laneHostScopedAccountHomesEnabled: deps.laneHostScopedAccountHomesEnabled ??
+            ((company) => defaultLaneHostScopedAccountHomesEnabled(company, env)),
         trackerActor: deps.trackerActor ?? defaultTrackerActor,
     };
 }
@@ -298,6 +312,7 @@ function livenessDepsFromCtx(ctx) {
         env: ctx.env,
         existsSync: ctx.existsSync,
         readFileSync: ctx.readFileSync,
+        hostname: ctx.hostname,
     };
 }
 function reconcileHostFromCtx(ctx) {
@@ -1004,6 +1019,7 @@ async function loadHostCapacitySnapshots(ctx, hqRoot, config = loadLanesConfig(h
         lanes: loadAllLanes(hqRoot),
         config,
         existsSync: ctx.existsSync,
+        hostname: ctx.hostname(),
         now: ctx.now(),
     });
     const remote = await Promise.all(remoteIds.map(async (id) => {
@@ -1118,6 +1134,7 @@ async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config) {
         existsSync: ctx.existsSync,
         probe: ctx.probeProvider,
         env: ctx.env,
+        hostname: ctx.hostname(),
         now: ctx.now(),
     });
     const snapshots = [{
@@ -1140,6 +1157,7 @@ async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config) {
                     existsSync: ctx.existsSync,
                     probe: ctx.probeProvider,
                     env: ctx.env,
+                    hostname: ctx.hostname(),
                     now: ctx.now(),
                 }),
                 lanes: actualLocalLanes,
@@ -2196,6 +2214,7 @@ export function applyOutpostAccountPickup(hqRoot, laneId, modelDeps = {}) {
     try {
         const resolved = resolveAccount(lane.provider, lane.account, config, {
             hqRoot,
+            hostname: os.hostname(),
             accountDeps: {
                 probe: modelDeps.probe,
                 env: modelDeps.env,
@@ -2203,6 +2222,7 @@ export function applyOutpostAccountPickup(hqRoot, laneId, modelDeps = {}) {
         });
         const status = accountStatus(lane.provider, resolved.id, config, {
             existsSync: (p) => fs.existsSync(p),
+            hostname: os.hostname(),
             probe: modelDeps.probe,
             env: modelDeps.env,
         });
@@ -2589,6 +2609,7 @@ async function runCreate(ctx, opts) {
         }
         const resolved = resolveAccount(provider, requested, config, {
             hqRoot,
+            hostname: ctx.hostname(),
             cliModel,
             model: cliModel ?? profileModel,
         });
@@ -2597,6 +2618,7 @@ async function runCreate(ctx, opts) {
     else if (profileAccount !== undefined && profileAccounts === undefined) {
         const resolved = resolveAccount(provider, profileAccount, config, {
             hqRoot,
+            hostname: ctx.hostname(),
             cliModel,
             model: cliModel ?? profileModel,
         });
@@ -2650,6 +2672,7 @@ async function runCreate(ctx, opts) {
         const candidate = pinnedAccount ??
             resolveAccount(provider, undefined, config, {
                 hqRoot,
+                hostname: ctx.hostname(),
                 existsSync: ctx.existsSync,
                 accountDeps: { probe: ctx.probeProvider, env: ctx.env },
                 cliModel,
@@ -2669,6 +2692,7 @@ async function runCreate(ctx, opts) {
                     (profileAccounts === undefined || profileAccounts.includes(id)) &&
                     accountStatus(provider, id, config, {
                         existsSync: ctx.existsSync,
+                        hostname: ctx.hostname(),
                         probe: ctx.probeProvider,
                         env: ctx.env,
                     }).logged_in === true)
@@ -2679,7 +2703,10 @@ async function runCreate(ctx, opts) {
         const quotaBlocked = [];
         const quota = loadQuotaState(hqRoot);
         for (const id of toValidate) {
-            const home = accounts[id]?.home;
+            const account = accounts[id];
+            const home = account === undefined
+                ? undefined
+                : effectiveAccountHome(account, ctx.hostname()).home;
             if (home === undefined)
                 continue;
             checkedAccounts.push(id);
@@ -2782,6 +2809,7 @@ async function runCreate(ctx, opts) {
                         existsSync: ctx.existsSync,
                         probe: ctx.probeProvider,
                         env: ctx.env,
+                        hostname: ctx.hostname(),
                         now: ctx.now(),
                     }),
                     lanes: localLanes,
@@ -2805,6 +2833,7 @@ async function runCreate(ctx, opts) {
             pinnedAccount = resolveAccount(provider, undefined, config, {
                 hqRoot,
                 existsSync: ctx.existsSync,
+                hostname: ctx.hostname(),
                 accountDeps: { probe: ctx.probeProvider, env: ctx.env },
                 cliModel,
                 model: cliModel ?? profileModel,
@@ -4029,6 +4058,7 @@ async function runCapacity(ctx) {
         existsSync: ctx.existsSync,
         probe: ctx.probeProvider,
         env: ctx.env,
+        hostname: ctx.hostname(),
         now: ctx.now(),
     });
     printJson(snapshot);
@@ -4873,6 +4903,7 @@ function validateResumeProfileModel(ctx, lane, profile) {
     const account = resolveAccount(lane.provider, lane.account, config, {
         hqRoot,
         existsSync: ctx.existsSync,
+        hostname: ctx.hostname(),
         model: profile.meta.model,
     });
     validateProfileLaneModel(lane.provider, profile.meta.model, account.home, profile.id, {
@@ -4919,7 +4950,7 @@ function recordResumeSetup(ctx, lane, input) {
         if (account === undefined) {
             throw new AccountResolutionError("unknown_account", `Lane ${lane.lane_id} records account ${JSON.stringify(lane.account)} which is not configured for ${lane.provider}`, { provider: lane.provider, account: lane.account ?? "", enabled: [] });
         }
-        validateLaneModel(lane.provider, model, account.home, {
+        validateLaneModel(lane.provider, model, effectiveAccountHome(account, ctx.hostname()).home, {
             readFileSync: ctx.readFileSync,
             probe: ctx.probeProvider,
             env: ctx.env,
@@ -5039,11 +5070,13 @@ async function prepareAccountMove(ctx, lane, input) {
     if (targetCfg === undefined) {
         throw new AccountResolutionError("unknown_account", `Unknown account ${JSON.stringify(target)} for ${lane.provider}. Configured: ${Object.keys(providerCfg.accounts).join(", ") || "(none)"}`, { provider: lane.provider, account: target, enabled: Object.keys(providerCfg.accounts).filter((id) => providerCfg.accounts[id]?.enabled) });
     }
+    const targetHome = effectiveAccountHome(targetCfg, ctx.hostname()).home;
     if (!targetCfg.enabled) {
         throw new AccountResolutionError("account_disabled", `Account ${JSON.stringify(target)} is disabled${targetCfg.disabled_reason ? `: ${targetCfg.disabled_reason}` : ""}`, { provider: lane.provider, account: target, reason: targetCfg.disabled_reason ?? "" });
     }
     if (accountStatus(lane.provider, target, config, {
         existsSync: ctx.existsSync,
+        hostname: ctx.hostname(),
         probe: ctx.probeProvider,
         env: ctx.env,
     }).logged_in !== true) {
@@ -5060,7 +5093,7 @@ async function prepareAccountMove(ctx, lane, input) {
             : undefined;
     const profileModel = profileDefaultsApply ? profile?.meta.model : undefined;
     if (input.cliModel === undefined && profileDefaultsApply && profileModel !== undefined && pinnedModel === undefined) {
-        validateProfileLaneModel(lane.provider, profileModel, targetCfg.home, profile.id, {
+        validateProfileLaneModel(lane.provider, profileModel, targetHome, profile.id, {
             readFileSync: ctx.readFileSync,
             probe: ctx.probeProvider,
             env: ctx.env,
@@ -5086,7 +5119,7 @@ async function prepareAccountMove(ctx, lane, input) {
         throw new LanesError("account_quota_held", `Account ${target} for ${lane.provider} is held${block.quota_reset_at ? ` until ${block.quota_reset_at}` : ""}${block.marker ? ` (${block.marker})` : ""}`, { provider: lane.provider, account: target, quota_reset_at: block.quota_reset_at ?? null, marker: block.marker ?? null, model: model ?? null });
     }
     if (model !== undefined) {
-        validateLaneModel(lane.provider, model, targetCfg.home, {
+        validateLaneModel(lane.provider, model, targetHome, {
             readFileSync: ctx.readFileSync,
             probe: ctx.probeProvider,
             env: ctx.env,
@@ -5096,14 +5129,15 @@ async function prepareAccountMove(ctx, lane, input) {
     if (sourceCfg === undefined) {
         throw new AccountResolutionError("unknown_account", `Lane ${laneId} records account ${JSON.stringify(lane.account)} which is not configured for ${lane.provider}`, { provider: lane.provider, account: lane.account ?? "", enabled: [] });
     }
+    const sourceHome = effectiveAccountHome(sourceCfg, ctx.hostname()).home;
     // Checks done. Copy the session files, then write the record.
     const copy = ensureSessionHome({
         provider: lane.provider,
         sessionId,
         cwd: hqRoot,
-        targetHome: targetCfg.home,
-        registeredHomes: Object.values(providerCfg.accounts).map((account) => account.home),
-        providerHomeAtSpawn: lane.provider_home_at_spawn ?? sourceCfg.home,
+        targetHome,
+        registeredHomes: Object.values(providerCfg.accounts).map((account) => effectiveAccountHome(account, ctx.hostname()).home),
+        providerHomeAtSpawn: lane.provider_home_at_spawn ?? sourceHome,
     });
     const at = now.toISOString();
     const from = lane.account ?? null;
@@ -5186,6 +5220,7 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile) {
         }
         if (accountStatus("claude", lane.account, config, {
             existsSync: ctx.existsSync,
+            hostname: ctx.hostname(),
             probe: ctx.probeProvider,
             env: ctx.env,
         }).logged_in === false) {
@@ -5212,6 +5247,7 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile) {
         ? false
         : accountStatus("claude", lane.account, config, {
             existsSync: ctx.existsSync,
+            hostname: ctx.hostname(),
             probe: ctx.probeProvider,
             env: ctx.env,
         }).logged_in;
@@ -5274,6 +5310,7 @@ function assertCurrentResumeAccountAvailable(ctx, lane) {
     }
     if (accountStatus(lane.provider, lane.account, config, {
         existsSync: ctx.existsSync,
+        hostname: ctx.hostname(),
         probe: ctx.probeProvider,
         env: ctx.env,
     }).logged_in !== true) {
@@ -6419,7 +6456,7 @@ function drainHookStatusFor(ctx, lane) {
     const account = config.providers[lane.provider].accounts[lane.account];
     if (account === undefined)
         return null;
-    const home = canonicalizeHome(account.home, {
+    const home = canonicalizeHome(effectiveAccountHome(account, ctx.hostname()).home, {
         homedir: ctx.homedir,
         realpathSync: (p) => fs.realpathSync(p),
         existsSync: (p) => fs.existsSync(p),
@@ -7671,6 +7708,7 @@ async function runAccountsList(ctx, opts) {
     const quota = loadQuotaState(hqRoot);
     const accounts = providers.flatMap((provider) => listAccountStatuses(provider, config, {
         existsSync: ctx.existsSync,
+        hostname: ctx.hostname(),
         probe: ctx.probeProvider,
         env: ctx.env,
     }).map((status) => {
@@ -7686,6 +7724,7 @@ async function runAccountsList(ctx, opts) {
         });
         return {
             ...status,
+            effective_home: status.home,
             model: accountCfg?.model ?? null,
             effort: accountCfg?.effort ?? null,
             effective_model: model ?? null,
@@ -7849,9 +7888,23 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
         throw new LanesError("device_auth_unsupported", "--device-auth is supported only for codex account login", { provider });
     }
     const registeredAccount = config.providers[provider].accounts[id];
-    const homeRaw = opts.home?.trim() ||
-        registeredAccount?.home ||
-        (id === "a" ? DEFAULT_ACCOUNT_HOMES[provider] : `~/.${provider}-${id}`);
+    const hostname = ctx.hostname().trim();
+    if (!hostname) {
+        throw new LanesError("host_identity_unknown", "Cannot resolve this host's hostname for account login", {});
+    }
+    const requestedHome = opts.home?.trim();
+    if (opts.home !== undefined && !requestedHome) {
+        throw new LanesError("invalid_account_home", "--home must be a non-empty path", { provider, account: id });
+    }
+    const hostScopedWriterEnabled = registeredAccount !== undefined && requestedHome !== undefined
+        ? await hostScopedAccountHomesEnabled(ctx)
+        : false;
+    const homeRaw = requestedHome ??
+        (registeredAccount !== undefined
+            ? effectiveAccountHome(registeredAccount, hostname).home
+            : id === "a"
+                ? DEFAULT_ACCOUNT_HOMES[provider]
+                : `~/.${provider}-${id}`);
     const homeResolved = homeRaw.startsWith("~") || path.isAbsolute(homeRaw)
         ? homeRaw
         : resolveCallerPath(callerCwd, homeRaw);
@@ -7860,20 +7913,43 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
         realpathSync: (p) => fs.realpathSync(p),
         existsSync: (p) => fs.existsSync(p),
     });
-    for (const [existingId, account] of Object.entries(config.providers[provider].accounts)) {
-        if (existingId === id)
-            continue;
-        if (account.home === home) {
-            throw new LanesError("duplicate_account_home", `Home ${home} is already registered as ${provider} account ${existingId}`, { provider, accounts: [existingId, id], home });
+    const nextAccount = registeredAccount === undefined
+        ? { home, enabled: true }
+        : { ...registeredAccount, enabled: true };
+    if (registeredAccount !== undefined) {
+        if (hostScopedWriterEnabled && requestedHome !== undefined) {
+            if (home === registeredAccount.home) {
+                if (nextAccount.hosts !== undefined) {
+                    delete nextAccount.hosts[hostname];
+                    if (Object.keys(nextAccount.hosts).length === 0)
+                        delete nextAccount.hosts;
+                }
+            }
+            else {
+                nextAccount.hosts = {
+                    ...(registeredAccount.hosts ?? {}),
+                    [hostname]: { home },
+                };
+            }
+        }
+        else if (requestedHome !== undefined) {
+            // With the rollout off, retain the legacy shared-home write shape.
+            nextAccount.home = home;
         }
     }
+    delete nextAccount.disabled_reason;
+    assertUniqueAccountHomes(provider, {
+        ...config.providers[provider].accounts,
+        [id]: nextAccount,
+    });
     ensureDir(home);
     const defaultId = config.providers[provider].default_account;
-    const defaultHome = (defaultId !== undefined
-        ? config.providers[provider].accounts[defaultId]?.home
+    const defaultAccount = defaultId !== undefined
+        ? config.providers[provider].accounts[defaultId]
+        : Object.values(config.providers[provider].accounts).find((account) => account.enabled);
+    const defaultHome = (defaultAccount !== undefined
+        ? effectiveAccountHome(defaultAccount, hostname).home
         : undefined) ??
-        Object.values(config.providers[provider].accounts).find((account) => account.enabled)
-            ?.home ??
         canonicalizeHome(DEFAULT_ACCOUNT_HOMES[provider], {
             homedir: ctx.homedir,
             realpathSync: (p) => fs.realpathSync(p),
@@ -7899,12 +7975,10 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     if ((grokNeedsRails || copied) && !railsPresent(home)) {
         throw new LanesError("rails_missing", `Hook rails are missing under ${home}; account not enabled`, { provider, account: id, home });
     }
-    config.providers[provider].accounts[id] = {
-        home,
-        enabled: true,
-    };
+    config.providers[provider].accounts[id] = nextAccount;
     const status = accountStatus(provider, id, config, {
         existsSync: ctx.existsSync,
+        hostname,
         probe: ctx.probeProvider,
         env: ctx.env,
     });
@@ -7916,6 +7990,93 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     writeLanesConfig(hqRoot, config);
     printJson({ ok: true, action: "accounts.login", account: status });
 }
+async function runAccountsSetHome(ctx, providerRaw, accountIdRaw, homeRaw, opts) {
+    if (!(await hostScopedAccountHomesEnabled(ctx))) {
+        throw new LanesError("host_scoped_account_homes_disabled", "Setting a host-specific account home requires the lanes.host-scoped-account-homes flag", { flag: LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG });
+    }
+    const callerCwd = ctx.callerCwd();
+    const hqRoot = ctx.hqRoot();
+    const provider = parseLaneProvider(providerRaw);
+    const id = accountIdRaw.trim();
+    if (!id) {
+        throw new AccountResolutionError("unknown_account", "account-id must be non-empty", {
+            provider,
+            account: accountIdRaw,
+            enabled: [],
+        });
+    }
+    const hostname = opts.host === undefined ? ctx.hostname().trim() : opts.host.trim();
+    if (!hostname || (opts.host !== undefined && hostname !== opts.host)) {
+        throw new LanesError("invalid_host", "--host must be a non-empty hostname without surrounding whitespace", {
+            host: opts.host ?? "",
+        });
+    }
+    if (!homeRaw.trim()) {
+        throw new LanesError("invalid_account_home", "home path must be a non-empty path", {
+            provider,
+            account: id,
+        });
+    }
+    const config = loadLanesConfig(hqRoot);
+    const account = config.providers[provider].accounts[id];
+    if (account === undefined) {
+        throw new AccountResolutionError("unknown_account", `Unknown account ${JSON.stringify(id)} for ${provider}`, {
+            provider,
+            account: id,
+            enabled: Object.keys(config.providers[provider].accounts).filter((key) => config.providers[provider].accounts[key]?.enabled),
+        });
+    }
+    const homePath = homeRaw.trim();
+    const isCurrentHost = hostname === ctx.hostname().trim();
+    let home;
+    if (isCurrentHost) {
+        const homeResolved = homePath.startsWith("~") || path.isAbsolute(homePath)
+            ? homePath
+            : resolveCallerPath(callerCwd, homePath);
+        home = canonicalizeHome(homeResolved, {
+            homedir: ctx.homedir,
+            realpathSync: (p) => fs.realpathSync(p),
+            existsSync: (p) => fs.existsSync(p),
+        });
+    }
+    else if (homePath === "~" || homePath.startsWith("~/")) {
+        home = homePath;
+    }
+    else if (path.isAbsolute(homePath)) {
+        home = path.normalize(homePath);
+    }
+    else {
+        throw new LanesError("invalid_remote_account_home", "A home for another host must be an absolute path or start with ~/", { provider, account: id, hostname, home: homePath });
+    }
+    for (const [otherId, other] of Object.entries(config.providers[provider].accounts)) {
+        if (otherId !== id && effectiveAccountHome(other, hostname).home === home) {
+            throw new LanesError("duplicate_account_home", `Home ${home} is already registered as ${provider} account ${otherId} on host ${hostname}`, { provider, accounts: [otherId, id], home, hostname });
+        }
+    }
+    if (home === account.home) {
+        if (account.hosts !== undefined) {
+            delete account.hosts[hostname];
+            if (Object.keys(account.hosts).length === 0)
+                delete account.hosts;
+        }
+    }
+    else {
+        const hosts = Object.assign(Object.create(null), account.hosts ?? {});
+        hosts[hostname] = { home };
+        account.hosts = hosts;
+    }
+    assertUniqueAccountHomes(provider, config.providers[provider].accounts);
+    writeLanesConfig(hqRoot, config);
+    printJson({
+        ok: true,
+        action: "accounts.set-home",
+        provider,
+        account: id,
+        hostname,
+        home,
+        home_source: home === account.home ? "default" : "host",
+    });
+}
 async function runAccountsEnable(ctx, providerRaw, accountId) {
     const hqRoot = ctx.hqRoot();
     const provider = parseLaneProvider(providerRaw);
@@ -7932,6 +8093,7 @@ async function runAccountsEnable(ctx, providerRaw, accountId) {
     }
     const status = accountStatus(provider, accountId, config, {
         existsSync: ctx.existsSync,
+        hostname: ctx.hostname(),
         probe: ctx.probeProvider,
         env: ctx.env,
     });
@@ -7948,6 +8110,7 @@ async function runAccountsEnable(ctx, providerRaw, accountId) {
         action: "accounts.enable",
         account: accountStatus(provider, accountId, loadLanesConfig(hqRoot), {
             existsSync: ctx.existsSync,
+            hostname: ctx.hostname(),
             probe: ctx.probeProvider,
             env: ctx.env,
         }),
@@ -7976,6 +8139,7 @@ async function runAccountsDisable(ctx, providerRaw, accountId, opts) {
         action: "accounts.disable",
         account: accountStatus(provider, accountId, loadLanesConfig(hqRoot), {
             existsSync: ctx.existsSync,
+            hostname: ctx.hostname(),
             probe: ctx.probeProvider,
             env: ctx.env,
         }),
@@ -8490,6 +8654,17 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runAccountsBalance(ctx, opts);
     }));
+    accounts
+        .command("set-home")
+        .description("Set the host-specific home for an existing provider account")
+        .argument("<provider>", "claude | codex | grok")
+        .argument("<account-id>", "Existing account id")
+        .argument("<path>", "Home directory for this host")
+        .option("--host <hostname>", "Host key (defaults to this host's hostname)")
+        .option("--json", "JSON on stdout (always)")
+        .action(wrap(async (provider, accountId, home, opts) => {
+        await runAccountsSetHome(ctx, provider, accountId, home, opts);
+    }));
     accounts
         .command("login")
         .description("Create a home, run the vendor login, and register the account")

package/dist/lib/lanes/account-home.d.ts

@@ -0,0 +1,8 @@
+import type { AccountConfig } from "./types.js";
+export type EffectiveAccountHome = {
+    home: string;
+    source: "host" | "default";
+};
+/** Resolve the account home for this host; an empty host identity fails back to the default. */
+export declare function effectiveAccountHome(account: AccountConfig, hostname?: string): EffectiveAccountHome;
+//# sourceMappingURL=account-home.d.ts.map

package/dist/lib/lanes/account-home.js

@@ -0,0 +1,10 @@
+import * as os from "node:os";
+/** Resolve the account home for this host; an empty host identity fails back to the default. */
+export function effectiveAccountHome(account, hostname = os.hostname()) {
+    const host = hostname.trim();
+    const hostHome = host ? account.hosts?.[host]?.home : undefined;
+    return hostHome === undefined
+        ? { home: account.home, source: "default" }
+        : { home: hostHome, source: "host" };
+}
+//# sourceMappingURL=account-home.js.map