@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/lib/doctor/fix/apply.js

@@ -8,11 +8,13 @@
  *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses and exits non-zero
  *      unless `--force`, so a repair can never be tangled up with unrelated
  *      in-flight edits to the security layer.
- *   2. Allowlist only. It repairs exactly three classes — restore an execute
- *      bit, add a hook id to the gate profiles it is missing from, re-register a
- *      script present on disk — and NEVER rewrites a hook body or deletes a file.
- *      Classification is owned by {@link deriveRemediation}; a content-drift
- *      finding is manual-only and simply never appears in the fixable set.
+ *   2. Allowlist only. It repairs the classified safe classes — restore an
+ *      execute bit, add a hook id to the gate profiles it is missing from,
+ *      re-register a script present on disk, or pull a company whose local
+ *      tree exists but whose journal is stale — and NEVER rewrites a hook body
+ *      or deletes a file. Classification is owned by {@link deriveRemediation};
+ *      a content-drift finding is manual-only and simply never appears in the
+ *      fixable set.
  *   3. Preview + confirmation. Every change is shown diff-style and requires
  *      confirmation, with `--yes` for non-interactive use.
  *   4. Backup first. Before any write, the affected files are copied under
@@ -33,9 +35,18 @@ import { createDefaultRegistry } from "../registry.js";
 import { flattenFamilies } from "../report.js";
 import { gateMembership, parseHookGateProfiles, } from "../hook-gate-profiles.js";
 import { createBackup } from "./backup.js";
+import { removeStrayGateEntries } from "../stray-gate-entries.js";
 import { deriveRemediation } from "./remediation.js";
+import { botDir } from "../../bot/paths.js";
+import { readBotConfig } from "../../bot/config.js";
+import { buildBotDaemonPaths, rewriteBotDaemonNodePath } from "../../bot/daemon.js";
+import { classifyRefreshSyncOutcome, } from "./refresh-sync-outcome.js";
 /** The tree subtrees whose uncommitted changes block a `--fix` run. */
 export const HOOK_CONFIG_DIRS = [".claude", ".codex", ".grok"];
+/** Per-company bound for the default `hq sync pull` repair. */
+export const REFRESH_SYNC_TIMEOUT_MS = 90_000;
+/** A newly unlocked safe repair can be picked up for at most this many passes. */
+export const MAX_FIX_PASSES = 3;
 /**
  * Apply every auto-fixable finding, honouring the dirty-tree refusal, the
  * preview/confirmation gate, the pre-write backup, and the post-fix re-check.
@@ -53,6 +64,7 @@ export async function applyFixes(options) {
         fixableCount: 0,
         backupDir: null,
         restoreCommand: null,
+        backups: [],
         applied: [],
         ...over,
     });
@@ -68,74 +80,219 @@ export async function applyFixes(options) {
             return empty({ exitCode: 1, refused: "dirty-tree" });
         }
     }
-    // 2. Collect findings and keep only the allowlisted auto-fixable ones.
-    const findings = await runChecks(hqRoot);
-    const fixable = [];
-    for (const result of findings) {
-        const rem = deriveRemediation(result);
-        if (rem && rem.autoFixable)
-            fixable.push({ result, rem });
-    }
-    if (fixable.length === 0) {
-        write("hq doctor --fix: nothing to repair — no auto-fixable findings.\n");
-        return empty();
+    const collect = options.runChecks ?? defaultRunChecks;
+    const refreshSync = options.refreshSync ?? defaultRefreshSync;
+    const rewriteBotNodePath = options.rewriteBotNodePath ?? defaultRewriteBotNodePath;
+    // 2. Collect findings, then plan each newly unlocked allowlisted repair.
+    //    Identity is deliberately the check id + target pair: an unsuccessful
+    //    repair must not be applied repeatedly in one invocation.
+    let findings = await collect(hqRoot);
+    const appliedKeys = new Set();
+    const planned = [];
+    const backups = [];
+    let fixableCount = 0;
+    let refused = null;
+    let lastBackupMs = Number.NEGATIVE_INFINITY;
+    const backupClock = () => {
+        const suppliedMs = (options.now ?? (() => new Date()))().getTime();
+        lastBackupMs = Math.max(suppliedMs, lastBackupMs + 1);
+        return new Date(lastBackupMs);
+    };
+    const buildPlans = (results) => {
+        const keysThisPass = new Set();
+        const plans = [];
+        for (const result of results) {
+            const rem = deriveRemediation(result);
+            if (!rem?.autoFixable)
+                continue;
+            const plan = planFix(hqRoot, result, rem, refreshSync, rewriteBotNodePath);
+            if (!plan)
+                continue;
+            const key = JSON.stringify([plan.checkId, plan.target]);
+            if (appliedKeys.has(key) || keysThisPass.has(key))
+                continue;
+            keysThisPass.add(key);
+            plans.push(plan);
+        }
+        return plans;
+    };
+    for (let pass = 1; pass <= MAX_FIX_PASSES; pass += 1) {
+        const plans = buildPlans(findings);
+        if (plans.length === 0)
+            break;
+        fixableCount += plans.length;
+        // 3. Preview and require confirmation for every pass unless --yes is set.
+        write(`Pass ${pass}/${MAX_FIX_PASSES}: hq doctor --fix will apply ${plans.length} repair${plans.length === 1 ? "" : "s"}:\n\n`);
+        for (const plan of plans)
+            write(plan.preview + "\n");
+        if (!options.yes) {
+            const confirmed = await Promise.resolve((options.confirm ?? declineByDefault)());
+            if (!confirmed) {
+                refused = "declined";
+                if (planned.length === 0) {
+                    write("Aborted — no changes written.\n");
+                    return empty({ refused, fixableCount });
+                }
+                write(`Pass ${pass} declined — no further changes written.\n`);
+                break;
+            }
+        }
+        // 4. Back up this pass's files before its first write. The clock advances
+        //    at least one millisecond per backup so fast consecutive passes cannot
+        //    overwrite an earlier pass's restore point.
+        const affected = unique(plans.map((plan) => plan.relpath).filter((rel) => rel.length > 0));
+        const backup = affected.length > 0 ? createBackup(hqRoot, affected, backupClock) : null;
+        if (backup) {
+            backups.push({
+                pass,
+                backupDir: backup.dir,
+                restoreCommand: backup.restoreCommand,
+            });
+            write(`\nBacked up ${backup.files.length} file${backup.files.length === 1 ? "" : "s"} for pass ${pass} to ${backup.dir}\n`);
+            write(`To restore: ${backup.restoreCommand}\n`);
+        }
+        // 5. Apply each plan once. Later findings with this check id + target are
+        //    excluded even if this repair did not make its check pass.
+        for (const plan of plans) {
+            appliedKeys.add(JSON.stringify([plan.checkId, plan.target]));
+            planned.push({ plan, pass });
+            await plan.apply();
+        }
+        // 6. Re-run checks. Newly surfaced repairs are considered by the next loop.
+        findings = await collect(hqRoot);
     }
-    const plans = fixable
-        .map(({ result, rem }) => planFix(hqRoot, result, rem))
-        .filter((plan) => plan !== null);
-    if (plans.length === 0) {
+    if (planned.length === 0) {
         write("hq doctor --fix: nothing to repair — no auto-fixable findings.\n");
-        return empty();
-    }
-    // 3. Diff-style preview + confirmation (AC5).
-    write(`hq doctor --fix will apply ${plans.length} repair${plans.length === 1 ? "" : "s"}:\n\n`);
-    for (const plan of plans)
-        write(plan.preview + "\n");
-    if (!options.yes) {
-        const confirmed = await Promise.resolve((options.confirm ?? declineByDefault)());
-        if (!confirmed) {
-            write("Aborted — no changes written.\n");
-            return empty({ refused: "declined" });
-        }
+        return empty({ refused, fixableCount });
     }
-    // 4. Back up every file about to change BEFORE the first write (AC6).
-    const affected = unique(plans.map((plan) => plan.relpath));
-    const backup = createBackup(hqRoot, affected, options.now);
-    // 5. Apply. Each plan reads the current on-disk state, so multiple plans that
-    //    touch the same file (two gate ids) compose correctly.
-    for (const plan of plans)
-        plan.apply();
-    write(`\nBacked up ${backup.files.length} file${backup.files.length === 1 ? "" : "s"} to ${backup.dir}\n`);
-    write(`To restore: ${backup.restoreCommand}\n`);
-    // 6. Re-run the checks and report the post-fix status of each repair (AC7).
-    const after = await runChecks(hqRoot);
-    const applied = plans.map((plan) => ({
-        checkId: plan.checkId,
-        fixClass: plan.fixClass,
-        target: plan.target,
-        summary: plan.summary,
-        postStatus: plan.postStatus(after),
-    }));
+    // Show each repair's final post-fix status, including work from earlier passes.
+    const applied = planned.map(({ plan, pass }) => {
+        const refreshSyncOutcome = plan.refreshSyncOutcome?.();
+        return {
+            pass,
+            checkId: plan.checkId,
+            fixClass: plan.fixClass,
+            target: plan.target,
+            summary: plan.summary,
+            postStatus: plan.postStatus(findings),
+            ...(refreshSyncOutcome ? { refreshSyncOutcome } : {}),
+        };
+    });
     write("\nPost-fix status:\n");
     for (const fix of applied) {
-        write(`  ${fix.postStatus ?? "UNKNOWN"}  ${fix.checkId} [${fix.target}]\n`);
+        write(`  ${fix.postStatus ?? "UNKNOWN"}  ${fix.checkId} [${fix.target}] (pass ${fix.pass})\n`);
+    }
+    // Restore later pass snapshots first. This also returns every file to its
+    // pre-run state when multiple passes touched the same path.
+    const restoreCommand = backups.length > 0
+        ? [...backups].reverse().map(({ restoreCommand: command }) => command).join(" && ")
+        : null;
+    if (restoreCommand)
+        write(`To restore all changes: ${restoreCommand}\n`);
+    if (planned.at(-1)?.pass === MAX_FIX_PASSES && buildPlans(findings).length > 0) {
+        write(`Stopped after ${MAX_FIX_PASSES} repair passes; new auto-fixable findings remain.\n`);
     }
     return {
         exitCode: 0,
         wrote: true,
-        refused: null,
-        fixableCount: fixable.length,
-        backupDir: backup.dir,
-        restoreCommand: backup.restoreCommand,
+        refused,
+        fixableCount,
+        backupDir: backups[0]?.backupDir ?? null,
+        restoreCommand,
+        backups,
         applied,
     };
 }
 /** Run the default (read-only) check registry and flatten to a result list. */
-async function runChecks(hqRoot) {
-    const context = { hqRoot, platform: { id: "unknown" } };
+async function defaultRunChecks(hqRoot) {
+    // `--fix` never repairs the integrations family (networked inventory), so
+    // skip it: a hung control-plane read must not stall the safe repair pass.
+    const context = {
+        hqRoot,
+        platform: { id: "unknown" },
+        integrations: false,
+    };
     const families = await createDefaultRegistry().run(context);
     return flattenFamilies(families);
 }
+/**
+ * Default `refresh-sync` repair: a bounded, pull-only, keep-conflicts
+ * `hq sync pull --company <slug>` against the tree `--fix` is repairing.
+ * Never a push, never interactive. A timeout or non-zero exit is reported
+ * rather than thrown so later plans still run.
+ */
+export function defaultRefreshSync(target) {
+    const hqBin = process.argv[1];
+    const args = hqBin
+        ? [
+            hqBin,
+            "sync",
+            "pull",
+            "--company",
+            target.slug,
+            "--hq-root",
+            target.hqRoot,
+            "--on-conflict",
+            "keep",
+            "--lock-timeout",
+            "30",
+        ]
+        : [
+            "sync",
+            "pull",
+            "--company",
+            target.slug,
+            "--hq-root",
+            target.hqRoot,
+            "--on-conflict",
+            "keep",
+            "--lock-timeout",
+            "30",
+        ];
+    const result = spawnSync(hqBin ? process.execPath : "hq", args, {
+        encoding: "utf8",
+        timeout: REFRESH_SYNC_TIMEOUT_MS,
+        cwd: target.hqRoot,
+    });
+    if (result.error) {
+        const spawnError = result.error;
+        const outcome = classifyRefreshSyncOutcome({
+            errorCode: spawnError.code,
+            ...(result.error.message.includes("ETIMEDOUT")
+                ? { errorCode: "ETIMEDOUT" }
+                : {}),
+            signal: result.signal,
+            status: result.status,
+            stdout: result.stdout,
+            stderr: result.stderr,
+        });
+        return Promise.resolve({
+            ok: false,
+            outcome,
+            message: outcome === "pull-timeout"
+                ? `timed out pulling '${target.slug}'`
+                : `could not start pull for '${target.slug}': ${result.error.message}`,
+        });
+    }
+    if (result.status !== 0) {
+        const outcome = classifyRefreshSyncOutcome({
+            status: result.status,
+            stdout: result.stdout,
+            stderr: result.stderr,
+        });
+        const detail = (result.stderr || result.stdout || "").trim().split("\n").at(-1) ?? "";
+        return Promise.resolve({
+            ok: false,
+            outcome,
+            message: `pull of '${target.slug}' exited ${result.status}${detail ? `: ${detail}` : ""}`,
+        });
+    }
+    return Promise.resolve({
+        ok: true,
+        outcome: "pull-succeeded",
+        message: `pulled '${target.slug}'`,
+    });
+}
 // --- Dirty-tree probe ----------------------------------------------------------
 /**
  * The uncommitted changes under {@link HOOK_CONFIG_DIRS}, one porcelain line
@@ -155,18 +312,75 @@ export function uncommittedHookConfigChanges(hqRoot) {
 }
 // --- Fix planning --------------------------------------------------------------
 /** Build the concrete plan for one auto-fixable finding, or null if unplannable. */
-function planFix(hqRoot, result, rem) {
+function planFix(hqRoot, result, rem, refreshSync, rewriteBotNodePath = defaultRewriteBotNodePath) {
     switch (rem.fixClass) {
+        case "bot-node-path":
+            return planBotNodePath(result, rem, rewriteBotNodePath);
         case "executable-bit":
             return planExecutableBit(hqRoot, result, rem);
         case "gate-profile":
             return planGateProfile(hqRoot, result, rem);
-        case "register-hook":
-            return planRegisterHook(hqRoot, result, rem);
+        case "remove-stray-gate-entries":
+            return planRemoveStrayGateEntries(hqRoot, result, rem);
+        case "refresh-sync":
+            return planRefreshSync(hqRoot, result, rem, refreshSync);
         default:
             return null;
     }
 }
+/** Rewrite one bot LaunchAgent's node path (file only; launchd untouched). */
+function planBotNodePath(result, rem, rewrite) {
+    const name = rem.fixTarget;
+    if (!name)
+        return null;
+    return {
+        checkId: result.checkId,
+        fixClass: "bot-node-path",
+        target: name,
+        relpath: "",
+        preview: `  ~/Library/LaunchAgents/ai.getindigo.hq-bot.${name}.plist\n` +
+            `    ~ node path -> upgrade-stable alias of the same node\n` +
+            `      file only: the bot is not stopped or started; the new path loads at its next start`,
+        summary: `rewrite ${name} startup agent node path`,
+        apply: () => {
+            rewrite(name);
+        },
+        postStatus: (results) => results.find((entry) => entry.checkId === result.checkId)?.status ?? null,
+    };
+}
+/** Default `bot-node-path` repair against the real bot state and LaunchAgents. */
+export function defaultRewriteBotNodePath(name) {
+    if (process.platform !== "darwin")
+        return null;
+    const dir = botDir(name);
+    const config = readBotConfig(dir);
+    if (!config)
+        return null;
+    return rewriteBotDaemonNodePath(buildBotDaemonPaths({ name, botDir: dir, hqRoot: config.hqRoot, hqBinary: "hq" }), { platform: "darwin" });
+}
+/** Pull one company to refresh a stale or never-synced journal. */
+function planRefreshSync(hqRoot, result, rem, refreshSync) {
+    const slug = rem.fixTarget;
+    if (!slug)
+        return null;
+    let outcome;
+    return {
+        checkId: result.checkId,
+        fixClass: "refresh-sync",
+        target: slug,
+        relpath: "",
+        preview: `  companies/${slug}\n` +
+            `    ~ hq sync pull --company ${slug} --on-conflict keep\n` +
+            `      refresh the stale sync journal (keeps local conflict copies)`,
+        summary: `pull ${slug} to refresh its sync journal`,
+        apply: async () => {
+            const result = await refreshSync({ slug, hqRoot });
+            outcome = result.outcome;
+        },
+        refreshSyncOutcome: () => outcome,
+        postStatus: (results) => results.find((entry) => entry.checkId === result.checkId)?.status ?? null,
+    };
+}
 /** Restore the execute bit on a hook script. */
 function planExecutableBit(hqRoot, result, rem) {
     const abs = rem.fixTarget;
@@ -230,34 +444,32 @@ function planGateProfile(hqRoot, result, rem) {
         postStatus: (results) => statusForTarget(results, ".gate-profiles", hookId),
     };
 }
-/** Re-register a script that is present on disk but wired in no settings file. */
-function planRegisterHook(hqRoot, result, rem) {
-    const scriptAbs = rem.fixTarget;
-    if (!scriptAbs)
+/** Remove matcher-less hook-gate.sh registrations an older doctor wrote. */
+function planRemoveStrayGateEntries(hqRoot, result, rem) {
+    const settingsPath = rem.fixTarget;
+    if (!settingsPath)
+        return null;
+    const current = readJson(settingsPath);
+    if (!current)
+        return null;
+    const { removed } = removeStrayGateEntries(current);
+    if (removed === 0)
         return null;
-    const settingsPath = path.join(hqRoot, ".claude", "settings.json");
-    const hookId = path.basename(scriptAbs).replace(/\.sh$/, "");
-    const event = "PreToolUse";
-    const command = `bash "$CLAUDE_PROJECT_DIR/.claude/hooks/hook-gate.sh" ${hookId} ` +
-        `"$CLAUDE_PROJECT_DIR/.claude/hooks/${hookId}.sh"`;
     const relpath = toRelpath(hqRoot, settingsPath);
     return {
         checkId: result.checkId,
-        fixClass: "register-hook",
-        target: scriptAbs,
+        fixClass: "remove-stray-gate-entries",
+        target: settingsPath,
         relpath,
         preview: `  ${relpath}\n` +
-            `    + hooks.${event}: register ${hookId} via hook-gate.sh\n` +
-            `      ${command}`,
-        summary: `register ${hookId} on ${event}`,
+            `    - ${removed} matcher-less hook-gate.sh registration${removed === 1 ? "" : "s"} (they fire on every tool call)`,
+        summary: `remove ${removed} stray hook registration${removed === 1 ? "" : "s"} from ${relpath}`,
         apply: () => {
-            const settings = readJson(settingsPath) ?? {};
-            const updated = registerHookInSettings(settings, event, command);
-            fs.writeFileSync(settingsPath, JSON.stringify(updated, null, 2) + "\n");
+            const latest = readJson(settingsPath) ?? {};
+            const cleaned = removeStrayGateEntries(latest).settings;
+            fs.writeFileSync(settingsPath, JSON.stringify(cleaned, null, 2) + "\n");
         },
-        // After registration the script becomes a wired, executable file, reported
-        // by the Claude wiring tier's `…script` PASS keyed on the same path.
-        postStatus: (results) => statusForPath(results, scriptAbs),
+        postStatus: (results) => statusForTarget(results, ".stray-gate-registration", settingsPath),
     };
 }
 // --- Shell / JSON edit primitives ---------------------------------------------

package/dist/lib/doctor/fix/json-output.d.ts

@@ -0,0 +1,28 @@
+import type { AppliedFix, AppliedFixBackup, ApplyFixesResult } from "./apply.js";
+export declare const DOCTOR_FIX_JSON_SCHEMA_VERSION = 1;
+export interface DoctorFixJsonResult {
+    schemaVersion: number;
+    exitCode: number;
+    refused: ApplyFixesResult["refused"] | "outside-hq-tree";
+    applied: {
+        checkId: string;
+        fixClass: AppliedFix["fixClass"];
+        pass: number;
+        postStatus: AppliedFix["postStatus"];
+    }[];
+    backups: Pick<AppliedFixBackup, "pass" | "backupDir" | "restoreCommand">[];
+    refreshSync: {
+        checkId: string;
+        outcome: NonNullable<AppliedFix["refreshSyncOutcome"]>;
+        postStatus: AppliedFix["postStatus"];
+    }[];
+}
+/** Build the intentionally narrow JSON surface for `hq doctor --fix --json`. */
+export declare function buildDoctorFixJson(input: {
+    exitCode: number;
+    refused: ApplyFixesResult["refused"] | "outside-hq-tree";
+    applied: readonly AppliedFix[];
+    backups?: readonly AppliedFixBackup[];
+}): DoctorFixJsonResult;
+export declare function renderDoctorFixJson(input: Parameters<typeof buildDoctorFixJson>[0]): string;
+//# sourceMappingURL=json-output.d.ts.map

package/dist/lib/doctor/fix/json-output.js

@@ -0,0 +1,33 @@
+export const DOCTOR_FIX_JSON_SCHEMA_VERSION = 1;
+/** Build the intentionally narrow JSON surface for `hq doctor --fix --json`. */
+export function buildDoctorFixJson(input) {
+    return {
+        schemaVersion: DOCTOR_FIX_JSON_SCHEMA_VERSION,
+        exitCode: input.exitCode,
+        refused: input.refused,
+        applied: input.applied.map(({ checkId, fixClass, pass, postStatus }) => ({
+            checkId,
+            fixClass,
+            pass,
+            postStatus,
+        })),
+        backups: (input.backups ?? []).map(({ pass, backupDir, restoreCommand }) => ({
+            pass,
+            backupDir,
+            restoreCommand,
+        })),
+        refreshSync: input.applied.flatMap((fix) => fix.fixClass === "refresh-sync" && fix.refreshSyncOutcome
+            ? [
+                {
+                    checkId: fix.checkId,
+                    outcome: fix.refreshSyncOutcome,
+                    postStatus: fix.postStatus,
+                },
+            ]
+            : []),
+    };
+}
+export function renderDoctorFixJson(input) {
+    return JSON.stringify(buildDoctorFixJson(input), null, 2) + "\n";
+}
+//# sourceMappingURL=json-output.js.map

package/dist/lib/doctor/fix/refresh-sync-outcome.d.ts

@@ -0,0 +1,12 @@
+/** Privacy-safe outcomes for a targeted refresh-sync attempt. */
+export type RefreshSyncOutcome = "pull-succeeded" | "pull-timeout" | "pull-failed:4xx" | "pull-failed:5xx" | "pull-failed:network" | "pull-failed:other";
+export interface RefreshSyncObservation {
+    errorCode?: string;
+    signal?: string | null;
+    status?: number | null;
+    stdout?: string;
+    stderr?: string;
+}
+/** Classify process/HTTP results without retaining their free-text details. */
+export declare function classifyRefreshSyncOutcome(observation: RefreshSyncObservation): RefreshSyncOutcome;
+//# sourceMappingURL=refresh-sync-outcome.d.ts.map

package/dist/lib/doctor/fix/refresh-sync-outcome.js

@@ -0,0 +1,25 @@
+/** Classify process/HTTP results without retaining their free-text details. */
+export function classifyRefreshSyncOutcome(observation) {
+    const details = String(observation.stdout ?? "") + "\n" + String(observation.stderr ?? "");
+    const errorCode = observation.errorCode ??
+        /\b(ETIMEDOUT|ETIME|EAI_AGAIN|ENOTFOUND|ECONNRESET|ECONNREFUSED|EHOSTUNREACH|ENETUNREACH|EPIPE|ECONNABORTED)\b/.exec(details)?.[1];
+    if (errorCode === "ETIMEDOUT" ||
+        errorCode === "ETIME" ||
+        observation.signal === "SIGTERM") {
+        return "pull-timeout";
+    }
+    if (!errorCode && observation.status === 0) {
+        return "pull-succeeded";
+    }
+    const httpStatus = /(?:HTTP(?:\/\d(?:\.\d)?)?\s+|status(?:\s+code)?\s*[=: ]\s*)([45]\d\d)\b/i.exec(details)?.[1] ?? "";
+    if (httpStatus.startsWith("4"))
+        return "pull-failed:4xx";
+    if (httpStatus.startsWith("5"))
+        return "pull-failed:5xx";
+    if (errorCode &&
+        /^(?:EAI_AGAIN|ENOTFOUND|ECONNRESET|ECONNREFUSED|EHOSTUNREACH|ENETUNREACH|EPIPE|ECONNABORTED)$/.test(errorCode)) {
+        return "pull-failed:network";
+    }
+    return "pull-failed:other";
+}
+//# sourceMappingURL=refresh-sync-outcome.js.map

package/dist/lib/doctor/fix/remediation.d.ts

@@ -7,8 +7,8 @@
  * classes, and if so exactly which file or hook id to act on. This module is the
  * single classifier that turns a {@link CheckResult} into that structured shape.
  *
- * The three — and only three — auto-fixable classes are a deliberate, security
- * -reviewed allowlist (see the PRD decision record):
+ * The auto-fixable classes are a deliberate, security-reviewed allowlist
+ * (see the PRD decision record):
  *
  *   - `executable-bit`  — restore the execute bit on a hook script that exists
  *                         but lost `+x`. Detected by the shared `chmod +x …`
@@ -17,8 +17,16 @@
  *   - `gate-profile`    — add a gated hook id to the `hook-gate.sh` profile
  *                         allowlists it is missing from. Detected by the
  *                         `…gate-profiles` FAIL from the Claude wiring tier.
- *   - `register-hook`   — re-register a script that is present on disk but wired
- *                         nowhere. Detected by the `…orphan` WARN.
+ *   - `remove-stray-gate-entries` — delete matcher-less hook-gate.sh
+ *                         registrations an older `--fix` wrote into
+ *                         settings.json / settings.local.json. Detected by the
+ *                         `…stray-gate-registration` FAIL. (An orphan script is
+ *                         never auto-registered: that is what created them.)
+ *   - `refresh-sync`    — run a targeted pull for a company journal that is
+ *                         stale or never-synced AND has a local
+ *                         `companies/<slug>` tree. Pull-only, `--on-conflict
+ *                         keep`, no hook-file rewrite. Personal journals and
+ *                         leftover shards without a local tree stay manual.
  *
  * EVERYTHING else — content drift between platform copies, a missing script, a
  * missing Codex counterpart, an unquoted `$CLAUDE_PROJECT_DIR`, a stale
@@ -30,7 +38,7 @@
  */
 import type { CheckResult } from "../types.js";
 /** The allowlisted safe repair classes `--fix` is permitted to apply. */
-export type FixClass = "executable-bit" | "gate-profile" | "register-hook";
+export type FixClass = "executable-bit" | "gate-profile" | "remove-stray-gate-entries" | "refresh-sync" | "bot-node-path";
 /**
  * A finding's structured remediation. `autoFixable`, `action`, and `command`
  * are the `--json` surface (AC1); `fixTarget`/`fixClass` are the internal handle
@@ -46,7 +54,7 @@ export interface Remediation {
     /** The safe class when {@link autoFixable}, else null (manual-only). */
     fixClass: FixClass | null;
     /**
-     * The concrete file path (exec-bit, register-hook) or hook id (gate-profile)
+     * The concrete file path (exec-bit, remove-stray-gate-entries) or hook id (gate-profile)
      * the auto-fix operates on. Present only when {@link autoFixable}. Internal —
      * deliberately omitted from the `--json` document.
      */