@indigoai-us/hq-cli 5.345.144 → 5.345.146

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [5.345.146] — 2026-10-17
+- `hq capacity route` and `hq lanes create --account auto` can now use a Claude account whose weekly limit is used up but whose paid extra usage is on. Pass `--allow-extra-usage` to allow it; the account is picked last. Without the flag, the refusal now says extra usage is on and names the flag.
+
+## [5.345.145] — 2026-10-17
+- `hq core checkpoint`: the background checkpoint helper now fills in automatic
+  saves that were queued before it started. It writes its own report first,
+  then works through at most 5 queued saves per run; any extra queued saves go
+  back on the queue for the next run instead of being dropped. If a run is
+  stopped partway through its queued saves, the next run puts the ones it did
+  not finish back on the queue.
+- Outpost scheduled-job alerts now reach owners recorded by their Cognito user
+  id. `hq core job notify` used to pass the id to `hq dm`, which read it as a
+  channel name and failed with "No channel named …". It now sends to the email
+  `hq whoami --json` reports for that id (the signed-in person, or the person
+  an Outpost acts for), and logs a clear reason when it cannot match one.
+- `hq whoami --json` adds `sub`, `delegatedEmail` and `delegatedSub`.
+- `hq core jobs reconcile` matches company jobs owned by the Outpost owner's
+  email or id, and reaches the user systemd manager when it runs from a system
+  service with no login session (it used to fail with "Failed to connect to
+  bus: No medium found").
+- `hq members list --json` prints each member's person id (`person_id`, the `prs_` id that file and secret grants use), email, name, slug, role and membership key. `--pending --json` does the same for pending invites. `hq members list --ids` adds a PERSON_ID column to the table. The default table is unchanged.
+
 ## [5.345.144] — 2026-10-16
 - New `hq library add <file|url>...` uploads files or http(s) URLs straight to
   the company vault and writes only a `.hqcloud` placeholder into

package/dist/command-catalog.generated.d.ts

@@ -3586,6 +3586,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--pending";
             readonly description: "List pending invites instead of active members";
             readonly hidden: false;
+        }, {
+            readonly flags: "--ids";
+            readonly description: "Add a PERSON_ID column (the prs_ id used in grants and membership keys)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print machine-readable JSON, including each person id";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -10367,6 +10375,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Minimum headroom percent the pick must clear (0-100)";
             readonly hidden: false;
             readonly defaultValue: "15";
+        }, {
+            readonly flags: "--allow-extra-usage";
+            readonly description: "Rank a Claude account whose plan limit is used up but whose paid extra usage is on (ranked last)";
+            readonly hidden: false;
         }, {
             readonly flags: "--json";
             readonly description: "Print the route result as JSON (default)";
@@ -14044,6 +14056,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--account <id>";
             readonly description: "Provider account id, or 'auto' to pick the account with the most room (all accounts are one pool across companies)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--allow-extra-usage";
+            readonly description: "With --account auto, allow a Claude account whose plan limit is used up but whose paid extra usage is on; ranked last";
+            readonly hidden: false;
         }, {
             readonly flags: "--model <id>";
             readonly description: "Model id for the provider CLI";

package/dist/command-catalog.generated.js

@@ -4333,6 +4333,16 @@ export const COMMAND_CATALOG = [
                         "flags": "--pending",
                         "description": "List pending invites instead of active members",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--ids",
+                        "description": "Add a PERSON_ID column (the prs_ id used in grants and membership keys)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON, including each person id",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []
@@ -12563,6 +12573,11 @@ export const COMMAND_CATALOG = [
                         "hidden": false,
                         "defaultValue": "15"
                     },
+                    {
+                        "flags": "--allow-extra-usage",
+                        "description": "Rank a Claude account whose plan limit is used up but whose paid extra usage is on (ranked last)",
+                        "hidden": false
+                    },
                     {
                         "flags": "--json",
                         "description": "Print the route result as JSON (default)",
@@ -17072,6 +17087,11 @@ export const COMMAND_CATALOG = [
                         "description": "Provider account id, or 'auto' to pick the account with the most room (all accounts are one pool across companies)",
                         "hidden": false
                     },
+                    {
+                        "flags": "--allow-extra-usage",
+                        "description": "With --account auto, allow a Claude account whose plan limit is used up but whose paid extra usage is on; ranked last",
+                        "hidden": false
+                    },
                     {
                         "flags": "--model <id>",
                         "description": "Model id for the provider CLI",

package/dist/commands/capacity.js

@@ -358,6 +358,7 @@ export function registerCapacityCommand(program) {
         .option("--model <id>", "Model id. Narrows --provider any to the mapped provider")
         .option("--prefer <list>", "Comma-separated preferred provider order", "claude,codex,grok")
         .option("--floor <percent>", "Minimum headroom percent the pick must clear (0-100)", "15")
+        .option("--allow-extra-usage", "Rank a Claude account whose plan limit is used up but whose paid extra usage is on (ranked last)")
         .option("--json", "Print the route result as JSON (default)")
         .option("--text", "Print a single-line text summary instead of JSON")
         .action((_opts, command) => {
@@ -394,6 +395,7 @@ export function registerCapacityCommand(program) {
                     collectorEnabled: mark ? mark.enabled : null,
                     capacityStale: freshness.stale,
                     lanesError,
+                    allowExtraUsage: opts.allowExtraUsage === true,
                 });
             }
             catch (err) {

package/dist/commands/core-checkpoint-native.d.ts

@@ -27,6 +27,14 @@ export declare const NO_BACKEND_RETRY_MS: number;
  * always releases the queue before the lock would be presumed abandoned.
  */
 export declare const SIBLING_MAX_RUNTIME_MS: number;
+/**
+ * Queued payloads one sibling run may process, across its launch claim and its
+ * own queue drain. Each one runs the full upgrade flow, so a 50-deep queue in
+ * one run outlasts SIBLING_MAX_RUNTIME_MS and the grok turn cap; the run is
+ * then killed with work half done. The launcher re-queues the overflow for the
+ * next sibling instead.
+ */
+export declare const MAX_QUEUED_PAYLOADS_PER_RUN = 5;
 type Backend = "claude" | "codex" | "grok" | "none";
 type SpawnableBackend = Exclude<Backend, "none">;
 /**
@@ -121,6 +129,28 @@ export declare function siblingLaunch(backend: SpawnableBackend, args: string[],
     command: string;
     args: string[];
 };
+/**
+ * Keep the oldest {@link MAX_QUEUED_PAYLOADS_PER_RUN} claimed payloads for this
+ * run and append the rest back to the queue, so a deep queue is worked off
+ * across several runs instead of being lost when one run hits its cap. The
+ * claim file is rewritten to hold only what this run owns.
+ */
+export declare function limitClaimedPayloads(entries: unknown[], claimPath: string, pendingPath: string, limit?: number): unknown[];
+/** Times one queued record may be recovered from a finished run before it is dropped. */
+export declare const MAX_CLAIM_RECOVERIES = 3;
+/**
+ * Put back the queued records a finished sibling claimed but never processed.
+ *
+ * A sibling stopped at its wall-clock or turn cap leaves its claim files
+ * (pending-claimed*.jsonl) in its run directory. A record whose thread file
+ * still exists at its thread_path was not upgraded (the sibling renames the
+ * -auto- file when it is done), so it is appended back to pending.jsonl for
+ * this launch to claim. Only runs whose process is gone are read, records
+ * already queued are not duplicated, and each record is recovered at most
+ * {@link MAX_CLAIM_RECOVERIES} times so one the sibling keeps skipping cannot
+ * cycle forever. Each claim file read is renamed to *.recovered.
+ */
+export declare function recoverOrphanedClaims(siblingRoot: string, pendingPath: string, liveRoot: string): number;
 /** Attach the native checkpoint command to the hidden `hq core` group. */
 export declare function registerCoreCheckpointCommand(core: Command, preResolvedHqRoot?: string): void;
 export {};

package/dist/commands/core-checkpoint-native.js

@@ -92,6 +92,14 @@ const SIBLING_LOCK_TTL_MS = 60 * 60 * 1000;
 export const SIBLING_MAX_RUNTIME_MS = 30 * 60 * 1000;
 /** Newest-wins cap so a wedged sibling cannot grow an unbounded queue. */
 const MAX_PENDING_PAYLOADS = 50;
+/**
+ * Queued payloads one sibling run may process, across its launch claim and its
+ * own queue drain. Each one runs the full upgrade flow, so a 50-deep queue in
+ * one run outlasts SIBLING_MAX_RUNTIME_MS and the grok turn cap; the run is
+ * then killed with work half done. The launcher re-queues the overflow for the
+ * next sibling instead.
+ */
+export const MAX_QUEUED_PAYLOADS_PER_RUN = 5;
 class CheckpointUsageError extends Error {
 }
 /**
@@ -202,16 +210,37 @@ report instead of guessing.
    skip silently on any failure. Hook or automation improvements go ONLY under
    personal/hooks/ as proposals.
 7. WRITE BOUNDS: you may write only under personal/, workspace/, and companies/<company>/ as constrained above. You must NEVER write into .claude/, core/, .agents/, .codex/, repos/, or anywhere outside the HQ root.
-8. Write <runDir>/report.md — full prose: what you read, what you changed
-   (paths), and what you skipped and why. List every policy or knowledge file
-   you amended, superseded, merged or deleted with the reason, so a human can
+8. Write <runDir>/report.md NOW, before you touch any queued payload — full
+   prose: what you read, what you changed (paths), and what you skipped and
+   why. List every policy or knowledge file you
+   amended, superseded, merged or deleted with the reason, so a human can
    audit and reverse it; a deletion you do not name in the report is a defect.
-   Then drain the queue: while
-   workspace/checkpoints/sibling/pending.jsonl exists and is non-empty, claim
+   The run can be stopped at its time or turn cap at any point after this, so
+   this run's own report must already exist.
+9. QUEUED PAYLOADS CLAIMED AT LAUNCH: the payload's pending_payloads array
+   holds checkpoints that were queued while an earlier sibling was busy; the
+   same records are in <runDir>/pending-claimed.jsonl. The launcher hands one
+   run at most <maxQueued> of them and has already put any others back in
+   workspace/checkpoints/sibling/pending.jsonl. For EACH record in
+   pending_payloads, in order, run steps 1-5 with that record as the payload:
+   upgrade the thread file named in its thread_path IN PLACE and drop -auto-
+   from its filename. If that -auto- file no longer exists, the record was
+   already processed; note it and move on. For a queued record, skip the
+   journal close in step 4 (it belongs to the parent session) and skip step 5b
+   (ontology); in steps 3 and 7, <company> means that record's own company, not
+   this run's. After EACH record, append one line to <runDir>/report.md naming
+   its thread and what you did, so a run stopped mid-queue shows how far it got.
+   If the array is empty, skip this step.
+10. Drain the queue, still within the same limit of <maxQueued> queued records
+   per run counted across step 9 and this step: while
+   workspace/checkpoints/sibling/pending.jsonl exists and is non-empty and you
+   have processed fewer than <maxQueued> queued records, claim
    it atomically by renaming it aside —
    mv workspace/checkpoints/sibling/pending.jsonl <runDir>/pending-claimed-N.jsonl
-   (N counting up from 2) — and process the claimed payloads with this same
-   flow. Repeat until a claim finds nothing left, then update the report.
+   (N counting up from 2) — and process its records as in step 9. When you
+   reach the limit, append every record of that claimed file you did not
+   process back to workspace/checkpoints/sibling/pending.jsonl (append with >>,
+   never overwrite) so the next sibling takes it, and record that in the report.
    NEVER read the queue and truncate it in place: a payload appended between
    your read and the truncate is lost, and its checkpoint is never enriched.
 `;
@@ -241,7 +270,8 @@ export function renderSiblingPrompt(runDir, payloadPath, options = {}) {
         .replaceAll("<ontologyStep>", () => ontologyStep)
         .replaceAll("<runDir>", () => runDir)
         .replaceAll("<payloadPath>", () => payloadPath)
-        .replaceAll("<hqRoot>", () => options.hqRoot ?? "");
+        .replaceAll("<hqRoot>", () => options.hqRoot ?? "")
+        .replaceAll("<maxQueued>", () => String(MAX_QUEUED_PAYLOADS_PER_RUN));
 }
 function collect(value, previous) {
     return [...previous, value];
@@ -1137,7 +1167,8 @@ function appendPending(pendingPath, payload) {
  * describes is never enriched. Renaming is atomic, so this run receives exactly
  * the file that existed at the moment of the claim while concurrent callers go
  * on appending to a fresh queue. The claimed file is left in the run directory
- * as an audit trail and as a recovery point if this sibling dies.
+ * as an audit trail and as a recovery point if this sibling dies: the next
+ * launch re-queues its unprocessed records through recoverOrphanedClaims.
  */
 function claimPending(pendingPath, claimPath) {
     try {
@@ -1162,6 +1193,124 @@ function claimPending(pendingPath, claimPath) {
     }
     return entries;
 }
+/**
+ * Keep the oldest {@link MAX_QUEUED_PAYLOADS_PER_RUN} claimed payloads for this
+ * run and append the rest back to the queue, so a deep queue is worked off
+ * across several runs instead of being lost when one run hits its cap. The
+ * claim file is rewritten to hold only what this run owns.
+ */
+export function limitClaimedPayloads(entries, claimPath, pendingPath, limit = MAX_QUEUED_PAYLOADS_PER_RUN) {
+    if (entries.length <= limit)
+        return entries;
+    const kept = entries.slice(0, limit);
+    const overflow = entries.slice(limit);
+    // Re-queue first: if the rewrite below fails, every record is still on disk.
+    fs.appendFileSync(pendingPath, overflow.map((entry) => `${JSON.stringify(entry)}\n`).join(""));
+    fs.writeFileSync(claimPath, kept.map((entry) => `${JSON.stringify(entry)}\n`).join(""));
+    return kept;
+}
+/** Times one queued record may be recovered from a finished run before it is dropped. */
+export const MAX_CLAIM_RECOVERIES = 3;
+/**
+ * Put back the queued records a finished sibling claimed but never processed.
+ *
+ * A sibling stopped at its wall-clock or turn cap leaves its claim files
+ * (pending-claimed*.jsonl) in its run directory. A record whose thread file
+ * still exists at its thread_path was not upgraded (the sibling renames the
+ * -auto- file when it is done), so it is appended back to pending.jsonl for
+ * this launch to claim. Only runs whose process is gone are read, records
+ * already queued are not duplicated, and each record is recovered at most
+ * {@link MAX_CLAIM_RECOVERIES} times so one the sibling keeps skipping cannot
+ * cycle forever. Each claim file read is renamed to *.recovered.
+ */
+export function recoverOrphanedClaims(siblingRoot, pendingPath, liveRoot) {
+    let runDirs;
+    try {
+        runDirs = fs.readdirSync(siblingRoot).filter((entry) => entry !== "pending.jsonl");
+    }
+    catch {
+        return 0;
+    }
+    const queuedThreads = new Set();
+    try {
+        for (const line of fs.readFileSync(pendingPath, "utf8").split("\n")) {
+            if (!line.trim())
+                continue;
+            try {
+                const threadPath = JSON.parse(line).thread_path;
+                if (typeof threadPath === "string")
+                    queuedThreads.add(threadPath);
+            }
+            catch {
+                // A torn line names no thread.
+            }
+        }
+    }
+    catch {
+        // No queue yet.
+    }
+    const recovered = [];
+    let count = 0;
+    for (const runDir of runDirs.sort()) {
+        const absolute = path.join(siblingRoot, runDir);
+        let claimFiles;
+        try {
+            claimFiles = fs.readdirSync(absolute).filter((entry) => /^pending-claimed(?:-\d+)?\.jsonl$/u.test(entry));
+        }
+        catch {
+            continue;
+        }
+        if (claimFiles.length === 0)
+            continue;
+        let pid = Number.NaN;
+        try {
+            pid = Number.parseInt(fs.readFileSync(path.join(absolute, "sibling.pid"), "utf8").trim(), 10);
+        }
+        catch {
+            // A run that never recorded a PID cannot still be running.
+        }
+        if (Number.isSafeInteger(pid) && pid > 0 && processAlive(pid))
+            continue;
+        for (const claimFile of claimFiles.sort()) {
+            const claimPath = path.join(absolute, claimFile);
+            let content;
+            try {
+                content = fs.readFileSync(claimPath, "utf8");
+            }
+            catch {
+                continue;
+            }
+            for (const line of content.split("\n")) {
+                if (!line.trim())
+                    continue;
+                let entry;
+                try {
+                    entry = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                const threadPath = entry.thread_path;
+                if (typeof threadPath !== "string" || !threadPath || queuedThreads.has(threadPath))
+                    continue;
+                if (!fs.existsSync(path.resolve(liveRoot, threadPath)))
+                    continue;
+                const attempts = typeof entry.claim_recoveries === "number" ? entry.claim_recoveries : 0;
+                if (attempts >= MAX_CLAIM_RECOVERIES)
+                    continue;
+                queuedThreads.add(threadPath);
+                recovered.push(`${JSON.stringify({ ...entry, claim_recoveries: attempts + 1 })}\n`);
+                count += 1;
+            }
+            // Re-queue before retiring the claim file, so a failure leaves the
+            // records on disk; a repeat read is deduplicated by thread_path above.
+            if (recovered.length > 0)
+                fs.appendFileSync(pendingPath, recovered.splice(0).join(""));
+            fs.renameSync(claimPath, `${claimPath}.recovered`);
+        }
+    }
+    return count;
+}
 async function startSibling(liveRoot, input, threadPath, backend) {
     const stateDir = path.join(liveRoot, "workspace", "orchestrator", "hook-state");
     const siblingRoot = path.join(liveRoot, "workspace", "checkpoints", "sibling");
@@ -1183,9 +1332,17 @@ async function startSibling(liveRoot, input, threadPath, backend) {
         printResult(`checkpoint: sibling busy — payload queued (${depth} pending)`);
         return;
     }
+    // Before this run's directory exists, so only earlier runs are read.
+    try {
+        recoverOrphanedClaims(siblingRoot, pendingPath, liveRoot);
+    }
+    catch {
+        // Recovery is best effort; the claim files stay on disk for the next launch.
+    }
     const runDir = path.join(siblingRoot, `${formatTimestamp(new Date())}-${summarySlug(input.summary ?? "checkpoint")}`);
     fs.mkdirSync(runDir, { recursive: true });
-    payload.pending_payloads = claimPending(pendingPath, path.join(runDir, "pending-claimed.jsonl"));
+    const claimPath = path.join(runDir, "pending-claimed.jsonl");
+    payload.pending_payloads = limitClaimedPayloads(claimPending(pendingPath, claimPath), claimPath, pendingPath);
     if (!payload.company) {
         let queued;
         try {

package/dist/commands/core-job-notify-native.js

@@ -195,6 +195,40 @@ function emailFromWhoami(output) {
     }
     return "";
 }
+const EMAIL_RECIPIENT = /^[^\s@]+@[^\s@]+$/;
+const COGNITO_SUB = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Outpost jobs may record `owner` as the owner's Cognito user id (the box's
+ * OUTPOST_USER_ID; the reconciler matches company jobs on it). `hq dm` cannot
+ * address a Cognito id: any token that is not an email or prs_/agt_ uid is
+ * treated as a channel name and bounces with "No channel named …". Map the id
+ * to the signed-in identity's email when `hq whoami --json` reports the same
+ * subject, directly or as the human an Outpost session acts for.
+ */
+function resolveCognitoOwner(owner, deps) {
+    if (!deps.commandExists("hq"))
+        return "";
+    let parsed;
+    try {
+        const raw = deps.run("hq", ["whoami", "--json"], { cwd: deps.cwd, env: deps.env, captureStdout: true }).stdout;
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return "";
+        parsed = value;
+    }
+    catch {
+        return "";
+    }
+    const target = owner.toLowerCase();
+    for (const [subKey, emailKey] of [["sub", "email"], ["delegatedSub", "delegatedEmail"]]) {
+        const sub = parsed[subKey];
+        const email = parsed[emailKey];
+        if (typeof sub === "string" && sub.toLowerCase() === target
+            && typeof email === "string" && EMAIL_RECIPIENT.test(email))
+            return email;
+    }
+    return "";
+}
 function normalizedEpoch(value) {
     if (!/^-?\d+$/.test(value))
         throw new Error(`invalid HQ_JOB_NOTIFY_NOW_EPOCH: ${value}`);
@@ -260,6 +294,17 @@ export function runJobNotify(argv, options = {}) {
         log("no owner recipient — cannot dm (logged only); never fails the job");
         deps.appendFile(deliveryLog, '{"delivered":false,"reason":"missing_owner"}\n');
     }
+    let recipient = owner;
+    const cognitoOwner = Boolean(owner) && COGNITO_SUB.test(owner);
+    if (cognitoOwner) {
+        recipient = resolveCognitoOwner(owner, deps);
+        if (recipient)
+            log(`owner ${owner} is a Cognito user id — delivering to ${recipient}`);
+        else {
+            log(`owner ${owner} is a Cognito user id that hq dm cannot address and hq whoami does not report it — set the job owner to an email or prs_ uid (logged only); never fails the job`);
+            deps.appendFile(deliveryLog, '{"delivered":false,"reason":"unresolved_owner_id"}\n');
+        }
+    }
     let previous = {};
     if (deps.exists(stateFile))
         previous = JSON.parse(deps.readFile(stateFile));
@@ -306,18 +351,22 @@ export function runJobNotify(argv, options = {}) {
         log("skip dm send — missing owner");
         deliverRc = 1;
     }
+    else if (!recipient) {
+        log("skip dm send — owner id has no dm recipient");
+        deliverRc = 1;
+    }
     else if (!dmBin) {
         log("skip dm send — hq CLI not found");
         deliverRc = 1;
     }
     else {
         const args = dmBin === "hq"
-            ? ["dm", owner, headline, "--details", details]
-            : [owner, headline, details];
+            ? ["dm", recipient, headline, "--details", details]
+            : [recipient, headline, details];
         deliverRc = deps.run(dmBin, args, { cwd: deps.cwd, env: deps.env, captureStdout: false, logPath: deliveryLog }).code;
         if (deliverRc === 0) {
             delivered = 1;
-            log(`dm delivered to ${owner} kind=${kind} job=${parsed.jobId}`);
+            log(`dm delivered to ${recipient} kind=${kind} job=${parsed.jobId}`);
         }
         else
             log(`dm delivery failed rc=${deliverRc} job=${parsed.jobId} (logged; not failing run)`);
@@ -344,6 +393,7 @@ export function runJobNotify(argv, options = {}) {
         delivered: delivered === 1,
         kind,
         owner,
+        ...(cognitoOwner ? { recipient: recipient || null } : {}),
         channel_unimplemented: channelUnimplemented === 1,
         deliver_rc: deliverRc,
     }, "compact"));

package/dist/commands/core-jobs-native.d.ts

@@ -15,6 +15,14 @@ export type ReconcileOptions = {
     fetcher?: typeof fetch;
     now?: () => Date;
 };
+/**
+ * A system unit with User=ec2-user (outpost-jobs-reconcile.service) or a cron
+ * job has no login session, so XDG_RUNTIME_DIR / DBUS_SESSION_BUS_ADDRESS are
+ * unset and `systemctl --user` fails with "Failed to connect to bus: No medium
+ * found" (feedback_6ce027d7). When the lingering user manager's runtime dir
+ * exists, point systemctl at it. Caller-provided values are kept.
+ */
+export declare function withUserBusEnvironment(env: NodeJS.ProcessEnv, uid: number | undefined, runtimeBase?: string, exists?: (file: string) => boolean): NodeJS.ProcessEnv;
 export declare function runReconcile(argv: string[], rootArg?: string, options?: ReconcileOptions): Promise<number>;
 export declare function registerCoreJobsNativeCommand(core: Command): void;
 export declare function rawArgumentsForCommand(command: Command, fallback: string[], raw?: string[]): string[];

package/dist/commands/core-jobs-native.js

@@ -379,9 +379,36 @@ Env / overrides (tests):
 
 Exit: 0 success; 1 partial failures; 2 usage/config.
 `;
-function commandResult(command, args) {
+/**
+ * A system unit with User=ec2-user (outpost-jobs-reconcile.service) or a cron
+ * job has no login session, so XDG_RUNTIME_DIR / DBUS_SESSION_BUS_ADDRESS are
+ * unset and `systemctl --user` fails with "Failed to connect to bus: No medium
+ * found" (feedback_6ce027d7). When the lingering user manager's runtime dir
+ * exists, point systemctl at it. Caller-provided values are kept.
+ */
+export function withUserBusEnvironment(env, uid, runtimeBase = "/run/user", exists = fs.existsSync) {
+    if (uid === undefined)
+        return env;
+    const next = { ...env };
+    if (!next.XDG_RUNTIME_DIR) {
+        const directory = path.posix.join(runtimeBase, String(uid));
+        if (!exists(directory))
+            return next;
+        next.XDG_RUNTIME_DIR = directory;
+    }
+    if (!next.DBUS_SESSION_BUS_ADDRESS && exists(path.posix.join(next.XDG_RUNTIME_DIR, "bus"))) {
+        next.DBUS_SESSION_BUS_ADDRESS = `unix:path=${next.XDG_RUNTIME_DIR}/bus`;
+    }
+    return next;
+}
+function schedulerCommandResult(command, args) {
+    const env = withUserBusEnvironment(process.env, typeof process.getuid === "function" ? process.getuid() : undefined, process.env.HQ_JOB_USER_RUNTIME_BASE || "/run/user");
+    return commandResult(command, args, env);
+}
+function commandResult(command, args, env = process.env) {
     const result = spawnSync(command, args, {
         encoding: "utf8",
+        env,
         stdio: ["ignore", "pipe", "pipe"],
     });
     return {
@@ -486,6 +513,11 @@ function resolveBoxOwners(options) {
                 email = shellText(record.email ?? user?.email);
                 add(email);
                 add(shellText(record.personUid ?? record.person_uid ?? record.uid));
+                // The person (or the human an Outpost session acts for) by Cognito
+                // id and email, so a job owner written either way matches the box.
+                add(shellText(record.sub));
+                add(shellText(record.delegatedEmail));
+                add(shellText(record.delegatedSub));
             }
             if (!email) {
                 const humanEmail = /.*Email:\s*(.*)/i.exec(who)?.[1]
@@ -757,7 +789,7 @@ function systemctlResult(args, dryRun, command, options) {
         return { status: 127, stdout: "", stderr: "scheduler stub was requested but no injected runner was supplied" };
     }
     try {
-        const runner = options.schedulerRunner ?? commandResult;
+        const runner = options.schedulerRunner ?? schedulerCommandResult;
         return runner(command, ["--user", ...args]);
     }
     catch (error) {

package/dist/commands/lanes.js

@@ -3483,6 +3483,7 @@ async function runCreate(ctx, opts) {
             collectorEnabled: readCollectorMark(ledgerOptions)?.enabled ?? null,
             capacityStale: capacityViewAge(view.generatedAt, ctx.now().getTime()).stale,
             lanesError: routeLanesError,
+            allowExtraUsage: opts.allowExtraUsage === true,
         });
         if (!result.ok || !result.pick) {
             const resetSuffix = result.next_reset ? `; next reset ${result.next_reset}` : "";
@@ -9935,6 +9936,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--remote-control", "Open a Claude lane in Remote Control using account a for login and the selected account for inference")
         .option("--title <text>", "Human-readable Claude Remote Control session title; required with --remote-control")
         .option("--account <id>", "Provider account id, or 'auto' to pick the account with the most room (all accounts are one pool across companies)")
+        .option("--allow-extra-usage", "With --account auto, allow a Claude account whose plan limit is used up but whose paid extra usage is on; ranked last")
         .option("--model <id>", "Model id for the provider CLI")
         .option("--effort <level>", "Effort level; claude: low|medium|high|xhigh|max, codex: minimal|low|medium|high|xhigh|max|ultra, grok: low|medium|high|xhigh")
         .option("--senior <ref>", "session:<id> | lane:<id> | user")

package/dist/commands/members.d.ts

@@ -145,6 +145,26 @@ export declare class InviteHttpError extends Error {
 }
 export declare function formatInviteHttpError(status: number, fallback: string, code?: string): string;
 export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
+/** JSON row for `hq members list --json`. `person_id` is the prs_/agt_ id grants use. */
+export declare function activeMemberJson(m: ActiveMember): {
+    person_id: string;
+    email: string | null;
+    name: string | null;
+    slug: string | null;
+    role: string;
+    status: string;
+    membership_key: string;
+};
+/** JSON row for `hq members list --pending --json`. */
+export declare function pendingInviteJson(inv: PendingInvite): {
+    person_id: string | null;
+    email: string | null;
+    role: string;
+    status: string;
+    invited_by: string;
+    invited_at: string;
+    membership_key: string;
+};
 export declare function listActiveMembers(token: string, companyUid: string): Promise<ActiveMember[]>;
 /**
  * Resolve a role-change target to an active membership key.

package/dist/commands/members.js

@@ -237,6 +237,30 @@ export async function listPendingInvites(token, companyUid) {
     const data = (await res.json());
     return data?.pending ?? data?.invites ?? [];
 }
+/** JSON row for `hq members list --json`. `person_id` is the prs_/agt_ id grants use. */
+export function activeMemberJson(m) {
+    return {
+        person_id: m.personUid,
+        email: m.personEmail ?? null,
+        name: m.personName ?? null,
+        slug: m.personSlug ?? null,
+        role: m.role,
+        status: m.status,
+        membership_key: m.membershipKey,
+    };
+}
+/** JSON row for `hq members list --pending --json`. */
+export function pendingInviteJson(inv) {
+    return {
+        person_id: inv.personUid ?? null,
+        email: inv.inviteeEmail ?? null,
+        role: inv.role,
+        status: inv.status,
+        invited_by: inv.invitedBy,
+        invited_at: inv.invitedAt,
+        membership_key: inv.membershipKey,
+    };
+}
 export async function listActiveMembers(token, companyUid) {
     const res = await vaultApiFetch({
         token,
@@ -750,6 +774,8 @@ export function registerMembersCommand(program) {
         .command("list")
         .description("List the company's active members (use --pending for pending invites)")
         .option("--pending", "List pending invites instead of active members")
+        .option("--ids", "Add a PERSON_ID column (the prs_ id used in grants and membership keys)")
+        .option("--json", "Print machine-readable JSON, including each person id")
         .action(async (opts) => {
         try {
             const token = (await resolveVaultCredential()).token;
@@ -758,6 +784,13 @@ export function registerMembersCommand(program) {
             if (opts.pending) {
                 // --pending: preserve the original pending-invites view verbatim.
                 const invites = await listPendingInvites(token, companyUid);
+                if (opts.json) {
+                    console.log(JSON.stringify({
+                        company_uid: companyUid,
+                        pending: invites.map(pendingInviteJson),
+                    }, null, 2));
+                    return;
+                }
                 if (invites.length === 0) {
                     console.log(chalk.gray("No pending invites for this company."));
                     return;
@@ -788,17 +821,33 @@ export function registerMembersCommand(program) {
             // Default: list ACTIVE members so their emails drop straight into
             // `hq secrets share <path> --with <email>`.
             const activeMembers = await listActiveMembers(token, companyUid);
+            if (opts.json) {
+                console.log(JSON.stringify({
+                    company_uid: companyUid,
+                    members: activeMembers.map(activeMemberJson),
+                }, null, 2));
+                return;
+            }
             if (activeMembers.length === 0) {
                 console.log(chalk.gray("No active members found for this company."));
                 return;
             }
             const emailW = Math.max(5, ...activeMembers.map((m) => (m.personEmail ?? m.personUid).length));
             const roleW = Math.max(4, ...activeMembers.map((m) => m.role.length));
-            console.log(chalk.bold(["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW), "NAME"].join("  ")));
+            const idW = Math.max(9, ...activeMembers.map((m) => m.personUid.length));
+            const header = ["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW)];
+            if (opts.ids)
+                header.push("PERSON_ID".padEnd(idW));
+            header.push("NAME");
+            console.log(chalk.bold(header.join("  ")));
             for (const m of activeMembers) {
                 const email = m.personEmail ?? m.personUid;
                 const name = m.personName ?? m.personSlug ?? "";
-                console.log([email.padEnd(emailW), m.role.padEnd(roleW), name].join("  "));
+                const row = [email.padEnd(emailW), m.role.padEnd(roleW)];
+                if (opts.ids)
+                    row.push(m.personUid.padEnd(idW));
+                row.push(name);
+                console.log(row.join("  "));
             }
         }
         catch (err) {

package/dist/commands/whoami.js

@@ -153,6 +153,15 @@ export function registerWhoamiCommand(program) {
                     authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
                     tokenSource: machine ? 'machine' : 'person',
                     email: machine ? null : displayedIdentity.email ?? null,
+                    // Cognito subject of the person shown in `email` (null for machine
+                    // identities). Outpost jobs record owners by this id.
+                    sub: machine ? null : displayedIdentity.sub ?? null,
+                    // The human an Outpost session acts for, from the token's
+                    // delegated claims, for machine and person sources alike.
+                    delegatedEmail: identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined
+                        ? identity.delegatedEmail : null,
+                    delegatedSub: identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined
+                        ? identity.delegatedSub : null,
                     personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
                     agentUid,
                     username: machineCreds?.username ?? null,

package/dist/lib/capacity/route.d.ts

@@ -1,6 +1,6 @@
 import type { LaneRecord, LaneState, LanesConfig } from "../lanes/types.js";
 import { type LaneProvider } from "../lanes/types.js";
-import { type NowLimit, type NowView } from "./ledger.js";
+import { type NowAccount, type NowLimit, type NowView } from "./ledger.js";
 /** All lane providers, in the stable order boss-route uses for ranking ties. */
 export declare const ROUTE_PROVIDERS: readonly LaneProvider[];
 /** Lane states that count against an account's live load. */
@@ -28,6 +28,12 @@ export declare const OLD_READING_PENALTY = 10;
  * view stale). Sits below any account with fresh known headroom.
  */
 export declare const UNKNOWN_USAGE_SCORE = -100;
+/**
+ * Score for an account whose plan limit is used up but which still runs on
+ * paid extra usage. Ranked only with --allow-extra-usage, below every account
+ * with plan room or unknown usage.
+ */
+export declare const EXTRA_USAGE_SCORE = -200;
 /** Default --floor applied by the CLI (percent headroom to clear). */
 export declare const DEFAULT_FLOOR = 15;
 /** Default --prefer order applied by the CLI. */
@@ -85,6 +91,8 @@ export interface RouteRanked {
     lane_flags: string;
     /** True when no usable reading exists and the account is ranked as unknown. */
     usage_unknown: boolean;
+    /** True when a plan limit is used up and the lane would spend paid extra usage. */
+    extra_usage?: boolean;
 }
 /** Live lane on an account the router would avoid; command names a replacement. */
 export interface RouteMove {
@@ -130,6 +138,12 @@ export interface PickAccountInput {
     capacityStale?: boolean;
     /** Error summary when the lanes list could not be read. */
     lanesError?: string | null;
+    /**
+     * Owner opt-in (2026-10-17): rank an account whose plan limit is used up
+     * but whose Claude extra usage is enabled and not capped. Off by default so
+     * lanes never spend paid usage without being asked to.
+     */
+    allowExtraUsage?: boolean;
 }
 export declare class RouteUsageError extends Error {
     readonly code = "route_usage";
@@ -141,6 +155,12 @@ export declare function resolveRequestedProviders(raw: readonly string[] | undef
 export declare function resolvePreferOrder(raw: readonly string[] | undefined): LaneProvider[];
 /** Parse `--floor <n>`; 0..100 inclusive, default DEFAULT_FLOOR when missing. */
 export declare function resolveFloor(raw: string | number | undefined): number;
+/**
+ * True when the account's Claude extra usage reading says the provider will
+ * keep serving it after a plan limit runs out: enabled, not at its monthly
+ * cap, and not stopped by a spend control.
+ */
+export declare function hasExtraUsageRoom(account: NowAccount): boolean;
 /**
  * Pure routing decision over a snapshot: scores every signed-in lane account,
  * applies the --prefer order under the --floor headroom, returns the pick (or

package/dist/lib/capacity/route.js

@@ -47,6 +47,12 @@ export const OLD_READING_PENALTY = 10;
  * view stale). Sits below any account with fresh known headroom.
  */
 export const UNKNOWN_USAGE_SCORE = -100;
+/**
+ * Score for an account whose plan limit is used up but which still runs on
+ * paid extra usage. Ranked only with --allow-extra-usage, below every account
+ * with plan room or unknown usage.
+ */
+export const EXTRA_USAGE_SCORE = -200;
 /** Default --floor applied by the CLI (percent headroom to clear). */
 export const DEFAULT_FLOOR = 15;
 /** Default --prefer order applied by the CLI. */
@@ -178,6 +184,27 @@ function liveLaneCount(lanes, provider, account) {
     }
     return count;
 }
+/**
+ * True when the account's Claude extra usage reading says the provider will
+ * keep serving it after a plan limit runs out: enabled, not at its monthly
+ * cap, and not stopped by a spend control.
+ */
+export function hasExtraUsageRoom(account) {
+    const limits = account.limits ?? [];
+    const extra = limits.find((l) => l.kind === "credits" && l.limitId === "extra_usage");
+    if (!extra || extra.hasCredits !== true)
+        return false;
+    if (extra.spendControlReached === true)
+        return false;
+    if (typeof extra.usedPercent === "number" && extra.usedPercent >= 100)
+        return false;
+    const spend = limits.find((l) => l.kind === "credits" && l.limitId === "spend");
+    if (spend?.spendControlReached === true)
+        return false;
+    if (spend && typeof spend.usedPercent === "number" && spend.usedPercent >= 100)
+        return false;
+    return true;
+}
 function limitAgeMs(view, nowMs) {
     if (!view.resetPassed || !view.limit.resetsAt)
         return view.readAge;
@@ -368,9 +395,49 @@ export function pickAccount(input) {
                 && row.readAge <= LIMIT_STALE_MS
                 && (row.limit.state === "exhausted" || (typeof row.used === "number" && row.used >= 100)));
             if (exhausted) {
+                const extraRoom = providerId === "claude" && hasExtraUsageRoom(account);
+                if (extraRoom && input.allowExtraUsage === true) {
+                    const live = liveLaneCount(lanes, providerId, laneMatch.id);
+                    const weekly = applicable.find((l) => l.kind === "weekly_all");
+                    const whyParts = [
+                        `${labelLimit(exhausted.limit)} used up; runs on paid extra usage (--allow-extra-usage)`,
+                    ];
+                    if (live)
+                        whyParts.push(`${live} live lane${live === 1 ? "" : "s"} already on it`);
+                    if (tokenExpired)
+                        whyParts.push("sign-in renews when the lane starts");
+                    ranked.push({
+                        provider: providerId,
+                        account: laneMatch.id,
+                        label,
+                        organization: account.organization ?? null,
+                        headroom: 0,
+                        score: EXTRA_USAGE_SCORE - live * LANE_PENALTY,
+                        live_lanes: live,
+                        reset_soon: false,
+                        token_expired: tokenExpired,
+                        reading_age_h: Math.round(limitAgeMs(exhausted, nowMs) / 36e5),
+                        binding: {
+                            limit: labelLimit(exhausted.limit),
+                            used_percent: typeof exhausted.used === "number" ? exhausted.used : 100,
+                            resets_at: exhausted.limit.resetsAt ?? null,
+                        },
+                        weekly_resets_at: weekly?.resetsAt ?? null,
+                        why: whyParts.join("; "),
+                        lane_flags: `--provider ${providerId} --account ${laneMatch.id}`,
+                        usage_unknown: false,
+                        extra_usage: true,
+                    });
+                    continue;
+                }
                 skipped.push({
                     ...base,
-                    reason: `${labelLimit(exhausted.limit)} used up`,
+                    reason: extraRoom
+                        ? `${labelLimit(exhausted.limit)} used up; extra usage is on`
+                        : `${labelLimit(exhausted.limit)} used up`,
+                    ...(extraRoom
+                        ? { fix: "pass --allow-extra-usage to run on paid extra usage" }
+                        : {}),
                     resets_at: exhausted.limit.resetsAt ?? null,
                 });
                 continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.144",
+  "version": "5.345.146",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {