@indigoai-us/hq-cli 5.310.0 → 5.311.0

package/dist/commands/dm.js

@@ -892,7 +892,7 @@ export function callerFromToken(token) {
         ...(emailNorm ? { email: emailNorm } : {}),
     };
 }
-export function isCallerMessage(m, me) {
+function isCallerMessage(m, me) {
     if (me.personUid && m.fromPersonUid === me.personUid)
         return true;
     if (me.email && (m.fromEmail ?? "").trim().toLowerCase() === me.email) {
@@ -1060,7 +1060,7 @@ export function agentCallerUid(token, machine = isMachineIdentity) {
 export const AGENT_THREAD_UNAVAILABLE = "`hq dm thread` reads /v1/notify/thread, which is not available to agent identities. " +
     "Use `hq dm inbox` — for agents it reads GET /v1/agents/{uid}/inbox.";
 /** One-line summary of an agent inbox item (DM, email, … — shapes vary by channel). Pure. */
-export function formatAgentInboxItem(item) {
+function formatAgentInboxItem(item) {
     const str = (k) => (typeof item[k] === "string" ? item[k] : "");
     const id = str("messageId") || str("id") || "?";
     const channel = str("channel") || "inbox";
@@ -1070,7 +1070,7 @@ export function formatAgentInboxItem(item) {
     return `${chalk.bold(from)} ${chalk.dim(`[${channel}] ${id}${when ? ` ${when}` : ""}`)}\n  ${firstLine(text)}`;
 }
 /** Remove delegated execution context before agent inbox items can be emitted. */
-export function redactAgentInboxItem(item) {
+function redactAgentInboxItem(item) {
     const { actingContext: _actingContext, ...safe } = item;
     return safe;
 }

package/dist/commands/integrations-import.d.ts

@@ -3,7 +3,7 @@ import { type McpManifest } from "./mcp-registration.js";
 export type DesktopConnector = McpManifest & {
     [key: string]: unknown;
 };
-export type ImportStatus = "imported" | "needs-signin" | "shared-for-local" | "skipped";
+export type ImportStatus = "imported" | "needs-signin" | "shared-for-local" | "personal-for-local" | "skipped";
 export interface ImportOutcome {
     name: string;
     status: ImportStatus;

package/dist/commands/integrations-import.js

@@ -15,6 +15,7 @@ import { bareProvider, IntegrationsCliError, printJson } from "./integrations-co
 import { installIntegration, startOAuth } from "./integrations-api.js";
 import { loadRevealedSecrets } from "./secrets.js";
 import { registerServer } from "./mcp-registration.js";
+import { personalConnectorSettingsEnabled } from "./personal-connector-settings-flag.js";
 const OAUTH_REQUIRED_CODE = "INTEGRATION_FACTORY_OAUTH_REQUIRED";
 /** Claude Desktop's documented connector-config location for the current OS. */
 export function claudeDesktopConfigPath(platform = process.platform, home = os.homedir(), env = process.env) {
@@ -149,7 +150,13 @@ function oauthRequired(error) {
 function reconnectCommand(name, provider) {
     return `hq integrations reconnect ${name} --provider ${bareProvider(provider)}`;
 }
-function connectorPath(hqRoot, company, name) {
+function connectorPath(hqRoot, name, company, personal) {
+    if (personal) {
+        return path.join(hqRoot, "personal", "settings", "connectors", `${name}.json`);
+    }
+    if (!company) {
+        throw new IntegrationsCliError("A company is required for a shared connector manifest.", { expected: true });
+    }
     return path.join(hqRoot, "companies", company, "settings", "connectors", `${name}.json`);
 }
 /**
@@ -172,8 +179,8 @@ async function companyFolderSlug(token, companyUid) {
     }
     return folderSlug;
 }
-function writeLocalConnector(hqRoot, company, name, entry) {
-    const target = connectorPath(hqRoot, company, name);
+function writeLocalConnector(hqRoot, name, company, personal, entry) {
+    const target = connectorPath(hqRoot, name, company, personal);
     fs.mkdirSync(path.dirname(target), { recursive: true });
     fs.writeFileSync(target, `${JSON.stringify(stripConnectorSecrets(entry), null, 2)}\n`, { mode: 0o600 });
     return target;
@@ -225,11 +232,13 @@ function renderOutcomes(outcomes) {
     for (const outcome of outcomes) {
         console.log(`${redactUrlsInText(outcome.name).padEnd(25)} ${outcome.status.padEnd(19)} ${redactUrlsInText(outcome.reason ?? outcome.path ?? "")}`);
     }
-    for (const outcome of outcomes.filter((item) => item.status === "shared-for-local")) {
-        console.log(chalk.dim(`  Shared manifest: ${redactUrlsInText(outcome.path ?? "")}`));
-        console.log(chalk.dim(`  Teammate install: ${redactUrlsInText(outcome.installCommand ?? "")}`));
+    for (const outcome of outcomes.filter((item) => item.status === "shared-for-local" || item.status === "personal-for-local")) {
+        const label = outcome.status === "personal-for-local" ? "Personal manifest" : "Shared manifest";
+        const installLabel = outcome.status === "personal-for-local" ? "Personal install" : "Teammate install";
+        console.log(chalk.dim(`  ${label}: ${redactUrlsInText(outcome.path ?? "")}`));
+        console.log(chalk.dim(`  ${installLabel}: ${redactUrlsInText(outcome.installCommand ?? "")}`));
     }
-    if (outcomes.some((item) => item.status === "shared-for-local")) {
+    if (outcomes.some((item) => item.status === "shared-for-local" || item.status === "personal-for-local")) {
         console.log(chalk.yellow("  Local connector credentials were replaced with ${secret:ENV_NAME}. Set them with `hq secrets` before installing."));
     }
     if (outcomes.some((item) => item.redactedArgumentCredentials)) {
@@ -245,7 +254,7 @@ function renderOutcomes(outcomes) {
 export function registerImportCommands(integrations) {
     integrations
         .command("import")
-        .description("Import Claude Desktop connectors into company Integrations")
+        .description("Import Claude Desktop connectors into HQ Integrations")
         .option("--company <slug>", "Company slug (defaults to your single active company)")
         .option("--dry-run", "Detect and classify connectors without writing or connecting")
         .option("--only <name[,name...]>", "Import only these Claude Desktop connector names")
@@ -272,6 +281,7 @@ export function registerImportCommands(integrations) {
         const outcomes = [];
         let company;
         let hqRoot;
+        const personalSettings = personalConnectorSettingsEnabled();
         const localCompany = async () => company ??= await companyFolderSlug(token, companyUid);
         const localHqRoot = () => hqRoot ??= resolveDefaultHqRoot({ onMissing: "throw" });
         const normalizedNames = new Map();
@@ -297,13 +307,17 @@ export function registerImportCommands(integrations) {
                 continue;
             }
             if (isLocal(entry)) {
-                const resolvedCompany = await localCompany();
-                const target = connectorPath(localHqRoot(), resolvedCompany, safeName);
+                const resolvedCompany = personalSettings ? undefined : await localCompany();
+                const target = connectorPath(localHqRoot(), safeName, resolvedCompany, personalSettings);
                 outcomes.push({
                     name,
-                    status: "shared-for-local",
-                    ...(opts.dryRun ? { reason: "would write secret-stripped local manifest" } : { path: writeLocalConnector(localHqRoot(), resolvedCompany, safeName, entry) }),
-                    installCommand: `hq integrations install-local ${safeName} --company ${resolvedCompany}`,
+                    status: personalSettings ? "personal-for-local" : "shared-for-local",
+                    ...(opts.dryRun
+                        ? { reason: personalSettings ? "would write secret-stripped personal manifest" : "would write secret-stripped local manifest" }
+                        : { path: writeLocalConnector(localHqRoot(), safeName, resolvedCompany, personalSettings, entry) }),
+                    installCommand: personalSettings
+                        ? `hq integrations install-local ${safeName}`
+                        : `hq integrations install-local ${safeName} --company ${resolvedCompany}`,
                     ...(hasRedactedArgumentCredentials(entry) ? { redactedArgumentCredentials: true } : {}),
                 });
                 // Keep dry-run output useful without leaking a filesystem write target.
@@ -324,7 +338,7 @@ export function registerImportCommands(integrations) {
     });
     integrations
         .command("install-local <name>")
-        .description("Register a company-shared local connector in this machine's Claude/Codex MCP config")
+        .description("Install local connector settings in this machine's Claude/Codex MCP config")
         .option("--company <slug>", "Company slug (defaults to your single active company)")
         .option("--json", "Machine-readable registration result")
         .action(async (name, opts) => {
@@ -334,11 +348,12 @@ export function registerImportCommands(integrations) {
         }
         const token = await ensureCognitoToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const company = await companyFolderSlug(token, companyUid);
+        const personalSettings = personalConnectorSettingsEnabled();
+        const company = personalSettings ? undefined : await companyFolderSlug(token, companyUid);
         const hqRoot = resolveDefaultHqRoot({ onMissing: "throw" });
-        const manifestPath = connectorPath(hqRoot, company, safeName);
+        const manifestPath = connectorPath(hqRoot, safeName, company, personalSettings);
         if (!fs.existsSync(manifestPath)) {
-            throw new IntegrationsCliError(`Shared connector not found: ${manifestPath}`, { expected: true });
+            throw new IntegrationsCliError(`Connector settings not found: ${manifestPath}`, { expected: true });
         }
         let manifest;
         try {
@@ -346,7 +361,7 @@ export function registerImportCommands(integrations) {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            throw new IntegrationsCliError(`Could not parse shared connector ${manifestPath}: ${message}`, { expected: true });
+            throw new IntegrationsCliError(`Could not parse connector settings ${manifestPath}: ${message}`, { expected: true });
         }
         const secretNames = [...Object.values({ ...(manifest.env ?? {}), ...(manifest.headers ?? {}) }), ...(manifest.args ?? [])]
             .flatMap((value) => [...value.matchAll(/\$\{secret:([A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]*)*)\}/g)].map((match) => match[1]));
@@ -356,7 +371,7 @@ export function registerImportCommands(integrations) {
         const result = registerServer({
             name: safeName,
             manifest,
-            pack: `company-${company}-connectors`,
+            pack: personalSettings ? "personal-connectors" : `company-${company}-connectors`,
             resolveSecret: (secret) => secrets.get(secret) ?? null,
         });
         if (opts.json)

package/dist/commands/lanes-accounts.js

@@ -165,12 +165,13 @@ export function createLaneAccountsHandlers(deps) {
         }
         const hqRoot = ctx.hqRoot();
         const config = loadLanesConfig(hqRoot);
+        const quotaState = loadQuotaState(hqRoot);
         const loaded = await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config);
         // Retain the established response field for clients; balancing is now
         // unconditional, so this compatibility value is always true.
         const balanceGateEnabled = true;
         const recentUsageEnabled = await deps.readClaudeAccountBalanceSignalsEnabled(ctx);
-        const loads = accountLoadsForReport({ hosts: loaded.snapshots, config });
+        const loads = accountLoadsForReport({ hosts: loaded.snapshots, config, quotaState });
         const suggestions = planClaudeBalanceMoves({ hosts: loaded.snapshots, config });
         const selections = loaded.snapshots.map((host) => {
             try {
@@ -178,6 +179,7 @@ export function createLaneAccountsHandlers(deps) {
                     hosts: loaded.snapshots,
                     targetHost: host.capacity.host,
                     config,
+                    quotaState,
                     recentUsageEnabled,
                     now: ctx.now(),
                     unavailableHosts: loaded.unavailableHosts,

package/dist/commands/lanes-message.js

@@ -396,9 +396,31 @@ export function createLaneMessageHandlers(deps) {
             if (opts.model !== undefined && opts.account === undefined) {
                 throw new LanesError("model_requires_account", "--model on hq lanes message is only accepted together with --account", {});
             }
-            const automaticAccountSelection = opts.account === undefined && mechanism === "resume"
-                ? await selectAutomaticClaudeResumeAccount(ctx, lane, resumeProfile)
-                : undefined;
+            let quotaHoldDeferred;
+            let automaticAccountSelection = undefined;
+            if (opts.account === undefined && mechanism === "resume") {
+                try {
+                    automaticAccountSelection = await selectAutomaticClaudeResumeAccount(ctx, lane, resumeProfile);
+                }
+                catch (err) {
+                    const reasons = err instanceof LanesError && err.error === "claude_account_balance_no_eligible_account" &&
+                        Array.isArray(err.details.account_reasons)
+                        ? err.details.account_reasons.filter((reason) => reason !== null && typeof reason === "object" && !Array.isArray(reason))
+                        : [];
+                    const held = reasons.filter((reason) => reason.reason === "quota_held");
+                    if (held.length === 0)
+                        throw err;
+                    const resetTimes = held
+                        .map((reason) => reason.quota_reset_at)
+                        .filter((value) => typeof value === "string" && Number.isFinite(Date.parse(value)))
+                        .sort((a, b) => Date.parse(a) - Date.parse(b));
+                    quotaHoldDeferred = {
+                        ...(resetTimes[0] !== undefined ? { quota_reset_at: resetTimes[0] } : {}),
+                        ...(lane.model !== undefined ? { model: lane.model } : {}),
+                    };
+                    automaticAccountSelection = undefined;
+                }
+            }
             const resumeEffort = resolveResumeEffort(ctx, lane, {
                 cliEffort,
                 profile: resumeProfile,
@@ -488,7 +510,49 @@ export function createLaneMessageHandlers(deps) {
             let resumed = null;
             let move = null;
             let queuedOnAdmission = false;
-            if (opts.account !== undefined && !keepCurrentAccount) {
+            let queuedOnQuotaHold = false;
+            if (quotaHoldDeferred !== undefined) {
+                const sessionId = lane.provider_session_id;
+                if (!sessionId) {
+                    throw new LanesError("no_provider_session", `Lane ${laneId} has no provider session id to queue this message`, {
+                        lane_id: laneId,
+                        provider: lane.provider,
+                    });
+                }
+                lane = casUpdateLane(hqRoot, laneId, (current) => {
+                    if (current.version !== lane.version || current.state !== lane.state) {
+                        throw new LanesError("lane_admission_conflict", `Lane ${laneId} changed while its quota-held message was queued`, {
+                            lane_id: laneId,
+                            prepared_version: lane.version,
+                            version: current.version,
+                            state: current.state,
+                        });
+                    }
+                    return {
+                        ...current,
+                        state: "queued",
+                        queued_reason: "account_retry",
+                        queued_details: undefined,
+                        queued_at: at,
+                        admission_reserved_at: undefined,
+                        pending_resume: {
+                            session_id: sessionId,
+                            trigger: "message",
+                            caller: ctx.env.HQ_LANE_ID?.trim() || "user",
+                            text: deliveryText,
+                            ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                            message_id: messageId,
+                            compact: opts.compact !== false,
+                            at,
+                        },
+                    };
+                });
+                queuedOnQuotaHold = true;
+                storySwitchDeliveryStarted = true;
+                markAccepted();
+                deps.onLaneMessageQueued?.(laneId, "quota_hold");
+            }
+            else if (opts.account !== undefined && !keepCurrentAccount) {
                 // A moved message is always a resume on the target account: a running
                 // lane (the dropbox mechanism) is refused inside prepareAccountMove.
                 move = await prepareAccountMove(ctx, lane, {
@@ -556,7 +620,7 @@ export function createLaneMessageHandlers(deps) {
                 });
             }
             let questionCancellation = null;
-            if (move?.queued) {
+            if (move?.queued || queuedOnQuotaHold) {
                 // Parked at the target's cap: reconcile resumes the session there.
                 markAccepted();
                 questionCancellation = awaitingInputFallback
@@ -678,11 +742,13 @@ export function createLaneMessageHandlers(deps) {
             const drainHook = drainHookStatusFor(ctx, next);
             const deliveryStatus = move?.queued
                 ? "queued_on_target_account"
-                : queuedOnAdmission
-                    ? "queued_on_admission"
-                    : mechanism === "dropbox"
-                        ? "awaiting_next_tool_call"
-                        : "worker_spawned";
+                : queuedOnQuotaHold
+                    ? "queued_on_quota_hold"
+                    : queuedOnAdmission
+                        ? "queued_on_admission"
+                        : mechanism === "dropbox"
+                            ? "awaiting_next_tool_call"
+                            : "worker_spawned";
             const warning = [
                 eligibility.supersededMessageWarning,
                 mechanism === "dropbox" && drainHook !== null && !drainHook.registered
@@ -702,6 +768,14 @@ export function createLaneMessageHandlers(deps) {
                     delivery: mechanism,
                     delivered_to: { host: lane.host.id, lane_id: laneId, mechanism },
                     delivery_status: deliveryStatus,
+                    ...(queuedOnQuotaHold ? {
+                        queued_reason: "account_quota_held",
+                        quota_hold: {
+                            reason: "account_quota_held",
+                            quota_reset_at: quotaHoldDeferred?.quota_reset_at ?? null,
+                            model: quotaHoldDeferred?.model ?? null,
+                        },
+                    } : {}),
                     inbox_path: mechanism === "dropbox" ? dropboxInboxPath(hqRoot, laneId) : null,
                     drain_hook: drainHook,
                     warning,

package/dist/commands/lanes-shared.d.ts

@@ -156,7 +156,7 @@ export interface LaneMessageHandlerDeps {
     /** Test seam invoked after a provider worker has been started. */
     onLaneWorkerStarted?: (laneId: string, command: "message" | "resume") => void;
     /** Test seam invoked after a message has been durably queued for a lane. */
-    onLaneMessageQueued?: (laneId: string, path: "admission" | "account_move") => void;
+    onLaneMessageQueued?: (laneId: string, path: "admission" | "account_move" | "quota_hold") => void;
     archiveResumeMessage(hqRoot: string, laneId: string, message: {
         message_id: string;
         [key: string]: unknown;
@@ -264,6 +264,9 @@ export interface Ctx {
     backfillOutpostIdentity: (expectedId: string) => "created" | "unchanged";
     fetchText: (url: string) => Promise<string>;
     lanePlacementEnabled: (company: LaneCompanyRef | undefined) => Promise<boolean>;
+    readLeadAutopilotFlag: (flag: string, options: {
+        company: LaneCompanyRef;
+    }) => Promise<boolean>;
     storyLedgerEnabled: () => boolean;
     isSsmOwnerDispatch: () => boolean;
     withGrantHireLocks: typeof withLaneHireLocks;

package/dist/commands/lanes.d.ts

@@ -32,7 +32,7 @@ export interface LanesCommandDeps {
     /** Test seam for failures after a lane provider worker is started. */
     onLaneWorkerStarted?: (laneId: string, command: "message" | "resume") => void;
     /** Test seam for failures after a message is durably queued. */
-    onLaneMessageQueued?: (laneId: string, path: "admission" | "account_move") => void;
+    onLaneMessageQueued?: (laneId: string, path: "admission" | "account_move" | "quota_hold") => void;
     hqRoot?: () => string;
     /** Start HQ-root walk here instead of process.cwd(). Tests only. */
     cwd?: () => string;
@@ -40,6 +40,9 @@ export interface LanesCommandDeps {
     now?: () => Date;
     hostname?: () => string;
     resolveCompany?: (company?: string) => Promise<LaneCompanyRef>;
+    readLeadAutopilotFlag?: (flag: string, options: {
+        company: LaneCompanyRef;
+    }) => Promise<boolean>;
     /** Membership-backed explicit company selection for account-home writers. */
     resolveActiveCompany?: (company: string) => Promise<LaneCompanyRef | null>;
     listOutpostIds?: () => Promise<string[]>;

package/dist/commands/lanes.js

@@ -33,7 +33,9 @@ import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
+import { isControllerAliasOutpostId } from "../lib/lanes/admission-host.js";
 import { runLeadAutopilotPass } from "../lib/lanes/autopilot.js";
+import { syncOutpostLeadRegistries } from "../lib/lanes/autopilot-registry.js";
 import { OutpostSnapshotInvocationMemo } from "../lib/lanes/outpost-snapshot-memo.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, selectOutpostHireGrantHierarchy, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
@@ -253,6 +255,7 @@ function resolveDeps(deps = {}) {
         now: deps.now ?? (() => new Date()),
         hostname: deps.hostname ?? (() => os.hostname()),
         resolveCompany: deps.resolveCompany ?? defaultResolveCompany,
+        readLeadAutopilotFlag: deps.readLeadAutopilotFlag ?? readLanesRegistryFlag,
         resolveActiveCompany: deps.resolveActiveCompany ?? defaultResolveActiveCompany,
         listOutpostIds: deps.listOutpostIds ?? defaultListOutpostIds,
         listOutpostRoutes,
@@ -1112,8 +1115,7 @@ async function loadHostCapacitySnapshots(ctx, hqRoot, config = loadLanesConfig(h
         .map((id) => id.trim())
         // `primary` aliases the controller when running on the primary box. From
         // another Outpost it identifies a separate host and must be measured.
-        .filter((id) => id !== "primary" ||
-        (localHost.kind === "outpost" && localHost.id !== "primary"))
+        .filter((id) => !isControllerAliasOutpostId(id, localHost))
         .filter((id) => localHost.kind !== "outpost" || id !== localHost.id)
         .sort();
     const local = buildHostCapacitySnapshot({
@@ -1676,7 +1678,7 @@ async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config) {
         });
     }
     const remoteIds = outpostIds.map((id) => id.trim())
-        .filter((id) => id !== "primary" || (localHost.kind === "outpost" && localHost.id !== "primary"))
+        .filter((id) => !isControllerAliasOutpostId(id, localHost))
         .filter((id) => localHost.kind !== "outpost" || id !== localHost.id)
         .sort();
     const remoteResults = await mapWithConcurrency(remoteIds, OUTPOST_HIRE_SUMMARY_CONCURRENCY, async (id) => {
@@ -3282,6 +3284,8 @@ async function runCreate(ctx, opts) {
             hosts: balanceHostLoad.snapshots,
             targetHost,
             config,
+            quotaState: loadQuotaState(hqRoot),
+            ...(modelToValidate !== undefined ? { model: modelToValidate } : {}),
             recentUsageEnabled: await readClaudeAccountBalanceSignalsEnabled(ctx, company ?? undefined),
             now: ctx.now(),
             ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
@@ -3329,6 +3333,8 @@ async function runCreate(ctx, opts) {
                     hosts,
                     targetHost: balanceTargetHost,
                     config,
+                    quotaState: loadQuotaState(hqRoot),
+                    ...(modelToValidate !== undefined ? { model: modelToValidate } : {}),
                     recentUsageEnabled: await readClaudeAccountBalanceSignalsEnabled(ctx, company ?? undefined),
                     now: ctx.now(),
                     ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
@@ -6391,9 +6397,8 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
             probe: ctx.probeProvider,
             env: ctx.env,
         }).logged_in;
-    const accountNeedsRepair = lane.account !== undefined &&
+    const recordedAccountUnavailable = lane.account !== undefined &&
         (currentConfig?.enabled !== true || currentLogin === false);
-    const repairUnavailableAccount = options.repairUnavailableAccount === true && accountNeedsRepair;
     const profile = workerProfile?.profile ?? (lane.worker_profile !== undefined
         ? loadWorkerProfile(hqRoot, lane.worker_profile)
         : undefined);
@@ -6413,6 +6418,16 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         (lane.model_source === "cli" || lane.model_source === "preserved")
         ? lane.account
         : undefined;
+    const quotaModel = resolveLaneModel({
+        cliModel: pinnedModel ?? (lane.model_source === "account" ? lane.model : undefined),
+        profileModel: profileDefaultsApply ? profile?.meta.model : undefined,
+        accountModel: lane.account === undefined ? undefined : config.providers.claude.accounts[lane.account]?.model,
+        providerModel: config.providers.claude.model,
+    });
+    const recordedAccountQuotaHeld = lane.account !== undefined &&
+        quotaBlockFor(loadQuotaState(hqRoot), "claude", lane.account, quotaModel, ctx.now()).blocked;
+    const accountNeedsRepair = recordedAccountUnavailable || recordedAccountQuotaHeld;
+    const repairUnavailableAccount = options.repairUnavailableAccount === true && accountNeedsRepair;
     const preservedModel = repairUnavailableAccount && lane.model_source === "account"
         ? lane.model ?? currentConfig?.model
         : undefined;
@@ -6430,7 +6445,8 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
     const currentTargetAccount = lane.account === undefined
         ? undefined
         : targetHost?.capacity.providers.claude.accounts[lane.account];
-    if (profilePin !== undefined &&
+    if (!recordedAccountQuotaHeld &&
+        profilePin !== undefined &&
         lane.account !== undefined &&
         allowedAccounts?.includes(lane.account) &&
         currentConfig?.enabled === true &&
@@ -6443,6 +6459,7 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         hosts: balanceHosts.snapshots,
         targetHost: lane.host,
         config,
+        quotaState: loadQuotaState(hqRoot),
         recentUsageEnabled: await readClaudeAccountBalanceSignalsEnabled(ctx, lane.company ?? undefined),
         now: ctx.now(),
         ...(!repairUnavailableAccount && allowedAccounts !== undefined ? { allowedAccounts } : {}),
@@ -7810,6 +7827,29 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
         summary.ok = false;
     }
     const terminalizedRemoteIds = new Set(remoteLost.map(({ id }) => id));
+    let autopilotRegistrySync;
+    const reconcileHost = reconcileHostFromCtx(ctx);
+    const localHost = laneHostFromCtx(ctx);
+    if (!opts.dryRun && (reconcileHost.outpostId === null || isControllerAliasOutpostId(reconcileHost.outpostId, localHost))) {
+        try {
+            autopilotRegistrySync = await syncOutpostLeadRegistries({
+                hqRoot,
+                outpostIds: await ctx.listOutpostIds(),
+                generatedAt: ctx.now().toISOString(),
+                localHost,
+                resolveCompany: (slug) => ctx.resolveCompany(slug),
+                readFlag: (flag, options) => ctx.readLeadAutopilotFlag(flag, options),
+                dispatch: ctx.dispatchOutpostExec,
+            });
+        }
+        catch (error) {
+            const code = error instanceof LanesError ? error.error : "lead_autopilot_registry_sync_failed";
+            const message = error instanceof Error ? error.message : String(error);
+            summary.ok = false;
+            summary.errors.push({ code, message });
+            process.stderr.write(`hq lanes autopilot registry: ${message}\n`);
+        }
+    }
     let autopilot;
     try {
         const host = reconcileHostFromCtx(ctx);
@@ -7842,11 +7882,12 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         summary.ok = false;
-        summary.errors.push({ code: "lead_autopilot_failed", message });
+        summary.errors.push({ code: error instanceof LanesError ? error.error : "lead_autopilot_failed", message });
         process.stderr.write(`hq lanes autopilot: ${message}\n`);
     }
     printJson({
         ...summary,
+        ...(autopilotRegistrySync ? { autopilot_registry_sync: autopilotRegistrySync } : {}),
         ...(autopilot ? { autopilot } : {}),
         ...(remoteLost.length > 0 ? { remote_lost: remoteLost } : {}),
         ...(mirrorRefresh.unverifiedRemote.size > 0

package/dist/commands/personal-connector-settings-flag.d.ts

@@ -0,0 +1,4 @@
+export declare const CLI_PERSONAL_CONNECTOR_SETTINGS_FLAG = "cli.personal-connector-settings";
+/** Keep company-shared connector storage unchanged until the flag is explicitly enabled. */
+export declare function personalConnectorSettingsEnabled(): boolean;
+//# sourceMappingURL=personal-connector-settings-flag.d.ts.map

package/dist/commands/personal-connector-settings-flag.js

@@ -0,0 +1,7 @@
+import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+export const CLI_PERSONAL_CONNECTOR_SETTINGS_FLAG = "cli.personal-connector-settings";
+/** Keep company-shared connector storage unchanged until the flag is explicitly enabled. */
+export function personalConnectorSettingsEnabled() {
+    return resolveProcessFlagGate(CLI_PERSONAL_CONNECTOR_SETTINGS_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=personal-connector-settings-flag.js.map

package/dist/commands/report.d.ts

@@ -1,44 +1,19 @@
 import { Command } from "commander";
-import { buildReportTarball, deployOrgContext, type ChannelReport, type DeployAccessPolicy, type ReportDeployment, type ReportPatch, ReportPublishError } from "../lib/report-publish.js";
-type ChannelRow = {
-    channelId?: string;
-    scope?: string;
-    companyUid?: string | null;
-};
+import { deployOrgContext, type ChannelReport, type ReportPatch } from "../lib/report-publish.js";
 type ReportPatchInput = ReportPatch | ((current: ChannelReport) => ReportPatch);
-/** Any company-owned channel (company or project scope) can carry reports; personal channels cannot. */
-export declare function isCompanyReportChannel(channel: ChannelRow): boolean;
-/**
- * Records created before hq-pro stamped companyUid carry null. The channel the
- * caller can see knows its company, and publish needs it to pick the deploy
- * org, so fill it from there rather than failing every publish.
- */
-export declare function withChannelCompany(report: ChannelReport, channels: ChannelRow[]): ChannelReport;
 /** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
 export declare function resolveReport(token: string, reportId: string, requestedChannelId?: string): Promise<ChannelReport>;
 export declare function patchReport(token: string, report: ChannelReport, patch: ReportPatchInput): Promise<ChannelReport>;
-/** hq-deploy refused the subdomain: another app, not visible to this caller, holds it. */
-export declare class SubdomainTakenError extends ReportPublishError {
-    constructor();
-}
 /**
  * Subdomains to try, in order. The first is the report's own slug; the rest
  * are used only when an app the caller cannot see already holds it (for
  * example, one left by an earlier publish under a different account).
  */
 export declare function candidateSlugs(slug: string, attempts?: number): string[];
-export declare function resolveCompanySlug(token: string, companyUid: string): Promise<string>;
 export declare function findOrCreateApp(token: string, slug: string, org: ReturnType<typeof deployOrgContext>): Promise<{
     id: string;
     subdomain: string;
 }>;
-export declare function deployReportStatic(token: string, input: {
-    slug: string;
-    files: Parameters<typeof buildReportTarball>[0];
-    access: DeployAccessPolicy;
-    org: ReturnType<typeof deployOrgContext>;
-}): Promise<ReportDeployment>;
 export declare function registerReportCommand(program: Command): void;
-export declare function runReportCommand(action: () => Promise<void>): Promise<void>;
 export {};
 //# sourceMappingURL=report.d.ts.map

package/dist/commands/report.js

@@ -99,7 +99,7 @@ async function listReportChannels(token) {
     return Array.isArray(listed.channels) ? listed.channels : [];
 }
 /** Any company-owned channel (company or project scope) can carry reports; personal channels cannot. */
-export function isCompanyReportChannel(channel) {
+function isCompanyReportChannel(channel) {
     if (channel.scope === "personal")
         return false;
     return channel.scope === "company" || channel.scope === "project" || Boolean(channel.companyUid);
@@ -125,7 +125,7 @@ async function readReportInChannel(token, channelId, reportId) {
  * caller can see knows its company, and publish needs it to pick the deploy
  * org, so fill it from there rather than failing every publish.
  */
-export function withChannelCompany(report, channels) {
+function withChannelCompany(report, channels) {
     if (report.companyUid)
         return report;
     const companyUid = channels.find((row) => row.channelId === report.channelId)?.companyUid;
@@ -232,7 +232,7 @@ async function deployJson(token, route, method, body, extraHeaders = {}) {
     return await res.json();
 }
 /** hq-deploy refused the subdomain: another app, not visible to this caller, holds it. */
-export class SubdomainTakenError extends ReportPublishError {
+class SubdomainTakenError extends ReportPublishError {
     constructor() {
         super("hq-deploy rejected the report deployment.");
     }
@@ -245,7 +245,7 @@ export class SubdomainTakenError extends ReportPublishError {
 export function candidateSlugs(slug, attempts = 3) {
     return [slug, ...Array.from({ length: attempts }, (_, i) => `${slug}-${i + 2}`)];
 }
-export async function resolveCompanySlug(token, companyUid) {
+async function resolveCompanySlug(token, companyUid) {
     const res = await vaultApiFetch({ token, path: `/entity/${encodeURIComponent(companyUid)}` });
     if (!res.ok)
         throw new ReportPublishError("Could not resolve the report's company for deploy.");
@@ -290,7 +290,7 @@ export async function findOrCreateApp(token, slug, org) {
         throw new ReportPublishError("hq-deploy returned an incomplete app record.");
     return { id, subdomain };
 }
-export async function deployReportStatic(token, input) {
+async function deployReportStatic(token, input) {
     const app = await findOrCreateApp(token, input.slug, input.org);
     await deployJson(token, `/api/apps/${encodeURIComponent(app.id)}/access-policy`, "PUT", input.access, input.org.headers);
     const tarball = buildReportTarball(input.files);
@@ -525,7 +525,7 @@ export function registerReportCommand(program) {
         print(templates, options.json === true);
     });
 }
-export async function runReportCommand(action) {
+async function runReportCommand(action) {
     try {
         await action();
     }