@indigoai-us/hq-cloud 6.11.18 → 6.11.20

package/src/cli/share.ts

@@ -1156,14 +1156,7 @@ async function executeUploads(
       remoteMeta = await headRemoteFile(run.ctx, relativePath);
     } catch (headErr) {
       if (isAccessDenied(headErr)) {
-        run.emit({
-          type: "error",
-          path: relativePath,
-          message:
-            "skipped: outside granted ACL scope (server returned 403 " +
-            "SCOPE_EXCEEDS_PARENT / access denied on HEAD). Grant this path " +
-            "to push it, or it stays local-only.",
-        });
+        run.scopeExcludedSet.add(relativePath);
         return;
       }
       throw headErr;
@@ -1325,16 +1318,14 @@ async function executeUploads(
         counters.filesSkipped++;
         return;
       }
+      if (isAccessDenied(err)) {
+        run.scopeExcludedSet.add(relativePath);
+        return;
+      }
       run.emit({
         type: "error",
         path: relativePath,
-        message: isAccessDenied(err)
-          ? "skipped: outside granted ACL scope (server returned 403 " +
-            "SCOPE_EXCEEDS_PARENT / access denied on PUT). Grant this path " +
-            "to push it, or it stays local-only."
-          : err instanceof Error
-            ? err.message
-            : String(err),
+        message: err instanceof Error ? err.message : String(err),
       });
     }
   };
@@ -2256,12 +2247,25 @@ async function computeDeletePlan(
   for (let i = 0; i < headCandidates.length; i += DELETE_PLAN_HEAD_CONCURRENCY) {
     const chunk = headCandidates.slice(i, i + DELETE_PLAN_HEAD_CONCURRENCY);
     const results = await Promise.all(
-      chunk.map(async (c) => ({
-        candidate: c,
-        remote: await headRemoteFile(ctx, c.key),
-      })),
+      chunk.map(async (c) => {
+        try {
+          return {
+            candidate: c,
+            remote: await headRemoteFile(ctx, c.key),
+            scopeExcluded: false,
+          };
+        } catch (err) {
+          if (isAccessDenied(err)) {
+            return { candidate: c, remote: null, scopeExcluded: true };
+          }
+          throw err;
+        }
+      }),
     );
-    for (const { candidate, remote } of results) {
+    for (const { candidate, remote, scopeExcluded } of results) {
+      if (scopeExcluded) {
+        continue;
+      }
       if (remote === null) {
         plan.toTombstone.push(candidate.key);
         continue;

package/src/company-resolver.test.ts

@@ -4,7 +4,7 @@
  * the trailing-slash sibling boundary, and the unattributed (no-match) path.
  */
 
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, afterEach } from "vitest";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";

package/src/ignore.test.ts

@@ -49,6 +49,19 @@ describe("createIgnoreFilter", () => {
     expect(shouldSync(path.join(hqRoot, "node_modules/react/index.js"))).toBe(false);
   });
 
+  it("repos/ exclusion is root-anchored to hqRoot (DEV-1791)", () => {
+    const shouldSync = createIgnoreFilter(hqRoot);
+    expect(shouldSync(path.join(hqRoot, "repos/private/hq-cloud/src/x.ts"))).toBe(false);
+    expect(shouldSync(path.join(hqRoot, "repos/public/hq-core/README.md"))).toBe(false);
+    expect(
+      shouldSync(path.join(hqRoot, "companies/lutiq/knowledge/repos/dev-docs-mcp/overview.md")),
+    ).toBe(true);
+    expect(shouldSync(path.join(hqRoot, "companies/indigo/knowledge/repos/foo/notes.md"))).toBe(
+      true,
+    );
+    expect(shouldSync(path.join(hqRoot, "companies/lutiq/knowledge/repos"), true)).toBe(true);
+  });
+
   it("permissive mode: .hqignore patterns are honored", () => {
     fs.writeFileSync(path.join(hqRoot, ".hqignore"), "companies/*/data/\n");
     const shouldSync = createIgnoreFilter(hqRoot);

package/src/ignore.ts

@@ -119,8 +119,11 @@ export const DEFAULT_IGNORES = [
   "**/.claude/state/",
   "**/.claude/audit/",
 
-  // HQ repos directory (managed separately, not synced)
-  "repos/",
+  // HQ repos directory (managed separately, not synced). Root-anchored so
+  // only hqRoot/repos/ is excluded; bare `repos/` would match any nested
+  // directory named repos (for example companies/<co>/knowledge/repos/),
+  // silently dropping discover-generated knowledge (DEV-1791).
+  "/repos/",
 
   // Secrets / env
   ".env",

package/src/lib/conflict-file.ts

@@ -76,6 +76,6 @@ export function buildConflictId(
   detectedAt: string,
 ): string {
   const safeTs = detectedAt.replace(/:/g, "-").replace(/\.\d+/, "");
-  const safePath = originalRelative.replace(/[\/\\.]/g, "-");
+  const safePath = originalRelative.replace(/[/\\.]/g, "-");
   return `${safePath}-${safeTs}`;
 }

package/src/prefix-coalesce.ts

@@ -42,10 +42,6 @@ const SCOPE_PREFIX_MARKER = "\u0000hq-scope:";
 const SCOPE_PREFIX_MARKER_PREFIX = `${SCOPE_PREFIX_MARKER}prefix`;
 const SCOPE_PREFIX_MARKER_EXACT = `${SCOPE_PREFIX_MARKER}exact`;
 
-function isScopePrefixEntry(value: ScopePrefixInput): value is ScopePrefixEntry {
-  return typeof value !== "string";
-}
-
 function inferStringMatch(prefix: string): ScopePrefixMatch {
   return prefix === "" || prefix.endsWith("/") ? "prefix" : "exact";
 }

package/src/s3.test.ts

@@ -294,8 +294,6 @@ describe("uploadFile", () => {
   it("preserves the existing created-at on re-upload (NEW-pill ageing window)", async () => {
     // First upload happened a week ago; second run must keep that timestamp
     // so the hq-console "NEW" pill doesn't reset on every sync tick.
-    const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000).toISOString();
-
     // Override the FakeS3Client's HeadObject to return the legacy timestamp
     // for this one test. The mock factory returns a fresh object per send
     // invocation so we patch at the class level via a one-shot wrapper.

package/src/sync/push-receiver.test.ts

@@ -22,7 +22,7 @@
  * fake SQS client / in-memory fanout.
  */
 
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { describe, expect, it } from "vitest";
 
 import { encodePushEvent, type PushEvent } from "./push-event.js";
 import { StaticFlagProvider } from "./feature-flags.js";

package/src/vault-client.test.ts

@@ -830,6 +830,26 @@ describe("listMyExplicitGrants (US-004)", () => {
     expect(init.body).toBeUndefined();
   });
 
+  it("parses creator-sourced grants", async () => {
+    const grant: ExplicitGrant = {
+      companyUid: "cmp_abc",
+      path: "personal/psn_creator",
+      permission: "admin",
+      source: "creator",
+    };
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        grants: [grant],
+        computedAt: "2026-05-20T12:00:00.000Z",
+      }),
+    );
+
+    const grants = await client.listMyExplicitGrants("cmp_abc");
+
+    expect(grants[0]?.source).toBe("creator");
+    expect(grants).toEqual([grant]);
+  });
+
   it("URL-encodes the companyUid query parameter", async () => {
     fetchSpy.mockResolvedValueOnce(
       jsonResponse(200, { grants: [], computedAt: "2026-05-20T12:00:00.000Z" }),

package/src/vault-client.ts

@@ -187,7 +187,7 @@ export interface CreateEntityResult {
  * `granteeType: 'company-wide'` row. Both mean "every active member of
  * this company sees this prefix".
  */
-export type GrantSource = "person" | "email" | "group" | "open";
+export type GrantSource = "creator" | "person" | "email" | "group" | "open";
 
 /** Permission level surfaced on a grant row. Matches `AclPermission`. */
 export type GrantPermission = "read" | "write" | "admin";
@@ -478,7 +478,7 @@ type VaultResponseSchema<T> = z.ZodType<T>;
 const membershipRoleSchema = z.enum(["owner", "admin", "member", "guest"]);
 const membershipStatusSchema = z.enum(["pending", "active", "revoked"]);
 const grantPermissionSchema = z.enum(["read", "write", "admin"]);
-const grantSourceSchema = z.enum(["person", "email", "group", "open"]);
+const grantSourceSchema = z.enum(["creator", "person", "email", "group", "open"]);
 const presignOpSchema = z.enum(["get", "put", "delete"]);
 const syncModeSchema = z.enum(["shared", "all", "custom"]);
 const vendPurposeSchema = z.enum(["sync", "browse"]);