@indigoai-us/hq-cli 5.240.0 → 5.242.0

package/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 ## [Unreleased]
 
+## [5.242.0] — 2026-09-27
+
+### Changed
+
+- Removed the completed `lanes.message-compaction-replay`,
+  `lanes.outpost-question-visibility`, and
+  `lanes.host-scoped-account-homes` gates. Their shipped behaviors now run
+  unconditionally.
+- Account-home login and `set-home` no longer require an unrelated active
+  company selection when `--company` is omitted; explicit `--company` values
+  remain validated.
+
+## [5.241.0] — 2026-09-27
+
+### Fixed
+
+- A bot whose only persistent storage is a network share can now enroll.
+  Enrollment wrote its credentials and then locked them to the owner, and on
+  a CIFS/SMB share mounted with a fixed file mode — Azure Files is the one
+  that found this — that last step fails outright. Enrollment died there,
+  left a temp file holding the private key behind, and offered no way
+  forward: the only writable alternative was storage a container rebuild
+  erases.
+
+  The write now reports whether owner-only permissions actually took, rather
+  than assuming they did, and `hq agent enroll` says plainly when they did
+  not: the credential is readable by anything else with access to that
+  share. The file is still requested owner-only, the result is read back
+  from the filesystem instead of trusted, a refused chmod on ordinary
+  storage still fails loudly, and a failed write no longer leaves the secret
+  behind in a temp file.
+- Resume can keep a lane on its recorded account when it uses a CLI-selected
+  model, even if that account's configured default differs. A lane without an
+  account allowlist may use any otherwise eligible account.
+- With a worker-profile account pin, resume keeps a healthy recorded account
+  that is allowed by the pin even when the pin includes other accounts and the
+  recorded account's default differs from the lane's CLI-selected model.
+
 ## [5.240.0] — 2026-09-27
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -8447,7 +8447,7 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "Host key (defaults to this host's hostname)";
             }, {
                 readonly flags: "--company <slug|uid>";
-                readonly description: "Company scope for the host-account-home flag";
+                readonly description: "Company scope for account-home validation";
             }, {
                 readonly flags: "--json";
                 readonly description: "JSON on stdout (always)";
@@ -8473,7 +8473,7 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "Account home directory";
             }, {
                 readonly flags: "--company <slug|uid>";
-                readonly description: "Company scope for the host-account-home flag";
+                readonly description: "Company scope for account-home validation";
             }, {
                 readonly flags: "--device-auth";
                 readonly description: "Use Codex device authentication instead of localhost callback";

package/dist/command-catalog.generated.js

@@ -10929,7 +10929,7 @@ export const COMMAND_CATALOG = [
                             },
                             {
                                 "flags": "--company <slug|uid>",
-                                "description": "Company scope for the host-account-home flag"
+                                "description": "Company scope for account-home validation"
                             },
                             {
                                 "flags": "--json",
@@ -10963,7 +10963,7 @@ export const COMMAND_CATALOG = [
                             },
                             {
                                 "flags": "--company <slug|uid>",
-                                "description": "Company scope for the host-account-home flag"
+                                "description": "Company scope for account-home validation"
                             },
                             {
                                 "flags": "--device-auth",

package/dist/commands/agent-enroll.d.ts

@@ -129,6 +129,14 @@ export interface EnrollResult {
     companyMismatch?: string;
     /** True when this enrolled beside a person's session in its own directory. */
     local: boolean;
+    /**
+     * False when the filesystem could not make the credential owner-only — a
+     * share mounted with a fixed file_mode. The identity works; anything else
+     * with access to that share can read it.
+     */
+    permissionsEnforced: boolean;
+    /** errno of the refused chmod, when there was one (EPERM on Azure Files). */
+    permissionsError?: string;
     /** The tree this identity lives in. */
     agentDir: string;
 }

package/dist/commands/agent-enroll.js

@@ -252,7 +252,7 @@ export async function enrollHost(opts, deps = {}) {
     // server can bind the code to it, and a failed call leaves a harmless
     // unenrolled key behind (regenerated on the next attempt).
     const pair = (deps.generateKeyPair ?? generateHostKeyPair)();
-    writeHostKeyPair(paths, pair);
+    const keyWrite = writeHostKeyPair(paths, pair);
     let res;
     try {
         res = await doFetch(`${apiBaseUrl}${ENROLL_PATH}`, {
@@ -290,8 +290,12 @@ export async function enrollHost(opts, deps = {}) {
         companySlug: parsed.companySlug,
         apiBaseUrl,
     };
-    writeMachineCreds(paths, creds);
+    const credsWrite = writeMachineCreds(paths, creds);
+    const enforced = keyWrite.enforced && credsWrite.enforced;
+    const permissionsError = keyWrite.chmodError ?? credsWrite.chmodError;
     return {
+        permissionsEnforced: enforced,
+        ...(permissionsError ? { permissionsError } : {}),
         local: target.local,
         agentDir: paths.agentDir,
         agentUid: parsed.agentUid,
@@ -305,6 +309,10 @@ export async function enrollHost(opts, deps = {}) {
             : {}),
     };
 }
+/** Directory label for the permissions note — never the credential itself. */
+function paths_agentDirLabel() {
+    return agentKitPaths(os.homedir(), process.env).agentDir;
+}
 export function registerAgentEnrollCommand(agent) {
     agent
         .command("enroll <code>")
@@ -330,6 +338,15 @@ export function registerAgentEnrollCommand(agent) {
                     `  directory beside them: ${result.agentDir}. Their session was not read or changed.\n` +
                     `  Every hq agent command finds this tree on its own — no environment to set.`));
             }
+            if (!result.permissionsEnforced) {
+                // Not a warning to bury: the credential is on disk and working,
+                // but this filesystem cannot keep it to one owner.
+                console.log(chalk.yellow(`  note: this filesystem could not make the credential owner-only` +
+                    `${result.permissionsError ? ` (chmod: ${result.permissionsError})` : ""}.\n` +
+                    `        Anything with access to ${paths_agentDirLabel()} can read it. That is\n` +
+                    `        usually a network share mounted with a fixed file_mode. Keep the\n` +
+                    `        share itself restricted, or move the identity to local storage.`));
+            }
             console.log(`  host fingerprint: ${result.hostFingerprint}`);
             console.log(`  credentials:      ${result.credsPath} (0600)`);
             console.log(`  host key:         ${result.hostKeyPath} (0600)`);

package/dist/commands/lanes.d.ts

@@ -91,18 +91,12 @@ export interface LanesCommandDeps {
     isSsmOwnerDispatch?: () => boolean;
     /** Test seam for changing a lane between pre-lock and locked grant reads. */
     withGrantHireLocks?: typeof withLaneHireLocks;
-    /** Test seam for the default-off Outpost question visibility gate. */
-    laneOutpostQuestionVisibilityEnabled?: (company?: LaneCompanyRef | null) => boolean | Promise<boolean>;
     /** Test seam for the hq-flags gated tracker commands. */
     laneTrackerEnabled?: (company: LaneCompanyRef) => boolean | Promise<boolean>;
-    /** Test seam for the default-off host-scoped account-home writer gate. */
-    laneHostScopedAccountHomesEnabled?: (company?: LaneCompanyRef | null) => boolean | Promise<boolean>;
     /** Test seam for recording approvals against the active identity. */
     trackerActor?: () => string | null;
 }
 export declare const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
-export declare const LANE_OUTPOST_QUESTION_VISIBILITY_FLAG = "lanes.outpost-question-visibility";
-export declare const LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG = "lanes.host-scoped-account-homes";
 export declare function parseSeniorRef(raw: string): SeniorRef;
 export declare function resolveAnswerChoice(choice: string, options: string[], freeform: boolean): string;
 export declare function parseQuestionBody(raw: unknown): QuestionBody | null;

package/dist/commands/lanes.js

@@ -10,7 +10,6 @@ import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { readLocalOverride } from "@indigoai-us/hq-flags-client";
 import { Option } from "commander";
 import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { registerLaneChecksCommand } from "./lanes-checks.js";
@@ -72,29 +71,12 @@ const VENDOR_LOGIN = {
 };
 export { emitLaneDecisionEvents };
 export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
-export const LANE_OUTPOST_QUESTION_VISIBILITY_FLAG = "lanes.outpost-question-visibility";
-export const LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG = "lanes.host-scoped-account-homes";
 function defaultLanePlacementEnabled() {
     return resolveProcessFlagGate(LANE_OUTPOST_LOAD_BALANCING_FLAG, { fallback: false }, () => false);
 }
 function defaultLaneTrackerEnabled(company) {
     return readLanesRegistryFlag(LANES_TRACKER_FLAG, { company });
 }
-function defaultLaneOutpostQuestionVisibilityEnabled(company, env) {
-    return readLanesRegistryFlag(LANE_OUTPOST_QUESTION_VISIBILITY_FLAG, {
-        company,
-        env,
-    });
-}
-function defaultLaneHostScopedAccountHomesEnabled(company, env) {
-    return readLanesRegistryFlag(LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG, { company, env });
-}
-async function hostScopedAccountHomesEnabled(ctx, company) {
-    const localOverride = readLocalOverride(LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG, ctx.env);
-    if (localOverride !== null)
-        return localOverride;
-    return ctx.laneHostScopedAccountHomesEnabled(company ?? await ctx.resolveCompany());
-}
 async function resolveSelectedAccountHomeCompany(ctx, selector) {
     const company = await ctx.resolveActiveCompany(selector);
     if (!company) {
@@ -312,11 +294,7 @@ function resolveDeps(deps = {}) {
         storyLedgerEnabled: deps.storyLedgerEnabled ?? laneStoryLedgerEnabled,
         isSsmOwnerDispatch: deps.isSsmOwnerDispatch ?? (() => isSsmRunCommandProcess()),
         withGrantHireLocks: deps.withGrantHireLocks ?? withLaneHireLocks,
-        laneOutpostQuestionVisibilityEnabled: deps.laneOutpostQuestionVisibilityEnabled ??
-            ((company) => defaultLaneOutpostQuestionVisibilityEnabled(company, env)),
         laneTrackerEnabled: deps.laneTrackerEnabled ?? defaultLaneTrackerEnabled,
-        laneHostScopedAccountHomesEnabled: deps.laneHostScopedAccountHomesEnabled ??
-            ((company) => defaultLaneHostScopedAccountHomesEnabled(company, env)),
         trackerActor: deps.trackerActor ?? defaultTrackerActor,
     };
 }
@@ -5921,6 +5899,10 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         : lane.model_source === undefined || lane.model_source === "cli" || lane.model_source === "preserved"
             ? lane.model
             : undefined;
+    const recordedModelAccount = lane.account !== undefined &&
+        (lane.model_source === "cli" || lane.model_source === "preserved")
+        ? lane.account
+        : undefined;
     const preservedModel = repairUnavailableAccount && lane.model_source === "account"
         ? lane.model ?? currentConfig?.model
         : undefined;
@@ -5944,7 +5926,8 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         currentConfig?.enabled === true &&
         currentTargetAccount?.enabled === true &&
         currentTargetAccount.logged_in === true &&
-        (model === undefined || currentConfig.model === undefined || currentConfig.model === model))
+        (model === undefined || currentConfig.model === undefined || currentConfig.model === model ||
+            lane.account === recordedModelAccount))
         return undefined;
     const selected = selectClaudeAccount({
         hosts: balanceHosts.snapshots,
@@ -5952,6 +5935,7 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         config,
         ...(!repairUnavailableAccount && allowedAccounts !== undefined ? { allowedAccounts } : {}),
         ...(model !== undefined ? { model } : {}),
+        ...(recordedModelAccount !== undefined ? { recordedModelAccount } : {}),
         unavailableHosts: balanceHosts.unavailableHosts,
     });
     const historyReason = lane.account === undefined
@@ -8254,19 +8238,15 @@ async function loadPrimaryOwnedOutpostQuestions(ctx, hqRoot, companyFilter) {
     for (const [outpostId, lanes] of [...lanesByOutpost.entries()].sort(([a], [b]) => a.localeCompare(b))) {
         for (const group of groupQuestionLanesByCompany(hqRoot, lanes, companyFilter)) {
             if (group.company === null) {
-                if (await ctx.laneOutpostQuestionVisibilityEnabled(null)) {
-                    errors.push({
-                        host: `outpost:${outpostId}`,
-                        error: "outpost_question_company_unavailable",
-                    });
-                }
+                errors.push({
+                    host: `outpost:${outpostId}`,
+                    error: "outpost_question_company_unavailable",
+                });
                 continue;
             }
             if (companyFilter && !questionCompanyRefMatches(group.company, companyFilter))
                 continue;
-            if (await ctx.laneOutpostQuestionVisibilityEnabled(group.company)) {
-                eligibleGroups.push({ outpostId, group });
-            }
+            eligibleGroups.push({ outpostId, group });
         }
     }
     if (eligibleGroups.length === 0) {
@@ -8972,12 +8952,9 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     if (opts.home !== undefined && !requestedHome) {
         throw new LanesError("invalid_account_home", "--home must be a non-empty path", { provider, account: id });
     }
-    const company = opts.company !== undefined
-        ? await resolveSelectedAccountHomeCompany(ctx, opts.company)
-        : undefined;
-    const hostScopedWriterEnabled = registeredAccount !== undefined && requestedHome !== undefined
-        ? await hostScopedAccountHomesEnabled(ctx, company)
-        : false;
+    if (opts.company !== undefined) {
+        await resolveSelectedAccountHomeCompany(ctx, opts.company);
+    }
     const homeRaw = requestedHome ??
         (registeredAccount !== undefined
             ? effectiveAccountHome(registeredAccount, hostname).home
@@ -8995,25 +8972,19 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     const nextAccount = registeredAccount === undefined
         ? { home, enabled: true }
         : { ...registeredAccount, enabled: true };
-    if (registeredAccount !== undefined) {
-        if (hostScopedWriterEnabled && requestedHome !== undefined) {
-            if (home === registeredAccount.home) {
-                if (nextAccount.hosts !== undefined) {
-                    delete nextAccount.hosts[hostname];
-                    if (Object.keys(nextAccount.hosts).length === 0)
-                        delete nextAccount.hosts;
-                }
-            }
-            else {
-                nextAccount.hosts = {
-                    ...(registeredAccount.hosts ?? {}),
-                    [hostname]: { home },
-                };
+    if (registeredAccount !== undefined && requestedHome !== undefined) {
+        if (home === registeredAccount.home) {
+            if (nextAccount.hosts !== undefined) {
+                delete nextAccount.hosts[hostname];
+                if (Object.keys(nextAccount.hosts).length === 0)
+                    delete nextAccount.hosts;
             }
         }
-        else if (requestedHome !== undefined) {
-            // With the rollout off, retain the legacy shared-home write shape.
-            nextAccount.home = home;
+        else {
+            nextAccount.hosts = {
+                ...(registeredAccount.hosts ?? {}),
+                [hostname]: { home },
+            };
         }
     }
     delete nextAccount.disabled_reason;
@@ -9070,12 +9041,8 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     printJson({ ok: true, action: "accounts.login", account: status });
 }
 async function runAccountsSetHome(ctx, providerRaw, accountIdRaw, homeRaw, opts) {
-    const company = opts.company !== undefined
-        ? await resolveSelectedAccountHomeCompany(ctx, opts.company)
-        : undefined;
-    if (!(await hostScopedAccountHomesEnabled(ctx, company))) {
-        throw new LanesError("host_scoped_account_homes_disabled", "Setting a host-specific account home requires the lanes.host-scoped-account-homes flag", { flag: LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG });
-    }
+    if (opts.company !== undefined)
+        await resolveSelectedAccountHomeCompany(ctx, opts.company);
     const callerCwd = ctx.callerCwd();
     const hqRoot = ctx.hqRoot();
     const provider = parseLaneProvider(providerRaw);
@@ -9838,7 +9805,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .argument("<account-id>", "Existing account id")
         .argument("<path>", "Home directory for this host")
         .option("--host <hostname>", "Host key (defaults to this host's hostname)")
-        .option("--company <slug|uid>", "Company scope for the host-account-home flag")
+        .option("--company <slug|uid>", "Company scope for account-home validation")
         .option("--json", "JSON on stdout (always)")
         .action(wrap(async (provider, accountId, home, opts) => {
         await runAccountsSetHome(ctx, provider, accountId, home, opts);
@@ -9849,7 +9816,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .argument("<provider>", "claude | codex | grok")
         .argument("<account-id>", "Open-ended account id")
         .option("--home <path>", "Account home directory")
-        .option("--company <slug|uid>", "Company scope for the host-account-home flag")
+        .option("--company <slug|uid>", "Company scope for account-home validation")
         .option("--device-auth", "Use Codex device authentication instead of localhost callback")
         .action(wrap(async (provider, accountId, opts) => {
         await runAccountsLogin(ctx, provider, accountId, opts);

package/dist/lib/agent-kit/creds.d.ts

@@ -7,6 +7,22 @@
  * module reads `~/.hq/cognito-tokens.json` — a human's session is never
  * consulted, copied, or reused by an agent identity (policy
  * never-extract-stored-session-tokens-to-forge-privileged-calls).
+ *
+ * NOT EVERY FILESYSTEM CAN KEEP THAT PROMISE. A CIFS/SMB mount (Azure Files
+ * is the one that found this) is mounted with a fixed `file_mode` and fails
+ * `chmod` outright with EPERM; an NFS export or a Docker volume may accept
+ * the call and ignore it. A bot whose only persistent storage is such a
+ * share used to be unable to enroll at all — enrollment died on the chmod,
+ * leaving a stray temp file behind, and the only alternative was to keep the
+ * identity on disposable storage where a rebuild erases it.
+ *
+ * So the write no longer fails there: it reports whether owner-only
+ * permissions actually took, and the caller says so out loud. The file is
+ * still requested 0600 at creation, the outcome is read back from the
+ * filesystem rather than assumed, and a host that cannot honour it learns
+ * that its credential is readable by anything else with access to the same
+ * share. Refusing to enroll would not have made that credential safer; it
+ * would only have moved it somewhere it silently disappears.
  */
 import type { AgentKitPaths, KitComponent } from "./paths.js";
 /** Exact `machine-creds.json` shape for an external agent (api-contract v1). */
@@ -33,8 +49,20 @@ export interface HostKeyPair {
 /** Contract fingerprint: sha256(DER SPKI public key) hex, first 16 chars. */
 export declare function hostFingerprint(publicPem: string): string;
 export declare function generateHostKeyPair(): HostKeyPair;
-export declare function writeHostKeyPair(paths: Pick<AgentKitPaths, "hostKeyPath" | "hostKeyPubPath">, pair: HostKeyPair): void;
-export declare function writeMachineCreds(paths: Pick<AgentKitPaths, "machineCredsPath">, creds: ExternalMachineCreds): void;
+/**
+ * What a write could actually guarantee about who can read the file.
+ * `enforced: false` means the bytes are on disk but readable beyond the
+ * owner — true of a share mounted with a fixed `file_mode`.
+ */
+export interface PrivateFileOutcome {
+    enforced: boolean;
+    /** Mode observed after the write, when it could be read back. */
+    observedMode?: number;
+    /** errno of a refused chmod (EPERM on Azure Files), when there was one. */
+    chmodError?: string;
+}
+export declare function writeHostKeyPair(paths: Pick<AgentKitPaths, "hostKeyPath" | "hostKeyPubPath">, pair: HostKeyPair): PrivateFileOutcome;
+export declare function writeMachineCreds(paths: Pick<AgentKitPaths, "machineCredsPath">, creds: ExternalMachineCreds): PrivateFileOutcome;
 /**
  * Read the creds file without trusting it: returns null unless it is an
  * external-agent file with every contract field present.

package/dist/lib/agent-kit/creds.js

@@ -7,6 +7,22 @@
  * module reads `~/.hq/cognito-tokens.json` — a human's session is never
  * consulted, copied, or reused by an agent identity (policy
  * never-extract-stored-session-tokens-to-forge-privileged-calls).
+ *
+ * NOT EVERY FILESYSTEM CAN KEEP THAT PROMISE. A CIFS/SMB mount (Azure Files
+ * is the one that found this) is mounted with a fixed `file_mode` and fails
+ * `chmod` outright with EPERM; an NFS export or a Docker volume may accept
+ * the call and ignore it. A bot whose only persistent storage is such a
+ * share used to be unable to enroll at all — enrollment died on the chmod,
+ * leaving a stray temp file behind, and the only alternative was to keep the
+ * identity on disposable storage where a rebuild erases it.
+ *
+ * So the write no longer fails there: it reports whether owner-only
+ * permissions actually took, and the caller says so out loud. The file is
+ * still requested 0600 at creation, the outcome is read back from the
+ * filesystem rather than assumed, and a host that cannot honour it learns
+ * that its credential is readable by anything else with access to the same
+ * share. Refusing to enroll would not have made that credential safer; it
+ * would only have moved it somewhere it silently disappears.
  */
 import { createHash, createPublicKey, generateKeyPairSync } from "node:crypto";
 import * as fs from "node:fs";
@@ -23,20 +39,73 @@ export function generateHostKeyPair() {
     const publicPem = publicKey.export({ type: "spki", format: "pem" }).toString();
     return { privatePem, publicPem, fingerprint: hostFingerprint(publicPem) };
 }
+/**
+ * chmod failures that mean "this filesystem does not do modes" rather than
+ * "something is wrong". Anything else still throws: a refused chmod on a
+ * local disk is a real fault and must not be swallowed.
+ */
+const MODE_UNSUPPORTED_CODES = new Set([
+    "EPERM",
+    "EACCES",
+    "EINVAL",
+    "ENOTSUP",
+    "EOPNOTSUPP",
+]);
 /** Write a file atomically with the given mode, replacing any existing one. */
 function writePrivateFile(dest, contents, mode) {
     fs.mkdirSync(path.dirname(dest), { recursive: true, mode: 0o700 });
-    const tmp = `${dest}.tmp.${process.pid}`;
-    fs.writeFileSync(tmp, contents, { mode });
-    fs.chmodSync(tmp, mode);
-    fs.renameSync(tmp, dest);
+    // Date.now() as well as the pid: two writes from one process must not
+    // collide on a temp name, and a leftover from a crashed run must not be
+    // adopted by the next one.
+    const tmp = `${dest}.tmp.${process.pid}.${Date.now()}`;
+    let chmodError;
+    try {
+        fs.writeFileSync(tmp, contents, { mode });
+        try {
+            fs.chmodSync(tmp, mode);
+        }
+        catch (err) {
+            const code = err.code ?? "";
+            if (!MODE_UNSUPPORTED_CODES.has(code))
+                throw err;
+            chmodError = code;
+        }
+        // Read the truth back rather than trusting either call: a mount can
+        // accept chmod and ignore it just as easily as it can refuse.
+        let observedMode;
+        try {
+            observedMode = fs.statSync(tmp).mode & 0o777;
+        }
+        catch {
+            /* stat is not worth failing a write over */
+        }
+        fs.renameSync(tmp, dest);
+        return {
+            enforced: observedMode === undefined ? !chmodError : (observedMode & 0o077) === 0,
+            ...(observedMode === undefined ? {} : { observedMode }),
+            ...(chmodError ? { chmodError } : {}),
+        };
+    }
+    catch (err) {
+        // Never leave the temp file behind — it holds the same secret as the
+        // file that failed to land.
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* already gone */
+        }
+        throw err;
+    }
 }
 export function writeHostKeyPair(paths, pair) {
-    writePrivateFile(paths.hostKeyPath, pair.privatePem, 0o600);
+    const key = writePrivateFile(paths.hostKeyPath, pair.privatePem, 0o600);
+    // The public half is public; its mode is not a promise worth reporting.
     writePrivateFile(paths.hostKeyPubPath, pair.publicPem, 0o644);
+    return key;
 }
 export function writeMachineCreds(paths, creds) {
-    writePrivateFile(paths.machineCredsPath, `${JSON.stringify(creds, null, 2)}\n`, 0o600);
+    return writePrivateFile(paths.machineCredsPath, `${JSON.stringify(creds, null, 2)}\n`, 0o600);
 }
 /**
  * Read the creds file without trusting it: returns null unless it is an

package/dist/lib/lanes/claude-balance.d.ts

@@ -70,6 +70,8 @@ export declare function selectClaudeAccount(input: {
     config: LanesConfig;
     allowedAccounts?: readonly string[];
     model?: string;
+    /** Keep the recorded account eligible for its already-running CLI model. */
+    recordedModelAccount?: string;
     explicitAccount?: string;
     unavailableHosts?: readonly BalanceHostGap[];
 }): ClaudeAccountSelection;

package/dist/lib/lanes/claude-balance.js

@@ -104,7 +104,8 @@ function buildLoads(input) {
         const hosts = input.hosts.map((host) => accountHostLoad(host, account));
         const targetLoad = hosts.find((host) => sameHost(host.host, targetHost));
         const configuredModel = configAccounts[account]?.model;
-        const ineligible = targetIneligibilityReason(account, configAccounts[account]?.enabled === true, input.allowedAccounts, targetLoad) ?? (input.model !== undefined && configuredModel !== undefined && configuredModel !== input.model
+        const ineligible = targetIneligibilityReason(account, configAccounts[account]?.enabled === true, input.allowedAccounts, targetLoad) ?? (account !== input.recordedModelAccount &&
+            input.model !== undefined && configuredModel !== undefined && configuredModel !== input.model
             ? "model_mismatch"
             : undefined);
         if (ineligible !== undefined)

package/dist/lib/lanes/dropbox.d.ts

@@ -10,13 +10,12 @@
 import * as fs from "node:fs";
 import { probeProviderCompactionsSince } from "./compaction.js";
 import { tryReadLane } from "./store.js";
-import { type LaneCompanyRef, type LaneRecord, type LaneState, type QuestionRecord } from "./types.js";
+import { type LaneRecord, type LaneState, type QuestionRecord } from "./types.js";
 export declare const DROPBOX_DIR = "dropbox";
 export declare const INBOX_NAME = "inbox.jsonl";
 export declare const DRAINING_DIR = "draining";
 export declare const DELIVERED_DIR = "delivered";
 export declare const INFLIGHT_DIR = "inflight";
-export { LANE_MESSAGE_COMPACTION_REPLAY_FLAG } from "./message-replay.js";
 export interface DropboxMessage {
     at?: string;
     message_id?: string;
@@ -59,10 +58,6 @@ export interface LaneDrainHookInput {
     hook_event_name?: string;
 }
 export interface RunDrainHookDeps {
-    readFlag?: (flag: string, options: {
-        company?: LaneCompanyRef | null;
-        env: NodeJS.ProcessEnv;
-    }) => Promise<boolean>;
     readLane?: typeof tryReadLane;
     probeCompactionsSince?: typeof probeProviderCompactionsSince;
 }

package/dist/lib/lanes/dropbox.js

@@ -12,8 +12,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { probeProviderCompactionsSince, providerTranscriptSize, } from "./compaction.js";
 import { LanesError } from "./errors.js";
-import { readLanesRegistryFlag } from "./registry-flag.js";
-import { LANE_MESSAGE_COMPACTION_REPLAY_FLAG, MESSAGE_COMPACTION_REPLAY_NOTE, MESSAGE_REPLAY_STATE_NAME, } from "./message-replay.js";
+import { MESSAGE_COMPACTION_REPLAY_NOTE, MESSAGE_REPLAY_STATE_NAME, } from "./message-replay.js";
 import { LANES_RUNS_REL, readProcStarttime } from "./spawn.js";
 import { tryReadLane } from "./store.js";
 export const DROPBOX_DIR = "dropbox";
@@ -21,7 +20,6 @@ export const INBOX_NAME = "inbox.jsonl";
 export const DRAINING_DIR = "draining";
 export const DELIVERED_DIR = "delivered";
 export const INFLIGHT_DIR = "inflight";
-export { LANE_MESSAGE_COMPACTION_REPLAY_FLAG } from "./message-replay.js";
 function defaultDrainDeps() {
     return {
         mkdirSync: fs.mkdirSync.bind(fs),
@@ -492,8 +490,8 @@ function readReplayState(filePath, turnId) {
         (state.flag_enabled !== undefined && typeof state.flag_enabled !== "boolean")) {
         throw new LanesError("message_replay_state_invalid", `Replay state ${filePath} does not match the current provider turn`);
     }
-    // Older state files persisted this per-turn cache. Accept it, but remove it
-    // before the next write so the flag is refreshed for every compaction.
+    // Older state files persisted the removed per-turn flag. Accept it, but
+    // remove it before the next write so the stale cache does not live on.
     delete state.flag_enabled;
     return state;
 }
@@ -602,12 +600,9 @@ export async function runDrainHook(env, input = {}, deps = {}) {
                             }
                             else if (delta.count > 0) {
                                 state.last_compaction_marker += delta.count;
-                                const flagEnabled = await (deps.readFlag ?? readLanesRegistryFlag)(LANE_MESSAGE_COMPACTION_REPLAY_FLAG, { company: lane.company, env });
-                                if (flagEnabled) {
-                                    replayed = deliveredMessagesForTurn(hqRoot, laneId, turnId);
-                                    if (replayed.length > 0)
-                                        replayNote = MESSAGE_COMPACTION_REPLAY_NOTE;
-                                }
+                                replayed = deliveredMessagesForTurn(hqRoot, laneId, turnId);
+                                if (replayed.length > 0)
+                                    replayNote = MESSAGE_COMPACTION_REPLAY_NOTE;
                             }
                         }
                     }

package/dist/lib/lanes/message-replay.d.ts

@@ -1,4 +1,3 @@
-export declare const LANE_MESSAGE_COMPACTION_REPLAY_FLAG = "lanes.message-compaction-replay";
 export declare const MESSAGE_REPLAY_STATE_NAME = "message-compaction-replay.json";
 export declare const MESSAGE_COMPACTION_REPLAY_NOTE = "These messages were delivered before a context compaction and still apply.";
 export interface MessageReplayState {

package/dist/lib/lanes/message-replay.js

@@ -1,4 +1,3 @@
-export const LANE_MESSAGE_COMPACTION_REPLAY_FLAG = "lanes.message-compaction-replay";
 export const MESSAGE_REPLAY_STATE_NAME = "message-compaction-replay.json";
 export const MESSAGE_COMPACTION_REPLAY_NOTE = "These messages were delivered before a context compaction and still apply.";
 //# sourceMappingURL=message-replay.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.240.0",
+  "version": "5.242.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {