@indigoai-us/hq-cli 5.345.156 → 5.345.160

package/dist/commands/lanes.js

@@ -5,6 +5,7 @@
  * `accounts login`, which hands the terminal to the vendor's own sign-in.
  * `watch` and the monitor reminder are the line-oriented text surfaces.
  */
+import { accountMatchesCompany, accountMayRetainLane, companyMismatchError } from "../lib/lanes/account-company.js";
 import { spawn, spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
@@ -104,6 +105,7 @@ import { blockerFreshnessFingerprint, resolveBlockerFreshnessForLane, } from "..
 import { resolveKrFreshnessForShow } from "../lib/lanes/kr-freshness.js";
 import { ensureSessionHome } from "../lib/lanes/session-relink.js";
 import { defaultProbe, validateProfileLaneModel, validateLaneModel, } from "../lib/lanes/models.js";
+import { readLaneClaudeCredential } from "../lib/lanes/claude-credential.js";
 import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ONLY_RULE, STANDING_AUTHORIZATION, tempHomeRule, spawnLaneWorker, spawnEnvelopeRepairRequest, laneRunDir, readSpawnManifest, stopLaneProcesses, } from "../lib/lanes/spawn.js";
 import { handOffInstallHere } from "../lib/daemon/handoff.js";
 export { spawnLaneWorker };
@@ -439,6 +441,7 @@ function resolveDeps(deps = {}) {
         mesh: deps.mesh ?? createDefaultMesh(),
         sleep: deps.sleep ?? defaultSleep,
         spawnProcess: deps.spawnProcess,
+        statfs: deps.statfs,
         proveDetached: deps.proveDetached,
         killProcess: deps.killProcess,
         isAlive: deps.isAlive,
@@ -460,6 +463,8 @@ function resolveDeps(deps = {}) {
             }),
         resolveMachineIdentity: deps.resolveMachineIdentity ?? lookupMachineIdentity,
         probeProvider: deps.probeProvider ?? defaultProbe,
+        readClaudeCredential: deps.readClaudeCredential ??
+            (deps.probeProvider === undefined ? readLaneClaudeCredential : undefined),
         runCompaction: deps.runCompaction,
         locateTranscript: deps.locateTranscript,
         monitorEvidence: deps.monitorEvidence ??
@@ -511,9 +516,11 @@ function startAdmittedLane(ctx, root, candidate) {
             env: ctx.env,
             hostname: admissionHost.hostname,
             admissionHost,
+            readClaudeCredential: ctx.readClaudeCredential,
             modelDeps: { readFileSync: ctx.readFileSync, probe: ctx.probeProvider, env: ctx.env },
             existsSync: ctx.existsSync,
             spawnProcess: ctx.spawnProcess,
+            statfs: ctx.statfs,
             proveDetached: ctx.proveDetached,
             killProcess: ctx.killProcess,
             now: ctx.now,
@@ -2161,6 +2168,7 @@ async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config, options = {})
         config,
         existsSync: ctx.existsSync,
         probe: ctx.probeProvider,
+        readClaudeCredential: ctx.readClaudeCredential,
         env: ctx.env,
         hostname: ctx.hostname(),
         now: ctx.now(),
@@ -2184,6 +2192,7 @@ async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config, options = {})
                     config,
                     existsSync: ctx.existsSync,
                     probe: ctx.probeProvider,
+                    readClaudeCredential: ctx.readClaudeCredential,
                     env: ctx.env,
                     hostname: ctx.hostname(),
                     now: ctx.now(),
@@ -4012,6 +4021,7 @@ async function runCreate(ctx, opts) {
                         existsSync: ctx.existsSync,
                         hostname: ctx.hostname(),
                         probe: ctx.probeProvider,
+                        readClaudeCredential: ctx.readClaudeCredential,
                         env: ctx.env,
                     }).logged_in === true)
                     .sort(),
@@ -4083,7 +4093,25 @@ async function runCreate(ctx, opts) {
             });
         }
     }
-    const allowedAccounts = validatedAccounts.size > 0 ? [...validatedAccounts] : profileAccounts;
+    const candidateAccounts = validatedAccounts.size > 0 ? [...validatedAccounts] : profileAccounts;
+    const accountCompany = resolveLaneCompany(hqRoot, { lane_id: "pending-create", company, mesh_company: meshCompany ?? undefined, project_id: project }).company;
+    const allowedAccounts = Object.keys(config.providers[provider].accounts).filter((id) => (candidateAccounts === undefined || candidateAccounts.includes(id)) &&
+        accountMatchesCompany(config.providers[provider].accounts[id], accountCompany, config.providers[provider].accounts));
+    if (pinnedAccount !== undefined && !accountMatchesCompany(config.providers[provider].accounts[pinnedAccount], accountCompany, config.providers[provider].accounts)) {
+        throw new LanesError("account_company_mismatch", `Account ${pinnedAccount} does not belong to the lane company`, { provider, account: pinnedAccount });
+    }
+    // Local creates and Claude balancing select an account here; other Outpost
+    // creates pick theirs on the Outpost, so they are not refused locally.
+    if (pinnedAccount === undefined && (outpostId === undefined || provider === "claude")) {
+        const mismatch = companyMismatchError({
+            provider,
+            providerAccounts: config.providers[provider].accounts,
+            candidates: candidateAccounts ?? Object.keys(config.providers[provider].accounts),
+            company: accountCompany,
+        });
+        if (mismatch !== undefined)
+            throw mismatch;
+    }
     let accountSelection;
     if (provider === "claude") {
         const persistedLocalHost = outpostId === undefined && placementHostOverride === undefined
@@ -4101,6 +4129,7 @@ async function runCreate(ctx, opts) {
         balanceTargetHost = targetHost;
         balanceHostLoad = await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config);
         const selected = selectClaudeAccount({
+            company: accountCompany,
             hosts: balanceHostLoad.snapshots,
             targetHost,
             actualTargetHost,
@@ -4119,11 +4148,7 @@ async function runCreate(ctx, opts) {
         accountSelection = { ...selected, selected_at: ctx.now().toISOString() };
     }
     const balancedAdmissionAccounts = !outpostId && pinnedAccount === undefined
-        ? [...new Set(allowedAccounts ??
-                Object.entries(config.providers[provider].accounts)
-                    .filter(([id, account]) => account.enabled &&
-                    (profileAccounts === undefined || profileAccounts.includes(id)))
-                    .map(([id]) => id))]
+        ? allowedAccounts.filter((id) => config.providers[provider].accounts[id]?.enabled)
         : undefined;
     // The lane id is created in `persist`; its Work Mesh thread is ensured
     // immediately afterward from that stable identity.
@@ -4167,6 +4192,7 @@ async function runCreate(ctx, opts) {
                         config,
                         existsSync: ctx.existsSync,
                         probe: ctx.probeProvider,
+                        readClaudeCredential: ctx.readClaudeCredential,
                         env: ctx.env,
                         hostname: ctx.hostname(),
                         now: ctx.now(),
@@ -4181,6 +4207,7 @@ async function runCreate(ctx, opts) {
                     ? { kind: "outpost", id: outpostId }
                     : localStableHost(ctx));
                 const selected = selectClaudeAccount({
+                    company: accountCompany,
                     hosts,
                     targetHost: balanceTargetHost,
                     actualTargetHost: actualTargetHostForPersist,
@@ -4521,6 +4548,7 @@ async function runCreate(ctx, opts) {
     else if (admission.action === "start") {
         started = spawnLaneWorker(hqRoot, lane, {
             env: ctx.env,
+            readClaudeCredential: ctx.readClaudeCredential,
             modelDeps: {
                 readFileSync: ctx.readFileSync,
                 probe: ctx.probeProvider,
@@ -4850,6 +4878,10 @@ function outpostRejectedGrantContextOption(result) {
     return result.exitCode !== 0 &&
         /unknown option\s+(?:['"])?--grant-context(?:['"])?(?:\s|$)/i.test(`${result.stderr}\n${result.stdout}`);
 }
+function outpostRejectedSetTargetCommand(result) {
+    return result.exitCode !== 0 &&
+        /unknown command\s+(?:['"])?set-target(?:['"])?(?:\s|$)/i.test(`${result.stderr}\n${result.stdout}`);
+}
 function outpostRejectedFailedResumeOption(result) {
     return result.exitCode !== 0 &&
         /unknown option\s+(?:['"])?--(?:from-failed|failed-resume-context)(?:['"])?(?:\s|$)/i.test(`${result.stderr}\n${result.stdout}`);
@@ -5230,9 +5262,11 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
                             ? "approve-target"
                             : action === "repair-company"
                                 ? "repair-company-target"
-                                : action,
+                                : action === "set"
+                                    ? "set-target"
+                                    : action,
                 laneId: lane.lane_id,
-                hqBinary: action === "grant" || action === "reparent" || action === "repair-company"
+                hqBinary: action === "grant" || action === "reparent" || action === "repair-company" || action === "set"
                     ? outpostCliOverride(ctx, outpostId)
                     : undefined,
                 text: options.text,
@@ -5247,6 +5281,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
                 fromFailed: options.fromFailed,
                 hire: options.hire,
                 senior: options.senior,
+                actor: options.actor,
                 reason: options.reason,
                 company: options.company,
                 grantContext: contexts.grantContext,
@@ -5297,6 +5332,14 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
             required_option: "--from-failed",
         });
     }
+    if (action === "set" && outpostRejectedSetTargetCommand(dispatched)) {
+        throw new LanesError("outpost_cli_upgrade_required", `Outpost ${outpostId} needs an hq-cli release containing remote lane settings before hq lanes set can change lane ${lane.lane_id}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: dispatched.commandId,
+            required_command: "set-target",
+        });
+    }
     const ownerError = ownerErrorFromOutput(dispatched.stdout);
     if (options.effort !== undefined && outpostRejectedEffortOption(dispatched)) {
         throw new LanesError("outpost_effort_unsupported", `Outpost ${outpostId} rejected --effort; update hq-cli on that Outpost before changing a lane's effort remotely`, {
@@ -5372,23 +5415,25 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
                             remote.lane.company !== null &&
                             remote.lane.company !== undefined &&
                             remote.lane.company.slug === options.company
-                        : action === "reparent"
-                            ? remote.lane !== null && typeof remote.lane === "object" &&
-                                Array.isArray(remote.changed_descendant_ids)
-                            : (((remote.delivery_status === "worker_spawned" ||
-                                remote.delivery_status === "queued_on_target_account") &&
-                                remote.lane !== undefined) ||
-                                (remote.delivery_status === "queued_on_admission" &&
-                                    remote.lane !== null &&
-                                    typeof remote.lane === "object" &&
-                                    !Array.isArray(remote.lane) &&
-                                    remote.lane.state === "queued") ||
-                                (remote.delivery_status === "queued_for_reconcile" &&
-                                    remote.lane !== null &&
-                                    typeof remote.lane === "object" &&
-                                    !Array.isArray(remote.lane) &&
-                                    remote.lane.state === "queued" &&
-                                    remote.lane.queued_reason !== "worker_profile_changed")));
+                        : action === "set"
+                            ? remote.lane !== null && typeof remote.lane === "object" && !Array.isArray(remote.lane)
+                            : action === "reparent"
+                                ? remote.lane !== null && typeof remote.lane === "object" &&
+                                    Array.isArray(remote.changed_descendant_ids)
+                                : (((remote.delivery_status === "worker_spawned" ||
+                                    remote.delivery_status === "queued_on_target_account") &&
+                                    remote.lane !== undefined) ||
+                                    (remote.delivery_status === "queued_on_admission" &&
+                                        remote.lane !== null &&
+                                        typeof remote.lane === "object" &&
+                                        !Array.isArray(remote.lane) &&
+                                        remote.lane.state === "queued") ||
+                                    (remote.delivery_status === "queued_for_reconcile" &&
+                                        remote.lane !== null &&
+                                        typeof remote.lane === "object" &&
+                                        !Array.isArray(remote.lane) &&
+                                        remote.lane.state === "queued" &&
+                                        remote.lane.queued_reason !== "worker_profile_changed")));
     if (!resultConfirmed) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without a confirmed ${action} result for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
@@ -5447,7 +5492,11 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
             printJson(response);
         return response;
     }
-    if (action === "approve" || action === "reparent" || action === "resume" || action === "repair-company") {
+    if (action === "approve" ||
+        action === "reparent" ||
+        action === "resume" ||
+        action === "repair-company" ||
+        action === "set") {
         const ownerLane = dispatchedOwnerLane(ctx, lane.lane_id, outpostId, remote.lane, behavior);
         const descendants = [];
         if (action === "reparent") {
@@ -5777,6 +5826,7 @@ async function runPickup(ctx, opts) {
         try {
             return spawnLaneWorker(hqRoot, current, {
                 env: ctx.env,
+                readClaudeCredential: ctx.readClaudeCredential,
                 modelDeps: {
                     readFileSync: ctx.readFileSync,
                     probe: ctx.probeProvider,
@@ -6173,6 +6223,7 @@ async function runCapacity(ctx) {
         config: loadLanesConfig(hqRoot),
         existsSync: ctx.existsSync,
         probe: ctx.probeProvider,
+        readClaudeCredential: ctx.readClaudeCredential,
         env: ctx.env,
         hostname: ctx.hostname(),
         now: ctx.now(),
@@ -6717,6 +6768,10 @@ async function printGrantResult(ctx, hqRoot, updated, hierarchy) {
  * resume. The running turn keeps its values. Both are stored as explicit
  * (`cli`) choices, so keep-alive and `hq lanes resume` keep them until the
  * next `set` or an explicit resume `--effort`/`--worker`.
+ *
+ * A lane whose state lives on another Outpost is resolved the same way
+ * `hq lanes grant` resolves it, and the change is forwarded to the owning
+ * Outpost after the caller is checked against the owner's senior.
  */
 async function runSet(ctx, laneId, opts) {
     if (opts.company !== undefined) {
@@ -6726,6 +6781,60 @@ async function runSet(ctx, laneId, opts) {
         await runRepairCompany(ctx, laneId, { company: opts.company });
         return;
     }
+    const request = parseLaneSetRequest(laneId, opts);
+    const target = await resolveCommandLaneTarget(ctx, laneId);
+    const lane = target.lane;
+    const callerLaneId = ctx.env.HQ_LANE_ID?.trim() || undefined;
+    const authorization = callerLaneId === lane.lane_id
+        ? { authorized: true }
+        : callerSeniorAuthorization(ctx, lane.senior);
+    if (!authorization.authorized) {
+        throw new LanesError("lane_set_unauthorized", appendCallerSeniorReason(`Only lane ${lane.lane_id} or its senior ${seniorKey(lane.senior)} may change its model or effort`, authorization), { lane_id: lane.lane_id, senior: lane.senior, reason: authorization.reason });
+    }
+    const actor = callerLaneId !== undefined
+        ? `lane:${callerLaneId}`
+        : `session:${sessionIdFromEnv(ctx.env) ?? "unknown"}`;
+    if (target.remoteOnly || (lane.host.kind === "outpost" && !laneRunsHereForOperatorMutation(ctx, lane))) {
+        assertLaneSetResumable(lane);
+        // Reject a bad effort here so the owner round trip is not spent on it.
+        parseCliEffort(lane.provider, request.effort);
+        await dispatchOutpostLaneCommand(ctx, lane, "set", {
+            model: request.model,
+            effort: request.effort,
+            reason: request.reason,
+            senior: seniorKey(lane.senior),
+            actor,
+        }, target.remoteOnly
+            ? { syncPrimary: false, expectedOwnerHost: target.ownerHost }
+            : {});
+        return;
+    }
+    const updated = applyLaneSettings(ctx, lane.lane_id, request, { actor });
+    printLaneSetResult(updated);
+}
+/**
+ * Owner side of a forwarded `hq lanes set`. The primary has already checked
+ * the caller against the lane's senior; this side accepts only an SSM Run
+ * Command dispatch for a lane hosted here whose senior is still the one the
+ * primary checked.
+ */
+async function runSetOwnerTarget(ctx, laneId, opts) {
+    if (!ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("lane_set_dispatch_unauthorized", "The Outpost set target is available only to an SSM Run Command dispatch", { lane_id: laneId });
+    }
+    const request = parseLaneSetRequest(laneId, opts);
+    if (opts.senior === undefined) {
+        throw new LanesError("lane_set_senior_required", "--senior is required", { lane_id: laneId });
+    }
+    const expectedSenior = parseSeniorRef(opts.senior);
+    const actor = opts.actor?.trim();
+    if (!actor || !/^(?:lane|session):\S+$/.test(actor)) {
+        throw new LanesError("lane_set_actor_invalid", "--actor must be lane:<id> or session:<id>", { lane_id: laneId });
+    }
+    const updated = applyLaneSettings(ctx, laneId, request, { actor, expectedSenior });
+    printLaneSetResult(updated);
+}
+function parseLaneSetRequest(laneId, opts) {
     if (opts.model === undefined && opts.effort === undefined) {
         throw new LanesError("lane_set_empty", "hq lanes set needs --company, --model, or --effort", { lane_id: laneId });
     }
@@ -6735,26 +6844,37 @@ async function runSet(ctx, laneId, opts) {
     }
     if (reason !== undefined)
         assertNoSecretText("set reason", reason);
+    const model = opts.model?.trim();
+    if (opts.model !== undefined && !model) {
+        throw new LanesError("empty_model", "--model is empty or whitespace-only", { value: opts.model });
+    }
+    return {
+        ...(model !== undefined ? { model } : {}),
+        ...(opts.effort !== undefined ? { effort: opts.effort } : {}),
+        ...(reason !== undefined ? { reason } : {}),
+    };
+}
+function assertLaneSetResumable(lane) {
+    if (lane.state === "killed" || lane.state === "cancelled") {
+        throw new LanesError("lane_not_resumable", `Lane ${lane.lane_id} is ${lane.state} and will not run again`, { lane_id: lane.lane_id, state: lane.state });
+    }
+}
+function assertLaneSetSenior(lane, expectedSenior) {
+    if (expectedSenior === undefined || seniorKey(lane.senior) === seniorKey(expectedSenior))
+        return;
+    throw new LanesError("lane_set_senior_changed", `Lane ${lane.lane_id}'s senior changed after the primary authorized its settings change`, { lane_id: lane.lane_id, expected_senior: expectedSenior, current_senior: lane.senior });
+}
+/** Apply a validated set request to a lane whose state lives on this host. */
+function applyLaneSettings(ctx, laneId, request, options) {
     const hqRoot = ctx.hqRoot();
     const lane = readLane(hqRoot, laneId);
-    const callerLaneId = ctx.env.HQ_LANE_ID?.trim() || undefined;
-    const authorization = callerLaneId === laneId
-        ? { authorized: true }
-        : callerSeniorAuthorization(ctx, lane.senior);
-    if (!authorization.authorized) {
-        throw new LanesError("lane_set_unauthorized", appendCallerSeniorReason(`Only lane ${laneId} or its senior ${seniorKey(lane.senior)} may change its model or effort`, authorization), { lane_id: laneId, senior: lane.senior, reason: authorization.reason });
-    }
     if (lane.host.kind === "outpost" && !laneRunsHereForOperatorMutation(ctx, lane)) {
         throw new LanesError("set_remote_unsupported", `Lane ${laneId} runs on Outpost ${lane.host.id}; run hq lanes set on that Outpost`, { lane_id: laneId, outpost_id: lane.host.id });
     }
     assertLaneRunsHereForOperatorMutation(ctx, lane, "set");
-    if (lane.state === "killed" || lane.state === "cancelled") {
-        throw new LanesError("lane_not_resumable", `Lane ${laneId} is ${lane.state} and will not run again`, { lane_id: laneId, state: lane.state });
-    }
-    const model = opts.model?.trim();
-    if (opts.model !== undefined && !model) {
-        throw new LanesError("empty_model", "--model is empty or whitespace-only", { value: opts.model });
-    }
+    assertLaneSetSenior(lane, options.expectedSenior);
+    assertLaneSetResumable(lane);
+    const { model, reason } = request;
     if (model !== undefined) {
         const config = loadLanesConfig(hqRoot);
         const account = lane.account === undefined
@@ -6769,16 +6889,13 @@ async function runSet(ctx, laneId, opts) {
             env: ctx.env,
         });
     }
-    const effort = parseCliEffort(lane.provider, opts.effort);
+    const effort = parseCliEffort(lane.provider, request.effort);
     const at = ctx.now().toISOString();
-    const actor = callerLaneId !== undefined
-        ? `lane:${callerLaneId}`
-        : `session:${sessionIdFromEnv(ctx.env) ?? "unknown"}`;
-    const updated = casUpdateLane(hqRoot, laneId, (current) => {
+    return casUpdateLane(hqRoot, laneId, (current) => {
         if (current.version !== lane.version) {
             throw new LanesError("lane_set_conflict", `Lane ${laneId} changed while the settings were checked; run hq lanes set again`, { lane_id: laneId, prepared_version: lane.version, version: current.version });
         }
-        const entry = { at, actor, ...(reason !== undefined ? { reason } : {}) };
+        const entry = { at, actor: options.actor, ...(reason !== undefined ? { reason } : {}) };
         const next = { ...current };
         const pending = { ...(current.pending_settings ?? {}) };
         // A running turn keeps the model and effort it launched with, because the
@@ -6810,9 +6927,12 @@ async function runSet(ctx, laneId, opts) {
         next.settings_history = appendCappedHistory(current.settings_history ?? [], entry);
         return next;
     });
+}
+function printLaneSetResult(updated) {
     printJson({
         ok: true,
         action: "set",
+        lane_id: updated.lane_id,
         lane: updated,
         model: updated.pending_settings?.model ?? updated.model ?? null,
         effort: updated.pending_settings?.effort ?? updated.effort ?? null,
@@ -7331,7 +7451,8 @@ function validateResumeProfileModel(ctx, lane, profile) {
         env: ctx.env,
     });
 }
-function applyResumeProfileAndEffort(current, next, input) {
+/** @internal Exported for regression tests of the profile-refresh company check. */
+export function applyResumeProfileAndEffort(hqRoot, current, next, input) {
     if (input.profile !== undefined) {
         const profile = input.profile.profile;
         next.worker = input.profile.id;
@@ -7387,6 +7508,12 @@ function applyResumeProfileAndEffort(current, next, input) {
             next.provider = targetProvider;
             next.provider_source = providerPinned ? current.provider_source : "profile";
             if (!accountPinned && profileMatchesProvider) {
+                if (profileAccount !== undefined && profileAccount !== current.account &&
+                    !accountMatchesCompany(loadLanesConfig(hqRoot).providers[targetProvider].accounts[profileAccount], resolveLaneCompany(hqRoot, current).company, loadLanesConfig(hqRoot).providers[targetProvider].accounts)) {
+                    throw new LanesError("account_company_mismatch", "Worker profile account does not belong to the lane company", {
+                        lane_id: current.lane_id, account: profileAccount,
+                    });
+                }
                 next.account = profileAccount;
                 next.account_source = profileAccount === undefined ? "balanced" : "profile";
                 next.account_selection = undefined;
@@ -7496,7 +7623,7 @@ function recordResumeSetup(ctx, lane, input) {
             next.keep_alive_blocked_reason = undefined;
         if (input.accountSource !== undefined)
             next.account_source = input.accountSource;
-        applyResumeProfileAndEffort(current, next, { ...input, at: ctx.now().toISOString() });
+        applyResumeProfileAndEffort(ctx.hqRoot(), current, next, { ...input, at: ctx.now().toISOString() });
         if (input.accountSource !== undefined)
             next.account_source = input.accountSource;
         if (input.clearWorkerProfileChangedQueue === true) {
@@ -7576,6 +7703,11 @@ async function prepareAccountMove(ctx, lane, input) {
     if (targetCfg === undefined) {
         throw new AccountResolutionError("unknown_account", `Unknown account ${JSON.stringify(target)} for ${lane.provider}. Configured: ${Object.keys(providerCfg.accounts).join(", ") || "(none)"}`, { provider: lane.provider, account: target, enabled: Object.keys(providerCfg.accounts).filter((id) => providerCfg.accounts[id]?.enabled) });
     }
+    if (!accountMatchesCompany(targetCfg, resolveLaneCompany(hqRoot, lane).company, providerCfg.accounts)) {
+        throw new LanesError("account_company_mismatch", "Lane moves require an account assigned to the lane's company", {
+            provider: lane.provider, account: target, company: lane.company,
+        });
+    }
     const targetHome = lane.remote_control === true
         ? remoteControlSessionHome(config, ctx.hostname())
         : effectiveAccountHome(targetCfg, ctx.hostname()).home;
@@ -7586,6 +7718,7 @@ async function prepareAccountMove(ctx, lane, input) {
         existsSync: ctx.existsSync,
         hostname: ctx.hostname(),
         probe: ctx.probeProvider,
+        readClaudeCredential: ctx.readClaudeCredential,
         env: ctx.env,
     }).logged_in !== true) {
         throw new LanesError("account_not_logged_in", `Account ${target} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: target, lane_id: laneId });
@@ -7705,7 +7838,7 @@ async function prepareAccountMove(ctx, lane, input) {
                         ...input.pending,
                     },
             };
-            applyResumeProfileAndEffort(current, next, {
+            applyResumeProfileAndEffort(ctx.hqRoot(), current, next, {
                 ...(input.workerProfile !== undefined ? { profile: input.workerProfile } : {}),
                 ...(input.profileRepin !== undefined ? { profileRepin: input.profileRepin } : {}),
                 ...(input.effort !== undefined ? { effort: input.effort } : {}),
@@ -7752,10 +7885,12 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
             existsSync: ctx.existsSync,
             hostname: ctx.hostname(),
             probe: ctx.probeProvider,
+            readClaudeCredential: ctx.readClaudeCredential,
             env: ctx.env,
         }).logged_in;
     const recordedAccountUnavailable = lane.account !== undefined &&
-        (currentConfig?.enabled !== true || currentLogin === false);
+        (currentConfig?.enabled !== true || currentLogin === false ||
+            !accountMayRetainLane(currentConfig, resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts));
     const profile = workerProfile?.profile ?? (lane.worker_profile !== undefined
         ? loadWorkerProfile(hqRoot, lane.worker_profile)
         : undefined);
@@ -7817,7 +7952,7 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
     const currentTargetAccount = lane.account === undefined
         ? undefined
         : targetHost?.capacity.providers.claude.accounts[lane.account];
-    if (!recordedAccountQuotaHeld &&
+    if (!accountNeedsRepair &&
         profilePin !== undefined &&
         lane.account !== undefined &&
         allowedAccounts?.includes(lane.account) &&
@@ -7826,6 +7961,8 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         currentTargetAccount.logged_in === true)
         return undefined;
     const selectionInput = {
+        company: resolveLaneCompany(hqRoot, lane).company,
+        retainedAccount: lane.account,
         hosts: balanceHosts.snapshots,
         targetHost: lane.host,
         actualTargetHost: lane.host,
@@ -7990,6 +8127,7 @@ function automaticBalanceMoveHistoryReason(ctx, lane) {
         existsSync: ctx.existsSync,
         hostname: ctx.hostname(),
         probe: ctx.probeProvider,
+        readClaudeCredential: ctx.readClaudeCredential,
         env: ctx.env,
     }).logged_in;
     if (login === false)
@@ -9693,6 +9831,7 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
         dryRun: Boolean(opts.dryRun),
         spawnLaneDeps: {
             env: ctx.env,
+            readClaudeCredential: ctx.readClaudeCredential,
             modelDeps: {
                 readFileSync: ctx.readFileSync,
                 probe: ctx.probeProvider,
@@ -10404,6 +10543,17 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (laneId, opts) => {
         await runGrantOwnerTarget(ctx, laneId, opts);
     }));
+    lanes
+        .command("set-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .option("--model <name>", "Model for the next resume")
+        .option("--effort <level>", "Effort for the next resume")
+        .option("--reason <text>", "Reason recorded in the lane's settings history")
+        .option("--senior <ref>", "Senior the primary authorized the change against")
+        .option("--actor <ref>", "lane:<id> or session:<id> that requested the change")
+        .action(wrap(async (laneId, opts) => {
+        await runSetOwnerTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("keep-alive")
         .description("Opt a lane into or out of automatic lead-lane resumes")

package/dist/commands/meetings.d.ts

@@ -3,10 +3,10 @@ import { type PricingPlan } from "../lib/billing/usage-only.js";
 /** Upper bound on list pages one short-id lookup reads (per cursor chain). */
 export declare const SHORT_ID_MAX_PAGES = 50;
 /**
- * The 402 copy for meeting bots. A usage-only company (US-012: the body or the
- * company's billing summary says `pricingPlan: "usage-only"`) has no Workforce
- * plan to buy, so it is told to add a card. Every other company keeps the
- * Workforce copy.
+ * The 402 copy for meeting bots. A usage pause (US-024) prints the server's
+ * message and Billing link. A usage-only company (US-012) is told to add a
+ * card. Every other company gets the server's sentence under a line that
+ * names no plan: the flat plans are closed.
  */
 export declare function meetingPaymentRequiredLines(body: Record<string, unknown>, resolvePlan?: () => Promise<PricingPlan | null>): Promise<string[]>;
 export declare function registerMeetingsCommand(program: Command): void;

package/dist/commands/meetings.js

@@ -4,7 +4,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid, resolveCallerPersonUid, } from "../utils/vault-api.js";
 import { isPlanGateError, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
 import { mapWithConcurrency } from "./sync-manifest.js";
-import { isUsageOnly, pricingPlanFromBody, resolveCompanyPricingPlan, usageOnlyCardRequiredLines, } from "../lib/billing/usage-only.js";
+import { isUsageOnly, pricingPlanFromBody, resolveCompanyPricingPlan, usageOnlyCardRequiredLines, usagePauseFromBody, } from "../lib/billing/usage-only.js";
 const LIVE_SNAPSHOT_STATUSES = new Set([
     "joining",
     "recording",
@@ -318,23 +318,32 @@ async function resolveShortId(token, prefix, query) {
     process.exit(1);
 }
 /**
- * The 402 copy for meeting bots. A usage-only company (US-012: the body or the
- * company's billing summary says `pricingPlan: "usage-only"`) has no Workforce
- * plan to buy, so it is told to add a card. Every other company keeps the
- * Workforce copy.
+ * The 402 copy for meeting bots. A usage pause (US-024) prints the server's
+ * message and Billing link. A usage-only company (US-012) is told to add a
+ * card. Every other company gets the server's sentence under a line that
+ * names no plan: the flat plans are closed.
  */
 export async function meetingPaymentRequiredLines(body, resolvePlan = () => resolveCompanyPricingPlan()) {
     const plan = pricingPlanFromBody(body) ?? (await resolvePlan().catch(() => null));
     if (isUsageOnly(plan)) {
         return usageOnlyCardRequiredLines("A meeting notetaker bot").map((line, i) => i === 0 ? chalk.red(line) : chalk.dim(line));
     }
+    // US-024: a usage pause is the server's own answer: its message and link.
+    const pause = usagePauseFromBody(body);
+    if (pause) {
+        return [
+            chalk.red(pause.message),
+            ...(pause.actionUrl ? [chalk.dim(`Billing: ${pause.actionUrl}`)] : []),
+        ];
+    }
+    // The server's sentence when it sent one; otherwise copy that names no plan.
     const detail = typeof body.message === "string"
         ? body.message
         : typeof body.error === "string"
             ? body.error
-            : "Upgrade your company to HQ Workforce to record meetings.";
+            : "Run `hq billing status` or open the company's Billing page to check it.";
     return [
-        chalk.red("Meeting notetaker bots require the $500/mo HQ Workforce plan."),
+        chalk.red("Meeting notetaker bots are not available on this company's current billing."),
         chalk.dim(detail),
     ];
 }
@@ -660,7 +669,7 @@ export function registerMeetingsCommand(program) {
             const companySlug = meetings.opts().company;
             // Always name a company. With no companyId the backend files the bot
             // under Personal, which can never record, so an entitled user would
-            // get the HQ Workforce upgrade prompt. Without --company this uses the
+            // get the payment-required refusal. Without --company this uses the
             // caller's only active company, or asks them to pick one.
             const query = {
                 companyId: await getCompanyUid(token, companySlug),