@indigoai-us/hq-cli 5.345.94 → 5.345.96

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.345.96] — 2026-10-12
+- `hq doctor --json --client-health-report` no longer lists company journals
+  that this repair pass did not try to refresh. Session-start health stops
+  filing those leftover rows as unrepaired.
+
+## [5.345.95] — 2026-10-12
+- `hq doctor --fix` still refreshes a stale personal-files journal and a
+  company journal in the same pass when hook files have uncommitted changes.
+  Session-start health no longer treats that pair as unrepaired.
+
 ## [5.345.94] — 2026-10-12
 - Local bots now turn `@Name` in a group-room post into a real mention, so the addressed bot receives that post in its inbox. A room post that does not mention another bot still does not wake that bot.
 

package/dist/lib/doctor/fix/apply.d.ts

@@ -8,9 +8,11 @@
  *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses hook-file repairs
  *      and exits non-zero unless `--force`, so those writes can never be
  *      tangled up with unrelated in-flight edits to the security layer.
- *      Repairs that do not write those trees (a stale-company `refresh-sync`
- *      pull) still run: the SessionStart health hook never passes `--force`,
- *      and blocking the pull left `sync.journal.<slug>` WARN after `--fix`.
+ *      Repairs that do not write those trees (`refresh-sync` pulls for a
+ *      stale company journal or the personal vault) still run: the
+ *      SessionStart health hook never passes `--force`, and blocking those
+ *      pulls left `sync.journal.<slug>` and
+ *      `sync.journal.__hq_personal_vault__` WARN after `--fix`.
  *   2. Allowlist only. It repairs the classified safe classes — restore an
  *      execute bit, add a hook id to the gate profiles it is missing from,
  *      re-register a script present on disk, or pull a company or personal

package/dist/lib/doctor/fix/apply.js

@@ -8,9 +8,11 @@
  *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses hook-file repairs
  *      and exits non-zero unless `--force`, so those writes can never be
  *      tangled up with unrelated in-flight edits to the security layer.
- *      Repairs that do not write those trees (a stale-company `refresh-sync`
- *      pull) still run: the SessionStart health hook never passes `--force`,
- *      and blocking the pull left `sync.journal.<slug>` WARN after `--fix`.
+ *      Repairs that do not write those trees (`refresh-sync` pulls for a
+ *      stale company journal or the personal vault) still run: the
+ *      SessionStart health hook never passes `--force`, and blocking those
+ *      pulls left `sync.journal.<slug>` and
+ *      `sync.journal.__hq_personal_vault__` WARN after `--fix`.
  *   2. Allowlist only. It repairs the classified safe classes — restore an
  *      execute bit, add a hook id to the gate profiles it is missing from,
  *      re-register a script present on disk, or pull a company or personal
@@ -46,6 +48,7 @@ import { botDir } from "../../bot/paths.js";
 import { readBotConfig } from "../../bot/config.js";
 import { buildBotDaemonPaths, rewriteBotDaemonNodePath } from "../../bot/daemon.js";
 import { classifyRefreshSyncOutcome, } from "./refresh-sync-outcome.js";
+import { readRefreshSyncProgress, writeRefreshSyncCursor, writeRefreshSyncLastRun, } from "./refresh-sync-progress.js";
 import { clientHealthShowManualOnlyEnabled } from "../client-health-reason-codes-flag.js";
 /** The tree subtrees whose uncommitted changes block a `--fix` run. */
 export const HOOK_CONFIG_DIRS = [".claude", ".codex", ".grok"];
@@ -55,33 +58,6 @@ export const REFRESH_SYNC_TIMEOUT_MS = 90_000;
 export const MAX_FIX_PASSES = 3;
 /** Two 90s pulls leave 120s for startup and check overhead under the hook's 300s ceiling. */
 export const MAX_REFRESH_SYNC_PLANS_PER_RUN = 2;
-const REFRESH_SYNC_PROGRESS_RELATIVE_PATH = path.join("workspace", "doctor", "refresh-sync-progress.json");
-function readRefreshSyncProgress(hqRoot) {
-    let contents;
-    try {
-        contents = fs.readFileSync(path.join(hqRoot, REFRESH_SYNC_PROGRESS_RELATIVE_PATH), "utf8");
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    }
-    const parsed = JSON.parse(contents);
-    if (typeof parsed === "object" && parsed !== null &&
-        parsed.version === 1 &&
-        typeof parsed.lastAttemptedSlug === "string") {
-        return parsed;
-    }
-    throw new Error(`Invalid refresh-sync progress cursor at ${REFRESH_SYNC_PROGRESS_RELATIVE_PATH}`);
-}
-function writeRefreshSyncProgress(hqRoot, slug) {
-    const progressPath = path.join(hqRoot, REFRESH_SYNC_PROGRESS_RELATIVE_PATH);
-    const directory = path.dirname(progressPath);
-    fs.mkdirSync(directory, { recursive: true });
-    const temporaryPath = `${progressPath}.${process.pid}.tmp`;
-    fs.writeFileSync(temporaryPath, `${JSON.stringify({ version: 1, lastAttemptedSlug: slug })}\n`, { mode: 0o600 });
-    fs.renameSync(temporaryPath, progressPath);
-}
 function rotateRefreshSyncPlans(plans, afterSlug) {
     const ordered = [...plans].sort((a, b) => a.target < b.target ? -1 : a.target > b.target ? 1 : 0);
     if (!afterSlug || ordered.length < 2)
@@ -120,7 +96,10 @@ export async function applyFixes(options) {
     const refuseDirtyHookWrites = (plans) => {
         if (dirty.length === 0)
             return plans;
-        const allowed = plans.filter((plan) => plan.relpath.length === 0);
+        // Journal refreshes never write hook files. Allow them by class, not
+        // only by empty relpath, so a personal-vault pull and a company pull
+        // still run when SessionStart `--fix --yes` cannot pass `--force`.
+        const allowed = plans.filter((plan) => plan.fixClass === "refresh-sync" || plan.relpath.length === 0);
         if (allowed.length === plans.length)
             return plans;
         if (allowed.length === 0)
@@ -249,7 +228,7 @@ export async function applyFixes(options) {
                 // Persist before starting the bounded pull. If this process is killed,
                 // the next invocation resumes after this company instead of starving
                 // every later journal behind it.
-                writeRefreshSyncProgress(hqRoot, plan.target);
+                writeRefreshSyncCursor(hqRoot, plan.target);
                 lastAttemptedRefreshSyncSlug = plan.target;
                 refreshSyncAppliedThisRun += 1;
             }
@@ -279,6 +258,14 @@ export async function applyFixes(options) {
             ...(refreshSyncOutcome ? { refreshSyncOutcome } : {}),
         };
     });
+    const refreshSyncApplied = applied.filter((fix) => fix.fixClass === "refresh-sync");
+    if (refreshSyncApplied.length > 0) {
+        writeRefreshSyncLastRun(hqRoot, {
+            lastAttemptedSlug: lastAttemptedRefreshSyncSlug ?? refreshSyncApplied.at(-1).target,
+            lastRunAttemptedCheckIds: refreshSyncApplied.map((fix) => fix.checkId),
+            lastRunAtMs: backupClock().getTime(),
+        });
+    }
     write("\nPost-fix status:\n");
     for (const fix of applied) {
         write(`  ${fix.postStatus ?? "UNKNOWN"}  ${fix.checkId} [${fix.target}] (pass ${fix.pass})\n`);

package/dist/lib/doctor/fix/refresh-sync-progress.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Persisted `--fix` refresh-sync cursor.
+ *
+ * `lastAttemptedSlug` is written before each pull so a killed repair resumes
+ * after that company instead of starving later journals. `lastRunAttemptedCheckIds`
+ * is written only when a repair pass finishes, so `--client-health-report`
+ * can omit company journals this pass did not try — the SessionStart hook
+ * otherwise files those leftover rows as unrepaired.
+ */
+import type { CheckResult } from "../types.js";
+export declare const REFRESH_SYNC_PROGRESS_RELATIVE_PATH: string;
+/** Hook re-verify runs immediately after `--fix`; 15 minutes covers a slow box. */
+export declare const CLIENT_HEALTH_REFRESH_SYNC_FRESH_MS: number;
+export interface RefreshSyncProgress {
+    version: 1 | 2;
+    lastAttemptedSlug: string;
+    lastRunAttemptedCheckIds?: string[];
+    lastRunAtMs?: number;
+}
+export declare function readRefreshSyncProgress(hqRoot: string): RefreshSyncProgress | null;
+/** Persist the resume cursor without claiming this run finished. */
+export declare function writeRefreshSyncCursor(hqRoot: string, slug: string): void;
+/** Record the check ids this completed `--fix` pass actually tried to refresh. */
+export declare function writeRefreshSyncLastRun(hqRoot: string, input: {
+    lastAttemptedSlug: string;
+    lastRunAttemptedCheckIds: string[];
+    lastRunAtMs: number;
+}): void;
+export declare function freshAttemptedCompanyJournalCheckIds(hqRoot: string, nowMs: number): ReadonlySet<string> | null;
+/** True when a client-health report should hide this leftover company journal. */
+export declare function isUnreachedCompanyJournalForClientHealth(result: CheckResult, attemptedCheckIds: ReadonlySet<string> | null): boolean;
+//# sourceMappingURL=refresh-sync-progress.d.ts.map

package/dist/lib/doctor/fix/refresh-sync-progress.js

@@ -0,0 +1,109 @@
+/**
+ * Persisted `--fix` refresh-sync cursor.
+ *
+ * `lastAttemptedSlug` is written before each pull so a killed repair resumes
+ * after that company instead of starving later journals. `lastRunAttemptedCheckIds`
+ * is written only when a repair pass finishes, so `--client-health-report`
+ * can omit company journals this pass did not try — the SessionStart hook
+ * otherwise files those leftover rows as unrepaired.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { isCompanyJournalSlug, journalSlugFromCheckId, } from "../checks/sync-health.js";
+import { deriveRemediation } from "./remediation.js";
+export const REFRESH_SYNC_PROGRESS_RELATIVE_PATH = path.join("workspace", "doctor", "refresh-sync-progress.json");
+/** Hook re-verify runs immediately after `--fix`; 15 minutes covers a slow box. */
+export const CLIENT_HEALTH_REFRESH_SYNC_FRESH_MS = 15 * 60 * 1000;
+function progressPath(hqRoot) {
+    return path.join(hqRoot, REFRESH_SYNC_PROGRESS_RELATIVE_PATH);
+}
+function isCheckIdList(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+export function readRefreshSyncProgress(hqRoot) {
+    let contents;
+    try {
+        contents = fs.readFileSync(progressPath(hqRoot), "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    const parsed = JSON.parse(contents);
+    if (typeof parsed !== "object" || parsed === null) {
+        throw new Error(`Invalid refresh-sync progress cursor at ${REFRESH_SYNC_PROGRESS_RELATIVE_PATH}`);
+    }
+    const record = parsed;
+    if ((record.version !== 1 && record.version !== 2) ||
+        typeof record.lastAttemptedSlug !== "string") {
+        throw new Error(`Invalid refresh-sync progress cursor at ${REFRESH_SYNC_PROGRESS_RELATIVE_PATH}`);
+    }
+    if (record.lastRunAttemptedCheckIds !== undefined &&
+        !isCheckIdList(record.lastRunAttemptedCheckIds)) {
+        throw new Error(`Invalid refresh-sync progress cursor at ${REFRESH_SYNC_PROGRESS_RELATIVE_PATH}`);
+    }
+    if (record.lastRunAtMs !== undefined && !Number.isFinite(record.lastRunAtMs)) {
+        throw new Error(`Invalid refresh-sync progress cursor at ${REFRESH_SYNC_PROGRESS_RELATIVE_PATH}`);
+    }
+    return record;
+}
+function writeProgressFile(hqRoot, progress) {
+    const target = progressPath(hqRoot);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    const temporaryPath = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(temporaryPath, `${JSON.stringify(progress)}\n`, { mode: 0o600 });
+    fs.renameSync(temporaryPath, target);
+}
+/** Persist the resume cursor without claiming this run finished. */
+export function writeRefreshSyncCursor(hqRoot, slug) {
+    const existing = readRefreshSyncProgress(hqRoot);
+    writeProgressFile(hqRoot, {
+        version: 2,
+        lastAttemptedSlug: slug,
+        ...(existing?.lastRunAttemptedCheckIds
+            ? { lastRunAttemptedCheckIds: existing.lastRunAttemptedCheckIds }
+            : {}),
+        ...(existing?.lastRunAtMs !== undefined ? { lastRunAtMs: existing.lastRunAtMs } : {}),
+    });
+}
+/** Record the check ids this completed `--fix` pass actually tried to refresh. */
+export function writeRefreshSyncLastRun(hqRoot, input) {
+    writeProgressFile(hqRoot, {
+        version: 2,
+        lastAttemptedSlug: input.lastAttemptedSlug,
+        lastRunAttemptedCheckIds: input.lastRunAttemptedCheckIds,
+        lastRunAtMs: input.lastRunAtMs,
+    });
+}
+export function freshAttemptedCompanyJournalCheckIds(hqRoot, nowMs) {
+    let progress;
+    try {
+        progress = readRefreshSyncProgress(hqRoot);
+    }
+    catch {
+        return null;
+    }
+    if (!progress ||
+        progress.lastRunAtMs === undefined ||
+        !isCheckIdList(progress.lastRunAttemptedCheckIds) ||
+        nowMs - progress.lastRunAtMs < 0 ||
+        nowMs - progress.lastRunAtMs > CLIENT_HEALTH_REFRESH_SYNC_FRESH_MS) {
+        return null;
+    }
+    return new Set(progress.lastRunAttemptedCheckIds);
+}
+/** True when a client-health report should hide this leftover company journal. */
+export function isUnreachedCompanyJournalForClientHealth(result, attemptedCheckIds) {
+    if (!attemptedCheckIds)
+        return false;
+    if (result.status !== "FAIL" && result.status !== "WARN")
+        return false;
+    const slug = journalSlugFromCheckId(result.checkId);
+    if (!slug || !isCompanyJournalSlug(slug))
+        return false;
+    if (attemptedCheckIds.has(result.checkId))
+        return false;
+    return deriveRemediation(result)?.autoFixable === true;
+}
+//# sourceMappingURL=refresh-sync-progress.js.map

package/dist/lib/doctor/json-output.d.ts

@@ -109,9 +109,12 @@ export interface BuildDoctorJsonInput {
      * Ordinary hq-core upgrade WARNs stay in human `hq doctor` output and in
      * default `--json`, but they are omitted here: `--fix` cannot apply a
      * release, and older hooks treated the leftover WARN as an unrepaired
-     * failure.
+     * failure. Company journals this `--fix` pass did not try to refresh are
+     * omitted the same way: the repair cap leaves them for a later session.
      */
     clientHealthReport?: boolean;
+    /** Clock for the leftover-journal freshness window. Default: `Date.now`. */
+    now?: () => Date;
 }
 /**
  * True when a sync finding is an ordinary, non-repairable hq-core upgrade.

package/dist/lib/doctor/json-output.js

@@ -19,6 +19,7 @@
  */
 import { computeExitCode, summarize, UNKNOWN_PLATFORM, } from "./report.js";
 import { deriveRemediation } from "./fix/remediation.js";
+import { freshAttemptedCompanyJournalCheckIds, isUnreachedCompanyJournalForClientHealth, } from "./fix/refresh-sync-progress.js";
 /**
  * The `--json` schema version. Bump on any breaking change to the document
  * shape; the snapshot test in report.test.ts fails until the bump is
@@ -38,12 +39,19 @@ export function isOrdinaryCoreUpdateWarn(result) {
 }
 /** Assemble the machine-readable document from a completed run. */
 export function buildDoctorJson(input) {
+    const attemptedRefreshSyncCheckIds = input.clientHealthReport === true
+        ? freshAttemptedCompanyJournalCheckIds(input.hqRoot, (input.now ?? (() => new Date()))().getTime())
+        : null;
     const results = [];
     for (const run of input.families) {
         for (const result of run.results) {
             if (input.clientHealthReport === true && isOrdinaryCoreUpdateWarn(result)) {
                 continue;
             }
+            if (input.clientHealthReport === true &&
+                isUnreachedCompanyJournalForClientHealth(result, attemptedRefreshSyncCheckIds)) {
+                continue;
+            }
             results.push(toJsonResult(run.family.id, result, input.clientHealthReasonCodesEnabledCheckIds, input.clientHealthCheckStatusEnabledCheckIds));
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.94",
+  "version": "5.345.96",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {