@indigoai-us/hq-cli 5.230.1 → 5.230.2

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.230.2] — 2026-09-27
+
+### Fixed
+
+- Resuming a terminal Outpost lane whose senior lives on the primary now checks
+  hire-grant capacity on both hosts using the primary hierarchy, then syncs the
+  running owner record back to the primary. An owner CLI that rejects the
+  hierarchy context now fails with an upgrade-required error instead of retrying
+  without the grant check.
+
 ## [5.230.1] — 2026-09-27
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -8056,6 +8056,9 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--worker <profile>";
             readonly description: "Attach a personal worker profile for the resumed turn";
+        }, {
+            readonly flags: "--grant-context <base64url>";
+            readonly description: "";
         }, {
             readonly flags: "--keep-alive";
             readonly description: "Automatically resume done lead lanes while their story remains open";

package/dist/command-catalog.generated.js

@@ -10421,6 +10421,10 @@ export const COMMAND_CATALOG = [
                         "flags": "--worker <profile>",
                         "description": "Attach a personal worker profile for the resumed turn"
                     },
+                    {
+                        "flags": "--grant-context <base64url>",
+                        "description": ""
+                    },
                     {
                         "flags": "--keep-alive",
                         "description": "Automatically resume done lead lanes while their story remains open"

package/dist/commands/lanes.js

@@ -1039,15 +1039,36 @@ async function mapWithConcurrency(values, concurrency, map) {
     await Promise.all(workers);
     return results;
 }
-async function withResumeHireAdmission(ctx, lane, fn) {
+async function withResumeHireAdmission(ctx, lane, fn, grantContext) {
     const hqRoot = ctx.hqRoot();
+    if (grantContext !== undefined && (!ctx.isSsmOwnerDispatch() ||
+        lane.host.kind !== "outpost" ||
+        !laneIsHostedHere(ctx, lane) ||
+        lane.senior.kind !== "lane" ||
+        !sameHireGrantSenior(lane.senior, grantContext.expected_senior))) {
+        throw new LanesError("hire_grant_senior_changed", `Lane ${lane.lane_id}'s senior changed after the primary authorized its resume`, { lane_id: lane.lane_id, expected_senior: grantContext.expected_senior, current_senior: lane.senior });
+    }
     if (!isTerminalLaneState(lane.state) ||
         lane.senior.kind !== "lane" ||
         !lane.senior.id) {
         return fn();
     }
+    if (grantContext === undefined &&
+        lane.host.kind === "outpost" &&
+        laneIsHostedHere(ctx, lane) &&
+        !listLaneIds(hqRoot).includes(lane.senior.id)) {
+        throw new LanesError("hire_grant_context_required", `Resume of Outpost lane ${lane.lane_id} requires the primary senior's hire-grant context`, { lane_id: lane.lane_id, senior_lane_id: lane.senior.id });
+    }
     return withHireGrantAdmission(hqRoot, lane.senior.id, (snapshot) => {
         const current = readLane(hqRoot, lane.lane_id);
+        if (grantContext !== undefined &&
+            !sameHireGrantSenior(current.senior, grantContext.expected_senior)) {
+            throw new LanesError("hire_grant_senior_changed", `Lane ${current.lane_id}'s senior changed before the Outpost resumed it`, {
+                lane_id: current.lane_id,
+                expected_senior: grantContext.expected_senior,
+                current_senior: current.senior,
+            });
+        }
         // A different resume already reactivated this lane; it occupies the slot
         // in the shared snapshot and is not a second hire.
         if (!isTerminalLaneState(current.state))
@@ -1056,7 +1077,7 @@ async function withResumeHireAdmission(ctx, lane, fn) {
         if (refusal !== null)
             throw refusal;
         return fn();
-    });
+    }, grantContext?.hierarchy);
 }
 const CAPACITY_PROBE_TIMEOUT_MS = 15_000;
 const MAX_PLACEMENT_OUTPOSTS = 16;
@@ -3569,6 +3590,10 @@ function outpostRejectedProfileRepinOption(result) {
     return result.exitCode !== 0 &&
         /unknown option\s+(?:['"])?--profile-repin-context(?:['"])?(?:\s|$)/i.test(`${result.stderr}\n${result.stdout}`);
 }
+function outpostRejectedGrantContextOption(result) {
+    return result.exitCode !== 0 &&
+        /unknown option\s+(?:['"])?--grant-context(?:['"])?(?:\s|$)/i.test(`${result.stderr}\n${result.stdout}`);
+}
 function verifyOutpostProfileContent(hqRoot, lane) {
     if (lane.host.kind !== "outpost" || lane.worker_profile === undefined)
         return;
@@ -3713,9 +3738,14 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         grantHierarchy = hierarchy;
         grantContext = createOutpostHireGrantContext(lane, hierarchy);
     }
+    else if (action === "resume" &&
+        lane.senior.kind === "lane") {
+        grantContext = createOutpostHireGrantContext(lane, loadAllLanes(ctx.hqRoot()));
+    }
     let dispatched;
+    let grantContextRejected = false;
     try {
-        const dispatchCommand = (repinContext) => ctx.dispatchOutpostExec({
+        const dispatchCommand = (contexts) => ctx.dispatchOutpostExec({
             outpostId,
             command: buildOutpostLaneCommand({
                 action: action === "grant"
@@ -3738,20 +3768,38 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                 hire: options.hire,
                 senior: options.senior,
                 reason: options.reason,
-                grantContext,
-                ...(repinContext !== undefined ? { profileRepinContext: repinContext } : {}),
+                grantContext: contexts.grantContext,
+                profileRepinContext: contexts.profileRepinContext,
                 compact: options.compact,
             }),
         });
-        dispatched = await dispatchCommand(profileRepinContext);
-        if (profileRepinContext !== undefined &&
-            outpostRejectedProfileRepinOption(dispatched)) {
-            dispatched = await dispatchCommand();
+        let contexts = { grantContext, profileRepinContext };
+        dispatched = await dispatchCommand(contexts);
+        for (let retry = 0; action === "resume" && retry < 2; retry += 1) {
+            if (contexts.grantContext !== undefined && outpostRejectedGrantContextOption(dispatched)) {
+                grantContextRejected = true;
+                break;
+            }
+            else if (contexts.profileRepinContext !== undefined &&
+                outpostRejectedProfileRepinOption(dispatched)) {
+                contexts = { ...contexts, profileRepinContext: undefined };
+            }
+            else {
+                break;
+            }
+            dispatched = await dispatchCommand(contexts);
         }
     }
     catch (err) {
         throw new LanesError("outpost_dispatch_failed", `Could not dispatch ${action} for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
     }
+    if (grantContextRejected) {
+        throw new LanesError("outpost_cli_upgrade_required", `Outpost ${outpostId} needs an hq-cli release containing this fix before it can resume lane ${lane.lane_id} under its primary-hosted senior`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            required_option: "--grant-context",
+        });
+    }
     const ownerError = ownerErrorFromOutput(dispatched.stdout);
     if (options.effort !== undefined && outpostRejectedEffortOption(dispatched)) {
         throw new LanesError("outpost_effort_unsupported", `Outpost ${outpostId} rejected --effort; update hq-cli on that Outpost before changing a lane's effort remotely`, {
@@ -3766,7 +3814,9 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
     }
     if (ownerError) {
-        if (action === "resume" && ownerError.error === "worker_profile_hash_mismatch") {
+        if (action === "resume" &&
+            (ownerError.error === "worker_profile_hash_mismatch" ||
+                ownerError.error.startsWith("hire_grant_"))) {
             throw new LanesError(ownerError.error, ownerError.message, {
                 ...ownerError.details,
                 lane_id: lane.lane_id,
@@ -3821,7 +3871,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
                         Array.isArray(remote.changed_descendant_ids)
                     : (remote.delivery_status === "worker_spawned" ||
                         remote.delivery_status === "queued_on_target_account") &&
-                        (options.worker === undefined || remote.lane !== undefined));
+                        remote.lane !== undefined);
     if (!resultConfirmed) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without a confirmed ${action} result for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
@@ -3842,7 +3892,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
         return;
     }
-    if (action === "reparent" || (action === "resume" && options.worker !== undefined)) {
+    if (action === "reparent" || action === "resume") {
         const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
         const descendants = [];
         if (action === "reparent") {
@@ -6549,16 +6599,25 @@ function laneWithRecoveredProviderSession(hqRoot, lane) {
 async function runResume(ctx, laneId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    const hireGrantContext = opts.grantContext === undefined
+        ? undefined
+        : (() => {
+            if (!ctx.isSsmOwnerDispatch()) {
+                throw new LanesError("hire_grant_dispatch_unauthorized", "Resume grant context is only valid on an Outpost owner dispatch", { lane_id: laneId });
+            }
+            return parseOutpostHireGrantContext(opts.grantContext, laneId);
+        })();
     if (opts.profileRepinContext !== undefined && !ctx.isSsmOwnerDispatch()) {
         throw new LanesError("worker_profile_hash_mismatch", "Profile re-pin context is only valid on an Outpost owner dispatch", { lane_id: laneId });
     }
     if (lane.host.kind === "outpost" && !laneIsHostedHere(ctx, lane)) {
+        await withResumeHireAdmission(ctx, lane, () => undefined);
         await dispatchOutpostLaneCommand(ctx, lane, "resume", opts);
         return;
     }
     // Fail before provider/session work if a terminal child would consume a
     // slot that its senior has already assigned elsewhere.
-    await withResumeHireAdmission(ctx, lane, () => undefined);
+    await withResumeHireAdmission(ctx, lane, () => undefined, hireGrantContext);
     assertLaneRunsHereForOperatorMutation(ctx, lane, "resume");
     const cliEffort = parseCliEffort(lane.provider, opts.effort);
     if (cliEffort !== undefined && !providerSupportsSessionResume(lane.provider)) {
@@ -6768,7 +6827,7 @@ async function runResume(ctx, laneId, opts) {
                     compact: opts.compact !== false,
                     effort: resumeEffort ?? recordedResumeEffort(lane),
                 });
-            });
+            }, hireGrantContext);
         }, ctx.sleep);
     }
     if (text !== undefined && messageId !== undefined) {
@@ -9567,6 +9626,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--effort <level>", "Reasoning effort for the resumed provider turn")
         .option("--worker <profile>", "Attach a personal worker profile for the resumed turn")
         .addOption(new Option("--profile-repin-context <base64url>").hideHelp())
+        .addOption(new Option("--grant-context <base64url>").hideHelp())
         .option("--keep-alive", "Automatically resume done lead lanes while their story remains open")
         .option("--mesh-company <slug>", "Attach Work Mesh attribution after verifying company membership")
         .option("--no-compact", "Skip the resume-time compaction check for this resume")

package/dist/lib/lanes/grants.d.ts

@@ -4,16 +4,16 @@ export type LaneHireGrantRow = Pick<LaneRecord, "lane_id" | "state" | "senior" |
 export declare function aliveDirectChildren<T extends LaneHireGrantRow>(lanes: readonly T[], parentLaneId: string): T[];
 export declare function assignedChildHireGrants(children: readonly LaneHireGrantRow[], exceptLaneId?: string): number;
 export interface HireGrantAdmissionSnapshot {
-    parent: LaneRecord;
-    children: LaneRecord[];
+    parent: LaneHireGrantRow;
+    children: LaneHireGrantRow[];
     parentGrant: number;
     availableChildGrant: number;
 }
 /** Shared refusal logic for resuming a terminal lane under an active senior. */
 export declare function terminalChildResumeHireGrantError(current: LaneRecord, snapshot: HireGrantAdmissionSnapshot): LanesError | null;
-export declare function hireGrantCapacityError(parent: LaneRecord, children: readonly LaneRecord[]): LanesError;
+export declare function hireGrantCapacityError(parent: LaneHireGrantRow, children: readonly LaneHireGrantRow[]): LanesError;
 /** Keep the occupancy snapshot and the resulting lane write in one parent-lock scope. */
-export declare function withHireGrantAdmission<T>(hqRoot: string, parentLaneId: string, fn: (snapshot: HireGrantAdmissionSnapshot) => T): T;
+export declare function withHireGrantAdmission<T>(hqRoot: string, parentLaneId: string, fn: (snapshot: HireGrantAdmissionSnapshot) => T, suppliedHierarchy?: readonly LaneHireGrantRow[]): T;
 export interface HireGrantBackfillRow {
     lane_id: string;
     existing_grant: number | null;

package/dist/lib/lanes/grants.js

@@ -72,10 +72,28 @@ export function hireGrantCapacityError(parent, children) {
     });
 }
 /** Keep the occupancy snapshot and the resulting lane write in one parent-lock scope. */
-export function withHireGrantAdmission(hqRoot, parentLaneId, fn) {
+export function withHireGrantAdmission(hqRoot, parentLaneId, fn, suppliedHierarchy) {
     return withLaneHireLocks(hqRoot, [parentLaneId], () => {
-        const parent = readLane(hqRoot, parentLaneId);
-        const allLanes = listLaneIds(hqRoot).map((id) => readLane(hqRoot, id));
+        const ownerLanes = listLaneIds(hqRoot).map((id) => readLane(hqRoot, id));
+        let allLanes;
+        let parent;
+        if (suppliedHierarchy === undefined) {
+            parent = readLane(hqRoot, parentLaneId);
+            allLanes = ownerLanes;
+        }
+        else {
+            const byId = new Map(suppliedHierarchy.map((lane) => [lane.lane_id, lane]));
+            // The owner copy is authoritative for every lane it stores; the supplied
+            // primary snapshot fills only hierarchy rows that live on another host.
+            for (const lane of ownerLanes)
+                byId.set(lane.lane_id, lane);
+            allLanes = [...byId.values()];
+            const suppliedParent = byId.get(parentLaneId);
+            if (!suppliedParent) {
+                throw new LanesError("hire_grant_context_invalid", `The dispatched hierarchy is missing senior lane ${parentLaneId}`, { senior_lane_id: parentLaneId });
+            }
+            parent = suppliedParent;
+        }
         const children = aliveDirectChildren(allLanes, parentLaneId);
         const parentGrant = parent.hire_grant ?? 0;
         const availableChildGrant = Math.max(0, parentGrant - assignedChildHireGrants(children));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.230.1",
+  "version": "5.230.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {