@indigoai-us/hq-cli 5.229.0 → 5.229.1

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.229.1] — 2026-09-27
+
+### Fixed
+
+- An authorized `hq lanes resume --worker` on an Outpost re-pins a changed
+  worker profile before spawn, preserves the provider session, records the
+  hash change in lane history, and syncs the resulting lane record to primary.
+
 ## [5.229.0] — 2026-09-27
 
 ### Added
@@ -13,6 +21,8 @@
   new entity, and to skip glossary or translation table rows, paths and names
   built from tags or slugs.
 
+## [5.228.4] — 2026-09-27
+
 ### Fixed
 
 - Account history now distinguishes automatic moves caused by a quota hold, an

package/dist/commands/lanes.js

@@ -25,6 +25,7 @@ import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { resolveProcessFlagGate } from "../lib/flag-registry.js";
 import { defaultTrackerActor, LANES_TRACKER_FLAG, LANES_TRACKER_MESH_FLAG, registerLaneTrackerCommands, } from "./lanes-tracker.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
+import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
 import { buildOutpostCapacityCommand, buildOutpostBalanceMoveCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostMoveTargetCommand, buildOutpostQuestionAnswerCommand, buildOutpostQuestionListCommand, buildOutpostQuestionShowCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, outpostRejectedEffortOption, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
@@ -3564,6 +3565,10 @@ function parseRemoteJson(stdout, surface) {
     }
     return null;
 }
+function outpostRejectedProfileRepinOption(result) {
+    return result.exitCode !== 0 &&
+        /unknown option\s+(?:['"])?--profile-repin-context(?:['"])?(?:\s|$)/i.test(`${result.stderr}\n${result.stdout}`);
+}
 function verifyOutpostProfileContent(hqRoot, lane) {
     if (lane.host.kind !== "outpost" || lane.worker_profile === undefined)
         return;
@@ -3579,6 +3584,89 @@ function verifyOutpostProfileContent(hqRoot, lane) {
         });
     }
 }
+function resumeProfileRepinActor(ctx) {
+    const laneId = ctx.env.HQ_LANE_ID?.trim();
+    if (laneId)
+        return `lane:${laneId}`;
+    const sessionId = sessionIdFromEnv(ctx.env);
+    return sessionId ? `session:${sessionId}` : "ssm-owner-dispatch";
+}
+function workerProfileHashMismatch(lane, profile) {
+    return new LanesError("worker_profile_hash_mismatch", `Worker profile ${JSON.stringify(profile.id)} on Outpost ${lane.host.id} does not match the hash recorded by the lane`, {
+        lane_id: lane.lane_id,
+        worker: profile.id,
+        outpost: lane.host.kind === "outpost" ? lane.host.id : null,
+        expected_hash: lane.worker_profile_hash ?? null,
+        actual_hash: profile.profile.contentHash,
+    });
+}
+function authorizeResumeProfileRepin(ctx, lane, profile, encodedContext) {
+    const ssmOwnerDispatch = ctx.isSsmOwnerDispatch();
+    if (encodedContext !== undefined && !ssmOwnerDispatch) {
+        throw profile === undefined
+            ? new LanesError("worker_profile_hash_mismatch", "Profile re-pin context is only valid on an Outpost owner dispatch", { lane_id: lane.lane_id })
+            : workerProfileHashMismatch(lane, profile);
+    }
+    let context;
+    if (encodedContext !== undefined) {
+        try {
+            context = parseOutpostProfileRepinContext(encodedContext, lane.lane_id);
+        }
+        catch {
+            throw profile === undefined
+                ? new LanesError("worker_profile_hash_mismatch", "Profile re-pin context is invalid", { lane_id: lane.lane_id })
+                : workerProfileHashMismatch(lane, profile);
+        }
+        if (lane.host.kind !== "outpost" ||
+            !sameHireGrantSenior(lane.senior, context.expected_senior)) {
+            throw profile === undefined
+                ? new LanesError("worker_profile_hash_mismatch", "Lane senior changed after profile re-pin authorization", { lane_id: lane.lane_id })
+                : workerProfileHashMismatch(lane, profile);
+        }
+    }
+    if (profile === undefined ||
+        lane.host.kind !== "outpost" ||
+        lane.worker_profile_hash === profile.profile.contentHash) {
+        return undefined;
+    }
+    if (ssmOwnerDispatch) {
+        if (context === undefined)
+            throw workerProfileHashMismatch(lane, profile);
+        return {
+            kind: "ssm-owner-dispatch",
+            expectedSenior: context.expected_senior,
+            actor: context.actor,
+            reason: context.reason,
+            newHash: profile.profile.contentHash,
+        };
+    }
+    if (context !== undefined || !callerMatchesSenior(ctx, lane.senior)) {
+        throw workerProfileHashMismatch(lane, profile);
+    }
+    return {
+        kind: "senior",
+        expectedSenior: lane.senior,
+        actor: resumeProfileRepinActor(ctx),
+        reason: "resume --worker",
+        newHash: profile.profile.contentHash,
+    };
+}
+function assertResumeProfileRepinStillAuthorized(ctx, current, authorization) {
+    const authorized = current.host.kind === "outpost" &&
+        sameHireGrantSenior(current.senior, authorization.expectedSenior) &&
+        (authorization.kind === "ssm-owner-dispatch"
+            ? ctx.isSsmOwnerDispatch()
+            : callerMatchesSenior(ctx, current.senior));
+    if (!authorized) {
+        throw new LanesError("worker_profile_hash_mismatch", `Lane ${current.lane_id}'s senior changed before its Outpost profile could be re-pinned`, {
+            lane_id: current.lane_id,
+            expected_senior: authorization.expectedSenior,
+            current_senior: current.senior,
+            expected_hash: current.worker_profile_hash ?? null,
+            actual_hash: authorization.newHash,
+        });
+    }
+}
 function laneIsHostedHere(ctx, lane) {
     if (lane.host.kind !== "outpost")
         return true;
@@ -3603,6 +3691,15 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch to`, { lane_id: lane.lane_id });
     }
     const outpostId = lane.host.id;
+    const profileRepinContext = action === "resume" &&
+        options.worker !== undefined &&
+        callerMatchesSenior(ctx, lane.senior)
+        ? createOutpostProfileRepinContext({
+            laneId: lane.lane_id,
+            expectedSenior: lane.senior,
+            actor: resumeProfileRepinActor(ctx),
+        })
+        : undefined;
     let grantContext;
     let grantHierarchy;
     if (action === "grant") {
@@ -3618,7 +3715,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
     }
     let dispatched;
     try {
-        dispatched = await ctx.dispatchOutpostExec({
+        const dispatchCommand = (repinContext) => ctx.dispatchOutpostExec({
             outpostId,
             command: buildOutpostLaneCommand({
                 action: action === "grant"
@@ -3642,9 +3739,15 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                 senior: options.senior,
                 reason: options.reason,
                 grantContext,
+                ...(repinContext !== undefined ? { profileRepinContext: repinContext } : {}),
                 compact: options.compact,
             }),
         });
+        dispatched = await dispatchCommand(profileRepinContext);
+        if (profileRepinContext !== undefined &&
+            outpostRejectedProfileRepinOption(dispatched)) {
+            dispatched = await dispatchCommand();
+        }
     }
     catch (err) {
         throw new LanesError("outpost_dispatch_failed", `Could not dispatch ${action} for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
@@ -3663,6 +3766,14 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
     }
     if (ownerError) {
+        if (action === "resume" && ownerError.error === "worker_profile_hash_mismatch") {
+            throw new LanesError(ownerError.error, ownerError.message, {
+                ...ownerError.details,
+                lane_id: lane.lane_id,
+                outpost_id: outpostId,
+                command_id: dispatched.commandId,
+            });
+        }
         throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the ${action} command: ${ownerError.message}`, {
             lane_id: lane.lane_id,
             outpost_id: outpostId,
@@ -3708,8 +3819,9 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                 : action === "reparent"
                     ? remote.lane !== null && typeof remote.lane === "object" &&
                         Array.isArray(remote.changed_descendant_ids)
-                    : remote.delivery_status === "worker_spawned" ||
-                        remote.delivery_status === "queued_on_target_account");
+                    : (remote.delivery_status === "worker_spawned" ||
+                        remote.delivery_status === "queued_on_target_account") &&
+                        (options.worker === undefined || remote.lane !== undefined));
     if (!resultConfirmed) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without a confirmed ${action} result for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
@@ -3730,19 +3842,22 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
         return;
     }
-    if (action === "reparent") {
+    if (action === "reparent" || (action === "resume" && options.worker !== undefined)) {
         const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
         const descendants = [];
-        for (const descendantId of changedDescendantIds) {
-            const ownerDescendant = await readOutpostLaneSnapshot(ctx, outpostId, descendantId);
-            descendants.push(syncLaneRecordFromOwner(ctx.hqRoot(), descendantId, outpostId, ownerDescendant, undefined, { allowNonTerminal: true }));
+        if (action === "reparent") {
+            for (const descendantId of changedDescendantIds) {
+                const ownerDescendant = await readOutpostLaneSnapshot(ctx, outpostId, descendantId);
+                descendants.push(syncLaneRecordFromOwner(ctx.hqRoot(), descendantId, outpostId, ownerDescendant, undefined, { allowNonTerminal: true }));
+            }
         }
         printJson({
             ...remote,
             lane_id: ownerLane.lane_id,
             lane: ownerLane,
-            changed_descendant_ids: changedDescendantIds,
-            descendants,
+            ...(action === "reparent"
+                ? { changed_descendant_ids: changedDescendantIds, descendants }
+                : {}),
             outpost_id: outpostId,
             outpost_command_id: dispatched.commandId,
             outpost_transport: "outposts_exec",
@@ -5248,6 +5363,18 @@ function applyResumeProfileAndEffort(current, next, input) {
         next.worker_pack = input.profile.pack;
         next.worker_profile = profile.id;
         next.worker_profile_hash = profile.contentHash;
+        if (input.profileRepin !== undefined &&
+            current.host.kind === "outpost" &&
+            current.worker_profile_hash !== profile.contentHash) {
+            const entry = {
+                old_hash: current.worker_profile_hash ?? null,
+                new_hash: profile.contentHash,
+                actor: input.profileRepin.actor,
+                at: input.at ?? new Date().toISOString(),
+                reason: input.profileRepin.reason,
+            };
+            next.worker_profile_repin_history = appendCappedHistory(current.worker_profile_repin_history ?? [], entry);
+        }
         next.worker_profile_ignored = ignoredWorkerProfileFields(current.provider);
         next.worker_policy_delivery = undefined;
         if (profile.meta.keep_alive !== undefined) {
@@ -5308,6 +5435,9 @@ function recordResumeSetup(ctx, lane, input) {
         if (current.version !== lane.version) {
             throw new LanesError("lane_resume_setup_conflict", `Lane ${lane.lane_id} changed while resume settings were prepared; run the resume again`, { lane_id: lane.lane_id, prepared_version: lane.version, version: current.version });
         }
+        if (input.profileRepin !== undefined) {
+            assertResumeProfileRepinStillAuthorized(ctx, current, input.profileRepin);
+        }
         const next = { ...current };
         applyResumeProfileAndEffort(current, next, { ...input, at: ctx.now().toISOString() });
         if (input.cliModel !== undefined) {
@@ -5525,6 +5655,9 @@ async function prepareAccountMove(ctx, lane, input) {
             if (current.version !== lane.version) {
                 throw new LanesError("account_move_conflict", `Lane ${laneId} changed while the move was prepared (version ${lane.version} → ${current.version}, state ${current.state}, account ${current.account ?? "(none)"}); run the move again`, { lane_id: laneId, prepared_version: lane.version, version: current.version, state: current.state, account: current.account ?? null });
             }
+            if (input.profileRepin !== undefined) {
+                assertResumeProfileRepinStillAuthorized(ctx, current, input.profileRepin);
+            }
             const next = {
                 ...current,
                 account: target,
@@ -5549,6 +5682,7 @@ async function prepareAccountMove(ctx, lane, input) {
             };
             applyResumeProfileAndEffort(current, next, {
                 ...(input.workerProfile !== undefined ? { profile: input.workerProfile } : {}),
+                ...(input.profileRepin !== undefined ? { profileRepin: input.profileRepin } : {}),
                 ...(input.effort !== undefined ? { effort: input.effort } : {}),
                 at,
             });
@@ -6410,6 +6544,9 @@ function laneWithRecoveredProviderSession(hqRoot, lane) {
 async function runResume(ctx, laneId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    if (opts.profileRepinContext !== undefined && !ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("worker_profile_hash_mismatch", "Profile re-pin context is only valid on an Outpost owner dispatch", { lane_id: laneId });
+    }
     if (lane.host.kind === "outpost" && !laneIsHostedHere(ctx, lane)) {
         await dispatchOutpostLaneCommand(ctx, lane, "resume", opts);
         return;
@@ -6478,6 +6615,7 @@ async function runResume(ctx, laneId, opts) {
     const resumeProfile = opts.worker !== undefined
         ? resolveResumeProfile(ctx, lane, opts.worker)
         : undefined;
+    const profileRepin = authorizeResumeProfileRepin(ctx, lane, resumeProfile, opts.profileRepinContext);
     const keepAlive = opts.keepAlive === true
         ? true
         : resumeProfile?.profile.meta.keep_alive;
@@ -6502,6 +6640,7 @@ async function runResume(ctx, laneId, opts) {
             account: opts.account,
             cliModel: opts.model?.trim() || undefined,
             ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
+            ...(profileRepin !== undefined ? { profileRepin } : {}),
             ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
             pending: {
                 trigger: "resume",
@@ -6526,6 +6665,7 @@ async function runResume(ctx, laneId, opts) {
                     ? { preservedModel: automaticAccountSelection.preservedModel }
                     : {}),
                 ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
+                ...(profileRepin !== undefined ? { profileRepin } : {}),
                 ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
                 pending: {
                     trigger: "resume",
@@ -6544,6 +6684,7 @@ async function runResume(ctx, laneId, opts) {
     }
     lane = recordResumeSetup(ctx, lane, {
         ...(move === null && resumeProfile !== undefined ? { profile: resumeProfile } : {}),
+        ...(move === null && profileRepin !== undefined ? { profileRepin } : {}),
         ...(move === null && resumeEffort !== undefined ? { effort: resumeEffort } : {}),
         ...(keepAlive !== undefined ? { keepAlive } : {}),
         ...(move === null && keepCurrentAccount && opts.model !== undefined ? { cliModel: opts.model } : {}),
@@ -9419,6 +9560,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--model <id>", "Model for the moved lane (with --account only)")
         .option("--effort <level>", "Reasoning effort for the resumed provider turn")
         .option("--worker <profile>", "Attach a personal worker profile for the resumed turn")
+        .addOption(new Option("--profile-repin-context <base64url>").hideHelp())
         .option("--keep-alive", "Automatically resume done lead lanes while their story remains open")
         .option("--mesh-company <slug>", "Attach Work Mesh attribution after verifying company membership")
         .option("--no-compact", "Skip the resume-time compaction check for this resume")

package/dist/lib/lanes/index.d.ts

@@ -10,7 +10,7 @@ export type { AdmissionCapReason, AdmissionHost } from "./admission.js";
 export { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "./host-capacity.js";
 export type { HostCapacityAccount, HostCapacityProvider, HostCapacitySnapshot, HostPlacementChoice, } from "./host-capacity.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STORY_STATUSES, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";
-export type { AccountConfig, AttributionHistoryEntry, EnvelopeDecision, EnvelopeQuestion, HostKind, LaneCompanyRef, LaneAccountSelection, LaneAccountSelectionConsidered, LaneAccountSelectionHostCount, LaneEnvelope, LaneHost, LaneProvider, LanePlacementPolicy, LaneRecord, LaneStory, LaneStoryStatus, PendingResume, AccountHistoryEntry, LaneState, LanesConfig, LastEnvelopeRef, LivenessState, LivenessWindows, ProviderConfig, QuestionAnswer, QuestionBodyRef, QuestionRecord, QuestionStatus, QueuedReason, RaisedVia, RoutingHistoryEntry, RoutingReason, SeniorHistoryEntry, SeniorKind, SeniorRef, StoryStatus, TerminalLaneState, ThrottleConfig, } from "./types.js";
+export type { AccountConfig, AttributionHistoryEntry, EnvelopeDecision, EnvelopeQuestion, HostKind, LaneCompanyRef, LaneAccountSelection, LaneAccountSelectionConsidered, LaneAccountSelectionHostCount, LaneEnvelope, LaneHost, LaneProvider, LanePlacementPolicy, LaneRecord, LaneStory, LaneStoryStatus, PendingResume, AccountHistoryEntry, LaneState, LanesConfig, LastEnvelopeRef, LivenessState, LivenessWindows, ProviderConfig, QuestionAnswer, QuestionBodyRef, QuestionRecord, QuestionStatus, QueuedReason, RaisedVia, RoutingHistoryEntry, RoutingReason, SeniorHistoryEntry, SeniorKind, SeniorRef, WorkerProfileRepinHistoryEntry, StoryStatus, TerminalLaneState, ThrottleConfig, } from "./types.js";
 export { ACTIVE_LANE_STORY_STATUSES, activeLaneStories, laneStories, laneStory, storyKey, storyStatusForEnvelope, storyWarning, withCurrentStory, withLaneStories, } from "./stories.js";
 export { DEFAULT_ACCOUNT_HOMES, DEFAULT_AUTO_COMPACT_TOKENS, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerAutoCompactTokens, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";
 export type { ConfigLoadDeps, ConfigWriteDeps } from "./config.js";

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -40,6 +40,7 @@ export interface OutpostLaneCommand {
     keepAlive?: boolean;
     hire?: string;
     grantContext?: string;
+    profileRepinContext?: string;
     senior?: string;
     reason?: string;
     compact?: boolean;

package/dist/lib/lanes/outpost-dispatch.js

@@ -150,6 +150,7 @@ export function buildOutpostLaneCommand(input) {
         ["--worker", input.worker],
         ["--hire", input.hire],
         ["--grant-context", input.grantContext],
+        ["--profile-repin-context", input.profileRepinContext],
         ["--senior", input.senior],
         ["--reason", input.reason],
     ]) {

package/dist/lib/lanes/outpost-profile-repin.d.ts

@@ -0,0 +1,17 @@
+import { type SeniorRef } from "./types.js";
+declare const PROFILE_REPIN_CONTEXT_SCHEMA: "hq-lane-profile-repin-context.v1";
+export interface OutpostProfileRepinContext {
+    schema_version: typeof PROFILE_REPIN_CONTEXT_SCHEMA;
+    lane_id: string;
+    expected_senior: SeniorRef;
+    actor: string;
+    reason: "resume --worker";
+}
+export declare function createOutpostProfileRepinContext(input: {
+    laneId: string;
+    expectedSenior: SeniorRef;
+    actor: string;
+}): string;
+export declare function parseOutpostProfileRepinContext(encoded: string, expectedLaneId: string): OutpostProfileRepinContext;
+export {};
+//# sourceMappingURL=outpost-profile-repin.d.ts.map

package/dist/lib/lanes/outpost-profile-repin.js

@@ -0,0 +1,84 @@
+import { LanesError } from "./errors.js";
+import { isSeniorKind } from "./types.js";
+const PROFILE_REPIN_CONTEXT_SCHEMA = "hq-lane-profile-repin-context.v1";
+const MAX_CONTEXT_BYTES = 4 * 1024;
+function contextError(message) {
+    return new LanesError("worker_profile_repin_context_invalid", message, {});
+}
+function parseSenior(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    if (Object.keys(record).some((key) => key !== "kind" && key !== "id"))
+        return null;
+    if (!isSeniorKind(record.kind))
+        return null;
+    if (record.id !== undefined &&
+        (typeof record.id !== "string" || !record.id.trim() || record.id.trim() !== record.id))
+        return null;
+    if ((record.kind === "session" || record.kind === "lane") && record.id === undefined)
+        return null;
+    if (record.kind === "user" && record.id !== undefined)
+        return null;
+    return record.id === undefined
+        ? { kind: record.kind }
+        : { kind: record.kind, id: record.id };
+}
+export function createOutpostProfileRepinContext(input) {
+    const context = {
+        schema_version: PROFILE_REPIN_CONTEXT_SCHEMA,
+        lane_id: input.laneId,
+        expected_senior: input.expectedSenior.id === undefined
+            ? { kind: input.expectedSenior.kind }
+            : { kind: input.expectedSenior.kind, id: input.expectedSenior.id },
+        actor: input.actor,
+        reason: "resume --worker",
+    };
+    const encoded = Buffer.from(JSON.stringify(context), "utf8").toString("base64url");
+    if (Buffer.byteLength(encoded, "utf8") > MAX_CONTEXT_BYTES) {
+        throw contextError(`Profile re-pin context for lane ${input.laneId} is too large`);
+    }
+    return encoded;
+}
+export function parseOutpostProfileRepinContext(encoded, expectedLaneId) {
+    if (encoded.length === 0 ||
+        encoded.length > MAX_CONTEXT_BYTES ||
+        !/^[A-Za-z0-9_-]+$/.test(encoded)) {
+        throw contextError("Profile re-pin context must be bounded base64url text");
+    }
+    let raw;
+    try {
+        const decoded = Buffer.from(encoded, "base64url");
+        if (decoded.toString("base64url") !== encoded) {
+            throw new Error("non-canonical base64url");
+        }
+        raw = JSON.parse(decoded.toString("utf8"));
+    }
+    catch {
+        throw contextError("Profile re-pin context is not valid base64url JSON");
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw contextError("Profile re-pin context must be a JSON object");
+    }
+    const record = raw;
+    if (Object.keys(record).some((key) => !["schema_version", "lane_id", "expected_senior", "actor", "reason"].includes(key))) {
+        throw contextError("Profile re-pin context contains unknown fields");
+    }
+    const expectedSenior = parseSenior(record.expected_senior);
+    if (record.schema_version !== PROFILE_REPIN_CONTEXT_SCHEMA ||
+        record.lane_id !== expectedLaneId ||
+        expectedSenior === null ||
+        typeof record.actor !== "string" ||
+        !record.actor.trim() ||
+        record.reason !== "resume --worker") {
+        throw contextError(`Profile re-pin context is invalid for lane ${expectedLaneId}`);
+    }
+    return {
+        schema_version: PROFILE_REPIN_CONTEXT_SCHEMA,
+        lane_id: expectedLaneId,
+        expected_senior: expectedSenior,
+        actor: record.actor,
+        reason: "resume --worker",
+    };
+}
+//# sourceMappingURL=outpost-profile-repin.js.map

package/dist/lib/lanes/store.js

@@ -562,6 +562,29 @@ export function parseLaneRecord(raw, filePath) {
             path: filePath,
         });
     }
+    if (raw.worker_profile_repin_history !== undefined) {
+        if (!Array.isArray(raw.worker_profile_repin_history)) {
+            throw new LaneSchemaError("worker_profile_repin_history must be an array when present", {
+                path: filePath,
+                field: "worker_profile_repin_history",
+            });
+        }
+        for (const [index, entry] of raw.worker_profile_repin_history.entries()) {
+            const field = `worker_profile_repin_history[${index}]`;
+            if (!isPlainObject(entry) || Object.keys(entry).some((key) => !["old_hash", "new_hash", "actor", "at", "reason"].includes(key))) {
+                throw new LaneSchemaError(`${field} must be an audit entry`, { path: filePath, field });
+            }
+            if (entry.old_hash !== null && (typeof entry.old_hash !== "string" || !entry.old_hash.trim())) {
+                throw new LaneSchemaError(`${field}.old_hash must be a non-empty string or null`, { path: filePath, field });
+            }
+            for (const key of ["new_hash", "actor", "reason"]) {
+                if (typeof entry[key] !== "string" || !entry[key].trim()) {
+                    throw new LaneSchemaError(`${field}.${key} must be a non-empty string`, { path: filePath, field });
+                }
+            }
+            requireTimestamp(entry.at, `${field}.at`, filePath);
+        }
+    }
     if (raw.account_selection !== undefined) {
         parseLaneAccountSelection(raw.account_selection, filePath);
     }
@@ -853,6 +876,11 @@ export function mergeLaneRecords(live, sidecars) {
                 account_history: unionHistory(all.map((record) => record.account_history ?? []), entryIdentity, base.account_history ?? []),
             }
             : {}),
+        ...(all.some((record) => record.worker_profile_repin_history !== undefined)
+            ? {
+                worker_profile_repin_history: unionHistory(all.map((record) => record.worker_profile_repin_history ?? []), entryIdentity, base.worker_profile_repin_history ?? []),
+            }
+            : {}),
         stories: mergeLaneStories(all, base),
     };
 }

package/dist/lib/lanes/types.d.ts

@@ -283,6 +283,14 @@ export interface SeniorHistoryEntry {
     by: string;
     reason: string;
 }
+/** Evidence for a senior-authorized Outpost worker-profile content re-pin. */
+export interface WorkerProfileRepinHistoryEntry {
+    old_hash: string | null;
+    new_hash: string;
+    actor: string;
+    at: string;
+    reason: string;
+}
 export interface AttributionHistoryEntry {
     project_id: string;
     story_id: string;
@@ -372,6 +380,8 @@ export interface LaneRecord {
     hire_grant?: number;
     /** Content hash of the profile last applied to this lane. */
     worker_profile_hash?: string;
+    /** Bounded audit history of authorized Outpost profile hash re-pins. */
+    worker_profile_repin_history?: WorkerProfileRepinHistoryEntry[];
     /** Profile fields intentionally unsupported by the selected provider. */
     worker_profile_ignored?: string[];
     /** How policy files were delivered on the most recent profile spawn. */

package/dist/lib/lanes/types.js

@@ -223,7 +223,7 @@ export const LANE_FIELD_WRITERS = {
     state: ["creator", "command", "watcher", "reconcile", "spawn"], queued_reason: ["creator", "command", "spawn", "watcher", "reconcile"], queued_at: ["creator", "command", "spawn", "watcher", "reconcile"], admission_reserved_at: ["creator", "command", "reconcile", "spawn", "watcher"],
     pickup_validation_pending: ["creator", "command", "spawn", "reconcile"],
     pickup_validation_pending_since: ["creator", "command", "spawn", "reconcile"],
-    priority: ["command"], worker: ["creator", "command"], worker_path: ["creator", "command"], worker_pack: ["creator", "command"], worker_profile: ["creator", "command"], worker_profile_hash: ["creator", "command", "spawn"], worker_profile_ignored: ["creator", "command", "spawn"], worker_policy_delivery: ["command", "spawn"],
+    priority: ["command"], worker: ["creator", "command"], worker_path: ["creator", "command"], worker_pack: ["creator", "command"], worker_profile: ["creator", "command"], worker_profile_hash: ["creator", "command", "spawn"], worker_profile_repin_history: ["command"], worker_profile_ignored: ["creator", "command", "spawn"], worker_policy_delivery: ["command", "spawn"],
     keep_alive: ["creator", "command"], keep_alive_opted_in_at: ["creator", "command"], keep_alive_blocked_reason: ["command", "reconcile"], keep_alive_resume_count: ["command", "reconcile"], keep_alive_last_resume_at: ["command", "reconcile"], keep_alive_next_eligible_at: ["command", "reconcile"], keep_alive_exhausted_at: ["command", "reconcile"],
     provider: ["creator"], account: ["creator", "spawn", "command", "watcher", "reconcile"], account_selection: ["creator", "command"], admission_accounts: ["creator", "command"], account_history: ["command", "spawn", "watcher", "reconcile"], pending_resume: ["command", "spawn", "watcher", "reconcile"], placement_default: ["creator"], host: ["creator", "command"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], attribution_history: ["command"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.229.0",
+  "version": "5.229.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {