@indigoai-us/hq-cli 5.26.0 → 5.29.0

package/dist/lib/local-tree-diff.js

@@ -24,7 +24,7 @@
  * for the destructive side effects (delete, tombstone, PUT sync-config).
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="77563dec-63f2-52df-9138-c88bfd1600b9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="20a280f3-0fed-5868-9ad4-fcc562253486")}catch(e){}}();
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { hashFile, isCoveredByAny, } from "@indigoai-us/hq-cloud";
@@ -55,7 +55,16 @@ export function buildNarrowPlan(input) {
     if (!fs.existsSync(walkRoot)) {
         return emptyPlan();
     }
-    walkLocal(walkRoot, hqRoot, (file) => {
+    // Walk with `walkRoot` as the rel-root so each file's `relPath` is
+    // COMPANY-RELATIVE (e.g. `meetings/a.md`) — the same namespace as the
+    // server's explicit-grant paths, the per-company journal keys, and the
+    // hq-cloud sync engine's `RemoteFile.key`. Computing it relative to `hqRoot`
+    // (the old behavior) produced `companies/<slug>/meetings/a.md`, which
+    // matched neither the company-relative grants nor the journal keys — so
+    // every file fell out of `prospectivePrefixSet` AND missed its journal
+    // entry, making narrow flag the entire tree as dirty orphans. See the
+    // namespace contract in hq-cloud `scope-shrink.ts` / `prefix-coalesce.ts`.
+    walkLocal(walkRoot, walkRoot, (file) => {
         if (isCoveredByAny(file.relPath, prospectivePrefixSet)) {
             staying.push(file);
             return;
@@ -100,7 +109,10 @@ function emptyPlan() {
  * Uses `lstat` rather than `stat` so a symlink's size doesn't follow the
  * target chain (matches the share-engine convention).
  */
-function walkLocal(dir, hqRoot, emit) {
+function walkLocal(dir, 
+// Rel-root for `relPath` — the company walk root (`<hqRoot>/companies/<slug>`),
+// so emitted `relPath`s are company-relative. Fixed across recursion.
+relRoot, emit) {
     let entries;
     try {
         entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -115,7 +127,7 @@ function walkLocal(dir, hqRoot, emit) {
     }
     for (const entry of entries) {
         const absPath = path.join(dir, entry.name);
-        const relPath = path.relative(hqRoot, absPath);
+        const relPath = path.relative(relRoot, absPath);
         if (entry.isSymbolicLink()) {
             // Record the link as a file-like entry. Don't descend — narrow is
             // about pruning files that the LOCAL tree has materialized here; a
@@ -132,7 +144,7 @@ function walkLocal(dir, hqRoot, emit) {
             continue;
         }
         if (entry.isDirectory()) {
-            walkLocal(absPath, hqRoot, emit);
+            walkLocal(absPath, relRoot, emit);
             continue;
         }
         if (entry.isFile()) {
@@ -241,4 +253,4 @@ export function formatBytes(n) {
     return `${v.toFixed(2)} ${units[i]}`;
 }
 //# sourceMappingURL=local-tree-diff.js.map
-//# debugId=77563dec-63f2-52df-9138-c88bfd1600b9
+//# debugId=20a280f3-0fed-5868-9ad4-fcc562253486

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.26.0",
+  "version": "5.29.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -15,7 +15,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "~5.39.0",
+    "@indigoai-us/hq-cloud": "~5.43.0",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",

package/src/commands/files-browse.test.ts

@@ -1,17 +1,22 @@
 /**
  * Unit tests for `hq files browse` + `hq files cat` (files-browse.ts).
  *
- * Stubs VaultClient.vend / listMyExplicitGrants / entity.findInMyNamespace
- * and the S3 client so we cover the three acceptance criteria the unit
- * suite is responsible for (acceptance 6):
+ * Stubs the multi-tenant STS vend routes (`sts.vend` / `sts.vendSelf`),
+ * listMyExplicitGrants, entity.findInMyNamespace/get, and the S3 client.
+ * Coverage focus:
  *
- *   1. vend uses `purpose: 'browse'` (NOT `'sync'`) for both subcommands.
- *   2. `--out` refuses any destination under `<hqRoot>/companies/`.
- *   3. ACL-source classification: keys with a covering explicit grant →
- *      `shared-with-you`; keys with no covering grant → `role-bypass`.
+ *   1. Browse/cat vend via `/sts/vend` (company) and `/sts/vend-self`
+ *      (personal) — NOT the legacy `POST /vend`, which is non-functional in
+ *      multi-tenant prod (undefined BUCKET_ARN → MalformedPolicyDocument).
+ *   2. Namespace translation: company vault keys are company-relative, so the
+ *      S3 list/get prefix is the bucket-relative form while the CLI surface
+ *      stays anchored at `companies/<slug>/`.
+ *   3. `--out` refuses any destination under `<hqRoot>/companies/`.
+ *   4. ACL-source classification over the company-relative key space.
  *
- * Plus the pure helpers (parseCompanySlugFromPath, classifyAclSource,
- * assertOutPathOutsideCompanies, formatBrowseTable).
+ * Plus the pure helpers (parseCompanySlugFromPath, toBucketRelative,
+ * toCompanyAnchored, classifyAclSource, assertOutPathOutsideCompanies,
+ * formatBrowseTable).
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -25,13 +30,19 @@ import {
   classifyAclSource,
   formatBrowseTable,
   parseCompanySlugFromPath,
+  toBucketRelative,
+  toCompanyAnchored,
   runBrowse,
   runCat,
+  runSharedWithMe,
+  formatSharedWithMeTable,
+  type BrowseVendResult,
   type FilesBrowseS3Client,
   type FilesBrowseVaultClient,
+  type FilesSharedWithMeVaultClient,
   type S3ClientFactory,
 } from "./files-browse.js";
-import type { ExplicitGrant, VendResult } from "@indigoai-us/hq-cloud";
+import type { ExplicitGrant } from "@indigoai-us/hq-cloud";
 import {
   ListObjectsV2Command,
   GetObjectCommand,
@@ -65,24 +76,17 @@ function fakeGrant(p: string): ExplicitGrant {
   };
 }
 
-function fakeVendResult(overrides: Partial<VendResult> = {}): VendResult {
+function fakeStsVend(): BrowseVendResult {
   return {
     credentials: {
       accessKeyId: "ASIA-test",
       secretAccessKey: "secret-test",
       sessionToken: "session-test",
-      expiration: new Date(Date.now() + 900_000).toISOString(),
     },
-    paths: ["companies/indigo/"],
-    operations: "read-only",
-    purpose: "browse",
-    policySize: 512,
-    ...overrides,
   };
 }
 
 interface StubVaultOpts {
-  vend?: VendResult;
   grants?: ExplicitGrant[];
   entity?:
     | { uid: string; slug: string; name?: string; bucketName?: string }
@@ -92,7 +96,8 @@ interface StubVaultOpts {
 function makeStubVaultClient(opts: StubVaultOpts = {}): {
   client: FilesBrowseVaultClient;
   spies: {
-    vend: ReturnType<typeof vi.fn>;
+    stsVend: ReturnType<typeof vi.fn>;
+    vendSelf: ReturnType<typeof vi.fn>;
     listMyExplicitGrants: ReturnType<typeof vi.fn>;
     findInMyNamespace: ReturnType<typeof vi.fn>;
   };
@@ -106,7 +111,8 @@ function makeStubVaultClient(opts: StubVaultOpts = {}): {
           name: "Indigo",
           bucketName: "hq-vault-cmp-indigo",
         });
-  const vend = vi.fn(async () => opts.vend ?? fakeVendResult());
+  const stsVend = vi.fn(async () => fakeStsVend());
+  const vendSelf = vi.fn(async () => fakeStsVend());
   const listMyExplicitGrants = vi.fn(async () => opts.grants ?? []);
   const findInMyNamespace = vi.fn(async () => entity);
   const get = vi.fn(async (uid: string) => {
@@ -114,11 +120,14 @@ function makeStubVaultClient(opts: StubVaultOpts = {}): {
     return entity;
   });
   const client: FilesBrowseVaultClient = {
-    vend,
+    sts: { vend: stsVend, vendSelf },
     listMyExplicitGrants,
     entity: { get, findInMyNamespace },
   };
-  return { client, spies: { vend, listMyExplicitGrants, findInMyNamespace } };
+  return {
+    client,
+    spies: { stsVend, vendSelf, listMyExplicitGrants, findInMyNamespace },
+  };
 }
 
 interface StubS3Opts {
@@ -171,36 +180,83 @@ describe("parseCompanySlugFromPath", () => {
   });
 });
 
+// ── toBucketRelative / toCompanyAnchored (namespace translation) ────────────
+
+describe("toBucketRelative", () => {
+  it("strips the companies/<slug>/ anchor to a company-relative key", () => {
+    expect(toBucketRelative("companies/indigo/knowledge/foo.md", "indigo")).toBe(
+      "knowledge/foo.md",
+    );
+  });
+
+  it("strips the anchor for a bare prefix (trailing slash preserved)", () => {
+    expect(toBucketRelative("companies/indigo/scratch/", "indigo")).toBe(
+      "scratch/",
+    );
+  });
+
+  it("yields empty string for the bare company root", () => {
+    expect(toBucketRelative("companies/indigo/", "indigo")).toBe("");
+  });
+
+  it("tolerates leading slashes", () => {
+    expect(toBucketRelative("/companies/indigo/x/y", "indigo")).toBe("x/y");
+  });
+
+  it("passes through a path that lacks the anchor (e.g. already relative)", () => {
+    expect(toBucketRelative("knowledge/foo.md", "indigo")).toBe(
+      "knowledge/foo.md",
+    );
+  });
+
+  it("does not strip a different company's anchor", () => {
+    expect(toBucketRelative("companies/acme/x", "indigo")).toBe(
+      "companies/acme/x",
+    );
+  });
+});
+
+describe("toCompanyAnchored", () => {
+  it("re-attaches the companies/<slug>/ anchor", () => {
+    expect(toCompanyAnchored("knowledge/foo.md", "indigo")).toBe(
+      "companies/indigo/knowledge/foo.md",
+    );
+  });
+
+  it("round-trips with toBucketRelative", () => {
+    const anchored = "companies/indigo/a/b/c.md";
+    expect(toCompanyAnchored(toBucketRelative(anchored, "indigo"), "indigo")).toBe(
+      anchored,
+    );
+  });
+});
+
 // ── classifyAclSource ───────────────────────────────────────────────────────
 
 describe("classifyAclSource", () => {
-  it("returns shared-with-you when any grant prefixes the key", () => {
-    const grants = [fakeGrant("companies/indigo/scratch/")];
-    expect(
-      classifyAclSource("companies/indigo/scratch/foo.txt", grants),
-    ).toBe("shared-with-you");
+  it("returns shared-with-you when any grant prefix covers the key", () => {
+    expect(classifyAclSource("scratch/foo.txt", ["scratch/"])).toBe(
+      "shared-with-you",
+    );
   });
 
-  it("returns role-bypass when no grant covers the key", () => {
-    const grants = [fakeGrant("companies/indigo/scratch/")];
-    expect(
-      classifyAclSource("companies/indigo/secrets/db.txt", grants),
-    ).toBe("role-bypass");
+  it("returns role-bypass when no grant prefix covers the key", () => {
+    expect(classifyAclSource("secrets/db.txt", ["scratch/"])).toBe(
+      "role-bypass",
+    );
   });
 
   it("returns role-bypass on an empty grant list", () => {
-    expect(classifyAclSource("companies/indigo/anything/x", [])).toBe(
-      "role-bypass",
-    );
+    expect(classifyAclSource("anything/x", [])).toBe("role-bypass");
   });
 
-  it("matches against the first covering grant — multiple grants are fine", () => {
-    const grants = [
-      fakeGrant("companies/other/"),
-      fakeGrant("companies/indigo/scratch/"),
-    ];
+  it("treats an empty-string prefix as a company-wide grant (shared)", () => {
+    expect(classifyAclSource("anything/x", [""])).toBe("shared-with-you");
+  });
+
+  it("matches against the first covering prefix — multiple are fine", () => {
     expect(
-      classifyAclSource("companies/indigo/scratch/sub/y.bin", grants),
+      classifyAclSource("scratch/sub/y.bin", ["other/", "scratch/"]),
     ).toBe("shared-with-you");
   });
 });
@@ -297,9 +353,9 @@ describe("formatBrowseTable", () => {
 // ── runBrowse ───────────────────────────────────────────────────────────────
 
 describe("runBrowse", () => {
-  it("vends with purpose='browse' (NOT 'sync') for the requested prefix", async () => {
+  it("vends via /sts/vend (company) and lists the company-relative prefix", async () => {
     const { client, spies } = makeStubVaultClient({});
-    const { factory } = makeStubS3Factory({
+    const { factory, sendSpy } = makeStubS3Factory({
       listResponses: [{ Contents: [] }],
     });
     await runBrowse({
@@ -308,29 +364,32 @@ describe("runBrowse", () => {
       s3Factory: factory,
       region: "us-east-1",
     });
-    expect(spies.vend).toHaveBeenCalledTimes(1);
-    const arg = spies.vend.mock.calls[0][0];
-    expect(arg.purpose).toBe("browse");
-    expect(arg.purpose).not.toBe("sync");
-    expect(arg.operations).toBe("read-only");
-    expect(arg.paths).toEqual(["companies/indigo/scratch/"]);
+    // Vend through the multi-tenant STS route — NOT the legacy POST /vend.
+    expect(spies.stsVend).toHaveBeenCalledTimes(1);
+    expect(spies.stsVend.mock.calls[0][0]).toEqual({ companyUid: "cmp_indigo" });
+    expect(spies.vendSelf).not.toHaveBeenCalled();
+    // S3 list prefix is company-relative (the bug: was anchored → 0 results).
+    const listCmd = sendSpy.mock.calls[0][0] as ListObjectsV2Command;
+    expect(listCmd.input.Prefix).toBe("scratch/");
   });
 
-  it("paginates ListObjectsV2 fully and classifies each key's ACL source", async () => {
+  it("paginates ListObjectsV2 fully, classifies ACL, and re-anchors keys for display", async () => {
     const { client } = makeStubVaultClient({
-      grants: [fakeGrant("companies/indigo/scratch/")],
+      // Real grants are glob/anchored; normalization folds this to "scratch/".
+      grants: [fakeGrant("companies/indigo/scratch/*")],
     });
     const { factory, sendSpy } = makeStubS3Factory({
+      // S3 keys are company-relative (no companies/<slug>/ prefix).
       listResponses: [
         {
           Contents: [
             {
-              Key: "companies/indigo/scratch/a.txt",
+              Key: "scratch/a.txt",
               Size: 10,
               LastModified: new Date("2026-01-01T00:00:00Z"),
             },
             {
-              Key: "companies/indigo/secrets/db.txt",
+              Key: "secrets/db.txt",
               Size: 20,
               LastModified: new Date("2026-01-02T00:00:00Z"),
             },
@@ -340,13 +399,13 @@ describe("runBrowse", () => {
         {
           Contents: [
             {
-              Key: "companies/indigo/scratch/sub/b.bin",
+              Key: "scratch/sub/b.bin",
               Size: 30,
               LastModified: new Date("2026-01-03T00:00:00Z"),
             },
             // S3 directory marker — should be filtered out.
             {
-              Key: "companies/indigo/scratch/empty/",
+              Key: "scratch/empty/",
               Size: 0,
               LastModified: new Date("2026-01-04T00:00:00Z"),
             },
@@ -362,6 +421,7 @@ describe("runBrowse", () => {
     });
     expect(sendSpy).toHaveBeenCalledTimes(2); // pagination
     expect(result.rows).toHaveLength(3);
+    // Displayed keys are re-anchored to companies/<slug>/.
     const byKey = Object.fromEntries(result.rows.map((r) => [r.key, r]));
     expect(byKey["companies/indigo/scratch/a.txt"].aclSource).toBe(
       "shared-with-you",
@@ -391,13 +451,11 @@ describe("runBrowse", () => {
   // ── personalMode (hq-cli#26) ──────────────────────────────────────────────
   //
   // Personal mode resolves the entity via `entity.get(personalUid)` (skipping
-  // the company-namespace lookup), omits the explicit-grants fetch, and tags
-  // every row with `aclSource: "personal-vault"`. The path arg is bucket-
-  // relative — companies/<slug>/ prefix is NOT required (and would be
-  // incorrect, since the person bucket is owner-only with no companies/
-  // subtree).
+  // the company-namespace lookup), vends via `/sts/vend-self`, omits the
+  // explicit-grants fetch, and tags every row `aclSource: "personal-vault"`.
+  // The path arg is bucket-relative — companies/<slug>/ prefix is NOT required.
 
-  it("personalMode: resolves entity via entity.get(personalUid), skips namespace lookup", async () => {
+  it("personalMode: resolves via entity.get, vends /sts/vend-self, skips namespace + grants", async () => {
     const { client, spies } = makeStubVaultClient({
       entity: {
         uid: "prs_test",
@@ -428,10 +486,9 @@ describe("runBrowse", () => {
     expect(spies.findInMyNamespace).not.toHaveBeenCalled();
     // Grants graph is a company concept — must not be fetched.
     expect(spies.listMyExplicitGrants).not.toHaveBeenCalled();
-    // Vend still issued for browse purpose, no policy difference.
-    expect(spies.vend).toHaveBeenCalledWith(
-      expect.objectContaining({ purpose: "browse", operations: "read-only" }),
-    );
+    // Personal vends self, never the company route.
+    expect(spies.vendSelf).toHaveBeenCalledWith({ personUid: "prs_test" });
+    expect(spies.stsVend).not.toHaveBeenCalled();
   });
 
   it("personalMode: empty pathPrefix lists the bucket root", async () => {
@@ -537,9 +594,9 @@ describe("runBrowse", () => {
 // ── runCat ──────────────────────────────────────────────────────────────────
 
 describe("runCat", () => {
-  it("vends with purpose='browse' for a cat call", async () => {
+  it("vends via /sts/vend and GetObjects the company-relative key", async () => {
     const { client, spies } = makeStubVaultClient({});
-    const { factory } = makeStubS3Factory({
+    const { factory, sendSpy } = makeStubS3Factory({
       getResponse: {
         Body: Readable.from(Buffer.from("hello world")),
       } as GetObjectCommandOutput,
@@ -554,8 +611,14 @@ describe("runCat", () => {
       hqRoot: tmpRoot,
       stdout: sink,
     });
-    expect(spies.vend).toHaveBeenCalledTimes(1);
-    expect(spies.vend.mock.calls[0][0].purpose).toBe("browse");
+    expect(spies.stsVend).toHaveBeenCalledTimes(1);
+    expect(spies.stsVend.mock.calls[0][0]).toEqual({ companyUid: "cmp_indigo" });
+    // GetObject key is company-relative (anchor stripped).
+    const getCmd = sendSpy.mock.calls.find(
+      (c) => c[0] instanceof GetObjectCommand,
+    )?.[0] as GetObjectCommand;
+    expect(getCmd.input.Bucket).toBe("hq-vault-cmp-indigo");
+    expect(getCmd.input.Key).toBe("scratch/a.txt");
   });
 
   it("writes to --out when outside the companies tree and reports byte count", async () => {
@@ -598,7 +661,8 @@ describe("runCat", () => {
     ).rejects.toThrow(/Refusing to write/);
     // Critically: no vend was issued (guard runs first) and no S3 call
     // was made — failing closed is the whole point of the guard.
-    expect(spies.vend).not.toHaveBeenCalled();
+    expect(spies.stsVend).not.toHaveBeenCalled();
+    expect(spies.vendSelf).not.toHaveBeenCalled();
     expect(sendSpy).not.toHaveBeenCalled();
     // And no file was written under the protected tree.
     expect(fs.existsSync(badOut)).toBe(false);
@@ -620,7 +684,7 @@ describe("runCat", () => {
 
   // ── personalMode (hq-cli#26) ──────────────────────────────────────────────
 
-  it("personalMode: streams from the person bucket, no slug parse on the key", async () => {
+  it("personalMode: streams from the person bucket via /sts/vend-self, no slug parse", async () => {
     const { client, spies } = makeStubVaultClient({
       entity: { uid: "prs_test", slug: "personal", bucketName: "hq-vault-prs-test" },
     });
@@ -654,14 +718,10 @@ describe("runCat", () => {
 
     expect(result.destination.kind).toBe("stdout");
     expect(spies.findInMyNamespace).not.toHaveBeenCalled();
-    // Vend issued against the bucket-relative key, browse purpose.
-    expect(spies.vend).toHaveBeenCalledWith(
-      expect.objectContaining({
-        paths: [".claude/CLAUDE.md"],
-        purpose: "browse",
-      }),
-    );
-    // GetObject targeted the person bucket.
+    // Personal vends self, against the bucket-relative key.
+    expect(spies.vendSelf).toHaveBeenCalledWith({ personUid: "prs_test" });
+    expect(spies.stsVend).not.toHaveBeenCalled();
+    // GetObject targeted the person bucket with the bucket-relative key.
     const getCmd = sendSpy.mock.calls.find(
       (c) => c[0] instanceof GetObjectCommand,
     )?.[0] as GetObjectCommand;
@@ -685,3 +745,89 @@ describe("runCat", () => {
     ).rejects.toThrow(/personalMode requires personalUid/);
   });
 });
+
+// ── runSharedWithMe ──────────────────────────────────────────────────────────
+
+function sharedWithMeClient(opts: {
+  memberships?: Array<{ companyUid: string }>;
+  grantsByCompany?: Record<string, ExplicitGrant[]>;
+  slugByUid?: Record<string, string>;
+}): FilesSharedWithMeVaultClient {
+  return {
+    listMyMemberships: async () => opts.memberships ?? [],
+    listMyExplicitGrants: async (companyUid: string) =>
+      opts.grantsByCompany?.[companyUid] ?? [],
+    entity: {
+      get: async (uid: string) => ({
+        uid,
+        slug: opts.slugByUid?.[uid] ?? uid,
+      }),
+    },
+  };
+}
+
+describe("runSharedWithMe", () => {
+  it("lists explicit grants for a single company (companyUid supplied)", async () => {
+    const rows = await runSharedWithMe({
+      vaultClient: sharedWithMeClient({
+        grantsByCompany: {
+          cmp_indigo: [fakeGrant("knowledge/"), fakeGrant("reports/q3.pdf")],
+        },
+      }),
+      companyUid: "cmp_indigo",
+      companySlug: "indigo",
+    });
+    expect(rows).toEqual([
+      { companySlug: "indigo", path: "knowledge/", permission: "read", source: "person" },
+      { companySlug: "indigo", path: "reports/q3.pdf", permission: "read", source: "person" },
+    ]);
+  });
+
+  it("rolls up across every membership when no company is supplied", async () => {
+    const rows = await runSharedWithMe({
+      vaultClient: sharedWithMeClient({
+        memberships: [{ companyUid: "cmp_b" }, { companyUid: "cmp_a" }],
+        slugByUid: { cmp_a: "acme", cmp_b: "beta" },
+        grantsByCompany: {
+          cmp_a: [fakeGrant("docs/")],
+          cmp_b: [fakeGrant("shared/")],
+        },
+      }),
+    });
+    // Sorted by company slug, then path.
+    expect(rows.map((r) => [r.companySlug, r.path])).toEqual([
+      ["acme", "docs/"],
+      ["beta", "shared/"],
+    ]);
+  });
+
+  it("skips a company whose grant fetch throws (best-effort roll-up)", async () => {
+    const client: FilesSharedWithMeVaultClient = {
+      listMyMemberships: async () => [{ companyUid: "cmp_ok" }, { companyUid: "cmp_bad" }],
+      listMyExplicitGrants: async (uid: string) => {
+        if (uid === "cmp_bad") throw new Error("boom");
+        return [fakeGrant("ok/")];
+      },
+      entity: { get: async (uid: string) => ({ uid, slug: uid }) },
+    };
+    const rows = await runSharedWithMe({ vaultClient: client });
+    expect(rows).toEqual([
+      { companySlug: "cmp_ok", path: "ok/", permission: "read", source: "person" },
+    ]);
+  });
+
+  it("formats an empty result with the role-bypass caveat", () => {
+    const out = formatSharedWithMeTable([]);
+    expect(out).toContain("Nothing is explicitly shared with you");
+    expect(out).toContain("role-bypass");
+  });
+
+  it("formats rows as a table with company + path + permission + source", () => {
+    const out = formatSharedWithMeTable([
+      { companySlug: "indigo", path: "knowledge/", permission: "read", source: "person" },
+    ]);
+    expect(out).toContain("COMPANY");
+    expect(out).toContain("indigo");
+    expect(out).toContain("knowledge/");
+  });
+});