@indigoai-us/hq-cli 5.345.113 → 5.345.114

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [5.345.114] — 2026-10-13
+- `hq capacity login <provider> --account <id>` signs a registered account
+  in again into its existing home. The account id, home, and Keychain item
+  stay the same. `--account default` (or the id registered at `~/.claude`)
+  signs in the default home without setting `CLAUDE_CONFIG_DIR`. A reserved
+  id that names no registered account is refused before any sign-in runs.
+- `hq capacity login --repair` signs in each signed-out account one at a
+  time, keeps going when one fails, and ends with a Fixed/Skipped report.
+  It exits 1 when any signed-out account was skipped.
+- `hq capacity route` and `hq lanes create --account auto` list every
+  signed-out account under `skipped` with its reason and the exact
+  `hq capacity login <provider> --account <id>` fix, using the lanes
+  account id. The `no_account_with_room` error now carries `skipped`.
+
 ## [5.345.113] — 2026-10-13
 - `hq daemon sync now --company <slug>` asks the running sync daemon to sync one company right away, without restarting sync. It needs hq-cloud 6.18.68 or later in the daemon; with an older daemon it falls back to the previous restart. `--json` reports which path it took. The desktop app uses this for Sync on the "Added to" banner.
 

package/dist/commands/capacity.js

@@ -533,9 +533,11 @@ export function registerCapacityCommand(program) {
             });
             if (wantsJson(opts, command)) {
                 console.log(JSON.stringify(result.json ?? loginJson(rows, clock.nowMs, provider), null, 2));
+                process.exitCode = result.exitCode;
                 return;
             }
             console.log(result.text);
+            process.exitCode = result.exitCode;
         }
         catch (err) {
             failCapacity(err);

package/dist/commands/lanes.js

@@ -3307,6 +3307,7 @@ async function runCreate(ctx, opts) {
             throw new LanesError("no_account_with_room", `No account has room${resetSuffix}`, {
                 next_reset: result.next_reset,
                 request: result.request,
+                skipped: result.skipped,
             });
         }
         autoChosenProvider = parseLaneProvider(result.pick.provider);

package/dist/lib/capacity/lane-login.js

@@ -10,30 +10,76 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { createLaneAccountsHandlers } from "../../commands/lanes-accounts.js";
+import { effectiveAccountHome } from "../lanes/account-home.js";
+import { canonicalizeHome, DEFAULT_ACCOUNT_HOMES, loadLanesConfig } from "../lanes/config.js";
 import { resolveLanesHqRoot } from "../lanes/hq-root.js";
 import { defaultProbe } from "../lanes/models.js";
+import { parseLaneProvider } from "../lanes/types.js";
 const ACCOUNT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const RESERVED_ACCOUNT_IDS = new Set(["a", "default"]);
 export async function loginLaneAccount(input) {
-    if (!ACCOUNT_ID_PATTERN.test(input.accountId) || RESERVED_ACCOUNT_IDS.has(input.accountId)) {
-        throw new Error(`Refusing account id ${input.accountId}. Use letters, numbers, dots, underscores, or hyphens, and not a reserved id.`);
+    if (!ACCOUNT_ID_PATTERN.test(input.accountId)) {
+        throw new Error(`Refusing account id ${input.accountId}. Use letters, numbers, dots, underscores, or hyphens.`);
     }
     const hqRoot = input.hqRoot ?? resolveLanesHqRoot({ env: input.env });
+    const provider = parseLaneProvider(input.provider);
+    const homedir = input.homedir ?? os.homedir;
+    const hostname = input.hostname ?? os.hostname();
+    const existing = existingAccount(hqRoot, provider, input.accountId, hostname, homedir);
     let captured;
     const handlers = createLaneAccountsHandlers(handlerDeps((value) => {
         captured = value;
     }));
     // One registry write. capacityOnly stores enabled:false and the capacity-only
     // reason in that write, re-checking whether lanes already use the account.
-    await handlers.runAccountsLogin(loginCtx(input, hqRoot), input.provider, input.accountId, {
+    // A registered id signs in again into the home the registry already names.
+    await handlers.runAccountsLogin(loginCtx(input, hqRoot), provider, existing?.id ?? input.accountId, {
         capacityOnly: true,
     });
     const account = captured?.account;
     if (!account?.id || !account.home) {
-        throw new Error(`lanes accounts login did not register ${input.provider} ${input.accountId}`);
+        throw new Error(`lanes accounts login did not register ${provider} ${input.accountId}`);
+    }
+    if (existing && (account.id !== existing.id || account.home !== existing.home)) {
+        throw new Error(`Sign-in for ${provider} ${existing.id} moved it to ${account.id} at ${account.home}; expected ${existing.home}`);
     }
     return { id: account.id, home: account.home };
 }
+/**
+ * The registry account an id names, with the home lanes use on this host.
+ * `default` names the account registered at the provider's default home.
+ * Reserved ids sign in again only when they name a registered account, so a
+ * new account never takes `a` or `default`.
+ */
+function existingAccount(hqRoot, provider, accountId, hostname, homedir) {
+    const accounts = loadLanesConfig(hqRoot).providers[provider].accounts;
+    const canonical = (home) => canonicalHome(home, homedir);
+    if (accountId === "default") {
+        const defaultHome = canonical(DEFAULT_ACCOUNT_HOMES[provider]);
+        for (const [id, entry] of Object.entries(accounts)) {
+            if (!entry)
+                continue;
+            const home = canonical(effectiveAccountHome(entry, hostname).home);
+            if (home === defaultHome)
+                return { id, home };
+        }
+        throw new Error(`No ${provider} account is registered at the default home. Run hq capacity login ${provider} to add one.`);
+    }
+    const entry = accounts[accountId];
+    if (entry)
+        return { id: accountId, home: canonical(effectiveAccountHome(entry, hostname).home) };
+    if (RESERVED_ACCOUNT_IDS.has(accountId)) {
+        throw new Error(`Refusing account id ${accountId}. It is reserved and no ${provider} account uses it.`);
+    }
+    return null;
+}
+function canonicalHome(home, homedir) {
+    return canonicalizeHome(home, {
+        homedir,
+        realpathSync: (target) => fs.realpathSync(target),
+        existsSync: (target) => fs.existsSync(target),
+    });
+}
 function handlerDeps(printJson) {
     return {
         automaticBalanceMoveHistoryReason: () => unused("automaticBalanceMoveHistoryReason"),
@@ -59,8 +105,8 @@ function loginCtx(input, hqRoot) {
         hostname: () => input.hostname ?? os.hostname(),
         homedir: input.homedir ?? os.homedir,
         existsSync: (target) => fs.existsSync(target),
-        spawnLogin: input.spawnLogin ?? defaultSpawnLogin,
-        probeProvider: input.probeProvider ?? defaultProbe,
+        spawnLogin: defaultHomeEnv(input.spawnLogin ?? defaultSpawnLogin, input.homedir ?? os.homedir),
+        probeProvider: defaultHomeProbe(input.probeProvider ?? defaultProbe, input.homedir ?? os.homedir),
     };
     return new Proxy(fields, {
         get(target, prop) {
@@ -72,6 +118,27 @@ function loginCtx(input, hqRoot) {
         },
     });
 }
+/**
+ * Claude Code keys its Keychain item on CLAUDE_CONFIG_DIR. The default home
+ * keeps the plain `Claude Code-credentials` item only when the variable is
+ * unset, so a sign-in into ~/.claude runs without it.
+ */
+function defaultHomeEnv(spawnLogin, homedir) {
+    return (opts) => spawnLogin({ ...opts, env: withoutDefaultClaudeDir(opts.env, homedir) });
+}
+/** The sign-in check reads the same Keychain item the sign-in wrote. */
+function defaultHomeProbe(probe, homedir) {
+    return (command, args, env) => probe(command, args, withoutDefaultClaudeDir(env, homedir));
+}
+function withoutDefaultClaudeDir(env, homedir) {
+    const configDir = env.CLAUDE_CONFIG_DIR;
+    if (!configDir || canonicalHome(configDir, homedir) !== canonicalHome(DEFAULT_ACCOUNT_HOMES.claude, homedir)) {
+        return env;
+    }
+    const next = { ...env };
+    delete next.CLAUDE_CONFIG_DIR;
+    return next;
+}
 function defaultSpawnLogin(opts) {
     return new Promise((resolve, reject) => {
         const child = spawn(opts.command, opts.args, {

package/dist/lib/capacity/route.d.ts

@@ -1,6 +1,6 @@
 import type { LaneRecord, LaneState, LanesConfig } from "../lanes/types.js";
 import { type LaneProvider } from "../lanes/types.js";
-import type { NowLimit, NowView } from "./ledger.js";
+import { type NowLimit, type NowView } from "./ledger.js";
 /** All lane providers, in the stable order boss-route uses for ranking ties. */
 export declare const ROUTE_PROVIDERS: readonly LaneProvider[];
 /** Lane states that count against an account's live load. */

package/dist/lib/capacity/route.js

@@ -15,6 +15,7 @@
  */
 import { canonicalizeHome } from "../lanes/config.js";
 import { LANE_PROVIDERS } from "../lanes/types.js";
+import { capacityLoginCommand } from "./ledger.js";
 /** All lane providers, in the stable order boss-route uses for ranking ties. */
 export const ROUTE_PROVIDERS = LANE_PROVIDERS;
 /** Lane states that count against an account's live load. */
@@ -225,7 +226,10 @@ export function pickAccount(input) {
                 skipped.push({
                     ...base,
                     reason: account.reason ?? `sign-in ${authState}`,
-                    fix: account.fixCommand ?? null,
+                    // Every signed-out reason (revoked, missing credential, missing
+                    // scope, auth-failed lane) is fixed by signing the lane account in
+                    // again, so the fix names the registry id lanes use.
+                    fix: capacityLoginCommand(providerId, laneMatch.id),
                 });
                 continue;
             }

package/dist/lib/capacity/sign-in.d.ts

@@ -88,6 +88,18 @@ export interface CapacityLoginResult {
     json?: unknown;
 }
 export declare function executeCapacityLogin(request: CapacityLoginRequest, deps: CapacityLoginDeps): Promise<CapacityLoginResult>;
+export interface RepairFixed {
+    provider: string;
+    label: string;
+    account: string;
+    home: string;
+}
+export interface RepairSkipped {
+    provider: string;
+    label: string;
+    reason: string;
+    fix: string | null;
+}
 export declare function organizationFor(view: NowView, provider: string, home: string): string | null;
 export declare function renameCapacityAccount(hqRoot: string, providerRaw: string, fromRaw: string, toRaw: string, options?: {
     force?: boolean;

package/dist/lib/capacity/sign-in.js

@@ -278,8 +278,11 @@ export async function executeCapacityLogin(request, deps) {
     if (request.account && !request.provider) {
         throw new SignInUsageError("Pass a provider before --account.");
     }
+    // A reserved id (a, default) is accepted here so a registered account can
+    // sign in again into its home. The lane login refuses one that names no
+    // registered account.
     if (request.account)
-        assertRegistryAccountId(request.account);
+        assertAccountIdShape(request.account);
     const providerFilter = request.provider;
     const wantsSignIn = Boolean(request.provider || request.account || request.repair);
     if (!request.interactive && wantsSignIn && !request.json) {
@@ -308,19 +311,69 @@ export async function executeCapacityLogin(request, deps) {
     }
     return { exitCode: 0, text: lines.join("\n\n") };
 }
+/**
+ * Signs in again for each signed-out account, one at a time, in roster order.
+ * A failed sign-in is reported and the next account still runs. Expired
+ * accounts are reported as skipped: opening the account refreshes them.
+ */
 async function runRepair(request, deps) {
     const plan = repairSelection(deps.rows, request.provider);
     const lines = [formatRepairPlan(plan)];
+    const fixed = [];
+    const skipped = [];
     for (const row of plan.signedOut) {
-        if (row.label === "default" || RESERVED_IDS.has(row.label)) {
-            lines.push(`${row.provider} ${row.label}: ${defaultVendorLogin(row.provider)}`);
+        const fix = row.command ?? `hq capacity login ${row.provider} --account ${row.label}`;
+        let logged;
+        try {
+            logged = await deps.loginAccount(row.provider, row.label);
+        }
+        catch (err) {
+            skipped.push({ provider: row.provider, label: row.label, reason: errorText(err), fix });
             continue;
         }
-        const logged = await deps.loginAccount(row.provider, row.label);
-        const view = await deps.readAccount(row.provider, row.label, logged.home);
-        lines.push(deps.formatReading(view, row.provider, row.label, logged.home));
+        fixed.push({ provider: row.provider, label: row.label, account: logged.id, home: logged.home });
+        try {
+            const view = await deps.readAccount(row.provider, logged.id, logged.home);
+            lines.push(deps.formatReading(view, row.provider, row.label, logged.home));
+        }
+        catch (err) {
+            lines.push(`${row.provider} ${row.label}: signed in; usage read failed: ${errorText(err)}`);
+        }
     }
-    return { exitCode: 0, text: lines.join("\n\n") };
+    for (const row of plan.expired) {
+        skipped.push({
+            provider: row.provider,
+            label: row.label,
+            reason: row.reason ?? EXPIRED_REASON,
+            fix: row.command ? formatRefreshLine(row.provider, row.command) : null,
+        });
+    }
+    lines.push(formatRepairSummary(fixed, skipped));
+    const failed = skipped.some((item) => plan.signedOut.some((row) => row.provider === item.provider && row.label === item.label));
+    return {
+        exitCode: failed ? 1 : 0,
+        text: lines.join("\n\n"),
+        json: { repair: { fixed, skipped } },
+    };
+}
+function formatRepairSummary(fixed, skipped) {
+    const lines = ["Fixed:"];
+    if (fixed.length === 0)
+        lines.push("  none");
+    for (const item of fixed)
+        lines.push(`  ${item.provider} ${item.label}`);
+    lines.push("Skipped:");
+    if (skipped.length === 0)
+        lines.push("  none");
+    for (const item of skipped) {
+        lines.push(`  ${item.provider} ${item.label}: ${item.reason}`);
+        if (item.fix)
+            lines.push(`    ${item.fix}`);
+    }
+    return lines.join("\n");
+}
+function errorText(err) {
+    return err instanceof Error ? err.message : String(err);
 }
 async function signInOne(provider, account, deps) {
     const id = account ?? deps.newAccountId();
@@ -489,20 +542,16 @@ function isAncestor(parent, child) {
     const relative = path.relative(parent, child);
     return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
 }
+function assertAccountIdShape(id) {
+    if (!ID_PATTERN.test(id)) {
+        throw new SignInUsageError("Account id must start with a letter or number and contain only letters, numbers, dots, underscores, or hyphens.");
+    }
+}
 function assertRegistryAccountId(id) {
     if (!ID_PATTERN.test(id) || RESERVED_IDS.has(id)) {
         throw new SignInUsageError("Account id must start with a letter or number, contain only letters, numbers, dots, underscores, or hyphens, and must not be reserved (a, default).");
     }
 }
-function defaultVendorLogin(provider) {
-    if (provider === "claude")
-        return "claude auth login";
-    if (provider === "codex")
-        return "codex login";
-    if (provider === "grok")
-        return "grok login";
-    return `hq capacity login ${provider}`;
-}
 function requiredId(value, name) {
     const id = value.trim();
     if (!id || id !== value)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.113",
+  "version": "5.345.114",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {