@indigoai-us/hq-cloud 6.11.19 → 6.12.0

package/dist/cli/share.test.js

@@ -831,7 +831,7 @@ describe("share", () => {
         expect(putKeys).not.toContain("settings/.gitkeep");
         expect(putKeys).not.toContain("projects/.gitkeep");
     });
-    it("scoped push defense-in-depth: a 403 on HEAD skips that key (named error) instead of aborting the company", async () => {
+    it("scoped push defense-in-depth: a 403 on HEAD skips that key as scope-excluded without an error event", async () => {
         // Belt-and-suspenders: even if a key slips past the prefix filter (a grant
         // that changed mid-run, a pin outside the grant, prefix-coalesce
         // imprecision), the server's correct 403 on the HEAD must NOT abort the
@@ -866,20 +866,72 @@ describe("share", () => {
         expect(result.filesUploaded).toBe(1);
         const putKeys = vi.mocked(uploadFile).mock.calls.map((c) => c[2]);
         expect(putKeys).toEqual(["in-scope.md"]);
-        // The blocked key surfaced as a path-named, scope-clear error event.
+        expect(result.filesExcludedByScope).toBe(1);
+        const scopeEv = events.find((e) => e.type === "scope-excluded");
+        expect(scopeEv).toBeDefined();
+        expect(scopeEv.count).toBe(1);
+        expect(scopeEv.samplePaths).toEqual(["out-of-reach.md"]);
+        expect(events.some((e) => e.type === "error")).toBe(false);
+    });
+    it("scoped push defense-in-depth: a 403 on PUT skips that key as scope-excluded without an error event", async () => {
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        fs.mkdirSync(companyRoot, { recursive: true });
+        const blockedFile = path.join(companyRoot, "put-denied.md");
+        fs.writeFileSync(blockedFile, "denied\n");
+        vi.mocked(uploadFile).mockImplementation(async (_ctx, _abs, key) => {
+            if (key === "put-denied.md") {
+                const err = new Error("access denied");
+                err.name = "AccessDenied";
+                throw err;
+            }
+            return { etag: '"upload-etag"' };
+        });
+        const events = [];
+        const result = await share({
+            paths: [blockedFile],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            onEvent: (e) => events.push(e),
+        });
+        expect(result.aborted).toBe(false);
+        expect(result.filesUploaded).toBe(0);
+        expect(result.filesExcludedByScope).toBe(1);
+        const scopeEv = events.find((e) => e.type === "scope-excluded");
+        expect(scopeEv).toBeDefined();
+        expect(scopeEv.count).toBe(1);
+        expect(scopeEv.samplePaths).toEqual(["put-denied.md"]);
+        expect(events.some((e) => e.type === "error")).toBe(false);
+    });
+    it("scoped push defense-in-depth: a non-access-denied PUT failure still emits an error event", async () => {
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        fs.mkdirSync(companyRoot, { recursive: true });
+        const failedFile = path.join(companyRoot, "put-failed.md");
+        fs.writeFileSync(failedFile, "failed\n");
+        vi.mocked(uploadFile).mockRejectedValueOnce(new Error("S3 down"));
+        const events = [];
+        const result = await share({
+            paths: [failedFile],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            onEvent: (e) => events.push(e),
+        });
+        expect(result.filesUploaded).toBe(0);
+        expect(result.filesExcludedByScope).toBe(0);
         const errs = events.filter((e) => e.type === "error");
         expect(errs).toHaveLength(1);
-        expect(errs[0].path).toBe("out-of-reach.md");
-        expect(errs[0].message).toMatch(/outside granted ACL scope/i);
+        expect(errs[0].path).toBe("put-failed.md");
+        expect(errs[0].message).toBe("S3 down");
     });
-    it("a Forbidden HEAD (presigned-transport denial) skips the key — NEVER an unconditional PUT", async () => {
+    it("a Forbidden HEAD (presigned-transport denial) skips the key as scope-excluded — NEVER an unconditional PUT", async () => {
         // Regression for the 2026-06-10..12 vault regression storm: the presigned
         // transport used to map per-key denials and signed-GET 403s to `null`,
         // which `processUploadItem` read as "no remote object" — skipping every
         // conflict guard and blind-PUTting this machine's (possibly stale) bytes
         // over a newer remote. The transport now throws `name: "Forbidden"`
         // (SDK HeadObject parity); this locks the share side of that contract:
-        // a Forbidden HEAD must skip the key, emit a named error, and issue NO PUT.
+        // a Forbidden HEAD must skip the key as scope-excluded and issue NO PUT.
         const companyRoot = path.join(tmpDir, "companies", "acme");
         fs.mkdirSync(companyRoot, { recursive: true });
         const staleFile = path.join(companyRoot, "stale-local.md");
@@ -901,9 +953,11 @@ describe("share", () => {
         expect(vi.mocked(uploadFile)).not.toHaveBeenCalled();
         expect(result.filesUploaded).toBe(0);
         expect(result.aborted).toBe(false);
-        const errs2 = events.filter((e) => e.type === "error");
-        expect(errs2).toHaveLength(1);
-        expect(errs2[0].path).toBe("stale-local.md");
+        expect(result.filesExcludedByScope).toBe(1);
+        const scopeEv = events.find((e) => e.type === "scope-excluded");
+        expect(scopeEv).toBeDefined();
+        expect(scopeEv.samplePaths).toEqual(["stale-local.md"]);
+        expect(events.some((e) => e.type === "error")).toBe(false);
     });
     it("uploads (no conflict) when only the local side changed since last sync", async () => {
         // Regression for hq-cloud#<conflict-detection>: a local edit to a file