@indigoai-us/hq-cloud 5.38.0 → 5.40.0

package/dist/bin/sync-runner.test.js

@@ -138,7 +138,7 @@ describe("argv parsing", () => {
         const deps = makeDeps();
         const code = await runRunner([], deps);
         expect(code).toBe(1);
-        expect(deps.stderr.raw()).toContain("--companies or --company");
+        expect(deps.stderr.raw()).toContain("--personal");
         expect(deps.stdout.events()).toEqual([]);
     });
     it("rejects --companies + --company together", async () => {
@@ -200,15 +200,23 @@ describe("auth", () => {
         ]);
         expect(deps.stdout.events()).toEqual([]);
     });
-    it("emits error event on stderr and returns 1 on non-auth discovery failure", async () => {
+    it("emits error event on stderr and returns 1 on non-auth discovery failure (after 3 attempts)", async () => {
+        let calls = 0;
         const deps = makeDeps({
             createVaultClient: () => ({
                 ...makeVaultStub(),
-                listMyMemberships: () => Promise.reject(new Error("network down")),
+                listMyMemberships: () => {
+                    calls++;
+                    return Promise.reject(new Error("network down"));
+                },
             }),
         });
         const code = await runRunner(["--companies"], deps);
         expect(code).toBe(1);
+        // Memberships retry burns all 3 attempts before surfacing the error —
+        // see listMembershipsWithRetry. Auth errors short-circuit (no retry);
+        // anything else (network, 5xx) retries twice more before giving up.
+        expect(calls).toBe(3);
         // error events go to stderr, not stdout
         const events = deps.stderr.events();
         expect(events).toHaveLength(1);
@@ -221,6 +229,96 @@ describe("auth", () => {
     });
 });
 // ---------------------------------------------------------------------------
+// memberships retry (3x with backoff, then abort)
+// ---------------------------------------------------------------------------
+//
+// `listMyMemberships()` is the single API call that drives every fanout
+// target in --companies mode. A transient network blip on this one call
+// shouldn't kill the whole sync — retry 3 times with backoff before
+// surfacing the error. Auth failures short-circuit (no retries — the
+// caller needs to re-vend, retries won't help).
+//
+// Single-company mode bypasses memberships entirely (the caller already
+// told us which company), so no retry path is needed there.
+describe("memberships retry", () => {
+    it("succeeds on 1st attempt with no retry", async () => {
+        let listCalls = 0;
+        const stub = makeVaultStub();
+        stub.listMyMemberships = () => {
+            listCalls++;
+            return Promise.resolve([{ companyUid: "cmp_acme" }]);
+        };
+        const deps = makeDeps({ createVaultClient: () => stub });
+        const code = await runRunner(["--companies"], deps);
+        expect(code).toBe(0);
+        expect(listCalls).toBe(1);
+    });
+    it("succeeds on 3rd attempt after 2 transient failures", async () => {
+        let listCalls = 0;
+        const stub = makeVaultStub();
+        stub.listMyMemberships = () => {
+            listCalls++;
+            if (listCalls < 3) {
+                return Promise.reject(new Error("ECONNRESET"));
+            }
+            return Promise.resolve([{ companyUid: "cmp_acme" }]);
+        };
+        const deps = makeDeps({ createVaultClient: () => stub });
+        const code = await runRunner(["--companies"], deps);
+        expect(code).toBe(0);
+        expect(listCalls).toBe(3);
+        // No error event should reach stderr — the retry succeeded.
+        expect(deps.stderr.events().some((e) => e.type === "error")).toBe(false);
+    });
+    it("exhausts 3 retries on persistent failure, then emits error event + exit 1", async () => {
+        let listCalls = 0;
+        const stub = makeVaultStub();
+        stub.listMyMemberships = () => {
+            listCalls++;
+            return Promise.reject(new Error("network down"));
+        };
+        const deps = makeDeps({ createVaultClient: () => stub });
+        const code = await runRunner(["--companies"], deps);
+        expect(code).toBe(1);
+        expect(listCalls).toBe(3);
+        const events = deps.stderr.events();
+        expect(events).toHaveLength(1);
+        expect(events[0]).toMatchObject({
+            type: "error",
+            message: expect.stringContaining("network down"),
+            path: "(discovery)",
+        });
+    });
+    it("VaultAuthError short-circuits retry (no retries on auth failure)", async () => {
+        let listCalls = 0;
+        const stub = makeVaultStub();
+        stub.listMyMemberships = () => {
+            listCalls++;
+            return Promise.reject(new VaultAuthError("token expired"));
+        };
+        const deps = makeDeps({ createVaultClient: () => stub });
+        const code = await runRunner(["--companies"], deps);
+        expect(code).toBe(0);
+        // Auth failures don't retry — re-vending creds is the caller's job.
+        expect(listCalls).toBe(1);
+        expect(deps.stderr.events()).toEqual([
+            { type: "auth-error", message: "token expired" },
+        ]);
+    });
+    it("single-company mode bypasses listMyMemberships entirely (no retry path triggered)", async () => {
+        let listCalls = 0;
+        const stub = makeVaultStub();
+        stub.listMyMemberships = () => {
+            listCalls++;
+            return Promise.reject(new Error("should not be called"));
+        };
+        const deps = makeDeps({ createVaultClient: () => stub });
+        const code = await runRunner(["--company", "cmp_explicit"], deps);
+        expect(code).toBe(0);
+        expect(listCalls).toBe(0);
+    });
+});
+// ---------------------------------------------------------------------------
 // claim-dance (first sign-in)
 // ---------------------------------------------------------------------------
 describe("claim-dance", () => {
@@ -380,6 +478,198 @@ describe("target resolution", () => {
     });
 });
 // ---------------------------------------------------------------------------
+// --personal mode (personal-vault-only, skip company fanout)
+// ---------------------------------------------------------------------------
+//
+// `--personal` is mutually exclusive with `--companies` and `--company`. It
+// runs ONLY the personal-vault target — no listMyMemberships call, no
+// claim-dance, no cloud-company fanout. Designed as the replacement
+// pathway for Rust's `personal.rs::run_personal_first_push` (the menubar's
+// first-push), so the entire personal-vault walker lives in one place
+// (hq-cloud TS) and not in two duplicate engines.
+describe("--personal mode", () => {
+    it("argv: --personal + --companies is rejected", async () => {
+        const deps = makeDeps();
+        const code = await runRunner(["--personal", "--companies"], deps);
+        expect(code).toBe(1);
+        expect(deps.stderr.raw()).toContain("mutually exclusive");
+    });
+    it("argv: --personal + --company X is rejected", async () => {
+        const deps = makeDeps();
+        const code = await runRunner(["--personal", "--company", "cmp_x"], deps);
+        expect(code).toBe(1);
+        expect(deps.stderr.raw()).toContain("mutually exclusive");
+    });
+    it("argv: --personal + --skip-personal is rejected (contradictory)", async () => {
+        const deps = makeDeps();
+        const code = await runRunner(["--personal", "--skip-personal"], deps);
+        expect(code).toBe(1);
+        expect(deps.stderr.raw()).toContain("contradictory");
+    });
+    it("does NOT call listMyMemberships (skips company-discovery API entirely)", async () => {
+        const listSpy = vi.fn();
+        const deps = makeDeps({
+            createVaultClient: () => ({
+                ...makeVaultStub({
+                    listPersons: () => Promise.resolve([
+                        {
+                            uid: "ent_person_1",
+                            type: "person",
+                            bucketName: "hq-vault-personal-1",
+                            status: "active",
+                        },
+                    ]),
+                }),
+                listMyMemberships: listSpy,
+            }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(0);
+        expect(listSpy).not.toHaveBeenCalled();
+    });
+    it("does NOT run claim-dance (skips pending-invites + ensurePerson)", async () => {
+        const claimSpy = vi.fn();
+        const ensureSpy = vi.fn();
+        const deps = makeDeps({
+            createVaultClient: () => ({
+                ...makeVaultStub({
+                    listPersons: () => Promise.resolve([
+                        {
+                            uid: "ent_person_1",
+                            type: "person",
+                            bucketName: "hq-vault-personal-1",
+                            status: "active",
+                        },
+                    ]),
+                }),
+                claimPendingInvitesByEmail: claimSpy,
+                ensureMyPersonEntity: ensureSpy,
+            }),
+            getIdTokenClaims: () => ({
+                sub: "sub-abc",
+                email: "user@example.com",
+                name: "User Name",
+            }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(0);
+        expect(claimSpy).not.toHaveBeenCalled();
+        expect(ensureSpy).not.toHaveBeenCalled();
+    });
+    it("emits fanout-plan with exactly one personal entry", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                listPersons: () => Promise.resolve([
+                    {
+                        uid: "ent_person_1",
+                        type: "person",
+                        bucketName: "hq-vault-personal-1",
+                        status: "active",
+                    },
+                ]),
+            }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(0);
+        const plan = deps.stdout
+            .events()
+            .find((e) => e.type === "fanout-plan");
+        expect(plan).toBeDefined();
+        expect(plan.companies).toHaveLength(1);
+        expect(plan.companies[0]).toMatchObject({ slug: "personal" });
+    });
+    it("calls syncFn ONCE with personalMode=true (default direction=pull)", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                listPersons: () => Promise.resolve([
+                    {
+                        uid: "ent_person_1",
+                        type: "person",
+                        bucketName: "hq-vault-personal-1",
+                        status: "active",
+                    },
+                ]),
+            }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(0);
+        expect(deps.sync).toHaveBeenCalledTimes(1);
+        const call = deps.sync.mock
+            .calls[0][0];
+        expect(call.personalMode).toBe(true);
+    });
+    it("--personal --direction push calls shareFn with personalMode + computePersonalVaultPaths", async () => {
+        const shareSpy = vi.fn().mockResolvedValue({
+            filesUploaded: 0,
+            bytesUploaded: 0,
+            filesSkipped: 0,
+            filesDeleted: 0,
+            conflictPaths: [],
+            aborted: false,
+        });
+        const deps = makeDeps({
+            share: shareSpy,
+            createVaultClient: () => makeVaultStub({
+                listPersons: () => Promise.resolve([
+                    {
+                        uid: "ent_person_1",
+                        type: "person",
+                        bucketName: "hq-vault-personal-1",
+                        status: "active",
+                    },
+                ]),
+            }),
+        });
+        const code = await runRunner(["--personal", "--direction", "push"], deps);
+        expect(code).toBe(0);
+        expect(shareSpy).toHaveBeenCalledTimes(1);
+        const opts = shareSpy.mock.calls[0][0];
+        expect(opts.personalMode).toBe(true);
+        // paths come from computePersonalVaultPaths — non-empty array of
+        // absolute hqRoot-anchored paths. Don't pin the exact contents
+        // (depends on hqRoot's local layout); just confirm the shape.
+        expect(Array.isArray(opts.paths)).toBe(true);
+    });
+    it("no person entity → emits setup-needed event, exit 0 (same shape as --companies)", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                listPersons: () => Promise.resolve([]),
+            }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(0);
+        expect(deps.stdout.events().some((e) => e.type === "setup-needed")).toBe(true);
+        expect(deps.sync).not.toHaveBeenCalled();
+    });
+    it("--personal honors --direction both (calls both shareFn and syncFn)", async () => {
+        const shareSpy = vi.fn().mockResolvedValue({
+            filesUploaded: 0,
+            bytesUploaded: 0,
+            filesSkipped: 0,
+            filesDeleted: 0,
+            conflictPaths: [],
+            aborted: false,
+        });
+        const deps = makeDeps({
+            share: shareSpy,
+            createVaultClient: () => makeVaultStub({
+                listPersons: () => Promise.resolve([
+                    {
+                        uid: "ent_person_1",
+                        type: "person",
+                        bucketName: "hq-vault-personal-1",
+                        status: "active",
+                    },
+                ]),
+            }),
+        });
+        const code = await runRunner(["--personal", "--direction", "both"], deps);
+        expect(code).toBe(0);
+        expect(shareSpy).toHaveBeenCalledTimes(1);
+        expect(deps.sync).toHaveBeenCalledTimes(1);
+    });
+});
+// ---------------------------------------------------------------------------
 // fanout-plan
 // ---------------------------------------------------------------------------
 describe("fanout-plan", () => {