@indigoai-us/hq-cli 5.328.0 → 5.330.0

package/dist/lib/doctor/checks/anywhere.js

@@ -16,6 +16,8 @@ import { CLI_VERSION } from "../../../cli-version.js";
 import { computeMcpStatus } from "../../../commands/mcp-status.js";
 import { HQ_MCP_SERVER_NAME, SKILL_LINK_PREFIX, claudeTargets } from "../../install/claude-targets.js";
 import { codexTargets } from "../../install/codex-targets.js";
+import { CHATGPT_MODE } from "../../install/chatgpt-targets.js";
+import { GROK_MODE } from "../../install/grok-targets.js";
 import { pingHqdVersion } from "../../daemon/convergence.js";
 import { daemonPresenceLabel, heartbeatFile, readHeartbeat } from "../../daemon/heartbeat.js";
 import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK } from "../../daemon/install.js";
@@ -42,10 +44,16 @@ export async function runAnywhereChecks(_context, deps = {}) {
     const claude = claudeTargets(home);
     const codex = codexTargets(home);
     const installed = [claude.hqPointer, claude.stateFile, codex.stateFile].some((p) => fs.existsSync(p));
+    const remoteModes = [
+        result("WARN", "chatgpt-mode", `ChatGPT integration mode: ${CHATGPT_MODE}; host connector setup is managed in ChatGPT`, "hq install --global --runtime chatgpt"),
+        result("WARN", "grok-mode", `Grok integration mode: ${GROK_MODE}; host connector setup is managed in Grok`, "hq install --global --runtime grok"),
+    ];
     if (!installed) {
-        return [result("NA", "installed", "HQ anywhere is not installed on this machine", REMEDIATION.installClaude)];
+        return [...remoteModes, result("NA", "installed", "HQ local anywhere runtime is not installed on this machine", REMEDIATION.installClaude)];
     }
-    const out = [];
+    const out = [...remoteModes];
+    const pluginInstall = readClaudePluginInstall(claude.stateFile);
+    out.push(checkInstallMode(claude.stateFile));
     out.push(checkPointer(claude.hqPointer));
     out.push(checkRegistry(registryFile(registryDir(home, env))));
     const service = (deps.serviceState ?? (() => defaultServiceState(home)))();
@@ -75,13 +83,59 @@ export async function runAnywhereChecks(_context, deps = {}) {
     out.push(checkHeartbeat(heartbeatFile(home, env), (deps.now ?? (() => new Date()))()));
     const mcp = computeMcpStatus({ home });
     const server = mcp.servers.find((s) => s.server === HQ_MCP_SERVER_NAME);
-    out.push(checkRegistration("claude", server?.claude, mcp.runtimes.claude, REMEDIATION.installClaude));
+    if (pluginInstall)
+        out.push(checkClaudePlugin(claude.settingsJson, pluginInstall));
+    else
+        out.push(checkRegistration("claude", server?.claude, mcp.runtimes.claude, REMEDIATION.installClaude));
     out.push(checkRegistration("codex", server?.codex, mcp.runtimes.codex, REMEDIATION.installCodex));
-    out.push(checkSkillLinks("claude", claude.skillsDir, REMEDIATION.installClaude));
+    if (pluginInstall)
+        out.push(result("PASS", "claude-skills", `HQ Claude skills are provided by plugin ${pluginInstall.pluginId}`));
+    else
+        out.push(checkSkillLinks("claude", claude.skillsDir, REMEDIATION.installClaude));
     if (mcp.runtimes.codex.installed)
         out.push(checkSkillLinks("codex", codex.skillsDir, REMEDIATION.installCodex));
     return out;
 }
+function checkInstallMode(file) {
+    try {
+        const state = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (typeof state.plugin?.pluginId === 'string') {
+            return result('PASS', 'install-mode', `Claude Code install mode: plugin (${state.plugin.pluginId})`, undefined, file);
+        }
+        return result('PASS', 'install-mode', 'Claude Code install mode: direct hooks and MCP', undefined, file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return result('WARN', 'install-mode', 'Claude Code install mode is unknown (install state is missing)', REMEDIATION.installClaude, file);
+        }
+        return result('FAIL', 'install-mode', `Claude Code install state is unreadable: ${error.message}`, REMEDIATION.installClaude, file);
+    }
+}
+function readClaudePluginInstall(file) {
+    try {
+        const state = JSON.parse(fs.readFileSync(file, 'utf8'));
+        const plugin = state.plugin;
+        if (typeof plugin?.pluginId === 'string' && typeof plugin.marketplaceName === 'string' && typeof plugin.sourceDir === 'string')
+            return plugin;
+    }
+    catch { /* checkInstallMode reports missing or unreadable state */ }
+    return undefined;
+}
+function checkClaudePlugin(settingsFile, plugin) {
+    const remediation = `hq install --global --runtime claude --via plugin --marketplace-dir "${plugin.sourceDir}"`;
+    try {
+        const settings = JSON.parse(fs.readFileSync(settingsFile, 'utf8'));
+        if (settings.enabledPlugins?.[plugin.pluginId] !== true)
+            return result('FAIL', 'claude-registration', `HQ Claude plugin ${plugin.pluginId} is not enabled`, remediation, settingsFile);
+        const marketplace = settings.extraKnownMarketplaces?.[plugin.marketplaceName];
+        if (marketplace?.source?.source !== 'directory' || marketplace.source.path !== plugin.sourceDir)
+            return result('FAIL', 'claude-registration', `HQ Claude plugin marketplace ${plugin.marketplaceName} is not registered from ${plugin.sourceDir}`, remediation, settingsFile);
+        return result('PASS', 'claude-registration', `HQ Claude plugin ${plugin.pluginId} is enabled from its recorded marketplace`);
+    }
+    catch (error) {
+        return result('FAIL', 'claude-registration', `Claude plugin settings are unreadable: ${error.message}`, remediation, settingsFile);
+    }
+}
 function checkPointer(file) {
     let root;
     try {

package/dist/lib/install/chatgpt-targets.d.ts

@@ -0,0 +1,8 @@
+/** ChatGPT host integration for US-015.
+ *
+ * ChatGPT currently accepts remote MCP apps, not direct local stdio servers.
+ * Keep this target read-only: the user creates the hosted connector in ChatGPT.
+ */
+export declare const CHATGPT_MODE: "remote-connector";
+export declare function chatgptConnectorInstructions(endpoint: string): string[];
+//# sourceMappingURL=chatgpt-targets.d.ts.map

package/dist/lib/install/chatgpt-targets.js

@@ -0,0 +1,15 @@
+/** ChatGPT host integration for US-015.
+ *
+ * ChatGPT currently accepts remote MCP apps, not direct local stdio servers.
+ * Keep this target read-only: the user creates the hosted connector in ChatGPT.
+ */
+export const CHATGPT_MODE = "remote-connector";
+export function chatgptConnectorInstructions(endpoint) {
+    return [
+        "ChatGPT supports hosted MCP connectors, not direct local MCP registration.",
+        `Hosted HQ MCP URL: ${endpoint}`,
+        "Enable it in ChatGPT web: Settings > Apps > Create, then add the URL as a custom MCP app. Workspace developer mode may need an admin to enable it first.",
+        "HQ did not write a ChatGPT configuration file.",
+    ];
+}
+//# sourceMappingURL=chatgpt-targets.js.map

package/dist/lib/install/codex-pack-contributions.d.ts

@@ -0,0 +1,8 @@
+type Doc = Record<string, unknown>;
+export declare function syncCodexPackSkills(packDir: string, packName: string, names: string[], remove?: boolean, home?: string): string[];
+export declare function mergeCodexPackHooks(doc: Doc, packDir: string, items: string[]): Doc;
+export declare function removeCodexPackHooks(doc: Doc, packDir: string, items: string[]): Doc;
+export declare function syncCodexPackHooks(packDir: string, items: string[], remove?: boolean, home?: string): void;
+export declare function readCodexPackHooks(target: string): Doc;
+export {};
+//# sourceMappingURL=codex-pack-contributions.d.ts.map

package/dist/lib/install/codex-pack-contributions.js

@@ -0,0 +1,205 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { anywhereRuntimeEnabled } from '../../commands/anywhere-runtime-flag.js';
+import { jsonFormat, readConfigDoc, writeConfigAtomic } from '../../commands/mcp-registration.js';
+const configFormat = {
+    parse: jsonFormat.parse,
+    serialize: jsonFormat.serialize,
+    emptyDoc: () => ({}),
+    assertEntry(doc, name) {
+        const hooks = doc.hooks;
+        if (name.startsWith('hooks-remove:')) {
+            const removedRoot = name.slice('hooks-remove:'.length);
+            if (hooks && Object.values(hooks).some((groups) => groups.some((group) => group.hooks?.some((hook) => typeof hook.command === 'string' && hook.command.includes(removedRoot))))) {
+                throw new Error(`Codex hook registrations for ${removedRoot} remain after removal`);
+            }
+            return;
+        }
+        if (!hooks || !Object.values(hooks).some((groups) => groups.some((group) => group.hooks?.some((hook) => typeof hook.command === 'string' && hook.command.includes(name))))) {
+            throw new Error(`Codex hook registrations for ${name} were not written`);
+        }
+    },
+};
+function hooksPath(home) { return path.join(home, '.codex', 'hooks.json'); }
+const ownerFile = '.hq-pack-owner';
+const validContributionName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function assertContributionNames(items) {
+    for (const item of items)
+        if (!validContributionName.test(item))
+            throw new Error(`Invalid Codex pack contribution name: ${item}`);
+}
+function hasPackOwner(target, packName) {
+    try {
+        const dirStat = fs.lstatSync(target);
+        const markerPath = path.join(target, ownerFile);
+        const markerStat = fs.lstatSync(markerPath);
+        return dirStat.isDirectory() && !dirStat.isSymbolicLink() && markerStat.isFile() && !markerStat.isSymbolicLink() && fs.readFileSync(markerPath, 'utf8') === `${packName}\n`;
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return false;
+        throw e;
+    }
+}
+export function syncCodexPackSkills(packDir, packName, names, remove = false, home = os.homedir()) {
+    assertContributionNames(names);
+    if ((!remove && !anywhereRuntimeEnabled()) || !fs.existsSync(path.join(home, '.codex')))
+        return [];
+    const root = path.join(home, '.codex', 'skills');
+    const warnings = [];
+    for (const name of names) {
+        const source = path.join(packDir, 'skills', name);
+        const target = path.join(root, name);
+        if (!source.startsWith(`${path.resolve(packDir, 'skills')}${path.sep}`))
+            throw new Error(`Invalid Codex skill path: ${name}`);
+        if (remove) {
+            if (hasPackOwner(target, packName))
+                fs.rmSync(target, { recursive: true, force: true });
+            continue;
+        }
+        assertSafeSkillTree(source, packDir, name);
+        let targetExists = false;
+        try {
+            fs.lstatSync(target);
+            targetExists = true;
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        if (targetExists) {
+            const owned = hasPackOwner(target, packName);
+            if (!owned) {
+                warnings.push(`left foreign Codex skill in place: ${name}`);
+                continue;
+            }
+            fs.rmSync(target, { recursive: true, force: true });
+        }
+        fs.mkdirSync(root, { recursive: true });
+        copySafeSkillTree(source, target);
+        fs.writeFileSync(path.join(target, ownerFile), `${packName}\n`, { flag: 'wx', mode: 0o644 });
+    }
+    return warnings;
+}
+function assertSafeSkillTree(source, packDir, name) {
+    const root = path.resolve(packDir);
+    const resolved = path.resolve(source);
+    const stat = fs.lstatSync(source);
+    if (!resolved.startsWith(`${root}${path.sep}`) || !stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error(`Codex skill payload must be a real directory inside the pack: ${name}`);
+    }
+    for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
+        const child = path.join(source, entry.name);
+        const childStat = fs.lstatSync(child);
+        if (childStat.isSymbolicLink())
+            throw new Error(`Codex skill payload contains a symlink: ${name}/${entry.name}`);
+        if (childStat.isDirectory())
+            assertSafeSkillTree(child, packDir, name);
+        else if (!childStat.isFile())
+            throw new Error(`Codex skill payload contains an unsupported entry: ${name}/${entry.name}`);
+    }
+}
+function copySafeSkillTree(source, target) {
+    fs.mkdirSync(target, { recursive: false });
+    for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
+        const from = path.join(source, entry.name);
+        const to = path.join(target, entry.name);
+        const stat = fs.lstatSync(from);
+        if (stat.isSymbolicLink())
+            throw new Error(`Codex skill payload contains a symlink: ${entry.name}`);
+        if (stat.isDirectory())
+            copySafeSkillTree(from, to);
+        else if (stat.isFile())
+            fs.copyFileSync(from, to, fs.constants.COPYFILE_EXCL);
+        else
+            throw new Error(`Codex skill payload contains an unsupported entry: ${entry.name}`);
+    }
+}
+function readRegistrations(packDir, items) {
+    assertContributionNames(items);
+    const all = {};
+    for (const item of items) {
+        const file = path.join(packDir, 'hooks', `${item}-hooks.json`);
+        if (!fs.existsSync(file))
+            continue;
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || !('hooks' in parsed) || !parsed.hooks || typeof parsed.hooks !== 'object' || Array.isArray(parsed.hooks)) {
+            throw new Error(`Invalid Codex hook registration template: ${file}`);
+        }
+        for (const [event, groups] of Object.entries(parsed.hooks)) {
+            if (!Array.isArray(groups))
+                throw new Error(`Invalid Codex hook event ${event} in ${file}`);
+            const resolved = groups.map((group) => ({
+                ...group,
+                hooks: (group.hooks ?? []).map((hook) => {
+                    if (typeof hook.command !== 'string' || !hook.command.startsWith('hooks/'))
+                        throw new Error(`Invalid pack-relative hook command in ${file}`);
+                    const rel = hook.command.slice('hooks/'.length);
+                    const abs = path.resolve(packDir, 'hooks', rel);
+                    if (!abs.startsWith(`${path.resolve(packDir)}${path.sep}`) || !fs.existsSync(abs))
+                        throw new Error(`Hook target is missing or outside the installed pack: ${hook.command}`);
+                    const timeout = event === 'SessionEnd' ? 3 : 300;
+                    return { ...hook, command: `/bin/sh ${JSON.stringify(abs)}`, timeout };
+                }),
+            }));
+            all[event] = [...(all[event] ?? []), ...resolved];
+        }
+    }
+    return all;
+}
+export function mergeCodexPackHooks(doc, packDir, items) {
+    const hooks = { ...(doc.hooks ?? {}) };
+    const registrations = readRegistrations(packDir, items);
+    removeCommands(hooks, registeredCommands(registrations));
+    for (const [event, groups] of Object.entries(registrations))
+        hooks[event] = [...(hooks[event] ?? []), ...groups];
+    return { ...doc, ...(Object.keys(hooks).length ? { hooks } : {}) };
+}
+export function removeCodexPackHooks(doc, packDir, items) {
+    const hooks = { ...(doc.hooks ?? {}) };
+    removeCommands(hooks, registeredCommands(readRegistrations(packDir, items)));
+    const next = { ...doc };
+    if (Object.keys(hooks).length)
+        next.hooks = hooks;
+    else
+        delete next.hooks;
+    return next;
+}
+function registeredCommands(registrations) {
+    const commands = new Set();
+    for (const groups of Object.values(registrations))
+        for (const group of groups) {
+            for (const hook of group.hooks ?? [])
+                if (typeof hook.command === 'string')
+                    commands.add(hook.command);
+        }
+    return commands;
+}
+function removeCommands(hooks, commands) {
+    for (const [event, groups] of Object.entries(hooks)) {
+        hooks[event] = groups.flatMap((group) => {
+            const kept = (group.hooks ?? []).filter((hook) => typeof hook.command !== 'string' || !commands.has(hook.command));
+            return kept.length ? [{ ...group, hooks: kept }] : [];
+        });
+        if (hooks[event].length === 0)
+            delete hooks[event];
+    }
+}
+export function syncCodexPackHooks(packDir, items, remove = false, home = os.homedir()) {
+    assertContributionNames(items);
+    if ((!remove && !anywhereRuntimeEnabled()) || !fs.existsSync(path.join(home, '.codex')))
+        return;
+    const codexItems = items.filter((item) => fs.existsSync(path.join(packDir, 'hooks', `${item}-hooks.json`)));
+    if (codexItems.length === 0)
+        return;
+    const target = hooksPath(home);
+    writeConfigAtomic({
+        target, pack: 'hq-anywhere', format: configFormat,
+        merge: (doc) => remove ? removeCodexPackHooks(doc, packDir, codexItems) : mergeCodexPackHooks(doc, packDir, codexItems),
+        assertName: remove ? `hooks-remove:${path.resolve(packDir)}${path.sep}` : codexItems[0],
+        env: { home },
+    });
+}
+export function readCodexPackHooks(target) { return readConfigDoc(target, configFormat).doc; }
+//# sourceMappingURL=codex-pack-contributions.js.map

package/dist/lib/install/codex-targets.d.ts

@@ -1,6 +1,6 @@
 import { type HookTarget } from './claude-targets.js';
 /** Events the Codex hook adapter is registered for at user scope. */
-export declare const CODEX_HOOK_EVENTS: readonly ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"];
+export declare const CODEX_HOOK_EVENTS: readonly ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop", "SessionEnd"];
 export declare const AGENTS_MD_BEGIN = "<!-- hq-anywhere:begin (managed by `hq install --global --runtime codex`; remove with `hq uninstall --global --runtime codex`) -->";
 export declare const AGENTS_MD_END = "<!-- hq-anywhere:end -->";
 /** Name of the legacy ad-hoc skills mirror (~/.codex/skills/hq). */

package/dist/lib/install/codex-targets.js

@@ -19,6 +19,7 @@ export const CODEX_HOOK_EVENTS = [
     'PreToolUse',
     'PostToolUse',
     'Stop',
+    'SessionEnd',
 ];
 export const AGENTS_MD_BEGIN = '<!-- hq-anywhere:begin (managed by `hq install --global --runtime codex`; remove with `hq uninstall --global --runtime codex`) -->';
 export const AGENTS_MD_END = '<!-- hq-anywhere:end -->';
@@ -108,7 +109,7 @@ export function addCodexHooks(doc, hqRoot, target = 'master') {
         if (present)
             continue;
         groups = removeCodexHooks({ hooks: { [event]: groups } }, hqRoot).hooks?.[event] ?? [];
-        groups.push({ hooks: [{ type: 'command', command: want, timeout: 300 }] });
+        groups.push({ hooks: [{ type: 'command', command: want, timeout: event === 'SessionEnd' ? 3 : 300 }] });
         hooks[event] = groups;
         changed = true;
     }

package/dist/lib/install/grok-targets.d.ts

@@ -0,0 +1,8 @@
+/** Grok host integration for US-015.
+ *
+ * Grok custom MCP connectors are remote URL integrations. The local CLI does
+ * not write host configuration; users add the hosted HQ MCP endpoint in Grok.
+ */
+export declare const GROK_MODE: "remote-connector";
+export declare function grokConnectorInstructions(endpoint: string): string[];
+//# sourceMappingURL=grok-targets.d.ts.map

package/dist/lib/install/grok-targets.js

@@ -0,0 +1,15 @@
+/** Grok host integration for US-015.
+ *
+ * Grok custom MCP connectors are remote URL integrations. The local CLI does
+ * not write host configuration; users add the hosted HQ MCP endpoint in Grok.
+ */
+export const GROK_MODE = "remote-connector";
+export function grokConnectorInstructions(endpoint) {
+    return [
+        "Grok supports remote custom MCP connectors; it cannot register a local stdio server directly.",
+        `Hosted HQ MCP URL: ${endpoint}`,
+        "Enable it at grok.com/connectors > New Connector > Custom, then enter the URL and finish authentication.",
+        "HQ did not write a Grok configuration file.",
+    ];
+}
+//# sourceMappingURL=grok-targets.js.map

package/dist/lib/lanes/flag-keys.d.ts

@@ -1,5 +1,7 @@
 /** hq-flags keys used by lane command behavior. */
 export declare const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
+/** Refresh provider/model/effort from a worker profile when a done lane takes a new story. */
+export declare const LANE_REUSE_REFRESHES_PROFILE_FLAG = "lanes.reuse-refreshes-profile";
 /** Enables one automatic continuation after a missing-envelope repair. */
 export declare const LANE_ENVELOPE_REPAIR_CONTINUE_FLAG = "lanes.envelope-repair-continue";
 /** Count only children with live work against their senior's hire grant. */

package/dist/lib/lanes/flag-keys.js

@@ -1,5 +1,7 @@
 /** hq-flags keys used by lane command behavior. */
 export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
+/** Refresh provider/model/effort from a worker profile when a done lane takes a new story. */
+export const LANE_REUSE_REFRESHES_PROFILE_FLAG = "lanes.reuse-refreshes-profile";
 /** Enables one automatic continuation after a missing-envelope repair. */
 export const LANE_ENVELOPE_REPAIR_CONTINUE_FLAG = "lanes.envelope-repair-continue";
 /** Count only children with live work against their senior's hire grant. */

package/dist/lib/lanes/keep-alive-audit.d.ts

@@ -1,6 +1,6 @@
-type KeepAliveAuditVerdict = "on_time" | "late" | "early_wake" | "message_wake" | "self_wake" | "early_by_keep_alive" | "not_restarted" | "keep_alive_off" | "waiting";
+type KeepAliveAuditVerdict = "on_time" | "late" | "early_wake" | "message_wake" | "self_wake" | "early_by_keep_alive" | "restarted_untimed" | "not_restarted" | "keep_alive_off" | "waiting";
 interface KeepAliveAuditRestart {
-    at: string;
+    at: string | null;
     trigger: string;
     caller: string | null;
 }
@@ -18,6 +18,7 @@ interface KeepAliveAuditRow {
 interface KeepAliveAuditSummary {
     by_verdict: Record<KeepAliveAuditVerdict, number>;
     not_restarted: number;
+    restarted_untimed: number;
     late_over_10m: number;
     early_wake_by_others: number;
     self_wake: number;

package/dist/lib/lanes/keep-alive-audit.js

@@ -4,6 +4,7 @@ import { LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS } from "./keep-alive.js";
 import { LanesError } from "./errors.js";
 import { laneRunDir } from "./spawn.js";
 import { listQuestionIds, readAllLanes, tryReadQuestion } from "./store.js";
+import { HISTORY_CAP } from "./types.js";
 function readDoneClassifications(hqRoot, laneId) {
     const root = fs.realpathSync(hqRoot);
     const watcherLog = path.join(laneRunDir(root, laneId), "logs", "watcher.out");
@@ -56,6 +57,7 @@ const VERDICTS = [
     "message_wake",
     "self_wake",
     "early_by_keep_alive",
+    "restarted_untimed",
     "keep_alive_off",
     "not_restarted",
     "waiting",
@@ -285,17 +287,42 @@ function firstRestartAfter(lane, stop, nextEnvelopeMs) {
         .map((entry) => ({ entry, at: parseTime(entry.at) }))
         .filter(({ entry, at }) => at !== undefined && at > stop.mtimeMs && (nextEnvelopeMs === undefined || at < nextEnvelopeMs) && typeof entry.trigger === "string")
         .sort((a, b) => a.at - b.at)[0];
-    if (!restart || restart.at === undefined)
+    if (restart?.at !== undefined) {
+        return {
+            at: iso(restart.at),
+            trigger: restart.entry.trigger,
+            caller: typeof restart.entry.caller === "string" ? restart.entry.caller : null,
+        };
+    }
+    // resume_history is capped and may no longer retain the launch that followed
+    // an older stop. keep_alive_history is the durable automatic-resume record;
+    // only count it when a later envelope confirms the queued turn actually ran.
+    if (nextEnvelopeMs === undefined)
         return null;
-    return {
-        at: iso(restart.at),
-        trigger: restart.entry.trigger,
-        caller: typeof restart.entry.caller === "string" ? restart.entry.caller : null,
-    };
+    const keepAliveResume = (lane.keep_alive_history ?? [])
+        .map((entry) => ({ entry, at: parseTime(entry.at) }))
+        .filter(({ entry, at }) => entry.resumed_from === "done" && at !== undefined && at > stop.mtimeMs && at < nextEnvelopeMs)
+        .sort((a, b) => a.at - b.at)[0];
+    if (keepAliveResume) {
+        // This timestamp records when reconcile queued the resume, not when the
+        // provider actually launched. The next envelope confirms a turn ran, but
+        // cannot establish its launch time.
+        return { at: null, trigger: "keep_alive", caller: null };
+    }
+    const resumeHistory = lane.resume_history ?? [];
+    const keepAliveHistory = lane.keep_alive_history ?? [];
+    if (resumeHistory.length >= HISTORY_CAP && keepAliveHistory.length >= HISTORY_CAP) {
+        // Both append-only histories can roll this resume out. The later envelope
+        // proves a turn ran, while its trigger and launch time are no longer known.
+        return { at: null, trigger: "unknown", caller: null };
+    }
+    return null;
 }
 function classifyVerdict(input) {
     const { dueAt, restart, lane, nowMs } = input;
     if (restart) {
+        if (restart.at === null)
+            return "restarted_untimed";
         const restartAt = Date.parse(restart.at);
         if (restart.caller === lane.lane_id)
             return "self_wake";
@@ -388,7 +415,7 @@ export function buildKeepAliveAudit(input) {
     let lateOverTenMinutes = 0;
     for (const row of rows) {
         byVerdict[row.verdict] += 1;
-        if (row.verdict === "late" && row.restart && Date.parse(row.restart.at) - Date.parse(row.due_at) > LATE_KPI_THRESHOLD_MS) {
+        if (row.verdict === "late" && row.restart !== null && row.restart.at !== null && Date.parse(row.restart.at) - Date.parse(row.due_at) > LATE_KPI_THRESHOLD_MS) {
             lateOverTenMinutes += 1;
         }
     }
@@ -399,6 +426,7 @@ export function buildKeepAliveAudit(input) {
         summary: {
             by_verdict: byVerdict,
             not_restarted: byVerdict.not_restarted,
+            restarted_untimed: byVerdict.restarted_untimed,
             late_over_10m: lateOverTenMinutes,
             early_wake_by_others: byVerdict.early_wake,
             self_wake: byVerdict.self_wake,
@@ -416,7 +444,7 @@ export function formatKeepAliveAuditText(result) {
         row.stopped_at,
         row.next_check_at ?? "—",
         row.due_at,
-        row.restart ? `${row.restart.at} ${row.restart.trigger}${row.restart.caller ? ` (${row.restart.caller})` : ""}` : "—",
+        row.restart ? `${row.restart.at ?? "untimed"} ${row.restart.trigger}${row.restart.caller ? ` (${row.restart.caller})` : ""}` : "—",
         row.verdict,
     ]);
     const widths = headings.map((heading, index) => Math.max(heading.length, ...values.map((row) => row[index].length)));

package/dist/lib/lanes/spawn.js

@@ -1733,8 +1733,8 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
         });
     }
     const profileDefaultsApply = profile !== undefined && profile.meta.provider === existing.provider;
-    const profileModel = profileDefaultsApply ? profile.meta.model : undefined;
-    const profileEffort = profileDefaultsApply ? profile.meta.effort : undefined;
+    const profileModel = profileDefaultsApply && existing.profile_settings_pinned !== true ? profile.meta.model : undefined;
+    const profileEffort = profileDefaultsApply && existing.profile_settings_pinned !== true ? profile.meta.effort : undefined;
     const ignoredProfileFields = profile
         ? ignoredWorkerProfileFields(existing.provider)
         : [];
@@ -1765,7 +1765,7 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
         : undefined;
     // `hq lanes set` on a running lane leaves the change pending until this spawn.
     const pendingSettings = existing.pending_settings;
-    let pinnedModel = pendingSettings?.model ?? (existing.model_source === undefined || existing.model_source === "cli" || existing.model_source === "preserved"
+    let pinnedModel = pendingSettings?.model ?? (existing.profile_settings_pinned === true || existing.model_source === undefined || existing.model_source === "cli" || existing.model_source === "preserved"
         ? existing.model
         : undefined);
     const accountDeps = {
@@ -1929,7 +1929,7 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
         : undefined;
     const effort = launch.effort ?? pendingResumeEffort ?? resolveLaneEffort({
         cliEffort: pendingSettings?.effort ?? (existing.effort_source === "cli" ? existing.effort : undefined),
-        profileEffort,
+        profileEffort: existing.profile_settings_pinned === true ? existing.effort : profileEffort,
         accountEffort: accountCfg?.effort,
         providerEffort: config.providers[lane.provider].effort,
         model,
@@ -2138,7 +2138,11 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
                             ? "cli"
                             : preservedAccountModel !== undefined || existing.model_source === "preserved"
                                 ? "preserved"
-                                : "cli"
+                                : existing.model_source === "cli"
+                                    ? "cli"
+                                    : existing.profile_settings_pinned === true
+                                        ? "profile"
+                                        : "cli"
                         : profileModel !== undefined
                             ? "profile"
                             : accountCfg?.model !== undefined
@@ -2483,8 +2487,8 @@ export function spawnEnvelopeRepair(hqRoot, lane, input, deps = {}) {
         })
         : undefined;
     const profileDefaultsApply = profile !== undefined && profile.meta.provider === lane.provider;
-    const profileModel = profileDefaultsApply ? profile.meta.model : undefined;
-    const profileEffort = profileDefaultsApply ? profile.meta.effort : undefined;
+    const profileModel = profileDefaultsApply && lane.profile_settings_pinned !== true ? profile.meta.model : undefined;
+    const profileEffort = profileDefaultsApply && lane.profile_settings_pinned !== true ? profile.meta.effort : undefined;
     const ignoredProfileFields = profile
         ? ignoredWorkerProfileFields(lane.provider)
         : [];
@@ -2506,7 +2510,7 @@ export function spawnEnvelopeRepair(hqRoot, lane, input, deps = {}) {
             ignoredFields: ignoredProfileFields,
         }
         : undefined;
-    const pinnedModel = lane.model_source === undefined || lane.model_source === "cli" || lane.model_source === "preserved"
+    const pinnedModel = lane.profile_settings_pinned === true || lane.model_source === undefined || lane.model_source === "cli" || lane.model_source === "preserved"
         ? lane.model
         : undefined;
     const resolved = resolveAccount(lane.provider, lane.account, config, {
@@ -2534,7 +2538,7 @@ export function spawnEnvelopeRepair(hqRoot, lane, input, deps = {}) {
     });
     const effort = resolveLaneEffort({
         cliEffort: lane.effort_source === "cli" ? lane.effort : undefined,
-        profileEffort,
+        profileEffort: lane.profile_settings_pinned === true ? lane.effort : profileEffort,
         accountEffort: accountCfg?.effort,
         providerEffort: config.providers[lane.provider].effort,
         model,
@@ -2618,7 +2622,7 @@ export function spawnEnvelopeRepair(hqRoot, lane, input, deps = {}) {
                 if (model !== undefined) {
                     next.model = model;
                     next.model_source = pinnedModel !== undefined
-                        ? lane.model_source === "preserved" ? "preserved" : "cli"
+                        ? lane.model_source === "preserved" ? "preserved" : lane.model_source === "profile" || lane.profile_settings_pinned === true ? "profile" : "cli"
                         : profileModel !== undefined
                             ? "profile"
                             : accountCfg?.model !== undefined

package/dist/lib/lanes/store.js

@@ -652,6 +652,27 @@ export function parseLaneRecord(raw, filePath) {
     if (!isLaneProvider(raw.provider)) {
         throw new LaneSchemaError(`Unknown provider ${JSON.stringify(raw.provider)}`, { path: filePath, value: raw.provider });
     }
+    if (raw.provider_source !== undefined && !["cli", "profile", "default"].includes(String(raw.provider_source))) {
+        throw new LaneSchemaError("provider_source must be cli, profile, or default", {
+            path: filePath,
+            field: "provider_source",
+            value: raw.provider_source,
+        });
+    }
+    if (raw.account_source !== undefined && !["cli", "profile", "balanced"].includes(String(raw.account_source))) {
+        throw new LaneSchemaError("account_source must be cli, profile, or balanced", {
+            path: filePath,
+            field: "account_source",
+            value: raw.account_source,
+        });
+    }
+    if (raw.profile_settings_pinned !== undefined && typeof raw.profile_settings_pinned !== "boolean") {
+        throw new LaneSchemaError("profile_settings_pinned must be a boolean", {
+            path: filePath,
+            field: "profile_settings_pinned",
+            value: raw.profile_settings_pinned,
+        });
+    }
     if (raw.worker_policy_delivery !== undefined &&
         raw.worker_policy_delivery !== "hook" &&
         raw.worker_policy_delivery !== "prompt") {
@@ -867,8 +888,8 @@ export function parseLaneRecord(raw, filePath) {
         for (const [index, entry] of raw.settings_history.entries()) {
             const field = `settings_history[${index}]`;
             if (!isPlainObject(entry) ||
-                Object.keys(entry).some((key) => !["at", "actor", "model", "effort", "reason"].includes(key)) ||
-                (entry.model === undefined && entry.effort === undefined)) {
+                Object.keys(entry).some((key) => !["at", "actor", "provider", "model", "effort", "reason"].includes(key)) ||
+                (entry.provider === undefined && entry.model === undefined && entry.effort === undefined)) {
                 throw new LaneSchemaError(`${field} must be a settings history entry`, { path: filePath, field });
             }
             requireTimestamp(entry.at, `${field}.at`, filePath);
@@ -878,6 +899,12 @@ export function parseLaneRecord(raw, filePath) {
             if (entry.reason !== undefined && (typeof entry.reason !== "string" || entry.reason.trim() === "")) {
                 throw new LaneSchemaError(`${field}.reason must be a non-empty string when present`, { path: filePath, field });
             }
+            if (entry.provider !== undefined && (!isPlainObject(entry.provider) ||
+                Object.keys(entry.provider).some((key) => key !== "from" && key !== "to") ||
+                !isLaneProvider(entry.provider.from) ||
+                !isLaneProvider(entry.provider.to))) {
+                throw new LaneSchemaError(`${field}.provider must be a {from, to} change`, { path: filePath, field });
+            }
             for (const key of ["model", "effort"]) {
                 const change = entry[key];
                 if (change === undefined)