@indigoai-us/hq-cli 5.345.100 → 5.345.102

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.345.102] — 2026-10-12
+- Session-start health no longer files a leftover company journal as an
+  unrepaired doctor finding, and company manifest rows keep a real check id
+  instead of showing up as unlabeled `unknown`. `hq doctor --fix` still
+  refreshes that company journal when hook files have uncommitted changes.
+
+## [5.345.101] — 2026-10-12
+- Doctor JSON no longer counts an ordinary HQ Core upgrade warning in its
+  summary after omitting it from results. Session-start health that only saw
+  that leftover warning after `hq doctor --fix` stops treating it as an
+  unrepaired failure. `hq doctor` still prints the upgrade.
+
 ## [5.345.100] — 2026-10-12
 - `hq storage status` no longer runs the big-file scan, so it returns the
   local backup and cloud history figures without waiting minutes on a big HQ.

package/dist/commands/doctor.js

@@ -33,7 +33,7 @@ import { PARITY_FAMILY_ID, PARITY_FAMILY_TITLE, runParityReplay, } from "../lib/
 import { applyFixes } from "../lib/doctor/fix/apply.js";
 import { renderDoctorFixJson } from "../lib/doctor/fix/json-output.js";
 import { clientHealthCheckStatusEnabled as isActiveCompanyClientHealthCheckStatusEnabled, clientHealthCheckStatusEnabledForCompany, clientHealthReasonCodesEnabled as isActiveCompanyClientHealthReasonCodesEnabled, clientHealthReasonCodesEnabledForCompany, } from "../lib/doctor/client-health-reason-codes-flag.js";
-import { isCompanyJournalSlug } from "../lib/doctor/checks/sync-health.js";
+import { clientHealthCompanyScopeFromCheckId } from "../lib/doctor/checks/sync-health.js";
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import * as readline from "node:readline";
 import { runSideEffectTests } from "../lib/doctor/deep/sandbox.js";
@@ -207,15 +207,7 @@ async function resolveClientHealthReasonCodesCheckIds(families, resolveForCompan
                 (result.status !== "FAIL" && result.status !== "WARN")) {
                 continue;
             }
-            const scoped = /^sync\.(?:journal|manifest)\.(.+)$/.exec(result.checkId);
-            const companyUidScope = scoped
-                ? /^company:(cmp_[A-Za-z0-9]{3,128})$/.exec(scoped[1])
-                : null;
-            const companySlug = companyUidScope
-                ? `company:${companyUidScope[1]}`
-                : scoped && isCompanyJournalSlug(scoped[1])
-                    ? scoped[1]
-                    : null;
+            const companySlug = clientHealthCompanyScopeFromCheckId(result.checkId);
             const checkIds = checksByCompany.get(companySlug) ?? [];
             checkIds.push(result.checkId);
             checksByCompany.set(companySlug, checkIds);
@@ -242,8 +234,7 @@ async function resolveClientHealthCheckStatusCheckIds(families, resolveForCompan
         for (const result of run.results) {
             if (result.status !== "FAIL" && result.status !== "WARN")
                 continue;
-            const scoped = /^sync\.(?:journal|manifest)\.(.+)$/.exec(result.checkId);
-            const companySlug = scoped && isCompanyJournalSlug(scoped[1]) ? scoped[1] : null;
+            const companySlug = clientHealthCompanyScopeFromCheckId(result.checkId);
             const checkIds = checksByCompany.get(companySlug) ?? [];
             checkIds.push(result.checkId);
             checksByCompany.set(companySlug, checkIds);

package/dist/lib/doctor/checks/sync-health.d.ts

@@ -107,6 +107,23 @@ export interface SyncHealthDeps {
  * outside `companies/`.
  */
 export declare function isSafeCompanySlug(slug: string): boolean;
+/**
+ * SessionStart health only ships `checkId` values matching
+ * `^sync.[A-Za-z0-9._-]{1,160}$`. A colon (hq-cloud's `company:cmp_…` scope
+ * key) becomes the unlabeled `unknown` row in those reports.
+ */
+export declare const CLIENT_HEALTH_SYNC_CHECK_ID: RegExp;
+/**
+ * Doctor JSON `checkId` for a manifest scope. hq-cloud keys company rows
+ * `company:cmp_…`; the colon is replaced so SessionStart health can report
+ * the real id instead of `unknown`.
+ */
+export declare function manifestCheckIdFromScopeKey(scopeKey: string): string;
+/**
+ * Company slug or `company:cmp_…` uid used to resolve per-company health
+ * flags from a sync finding. Manifest ids may use a colon or a dot.
+ */
+export declare function clientHealthCompanyScopeFromCheckId(checkId: string): string | null;
 /** True when this journal slug names a company rather than the personal tree. */
 export declare function isCompanyJournalSlug(slug: string): boolean;
 /** True when this journal slug names the personal tree or personal vault. */

package/dist/lib/doctor/checks/sync-health.js

@@ -194,13 +194,64 @@ const NON_COMPANY_JOURNAL_SLUGS = new Set([
     PERSONAL_SCOPE_SLUG,
     PERSONAL_VAULT_SCOPE_SLUG,
 ]);
+/**
+ * SessionStart health only ships `checkId` values matching
+ * `^sync.[A-Za-z0-9._-]{1,160}$`. A colon (hq-cloud's `company:cmp_…` scope
+ * key) becomes the unlabeled `unknown` row in those reports.
+ */
+export const CLIENT_HEALTH_SYNC_CHECK_ID = /^sync\.[A-Za-z0-9._-]{1,160}$/;
+const COMPANY_SCOPE_UID = /^company[.:](cmp_[A-Za-z0-9]{3,128})$/;
 /** Keep malformed scopes distinct without letting them imitate valid slugs. */
 function journalSlugForCheckId(slug) {
     if (NON_COMPANY_JOURNAL_SLUGS.has(slug) || isSafeCompanySlug(slug)) {
         return slug;
     }
     const encoded = Array.from(slug, (character) => character.codePointAt(0).toString(16)).join("-");
-    return `__hq_invalid_journal_scope__${encoded}`;
+    return boundInvalidScopeToken(`__hq_invalid_journal_scope__${encoded}`);
+}
+function boundInvalidScopeToken(token) {
+    // `sync.` + token must fit the health-hook 160-char suffix budget.
+    const maxSuffix = 160;
+    if (token.length <= maxSuffix)
+        return token;
+    return token.slice(0, maxSuffix);
+}
+/**
+ * Doctor JSON `checkId` for a manifest scope. hq-cloud keys company rows
+ * `company:cmp_…`; the colon is replaced so SessionStart health can report
+ * the real id instead of `unknown`.
+ */
+export function manifestCheckIdFromScopeKey(scopeKey) {
+    if (scopeKey.startsWith("company:")) {
+        return `sync.manifest.${scopeKey.replace(/:/g, ".")}`;
+    }
+    if (scopeKey === "personal" || isSafeCompanySlug(scopeKey)) {
+        return `sync.manifest.${scopeKey}`;
+    }
+    const encoded = Array.from(scopeKey, (character) => character.codePointAt(0).toString(16)).join("-");
+    return `sync.manifest.${boundInvalidScopeToken(`__hq_invalid_scope__${encoded}`)}`;
+}
+/**
+ * Company slug or `company:cmp_…` uid used to resolve per-company health
+ * flags from a sync finding. Manifest ids may use a colon or a dot.
+ */
+export function clientHealthCompanyScopeFromCheckId(checkId) {
+    const journalSlug = journalSlugFromCheckId(checkId);
+    if (journalSlug && isCompanyJournalSlug(journalSlug) && isSafeCompanySlug(journalSlug)) {
+        return journalSlug;
+    }
+    const manifest = /^sync\.manifest\.(.+)$/.exec(checkId);
+    if (!manifest)
+        return null;
+    const rest = manifest[1];
+    const companyUid = COMPANY_SCOPE_UID.exec(rest)?.[1];
+    if (companyUid)
+        return `company:${companyUid}`;
+    if (rest === "personal" || NON_COMPANY_JOURNAL_SLUGS.has(rest))
+        return null;
+    if (isSafeCompanySlug(rest))
+        return rest;
+    return null;
 }
 /** True when this journal slug names a company rather than the personal tree. */
 export function isCompanyJournalSlug(slug) {
@@ -553,7 +604,7 @@ function manifestResults(deps, journals) {
     }
     const nowMs = deps.now().getTime();
     const reported = statuses.map((entry) => {
-        const checkId = `sync.manifest.${entry.scopeKey}`;
+        const checkId = manifestCheckIdFromScopeKey(entry.scopeKey);
         if (!entry.lastUploadAt) {
             return {
                 status: "UNTESTED",

package/dist/lib/doctor/json-output.d.ts

@@ -107,12 +107,12 @@ export interface BuildDoctorJsonInput {
     /**
      * JSON consumed by the SessionStart health hook (`--client-health-report`).
      * Ordinary hq-core upgrade WARNs are omitted from every JSON document
-     * (`--json` and `--client-health-report`): `--fix` cannot apply a release,
-     * and both current hooks and older ones that only call `hq doctor --json`
-     * treated the leftover WARN as an unrepaired failure. Human `hq doctor`
-     * still prints the upgrade. Company journals this `--fix` pass did not try
-     * to refresh are omitted only from `--client-health-report`: the repair cap
-     * leaves them for a later session.
+     * (`--json` and `--client-health-report`), including `summary` tallies:
+     * `--fix` cannot apply a release, and both current hooks and older ones
+     * that only call `hq doctor --json` treated the leftover WARN as an
+     * unrepaired failure. Human `hq doctor` still prints the upgrade. Company
+     * journals this `--fix` pass did not try to refresh are omitted only from
+     * `--client-health-report`: the repair cap leaves them for a later session.
      */
     clientHealthReport?: boolean;
     /** Clock for the leftover-journal freshness window. Default: `Date.now`. */
@@ -121,8 +121,9 @@ export interface BuildDoctorJsonInput {
 /**
  * True when a sync finding is an ordinary, non-repairable hq-core upgrade.
  * FAIL stays visible: that is a broken local core, not "a newer release exists".
- * JSON omits the WARN so SessionStart health (including core 15.x hooks that
- * only call `hq doctor --json`) does not file it as a failed repair.
+ * JSON omits the WARN (from `results` and `summary`) so SessionStart health
+ * (including core 15.x hooks that only call `hq doctor --json`) does not file
+ * it as a failed repair.
  */
 export declare function isOrdinaryCoreUpdateWarn(result: {
     checkId: string;

package/dist/lib/doctor/json-output.js

@@ -17,7 +17,7 @@
  * `target` and `remediation` are emitted only when present, matching the
  * per-item result shape where both are optional.
  */
-import { computeExitCode, summarize, UNKNOWN_PLATFORM, } from "./report.js";
+import { computeExitCode, emptyStatusCounts, UNKNOWN_PLATFORM, } from "./report.js";
 import { deriveRemediation } from "./fix/remediation.js";
 import { freshAttemptedCompanyJournalCheckIds, isUnreachedCompanyJournalForClientHealth, } from "./fix/refresh-sync-progress.js";
 /**
@@ -33,12 +33,20 @@ export const DOCTOR_JSON_SCHEMA_VERSION = 2;
 /**
  * True when a sync finding is an ordinary, non-repairable hq-core upgrade.
  * FAIL stays visible: that is a broken local core, not "a newer release exists".
- * JSON omits the WARN so SessionStart health (including core 15.x hooks that
- * only call `hq doctor --json`) does not file it as a failed repair.
+ * JSON omits the WARN (from `results` and `summary`) so SessionStart health
+ * (including core 15.x hooks that only call `hq doctor --json`) does not file
+ * it as a failed repair.
  */
 export function isOrdinaryCoreUpdateWarn(result) {
     return result.checkId === "sync.update.core" && result.status === "WARN";
 }
+/** Tally the results that actually ship in the JSON document. */
+function summarizeJsonResults(results) {
+    const counts = emptyStatusCounts();
+    for (const result of results)
+        counts[result.status] += 1;
+    return counts;
+}
 /** Assemble the machine-readable document from a completed run. */
 export function buildDoctorJson(input) {
     const attemptedRefreshSyncCheckIds = input.clientHealthReport === true
@@ -61,7 +69,7 @@ export function buildDoctorJson(input) {
         schemaVersion: DOCTOR_JSON_SCHEMA_VERSION,
         platform: input.platform ?? UNKNOWN_PLATFORM,
         hqRoot: input.hqRoot,
-        summary: summarize(input.families),
+        summary: summarizeJsonResults(results),
         exitCode: computeExitCode(input.families),
         ...(input.scope && input.scope.length > 0 ? { scope: [...input.scope] } : {}),
         results,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.100",
+  "version": "5.345.102",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {