@indigoai-us/hq-cloud 6.11.8 → 6.11.10

package/src/telemetry.test.ts

@@ -8,8 +8,9 @@
  * boundary is `TelemetryClientSurface`, not the HTTP layer.
  */
 
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import * as fs from "fs";
+import { promises as fsp } from "fs";
 import * as os from "os";
 import * as path from "path";
 import {
@@ -186,11 +187,20 @@ describe("sanitizeRow", () => {
       "sessionId", "timestamp", "uuid", "cwd", "gitBranch", "userType",
       "model", "inputTokens", "outputTokens",
       "cacheCreationInputTokens", "cacheReadInputTokens",
+      "companyUid",
     ]);
     for (const key of Object.keys(out)) {
       expect(allowed.has(key), `field "${key}" must be in server allowlist`).toBe(true);
     }
   });
+
+  it("(US-002) stamps companyUid when provided, omits it when not", () => {
+    const withUid = sanitizeRow(JSON.parse(USER_ROW), "cmp_01INDIGO")!;
+    expect(withUid.companyUid).toBe("cmp_01INDIGO");
+
+    const withoutUid = sanitizeRow(JSON.parse(USER_ROW))!;
+    expect("companyUid" in withoutUid).toBe(false);
+  });
 });
 
 // ── collectAndSendTelemetry ───────────────────────────────────────────────────
@@ -392,3 +402,110 @@ describe("collectAndSendTelemetry", () => {
     expect(client.posts).toHaveLength(1); // no second POST
   });
 });
+
+// ── companyUid edge attribution (US-002) ────────────────────────────────────────
+
+describe("collectAndSendTelemetry — companyUid attribution", () => {
+  const COMPANY_UID = "cmp_01INDIGOTEST";
+  let env: TestEnv;
+  let hqRoot: string;
+
+  // The manifest lives at <hqRoot>/companies/manifest.yaml; the repo it maps is
+  // a real subdir of hqRoot so the resolver's absolute-path math lines up.
+  function writeManifest(): void {
+    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
+    fs.writeFileSync(
+      path.join(hqRoot, "companies", "manifest.yaml"),
+      `companies:\n  indigo:\n    repos:\n      - repos/private/hq-cloud\n    cloud_uid: ${COMPANY_UID}\n`,
+    );
+  }
+
+  function rowWithCwd(uuid: string, cwd: string): string {
+    return JSON.stringify({
+      type: "user",
+      timestamp: "2026-06-10T10:00:00Z",
+      sessionId: "s1",
+      uuid,
+      userType: "human",
+      cwd,
+      message: { role: "user", content: [{ type: "text", text: "hi" }] },
+    });
+  }
+
+  beforeEach(() => {
+    env = setupEnv();
+    // Use the same tmp root as hqRoot so the repo path resolves under it.
+    hqRoot = env.root;
+    writeManifest();
+  });
+  afterEach(() => { teardownEnv(env); });
+
+  it("stamps companyUid on events whose cwd is inside a company repo", async () => {
+    const client = makeClient();
+    const inRepo = path.join(hqRoot, "repos/private/hq-cloud/src");
+    writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", inRepo)]);
+
+    await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+
+    expect(client.posts).toHaveLength(1);
+    expect(client.posts[0].events[0].companyUid).toBe(COMPANY_UID);
+  });
+
+  it("omits companyUid when the cwd maps to no company repo", async () => {
+    const client = makeClient();
+    writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", "/Users/x/some-other-repo")]);
+
+    await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+
+    expect(client.posts).toHaveLength(1);
+    expect("companyUid" in client.posts[0].events[0]).toBe(false);
+  });
+
+  it("never sends the reserved 'unattributed' value", async () => {
+    const client = makeClient();
+    writeJsonl(env, "proj", "s.jsonl", [
+      rowWithCwd("u1", path.join(hqRoot, "repos/private/hq-cloud")),
+      rowWithCwd("u2", "/elsewhere"),
+    ]);
+
+    await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+
+    for (const ev of client.posts.flatMap((p) => p.events)) {
+      expect(ev.companyUid).not.toBe("unattributed");
+    }
+  });
+
+  it("parses the manifest once per run (cache), not per event", async () => {
+    const client = makeClient();
+    const inRepo = path.join(hqRoot, "repos/private/hq-cloud");
+    // 5 events in one run; assert the manifest file is read exactly once.
+    writeJsonl(
+      env,
+      "proj",
+      "s.jsonl",
+      Array.from({ length: 5 }, (_, i) => rowWithCwd(`u${i}`, inRepo)),
+    );
+
+    const manifestPath = path.join(hqRoot, "companies", "manifest.yaml");
+    const realReadFile = fsp.readFile;
+    let manifestReads = 0;
+    const spy = vi
+      .spyOn(fsp, "readFile")
+      .mockImplementation((async (p: Parameters<typeof realReadFile>[0], ...rest: unknown[]) => {
+        if (typeof p === "string" && p === manifestPath) manifestReads++;
+        // @ts-expect-error pass-through to the real implementation
+        return realReadFile(p, ...rest);
+      }) as typeof realReadFile);
+
+    try {
+      await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
+    } finally {
+      spy.mockRestore();
+    }
+
+    expect(manifestReads).toBe(1); // one parse for all 5 events
+    const events = client.posts.flatMap((p) => p.events);
+    expect(events).toHaveLength(5);
+    for (const ev of events) expect(ev.companyUid).toBe(COMPANY_UID);
+  });
+});

package/src/telemetry.ts

@@ -27,6 +27,11 @@ import { promises as fs } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 
+import {
+  buildRepoCompanyMap,
+  resolveCompanyForCwd,
+  type RepoCompanyMap,
+} from "./company-resolver.js";
 import type {
   TelemetryOptInResponse,
   UsageBatch,
@@ -51,6 +56,15 @@ export interface CollectTelemetryOptions {
   machineId: string;
   /** Version of the wrapping caller (menubar app, CLI, etc.). Reaches CloudWatch metrics as the `installerVersion` dimension. */
   installerVersion: string;
+  /**
+   * HQ root, used to resolve each event's `cwd` → owning repo → owning company
+   * via `<hqRoot>/companies/manifest.yaml` and stamp `companyUid` on the event
+   * (surface-hq-console-telemetry US-002). The manifest is parsed ONCE per run
+   * (see `buildRepoCompanyMap`); the resulting map is reused for every event.
+   * When omitted (or when no repo matches), `companyUid` is left UNSET and the
+   * server treats the event as unattributed/personal.
+   */
+  hqRoot?: string;
   /** Override `~/.claude/projects` for tests. */
   claudeProjectsRoot?: string;
   /** Override `~/.hq/telemetry-cursor.json` for tests. */
@@ -148,12 +162,23 @@ const KEEP_TOP_LEVEL = [
  *      camelCase top-level fields. The original `message` object — which
  *      carries prompt/response text, thinking, and tool data — is dropped.
  *
+ * `companyUid` (US-002): when the caller has resolved the row's `cwd` to an
+ * owning company (`resolveCompanyForCwd`), it passes that `cmp_*` uid here and
+ * it is stamped on the wire row. It is on the server's KEEP allowlist
+ * (`apps/hq-pro/src/vault-service/handlers/usage.ts`). When `companyUid` is
+ * undefined (cwd maps to no company repo) the field is OMITTED — the server
+ * treats absence as unattributed/personal. The reserved value `unattributed`
+ * is never produced (it can only come from a resolved manifest `cmp_*` uid).
+ *
  * Returns `null` when the input isn't an object. Empty results (e.g. a row
  * with no recognised fields) are still returned as `{}` and emitted; the
  * server accepts empty rows and they're useful as a "Claude Code was run at
  * this time" heartbeat.
  */
-export function sanitizeRow(row: unknown): Record<string, unknown> | null {
+export function sanitizeRow(
+  row: unknown,
+  companyUid?: string,
+): Record<string, unknown> | null {
   if (!row || typeof row !== "object" || Array.isArray(row)) return null;
   const obj = row as Record<string, unknown>;
   const out: Record<string, unknown> = {};
@@ -164,6 +189,12 @@ export function sanitizeRow(row: unknown): Record<string, unknown> | null {
     }
   }
 
+  // Stamp the resolved company attribution. Omit when unresolved so the server
+  // reads it as unattributed/personal. Never the reserved `unattributed`.
+  if (companyUid !== undefined) {
+    out.companyUid = companyUid;
+  }
+
   const message = obj.message;
   if (message && typeof message === "object" && !Array.isArray(message)) {
     const m = message as Record<string, unknown>;
@@ -261,6 +292,13 @@ export async function collectAndSendTelemetry(
   const menubarPath = opts.menubarPath ?? path.join(home, ".hq", "menubar.json");
   const log = opts.log ?? (() => {});
 
+  // Company attribution (US-002): parse the manifest ONCE per run and reuse the
+  // repo-path→companyUid map for every event below. No per-event manifest read.
+  // When `hqRoot` is omitted the map is empty → every event stays unattributed.
+  const repoCompanyMap: RepoCompanyMap = opts.hqRoot
+    ? await buildRepoCompanyMap(opts.hqRoot)
+    : { entries: [] };
+
   // 1. Opt-in check (server-authoritative, with local fallback).
   let enabled: boolean;
   let optInSource: CollectTelemetryResult["optInSource"];
@@ -390,7 +428,17 @@ export async function collectAndSendTelemetry(
       } catch {
         continue;
       }
-      const sanitized = sanitizeRow(parsed);
+      // Resolve this row's cwd → owning company (cmp_* uid) before sanitizing,
+      // using the per-run map. Unresolved → undefined → companyUid omitted.
+      const rowCwd =
+        parsed && typeof parsed === "object" && !Array.isArray(parsed)
+          ? (parsed as Record<string, unknown>).cwd
+          : undefined;
+      const companyUid = resolveCompanyForCwd(
+        typeof rowCwd === "string" ? rowCwd : undefined,
+        repoCompanyMap,
+      );
+      const sanitized = sanitizeRow(parsed, companyUid);
       if (!sanitized) continue;
 
       // Cost of appending this row to the current batch: the row's JSON

package/src/vault-client.ts

@@ -393,7 +393,8 @@ export interface UsageBatch {
    * Sanitized event rows. Each row is a plain object containing only the
    * fields in the server's KEEP allowlist (sessionId, timestamp, uuid, cwd,
    * gitBranch, userType, model, inputTokens, outputTokens,
-   * cacheCreationInputTokens, cacheReadInputTokens). Any extra field is
+   * cacheCreationInputTokens, cacheReadInputTokens, and the optional
+   * companyUid edge-attribution field — US-002). Any extra field is
    * rejected by hq-pro with `unexpected-event-field`, so the sanitizer in
    * `./telemetry.ts` is the only thing allowed to produce these.
    */
@@ -416,7 +417,8 @@ export interface SkillInvocationBatch {
   /**
    * Skill-invocation event rows. Each row contains only the fields in the
    * server's KEEP allowlist (skill, source, sessionId, timestamp, uuid, cwd,
-   * hasArgs). Raw argument text is never included — see the privacy note in
+   * hasArgs, and the optional companyUid edge-attribution field — US-002).
+   * Raw argument text is never included — see the privacy note in
    * `./skill-telemetry.ts`. Any extra field is rejected by hq-pro with
    * `unexpected-event-field`, so the extractor in `./skill-telemetry.ts` is the
    * only thing allowed to produce these.

package/src/watcher.test.ts

@@ -7,7 +7,11 @@ import {
   WatchPushDriver,
   TreeWatcher,
   createWatchPathFilter,
+  PushEventEmitter,
 } from "./watcher.js";
+import { StaticFlagProvider } from "./sync/feature-flags.js";
+import type { PushEvent } from "./sync/push-event.js";
+import type { PushTransport } from "./sync/push-transport.js";
 
 /**
  * US-001 — Phase 1 test harness: watch-triggered push seam + latency assertion.
@@ -427,3 +431,80 @@ describe("US-002: TreeWatcher — lifecycle (real chokidar over a temp dir)", ()
     w.dispose();
   }, 10_000);
 });
+
+describe("PushEventEmitter — directory and delete tombstone handling", () => {
+  let dir: string;
+
+  beforeEach(() => {
+    dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "pushemit-")));
+  });
+
+  afterEach(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  function makeEmitter(opts?: {
+    published?: PushEvent[];
+    onError?: ReturnType<typeof vi.fn>;
+    getSequenceNumber?: () => number;
+  }): PushEventEmitter {
+    const published = opts?.published ?? [];
+    const transport: PushTransport = {
+      start: async () => {},
+      dispose: async () => {},
+      connected: true,
+      publish: async (event) => {
+        published.push(event);
+      },
+    };
+    return new PushEventEmitter({
+      originTenantId: "tenant-indigo",
+      originDeviceId: "device-a",
+      transport,
+      flagProvider: new StaticFlagProvider(["tenant-indigo"]),
+      now: () => new Date("2026-06-18T12:00:00.000Z"),
+      getSequenceNumber: opts?.getSequenceNumber,
+      onError: opts?.onError,
+    });
+  }
+
+  it("skips directory changes silently without publishing or reporting an error", async () => {
+    const published: PushEvent[] = [];
+    const onError = vi.fn();
+    const subdir = path.join(dir, "folder");
+    fs.mkdirSync(subdir);
+    const emitter = makeEmitter({ published, onError });
+
+    await emitter.emitForBatch({ paths: new Map([[subdir, "folder"]]) });
+
+    expect(published).toEqual([]);
+    expect(onError).not.toHaveBeenCalled();
+  });
+
+  it("emits and publishes a delete tombstone when the changed file is gone", async () => {
+    const published: PushEvent[] = [];
+    const onError = vi.fn();
+    const emitter = makeEmitter({
+      published,
+      onError,
+      getSequenceNumber: () => 99,
+    });
+    const missing = path.join(dir, "deleted.md");
+
+    await emitter.emitForBatch({ paths: new Map([[missing, "deleted.md"]]) });
+
+    expect(onError).not.toHaveBeenCalled();
+    expect(published).toEqual([
+      {
+        kind: "delete",
+        relativePath: "deleted.md",
+        originDeviceId: "device-a",
+        originTenantId: "tenant-indigo",
+        sequenceNumber: 99,
+        eventTimestamp: "2026-06-18T12:00:00.000Z",
+      },
+    ]);
+    expect(published[0]).not.toHaveProperty("contentHash");
+    expect(published[0]).not.toHaveProperty("mtime");
+  });
+});

package/src/watcher.ts

@@ -862,11 +862,12 @@ export class PushEventEmitter {
   ): Promise<void> {
     let event: PushEvent | undefined;
     try {
-      const [contentHash, st] = await Promise.all([
-        computeContentHash(absolutePath),
-        stat(absolutePath),
-      ]);
+      const st = await stat(absolutePath);
+      if (st.isDirectory()) return;
+
+      const contentHash = await computeContentHash(absolutePath);
       event = {
+        kind: "upsert",
         relativePath,
         contentHash,
         mtime: st.mtime.toISOString(),
@@ -876,12 +877,28 @@ export class PushEventEmitter {
         eventTimestamp: this.now().toISOString(),
       };
     } catch (err) {
-      // File deleted between debounce fire and hash read (legal race), or stat
-      // failed. Surface, don't crash.
-      this.onError(err instanceof Error ? err : new Error(String(err)), {
+      const code =
+        err && typeof err === "object" && "code" in err
+          ? (err as { code?: string }).code
+          : undefined;
+      if (code !== "ENOENT") {
+        // Genuine stat/read failure. Surface, don't crash.
+        this.onError(err instanceof Error ? err : new Error(String(err)), {
+          relativePath,
+        });
+        return;
+      }
+
+      // Deleted before/during capture: publish a tombstone so peers run a
+      // targeted pull and let the vault-confirmed tombstone path remove it.
+      event = {
+        kind: "delete",
         relativePath,
-      });
-      return;
+        originDeviceId: this.originDeviceId,
+        originTenantId: this.originTenantId,
+        sequenceNumber: this.nextSeq(),
+        eventTimestamp: this.now().toISOString(),
+      };
     }
 
     // US-011: 1st link of the 3-log diagnostic chain. Stamps the same
@@ -891,6 +908,7 @@ export class PushEventEmitter {
     this.logger?.info(
       {
         event: "watcher.emit",
+        kind: event.kind,
         originTenantId: event.originTenantId,
         originDeviceId: event.originDeviceId,
         relativePath: event.relativePath,

package/test/e2e/sync/cross-tenant-isolation.test.ts

@@ -215,6 +215,7 @@ function makeEvent(opts: {
 }): PushEvent {
   return {
     relativePath: opts.relativePath,
+    kind: "upsert",
     contentHash: ZERO_HASH,
     mtime: "2026-05-21T12:00:00.000Z",
     originDeviceId: opts.deviceId,
@@ -540,6 +541,7 @@ describe("US-018: receive path with vended credentials (isolation extension)", (
   function phase3Event(overrides: Partial<PushEvent>): PushEvent {
     return {
       relativePath: "companies/indigo/docs/x.md",
+      kind: "upsert",
       contentHash: `sha256:${"b".repeat(64)}`,
       mtime: "2026-06-10T12:00:00.000Z",
       originDeviceId: "peer",