@indigoai-us/hq-cli 5.345.156 → 5.345.160

package/dist/lib/lanes/compaction.d.ts

@@ -79,6 +79,8 @@ export type RunCompactionFn = (input: {
 }) => CompactionCommandResult;
 /** Synchronous `/compact`. stdout is discarded; stderr goes to the run dir. */
 export declare const defaultRunCompaction: RunCompactionFn;
+/** Stderr line printed before a resume-time `/compact` starts. */
+export declare function compactionStartNotice(sessionId: string): string;
 export interface CompactLaneSessionInput {
     command: string;
     /** Full argv of `claude -p --resume <sid> "/compact" …`, built by buildProviderCommand. */

package/dist/lib/lanes/compaction.js

@@ -388,6 +388,12 @@ export const defaultRunCompaction = (input) => {
         fs.closeSync(errFd);
     }
 };
+/** Stderr line printed before a resume-time `/compact` starts. */
+export function compactionStartNotice(sessionId) {
+    const minutes = Math.round(COMPACTION_TIMEOUT_MS / 60_000);
+    return `hq lanes: compacting session ${sessionId} before resume; this can take up to ${minutes} minutes. ` +
+        `Re-run with --no-compact to skip it.\n`;
+}
 /**
  * Run `/compact` on the recorded session and report what happened. A failed
  * or ineffective compaction is recorded, not thrown: the resume that needed
@@ -398,6 +404,9 @@ export function compactLaneSession(input) {
     const locate = input.locateTranscript ?? findSessionTranscript;
     const started = input.now();
     const beforeProbe = probeCompactBoundaries(locate(input.accountHome, input.sessionId));
+    // `/compact` runs synchronously and can take minutes. Say so before it
+    // starts, so a resume that is waiting on it does not look hung.
+    process.stderr.write(compactionStartNotice(input.sessionId));
     const result = run({
         command: input.command,
         args: input.args,

package/dist/lib/lanes/config.js

@@ -186,6 +186,12 @@ function parseAccount(provider, id, raw, deps) {
         home: canonicalizeHome(raw.home, deps),
         enabled: raw.enabled,
     };
+    if (raw.company !== undefined) {
+        if (typeof raw.company !== "string" || raw.company.trim() === "" || raw.company.trim() !== raw.company) {
+            throw new LanesConfigError("invalid_config", `providers.${provider}.accounts.${id}.company must be a non-empty company slug or UID`, { provider, account: id });
+        }
+        account.company = raw.company;
+    }
     if (raw.hosts !== undefined) {
         const field = `providers.${provider}.accounts.${id}.hosts`;
         if (!isPlainObject(raw.hosts)) {

package/dist/lib/lanes/envelope-repair-dispatch.js

@@ -1,6 +1,7 @@
 import { spawnSync as nodeSpawnSync } from "node:child_process";
 import * as path from "node:path";
 import { LanesError } from "./errors.js";
+import { liveNodeBinary } from "./node-binary.js";
 const LANE_RUNNER_ENTRY_NAMES = new Set(["watcher-main", "worker-process", "remote-control-lane"]);
 /**
  * True for the detached lane runner scripts. They are not the hq CLI: running
@@ -42,7 +43,7 @@ export function spawnEnvelopeRepairViaCurrentCli(hqRoot, lane, input, deps = {})
         isLaneRunnerEntry(cliEntry)) {
         throw new LanesError("repair_cli_entry_invalid", "Lane watcher has no valid absolute hq CLI entrypoint for envelope repair", { lane_id: lane.lane_id });
     }
-    const result = run(process.execPath, [cliEntry, "lanes", "_spawn-envelope-repair"], {
+    const result = run(liveNodeBinary(), [cliEntry, "lanes", "_spawn-envelope-repair"], {
         encoding: "utf8",
         timeout: 120_000,
         input: JSON.stringify(request),

package/dist/lib/lanes/hooks-install.js

@@ -25,6 +25,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { parse as parseToml, TomlError } from "smol-toml";
 import { LanesError } from "./errors.js";
+import { liveNodeBinary } from "./node-binary.js";
 import { parseLaneProvider } from "./types.js";
 export const DRAIN_HOOK_BASENAME = "hq-lanes-drain";
 export const DRAIN_HOOK_TIMEOUT_SECONDS = 30;
@@ -49,7 +50,7 @@ export const PROVIDER_REGISTRATION_KIND = {
 };
 export function drainHookCommand(_shPath, provider) {
     const providerEnv = provider === "grok" ? "HQ_LANE_PROVIDER=grok " : "";
-    return `${providerEnv}${shellQuote(process.execPath)} ${shellQuote(drainHookEntryPath())}`;
+    return `${providerEnv}${shellQuote(liveNodeBinary())} ${shellQuote(drainHookEntryPath())}`;
 }
 function legacyDrainHookCommand(shPath) {
     return `bash ${shPath}`;

package/dist/lib/lanes/host-capacity.d.ts

@@ -1,4 +1,5 @@
 import { type AuthState } from "./accounts.js";
+import type { ClaudeCredentialReader } from "./claude-credential.js";
 import { type QuotaState } from "./quota.js";
 import type { LaneHost, LaneProvider, LaneRecord, LanesConfig } from "./types.js";
 export interface HostCapacityAccount {
@@ -63,6 +64,7 @@ export declare function buildHostCapacitySnapshot(input: {
     hostname?: string;
     now: Date;
     quotaState?: QuotaState;
+    readClaudeCredential?: ClaudeCredentialReader;
 }): HostCapacitySnapshot;
 /** Reject malformed remote snapshots before they can influence host selection. */
 export declare function parseHostCapacitySnapshot(raw: unknown): HostCapacitySnapshot;

package/dist/lib/lanes/host-capacity.js

@@ -31,6 +31,7 @@ export function buildHostCapacitySnapshot(input) {
                 ...(input.probe !== undefined ? { probe: input.probe } : {}),
                 ...(input.env !== undefined ? { env: input.env } : {}),
                 ...(input.hostname !== undefined ? { hostname: input.hostname } : {}),
+                ...(input.readClaudeCredential !== undefined ? { readClaudeCredential: input.readClaudeCredential } : {}),
             });
             const accountLanes = providerLanes.filter((lane) => lane.account === id);
             const liveLanes = accountLanes.filter((lane) => lane.state === "running" || lane.state === "queued" || lane.state === "awaiting_input");

package/dist/lib/lanes/keep-alive.d.ts

@@ -30,7 +30,7 @@ export declare function queueLaneTerminalResume(current: LaneRecord, at: string,
     trigger?: "resume" | "watcher";
 }): LaneTerminalResumeResult;
 /** Persist a manager status miss and queue its one bounded follow-up turn. */
-export declare function queueManagerStatusGateResume(hqRoot: string, laneId: string, entry: Omit<ManagerStatusGateHistoryEntry, "event" | "resume_queued" | "resume_skipped_reason">, resumeText: string): LaneRecord;
+export declare function queueManagerStatusGateResume(hqRoot: string, laneId: string, entry: Omit<ManagerStatusGateHistoryEntry, "event" | "resume_queued" | "resume_skipped_reason">, resumeText: string, skip?: (current: LaneRecord) => boolean): LaneRecord;
 export declare const LEAD_LANE_KEEP_ALIVE_RESUME_TEXT = "Automatic keep-alive resume: your last turn ended with decision done and story_complete false. Continue the open work from where you stopped. End with done only when story_complete is true; if you are waiting, use hq lanes ask or stay in the loop.";
 export declare const LEAD_LANE_KEEP_ALIVE_BLOCKED_RESUME_TEXT = "You ended blocked with no pending question. Record the event you wait on in waiting_on, re-check each blocker, and continue the next unblocked story.";
 export declare const LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT = "Automatic keep-alive resume: your previous turn was interrupted by a provider process exit. Check your last state before continuing. Continue the open work from where you stopped. End with done only when story_complete is true; if you are waiting, use hq lanes ask or stay in the loop.";

package/dist/lib/lanes/keep-alive.js

@@ -75,8 +75,10 @@ export function queueLaneTerminalResume(current, at, resumeText, options = {}) {
     };
 }
 /** Persist a manager status miss and queue its one bounded follow-up turn. */
-export function queueManagerStatusGateResume(hqRoot, laneId, entry, resumeText) {
+export function queueManagerStatusGateResume(hqRoot, laneId, entry, resumeText, skip = () => false) {
     return retryUpdateLane(hqRoot, laneId, "watcher", (current) => {
+        if (skip(current))
+            return current;
         const gate = current.status_gate;
         if (gate === undefined || gate.turn_id !== entry.turn_id)
             return current;

package/dist/lib/lanes/links.js

@@ -117,6 +117,9 @@ function resolvePointer(root, sid, role, options) {
     if (role === "child" && !safeId(child))
         throw new LaneLinkError("child_name_invalid", `Invalid child name: ${child ?? ""}`);
     const link = options.link ?? pointer.link;
+    if (role === "conductor" && link !== pointer.link) {
+        throw new LaneLinkError("link_role_invalid", "A conductor can only consume or wait on its own link");
+    }
     if (role === "child") {
         if (options.link !== undefined && !safeId(options.link))
             throw new LaneLinkError("link_invalid", "Invalid --link");
@@ -412,15 +415,18 @@ export async function runLaneLink(subcommand, options) {
     }
     if (subcommand === "inbox" || subcommand === "read") {
         const role = subcommand === "inbox" ? "child" : "conductor";
-        const resolved = role === "conductor" && options.link !== undefined
-            ? { link: options.link }
-            : resolvePointer(root, requireSid(), role, options);
+        // Preserve explicit-link validation errors before resolving ownership.
+        if (role === "conductor" && options.link !== undefined)
+            linkPath(root, options.link);
+        const resolved = resolvePointer(root, requireSid(), role, options);
         linkPath(root, resolved.link);
         const text = drainLinkQueue(queueDir(root, resolved.link, role === "child" ? resolved.child : undefined));
         return { output: { messages: text } };
     }
     if (subcommand === "wait") {
-        const resolved = options.link ? { link: options.link } : resolvePointer(root, requireSid(), "conductor", options);
+        if (options.link !== undefined)
+            linkPath(root, options.link);
+        const resolved = resolvePointer(root, requireSid(), "conductor", options);
         return await waitForReport(linkPath(root, resolved.link), options.timeout ?? 1800, options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))));
     }
     if (subcommand === "list") {

package/dist/lib/lanes/loop.js

@@ -1002,6 +1002,21 @@ function appendJournal(runDir, value) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.appendFileSync(file, `${JSON.stringify(value)}\n`, { mode: 0o600 });
 }
+/**
+ * Where a synthetic failed or blocked handoff goes. The phase worker may have
+ * written its own handoff to result_path already (for example one that failed
+ * validation). That file is the only copy of the worker's evidence, so it is
+ * never overwritten: the synthetic handoff is written beside it instead
+ * (`<name>.lane-failure.json`). With no worker file, result_path itself gets
+ * the synthetic handoff so the pipeline driver still sees the phase end.
+ */
+function syntheticHandoffPath(resultPath) {
+    if (!fs.existsSync(resultPath))
+        return resultPath;
+    const ext = path.extname(resultPath);
+    const base = ext ? resultPath.slice(0, -ext.length) : resultPath;
+    return `${base}.lane-failure${ext || ".json"}`;
+}
 function writeResultAt(runDir, activeFile, record, result, includeHandoffValidationError = true) {
     const localPath = path.join(resultsDir(runDir), resultName(record.envelope_id));
     atomicJson(localPath, result);
@@ -1025,7 +1040,7 @@ function writeResultAt(runDir, activeFile, record, result, includeHandoffValidat
                         back_pressure: { tests: "skip", lint: "skip", typecheck: "skip", build: "skip" },
                         context_for_next: [result.error ?? result.status, ...(result.question_id ? [`Decision question: ${result.question_id}`] : [])].join("\n"),
                     };
-                    atomicJson(path.resolve(externalPath), failure);
+                    atomicJson(syntheticHandoffPath(path.resolve(externalPath)), failure);
                 }
             }
             else

package/dist/lib/lanes/node-binary.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The Node binary to use for a child process started by a long-lived lane
+ * process (loop worker, watcher, drain hook registration).
+ *
+ * `process.execPath` is fixed when the process starts. A Node upgrade can
+ * remove that file while the process keeps running (Homebrew deletes the old
+ * Cellar directory), and every later child then fails to start. When the
+ * launch-time binary is gone:
+ *
+ * 1. For a Homebrew Cellar path (`<prefix>/Cellar/<formula>/<version>/bin/node`),
+ *    use the stable `<prefix>/bin/node` symlink when it exists. That points at
+ *    the upgraded install of the same prefix and does not depend on PATH or on
+ *    a version manager shim reading the child's cwd.
+ * 2. Otherwise fall back to `node` resolved through the child env PATH.
+ */
+export declare function liveNodeBinary(execPath?: string, exists?: (candidate: string) => boolean): string;
+//# sourceMappingURL=node-binary.d.ts.map

package/dist/lib/lanes/node-binary.js

@@ -0,0 +1,30 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+/**
+ * The Node binary to use for a child process started by a long-lived lane
+ * process (loop worker, watcher, drain hook registration).
+ *
+ * `process.execPath` is fixed when the process starts. A Node upgrade can
+ * remove that file while the process keeps running (Homebrew deletes the old
+ * Cellar directory), and every later child then fails to start. When the
+ * launch-time binary is gone:
+ *
+ * 1. For a Homebrew Cellar path (`<prefix>/Cellar/<formula>/<version>/bin/node`),
+ *    use the stable `<prefix>/bin/node` symlink when it exists. That points at
+ *    the upgraded install of the same prefix and does not depend on PATH or on
+ *    a version manager shim reading the child's cwd.
+ * 2. Otherwise fall back to `node` resolved through the child env PATH.
+ */
+export function liveNodeBinary(execPath = process.execPath, exists = fs.existsSync) {
+    if (exists(execPath))
+        return execPath;
+    const parts = execPath.split(path.sep);
+    const cellar = parts.lastIndexOf("Cellar");
+    if (cellar > 0) {
+        const prefixLink = path.join(parts.slice(0, cellar).join(path.sep) || path.sep, "bin", "node");
+        if (exists(prefixLink))
+            return prefixLink;
+    }
+    return "node";
+}
+//# sourceMappingURL=node-binary.js.map

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -27,7 +27,7 @@ export interface OutpostDispatchResult {
     stderr: string;
 }
 export interface OutpostLaneCommand {
-    action: "message" | "resume" | "stop" | "show" | "logs" | "grant" | "grant-target" | "reparent-target" | "approve-target" | "repair-company-target" | "blocked-escalation-target";
+    action: "message" | "resume" | "stop" | "show" | "logs" | "grant" | "grant-target" | "reparent-target" | "approve-target" | "repair-company-target" | "set-target" | "blocked-escalation-target";
     laneId: string;
     hqBinary?: string;
     text?: string;
@@ -46,6 +46,7 @@ export interface OutpostLaneCommand {
     profileRepinContext?: string;
     approvalContext?: string;
     senior?: string;
+    actor?: string;
     reason?: string;
     company?: string;
     compact?: boolean;

package/dist/lib/lanes/outpost-dispatch.js

@@ -225,6 +225,7 @@ export function buildOutpostLaneCommand(input) {
         ["--approval-context", input.approvalContext],
         ["--failed-resume-context", input.failedResumeContext],
         ["--senior", input.senior],
+        ["--actor", input.actor],
         ["--reason", input.reason],
         ["--company", input.company],
         ["--message-id", input.messageId],

package/dist/lib/lanes/reconcile.js

@@ -5,6 +5,7 @@
  * compare-and-set. The per-lane watcher owns progress/terminal/silence of a
  * live process — this pass owns the transitions no single lane can own.
  */
+import { accountMatchesCompany } from "./account-company.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parseUserYaml } from "../../utils/user-yaml-error.js";
@@ -724,6 +725,8 @@ function availableBalancedAccount(hqRoot, lane, occupying, config, host, profile
     for (const account of lane.admission_accounts) {
         if (account === lane.account)
             continue;
+        if (!accountMatchesCompany(config.providers[lane.provider].accounts[account], resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts))
+            continue;
         if (config.providers[lane.provider].accounts[account]?.enabled !== true)
             continue;
         const status = accountStatus(lane.provider, account, config, {
@@ -754,6 +757,7 @@ function availableBalancedAccount(hqRoot, lane, occupying, config, host, profile
 function writeAdmissionAccount(hqRoot, lane, account, dryRun) {
     return casLaneIf(hqRoot, lane.lane_id, (current) => current.state === "queued" &&
         current.account === lane.account &&
+        accountMatchesCompany(loadLanesConfig(hqRoot).providers[current.provider].accounts[account], resolveLaneCompany(hqRoot, current).company, loadLanesConfig(hqRoot).providers[current.provider].accounts) &&
         current.admission_accounts?.includes(account) === true, (current) => ({ ...current, account }), dryRun).record;
 }
 function casQuestionIf(hqRoot, questionId, shouldWrite, updater, dryRun) {

package/dist/lib/lanes/remote-control-lane.js

@@ -15,6 +15,7 @@ import { isOwnedPoolForwarder, poolHostsFile, readRemoteControlPoolsConfig } fro
 import { accountStatus, isDefaultProviderHome } from "./accounts.js";
 import { effectiveAccountHome } from "./account-home.js";
 import { LanesError } from "./errors.js";
+import { readLaneClaudeCredential } from "./claude-credential.js";
 import { defaultProbe } from "./models.js";
 import { encodeClaudeProjectDir } from "./move-account.js";
 /** Keep every credential and network route tied to the selected pool. */
@@ -117,6 +118,7 @@ export function prepareRemoteControlLane(input) {
     }
     const status = accountStatus("claude", "a", input.config, {
         hostname: input.hostname, existsSync: fs.existsSync, probe: defaultProbe, env: input.env,
+        readClaudeCredential: readLaneClaudeCredential,
     });
     if (!status.logged_in) {
         throw new LanesError("remote_control_login_missing", "Claude account a must be logged in for Remote Control", {});

package/dist/lib/lanes/spawn.d.ts

@@ -8,6 +8,7 @@
  * mutable fields are re-read from the lane record (spec §5.4).
  */
 import { PROVIDER_HOME_ENV } from "./accounts.js";
+import { type ClaudeCredentialReader } from "./claude-credential.js";
 import { type RunCompactionFn } from "./compaction.js";
 import { type ResolvedEffort } from "./effort.js";
 import { type KnownModelsDeps } from "./models.js";
@@ -66,6 +67,8 @@ export type ProveDetachedFn = (pid: number) => DetachProof;
 export type KillProcessFn = (pid: number, signal?: NodeJS.Signals) => void;
 export interface SpawnLaneDeps {
     env?: NodeJS.ProcessEnv;
+    /** Claude credential expiry check; see spawnCredentialReader for the default. */
+    readClaudeCredential?: ClaudeCredentialReader;
     /** Builds the lane's fingerprint from the worker env. Defaults to laneStartFingerprint. */
     buildFingerprint?: (hqRoot: string, workerEnv: NodeJS.ProcessEnv) => string | null;
     /** Test seam for the default-off quota account failover registry gate. */

package/dist/lib/lanes/spawn.js

@@ -7,19 +7,22 @@
  * probed for existence and never read. Identity in the child is `HQ_LANE_ID`;
  * mutable fields are re-read from the lane record (spec §5.4).
  */
+import { accountMatchesCompany, accountMayRetainLane, companyMismatchError } from "./account-company.js";
 import { spawn, spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { configureRemoteControlChildEnv, prepareRemoteControlLane, remoteControlSelectionConfig } from "./remote-control-lane.js";
-import { PROVIDER_HOME_ENV, accountStatus, isDefaultProviderHome, isLoggedOut, resolveAccount, selectBalancedAccount, } from "./accounts.js";
+import { PROVIDER_HOME_ENV, accountStatus, isDefaultProviderHome, isLoggedOut, isSignInExpired, resolveAccount, selectBalancedAccount, } from "./accounts.js";
+import { readLaneClaudeCredential } from "./claude-credential.js";
 import { effectiveAccountHome } from "./account-home.js";
 import { buildHostCapacitySnapshot } from "./host-capacity.js";
 import { selectClaudeAccount } from "./claude-balance.js";
 import { loadQuotaState } from "./quota.js";
 import { COMPACTION_PROMPT, compactionAfterUsage, compactionDue, compactLaneSession, } from "./compaction.js";
 import { installDrainHook } from "./hooks-install.js";
+import { liveNodeBinary } from "./node-binary.js";
 import { loadLanesConfig, providerAutoCompactTokens, providerCompactAfterMs, } from "./config.js";
 import { appendEffortFlag, resolveLaneEffort, } from "./effort.js";
 import { defaultProbe, validateLaneModel, validateProfileLaneModel, } from "./models.js";
@@ -252,9 +255,19 @@ function selectSpawnAccount(input) {
     };
     if (lane.account === undefined) {
         const modelSpecified = pinnedModel !== undefined || profileModel !== undefined;
-        const allowedAccounts = modelSpecified
-            ? Object.keys(config.providers[lane.provider].accounts).filter((id) => supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname))
-            : undefined;
+        const company = resolveLaneCompany(hqRoot, lane).company;
+        const allowedAccounts = Object.entries(config.providers[lane.provider].accounts)
+            .filter(([id, account]) => accountMatchesCompany(account, company, config.providers[lane.provider].accounts) &&
+            (!modelSpecified || supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname)))
+            .map(([id]) => id);
+        const mismatch = companyMismatchError({
+            provider: lane.provider,
+            providerAccounts: config.providers[lane.provider].accounts,
+            candidates: Object.keys(config.providers[lane.provider].accounts),
+            company,
+        });
+        if (mismatch !== undefined)
+            throw mismatch;
         return {
             account: selectBalancedAccount(lane.provider, config, {
                 ...context,
@@ -269,7 +282,13 @@ function selectSpawnAccount(input) {
     let refusal;
     const operatorMovePending = lane.pending_resume !== undefined &&
         lane.account_history?.at(-1)?.reason === "operator_move";
-    if (current === undefined || !current.enabled) {
+    if (current !== undefined && !accountMayRetainLane(current, resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts)) {
+        reason = "account_unavailable";
+        refusal = new LanesError("account_company_mismatch", `Account ${lane.account} belongs to another company`, {
+            provider: lane.provider, account: lane.account,
+        });
+    }
+    else if (current === undefined || !current.enabled) {
         reason = "account_unavailable";
         refusal = new AccountResolutionError(current === undefined ? "unknown_account" : "account_disabled", `Account ${JSON.stringify(lane.account)} is unavailable for ${lane.provider}`, { provider: lane.provider, account: lane.account });
     }
@@ -278,11 +297,18 @@ function selectSpawnAccount(input) {
             existsSync,
             hostname,
             ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
+            ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
             ...(accountDeps?.env ? { env: accountDeps.env } : {}),
         });
         if (isLoggedOut(status)) {
             reason = repairRecordedAccount ? "recorded_account_logged_out" : "account_unavailable";
-            refusal = new LanesError("account_not_logged_in", `Account ${lane.account} for ${lane.provider} is not logged in`, { provider: lane.provider, account: lane.account });
+            refusal = new LanesError("account_not_logged_in", isSignInExpired(status)
+                ? expiredSignInMessage(lane.provider, lane.account, status)
+                : `Account ${lane.account} for ${lane.provider} is not logged in`, {
+                provider: lane.provider,
+                account: lane.account,
+                ...(isSignInExpired(status) ? { sign_in_state: "expired", sign_in_expires_at: status.sign_in_expires_at ?? null } : {}),
+            });
         }
         else {
             try {
@@ -339,6 +365,7 @@ function selectSpawnAccount(input) {
             config,
             existsSync,
             probe: accountDeps?.probe,
+            readClaudeCredential: accountDeps?.readClaudeCredential,
             env: accountDeps?.env,
             hostname,
             now,
@@ -348,6 +375,7 @@ function selectSpawnAccount(input) {
             targetHost: lane.host,
             actualTargetHost: lane.host,
             requestedPlacement: null,
+            company: resolveLaneCompany(hqRoot, lane).company,
             config,
             quotaState: loadQuotaState(hqRoot),
             ...((recordedModel ?? pinnedModel ?? profileModel) !== undefined
@@ -366,11 +394,13 @@ function selectSpawnAccount(input) {
         };
     }
     const allowedAccounts = Object.entries(config.providers[lane.provider].accounts)
+        .filter(([, account]) => accountMatchesCompany(account, resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts))
         .filter(([id, account]) => id !== lane.account && account.enabled)
         .filter(([id]) => accountStatus(lane.provider, id, config, {
         existsSync,
         hostname,
         ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
+        ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
         ...(accountDeps?.env ? { env: accountDeps.env } : {}),
     }).logged_in === true)
         .filter(([id]) => supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname))
@@ -406,6 +436,11 @@ function selectSpawnAccount(input) {
                 account_reasons: accountReasons,
             });
         }
+        if (lane.company !== null && lane.state === "queued" && lane.pending_resume !== undefined && err instanceof AccountResolutionError) {
+            throw new LanesError("same_company_account_unavailable", "No eligible account assigned to the lane's company is available", {
+                provider: lane.provider, account: lane.account, company: lane.company,
+            });
+        }
         if (reason === "account_unavailable" || reason === "recorded_account_logged_out") {
             if (refusal instanceof Error)
                 throw refusal;
@@ -545,6 +580,7 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
     const accountDeps = {
         probe: modelDeps.probe ?? defaultProbe,
         env,
+        ...spawnCredentialReader(deps, modelDeps),
     };
     const profile = lane.worker_profile ? loadWorkerProfile(hqRoot, lane.worker_profile) : undefined;
     let quotaFailoverEnabled = false;
@@ -572,6 +608,9 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
         : undefined;
     const unavailableAccounts = previouslyUnavailableAccounts(lane);
     const allowedAccounts = Object.entries(config.providers[lane.provider].accounts)
+        .filter(([id, account]) => id === lane.account
+        ? accountMayRetainLane(account, resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts)
+        : accountMatchesCompany(account, resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts))
         .filter(([id, account]) => (id !== lane.account || (quotaFailoverEnabled && reason === "usage_limit" && retryingExpiredQuota)) &&
         !unavailableAccounts.has(id) && account.enabled)
         .filter(([id]) => !quotaFailoverEnabled ||
@@ -583,6 +622,7 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
         existsSync,
         hostname,
         ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
+        ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
         ...(accountDeps?.env ? { env: accountDeps.env } : {}),
     }).logged_in === true)
         .filter(([id]) => supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname))
@@ -635,6 +675,7 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
                         existsSync,
                         hostname,
                         ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
+                        ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
                         ...(accountDeps?.env ? { env: accountDeps.env } : {}),
                     }).logged_in !== true)
                         return { account: id, reason: "login_required" };
@@ -666,6 +707,22 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
                 return retryUpdateLane(hqRoot, lane.lane_id, writer, holdLane);
             }
         }
+        if (resolveLaneCompany(hqRoot, lane).company !== null && err instanceof AccountResolutionError) {
+            const waitForAccount = (current) => {
+                if (current.state !== retryFromState || current.account !== lane.account || current.provider_session_id !== lane.provider_session_id) {
+                    throw new LanesError("account_retry_conflict", "Lane changed while company account recovery was prepared", { lane_id: lane.lane_id });
+                }
+                return {
+                    ...current, state: "queued", queued_reason: "account_retry", queued_details: undefined,
+                    queued_at: at, admission_reserved_at: undefined, terminal_reason: undefined,
+                    terminal_details: undefined, interrupted_at: undefined,
+                    pending_resume: current.provider_session_id
+                        ? pendingResumeForRetry(hqRoot, current, current.provider_session_id, at)
+                        : undefined,
+                };
+            };
+            return deps.dryRun ? waitForAccount(lane) : retryUpdateLane(hqRoot, lane.lane_id, writer, waitForAccount);
+        }
         if (reason === "account_unavailable" || unavailableAccounts.size > 0) {
             throw new LanesError("account_not_logged_in", `Account ${lane.account ?? "(none)"} for ${lane.provider} is unavailable and no other logged-in account can serve this lane`, { provider: lane.provider, account: lane.account ?? null });
         }
@@ -845,6 +902,21 @@ function appendCodexWorkerPolicyDirFlag(provider, args, workerPolicyDir) {
         return [...args, "-c", setting];
     return [...args.slice(0, separator), "-c", setting, ...args.slice(separator)];
 }
+/**
+ * The Claude credential expiry check rides with the real provider probe: a
+ * caller on the production probe also gets the real Keychain/file read, and a
+ * test that injects a fake probe gets no credential read unless it passes one.
+ */
+function spawnCredentialReader(deps, modelDeps) {
+    if (deps.readClaudeCredential !== undefined)
+        return { readClaudeCredential: deps.readClaudeCredential };
+    return modelDeps.probe === defaultProbe ? { readClaudeCredential: readLaneClaudeCredential } : {};
+}
+function expiredSignInMessage(provider, account, status) {
+    const at = status.sign_in_expires_at ? ` at ${status.sign_in_expires_at}` : "";
+    return `Account ${account} for ${provider} has an expired Claude sign-in (access token expired${at}). ` +
+        `Open Claude Code on this account and run /login, then retry.`;
+}
 function accountHomeHostname(deps) {
     return (deps.hostname?.trim() ||
         deps.admissionHost?.hostname.trim() ||
@@ -1958,7 +2030,7 @@ function spawnTrackedWorker(spawnProcess, command, args, env, cwd, stdoutPath, s
             throw error;
     }
     const runnerPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../dist/lib/lanes/worker-process.js");
-    return spawnDetached(spawnProcess, process.execPath, [runnerPath, command, ...args], { ...env, [LANE_WORKER_EXIT_PATH_ENV]: exitPath }, cwd, stdoutPath, stderrPath);
+    return spawnDetached(spawnProcess, liveNodeBinary(), [runnerPath, command, ...args], { ...env, [LANE_WORKER_EXIT_PATH_ENV]: exitPath }, cwd, stdoutPath, stderrPath);
 }
 function requireDetached(proveDetached, pid, kind) {
     const proof = proveDetached(pid);
@@ -2093,7 +2165,7 @@ export function armLaneWatcher(hqRoot, laneId, deps = {}) {
     if (!cliEntry) {
         throw new LanesError("watcher_cli_entry_unavailable", "Cannot arm the lane watcher without the current hq CLI entrypoint", { lane_id: laneId });
     }
-    const watcherPid = spawnDetached(spawnProcess, process.execPath, [watcherMainPath(), laneId], {
+    const watcherPid = spawnDetached(spawnProcess, liveNodeBinary(), [watcherMainPath(), laneId], {
         ...env,
         HQ_ROOT: hqRoot,
         HQ_LANE_ID: laneId,
@@ -2332,6 +2404,7 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
     const accountDeps = {
         probe: modelDeps.probe ?? defaultProbe,
         env,
+        ...spawnCredentialReader(deps, modelDeps),
     };
     const diskAccount = laneDiskAccount(config, existing.provider, existing.account);
     if (diskAccount !== undefined) {
@@ -2342,6 +2415,22 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
                 ...current,
                 state: "queued",
                 queued_reason: "low_disk",
+                // Commit an explicit resume's instruction together with the hold. A
+                // later admission must continue that turn, not start the old brief.
+                pending_resume: trigger.kind === "resume" ? {
+                    ...(existing.provider_session_id !== undefined ? { session_id: existing.provider_session_id } : {}),
+                    trigger: "resume",
+                    caller: typeof env.HQ_LANE_ID === "string" ? env.HQ_LANE_ID.trim() || "user" : "user",
+                    resumed_from: trigger.from,
+                    ...(trigger.fromFailed === true ? { from_failed: true } : {}),
+                    ...(trigger.expectedSenior !== undefined ? { expected_senior: trigger.expectedSenior } : {}),
+                    ...(trigger.text !== undefined ? { text: trigger.text } : {}),
+                    ...(trigger.message_id !== undefined ? { message_id: trigger.message_id } : {}),
+                    ...(trigger.fresh === true ? { fresh_thread: true } : {}),
+                    ...(deps.workingDirectory !== undefined ? { working_directory: deps.workingDirectory } : {}),
+                    compact: launch.compact !== false,
+                    at: measuredAt,
+                } : current.pending_resume,
                 queued_details: {
                     reason: "low_disk",
                     hq_free_bytes: free.hq.free_bytes,
@@ -2422,7 +2511,28 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
     if (preservedAccountModel !== undefined)
         pinnedModel = preservedAccountModel;
     const resolved = selection.account;
-    const status = accountStatus(lane.provider, resolved.id, config, { existsSync, hostname });
+    const status = accountStatus(lane.provider, resolved.id, config, {
+        existsSync,
+        hostname,
+        ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
+    });
+    if (isSignInExpired(status)) {
+        const failed = markPreSpawnFailure
+            ? markSpawnFailure(hqRoot, lane.lane_id, "account_not_logged_in", {
+                provider: lane.provider,
+                account: resolved.id,
+                sign_in_state: "expired",
+            })
+            : existing;
+        throw new LanesError("account_not_logged_in", expiredSignInMessage(lane.provider, resolved.id, status), {
+            provider: lane.provider,
+            account: resolved.id,
+            lane_id: lane.lane_id,
+            sign_in_state: "expired",
+            sign_in_expires_at: status.sign_in_expires_at ?? null,
+            lane: failed,
+        });
+    }
     if (isLoggedOut(status)) {
         const failed = markPreSpawnFailure
             ? markSpawnFailure(hqRoot, lane.lane_id, "account_not_logged_in", {

package/dist/lib/lanes/store.d.ts

@@ -24,6 +24,10 @@ export interface StoreDeps {
     closeSync: typeof fs.closeSync;
     fsyncSync: typeof fs.fsyncSync;
     chmodSync: typeof fs.chmodSync;
+    /** Optional so existing fakes keep working; defaults to node:fs. */
+    statSync?: (p: string) => fs.Stats;
+    fstatSync?: (fd: number) => fs.Stats;
+    linkSync?: typeof fs.linkSync;
 }
 export declare function resolveStoreHqRoot(hqRoot?: string, env?: NodeJS.ProcessEnv, cwd?: string): string;
 export declare function lanesStoreRoot(hqRoot?: string): string;
@@ -35,6 +39,8 @@ export declare function sanitizeHostComponent(hostname: string): string;
 export declare function mintLaneId(deps?: Pick<StoreDeps, "now" | "hostname"> & Partial<Pick<StoreDeps, "generateLaneUlid">>): string;
 export declare function mintQuestionId(deps?: Pick<StoreDeps, "now" | "hostname">): string;
 export declare function appendCappedHistory<T>(history: readonly T[], entry: T, cap?: number): T[];
+/** Test seam: run withRecordLock with overridden deps and a shorter timeout. */
+export declare function withRecordLockForTests<T>(recordPath: string, overrides: Partial<StoreDeps>, fn: () => T, timeoutMs?: number): T;
 /** Run a lane-owned file read/modify/write transaction under its sidecar lock. */
 export declare function withLaneRecordFileLock<T>(recordPath: string, fn: () => T): T;
 export declare function parseLaneRecord(raw: unknown, filePath?: string): LaneRecord;