@indigoai-us/hq-cloud 6.11.6 → 6.11.8

package/dist/cli/share.test.js

@@ -282,6 +282,148 @@ describe("share", () => {
         expect(result.filesUploaded).toBe(1);
         expect(uploadFile).toHaveBeenCalledWith(expect.anything(), testFile, "changed.md", undefined, expect.anything());
     });
+    // ── Push-side FILE_TOMBSTONE consult (delete-resync, 3B) ────────────────────
+    // An authoritative delete (`hq files delete`) writes a FILE_TOMBSTONE and
+    // removes the S3 object. Without a push-side consult, a behind peer that still
+    // holds the deleted file RE-UPLOADS it on a skipUnchanged=false push (e.g.
+    // `hq cloud share <path>`); the re-upload post-dates the tombstone, so the
+    // pull planner's timestamp-only re-create heuristic treats it as a genuine
+    // re-create and resurrects the key for everyone. These tests pin the fix: a
+    // stale-baseline copy is suppressed, while genuine content (locally-changed or
+    // no-journal) still uploads. Differential proof: reverting the consult in
+    // share.ts makes the first test fail (uploadFile IS called → resurrection).
+    describe("push-side tombstone consult", () => {
+        function seedJournal(key, hash, size) {
+            fs.writeFileSync(path.join(stateDir, "sync-journal.acme.json"), JSON.stringify({
+                version: "1",
+                lastSync: new Date().toISOString(),
+                files: {
+                    [key]: {
+                        hash,
+                        size,
+                        syncedAt: new Date().toISOString(),
+                        direction: "down",
+                    },
+                },
+            }));
+        }
+        it("suppresses re-upload of a stale-baseline copy of a tombstoned key", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(path.join(companyRoot, "docs"), { recursive: true });
+            const f = path.join(companyRoot, "docs", "shared.md");
+            fs.writeFileSync(f, "shared content");
+            const { hashFile } = await import("../journal.js");
+            // Journal hash === current file hash → this machine holds the exact
+            // deleted baseline (a behind peer that never pulled the delete).
+            seedJournal("docs/shared.md", hashFile(f), 14);
+            const events = [];
+            const result = await share({
+                paths: [path.join(companyRoot, "docs")],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                // skipUnchanged omitted (=false): models `hq cloud share <path>`, the
+                // path where a behind peer would otherwise re-upload the stale copy.
+                fileTombstones: new Map([
+                    ["docs/shared.md", { deletedAt: new Date().toISOString() }],
+                ]),
+                onEvent: (e) => events.push(e),
+            });
+            // The resurrection is blocked at the source: no upload for the tombstoned key.
+            expect(uploadFile).not.toHaveBeenCalled();
+            expect(result.filesUploaded).toBe(0);
+            expect(result.filesSuppressedByTombstone).toBe(1);
+            expect(events.some((e) => e.type === "upload-suppressed-tombstone" && e.path === "docs/shared.md")).toBe(true);
+        });
+        it("still uploads a LOCALLY-CHANGED file even when tombstoned (genuine edit/re-create)", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(path.join(companyRoot, "docs"), { recursive: true });
+            const f = path.join(companyRoot, "docs", "shared.md");
+            fs.writeFileSync(f, "edited-since-delete");
+            // Journal hash is stale (the file was edited after the delete) → genuine
+            // new content, must NOT be suppressed.
+            seedJournal("docs/shared.md", "stale-baseline-hash", 14);
+            const result = await share({
+                paths: [path.join(companyRoot, "docs")],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                fileTombstones: new Map([
+                    ["docs/shared.md", { deletedAt: new Date().toISOString() }],
+                ]),
+            });
+            expect(result.filesSuppressedByTombstone).toBe(0);
+            expect(result.filesUploaded).toBe(1);
+            expect(uploadFile).toHaveBeenCalledWith(expect.anything(), f, "docs/shared.md", undefined, expect.anything());
+        });
+        it("still uploads a tombstoned key with NO journal entry (genuine re-create)", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(path.join(companyRoot, "docs"), { recursive: true });
+            const f = path.join(companyRoot, "docs", "shared.md");
+            fs.writeFileSync(f, "freshly created");
+            // No journal entry seeded → indistinguishable from genuine new content;
+            // fail-open and upload (mirrors the pull side's `!journalEntry` branch).
+            const result = await share({
+                paths: [path.join(companyRoot, "docs")],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                fileTombstones: new Map([
+                    ["docs/shared.md", { deletedAt: new Date().toISOString() }],
+                ]),
+            });
+            expect(result.filesSuppressedByTombstone).toBe(0);
+            expect(result.filesUploaded).toBe(1);
+        });
+        it("auto-fetches tombstones via vaultConfig (no injection) and suppresses", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(path.join(companyRoot, "docs"), { recursive: true });
+            const f = path.join(companyRoot, "docs", "shared.md");
+            fs.writeFileSync(f, "shared content");
+            const { hashFile } = await import("../journal.js");
+            seedJournal("docs/shared.md", hashFile(f), 14);
+            // Re-stub fetch to also answer GET /v1/files/tombstones, proving share()
+            // fetches and consults tombstones on its own (the production wiring) when
+            // no map is injected.
+            const fetchMock = vi.fn().mockImplementation(async (url) => {
+                const u = String(url);
+                if (u.includes("/entity/check-slug/me")) {
+                    return {
+                        ok: true,
+                        status: 200,
+                        json: async () => ({ available: false, conflictingCompanyUid: mockEntity.uid }),
+                        text: async () => "",
+                    };
+                }
+                if (u.includes("/entity/by-slug/") || /\/entity\/cmp_/.test(u)) {
+                    return { ok: true, status: 200, json: async () => ({ entity: mockEntity }), text: async () => "" };
+                }
+                if (u.includes("/sts/vend")) {
+                    return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
+                }
+                if (u.includes("/v1/files/tombstones")) {
+                    return {
+                        ok: true,
+                        status: 200,
+                        json: async () => ({
+                            tombstones: [{ key: "docs/shared.md", deletedAt: new Date().toISOString() }],
+                        }),
+                        text: async () => "",
+                    };
+                }
+                return { ok: false, status: 404, text: async () => "Not found" };
+            });
+            vi.stubGlobal("fetch", fetchMock);
+            const result = await share({
+                paths: [path.join(companyRoot, "docs")],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+            });
+            expect(uploadFile).not.toHaveBeenCalled();
+            expect(result.filesSuppressedByTombstone).toBe(1);
+        });
+    });
     it("populates conflictPaths and emits a conflict event when both local and remote drifted from journal", async () => {
         const companyRoot = path.join(tmpDir, "companies", "acme");
         fs.mkdirSync(companyRoot, { recursive: true });
@@ -3431,7 +3573,7 @@ describe("currency-gated: journal version 2 fixtures", () => {
             expect(errorEvents.length).toBe(1);
             expect(errorEvents[0].path).toBe("f-2.bin");
         });
-        // ── Codex P1 (5.36.x): interactive conflict prompt serialization ────
+        // ── Interactive conflict prompt serialization ───────────────────────
         //
         // The parallel pool can run multiple processUploadItem workers
         // concurrently; each worker calls resolveConflict() on a conflict, and
@@ -3439,12 +3581,11 @@ describe("currency-gated: journal version 2 fixtures", () => {
         // prompt on process.stdin. Two prompts open at once would race for the
         // same terminal input — answers would interleave nondeterministically.
         //
-        // Trade-off (Option A): when onConflict is undefined we force pool
-        // concurrency to 1 for the whole run. Interactive sessions are rare
-        // (operator is already at the terminal clicking through prompts), so
-        // serializing the entire pool is acceptable and has the smallest
-        // blast radius vs. a per-prompt mutex. Non-interactive (onConflict set)
-        // keeps full parallelism.
+        // Fix: rather than force the WHOLE pool to concurrency=1 (which made an
+        // interactive `hq sync now` crawl even with zero conflicts), the pool
+        // keeps full concurrency and serializes ONLY the prompt via a chained
+        // lock (`resolveConflictSerialized`). At most one prompt awaits input at
+        // a time; this test pins that invariant.
         it("serializes interactive conflict prompts (no two readline prompts open at once)", async () => {
             const companyRoot = path.join(tmpDir, "companies", "acme");
             fs.mkdirSync(companyRoot, { recursive: true });
@@ -3548,6 +3689,56 @@ describe("currency-gated: journal version 2 fixtures", () => {
             // lower bound so the test isn't flaky on slow CI.
             expect(maxConcurrent).toBeGreaterThanOrEqual(4);
         });
+        it("interactive mode (onConflict unset) still runs transfers concurrently", async () => {
+            // REGRESSION: the 5.36.x interactive guard forced the WHOLE pool to
+            // concurrency=1 whenever onConflict was unset — so `hq sync now` (which
+            // omits --on-conflict) crawled through transfers one at a time even when
+            // no conflict ever occurred. The prompt is now serialized on its own
+            // chained lock, leaving the transfer pool at full concurrency.
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(companyRoot, { recursive: true });
+            const FILE_COUNT = 16;
+            for (let i = 0; i < FILE_COUNT; i++) {
+                fs.writeFileSync(path.join(companyRoot, `f-${i.toString().padStart(2, "0")}.bin`), `c-${i}`);
+            }
+            const startTimes = [];
+            const endTimes = [];
+            vi.mocked(uploadFile).mockImplementation(async () => {
+                startTimes.push(Date.now());
+                await new Promise((r) => setTimeout(r, 30));
+                endTimes.push(Date.now());
+                return { etag: '"upload-etag"' };
+            });
+            await share({
+                paths: [companyRoot],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                // onConflict intentionally omitted → interactive mode. No conflicts
+                // occur, so the transfer pool must NOT serialize.
+            });
+            const sortedEvents = [];
+            for (const t of startTimes)
+                sortedEvents.push({ t, kind: "start" });
+            for (const t of endTimes)
+                sortedEvents.push({ t, kind: "end" });
+            sortedEvents.sort((a, b) => a.t - b.t || (a.kind === "start" ? -1 : 1));
+            let cur = 0;
+            let maxConcurrent = 0;
+            for (const ev of sortedEvents) {
+                if (ev.kind === "start") {
+                    cur++;
+                    if (cur > maxConcurrent)
+                        maxConcurrent = cur;
+                }
+                else {
+                    cur--;
+                }
+            }
+            // Pre-fix this was exactly 1 (forced serial). Now it tracks the full
+            // pool; 4 is a conservative lower bound to avoid CI flakiness.
+            expect(maxConcurrent).toBeGreaterThanOrEqual(4);
+        });
         // ── Codex P1 (5.36.x): pool drains in-flight on worker rejection ────
         //
         // Pre-fix: the scheduler waited on `Promise.race(inFlight)`. If any