@cleocode/core 2026.4.11 → 2026.4.13

package/src/store/__tests__/sqlite-backup-global.test.ts

@@ -1,10 +1,11 @@
 /**
  * Tests for global-tier SQLite VACUUM INTO backup (vacuumIntoGlobalBackup,
- * listGlobalSqliteBackups).
+ * listGlobalSqliteBackups) and global-salt raw-file backup (backupGlobalSalt,
+ * listGlobalSaltBackups).
  *
  * All tests use a tmp-dir override via `cleoHomeOverride` so they NEVER
  * touch the real user's $XDG_DATA_HOME/cleo/ directory or corrupt actual
- * nexus backups.
+ * nexus/signaldock backups.
  *
  * Coverage:
  * - vacuumIntoGlobalBackup creates a snapshot and increments file count
@@ -14,12 +15,20 @@
  * - Scope filter: listGlobalSqliteBackups with prefix excludes other prefixes
  * - Restore round-trip: snapshot then restore preserves DB content
  * - XDG path: snapshots land under cleoHomeOverride/backups/sqlite/, not hardcoded ~/.cleo/
+ * - TC-100: vacuumIntoBackupAll includes conduit.db snapshot
+ * - TC-101: vacuumIntoGlobalBackup('signaldock') writes snapshot to global backups dir
+ * - TC-102: backupGlobalSalt writes binary file with 0o600 permissions
+ * - TC-103: Rotation: 11th conduit snapshot deletes the oldest
+ * - TC-104: listSqliteBackupsAll returns conduit key in result map
+ * - TC-105: listGlobalSqliteBackups('signaldock') returns signaldock snapshots
  *
  * @task T306
+ * @task T369
  * @epic T299
+ * @epic T310
  */
 
-import { existsSync, mkdirSync, readdirSync, utimesSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, statSync, utimesSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
@@ -278,4 +287,299 @@ describe('sqlite-backup global tier', () => {
       snapDb.close();
     }
   });
+
+  // ==========================================================================
+  // TC-100 through TC-105: T369 — conduit, signaldock, global-salt backup
+  // ==========================================================================
+
+  /**
+   * TC-100: vacuumIntoBackupAll includes conduit.db snapshot in
+   * `.cleo/backups/sqlite/` alongside tasks and brain.
+   *
+   * @task T369
+   * @epic T310
+   */
+  it('TC-100: vacuumIntoBackupAll includes conduit.db snapshot', async () => {
+    vi.resetModules();
+    const cwd = join(tmpdir(), `cleo-tc100-${Date.now()}`);
+    const cleoDir = join(cwd, '.cleo');
+    const tasksDbPath = join(cleoDir, 'tasks.db');
+    const brainDbPath = join(cleoDir, 'brain.db');
+    const conduitDbPath = join(cleoDir, 'conduit.db');
+    mkdirSync(cleoDir, { recursive: true });
+
+    // Seed all three databases
+    for (const dbPath of [tasksDbPath, brainDbPath, conduitDbPath]) {
+      const db = new DatabaseSync(dbPath);
+      db.exec(
+        "CREATE TABLE IF NOT EXISTS test_data (id INTEGER PRIMARY KEY, value TEXT); INSERT INTO test_data (value) VALUES ('hello');",
+      );
+      db.close();
+    }
+
+    const tasksDb = new DatabaseSync(tasksDbPath);
+    const brainDb = new DatabaseSync(brainDbPath);
+    const conduitDb = new DatabaseSync(conduitDbPath);
+
+    vi.doMock('../sqlite.js', () => ({ getNativeDb: () => tasksDb, getDb: () => tasksDb }));
+    vi.doMock('../brain-sqlite.js', () => ({ getBrainNativeDb: () => brainDb }));
+    vi.doMock('../conduit-sqlite.js', () => ({ getConduitNativeDb: () => conduitDb }));
+    vi.doMock('../nexus-sqlite.js', () => ({ getNexusNativeDb: () => null }));
+    vi.doMock('../signaldock-sqlite.js', () => ({
+      getGlobalSignaldockNativeDb: () => null,
+      getGlobalSignaldockDbPath: () => '',
+    }));
+    vi.doMock('../global-salt.js', () => ({ getGlobalSaltPath: () => join(cwd, 'global-salt') }));
+    vi.doMock('../../paths.js', () => ({
+      getCleoDir: () => cleoDir,
+      getCleoHome: () => cwd,
+    }));
+
+    const { vacuumIntoBackupAll, listSqliteBackupsAll } = await import('../sqlite-backup.js');
+    await vacuumIntoBackupAll({ cwd, force: true });
+
+    tasksDb.close();
+    brainDb.close();
+    conduitDb.close();
+
+    const allBackups = listSqliteBackupsAll(cwd);
+
+    // All three prefixes must be present
+    expect(allBackups).toHaveProperty('tasks');
+    expect(allBackups).toHaveProperty('brain');
+    expect(allBackups).toHaveProperty('conduit');
+
+    // Each must have at least one snapshot
+    expect(allBackups['tasks']?.length).toBeGreaterThanOrEqual(1);
+    expect(allBackups['brain']?.length).toBeGreaterThanOrEqual(1);
+    expect(allBackups['conduit']?.length).toBeGreaterThanOrEqual(1);
+
+    // Snapshot filenames must match the conduit- prefix
+    const conduitSnap = allBackups['conduit']?.[0];
+    expect(conduitSnap?.name).toMatch(/^conduit-\d{8}-\d{6}\.db$/);
+  });
+
+  /**
+   * TC-101: vacuumIntoGlobalBackup('signaldock') writes a snapshot to the
+   * global backups directory at `cleoHomeOverride/backups/sqlite/`.
+   *
+   * @task T369
+   * @epic T310
+   */
+  it('TC-101: vacuumIntoGlobalBackup(signaldock) writes snapshot to global backups dir', async () => {
+    vi.resetModules();
+    const cleoHome = join(tmpdir(), `cleo-tc101-${Date.now()}`);
+    const sdDbPath = join(cleoHome, 'signaldock.db');
+    mkdirSync(cleoHome, { recursive: true });
+
+    const db = new DatabaseSync(sdDbPath);
+    db.exec(
+      "CREATE TABLE IF NOT EXISTS agents (id TEXT PRIMARY KEY); INSERT INTO agents VALUES ('agent-1');",
+    );
+    db.close();
+
+    const sdDb = new DatabaseSync(sdDbPath);
+    vi.doMock('../signaldock-sqlite.js', () => ({
+      getGlobalSignaldockNativeDb: () => sdDb,
+      getGlobalSignaldockDbPath: () => sdDbPath,
+    }));
+    vi.doMock('../nexus-sqlite.js', () => ({ getNexusNativeDb: () => null }));
+    vi.doMock('../../paths.js', () => ({ getCleoHome: () => cleoHome }));
+
+    const { vacuumIntoGlobalBackup } = await import('../sqlite-backup.js');
+    const result = await vacuumIntoGlobalBackup('signaldock', { cleoHomeOverride: cleoHome });
+
+    sdDb.close();
+
+    expect(result.snapshotPath).toBeTruthy();
+    expect(result.snapshotPath).toContain('signaldock-');
+    expect(result.snapshotPath).toContain(join(cleoHome, 'backups', 'sqlite'));
+    expect(existsSync(result.snapshotPath)).toBe(true);
+
+    // Snapshot must pass integrity_check
+    const snap = new DatabaseSync(result.snapshotPath, { readonly: true });
+    try {
+      const row = snap.prepare('PRAGMA integrity_check').get() as Record<string, unknown>;
+      const ok = row?.['integrity_check'] ?? row?.['integrity check'];
+      expect(ok).toBe('ok');
+    } finally {
+      snap.close();
+    }
+  });
+
+  /**
+   * TC-102: backupGlobalSalt writes a 32-byte binary file to
+   * `cleoHomeOverride/backups/global-salt-<ts>` with 0o600 permissions.
+   *
+   * @task T369
+   * @epic T310
+   */
+  it('TC-102: backupGlobalSalt writes binary file with 0o600 permissions', async () => {
+    vi.resetModules();
+    const cleoHome = join(tmpdir(), `cleo-tc102-${Date.now()}`);
+    mkdirSync(cleoHome, { recursive: true });
+
+    // Write a fake 32-byte global-salt file at cleoHomeOverride/global-salt
+    const saltPath = join(cleoHome, 'global-salt');
+    const saltBytes = Buffer.alloc(32, 0xab);
+    writeFileSync(saltPath, saltBytes, { mode: 0o600 });
+
+    vi.doMock('../global-salt.js', () => ({ getGlobalSaltPath: () => saltPath }));
+    vi.doMock('../../paths.js', () => ({ getCleoHome: () => cleoHome }));
+
+    const { backupGlobalSalt } = await import('../sqlite-backup.js');
+    const result = await backupGlobalSalt({ cleoHomeOverride: cleoHome });
+
+    expect(result.snapshotPath).toBeTruthy();
+    expect(result.snapshotPath).toContain('global-salt-');
+    expect(existsSync(result.snapshotPath)).toBe(true);
+
+    // Must be 32 bytes
+    const s = statSync(result.snapshotPath);
+    expect(s.size).toBe(32);
+
+    // Must have 0o600 permissions (owner read/write only)
+    const mode = s.mode & 0o777;
+    expect(mode).toBe(0o600);
+  });
+
+  /**
+   * TC-103: Rotation — 11th conduit snapshot deletes the oldest so no more
+   * than 10 conduit snapshots remain in `.cleo/backups/sqlite/`.
+   *
+   * @task T369
+   * @epic T310
+   */
+  it('TC-103: rotation keeps max 10 conduit snapshots, deletes the oldest', async () => {
+    vi.resetModules();
+    const cwd = join(tmpdir(), `cleo-tc103-${Date.now()}`);
+    const cleoDir = join(cwd, '.cleo');
+    const conduitDbPath = join(cleoDir, 'conduit.db');
+    const backupDir = join(cleoDir, 'backups', 'sqlite');
+    mkdirSync(backupDir, { recursive: true });
+
+    // Seed the conduit DB
+    const dbInit = new DatabaseSync(conduitDbPath);
+    dbInit.exec('CREATE TABLE IF NOT EXISTS msgs (id INTEGER PRIMARY KEY);');
+    dbInit.close();
+
+    // Pre-create 11 fake conduit snapshot files with ascending mtimes
+    const staleFiles: string[] = [];
+    for (let i = 0; i < 11; i++) {
+      const day = String(i + 1).padStart(2, '0');
+      const name = `conduit-202601${day}-120000.db`;
+      const p = join(backupDir, name);
+      writeFileSync(p, 'fake-conduit-snapshot');
+      utimesSync(p, 1_700_000_000 + i * 100, 1_700_000_000 + i * 100);
+      staleFiles.push(p);
+    }
+
+    const conduitDb = new DatabaseSync(conduitDbPath);
+    vi.doMock('../conduit-sqlite.js', () => ({ getConduitNativeDb: () => conduitDb }));
+    vi.doMock('../sqlite.js', () => ({ getNativeDb: () => null, getDb: () => null }));
+    vi.doMock('../brain-sqlite.js', () => ({ getBrainNativeDb: () => null }));
+    vi.doMock('../nexus-sqlite.js', () => ({ getNexusNativeDb: () => null }));
+    vi.doMock('../signaldock-sqlite.js', () => ({
+      getGlobalSignaldockNativeDb: () => null,
+      getGlobalSignaldockDbPath: () => '',
+    }));
+    vi.doMock('../global-salt.js', () => ({ getGlobalSaltPath: () => '' }));
+    vi.doMock('../../paths.js', () => ({
+      getCleoDir: () => cleoDir,
+      getCleoHome: () => cwd,
+    }));
+
+    const { vacuumIntoBackupAll } = await import('../sqlite-backup.js');
+    await vacuumIntoBackupAll({ cwd, force: true });
+
+    conduitDb.close();
+
+    const remaining = readdirSync(backupDir).filter((f) => /^conduit-\d{8}-\d{6}\.db$/.test(f));
+    // After adding the 12th (11 stale + 1 new), rotation must trim to ≤10
+    expect(remaining.length).toBeLessThanOrEqual(10);
+  });
+
+  /**
+   * TC-104: listSqliteBackupsAll returns a `conduit` key in its result map.
+   *
+   * @task T369
+   * @epic T310
+   */
+  it('TC-104: listSqliteBackupsAll returns conduit key in result map', async () => {
+    vi.resetModules();
+    const cwd = join(tmpdir(), `cleo-tc104-${Date.now()}`);
+    const cleoDir = join(cwd, '.cleo');
+    const backupDir = join(cleoDir, 'backups', 'sqlite');
+    mkdirSync(backupDir, { recursive: true });
+
+    // Write a fake conduit snapshot
+    writeFileSync(join(backupDir, 'conduit-20260101-120000.db'), 'fake-conduit');
+
+    vi.doMock('../sqlite.js', () => ({ getNativeDb: () => null, getDb: () => null }));
+    vi.doMock('../brain-sqlite.js', () => ({ getBrainNativeDb: () => null }));
+    vi.doMock('../conduit-sqlite.js', () => ({ getConduitNativeDb: () => null }));
+    vi.doMock('../nexus-sqlite.js', () => ({ getNexusNativeDb: () => null }));
+    vi.doMock('../signaldock-sqlite.js', () => ({
+      getGlobalSignaldockNativeDb: () => null,
+      getGlobalSignaldockDbPath: () => '',
+    }));
+    vi.doMock('../global-salt.js', () => ({ getGlobalSaltPath: () => '' }));
+    vi.doMock('../../paths.js', () => ({
+      getCleoDir: () => cleoDir,
+      getCleoHome: () => cwd,
+    }));
+
+    const { listSqliteBackupsAll } = await import('../sqlite-backup.js');
+    const all = listSqliteBackupsAll(cwd);
+
+    // The result map must include all three registered prefixes
+    expect(all).toHaveProperty('tasks');
+    expect(all).toHaveProperty('brain');
+    expect(all).toHaveProperty('conduit');
+
+    // The conduit entry should include the seeded fake file
+    expect(all['conduit']?.length).toBeGreaterThanOrEqual(1);
+    expect(all['conduit']?.[0]?.name).toBe('conduit-20260101-120000.db');
+  });
+
+  /**
+   * TC-105: listGlobalSqliteBackups('signaldock') returns only the global
+   * signaldock snapshots, not nexus ones.
+   *
+   * @task T369
+   * @epic T310
+   */
+  it('TC-105: listGlobalSqliteBackups(signaldock) returns only signaldock entries', async () => {
+    vi.resetModules();
+    const cleoHome = join(tmpdir(), `cleo-tc105-${Date.now()}`);
+    const backupDir = join(cleoHome, 'backups', 'sqlite');
+    mkdirSync(backupDir, { recursive: true });
+
+    vi.doMock('../../paths.js', () => ({ getCleoHome: () => cleoHome }));
+
+    // Write two signaldock and one nexus snapshot
+    writeFileSync(join(backupDir, 'signaldock-20260101-120000.db'), 'sd-1');
+    writeFileSync(join(backupDir, 'signaldock-20260102-120000.db'), 'sd-2');
+    writeFileSync(join(backupDir, 'nexus-20260101-120000.db'), 'nexus-1');
+
+    const { listGlobalSqliteBackups } = await import('../sqlite-backup.js');
+
+    const sdEntries = listGlobalSqliteBackups('signaldock', cleoHome);
+    const nexusEntries = listGlobalSqliteBackups('nexus', cleoHome);
+
+    // signaldock filter must return exactly the two signaldock files
+    expect(sdEntries.length).toBe(2);
+    expect(sdEntries.every((e) => e.name.startsWith('signaldock-'))).toBe(true);
+
+    // nexus filter must return exactly the one nexus file
+    expect(nexusEntries.length).toBe(1);
+    expect(nexusEntries[0]?.name).toBe('nexus-20260101-120000.db');
+
+    // Each entry has required fields
+    for (const e of sdEntries) {
+      expect(e.path).toBeTruthy();
+      expect(typeof e.size).toBe('number');
+      expect(e.mtime).toBeInstanceOf(Date);
+    }
+  });
 });

package/src/store/__tests__/sqlite-backup.test.ts

@@ -153,6 +153,7 @@ describe('sqlite-backup', () => {
   it('listSqliteBackups and listBrainBackups return prefix-specific entries newest-first', async () => {
     vi.doMock('../sqlite.js', () => ({ getNativeDb: () => null }));
     vi.doMock('../brain-sqlite.js', () => ({ getBrainNativeDb: () => null }));
+    vi.doMock('../conduit-sqlite.js', () => ({ getConduitNativeDb: () => null }));
     const tempDir = join(tmpdir(), `cleo-test-list-${Date.now()}`);
     const backupDir = join(tempDir, 'backups', 'sqlite');
     mkdirSync(backupDir, { recursive: true });
@@ -186,8 +187,11 @@ describe('sqlite-backup', () => {
       'tasks-20260101-120000.db',
     ]);
     expect(brainList.map((e) => e.name)).toEqual(['brain-20260103-120000.db']);
-    expect(Object.keys(all).sort()).toEqual(['brain', 'tasks']);
+    // conduit is now a registered prefix (T369); no conduit files exist in
+    // this temp dir so its bucket is empty but still present in the map.
+    expect(Object.keys(all).sort()).toEqual(['brain', 'conduit', 'tasks']);
     expect(all['tasks']?.length).toBe(2);
     expect(all['brain']?.length).toBe(1);
+    expect(all['conduit']?.length).toBe(0);
   });
 });