@indigoai-us/hq-cli 5.309.1 → 5.311.0

package/dist/commands/core-worker-skills-command.js

@@ -0,0 +1,33 @@
+import { runBundledScript } from "../utils/run-bundled-script.js";
+import { coreNativeWorkerSkillsEnabled } from "./core-native-worker-skills-flag.js";
+import { runWorkerSkillLint, WORKER_SKILL_LINT_ASSET } from "./core-worker-lint-native.js";
+import { runWorkerSkillShare, WORKER_SKILL_SHARE_ASSET } from "./core-worker-share-native.js";
+const assets = {
+    lint: WORKER_SKILL_LINT_ASSET,
+    share: WORKER_SKILL_SHARE_ASSET,
+};
+/** Keep the shell rollback route byte-transparent while the family flag is off. */
+export async function runWorkerSkillCommand(name, args, context) {
+    if (!(await coreNativeWorkerSkillsEnabled())) {
+        const result = runBundledScript({
+            asset: assets[name],
+            args,
+            cwd: context.cwd,
+            hqRoot: context.hqRoot,
+        });
+        if (result.code !== 0)
+            process.exit(result.code);
+        return result.code;
+    }
+    const result = name === "lint"
+        ? runWorkerSkillLint(args, { cwd: context.cwd })
+        : runWorkerSkillShare(args, { cwd: context.cwd });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    if (result.code !== 0)
+        process.exit(result.code);
+    return result.code;
+}
+//# sourceMappingURL=core-worker-skills-command.js.map

package/dist/commands/core-worker-skills-runtime.d.ts

@@ -0,0 +1,33 @@
+import * as fs from "node:fs";
+export type WorkerSkillResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+export type WorkerSkillFs = Pick<typeof fs, "lstatSync" | "statSync" | "readdirSync" | "readFileSync" | "readlinkSync" | "existsSync" | "mkdirSync" | "renameSync" | "unlinkSync" | "symlinkSync">;
+export type GitResult = {
+    code: number;
+    stdout: string;
+};
+export type GitRunner = (args: string[], cwd: string, env: NodeJS.ProcessEnv) => GitResult;
+export type WorkerSkillDependencies = {
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+    fs?: WorkerSkillFs;
+    runGit?: GitRunner;
+    /** The bundled shell's absolute $0, used for byte-identical usage text. */
+    scriptPath?: string;
+};
+export declare function runGit(args: string[], cwd: string, env: NodeJS.ProcessEnv, injected?: GitRunner): GitResult;
+/** Match `git rev-parse --show-toplevel || pwd` without consulting HQ_ROOT. */
+export declare function resolveWorkerCallerRoot(dependencies: WorkerSkillDependencies): {
+    root: string;
+    env: NodeJS.ProcessEnv;
+    fs: WorkerSkillFs;
+};
+export declare function errorCode(error: unknown): string | undefined;
+export declare function missingOrUnreadable(error: unknown): boolean;
+export declare function isDirectory(filePath: string, fileSystem: WorkerSkillFs): boolean;
+export declare function isSymlink(filePath: string, fileSystem: WorkerSkillFs): boolean;
+export declare function existsFollowingLinks(filePath: string, fileSystem: WorkerSkillFs): boolean;
+//# sourceMappingURL=core-worker-skills-runtime.d.ts.map

package/dist/commands/core-worker-skills-runtime.js

@@ -0,0 +1,86 @@
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+const SYSTEM_FS = fs;
+function processGit(args, cwd, env) {
+    // Tests that set this marker must inject a runner. This guard catches an
+    // accidental escape from a synthetic fixture before any real executable can
+    // be reached through PATH.
+    if (env.HQ_CORE_STUBS === "1") {
+        throw new Error("real git execution is disabled while HQ_CORE_STUBS=1");
+    }
+    const result = spawnSync("git", args, { cwd, env, encoding: "utf8" });
+    return {
+        code: result.status ?? 127,
+        stdout: result.stdout ?? "",
+    };
+}
+export function runGit(args, cwd, env, injected) {
+    return (injected ?? processGit)(args, cwd, env);
+}
+function shellPwd(cwd, env, fileSystem) {
+    const logical = env.PWD;
+    if (!logical || !logical.startsWith("/"))
+        return cwd;
+    try {
+        const logicalStat = fileSystem.statSync(logical);
+        const cwdStat = fileSystem.statSync(cwd);
+        if (logicalStat.dev === cwdStat.dev && logicalStat.ino === cwdStat.ino)
+            return logical;
+    }
+    catch {
+        // Bash falls back to its physical cwd when PWD no longer names this inode.
+    }
+    return cwd;
+}
+/** Match `git rev-parse --show-toplevel || pwd` without consulting HQ_ROOT. */
+export function resolveWorkerCallerRoot(dependencies) {
+    const env = dependencies.env ?? process.env;
+    const fileSystem = dependencies.fs ?? SYSTEM_FS;
+    const git = runGit(["rev-parse", "--show-toplevel"], dependencies.cwd, env, dependencies.runGit);
+    if (git.code === 0) {
+        // Command substitution removes every trailing LF and no other whitespace.
+        return { root: git.stdout.replace(/\n+$/, ""), env, fs: fileSystem };
+    }
+    return { root: shellPwd(dependencies.cwd, env, fileSystem), env, fs: fileSystem };
+}
+export function errorCode(error) {
+    if (!error || typeof error !== "object" || !("code" in error))
+        return undefined;
+    const code = error.code;
+    return typeof code === "string" ? code : undefined;
+}
+export function missingOrUnreadable(error) {
+    return ["ENOENT", "ENOTDIR", "EACCES", "EPERM", "ELOOP"].includes(errorCode(error) ?? "");
+}
+export function isDirectory(filePath, fileSystem) {
+    try {
+        return fileSystem.statSync(filePath).isDirectory();
+    }
+    catch (error) {
+        if (missingOrUnreadable(error))
+            return false;
+        throw error;
+    }
+}
+export function isSymlink(filePath, fileSystem) {
+    try {
+        return fileSystem.lstatSync(filePath).isSymbolicLink();
+    }
+    catch (error) {
+        if (missingOrUnreadable(error))
+            return false;
+        throw error;
+    }
+}
+export function existsFollowingLinks(filePath, fileSystem) {
+    try {
+        fileSystem.statSync(filePath);
+        return true;
+    }
+    catch (error) {
+        if (missingOrUnreadable(error))
+            return false;
+        throw error;
+    }
+}
+//# sourceMappingURL=core-worker-skills-runtime.js.map

package/dist/commands/core.js

@@ -40,9 +40,11 @@ import { registerCoreJobsNativeCommand } from "./core-job-native.js";
 import { registerCoreResolveCompanyNativeCommand } from "./core-resolve-company-command.js";
 import { registerCoreCheckpointGateSettingCommand } from "./core-checkpoint-gate-setting.js";
 import { registerCoreAuditLogNative } from "./core-audit-log-native.js";
+import { registerCoreDmBindNative } from "./core-dm-bind-native.js";
 import { registerCoreGitPackExtensionCheckNative } from "./core-git-pack-extension-check-native.js";
 import { registerCorePinNative } from "./core-pin-native.js";
 import { registerCoreRefreshVaultAccessNative } from "./core-refresh-vault-access-native.js";
+import { registerCoreWorkMeshBindTrustedNative } from "./core-work-mesh-bind-trusted-native.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
 import { CompanyIndexUserError, renderIndexTarget } from "../lib/index-render/index.js";
@@ -63,6 +65,7 @@ import { readSentryReportStdin, reportSentryEvent } from "../lib/core-utils/sent
 import { CLEAN_HANDOFF_ASSET, RESUME_LOCK_ASSET, VERIFY_DELIVERABLES_ASSET, WORKTREE_GC_ASSET, runCleanWorktreeReconcileHandoff, runResumeThreadLock, runVerifyStoryDeliverables, runWorktreeGc, } from "../lib/core-utils/worktree-resume.js";
 import { coreNativeHandoffEnabled } from "./core-native-handoff-flag.js";
 import { coreCompanyIndexScopeEnabled } from "./core-company-index-scope-flag.js";
+import { runWorkerSkillCommand } from "./core-worker-skills-command.js";
 import { describeCoreCommand, registeredCoreCommandListing, } from "./core-command-catalog.js";
 /**
  * These commands are now native implementations. Their retained shell assets
@@ -227,6 +230,8 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/hq-job-run.sh", root: "live", summary: "Scheduled jobs runner used by generated systemd units" },
     { asset: "core/scripts/hq-job-notify.sh", root: "live", summary: "Scheduled jobs failure notification helper" },
     { asset: "core/scripts/hq-job-remediate.sh", root: "live", summary: "Scheduled jobs bounded remediation helper" },
+    { asset: "core/scripts/hq-dm-bind.sh", root: "live", summary: "Rollback shell for native dm-bind" },
+    { asset: "core/scripts/work-mesh-live-bind-trusted.sh", root: "live", summary: "Rollback shell for native work-mesh-bind-trusted" },
     // Shared shell libs sourced by the two relocated scripts (and hooks). Never
     // dispatched on their own (so no `hq core` command), but they MUST ship in the
     // tarball, or the bundled hq-session / checkpoint-stop-gate die at `source`
@@ -353,6 +358,7 @@ export function registerCoreCommands(program) {
     const core = program
         .command("core", { hidden: true })
         .description("HQ scaffold scripts hosted by the CLI (core; not a stable surface)")
+        .addHelpText("afterAll", "exact-company-directory-match-v1")
         // The root override lives on the GROUP, not the subcommands, so it can never
         // collide with a wrapped script's own flags — everything after the
         // subcommand name is passed through untouched.
@@ -372,6 +378,8 @@ export function registerCoreCommands(program) {
     registerCoreGitPackExtensionCheckNative(core);
     registerCorePinNative(core);
     registerCoreRefreshVaultAccessNative(core);
+    registerCoreDmBindNative(core);
+    registerCoreWorkMeshBindTrustedNative(core);
     // Wave 2 handoff/worktree commands retain their byte-identical shell assets
     // as a default-off rollback path for one release. Keep the gate helper small
     // so sibling Wave 2 work can reuse it without editing this command table.
@@ -472,10 +480,10 @@ export function registerCoreCommands(program) {
             .allowExcessArguments()
             .helpOption(false)
             .argument("[args...]", "arguments passed through to the script")
-            .action((args = [], _opts, cmd) => {
+            .action(async (args = [], _opts, cmd) => {
             const scope = core.opts();
             const operands = cmd.args.length > 0 ? cmd.args : args;
-            runEntry(entry, scope, operands);
+            await runWorkerSkillCommand(entry.name, operands, resolveEntryRoot(entry, scope));
         });
         describeCoreCommand(command, {
             execution: interpreterFor(entry.asset) === "node" ? "bundled-node" : "bundled-shell",

package/dist/commands/dm.d.ts

@@ -71,7 +71,7 @@ export interface ChannelMember {
     handle?: string;
 }
 /** A structured mention as the POST messages route expects it. */
-export interface ChannelMention {
+interface ChannelMention {
     participantUid: string;
     participantType: "agent" | "human";
     displayName: string;
@@ -133,7 +133,7 @@ export declare function resolveMentions(tokens: string[], members: ChannelMember
  * Returns null on anything that doesn't match. Pure → unit-testable.
  */
 export declare function parseDuration(input: string): number | null;
-export type DmAudience = "human" | "agent" | "both";
+type DmAudience = "human" | "agent" | "both";
 export interface DmSendBody {
     toEmail?: string;
     toPersonUid?: string;
@@ -321,7 +321,6 @@ export interface CallerIdentity {
  * Pure → unit-testable.
  */
 export declare function callerFromToken(token: string): CallerIdentity;
-export declare function isCallerMessage(m: ChannelMessageItem, me: CallerIdentity): boolean;
 /**
  * Newest-first channel history → the caller's most recent top-level eventId.
  * Replies (those with rootEventId) are skipped. Pure → unit-testable.
@@ -366,9 +365,6 @@ export declare function formatChannelTranscript(messages: ChannelMessageItem[],
  */
 export declare function agentCallerUid(token: string, machine?: () => boolean): string | null;
 export declare const AGENT_THREAD_UNAVAILABLE: string;
-/** One-line summary of an agent inbox item (DM, email, … — shapes vary by channel). Pure. */
-export declare function formatAgentInboxItem(item: Record<string, unknown>): string;
-/** Remove delegated execution context before agent inbox items can be emitted. */
-export declare function redactAgentInboxItem<T extends object>(item: T): Omit<T, "actingContext">;
 export declare function registerDmCommand(program: Command): void;
+export {};
 //# sourceMappingURL=dm.d.ts.map

package/dist/commands/dm.js

@@ -892,7 +892,7 @@ export function callerFromToken(token) {
         ...(emailNorm ? { email: emailNorm } : {}),
     };
 }
-export function isCallerMessage(m, me) {
+function isCallerMessage(m, me) {
     if (me.personUid && m.fromPersonUid === me.personUid)
         return true;
     if (me.email && (m.fromEmail ?? "").trim().toLowerCase() === me.email) {
@@ -1060,7 +1060,7 @@ export function agentCallerUid(token, machine = isMachineIdentity) {
 export const AGENT_THREAD_UNAVAILABLE = "`hq dm thread` reads /v1/notify/thread, which is not available to agent identities. " +
     "Use `hq dm inbox` — for agents it reads GET /v1/agents/{uid}/inbox.";
 /** One-line summary of an agent inbox item (DM, email, … — shapes vary by channel). Pure. */
-export function formatAgentInboxItem(item) {
+function formatAgentInboxItem(item) {
     const str = (k) => (typeof item[k] === "string" ? item[k] : "");
     const id = str("messageId") || str("id") || "?";
     const channel = str("channel") || "inbox";
@@ -1070,7 +1070,7 @@ export function formatAgentInboxItem(item) {
     return `${chalk.bold(from)} ${chalk.dim(`[${channel}] ${id}${when ? ` ${when}` : ""}`)}\n  ${firstLine(text)}`;
 }
 /** Remove delegated execution context before agent inbox items can be emitted. */
-export function redactAgentInboxItem(item) {
+function redactAgentInboxItem(item) {
     const { actingContext: _actingContext, ...safe } = item;
     return safe;
 }

package/dist/commands/integrations-import.d.ts

@@ -3,7 +3,7 @@ import { type McpManifest } from "./mcp-registration.js";
 export type DesktopConnector = McpManifest & {
     [key: string]: unknown;
 };
-export type ImportStatus = "imported" | "needs-signin" | "shared-for-local" | "skipped";
+export type ImportStatus = "imported" | "needs-signin" | "shared-for-local" | "personal-for-local" | "skipped";
 export interface ImportOutcome {
     name: string;
     status: ImportStatus;

package/dist/commands/integrations-import.js

@@ -15,6 +15,7 @@ import { bareProvider, IntegrationsCliError, printJson } from "./integrations-co
 import { installIntegration, startOAuth } from "./integrations-api.js";
 import { loadRevealedSecrets } from "./secrets.js";
 import { registerServer } from "./mcp-registration.js";
+import { personalConnectorSettingsEnabled } from "./personal-connector-settings-flag.js";
 const OAUTH_REQUIRED_CODE = "INTEGRATION_FACTORY_OAUTH_REQUIRED";
 /** Claude Desktop's documented connector-config location for the current OS. */
 export function claudeDesktopConfigPath(platform = process.platform, home = os.homedir(), env = process.env) {
@@ -149,7 +150,13 @@ function oauthRequired(error) {
 function reconnectCommand(name, provider) {
     return `hq integrations reconnect ${name} --provider ${bareProvider(provider)}`;
 }
-function connectorPath(hqRoot, company, name) {
+function connectorPath(hqRoot, name, company, personal) {
+    if (personal) {
+        return path.join(hqRoot, "personal", "settings", "connectors", `${name}.json`);
+    }
+    if (!company) {
+        throw new IntegrationsCliError("A company is required for a shared connector manifest.", { expected: true });
+    }
     return path.join(hqRoot, "companies", company, "settings", "connectors", `${name}.json`);
 }
 /**
@@ -172,8 +179,8 @@ async function companyFolderSlug(token, companyUid) {
     }
     return folderSlug;
 }
-function writeLocalConnector(hqRoot, company, name, entry) {
-    const target = connectorPath(hqRoot, company, name);
+function writeLocalConnector(hqRoot, name, company, personal, entry) {
+    const target = connectorPath(hqRoot, name, company, personal);
     fs.mkdirSync(path.dirname(target), { recursive: true });
     fs.writeFileSync(target, `${JSON.stringify(stripConnectorSecrets(entry), null, 2)}\n`, { mode: 0o600 });
     return target;
@@ -225,11 +232,13 @@ function renderOutcomes(outcomes) {
     for (const outcome of outcomes) {
         console.log(`${redactUrlsInText(outcome.name).padEnd(25)} ${outcome.status.padEnd(19)} ${redactUrlsInText(outcome.reason ?? outcome.path ?? "")}`);
     }
-    for (const outcome of outcomes.filter((item) => item.status === "shared-for-local")) {
-        console.log(chalk.dim(`  Shared manifest: ${redactUrlsInText(outcome.path ?? "")}`));
-        console.log(chalk.dim(`  Teammate install: ${redactUrlsInText(outcome.installCommand ?? "")}`));
+    for (const outcome of outcomes.filter((item) => item.status === "shared-for-local" || item.status === "personal-for-local")) {
+        const label = outcome.status === "personal-for-local" ? "Personal manifest" : "Shared manifest";
+        const installLabel = outcome.status === "personal-for-local" ? "Personal install" : "Teammate install";
+        console.log(chalk.dim(`  ${label}: ${redactUrlsInText(outcome.path ?? "")}`));
+        console.log(chalk.dim(`  ${installLabel}: ${redactUrlsInText(outcome.installCommand ?? "")}`));
     }
-    if (outcomes.some((item) => item.status === "shared-for-local")) {
+    if (outcomes.some((item) => item.status === "shared-for-local" || item.status === "personal-for-local")) {
         console.log(chalk.yellow("  Local connector credentials were replaced with ${secret:ENV_NAME}. Set them with `hq secrets` before installing."));
     }
     if (outcomes.some((item) => item.redactedArgumentCredentials)) {
@@ -245,7 +254,7 @@ function renderOutcomes(outcomes) {
 export function registerImportCommands(integrations) {
     integrations
         .command("import")
-        .description("Import Claude Desktop connectors into company Integrations")
+        .description("Import Claude Desktop connectors into HQ Integrations")
         .option("--company <slug>", "Company slug (defaults to your single active company)")
         .option("--dry-run", "Detect and classify connectors without writing or connecting")
         .option("--only <name[,name...]>", "Import only these Claude Desktop connector names")
@@ -272,6 +281,7 @@ export function registerImportCommands(integrations) {
         const outcomes = [];
         let company;
         let hqRoot;
+        const personalSettings = personalConnectorSettingsEnabled();
         const localCompany = async () => company ??= await companyFolderSlug(token, companyUid);
         const localHqRoot = () => hqRoot ??= resolveDefaultHqRoot({ onMissing: "throw" });
         const normalizedNames = new Map();
@@ -297,13 +307,17 @@ export function registerImportCommands(integrations) {
                 continue;
             }
             if (isLocal(entry)) {
-                const resolvedCompany = await localCompany();
-                const target = connectorPath(localHqRoot(), resolvedCompany, safeName);
+                const resolvedCompany = personalSettings ? undefined : await localCompany();
+                const target = connectorPath(localHqRoot(), safeName, resolvedCompany, personalSettings);
                 outcomes.push({
                     name,
-                    status: "shared-for-local",
-                    ...(opts.dryRun ? { reason: "would write secret-stripped local manifest" } : { path: writeLocalConnector(localHqRoot(), resolvedCompany, safeName, entry) }),
-                    installCommand: `hq integrations install-local ${safeName} --company ${resolvedCompany}`,
+                    status: personalSettings ? "personal-for-local" : "shared-for-local",
+                    ...(opts.dryRun
+                        ? { reason: personalSettings ? "would write secret-stripped personal manifest" : "would write secret-stripped local manifest" }
+                        : { path: writeLocalConnector(localHqRoot(), safeName, resolvedCompany, personalSettings, entry) }),
+                    installCommand: personalSettings
+                        ? `hq integrations install-local ${safeName}`
+                        : `hq integrations install-local ${safeName} --company ${resolvedCompany}`,
                     ...(hasRedactedArgumentCredentials(entry) ? { redactedArgumentCredentials: true } : {}),
                 });
                 // Keep dry-run output useful without leaking a filesystem write target.
@@ -324,7 +338,7 @@ export function registerImportCommands(integrations) {
     });
     integrations
         .command("install-local <name>")
-        .description("Register a company-shared local connector in this machine's Claude/Codex MCP config")
+        .description("Install local connector settings in this machine's Claude/Codex MCP config")
         .option("--company <slug>", "Company slug (defaults to your single active company)")
         .option("--json", "Machine-readable registration result")
         .action(async (name, opts) => {
@@ -334,11 +348,12 @@ export function registerImportCommands(integrations) {
         }
         const token = await ensureCognitoToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const company = await companyFolderSlug(token, companyUid);
+        const personalSettings = personalConnectorSettingsEnabled();
+        const company = personalSettings ? undefined : await companyFolderSlug(token, companyUid);
         const hqRoot = resolveDefaultHqRoot({ onMissing: "throw" });
-        const manifestPath = connectorPath(hqRoot, company, safeName);
+        const manifestPath = connectorPath(hqRoot, safeName, company, personalSettings);
         if (!fs.existsSync(manifestPath)) {
-            throw new IntegrationsCliError(`Shared connector not found: ${manifestPath}`, { expected: true });
+            throw new IntegrationsCliError(`Connector settings not found: ${manifestPath}`, { expected: true });
         }
         let manifest;
         try {
@@ -346,7 +361,7 @@ export function registerImportCommands(integrations) {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            throw new IntegrationsCliError(`Could not parse shared connector ${manifestPath}: ${message}`, { expected: true });
+            throw new IntegrationsCliError(`Could not parse connector settings ${manifestPath}: ${message}`, { expected: true });
         }
         const secretNames = [...Object.values({ ...(manifest.env ?? {}), ...(manifest.headers ?? {}) }), ...(manifest.args ?? [])]
             .flatMap((value) => [...value.matchAll(/\$\{secret:([A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]*)*)\}/g)].map((match) => match[1]));
@@ -356,7 +371,7 @@ export function registerImportCommands(integrations) {
         const result = registerServer({
             name: safeName,
             manifest,
-            pack: `company-${company}-connectors`,
+            pack: personalSettings ? "personal-connectors" : `company-${company}-connectors`,
             resolveSecret: (secret) => secrets.get(secret) ?? null,
         });
         if (opts.json)

package/dist/commands/lanes-accounts.js

@@ -165,12 +165,13 @@ export function createLaneAccountsHandlers(deps) {
         }
         const hqRoot = ctx.hqRoot();
         const config = loadLanesConfig(hqRoot);
+        const quotaState = loadQuotaState(hqRoot);
         const loaded = await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config);
         // Retain the established response field for clients; balancing is now
         // unconditional, so this compatibility value is always true.
         const balanceGateEnabled = true;
         const recentUsageEnabled = await deps.readClaudeAccountBalanceSignalsEnabled(ctx);
-        const loads = accountLoadsForReport({ hosts: loaded.snapshots, config });
+        const loads = accountLoadsForReport({ hosts: loaded.snapshots, config, quotaState });
         const suggestions = planClaudeBalanceMoves({ hosts: loaded.snapshots, config });
         const selections = loaded.snapshots.map((host) => {
             try {
@@ -178,6 +179,7 @@ export function createLaneAccountsHandlers(deps) {
                     hosts: loaded.snapshots,
                     targetHost: host.capacity.host,
                     config,
+                    quotaState,
                     recentUsageEnabled,
                     now: ctx.now(),
                     unavailableHosts: loaded.unavailableHosts,

package/dist/commands/lanes-message.js

@@ -396,9 +396,31 @@ export function createLaneMessageHandlers(deps) {
             if (opts.model !== undefined && opts.account === undefined) {
                 throw new LanesError("model_requires_account", "--model on hq lanes message is only accepted together with --account", {});
             }
-            const automaticAccountSelection = opts.account === undefined && mechanism === "resume"
-                ? await selectAutomaticClaudeResumeAccount(ctx, lane, resumeProfile)
-                : undefined;
+            let quotaHoldDeferred;
+            let automaticAccountSelection = undefined;
+            if (opts.account === undefined && mechanism === "resume") {
+                try {
+                    automaticAccountSelection = await selectAutomaticClaudeResumeAccount(ctx, lane, resumeProfile);
+                }
+                catch (err) {
+                    const reasons = err instanceof LanesError && err.error === "claude_account_balance_no_eligible_account" &&
+                        Array.isArray(err.details.account_reasons)
+                        ? err.details.account_reasons.filter((reason) => reason !== null && typeof reason === "object" && !Array.isArray(reason))
+                        : [];
+                    const held = reasons.filter((reason) => reason.reason === "quota_held");
+                    if (held.length === 0)
+                        throw err;
+                    const resetTimes = held
+                        .map((reason) => reason.quota_reset_at)
+                        .filter((value) => typeof value === "string" && Number.isFinite(Date.parse(value)))
+                        .sort((a, b) => Date.parse(a) - Date.parse(b));
+                    quotaHoldDeferred = {
+                        ...(resetTimes[0] !== undefined ? { quota_reset_at: resetTimes[0] } : {}),
+                        ...(lane.model !== undefined ? { model: lane.model } : {}),
+                    };
+                    automaticAccountSelection = undefined;
+                }
+            }
             const resumeEffort = resolveResumeEffort(ctx, lane, {
                 cliEffort,
                 profile: resumeProfile,
@@ -488,7 +510,49 @@ export function createLaneMessageHandlers(deps) {
             let resumed = null;
             let move = null;
             let queuedOnAdmission = false;
-            if (opts.account !== undefined && !keepCurrentAccount) {
+            let queuedOnQuotaHold = false;
+            if (quotaHoldDeferred !== undefined) {
+                const sessionId = lane.provider_session_id;
+                if (!sessionId) {
+                    throw new LanesError("no_provider_session", `Lane ${laneId} has no provider session id to queue this message`, {
+                        lane_id: laneId,
+                        provider: lane.provider,
+                    });
+                }
+                lane = casUpdateLane(hqRoot, laneId, (current) => {
+                    if (current.version !== lane.version || current.state !== lane.state) {
+                        throw new LanesError("lane_admission_conflict", `Lane ${laneId} changed while its quota-held message was queued`, {
+                            lane_id: laneId,
+                            prepared_version: lane.version,
+                            version: current.version,
+                            state: current.state,
+                        });
+                    }
+                    return {
+                        ...current,
+                        state: "queued",
+                        queued_reason: "account_retry",
+                        queued_details: undefined,
+                        queued_at: at,
+                        admission_reserved_at: undefined,
+                        pending_resume: {
+                            session_id: sessionId,
+                            trigger: "message",
+                            caller: ctx.env.HQ_LANE_ID?.trim() || "user",
+                            text: deliveryText,
+                            ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                            message_id: messageId,
+                            compact: opts.compact !== false,
+                            at,
+                        },
+                    };
+                });
+                queuedOnQuotaHold = true;
+                storySwitchDeliveryStarted = true;
+                markAccepted();
+                deps.onLaneMessageQueued?.(laneId, "quota_hold");
+            }
+            else if (opts.account !== undefined && !keepCurrentAccount) {
                 // A moved message is always a resume on the target account: a running
                 // lane (the dropbox mechanism) is refused inside prepareAccountMove.
                 move = await prepareAccountMove(ctx, lane, {
@@ -556,7 +620,7 @@ export function createLaneMessageHandlers(deps) {
                 });
             }
             let questionCancellation = null;
-            if (move?.queued) {
+            if (move?.queued || queuedOnQuotaHold) {
                 // Parked at the target's cap: reconcile resumes the session there.
                 markAccepted();
                 questionCancellation = awaitingInputFallback
@@ -678,11 +742,13 @@ export function createLaneMessageHandlers(deps) {
             const drainHook = drainHookStatusFor(ctx, next);
             const deliveryStatus = move?.queued
                 ? "queued_on_target_account"
-                : queuedOnAdmission
-                    ? "queued_on_admission"
-                    : mechanism === "dropbox"
-                        ? "awaiting_next_tool_call"
-                        : "worker_spawned";
+                : queuedOnQuotaHold
+                    ? "queued_on_quota_hold"
+                    : queuedOnAdmission
+                        ? "queued_on_admission"
+                        : mechanism === "dropbox"
+                            ? "awaiting_next_tool_call"
+                            : "worker_spawned";
             const warning = [
                 eligibility.supersededMessageWarning,
                 mechanism === "dropbox" && drainHook !== null && !drainHook.registered
@@ -702,6 +768,14 @@ export function createLaneMessageHandlers(deps) {
                     delivery: mechanism,
                     delivered_to: { host: lane.host.id, lane_id: laneId, mechanism },
                     delivery_status: deliveryStatus,
+                    ...(queuedOnQuotaHold ? {
+                        queued_reason: "account_quota_held",
+                        quota_hold: {
+                            reason: "account_quota_held",
+                            quota_reset_at: quotaHoldDeferred?.quota_reset_at ?? null,
+                            model: quotaHoldDeferred?.model ?? null,
+                        },
+                    } : {}),
                     inbox_path: mechanism === "dropbox" ? dropboxInboxPath(hqRoot, laneId) : null,
                     drain_hook: drainHook,
                     warning,

package/dist/commands/lanes-shared.d.ts

@@ -156,7 +156,7 @@ export interface LaneMessageHandlerDeps {
     /** Test seam invoked after a provider worker has been started. */
     onLaneWorkerStarted?: (laneId: string, command: "message" | "resume") => void;
     /** Test seam invoked after a message has been durably queued for a lane. */
-    onLaneMessageQueued?: (laneId: string, path: "admission" | "account_move") => void;
+    onLaneMessageQueued?: (laneId: string, path: "admission" | "account_move" | "quota_hold") => void;
     archiveResumeMessage(hqRoot: string, laneId: string, message: {
         message_id: string;
         [key: string]: unknown;
@@ -264,6 +264,9 @@ export interface Ctx {
     backfillOutpostIdentity: (expectedId: string) => "created" | "unchanged";
     fetchText: (url: string) => Promise<string>;
     lanePlacementEnabled: (company: LaneCompanyRef | undefined) => Promise<boolean>;
+    readLeadAutopilotFlag: (flag: string, options: {
+        company: LaneCompanyRef;
+    }) => Promise<boolean>;
     storyLedgerEnabled: () => boolean;
     isSsmOwnerDispatch: () => boolean;
     withGrantHireLocks: typeof withLaneHireLocks;

package/dist/commands/lanes.d.ts

@@ -32,7 +32,7 @@ export interface LanesCommandDeps {
     /** Test seam for failures after a lane provider worker is started. */
     onLaneWorkerStarted?: (laneId: string, command: "message" | "resume") => void;
     /** Test seam for failures after a message is durably queued. */
-    onLaneMessageQueued?: (laneId: string, path: "admission" | "account_move") => void;
+    onLaneMessageQueued?: (laneId: string, path: "admission" | "account_move" | "quota_hold") => void;
     hqRoot?: () => string;
     /** Start HQ-root walk here instead of process.cwd(). Tests only. */
     cwd?: () => string;
@@ -40,6 +40,9 @@ export interface LanesCommandDeps {
     now?: () => Date;
     hostname?: () => string;
     resolveCompany?: (company?: string) => Promise<LaneCompanyRef>;
+    readLeadAutopilotFlag?: (flag: string, options: {
+        company: LaneCompanyRef;
+    }) => Promise<boolean>;
     /** Membership-backed explicit company selection for account-home writers. */
     resolveActiveCompany?: (company: string) => Promise<LaneCompanyRef | null>;
     listOutpostIds?: () => Promise<string[]>;