@indigoai-us/hq-cli 5.345.78 → 5.345.79

package/CHANGELOG.md

@@ -2,12 +2,15 @@
 
 ## [Unreleased]
 
-## [5.345.78] — 2026-10-10
+## [5.345.79] — 2026-10-11
 - `hq lanes` no longer fails every list, message, or admission command when
   one lane still has leftover queue details from an older worker-profile wait.
   Those leftover details are dropped on read, cleared when the queue reason
   changes, and one unreadable lane is skipped so the rest of the host stays
   usable.
+- `hq doctor --fix` still refreshes a stale company sync journal when
+  `.claude/`, `.codex/`, or `.grok/` has uncommitted changes. Those dirty
+  files still block hook-file repairs unless you pass `--force`.
 
 ## [5.345.77] — 2026-10-10
 - Local bots no longer fail a turn when the installed Codex is too old for the

package/dist/lib/doctor/fix/apply.d.ts

@@ -5,9 +5,12 @@
  * wrapped in guardrails that are NOT polish — each is a PRD acceptance criterion:
  *
  *   1. Dirty-tree refusal. If the working tree has uncommitted changes under
- *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses and exits non-zero
- *      unless `--force`, so a repair can never be tangled up with unrelated
- *      in-flight edits to the security layer.
+ *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses hook-file repairs
+ *      and exits non-zero unless `--force`, so those writes can never be
+ *      tangled up with unrelated in-flight edits to the security layer.
+ *      Repairs that do not write those trees (a stale-company `refresh-sync`
+ *      pull) still run: the SessionStart health hook never passes `--force`,
+ *      and blocking the pull left `sync.journal.<slug>` WARN after `--fix`.
  *   2. Allowlist only. It repairs the classified safe classes — restore an
  *      execute bit, add a hook id to the gate profiles it is missing from,
  *      re-register a script present on disk, or pull a company whose local

package/dist/lib/doctor/fix/apply.js

@@ -5,9 +5,12 @@
  * wrapped in guardrails that are NOT polish — each is a PRD acceptance criterion:
  *
  *   1. Dirty-tree refusal. If the working tree has uncommitted changes under
- *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses and exits non-zero
- *      unless `--force`, so a repair can never be tangled up with unrelated
- *      in-flight edits to the security layer.
+ *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses hook-file repairs
+ *      and exits non-zero unless `--force`, so those writes can never be
+ *      tangled up with unrelated in-flight edits to the security layer.
+ *      Repairs that do not write those trees (a stale-company `refresh-sync`
+ *      pull) still run: the SessionStart health hook never passes `--force`,
+ *      and blocking the pull left `sync.journal.<slug>` WARN after `--fix`.
  *   2. Allowlist only. It repairs the classified safe classes — restore an
  *      execute bit, add a hook id to the gate profiles it is missing from,
  *      re-register a script present on disk, or pull a company whose local
@@ -107,20 +110,34 @@ export async function applyFixes(options) {
         ...over,
     });
     // 1. Dirty-tree refusal (AC8). Never write over uncommitted security-layer
-    //    edits unless the user forces it.
-    if (!options.force) {
-        const dirty = (options.dirtyCheck ?? uncommittedHookConfigChanges)(hqRoot);
-        if (dirty.length > 0) {
-            writeErr(`hq doctor --fix: refusing to run — uncommitted changes under ` +
-                `${HOOK_CONFIG_DIRS.join(", ")}:\n` +
-                dirty.map((line) => `  ${line}`).join("\n") +
-                `\nCommit or stash them, or re-run with --force.\n`);
-            return empty({ exitCode: 1, refused: "dirty-tree" });
-        }
-    }
+    //    edits unless the user forces it. Probe once; hook-file plans are
+    //    dropped per pass so a stale-journal pull can still run.
+    const dirty = options.force
+        ? []
+        : (options.dirtyCheck ?? uncommittedHookConfigChanges)(hqRoot);
+    const refuseDirtyHookWrites = (plans) => {
+        if (dirty.length === 0)
+            return plans;
+        const allowed = plans.filter((plan) => plan.relpath.length === 0);
+        if (allowed.length === plans.length)
+            return plans;
+        if (allowed.length === 0)
+            return "refuse";
+        writeErr(`hq doctor --fix: skipping hook-file repairs — uncommitted changes under ` +
+            `${HOOK_CONFIG_DIRS.join(", ")}. Refreshing sync journals still runs; ` +
+            `re-run with --force to repair hook files.\n`);
+        return allowed;
+    };
+    const refuseDirtyTree = () => {
+        writeErr(`hq doctor --fix: refusing to run — uncommitted changes under ` +
+            `${HOOK_CONFIG_DIRS.join(", ")}:\n` +
+            dirty.map((line) => `  ${line}`).join("\n") +
+            `\nCommit or stash them, or re-run with --force.\n`);
+        return empty({ exitCode: 1, refused: "dirty-tree" });
+    };
     // Resolve the customer-visible manual-only output gate once per fix run.
-    // Keep it behind the dirty-tree guard, and fail open to the pre-change
-    // output if the identity is absent or the registry lookup fails.
+    // Fail open to the pre-change output if the identity is absent or the
+    // registry lookup fails.
     let showManualOnlyRemediations = false;
     try {
         showManualOnlyRemediations =
@@ -172,7 +189,16 @@ export async function applyFixes(options) {
         ];
     };
     for (let pass = 1; pass <= MAX_FIX_PASSES; pass += 1) {
-        const plans = buildPlans(findings);
+        const plannedThisPass = refuseDirtyHookWrites(buildPlans(findings));
+        if (plannedThisPass === "refuse") {
+            if (planned.length === 0)
+                return refuseDirtyTree();
+            write(`Pass ${pass}/${MAX_FIX_PASSES}: remaining repairs write hook files; ` +
+                `stopped because the tree is dirty.\n`);
+            refused = "dirty-tree";
+            break;
+        }
+        const plans = plannedThisPass;
         if (plans.length === 0)
             break;
         fixableCount += plans.length;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.78",
+  "version": "5.345.79",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {