@indigoai-us/hq-cloud 6.11.11 → 6.11.13

package/src/cli/reindex.test.ts

@@ -18,14 +18,20 @@ import { lockPathFor, OPERATION_LOCKED_EXIT } from "../operation-lock.js";
 // HQ-B0: simulate the Windows filesystem rejecting a ':' in a path segment.
 // The flag is off by default, so every other test sees the real `mkdirSync`;
 // the regression test below flips it on only for its own run.
-const hoisted = vi.hoisted(() => ({ failNamespacedMkdir: false }));
+const hoisted = vi.hoisted(() => ({
+  failNamespacedMkdir: false,
+  // When set, any mkdir whose path contains this substring throws ENOENT —
+  // lets a test simulate a mkdir failure at a NON-wrapper site (e.g. the
+  // `.claude/skills` parent or a `core/<type>` mirror dir).
+  failMkdirContaining: "" as string,
+}));
 vi.mock("fs", async (importOriginal) => {
   const actual = await importOriginal<typeof import("fs")>();
   const mkdirSync = ((p: unknown, opts: unknown) => {
     if (
-      hoisted.failNamespacedMkdir &&
       typeof p === "string" &&
-      /[:][^/\\]*$/.test(p) // a colon in the final path segment
+      ((hoisted.failNamespacedMkdir && /[:][^/\\]*$/.test(p)) || // colon in final segment
+        (hoisted.failMkdirContaining !== "" && p.includes(hoisted.failMkdirContaining)))
     ) {
       throw Object.assign(
         new Error(`ENOENT: no such file or directory, mkdir '${p}'`),
@@ -269,4 +275,36 @@ describe("reindex", () => {
     expect(fs.existsSync(path.join(root, ".claude/skills/core:demo"))).toBe(false);
     expect(fs.existsSync(path.join(root, ".claude/skills/acme:widget"))).toBe(false);
   });
+
+  // ── HQ-B0 (residual): PR #98 guarded only the wrapper mkdir, leaving the
+  //    `.claude/skills` parent and the `core/<type>` mirror mkdirs unguarded.
+  //    A failure at EITHER must also degrade gracefully, not abort reindex.
+  it("does not abort reindex when the .claude/skills parent mkdir fails", () => {
+    writeSkill("core/skills/demo");
+
+    hoisted.failMkdirContaining = path.join(".claude", "skills");
+    try {
+      // The parent mkdir fails AND every recursive wrapper mkdir under it fails,
+      // so nothing is surfaced — but reindex must still complete cleanly.
+      expect(reindex({ repoRoot: root }).status).toBe(0);
+    } finally {
+      hoisted.failMkdirContaining = "";
+    }
+  });
+
+  it("does not abort reindex when a core/<type> mirror mkdir fails", () => {
+    writeSkill("core/skills/demo");
+    fs.mkdirSync(path.join(root, "personal/knowledge/my-kb"), { recursive: true });
+    fs.writeFileSync(path.join(root, "personal/knowledge/my-kb/note.md"), "n\n");
+
+    hoisted.failMkdirContaining = path.join("core", "knowledge");
+    try {
+      expect(reindex({ repoRoot: root }).status).toBe(0);
+    } finally {
+      hoisted.failMkdirContaining = "";
+    }
+
+    // The mirror for the failed type is skipped; skill surfacing still happened.
+    expect(fs.existsSync(path.join(root, ".claude/skills/core:demo"))).toBe(true);
+  });
 });

package/src/cli/reindex.ts

@@ -129,6 +129,31 @@ function warn(msg: string): void {
   process.stderr.write(`${msg}\n`);
 }
 
+// Create a directory (recursively), tolerating platform-specific mkdir
+// failures instead of aborting the whole reindex. The classic case (HQ-B0) is
+// a `<ns>:<skill>` wrapper whose ':' is a reserved drive/ADS separator on
+// Windows, where mkdirSync throws ENOENT — but any single mkdir failure (a
+// stray file in the slot, a permission hiccup) should degrade gracefully and
+// let the rest of the reindex proceed. Returns true on success; on failure it
+// logs a clear, actionable warning and returns false so the caller can skip
+// just that piece. PR #98 guarded only the wrapper mkdir; this guards every
+// mkdir site so no single one can crash `hq reindex`.
+function safeMkdir(dir: string, label: string): boolean {
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    return true;
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    warn(
+      `reindex: could not create ${label} '${dir}' ` +
+        `(${code ?? "error"}: ${(err as Error).message}); skipping. On Windows ` +
+        `this is usually an illegal path character (e.g. a ':' in a '<ns>:<skill>' ` +
+        `wrapper name).`,
+    );
+    return false;
+  }
+}
+
 // --- legacy `.claude/commands/<ns>/<skill>.md` symlink matcher --------------
 // Mirrors the bash `case` patterns; `*` matches any chars (including `/`).
 function isLegacyCommandTarget(t: string): boolean {
@@ -173,7 +198,10 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
   }
   try {
 
-  fs.mkdirSync(path.join(root, ".claude", "skills"), { recursive: true });
+  // Best-effort: each wrapper mkdir below is recursive and re-creates this
+  // parent as needed, so a failure here is non-fatal — warn and carry on so
+  // personal-overlay mirroring and registry regeneration still run.
+  safeMkdir(path.join(root, ".claude", "skills"), ".claude/skills directory");
 
   // --- Build (namespace, src_rel) pairs -------------------------------------
   const pairs: { ns: string; srcRel: string }[] = [];
@@ -270,23 +298,11 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
           /* best-effort */
         }
       }
-      try {
-        fs.mkdirSync(wrapper, { recursive: true });
-      } catch (err) {
-        // Namespaced wrappers embed a ':' in the directory name
-        // (`<ns>:<skill>`). That is a legal filename character on macOS/Linux
-        // but a reserved drive/ADS separator on Windows, so mkdir there fails
-        // with ENOENT. Skip this one wrapper with a clear message instead of
-        // aborting the whole reindex (the skill's source folder is untouched).
-        const code = (err as NodeJS.ErrnoException).code;
-        warn(
-          `reindex: could not create skill wrapper '${wrapperName}' ` +
-            `(${code ?? "error"}: ${(err as Error).message}). Namespaced wrappers ` +
-            `use a ':' in the directory name, which is not a legal filename ` +
-            `character on this platform (e.g. Windows); skipping this skill.`,
-        );
-        continue;
-      }
+      // Namespaced wrappers embed a ':' in the directory name (`<ns>:<skill>`),
+      // which is a reserved drive/ADS separator on Windows where mkdir fails
+      // with ENOENT (HQ-B0). Skip just this wrapper instead of aborting the
+      // whole reindex; the skill's source folder is untouched.
+      if (!safeMkdir(wrapper, `skill wrapper '${wrapperName}'`)) continue;
 
       // Symlink every (non-hidden) entry in the source skill folder. The
       // wrapper lives three levels below REPO_ROOT.
@@ -386,7 +402,7 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
     const coreDir = path.join(root, "core", type);
 
     if (!isDir(personalDir)) continue;
-    fs.mkdirSync(coreDir, { recursive: true });
+    if (!safeMkdir(coreDir, `core/${type} directory`)) continue;
 
     for (const entry of globEntries(personalDir)) {
       const entryPath = path.join(personalDir, entry);

package/src/cli/rescue-classify-ordering.test.ts

@@ -74,6 +74,41 @@ const lexists = (p: string) => {
   }
 };
 
+function hasRecoveryManifestFor(root: string, rel: string): boolean {
+  let found = false;
+  const interesting = /(recover|recovery|rollback|transaction|manifest|resume|rescue)/i;
+  const walk = (dir: string) => {
+    if (found) return;
+    let entries: fs.Dirent[];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    for (const ent of entries) {
+      if (found) return;
+      const abs = path.join(dir, ent.name);
+      if (ent.isDirectory()) {
+        walk(abs);
+        continue;
+      }
+      if (!ent.isFile()) continue;
+      const relPath = abs.slice(root.length + 1);
+      if (!interesting.test(relPath)) continue;
+      let body = "";
+      try {
+        body = fs.readFileSync(abs, "utf-8");
+      } catch {
+        body = "";
+      }
+      found = body.includes(rel) && interesting.test(`${relPath}\n${body}`);
+    }
+  };
+  walk(root);
+  return found;
+}
+
 describe.skipIf(!gitAvailable)("rescue classify-before-delete + dir-symlink handling", () => {
   let workDir: string;
   let upstream: string;
@@ -108,6 +143,8 @@ describe.skipIf(!gitAvailable)("rescue classify-before-delete + dir-symlink hand
     git(workDir, "init", "-b", "main", "upstream");
     fs.writeFileSync(path.join(upstream, "core/a.md"), "v1\n");
     fs.writeFileSync(path.join(upstream, "core/b.md"), "beta\n");
+    fs.mkdirSync(path.join(upstream, "core/blocker"), { recursive: true });
+    fs.writeFileSync(path.join(upstream, "core/blocker/second.md"), "upstream\n");
     git(upstream, "add", "-A");
     git(upstream, "commit", "-m", "floor");
     floorSha = git(upstream, "rev-parse", "HEAD");
@@ -267,6 +304,50 @@ exec ${JSON.stringify(realGit)} "$@"
     expect(fs.existsSync(path.join(hqRoot, "core/zzz.md"))).toBe(true);
   });
 
+  it("dry-run emits prior plan lines before a classifier fault aborts the walk", () => {
+    const hqRoot = makeHqRoot();
+    fs.writeFileSync(path.join(hqRoot, "core/zzz.md"), "trigger\n");
+
+    const r = runRescueCapture(liveArgs(hqRoot, ["--dry-run"]), {
+      ...baseEnv,
+      HQ_RESCUE_FAULT_AT_REL: "core/zzz.md",
+    });
+    const out = `${r.stdout}\n${r.stderr}`;
+
+    expect(r.threw, out).toBeDefined();
+    expect(String(r.threw)).toMatch(/fault injected at core\/zzz\.md/);
+    expect(out).toContain("unchanged (delete + replace): core/a.md");
+    expect(out).toContain("unchanged (preserved in place): core/b.md");
+    expect(out).not.toMatch(/DRY RUN classification summary/);
+    expect(fs.existsSync(path.join(hqRoot, "core/a.md"))).toBe(true);
+    expect(fs.readFileSync(path.join(hqRoot, "core/a.md"), "utf-8")).toBe("v1\n");
+    expect(fs.existsSync(path.join(hqRoot, "core/zzz.md"))).toBe(true);
+  });
+
+  it("F12: rolls back or records recovery when an apply action fails after earlier destructive actions", () => {
+    const hqRoot = makeHqRoot();
+    fs.mkdirSync(path.join(hqRoot, "core/blocker"), { recursive: true });
+    fs.writeFileSync(path.join(hqRoot, "core/blocker/second.md"), "local edit\n");
+    fs.writeFileSync(path.join(hqRoot, "personal/blocker"), "not a directory\n");
+
+    const firstDeletedByApply = path.join(hqRoot, "core/a.md");
+    const firstOriginal = fs.readFileSync(firstDeletedByApply, "utf-8");
+    const r = runRescueCapture(liveArgs(hqRoot), baseEnv);
+    const out = `${r.stdout}\n${r.stderr}\n${String(r.threw ?? "")}`;
+
+    const applyFailed = r.threw !== undefined || (r.status !== undefined && r.status !== 0);
+    expect(applyFailed, out).toBe(true);
+    expect(fs.existsSync(path.join(hqRoot, "core/blocker/second.md")), out).toBe(true);
+
+    const firstActionRolledBack =
+      fs.existsSync(firstDeletedByApply) &&
+      fs.readFileSync(firstDeletedByApply, "utf-8") === firstOriginal;
+    expect(
+      firstActionRolledBack || hasRecoveryManifestFor(hqRoot, "core/a.md"),
+      `${out}\ncore/a.md was deleted without rollback or a recovery/transaction manifest`,
+    ).toBe(true);
+  });
+
   it("dry-run classifies the dir-symlink identically to the live run and changes nothing", () => {
     const hqRoot = makeHqRoot();
     const target = path.join(hqRoot, "personal/knowledge/ad-creative-engine");