@indigoai-us/hq-cloud 6.11.1 → 6.11.3

package/dist/bin/sync-runner.test.js

@@ -2657,6 +2657,25 @@ describe("resolvePullScope", () => {
         }), "cmp_a", "acme");
         expect(scope).toEqual({ syncMode: "all" });
     });
+    it("returns all for an AGENT membership WITHOUT calling sync-config (HQ-1R: agents own no person entity → server 403s the person-gate)", async () => {
+        let called = false;
+        const scope = await resolvePullScope(stubClient({
+            listMyMemberships: async () => [membership("cmp_a", "agt_007#cmp_a")],
+            // Even if the server WOULD return a scoped config, the guard must
+            // short-circuit BEFORE the call (the real endpoint 403s an agent).
+            getMembershipSyncConfig: async () => {
+                called = true;
+                return {
+                    membershipId: "agt_007#cmp_a",
+                    syncMode: "custom",
+                    customPaths: ["secret/"],
+                    isDefault: false,
+                };
+            },
+        }), "cmp_a", "acme");
+        expect(called).toBe(false); // never hit the always-403 endpoint for an agent
+        expect(scope).toEqual({ syncMode: "all" });
+    });
     it("coalesces explicit grants for a shared-mode membership", async () => {
         const scope = await resolvePullScope(stubClient({
             listMyMemberships: async () => [membership("cmp_a", "mk_a")],