@indigoai-us/hq-cli 5.228.0 → 5.228.1

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [5.228.1] — 2026-09-27
+
+### Fixed
+
+- Reparenting an Outpost lane from the primary now dispatches to the owner,
+  where the hierarchy, tenant, depth, and enabled hire-grant checks are repeated.
+  The primary syncs the changed lane and each descendant whose depth changed.
+  `hq lanes show <lane-id>` refreshes that Outpost lane and its descendants
+  from the owner, including senior history, depth, and grants. Lane sessions
+  now share their lane's depth, and an SSM owner dispatch can change a
+  user-senior lane's grant without allowing a lane caller to impersonate the
+  user.
+
 ## [5.228.0] — 2026-09-27
 
 ### Changed

package/dist/command-catalog.generated.d.ts

@@ -7480,6 +7480,28 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "reparent-target";
+        readonly description: "";
+        readonly aliases: readonly [];
+        readonly hidden: true;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--senior <ref>";
+            readonly description: "New senior ref";
+        }, {
+            readonly flags: "--reason <text>";
+            readonly description: "Why the lane is being re-parented";
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "grant-target";
         readonly description: "";

package/dist/command-catalog.generated.js

@@ -9670,6 +9670,35 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "reparent-target",
+                "description": "",
+                "aliases": [],
+                "hidden": true,
+                "usage": "[options] <lane-id>",
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--senior <ref>",
+                        "description": "New senior ref"
+                    },
+                    {
+                        "flags": "--reason <text>",
+                        "description": "Why the lane is being re-parented"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "grant-target",
                 "description": "",

package/dist/commands/lanes.js

@@ -1668,7 +1668,11 @@ function depthOfRef(hqRoot, ref, ctx, visited = new Set(), override) {
                 senior: ref,
             });
         }
-        return depthOfRef(hqRoot, seniorOfSession(hqRoot, ref.id, ctx), ctx, visited, override) + 1;
+        const sessionSenior = seniorOfSession(hqRoot, ref.id, ctx);
+        const seniorDepth = depthOfRef(hqRoot, sessionSenior, ctx, visited, override);
+        // A lane's execution session shares the lane's depth. Other sessions are
+        // their own authority hop, including user-owned and nested sessions.
+        return seniorDepth + (sessionSenior.kind === "lane" ? 0 : 1);
     }
     if (!ref.id) {
         throw new LanesError("invalid_senior_ref", "Lane senior is missing an id", {
@@ -3617,9 +3621,15 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         dispatched = await ctx.dispatchOutpostExec({
             outpostId,
             command: buildOutpostLaneCommand({
-                action: action === "grant" ? "grant-target" : action,
+                action: action === "grant"
+                    ? "grant-target"
+                    : action === "reparent"
+                        ? "reparent-target"
+                        : action,
                 laneId: lane.lane_id,
-                hqBinary: action === "grant" ? outpostCliOverride(ctx, outpostId) : undefined,
+                hqBinary: action === "grant" || action === "reparent"
+                    ? outpostCliOverride(ctx, outpostId)
+                    : undefined,
                 text: options.text,
                 project: options.project,
                 story: options.story,
@@ -3629,6 +3639,8 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                 worker: options.worker,
                 keepAlive: options.keepAlive,
                 hire: options.hire,
+                senior: options.senior,
+                reason: options.reason,
                 grantContext,
                 compact: options.compact,
             }),
@@ -3682,6 +3694,9 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
             owner_error: ownerErrorFromOutput(dispatched.stdout),
         });
     }
+    const changedDescendantIds = action === "reparent"
+        ? parseReparentDescendantIds(remote?.changed_descendant_ids, lane.lane_id, outpostId)
+        : [];
     const resultConfirmed = remote !== null &&
         remote.ok === true &&
         remote.action === action &&
@@ -3690,8 +3705,11 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
             ? remote.accepted === true
             : action === "grant"
                 ? remote.hire_grant === Number(options.hire)
-                : remote.delivery_status === "worker_spawned" ||
-                    remote.delivery_status === "queued_on_target_account");
+                : action === "reparent"
+                    ? remote.lane !== null && typeof remote.lane === "object" &&
+                        Array.isArray(remote.changed_descendant_ids)
+                    : remote.delivery_status === "worker_spawned" ||
+                        remote.delivery_status === "queued_on_target_account");
     if (!resultConfirmed) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without a confirmed ${action} result for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
@@ -3712,6 +3730,25 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
         return;
     }
+    if (action === "reparent") {
+        const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
+        const descendants = [];
+        for (const descendantId of changedDescendantIds) {
+            const ownerDescendant = await readOutpostLaneSnapshot(ctx, outpostId, descendantId);
+            descendants.push(syncLaneRecordFromOwner(ctx.hqRoot(), descendantId, outpostId, ownerDescendant, undefined, { allowNonTerminal: true }));
+        }
+        printJson({
+            ...remote,
+            lane_id: ownerLane.lane_id,
+            lane: ownerLane,
+            changed_descendant_ids: changedDescendantIds,
+            descendants,
+            outpost_id: outpostId,
+            outpost_command_id: dispatched.commandId,
+            outpost_transport: "outposts_exec",
+        });
+        return;
+    }
     printJson({
         ...remote,
         outpost_id: outpostId,
@@ -3719,6 +3756,42 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         outpost_transport: "outposts_exec",
     });
 }
+function parseReparentDescendantIds(value, laneId, outpostId) {
+    if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || id.trim() === "")) {
+        throw new LanesError("outpost_reparent_result_invalid", `Outpost ${outpostId} returned an invalid descendant list for lane ${laneId}`, { lane_id: laneId, outpost_id: outpostId });
+    }
+    const ids = value;
+    if (new Set(ids).size !== ids.length || ids.includes(laneId)) {
+        throw new LanesError("outpost_reparent_result_invalid", `Outpost ${outpostId} returned duplicate or self-referential descendants for lane ${laneId}`, { lane_id: laneId, outpost_id: outpostId, descendant_lane_ids: ids });
+    }
+    return ids;
+}
+async function readOutpostLaneSnapshot(ctx, outpostId, laneId) {
+    let dispatched;
+    try {
+        dispatched = await ctx.dispatchOutpostExec({
+            outpostId,
+            command: buildOutpostLaneCommand({
+                action: "show",
+                laneId,
+                hqBinary: outpostCliOverride(ctx, outpostId),
+            }),
+            timeoutSeconds: OUTPOST_HIRE_SUMMARY_TIMEOUT_SECONDS,
+            waitMs: OUTPOST_HIRE_SUMMARY_WAIT_MS,
+        });
+    }
+    catch (err) {
+        throw new LanesError("outpost_lane_sync_unavailable", `Could not refresh descendant lane ${laneId} from Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: laneId, outpost_id: outpostId });
+    }
+    if (dispatched.done !== true || dispatched.status !== "Success" || dispatched.exitCode !== 0) {
+        throw new LanesError("outpost_lane_sync_unavailable", `Outpost ${outpostId} did not confirm the snapshot for descendant lane ${laneId}`, { lane_id: laneId, outpost_id: outpostId, command_id: dispatched.commandId });
+    }
+    const remote = parseRemoteJson(dispatched.stdout, "Outpost descendant lane snapshot");
+    if (!remote || remote.ok !== true || remote.action !== "show" || remote.lane === undefined) {
+        throw new LanesError("outpost_lane_sync_invalid", `Outpost ${outpostId} returned an invalid snapshot for descendant lane ${laneId}`, { lane_id: laneId, outpost_id: outpostId, command_id: dispatched.commandId });
+    }
+    return remote.lane;
+}
 async function dispatchOutpostQuestionAnswer(ctx, lane, questionId, options) {
     if (lane.host.kind !== "outpost") {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to answer its question`, { lane_id: lane.lane_id, question_id: questionId });
@@ -4717,9 +4790,38 @@ async function runMoveTarget(ctx, laneId, opts) {
         account: moved.account ?? null,
     });
 }
+async function refreshOutpostLaneCopiesForShow(ctx, lane, localLanes) {
+    if (lane.host.kind !== "outpost" || laneRunsHere(lane, reconcileHostFromCtx(ctx))) {
+        return lane;
+    }
+    const outpostId = lane.host.id;
+    const descendantIds = localLanes
+        .filter((candidate) => candidate.lane_id !== lane.lane_id &&
+        candidate.host.kind === "outpost" && candidate.host.id === outpostId &&
+        walkHitsLane(ctx.hqRoot(), candidate.senior, lane.lane_id, ctx))
+        .map((candidate) => candidate.lane_id);
+    const refresh = async (laneId) => {
+        try {
+            const ownerLane = await readOutpostLaneSnapshot(ctx, outpostId, laneId);
+            return syncLaneRecordFromOwner(ctx.hqRoot(), laneId, outpostId, ownerLane, undefined, { allowNonTerminal: true });
+        }
+        catch (err) {
+            const detail = isLanesError(err)
+                ? `${err.error}: ${err.message}`
+                : `outpost_lane_sync_unavailable: ${dispatchErrorMessage(err)}`;
+            process.stderr.write(`hq lanes: owner snapshot refresh failed for lane ${laneId}: ${detail}\n`);
+            return null;
+        }
+    };
+    const refreshed = await mapWithConcurrency([lane.lane_id, ...descendantIds], OUTPOST_HIRE_SUMMARY_CONCURRENCY, refresh);
+    const refreshedLane = refreshed[0] ?? null;
+    return refreshedLane ?? lane;
+}
 async function runShow(ctx, laneId) {
     const hqRoot = ctx.hqRoot();
-    const storedLane = readLane(hqRoot, laneId);
+    const initialLane = readLane(hqRoot, laneId);
+    const initialLanes = loadAllLanes(hqRoot);
+    const storedLane = await refreshOutpostLaneCopiesForShow(ctx, initialLane, initialLanes);
     const allLanes = loadAllLanes(hqRoot);
     const hire = await laneHirePresentation(ctx, storedLane, allLanes);
     const remoteQueued = storedLane.state === "queued" &&
@@ -6913,6 +7015,29 @@ function archiveResumeMessage(hqRoot, laneId, message) {
     fs.writeFileSync(path.join(dir, `${message.message_id}.resume.jsonl`), `${JSON.stringify(message)}\n`, "utf8");
 }
 async function runReparent(ctx, laneId, opts) {
+    const hqRoot = ctx.hqRoot();
+    if (!opts.senior) {
+        throw new LanesError("missing_senior", "--senior is required", {});
+    }
+    const initial = readLane(hqRoot, laneId);
+    if (initial.host.kind === "outpost" && !laneRunsHere(initial, reconcileHostFromCtx(ctx))) {
+        await dispatchOutpostLaneCommand(ctx, initial, "reparent", {
+            senior: opts.senior,
+            reason: opts.reason,
+        });
+        return;
+    }
+    const result = await reparentOnOwner(ctx, laneId, opts);
+    printJson({
+        ok: true,
+        action: "reparent",
+        lane_id: result.lane.lane_id,
+        lane: result.lane,
+        pending_questions: result.pendingQuestions,
+        changed_descendant_ids: result.changedDescendantIds,
+    });
+}
+async function reparentOnOwner(ctx, laneId, opts) {
     const hqRoot = ctx.hqRoot();
     if (!opts.senior) {
         throw new LanesError("missing_senior", "--senior is required", {});
@@ -6925,7 +7050,25 @@ async function runReparent(ctx, laneId, opts) {
         ...(initial.senior.kind === "lane" && initial.senior.id ? [initial.senior.id] : []),
         ...(nextSenior.kind === "lane" && nextSenior.id ? [nextSenior.id] : []),
     ];
-    withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts));
+    return withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts));
+}
+async function runReparentOwnerTarget(ctx, laneId, opts) {
+    if (!ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("outpost_reparent_dispatch_unauthorized", "The Outpost reparent target is available only to an SSM Run Command dispatch", { lane_id: laneId });
+    }
+    const lane = readLane(ctx.hqRoot(), laneId);
+    if (lane.host.kind !== "outpost" || !laneIsHostedHere(ctx, lane)) {
+        throw new LanesError("lane_remote", `Outpost reparent target cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: lane.host });
+    }
+    const result = await reparentOnOwner(ctx, laneId, opts);
+    printJson({
+        ok: true,
+        action: "reparent",
+        lane_id: result.lane.lane_id,
+        lane: result.lane,
+        pending_questions: result.pendingQuestions,
+        changed_descendant_ids: result.changedDescendantIds,
+    });
 }
 function runReparentLocked(ctx, laneId, opts) {
     const hqRoot = ctx.hqRoot();
@@ -6996,7 +7139,11 @@ function runReparentLocked(ctx, laneId, opts) {
                 to_depth: descendantDepth,
             });
         }
-        descendants.push({ laneId: other.lane_id, depth: descendantDepth });
+        descendants.push({
+            laneId: other.lane_id,
+            depth: descendantDepth,
+            changed: descendantDepth !== oldDescendantDepth,
+        });
     }
     const at = ctx.now().toISOString();
     const updated = casUpdateLane(hqRoot, laneId, (current) => {
@@ -7041,12 +7188,13 @@ function runReparentLocked(ctx, laneId, opts) {
             };
         });
     }
-    printJson({
-        ok: true,
-        action: "reparent",
+    return {
         lane: updated,
-        pending_questions: pending.length,
-    });
+        pendingQuestions: pending.length,
+        changedDescendantIds: descendants
+            .filter((descendant) => descendant.changed)
+            .map((descendant) => descendant.laneId),
+    };
 }
 const CANONICAL_LOG_STREAMS = [
     "watcher.err",
@@ -8979,6 +9127,14 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runCreate(ctx, opts);
     }));
+    lanes
+        .command("reparent-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--senior <ref>", "New senior ref")
+        .option("--reason <text>", "Why the lane is being re-parented")
+        .action(wrap(async (laneId, opts) => {
+        await runReparentOwnerTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("grant-target", { hidden: true })
         .argument("<lane-id>", "Lane id")

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -27,7 +27,7 @@ export interface OutpostDispatchResult {
     stderr: string;
 }
 export interface OutpostLaneCommand {
-    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target";
+    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target" | "reparent-target";
     laneId: string;
     hqBinary?: string;
     text?: string;
@@ -40,6 +40,8 @@ export interface OutpostLaneCommand {
     keepAlive?: boolean;
     hire?: string;
     grantContext?: string;
+    senior?: string;
+    reason?: string;
     compact?: boolean;
 }
 export declare function buildOutpostQuestionAnswerCommand(input: {

package/dist/lib/lanes/outpost-dispatch.js

@@ -150,6 +150,8 @@ export function buildOutpostLaneCommand(input) {
         ["--worker", input.worker],
         ["--hire", input.hire],
         ["--grant-context", input.grantContext],
+        ["--senior", input.senior],
+        ["--reason", input.reason],
     ]) {
         if (value !== undefined)
             args.push(flag, value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.228.0",
+  "version": "5.228.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {