@indigoai-us/hq-cloud 6.14.40 → 6.14.42

package/src/cli/sync.ts

@@ -2903,6 +2903,48 @@ function computePullPlan(
         continue;
       }
 
+      // ── Untracked-local guard (unjournaled local file) ──────────────
+      // Both `localChanged` and `remoteChanged` are gated on `!!journalEntry`,
+      // so a key with NO journal entry reads "clean on both sides" and falls
+      // all the way through to a plain `download` — silently replacing a local
+      // file that exists on disk. There is no conflict, no `.conflict-` mirror
+      // and no conflict-index record, so the loss is invisible unless someone
+      // happens to know what the file should contain.
+      //
+      // This destroyed in-progress edits to
+      // `companies/*/projects/*/prd.json` three times on 2026-08-01/02, but
+      // nothing about it is prd- or project-specific: it fires for ANY synced
+      // path whose journal entry is absent. Absence is common — a file created
+      // on this machine and on a peer under the same key before either pushed,
+      // a journal shard reset/lost/rebuilt (`readJournal` returns an empty
+      // `files` map for a missing shard, so EVERY divergent local file is in
+      // scope), a run under a different `HQ_STATE_DIR`, or an entry dropped by
+      // scope-shrink or rescue.
+      //
+      // No journal entry means no evidence that local and remote ever agreed,
+      // which is exactly when an overwrite is least safe. Route it through the
+      // conflict path instead: the executor's convergence probe fetches the
+      // remote once and, when the bytes already match (the ordinary
+      // fresh-machine / rebuilt-journal case), reconciles silently — no
+      // conflict, no mirror, journal stamped. Only genuine divergence surfaces,
+      // and there local is PRESERVED as-is with the cloud copy written beside
+      // it under `--on-conflict keep`, or the run halts under `abort`.
+      // Cloud-authoritative paths (board.json, ontology/, signals/, …) are
+      // unaffected — the conflict executor short-circuits those back to a
+      // pull-wins download before any mirror is minted.
+      if (!journalEntry) {
+        items.push({
+          action: "conflict",
+          remoteFile,
+          localPath,
+          localHash,
+          localMtime: localLstat!.mtime,
+          localSize: isLocalSymlink ? 0 : localLstat!.size,
+          localSnapshot: plannedLocalSnapshot,
+        });
+        continue;
+      }
+
       // Mirror the original 3-way merge from the inline loop. Tested by
       // `does NOT flag a pull conflict when only local changed since last
       // sync` and `detects conflicts with local changes…`.