@indigoai-us/hq-cli 5.337.0 → 5.338.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.338.0] — 2026-10-03
+- Preserve policy-trigger mutual exclusion without `flock` and honor configured stale-run thresholds without `yq`.
+- Add a manual macOS VM parity workflow for checking HQ CLI behavior in Tart.
+
 ## [5.337.0] — 2026-10-03
 - QMD index updates now share the cross-process writer lock and skip bounded SQLite contention so a later sync can catch up.
 - Self-update now checks the Windows npm prefix that stores command shims, so an unwritable prefix is detected before npm runs.

package/assets/scaffold/core/scripts/migrate-policy-triggers.sh

@@ -124,8 +124,61 @@ fi
 COOLDOWN_SECONDS="${HQ_MIGRATE_POLICY_TRIGGERS_COOLDOWN_SECONDS:-3600}"
 STAMP=""
 LOCK=""
+LOCK_FALLBACK_DIR=""
+LOCK_FALLBACK_HELD=0
+LOCK_FALLBACK_OWNER=""
+LOCK_FALLBACK_STALE_SECONDS=86400
 STATE_READY=0
 
+release_fallback_lock() {
+  [ "$LOCK_FALLBACK_HELD" = "1" ] || return 0
+  [ "$(cat "$LOCK_FALLBACK_DIR/owner" 2>/dev/null)" = "$LOCK_FALLBACK_OWNER" ] || return 0
+  rm -f "$LOCK_FALLBACK_DIR/owner" 2>/dev/null || return 0
+  rmdir "$LOCK_FALLBACK_DIR" 2>/dev/null || true
+}
+
+fallback_lock_is_stale() {
+  local lock_dir="$1" modified now age
+  modified="$(stat -c '%Y' "$lock_dir" 2>/dev/null || stat -f '%m' "$lock_dir" 2>/dev/null)"
+  case "$modified" in ''|*[!0-9]*) return 1 ;; esac
+  now="$(date -u '+%s')"
+  age=$((now - modified))
+  [ "$age" -ge "$LOCK_FALLBACK_STALE_SECONDS" ]
+}
+
+reclaim_stale_fallback_lock() {
+  local stale_dir="${LOCK_FALLBACK_DIR}.stale.$$.$RANDOM" owner_present=0 owner_value=""
+  restore_stale_dir() {
+    # Never let mv place the quarantined directory inside a replacement lock.
+    # A new holder may have created the path after our rename-aside.
+    if [ -e "$LOCK_FALLBACK_DIR" ] || [ -L "$LOCK_FALLBACK_DIR" ]; then return 1; fi
+    mv "$stale_dir" "$LOCK_FALLBACK_DIR" 2>/dev/null
+  }
+  [ -d "$LOCK_FALLBACK_DIR" ] || return 1
+  fallback_lock_is_stale "$LOCK_FALLBACK_DIR" || return 1
+  # Rename the observed lock aside atomically. Recheck the moved directory so
+  # a stale decision is never used to remove a replacement lock at the path.
+  mv "$LOCK_FALLBACK_DIR" "$stale_dir" 2>/dev/null || return 1
+  if fallback_lock_is_stale "$stale_dir"; then
+    if [ -e "$stale_dir/owner" ]; then
+      owner_present=1
+      owner_value="$(cat "$stale_dir/owner" 2>/dev/null)"
+      rm -f "$stale_dir/owner" 2>/dev/null || {
+        restore_stale_dir || true
+        return 1
+      }
+    fi
+    if rmdir "$stale_dir" 2>/dev/null; then
+      return 0
+    fi
+    if [ "$owner_present" = "1" ]; then
+      (set -o noclobber; printf '%s\n' "$owner_value" >"$stale_dir/owner") 2>/dev/null || true
+    fi
+  fi
+  restore_stale_dir || true
+  return 1
+}
+
 # Hash the resolved scope rather than using a shared per-root stamp: the
 # default scan deliberately includes tenant-specific directories.
 scope_key() {
@@ -192,12 +245,34 @@ fi
 # A scope-local advisory lock prevents concurrent SessionStart hooks from both
 # observing the same absent/stale stamp. Recheck after acquiring it because a
 # prior holder may have completed while this invocation waited to acquire it.
-if [ "$STATE_READY" = "1" ] && [ "$DRY" != "1" ] && command -v flock >/dev/null 2>&1; then
-  if ! exec 9>"$LOCK"; then
-    exit 0
-  fi
-  if ! flock -n 9; then # command -v flock checked above
-    exit 0
+if [ "$STATE_READY" = "1" ] && [ "$DRY" != "1" ]; then
+  if command -v flock >/dev/null 2>&1; then
+    if ! exec 9>"$LOCK"; then
+      exit 0
+    fi
+    if ! flock -n 9; then
+      exit 0
+    fi
+  else
+    # Atomic directory creation preserves mutual exclusion on stock macOS,
+    # which does not ship util-linux flock. An abandoned directory is only
+    # reclaimed after a 24-hour age threshold, well above this bounded scan.
+    LOCK_FALLBACK_DIR="${LOCK}.d"
+    if ! mkdir "$LOCK_FALLBACK_DIR" 2>/dev/null; then
+      if reclaim_stale_fallback_lock; then
+        mkdir "$LOCK_FALLBACK_DIR" 2>/dev/null || exit 0
+      else
+        exit 0
+      fi
+    fi
+    LOCK_FALLBACK_HELD=1
+    LOCK_FALLBACK_OWNER="$$:$RANDOM:$(date -u '+%s')"
+    if ! printf '%s\n' "$LOCK_FALLBACK_OWNER" >"$LOCK_FALLBACK_DIR/owner"; then
+      rmdir "$LOCK_FALLBACK_DIR" 2>/dev/null || true
+      LOCK_FALLBACK_HELD=0
+      exit 0
+    fi
+    trap release_fallback_lock EXIT
   fi
   if cooldown_blocks_run; then
     exit 0

package/assets/scaffold/core/scripts/repo-run-registry.sh

@@ -127,10 +127,32 @@ _is_pid_alive() {
 }
 
 _stale_minutes() {
-  if [[ -f "$ORCH_YAML" ]] && command -v yq >/dev/null 2>&1; then
-    local v
-    v=$(yq eval '.repo_coordination.stale_heartbeat_minutes // 15' "$ORCH_YAML" 2>/dev/null)
-    [[ -n "$v" && "$v" != "null" ]] && { echo "$v"; return; }
+  if [[ -f "$ORCH_YAML" ]]; then
+    if command -v yq >/dev/null 2>&1; then
+      local v
+      v=$(yq eval '.repo_coordination.stale_heartbeat_minutes // 15' "$ORCH_YAML" 2>/dev/null)
+      [[ -n "$v" && "$v" != "null" ]] && { echo "$v"; return; }
+    else
+      # Parse the one scalar this helper needs when yq is unavailable. Do not
+      # silently replace a configured timeout with the 15-minute default.
+      awk '
+        /^repo_coordination:[[:space:]]*(#.*)?$/ { in_repo=1; next }
+        in_repo && /^[^[:space:]#]/ { exit }
+        in_repo && /^[[:space:]]+stale_heartbeat_minutes:[[:space:]]*/ {
+          sub(/^[[:space:]]+stale_heartbeat_minutes:[[:space:]]*/, "")
+          sub(/[[:space:]]+#.*$/, "")
+          gsub(/^[[:space:]]+|[[:space:]]+$/, "")
+          gsub(/^["\047]|["\047]$/, "")
+          if ($0 == "" || $0 == "null" || $0 == "~") print 15
+          else if ($0 ~ /^[0-9]+$/) print $0
+          else print 15
+          found=1
+          exit
+        }
+        END { if (!found) print 15 }
+      ' "$ORCH_YAML"
+      return
+    fi
   fi
   echo 15
 }

package/dist/commands/core-migrate-policy-triggers-native.js

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import { evaluateTrigger } from "../utils/core-eval-trigger.js";
 import { awkCannotOpenFileDiagnostic } from "../lib/core-utils/awk-diagnostics.js";
 export const MIGRATE_POLICY_TRIGGERS_ASSET = "core/scripts/migrate-policy-triggers.sh";
+const FALLBACK_LOCK_STALE_SECONDS = 24 * 60 * 60;
 const ON_LIVE = "[PreToolUse, PostToolUse, UserPromptSubmit, AssistantIntent]";
 const ON_START = "[SessionStart]";
 const TAG_STOP = new Set(("infrastructure consolidated ux safety hq hq-core hq-cli hq-packages " +
@@ -173,7 +174,7 @@ function unreadablePolicyDiagnostic(filename, error, pathValue) {
     const message = code === "EACCES" || code === "EPERM" ? "Permission denied" : "No such file or directory";
     const script = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../assets/scaffold/core/scripts/migrate-policy-triggers.sh");
     const awk = awkCannotOpenFileDiagnostic(filename, message, 1, process.platform, pathValue);
-    return `${script}: line 314: ${filename}: ${message}\n${awk.repeat(3)}`;
+    return `${script}: line 389: ${filename}: ${message}\n${awk.repeat(3)}`;
 }
 function shellGlobMd(fileSystem, directory) {
     try {
@@ -255,20 +256,141 @@ export function runMigratePolicyTriggers(args, deps) {
     if (cooldownBlocks())
         return { code: 0, stdout, stderr };
     let lockFd;
-    if (stateReady && !dryRun && executableInPath("flock", deps.env, fileSystem)) {
+    let fallbackLockDir;
+    let fallbackLockOwner;
+    const releaseFallbackLock = () => {
+        if (!fallbackLockDir)
+            return;
         try {
-            lockFd = fileSystem.openSync(lock, "w");
+            if (fileSystem.readFileSync(path.join(fallbackLockDir, "owner"), "utf8").trim() === fallbackLockOwner) {
+                fileSystem.unlinkSync(path.join(fallbackLockDir, "owner"));
+                fileSystem.rmdirSync(fallbackLockDir);
+            }
+        }
+        catch { /* preserve the lock if ownership cannot be confirmed */ }
+        fallbackLockDir = undefined;
+    };
+    const reclaimStaleFallbackLock = (directory) => {
+        const restoreQuarantined = (staleDirectory) => {
+            try {
+                fileSystem.lstatSync(directory);
+                return;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    return;
+            }
+            try {
+                fileSystem.renameSync(staleDirectory, directory);
+            }
+            catch { /* preserve the quarantine if restoration fails */ }
+        };
+        const age = (candidate) => {
+            try {
+                return Math.floor(deps.now().getTime() / 1000) - Math.floor(fileSystem.statSync(candidate).mtimeMs / 1000);
+            }
+            catch {
+                return undefined;
+            }
+        };
+        if ((age(directory) ?? -1) < FALLBACK_LOCK_STALE_SECONDS)
+            return false;
+        const staleDirectory = `${directory}.stale.${process.pid}.${Math.random().toString(16).slice(2)}`;
+        try {
+            fileSystem.renameSync(directory, staleDirectory);
         }
         catch {
-            return { code: 0, stdout, stderr };
+            return false;
         }
-        const lockResult = (deps.runFlock ?? runNonblockingFlock)(lockFd, deps.cwd, deps.env.PATH ?? "");
-        if (lockResult.error || lockResult.status !== 0) {
-            fileSystem.closeSync(lockFd);
-            return { code: 0, stdout, stderr };
+        const staleAge = age(staleDirectory);
+        if (staleAge !== undefined && staleAge >= FALLBACK_LOCK_STALE_SECONDS) {
+            let ownerBytes;
+            try {
+                ownerBytes = fileSystem.readFileSync(path.join(staleDirectory, "owner"), "utf8");
+            }
+            catch (error) {
+                if (error.code !== "ENOENT") {
+                    restoreQuarantined(staleDirectory);
+                    return false;
+                }
+            }
+            if (ownerBytes !== undefined) {
+                try {
+                    fileSystem.unlinkSync(path.join(staleDirectory, "owner"));
+                }
+                catch {
+                    restoreQuarantined(staleDirectory);
+                    return false;
+                }
+            }
+            try {
+                fileSystem.rmdirSync(staleDirectory);
+                return true;
+            }
+            catch {
+                if (ownerBytes !== undefined) {
+                    try {
+                        fileSystem.writeFileSync(path.join(staleDirectory, "owner"), ownerBytes, { encoding: "utf8", mode: 0o600, flag: "wx" });
+                    }
+                    catch { /* keep the quarantined directory rather than overwrite a changed marker */ }
+                }
+                restoreQuarantined(staleDirectory);
+                return false;
+            }
+        }
+        restoreQuarantined(staleDirectory);
+        return false;
+    };
+    if (stateReady && !dryRun) {
+        if (executableInPath("flock", deps.env, fileSystem)) {
+            try {
+                lockFd = fileSystem.openSync(lock, "w");
+            }
+            catch {
+                return { code: 0, stdout, stderr };
+            }
+            const lockResult = (deps.runFlock ?? runNonblockingFlock)(lockFd, deps.cwd, deps.env.PATH ?? "");
+            if (lockResult.error || lockResult.status !== 0) {
+                fileSystem.closeSync(lockFd);
+                return { code: 0, stdout, stderr };
+            }
+        }
+        else {
+            fallbackLockDir = `${lock}.d`;
+            try {
+                fileSystem.mkdirSync(fallbackLockDir);
+            }
+            catch {
+                if (!reclaimStaleFallbackLock(fallbackLockDir)) {
+                    fallbackLockDir = undefined;
+                    return { code: 0, stdout, stderr };
+                }
+                try {
+                    fileSystem.mkdirSync(fallbackLockDir);
+                }
+                catch {
+                    fallbackLockDir = undefined;
+                    return { code: 0, stdout, stderr };
+                }
+            }
+            fallbackLockOwner = `${process.pid}:${Math.random().toString(36).slice(2)}:${nowSeconds()}`;
+            try {
+                fileSystem.writeFileSync(path.join(fallbackLockDir, "owner"), `${fallbackLockOwner}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            }
+            catch {
+                try {
+                    fileSystem.rmdirSync(fallbackLockDir);
+                }
+                catch { /* preserve a lock if cleanup is unsafe */ }
+                fallbackLockDir = undefined;
+                fallbackLockOwner = undefined;
+                return { code: 0, stdout, stderr };
+            }
         }
         if (cooldownBlocks()) {
-            fileSystem.closeSync(lockFd);
+            if (lockFd !== undefined)
+                fileSystem.closeSync(lockFd);
+            releaseFallbackLock();
             return { code: 0, stdout, stderr };
         }
     }
@@ -363,6 +485,7 @@ export function runMigratePolicyTriggers(args, deps) {
     finally {
         if (lockFd !== undefined)
             fileSystem.closeSync(lockFd);
+        releaseFallbackLock();
     }
     return { code: errorCode, stdout, stderr };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.337.0",
+  "version": "5.338.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {