@indigoai-us/hq-cloud 6.11.20 → 6.12.0

package/src/personal-vault.test.ts

@@ -1,14 +1,17 @@
 /**
  * Unit tests for the personal-vault path-discovery helpers.
  *
- * These cover the column-anchored `cloud: false` marker regex and the
- * `companies/{slug}/` enumeration filter — both are pure functions over
+ * These cover the column-anchored `cloud: true` exclusion-marker regex and
+ * the `companies/{slug}/` enumeration filter — both are pure functions over
  * disk + caller-supplied option sets, so we exercise them against tmp
- * directories rather than mocking fs.
+ * directories rather than mocking fs. Local (non-cloud) companies sync to
+ * the personal vault by DEFAULT: a missing/markerless `company.yaml` is
+ * INCLUDED; only an explicit `cloud: true` marker (or membership via
+ * `teamSyncedSlugs`) opts a company out.
  *
- * The sync-runner-level integration (env-var gate, team-synced slug
- * derivation, end-to-end share() invocation) lives in
- * `bin/sync-runner.test.ts` — tests G, H, I.
+ * The sync-runner-level integration (team-synced slug derivation,
+ * decommission of cloud-promoted companies, end-to-end share() invocation)
+ * lives in `bin/sync-runner.test.ts` — tests G, H, I.
  */
 
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
@@ -63,108 +66,125 @@ describe("personal-vault helpers", () => {
     expect(PERSONAL_VAULT_COMPANY_EXCLUDED_SLUGS).toContain("_template");
   });
 
-  // ── computePersonalCompanySubdirs: marker-regex acceptance ─────────────
-  it("marker: accepts canonical `cloud: false` at column 0", () => {
-    writeCompany("foo", "cloud: false\nname: Foo\n");
+  // ── computePersonalCompanySubdirs: default inclusion ───────────────────
+  // Local companies sync to the personal vault by default. A missing or
+  // markerless company.yaml is INCLUDED — only an explicit `cloud: true`
+  // marker (or membership) opts a company OUT.
+  it("default: includes a company with NO company.yaml", () => {
+    writeCompany("foo", null);
     expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
       path.join("companies", "foo"),
     ]);
   });
 
-  it("marker: accepts `cloud:false` (no space after colon)", () => {
-    writeCompany("foo", "cloud:false\n");
+  it("default: includes a company with an empty company.yaml", () => {
+    writeCompany("foo", "");
     expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
       path.join("companies", "foo"),
     ]);
   });
 
-  it("marker: accepts trailing comment after `cloud: false`", () => {
-    writeCompany("foo", "cloud: false   # local-only, never upload to team\n");
+  it("default: includes a company explicitly marked `cloud: false`", () => {
+    writeCompany("foo", "cloud: false\nname: Foo\n");
     expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
       path.join("companies", "foo"),
     ]);
   });
 
-  it("marker: accepts CRLF line endings", () => {
-    writeCompany("foo", "cloud: false\r\nname: Foo\r\n");
+  it("default: includes a company.yaml with no `cloud:` key at all", () => {
+    writeCompany("foo", "name: Foo\nslug: foo\n");
     expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
       path.join("companies", "foo"),
     ]);
   });
 
-  it("marker: accepts `cloud: false` even when it is NOT the first line", () => {
-    writeCompany("foo", "name: Foo\nslug: foo\ncloud: false\n");
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
+  // ── computePersonalCompanySubdirs: `cloud: true` exclusion-marker ──────
+  it("marker: excludes canonical `cloud: true` at column 0", () => {
+    writeCompany("foo", "cloud: true\nname: Foo\n");
+    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
   });
 
-  // ── computePersonalCompanySubdirs: marker-regex rejection ──────────────
-  it("marker: rejects `cloud: true`", () => {
-    writeCompany("foo", "cloud: true\n");
+  it("marker: excludes `cloud:true` (no space after colon)", () => {
+    writeCompany("foo", "cloud:true\n");
     expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
   });
 
-  it("marker: rejects missing company.yaml entirely", () => {
-    writeCompany("foo", null);
+  it("marker: excludes with a trailing comment after `cloud: true`", () => {
+    writeCompany("foo", "cloud: true   # cloud-backed, synced to team bucket\n");
     expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
   });
 
-  it("marker: rejects empty company.yaml", () => {
-    writeCompany("foo", "");
+  it("marker: excludes with CRLF line endings", () => {
+    writeCompany("foo", "cloud: true\r\nname: Foo\r\n");
     expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
   });
 
-  it("marker: rejects nested `cloud: false` (column-0 anchor — false-positive guard)", () => {
-    // Regression for an audit finding: an earlier `^[ \t]*cloud:` regex
-    // allowed arbitrary leading whitespace, which silently matched
-    // nested keys like `meta.cloud = false`. The tightened `^cloud:` regex
-    // rejects this, matching the canonical column-0 shape that
-    // `/designate-team`'s awk emits.
-    writeCompany("foo", "meta:\n  cloud: false\n");
+  it("marker: excludes `cloud: true` even when it is NOT the first line", () => {
+    writeCompany("foo", "name: Foo\nslug: foo\ncloud: true\n");
     expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
   });
 
-  it("marker: rejects list-item style `- cloud: false`", () => {
-    writeCompany("foo", "tags:\n- cloud: false\n");
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
+  // ── computePersonalCompanySubdirs: marker fails OPEN (still included) ───
+  // A marker that isn't the canonical column-0 lowercase `cloud: true`
+  // shape `/designate-team` emits does NOT exclude — the company stays in
+  // the personal vault, which is the safe default.
+  it("marker: nested `cloud: true` does NOT exclude (column-0 anchor)", () => {
+    writeCompany("foo", "meta:\n  cloud: true\n");
+    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
+      path.join("companies", "foo"),
+    ]);
   });
 
-  it("marker: rejects flow-mapping `{ cloud: false }`", () => {
-    writeCompany("foo", "{ cloud: false }\n");
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
+  it("marker: list-item style `- cloud: true` does NOT exclude", () => {
+    writeCompany("foo", "tags:\n- cloud: true\n");
+    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
+      path.join("companies", "foo"),
+    ]);
+  });
+
+  it("marker: flow-mapping `{ cloud: true }` does NOT exclude", () => {
+    writeCompany("foo", "{ cloud: true }\n");
+    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
+      path.join("companies", "foo"),
+    ]);
   });
 
-  it("marker: rejects YAML-alt boolean spellings (False, FALSE, no, off)", () => {
-    for (const variant of ["cloud: False\n", "cloud: FALSE\n", "cloud: no\n", "cloud: off\n"]) {
+  it("marker: YAML-alt boolean spellings (True, TRUE, yes, on) do NOT exclude", () => {
+    for (const variant of ["cloud: True\n", "cloud: TRUE\n", "cloud: yes\n", "cloud: on\n"]) {
       writeCompany("foo", variant);
-      expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
+      expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
+        path.join("companies", "foo"),
+      ]);
       fs.rmSync(path.join(hqRoot, "companies", "foo"), { recursive: true });
     }
   });
 
-  it("marker: rejects quoted `cloud: \"false\"` (the quote breaks the literal-false match)", () => {
-    writeCompany("foo", 'cloud: "false"\n');
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
+  it("marker: quoted `cloud: \"true\"` does NOT exclude (quote breaks the literal-true match)", () => {
+    writeCompany("foo", 'cloud: "true"\n');
+    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
+      path.join("companies", "foo"),
+    ]);
   });
 
-  it("marker: rejects `cloud: falsehood` (word-boundary guard)", () => {
-    writeCompany("foo", "cloud: falsehood\n");
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
+  it("marker: `cloud: truthy` does NOT exclude (word-boundary guard)", () => {
+    writeCompany("foo", "cloud: truthy\n");
+    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
+      path.join("companies", "foo"),
+    ]);
   });
 
   // ── Subdir-level filters ───────────────────────────────────────────────
-  it("filter: skips _template even with cloud:false marker", () => {
-    writeCompany("_template", "cloud: false\n");
-    writeCompany("real", "cloud: false\n");
+  it("filter: skips _template even when it would otherwise be included", () => {
+    writeCompany("_template", null);
+    writeCompany("real", null);
     expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
       path.join("companies", "real"),
     ]);
   });
 
-  it("filter: skips slugs in the teamSyncedSlugs set", () => {
-    writeCompany("free", "cloud: false\n");
-    writeCompany("team-acme", "cloud: false\n");
+  it("filter: skips slugs in the teamSyncedSlugs set (cloud-backed)", () => {
+    writeCompany("free", null);
+    writeCompany("team-acme", null);
     expect(
       rel(computePersonalCompanySubdirs(hqRoot, new Set(["team-acme"]))),
     ).toEqual([path.join("companies", "free")]);
@@ -175,7 +195,7 @@ describe("personal-vault helpers", () => {
     // crash, should not be enumerated as a company subdir.
     fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
     fs.writeFileSync(path.join(hqRoot, "companies", "README.md"), "# README");
-    writeCompany("real", "cloud: false\n");
+    writeCompany("real", null);
     expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
       path.join("companies", "real"),
     ]);
@@ -187,40 +207,31 @@ describe("personal-vault helpers", () => {
   });
 
   // ── computePersonalVaultPaths: top-level + company-subdir composition ──
-  it("composition: includeLocalCompanies=false skips companies/ entirely", () => {
+  it("composition: local company subdirs are included by default (no opt-in flag)", () => {
     fs.mkdirSync(path.join(hqRoot, ".claude"));
     fs.mkdirSync(path.join(hqRoot, "knowledge"));
-    writeCompany("foo", "cloud: false\n");
+    writeCompany("foo", null);
+    writeCompany("bar", "cloud: true\n");
 
     const out = rel(computePersonalVaultPaths(hqRoot));
-    // Top-level entries present, no companies/* subdir.
+    // Top-level entries present.
     expect(out).toContain(".claude");
     expect(out).toContain("knowledge");
-    expect(out.some((p) => p.startsWith("companies"))).toBe(false);
-  });
-
-  it("composition: includeLocalCompanies=true adds opt-in company subdirs", () => {
-    fs.mkdirSync(path.join(hqRoot, "knowledge"));
-    writeCompany("foo", "cloud: false\n");
-    writeCompany("bar", "cloud: true\n");
-
-    const out = rel(computePersonalVaultPaths(hqRoot, { includeLocalCompanies: true }));
-    expect(out).toContain("knowledge");
+    // Local (non-cloud) company included; cloud-marked one excluded.
     expect(out).toContain(path.join("companies", "foo"));
     expect(out).not.toContain(path.join("companies", "bar"));
     // The companies/ top-level entry itself is never present — only specific
-    // opted-in subdirs. Preserves the invariant that share() never walks
+    // eligible subdirs. Preserves the invariant that share() never walks
     // the whole companies/ tree under personalMode.
     expect(out).not.toContain("companies");
   });
 
-  it("composition: includeLocalCompanies=true + teamSyncedSlugs filter combine correctly", () => {
-    writeCompany("foo", "cloud: false\n");
-    writeCompany("synced", "cloud: false\n");
+  it("composition: teamSyncedSlugs filter excludes cloud-backed companies", () => {
+    writeCompany("foo", null);
+    writeCompany("synced", null);
 
     const out = rel(
       computePersonalVaultPaths(hqRoot, {
-        includeLocalCompanies: true,
         teamSyncedSlugs: new Set(["synced"]),
       }),
     );
@@ -230,7 +241,7 @@ describe("personal-vault helpers", () => {
 
   it("composition: missing hqRoot returns []", () => {
     fs.rmSync(hqRoot, { recursive: true });
-    expect(computePersonalVaultPaths(hqRoot, { includeLocalCompanies: true })).toEqual([]);
+    expect(computePersonalVaultPaths(hqRoot)).toEqual([]);
   });
 
   // ── companies/manifest.yaml inclusion ─────────────────────────────────
@@ -254,16 +265,14 @@ describe("personal-vault helpers", () => {
     expect(out).toContain(".claude");
   });
 
-  it("manifest: included even when includeLocalCompanies=false (manifest is unconditional)", () => {
+  it("manifest: included even when there are no eligible company subdirs", () => {
     fs.mkdirSync(path.join(hqRoot, "companies"));
     fs.writeFileSync(
       path.join(hqRoot, "companies", "manifest.yaml"),
       "companies: {}\n",
     );
 
-    const out = rel(
-      computePersonalVaultPaths(hqRoot, { includeLocalCompanies: false }),
-    );
+    const out = rel(computePersonalVaultPaths(hqRoot));
     expect(out).toContain(path.join("companies", "manifest.yaml"));
   });
 
@@ -303,18 +312,17 @@ describe("personal-vault helpers", () => {
     expect(out).not.toContain(path.join("companies", "README.md"));
   });
 
-  it("manifest: composes with includeLocalCompanies=true + local company subdirs", () => {
+  it("manifest: composes with local company subdirs", () => {
     fs.mkdirSync(path.join(hqRoot, "companies"));
     fs.writeFileSync(
       path.join(hqRoot, "companies", "manifest.yaml"),
       "companies:\n  foo: {cloud_uid: null}\n  team-acme: {cloud_uid: cmp_01XYZ}\n",
     );
-    writeCompany("foo", "cloud: false\n");
+    writeCompany("foo", null);
     writeCompany("team-acme", "cloud: true\n");
 
     const out = rel(
       computePersonalVaultPaths(hqRoot, {
-        includeLocalCompanies: true,
         teamSyncedSlugs: new Set(["team-acme"]),
       }),
     );
@@ -344,7 +352,7 @@ describe("personal-vault helpers", () => {
     expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
 
     // Push set carries the real manifest, never the conflict litter.
-    const out = rel(computePersonalVaultPaths(hqRoot, { includeLocalCompanies: true }));
+    const out = rel(computePersonalVaultPaths(hqRoot));
     expect(out).toContain(path.join("companies", "manifest.yaml"));
     expect(
       out.some((p) => p.includes("manifest.yaml.conflict-")),

package/src/personal-vault.ts

@@ -17,11 +17,13 @@
  *   - `companies/`: the top-level `companies/` directory is never enumerated
  *     wholesale. Team-backed companies are synced by the runner's
  *     per-membership fanout (one bucket per company). Individual
- *     `companies/{slug}/` subdirs MAY be added back via
- *     `computePersonalCompanySubdirs()` for companies that explicitly
- *     declare `cloud: false` in `company.yaml` and are not in the operator's
- *     team-synced membership set — those land under the personal bucket as
- *     `companies/{slug}/...` keys.
+ *     `companies/{slug}/` subdirs are added back via
+ *     `computePersonalCompanySubdirs()` for every LOCAL (non-cloud) company
+ *     — i.e. any company that is not in the operator's team-synced membership
+ *     set and is not explicitly marked `cloud: true` in `company.yaml`. Those
+ *     land under the personal bucket as `companies/{slug}/...` keys. (The
+ *     single `companies/manifest.yaml` is also carved in unconditionally as
+ *     the routing source-of-truth.)
  *   - `repos/`, `workspace/`: per user directive — heavy local-only
  *     content (cloned remotes, session threads) that has no business in
  *     the personal vault.
@@ -63,19 +65,12 @@ export interface PersonalVaultOptions {
    * Slugs of companies that already have their own team bucket (i.e. the
    * operator has an active Membership row for them). These are excluded
    * from the personal-bucket fallback so a single company's content never
-   * ends up in two buckets.
+   * ends up in two buckets. This membership-derived set is the single
+   * "cloud-backed" signal: when a company becomes cloud-true (gains an
+   * active membership), its slug lands here and the personal vault both
+   * stops pushing it and decommissions its stale copy.
    */
   teamSyncedSlugs?: ReadonlySet<string>;
-  /**
-   * When true, walk `companies/` and include subdirs that explicitly opt in
-   * via `cloud: false` in their `company.yaml` (after applying the standard
-   * filter: exclude `_template`, exclude team-synced slugs). When false
-   * (the default), `companies/` is never enumerated — same as the legacy
-   * personal-vault scope. Gated behind a runtime flag so the new behavior
-   * stays opt-in until operators explicitly request it via
-   * `HQ_SYNC_LOCAL_COMPANIES_TO_PERSONAL=1`.
-   */
-  includeLocalCompanies?: boolean;
 }
 
 /**
@@ -84,10 +79,12 @@ export interface PersonalVaultOptions {
  * Two sources are concatenated:
  *   1. Every top-level entry under `hqRoot` whose basename is NOT in
  *      `PERSONAL_VAULT_EXCLUDED_TOP_LEVEL`.
- *   2. Every `companies/{slug}/` subdir that opts into the personal
- *      bucket via `company.yaml: cloud: false`, after excluding (a)
- *      `_template`, (b) slugs already in `opts.teamSyncedSlugs`, and
- *      (c) any subdir without an explicit `cloud: false` marker.
+ *   2. Every local (non-cloud) `companies/{slug}/` subdir, after excluding
+ *      (a) `_template`, (b) slugs already in `opts.teamSyncedSlugs`
+ *      (cloud-backed — they sync to their own team bucket), and (c) any
+ *      subdir explicitly marked `cloud: true` in its `company.yaml`.
+ *      A company with no `company.yaml` (or one without a `cloud:` marker)
+ *      is included — local companies sync to the personal vault by default.
  *
  * Order is whatever `fs.readdirSync` returns — share() doesn't care, and
  * the per-file walk inside share() handles recursion uniformly. Missing
@@ -131,9 +128,10 @@ export function computePersonalVaultPaths(
   } catch {
     // Missing or unreadable — silently omit. Callers tolerate empty arrays.
   }
-  const companySubdirs = opts.includeLocalCompanies === true
-    ? computePersonalCompanySubdirs(hqRoot, opts.teamSyncedSlugs)
-    : [];
+  const companySubdirs = computePersonalCompanySubdirs(
+    hqRoot,
+    opts.teamSyncedSlugs,
+  );
   const continuity = computeContinuityPointerPaths(hqRoot);
   const agency = computeAgencySyncPaths(hqRoot);
   return [...topLevel, ...manifest, ...companySubdirs, ...continuity, ...agency];
@@ -273,10 +271,12 @@ export function computeAgencySyncPaths(hqRoot: string): string[] {
  *      (currently just `_template`).
  *   3. The slug is NOT in `teamSyncedSlugs` (membership-backed slugs sync
  *      to their own bucket and must not be double-written).
- *   4. `companies/{slug}/company.yaml` exists and contains a
- *      `cloud: false` line. A missing file or `cloud: true` opts the
- *      directory OUT of the personal vault — silent inclusion would
- *      capture scratch/dead dirs the user never intended to ship.
+ *   4. `companies/{slug}/company.yaml` does NOT contain an explicit
+ *      `cloud: true` line. Local companies sync to the personal vault by
+ *      default, so a missing/markerless `company.yaml` is INCLUDED; only an
+ *      explicit `cloud: true` marker opts the directory OUT (belt-and-braces
+ *      with `teamSyncedSlugs` for a company designated cloud-backed before
+ *      its membership has resolved).
  *
  * Returns absolute paths.
  */
@@ -303,7 +303,7 @@ export function computePersonalCompanySubdirs(
       continue;
     }
     if (!isDir) continue;
-    if (!companyHasCloudFalseMarker(subdir)) continue;
+    if (companyHasCloudTrueMarker(subdir)) continue;
     eligible.push(subdir);
   }
   return eligible;
@@ -311,25 +311,29 @@ export function computePersonalCompanySubdirs(
 
 /**
  * True iff `{subdir}/company.yaml` exists and contains an explicit
- * top-level `cloud: false` line. Matches the canonical shape
- * `/designate-team` writes — that command's awk is the only producer of
- * this key, and it always emits `cloud: <bool>` at column zero with no
- * indentation, no quoting, lowercase boolean, optional trailing comment.
+ * top-level `cloud: true` line — the marker `/designate-team` writes when a
+ * company is promoted to cloud-backed. That command's awk is the only
+ * producer of this key, and it always emits `cloud: <bool>` at column zero
+ * with no indentation, no quoting, lowercase boolean, optional trailing
+ * comment. A `true` marker excludes the directory from the personal-vault
+ * fallback; everything else (missing file, no marker, `cloud: false`)
+ * leaves it eligible — local companies sync to the personal vault by default.
  *
  * Anchored at column 0 deliberately:
- *   - rejects `meta:\n  cloud: false` (nested key, would be `meta.cloud`
+ *   - rejects `meta:\n  cloud: true` (nested key, would be `meta.cloud`
  *     in a real YAML parser — false positive for us if we allowed
  *     arbitrary leading whitespace)
- *   - rejects `- cloud: false` (list item, also a nested key)
- *   - rejects flow mappings like `{ cloud: false }`
+ *   - rejects `- cloud: true` (list item, also a nested key)
+ *   - rejects flow mappings like `{ cloud: true }`
  *
- * Other intentional rejections (lowercase `false` only, no YAML-alt
- * boolean spellings): `cloud: False`, `cloud: FALSE`, `cloud: no`,
- * `cloud: off`, `cloud: "false"`, `cloud: 'false'`. None of these are
+ * Other intentional rejections (lowercase `true` only, no YAML-alt
+ * boolean spellings): `cloud: True`, `cloud: TRUE`, `cloud: yes`,
+ * `cloud: on`, `cloud: "true"`, `cloud: 'true'`. None of these are
  * produced by `/designate-team`; matching them risks confusing
- * round-trips with hand-edited YAML.
+ * round-trips with hand-edited YAML. (A misspelled marker fails OPEN —
+ * the company stays in the personal vault — which is the safe default.)
  */
-function companyHasCloudFalseMarker(subdir: string): boolean {
+function companyHasCloudTrueMarker(subdir: string): boolean {
   const yamlPath = path.join(subdir, "company.yaml");
   let text: string;
   try {
@@ -337,5 +341,5 @@ function companyHasCloudFalseMarker(subdir: string): boolean {
   } catch {
     return false;
   }
-  return /^cloud:\s*false\b/m.test(text);
+  return /^cloud:\s*true\b/m.test(text);
 }