@indigoai-us/hq-cli 5.269.0 → 5.271.0

package/dist/commands/lanes.js

@@ -28,7 +28,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
-import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+import { resolveProcessFlagCompanyContext } from "../lib/flag-registry.js";
 import { defaultTrackerActor, LANES_TRACKER_FLAG, registerLaneTrackerCommands, } from "./lanes-tracker.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
@@ -50,7 +50,7 @@ import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, lan
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { resolveLaneCompany } from "../lib/lanes/lane-company.js";
@@ -76,12 +76,48 @@ export const LANES_RUNS_REL = path.join("workspace", "lanes-runs");
 /** The lane → mesh seam. Defined in lib/lanes/mesh-events.ts; the watcher shares it. */
 export { emitLaneDecisionEvents };
 export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
-function defaultLanePlacementEnabled() {
-    return resolveProcessFlagGate(LANE_OUTPOST_LOAD_BALANCING_FLAG, { fallback: false }, () => false);
+function lanePlacementFlagErrorCode(error) {
+    if (error && typeof error === "object") {
+        for (const key of ["code", "error", "name"]) {
+            const value = error[key];
+            if (typeof value === "string" && value.trim())
+                return value;
+        }
+    }
+    return "UnknownError";
+}
+function reportLanePlacementFlagReadFailure(error) {
+    process.stderr.write(`${JSON.stringify({
+        event: "lanes.outpost_load_balancing.flag_read_failed",
+        flag: LANE_OUTPOST_LOAD_BALANCING_FLAG,
+        error: lanePlacementFlagErrorCode(error),
+        fallback: false,
+    })}\n`);
+}
+function defaultLanePlacementEnabled(company) {
+    return readLanesRegistryFlag(LANE_OUTPOST_LOAD_BALANCING_FLAG, {
+        company,
+        reportFailure: reportLanePlacementFlagReadFailure,
+    });
+}
+async function readLanePlacementEnabled(ctx, company) {
+    try {
+        return await ctx.lanePlacementEnabled(company);
+    }
+    catch (error) {
+        reportLanePlacementFlagReadFailure(error);
+        return false;
+    }
 }
 function defaultLaneTrackerEnabled(company) {
     return readLanesRegistryFlag(LANES_TRACKER_FLAG, { company });
 }
+function processLanePlacementCompany(ctx) {
+    const context = resolveProcessFlagCompanyContext(ctx.env);
+    if (!context.companySlug)
+        return undefined;
+    return { slug: context.companySlug, uid: context.companyUid ?? "" };
+}
 function withoutProviderHome(value) {
     if (Array.isArray(value))
         return value.map(withoutProviderHome);
@@ -1059,6 +1095,66 @@ async function readOutpostLaneRecords(ctx, outpostId) {
     }
     return lanes;
 }
+async function resolveCommandLaneTarget(ctx, laneId, options = {}) {
+    try {
+        return { lane: readLane(ctx.hqRoot(), laneId), remoteOnly: false };
+    }
+    catch (err) {
+        if (!(err instanceof LanesError) || err.error !== "lane_not_found")
+            throw err;
+    }
+    const separator = laneId.lastIndexOf("_");
+    const hostSuffix = separator < 0 ? "" : laneId.slice(separator + 1);
+    if (!hostSuffix || sanitizeHostComponent(hostSuffix) !== hostSuffix) {
+        throw commandLaneNotFound(laneId, options.outpostHint === true);
+    }
+    let rawOutpostIds;
+    try {
+        rawOutpostIds = await ctx.listOutpostIds();
+    }
+    catch (err) {
+        throw new LanesError("outpost_list_unavailable", `Could not resolve registered Outposts for lane ${laneId}: ${dispatchErrorMessage(err)}`, { lane_id: laneId });
+    }
+    if (!Array.isArray(rawOutpostIds)) {
+        throw new LanesError("outpost_list_invalid", "Registered Outpost list is not an array", { lane_id: laneId });
+    }
+    const outpostIds = rawOutpostIds.map((id) => typeof id === "string" ? id.trim() : "");
+    if (outpostIds.length > MAX_PLACEMENT_OUTPOSTS ||
+        outpostIds.some((id) => id === "") ||
+        new Set(outpostIds).size !== outpostIds.length) {
+        throw new LanesError("outpost_list_invalid", "Registered Outpost list is malformed or exceeds the lane lookup limit", { lane_id: laneId, count: outpostIds.length, maximum: MAX_PLACEMENT_OUTPOSTS });
+    }
+    const matches = [];
+    for (const outpostId of outpostIds) {
+        const ownerLanes = await readOutpostLaneRecords(ctx, outpostId);
+        for (const lane of ownerLanes) {
+            if (lane.lane_id === laneId &&
+                lane.host.kind === "local" &&
+                sanitizeHostComponent(lane.host.id) === hostSuffix) {
+                matches.push({ outpostId, lane });
+            }
+        }
+    }
+    if (matches.length === 0) {
+        throw commandLaneNotFound(laneId, options.outpostHint === true);
+    }
+    if (matches.length !== 1) {
+        throw new LanesError("lane_outpost_ambiguous", `More than one registered Outpost reported lane ${laneId} with the same recorded host identity`, { lane_id: laneId, outpost_ids: matches.map((match) => match.outpostId) });
+    }
+    const match = matches[0];
+    return {
+        lane: { ...match.lane, host: { kind: "outpost", id: match.outpostId } },
+        remoteOnly: true,
+        outpostId: match.outpostId,
+        ownerHost: match.lane.host,
+    };
+}
+function commandLaneNotFound(laneId, outpostHint) {
+    const hint = outpostHint
+        ? "; pass --outpost <id> to confirm a registered Outpost"
+        : "";
+    return new LanesError("lane_not_found", `Lane ${laneId} was not found locally or on a registered Outpost with a matching host suffix${hint}`, { lane_id: laneId });
+}
 async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config) {
     const localHost = laneHostFromCtx(ctx);
     const localLanes = loadAllLanes(hqRoot);
@@ -1196,8 +1292,8 @@ function parsePlacementPolicy(raw) {
         return { kind: "outpost", id };
     throw new LanesError("lane_placement_invalid", `Invalid placement ${JSON.stringify(raw)}. Accepted: local, auto, outpost:<id>`, { value: raw, accepted: ["local", "auto", "outpost:<id>"] });
 }
-function assertPlacementEnabled(ctx) {
-    if (ctx.lanePlacementEnabled())
+async function assertPlacementEnabled(ctx, company, readPlacementEnabled = () => readLanePlacementEnabled(ctx, company)) {
+    if (await readPlacementEnabled())
         return;
     throw new LanesError("lane_placement_disabled", `Lane placement options require hq-flags gate ${LANE_OUTPOST_LOAD_BALANCING_FLAG}`, { flag: LANE_OUTPOST_LOAD_BALANCING_FLAG });
 }
@@ -2171,14 +2267,6 @@ async function runCreate(ctx, opts) {
     if (opts.outpost !== undefined && requestedPlacement !== undefined) {
         throw new LanesError("lane_placement_conflict", "Pass either --outpost or --placement, not both", {});
     }
-    let placementGate;
-    const placementEnabled = () => {
-        placementGate ??= ctx.lanePlacementEnabled();
-        return placementGate;
-    };
-    if ((requestedPlacement !== undefined || defaultPlacement !== undefined) && !placementEnabled()) {
-        assertPlacementEnabled(ctx);
-    }
     const companyFlag = opts.company?.trim();
     const meshCompanyFlag = opts.meshCompany?.trim();
     const project = opts.project?.trim();
@@ -2266,6 +2354,29 @@ async function runCreate(ctx, opts) {
         }
         meshCompany = resolvedMeshCompany;
     }
+    let placementCompanyResolved = false;
+    let placementCompany;
+    let placementGate;
+    const resolvePlacementCompany = () => {
+        if (!placementCompanyResolved) {
+            const projectCompany = company === null
+                ? resolveProjectQuestionCompany(hqRoot, {
+                    lane_id: "create",
+                    project_id: project,
+                })
+                : null;
+            placementCompany = company ?? projectCompany ?? meshCompany ?? undefined;
+            placementCompanyResolved = true;
+        }
+        return placementCompany;
+    };
+    const placementEnabled = () => {
+        placementGate ??= readLanePlacementEnabled(ctx, resolvePlacementCompany());
+        return placementGate;
+    };
+    if (requestedPlacement !== undefined || defaultPlacement !== undefined) {
+        await assertPlacementEnabled(ctx, resolvePlacementCompany(), placementEnabled);
+    }
     const seniorCompany = companyOfSenior(hqRoot, senior, ctx);
     assertSameTenant(company, senior, seniorCompany);
     const createStoryWarnings = [];
@@ -2316,15 +2427,17 @@ async function runCreate(ctx, opts) {
     const callerLaneId = ctx.env.HQ_LANE_ID?.trim() || undefined;
     if (requestedPlacement === undefined &&
         outpostId === undefined &&
-        callerLaneId !== undefined &&
-        placementEnabled()) {
+        callerLaneId !== undefined) {
         const callerLane = tryReadLane(hqRoot, callerLaneId);
         if (!callerLane) {
-            throw new LanesError("lane_not_found", `Caller lane ${callerLaneId} not found`, {
-                lane_id: callerLaneId,
-            });
+            if (await placementEnabled()) {
+                throw new LanesError("lane_not_found", `Caller lane ${callerLaneId} not found`, {
+                    lane_id: callerLaneId,
+                });
+            }
         }
-        if (callerLane.placement_default !== undefined) {
+        else if (callerLane.placement_default !== undefined &&
+            await placementEnabled()) {
             if (!sameLaneCompany(company, callerLane.company)) {
                 throw new LanesError("lane_placement_tenant_mismatch", "Cannot inherit placement from a manager lane in another tenant", { caller_lane_id: callerLaneId });
             }
@@ -2456,7 +2569,7 @@ async function runCreate(ctx, opts) {
     }
     if (outpostId !== undefined &&
         profile !== undefined &&
-        !placementEnabled()) {
+        !(await placementEnabled())) {
         throw new LanesError("worker_profile_outpost_unsupported", `Worker profile ${JSON.stringify(profile.id)} cannot be used with --outpost; personal profiles are local-only`, {
             worker: profile.id,
             outpost: outpostId,
@@ -3352,7 +3465,7 @@ function assertLaneRunsHereForOperatorMutation(ctx, lane, action) {
         return;
     throw new LanesError("lane_remote", `Cannot ${action} lane ${lane.lane_id} from this host; its state is owned by ${lane.host.kind}:${lane.host.id}`, { lane_id: lane.lane_id, host: lane.host, action });
 }
-async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
+async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior = {}) {
     if (lane.host.kind !== "outpost") {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch to`, { lane_id: lane.lane_id });
     }
@@ -3550,7 +3663,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
     }
     if (action === "grant") {
-        const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
+        const ownerLane = dispatchedOwnerLane(ctx, lane.lane_id, outpostId, remote.lane, behavior);
         printJson({
             ...remote,
             lane_id: ownerLane.lane_id,
@@ -3566,7 +3679,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         (remote.delivery_status === "worker_spawned" ||
             remote.delivery_status === "queued_on_target_account" ||
             remote.delivery_status === "queued_on_admission")) {
-        const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
+        const ownerLane = dispatchedOwnerLane(ctx, lane.lane_id, outpostId, remote.lane, behavior);
         printJson({
             ...remote,
             lane_id: ownerLane.lane_id,
@@ -3578,7 +3691,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         return;
     }
     if (action === "approve" || action === "reparent" || action === "resume") {
-        const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
+        const ownerLane = dispatchedOwnerLane(ctx, lane.lane_id, outpostId, remote.lane, behavior);
         const descendants = [];
         if (action === "reparent") {
             for (const descendantId of changedDescendantIds) {
@@ -3606,6 +3719,32 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         outpost_transport: "outposts_exec",
     });
 }
+function dispatchedOwnerLane(ctx, laneId, outpostId, rawLane, behavior) {
+    if (behavior.syncPrimary !== false) {
+        return syncLaneRecordFromOwner(ctx.hqRoot(), laneId, outpostId, rawLane, undefined, { allowNonTerminal: true });
+    }
+    let ownerLane;
+    try {
+        ownerLane = parseLaneRecord(rawLane);
+    }
+    catch (err) {
+        throw new LanesError("outpost_lane_sync_invalid", `Outpost ${outpostId} returned an invalid lane snapshot for ${laneId}`, { lane_id: laneId, outpost_id: outpostId, cause: dispatchErrorMessage(err) });
+    }
+    const expectedHost = behavior.expectedOwnerHost;
+    if (!expectedHost ||
+        ownerLane.lane_id !== laneId ||
+        ownerLane.host.kind !== expectedHost.kind ||
+        ownerLane.host.id !== expectedHost.id) {
+        throw new LanesError("outpost_lane_sync_invalid", `Outpost ${outpostId} returned a lane snapshot that does not match its recorded owner identity`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            owner_lane_id: ownerLane.lane_id,
+            owner_host: ownerLane.host,
+            expected_host: expectedHost ?? null,
+        });
+    }
+    return ownerLane;
+}
 function parseReparentDescendantIds(value, laneId, outpostId) {
     if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || id.trim() === "")) {
         throw new LanesError("outpost_reparent_result_invalid", `Outpost ${outpostId} returned an invalid descendant list for lane ${laneId}`, { lane_id: laneId, outpost_id: outpostId });
@@ -3992,7 +4131,8 @@ async function runList(ctx, opts) {
                 : false,
         };
     });
-    const host_capacity = ctx.lanePlacementEnabled()
+    const placementCompany = company ?? processLanePlacementCompany(ctx);
+    const host_capacity = await readLanePlacementEnabled(ctx, placementCompany)
         ? (await loadHostCapacitySnapshots(ctx, hqRoot)).entries
         : undefined;
     const result = {
@@ -4194,10 +4334,16 @@ function readLaneTimeout(hqRoot, laneId) {
     return { timeout_secs: record.timeout_secs, deadline_at: record.deadline_at };
 }
 async function runMove(ctx, laneId, opts) {
-    assertPlacementEnabled(ctx);
     const hqRoot = ctx.hqRoot();
     const policy = parsePlacementPolicy(opts.placement ?? "");
     const source = readLane(hqRoot, laneId);
+    const placementCompany = resolveLaneCompany(hqRoot, source).company ?? undefined;
+    let placementGate;
+    const placementEnabled = () => {
+        placementGate ??= readLanePlacementEnabled(ctx, placementCompany);
+        return placementGate;
+    };
+    await assertPlacementEnabled(ctx, placementCompany, placementEnabled);
     if (!laneCanMoveBeforeStart(source)) {
         throw new LanesError(source.state === "queued" ? "lane_move_started" : "lane_not_queued", `Lane ${laneId} cannot move after it has started; current state is ${source.state}`, { lane_id: laneId, state: source.state });
     }
@@ -4222,7 +4368,7 @@ async function runMove(ctx, laneId, opts) {
     });
     let moved;
     if (laneRunsHere(source, reconcileHostFromCtx(ctx))) {
-        moved = await commitLaneMove(ctx, laneId, choice.host, choice.account);
+        moved = await commitLaneMove(ctx, laneId, choice.host, choice.account, placementEnabled);
     }
     else if (source.host.kind === "outpost") {
         moved = await dispatchRemoteLaneMove(ctx, source, choice.host, choice.account);
@@ -4240,11 +4386,11 @@ async function runMove(ctx, laneId, opts) {
         lane: moved,
     });
 }
-async function commitLaneMove(ctx, laneId, target, account) {
-    assertPlacementEnabled(ctx);
+async function commitLaneMove(ctx, laneId, target, account, readPlacementEnabled) {
     const hqRoot = ctx.hqRoot();
     const before = readLane(hqRoot, laneId);
     assertLaneRunsHereForOperatorMutation(ctx, before, "move-target");
+    await assertPlacementEnabled(ctx, resolveLaneCompany(hqRoot, before).company ?? undefined, readPlacementEnabled);
     if (before.host.kind === target.kind && before.host.id === target.id) {
         throw new LanesError("lane_move_same_host", `Lane ${laneId} is already on ${target.kind}:${target.id}`, {
             lane_id: laneId,
@@ -4653,6 +4799,12 @@ function callerMatchesSenior(ctx, seniorRef) {
         (senior !== null && typeof senior === "object" && !Array.isArray(senior) &&
             senior.kind === "user");
 }
+function laneGrantTargetHostedHere(ctx, lane) {
+    if (lane.host.kind === "local") {
+        return laneRunsHere(lane, reconcileHostFromCtx(ctx));
+    }
+    return lane.host.kind === "outpost" && laneIsHostedHere(ctx, lane);
+}
 function forceAdmissionAuthorized(ctx, lane) {
     return callerMatchesSenior(ctx, lane.senior);
 }
@@ -4663,7 +4815,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
         throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
     }
     if (authorization === "ssm-owner-dispatch" &&
-        (initial.host.kind !== "outpost" || !laneIsHostedHere(ctx, initial))) {
+        !laneGrantTargetHostedHere(ctx, initial)) {
         throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: initial.host });
     }
     if (authorization === "ssm-owner-dispatch" &&
@@ -4682,7 +4834,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
             throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(current.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: current.senior });
         }
         if (authorization === "ssm-owner-dispatch" &&
-            (current.host.kind !== "outpost" || !laneIsHostedHere(ctx, current))) {
+            !laneGrantTargetHostedHere(ctx, current)) {
             throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: current.host });
         }
         if (authorization === "ssm-owner-dispatch" &&
@@ -4808,10 +4960,34 @@ async function runGrant(ctx, laneId, opts) {
     }
     const hireGrant = parseHireGrant(opts.hire);
     const hqRoot = ctx.hqRoot();
-    const initial = readLane(hqRoot, laneId);
+    const target = await resolveCommandLaneTarget(ctx, laneId, { outpostHint: true });
+    const initial = target.lane;
     if (!callerMatchesSenior(ctx, initial.senior)) {
         throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
     }
+    if (opts.outpost !== undefined) {
+        const requestedOutpost = opts.outpost.trim();
+        const recordedOutpost = target.remoteOnly
+            ? target.outpostId
+            : initial.host.kind === "outpost"
+                ? initial.host.id
+                : undefined;
+        if (!requestedOutpost || requestedOutpost !== recordedOutpost) {
+            throw new LanesError("lane_outpost_mismatch", `--outpost ${requestedOutpost || "<empty>"} does not match lane ${laneId}'s recorded host ${initial.host.kind}:${initial.host.id}`, {
+                lane_id: laneId,
+                requested_outpost_id: requestedOutpost || null,
+                recorded_host: target.remoteOnly ? target.ownerHost : initial.host,
+                matched_outpost_id: recordedOutpost ?? null,
+            });
+        }
+    }
+    if (target.remoteOnly) {
+        await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) }, {
+            syncPrimary: false,
+            expectedOwnerHost: target.ownerHost,
+        });
+        return;
+    }
     if (initial.host.kind === "outpost" && !laneRunsHere(initial, reconcileHostFromCtx(ctx))) {
         await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) });
         return;
@@ -6865,6 +7041,7 @@ export function registerLanesCommand(parent, deps = {}) {
         persistClaudeAccountSelection,
         printJson,
         recordResumeSetup,
+        resolveCommandLane: (commandCtx, laneId) => resolveCommandLaneTarget(commandCtx, laneId),
         resolveActiveQuestionCompany,
         resolveResumeProfile,
         selectAutomaticClaudeResumeAccount,
@@ -6889,6 +7066,7 @@ export function registerLanesCommand(parent, deps = {}) {
         persistClaudeAccountSelection,
         printJson,
         recordResumeSetup,
+        resolveCommandLane: (commandCtx, laneId) => resolveCommandLaneTarget(commandCtx, laneId),
         resolveResumeProfile,
         selectAutomaticClaudeResumeAccount,
         validateResumeProfileModel,
@@ -7002,7 +7180,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .command("grant-target", { hidden: true })
         .argument("<lane-id>", "Lane id")
         .option("--hire <n>", "Non-negative safe integer hire grant")
-        .option("--grant-context <base64url>", "Primary-authorized hire hierarchy and gate decision")
+        .option("--grant-context <base64url>", "Primary-authorized hire hierarchy context")
         .action(wrap(async (laneId, opts) => {
         await runGrantOwnerTarget(ctx, laneId, opts);
     }));
@@ -7022,14 +7200,15 @@ export function registerLanesCommand(parent, deps = {}) {
         .description("Set a lane's alive child-lane grant as its senior")
         .argument("<lane-id>", "Lane id")
         .requiredOption("--hire <n>", "Non-negative safe integer hire grant")
+        .option("--outpost <id>", "Confirm the registered Outpost hosting a native lane")
         .action(wrap(async (laneId, opts) => {
         await runGrant(ctx, laneId, opts);
     }));
     lanes
         .command("backfill-grants")
-        .description("Preview or apply missing hire grants for alive manager lanes")
+        .description("Preview missing hire grants for alive manager lanes; writes are disabled")
         .option("--dry-run", "Print proposed values without writing (default)")
-        .option("--apply", "Write missing hire grants; only run before enforcement is enabled")
+        .option("--apply", "Retained for compatibility; writes are disabled")
         .action(wrap(async (opts) => {
         await runBackfillGrants(ctx, opts);
     }));

package/dist/lib/billing/plan-limit-upgrade-url.d.ts

@@ -1,14 +1,11 @@
-export declare const PLAN_LIMIT_UPGRADE_FALLBACK_FLAG = "cli.plan-limit-upgrade-fallback";
-export declare const PLAN_LIMIT_UPGRADE_FALLBACK_DEFAULT = false;
 export interface PlanLimitUpgradeUrlChoices {
     topLevelUrl?: string | null;
     nestedUrl?: string | null;
     legacyUrl: string;
 }
-export declare function isPlanLimitUpgradeFallbackEnabled(): boolean;
 /** Resolve and attribute the final selected company billing destination. */
 export declare function selectPlanLimitUpgradeUrl(companySlug: string | undefined, choices: PlanLimitUpgradeUrlChoices): string;
 export declare function withCliLimitEntrySurface(value: string): string;
-/** Keep the existing destination and flag behavior while labeling company limit links. */
+/** Select the standard upgrade destination and label company limit links. */
 export declare function planLimitUpgradeFallbackUrl(companySlug: string | undefined, previousFallbackUrl: string): string;
 //# sourceMappingURL=plan-limit-upgrade-url.d.ts.map

package/dist/lib/billing/plan-limit-upgrade-url.js

@@ -1,11 +1,5 @@
-import { resolveProcessFlagGate } from "../flag-registry.js";
 import { DEFAULT_VAULT_API_URL } from "../../utils/cognito-session.js";
 import { consoleOrigin } from "../../utils/console-origin.js";
-export const PLAN_LIMIT_UPGRADE_FALLBACK_FLAG = "cli.plan-limit-upgrade-fallback";
-export const PLAN_LIMIT_UPGRADE_FALLBACK_DEFAULT = false;
-export function isPlanLimitUpgradeFallbackEnabled() {
-    return resolveProcessFlagGate(PLAN_LIMIT_UPGRADE_FALLBACK_FLAG, { fallback: PLAN_LIMIT_UPGRADE_FALLBACK_DEFAULT }, () => PLAN_LIMIT_UPGRADE_FALLBACK_DEFAULT);
-}
 function companyBillingUrl(companySlug) {
     const controlPlaneUrl = process.env.HQ_VAULT_API_URL?.trim() || DEFAULT_VAULT_API_URL;
     const origin = consoleOrigin(controlPlaneUrl);
@@ -19,20 +13,15 @@ function companyBillingUrl(companySlug) {
 }
 /** Resolve and attribute the final selected company billing destination. */
 export function selectPlanLimitUpgradeUrl(companySlug, choices) {
+    const topLevelUrl = choices.topLevelUrl?.trim() || undefined;
+    const nestedUrl = choices.nestedUrl?.trim() || undefined;
+    const generatedUrl = companyBillingUrl(companySlug);
     let selected;
-    if (!isPlanLimitUpgradeFallbackEnabled()) {
-        selected = choices.legacyUrl;
+    if (companySlug?.trim()) {
+        selected = generatedUrl ?? topLevelUrl ?? nestedUrl ?? choices.legacyUrl;
     }
     else {
-        const topLevelUrl = choices.topLevelUrl?.trim() || undefined;
-        const nestedUrl = choices.nestedUrl?.trim() || undefined;
-        const generatedUrl = companyBillingUrl(companySlug);
-        if (companySlug?.trim()) {
-            selected = generatedUrl ?? topLevelUrl ?? nestedUrl ?? choices.legacyUrl;
-        }
-        else {
-            selected = topLevelUrl ?? nestedUrl ?? generatedUrl ?? choices.legacyUrl;
-        }
+        selected = topLevelUrl ?? nestedUrl ?? generatedUrl ?? choices.legacyUrl;
     }
     return withCliLimitEntrySurface(selected);
 }
@@ -68,7 +57,7 @@ export function withCliLimitEntrySurface(value) {
     }
     return value;
 }
-/** Keep the existing destination and flag behavior while labeling company limit links. */
+/** Select the standard upgrade destination and label company limit links. */
 export function planLimitUpgradeFallbackUrl(companySlug, previousFallbackUrl) {
     return selectPlanLimitUpgradeUrl(companySlug, {
         legacyUrl: previousFallbackUrl,

package/dist/lib/doctor/checks/sync-runtime.d.ts

@@ -7,5 +7,5 @@ export interface SyncRuntimeOptions {
 /** Classify the last hour of sync log lines into privacy-safe results. */
 export declare function analyzeSyncRuntimeLog(lines: readonly string[], options: SyncRuntimeOptions): CheckResult[];
 /** Read the machine's sync logs and client health file. */
-export declare function defaultSyncRuntimeResults(now: Date, hqHome?: string): CheckResult[];
+export declare function defaultSyncRuntimeResults(now: Date, hqHome?: string, env?: NodeJS.ProcessEnv): CheckResult[];
 //# sourceMappingURL=sync-runtime.d.ts.map