@indigoai-us/hq-cloud 6.14.0 → 6.14.2

package/dist/bin/sync-runner.test.js

@@ -10,13 +10,14 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
-import { runRunner, runRunnerWithLoop, resolveDeletePolicy, resolveSkipPersonal, selectObjectIOFactory, routeChangeToTarget, buildTargetedPushArgv, resolvePullScope, readPinnedPrefixes, defaultCollectTelemetry, } from "./sync-runner.js";
+import { runRunner, runRunnerWithLoop, resolveDeletePolicy, resolveSkipPersonal, selectObjectIOFactory, routeChangeToTarget, buildTargetedPushArgv, resolvePullScope, readPinnedPrefixes, SESSIONS_SCOPE_PREFIX, defaultCollectTelemetry, } from "./sync-runner.js";
 import { PresignObjectIO, S3SdkObjectIO } from "../object-io.js";
 import { FakeClock } from "../watcher.js";
 import { PERSONAL_VAULT_JOURNAL_SLUG } from "../journal.js";
 import { HQ_CLOUD_VERSION } from "../version.js";
 import { lockPathFor, OPERATION_LOCKED_EXIT } from "../operation-lock.js";
 import { TRANSIENT_NETWORK_EXIT } from "../lib/net-errors.js";
+import { PARTIAL_SYNC_EXIT } from "../lib/exit-codes.js";
 import { isCoveredByAny } from "../prefix-coalesce.js";
 import { VaultAuthError } from "../vault-client.js";
 // ---------------------------------------------------------------------------
@@ -1335,6 +1336,52 @@ describe("all-complete aggregate", () => {
         expect(deps.stdout.events().some((e) => e.type === "all-complete")).toBe(true);
         expect(deps.stderr.raw()).toContain("runner.telemetry.timeout");
     });
+    it("emits action telemetry for completion and telemetry transport failure does not block completion", async () => {
+        const posts = [];
+        const client = {
+            ...makeVaultStub({
+                memberships: [{ companyUid: "cmp_a" }],
+                entityGet: (uid) => Promise.resolve({ uid, slug: "acme" }),
+            }),
+            postTelemetryEvents: vi.fn(async (batch) => {
+                posts.push(batch);
+                throw new Error("telemetry transport down");
+            }),
+        };
+        const deps = makeDeps({
+            createVaultClient: () => client,
+            collectTelemetry: vi.fn().mockResolvedValue(undefined),
+            sync: vi
+                .fn()
+                .mockResolvedValue(defaultSyncResult({
+                filesDownloaded: 2,
+                bytesDownloaded: 300,
+            })),
+        });
+        const code = await runRunner(["--companies"], deps);
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        expect(code).toBe(0);
+        expect(deps.stdout.events().some((e) => e.type === "all-complete")).toBe(true);
+        const completed = posts
+            .flatMap((post) => post.events)
+            .find((event) => event.eventName === "sync_runner_completed");
+        expect(completed).toMatchObject({
+            app: "hq-cloud",
+            source: "sync-runner",
+            schemaVersion: 1,
+            properties: {
+                result: "completed",
+                attemptedCount: 1,
+                companyCount: 1,
+                errorCount: 0,
+                filesDownloaded: 2,
+                bytesDownloaded: 300,
+                filesUploaded: 0,
+                bytesUploaded: 0,
+            },
+        });
+        expect(deps.stderr.raw()).toContain("runner.telemetry_events.nonfatal");
+    });
     it("sums filesDownloaded and bytesDownloaded across all companies", async () => {
         const slugs = { cmp_a: "acme", cmp_b: "beta" };
         const deps = makeDeps({
@@ -1974,6 +2021,13 @@ describe("personal slot fanout", () => {
             const keys = Object.keys(args);
             expect(keys).not.toContain("personalMode");
             expect(keys).not.toContain("journalSlug");
+            // Positive assertion on the runner→sync() glue (sync-runner-company.ts:278):
+            // the push-only sessions exclusion IS threaded into the company pull leg.
+            // The ABSENT-key checks above would still pass if a regression dropped the
+            // `...(excludePrefixes.length > 0 ? { excludePrefixes } : {})` spread or
+            // flipped its guard — silently re-enabling full session pulls. Pin the
+            // exact leak against the exported constant, not a string literal.
+            expect(args.excludePrefixes).toEqual([SESSIONS_SCOPE_PREFIX]);
         }
     });
     // ── Push-side personal-vault contract (Slice 2 / personal-vault scope) ────
@@ -2822,9 +2876,9 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         // No pending FakeClock timers left behind by the driver's debounce.
         expect(clock.pendingTimerCount()).toBe(0);
     });
-    it("a non-zero poll pass exit returns immediately (hard error surfaces)", async () => {
+    it("a hard-error (exit 1) poll pass returns immediately", async () => {
         const watcher = makeWatcherStub();
-        const runPass = vi.fn().mockResolvedValue(2);
+        const runPass = vi.fn().mockResolvedValue(1);
         const code = await runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
             runPass,
             clock: new FakeClock(),
@@ -2832,7 +2886,7 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             sleep: () => Promise.resolve(),
             onShutdownSignal: () => () => { },
         });
-        expect(code).toBe(2);
+        expect(code).toBe(1);
         expect(watcher.disposed).toBe(true);
     });
     it("a TRANSIENT_NETWORK_EXIT poll pass does NOT surface as a crash — the loop retries (HQ-SYNC-1W)", async () => {
@@ -2846,7 +2900,7 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             n++;
             // First pass: machine is offline (transient). Second pass: a real hard
             // error, used here only to end the otherwise-infinite loop deterministically.
-            return n === 1 ? TRANSIENT_NETWORK_EXIT : 2;
+            return n === 1 ? TRANSIENT_NETWORK_EXIT : 1;
         });
         const code = await runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
             runPass,
@@ -2858,10 +2912,40 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         // The transient pass did NOT end the loop — it ran again…
         expect(runPass).toHaveBeenCalledTimes(2);
         // …and the transient code was never surfaced as the watcher's exit code.
-        expect(code).toBe(2);
+        expect(code).toBe(1);
         expect(code).not.toBe(TRANSIENT_NETWORK_EXIT);
         expect(watcher.disposed).toBe(true);
     });
+    it("a PARTIAL_SYNC_EXIT poll pass does NOT surface as a crash — the loop retries", async () => {
+        // A partial pass (some per-file transfers threw: oversized object on an
+        // old runner, presign denial, expired token, corrupt vault key) must keep
+        // the watcher alive. Exiting on it got the watcher hot-respawned by the
+        // menubar supervisor and Sentry-captured on EVERY failing pass — the
+        // July 2026 "watcher exited unexpectedly (code=Some(2))" alert flood. The
+        // per-file errors still surface via ndjson `error` events; the loop logs
+        // and retries next tick. A one-shot `hq sync` still exits 2.
+        const watcher = makeWatcherStub();
+        let n = 0;
+        const runPass = vi.fn().mockImplementation(async () => {
+            n++;
+            // Two partial passes prove a DETERMINISTIC per-file failure doesn't kill
+            // the loop either. A hard error then ends the otherwise-infinite loop.
+            return n <= 2 ? PARTIAL_SYNC_EXIT : 1;
+        });
+        const code = await runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+            runPass,
+            clock: new FakeClock(),
+            createWatcher: () => watcher,
+            sleep: () => Promise.resolve(),
+            onShutdownSignal: () => () => { },
+        });
+        // Both partial passes stayed alive — the loop ran a third time…
+        expect(runPass).toHaveBeenCalledTimes(3);
+        // …and the partial code was never surfaced as the watcher's exit code.
+        expect(code).toBe(1);
+        expect(code).not.toBe(PARTIAL_SYNC_EXIT);
+        expect(watcher.disposed).toBe(true);
+    });
     it("without --event-push, no watcher is created (poll-only safety net)", async () => {
         let triggerShutdown = () => { };
         const createWatcher = vi.fn(() => makeWatcherStub());
@@ -3409,7 +3493,61 @@ describe("resolvePullScope", () => {
     });
     it("returns all when the client has no getMembershipSyncConfig", async () => {
         const scope = await resolvePullScope(stubClient({}), "cmp_a", "acme");
-        expect(scope).toEqual({ syncMode: "all" });
+        expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
+    });
+    // US-006 AC4: the sessions prefix is push-only, so `resolvePullScope` stamps
+    // `excludePrefixes: ["sessions/"]` on EVERY return — including `all`
+    // (full-bucket), owner→all, agent→all, shared, and custom. A single missed
+    // return site would silently regress to a full session pull; this test pins
+    // the invariant across every mode the resolver can return.
+    it("stamps the push-only sessions exclusion on EVERY resolved mode (AC4)", async () => {
+        expect(SESSIONS_SCOPE_PREFIX).toBe("sessions/");
+        const modes = [
+            // no-client early return → all
+            await resolvePullScope(stubClient({}), "cmp_a", "acme"),
+            // owner role-bypass → all
+            await resolvePullScope(stubClient({
+                listMyMemberships: async () => [ownerMembership("cmp_a", "mk_owner")],
+            }), "cmp_a", "acme"),
+            // agent membership → all (short-circuit before the always-403 endpoint)
+            await resolvePullScope(stubClient({
+                listMyMemberships: async () => [membership("cmp_a", "agt_9#cmp_a")],
+            }), "cmp_a", "acme"),
+            // config-all → all
+            await resolvePullScope(stubClient({
+                listMyMemberships: async () => [membership("cmp_a", "mk_a")],
+                getMembershipSyncConfig: async () => ({
+                    membershipId: "mk_a",
+                    syncMode: "all",
+                    isDefault: true,
+                }),
+            }), "cmp_a", "acme"),
+            // shared
+            await resolvePullScope(stubClient({
+                listMyMemberships: async () => [membership("cmp_a", "mk_a")],
+                getMembershipSyncConfig: async () => ({
+                    membershipId: "mk_a",
+                    syncMode: "shared",
+                    isDefault: false,
+                }),
+                listMyExplicitGrants: async () => [
+                    { companyUid: "cmp_a", path: "knowledge/", permission: "read", source: "person" },
+                ],
+            }), "cmp_a", "acme"),
+            // custom
+            await resolvePullScope(stubClient({
+                listMyMemberships: async () => [membership("cmp_a", "mk_a")],
+                getMembershipSyncConfig: async () => ({
+                    membershipId: "mk_a",
+                    syncMode: "custom",
+                    customPaths: ["projects/x/"],
+                    isDefault: false,
+                }),
+            }), "cmp_a", "acme"),
+        ];
+        for (const scope of modes) {
+            expect(scope.excludePrefixes).toEqual([SESSIONS_SCOPE_PREFIX]);
+        }
     });
     // OWNER role-bypass regression (feedback_67bdb8a4 / feedback_a46c3b37).
     // An owner owns the whole vault by ROLE; the grants endpoint deliberately
@@ -3434,7 +3572,7 @@ describe("resolvePullScope", () => {
                 return [];
             },
         }), "cmp_a", "acme");
-        expect(scope).toEqual({ syncMode: "all" });
+        expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
         // The short-circuit must fire BEFORE any grant resolution.
         expect(grantsCalled).toBe(false);
     });
@@ -3455,7 +3593,7 @@ describe("resolvePullScope", () => {
         // Even a `custom` row cannot scope an owner below their role on the sync
         // path (the server would 403 their own writes), so `all` wins and the
         // config fetch is never needed.
-        expect(scope).toEqual({ syncMode: "all" });
+        expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
         expect(configCalled).toBe(false);
     });
     it("still narrows a NON-owner (member) to explicit grants — the fix is owner-scoped", async () => {
@@ -3470,7 +3608,7 @@ describe("resolvePullScope", () => {
                 { companyUid: "cmp_a", path: "knowledge/", permission: "read", source: "person" },
             ],
         }), "cmp_a", "acme");
-        expect(scope).toEqual({ syncMode: "shared", prefixSet: ["knowledge/"] });
+        expect(scope).toEqual({ syncMode: "shared", prefixSet: ["knowledge/"], excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     });
     it("returns all for an all-mode membership (no prefixSet)", async () => {
         const scope = await resolvePullScope(stubClient({
@@ -3481,7 +3619,7 @@ describe("resolvePullScope", () => {
                 isDefault: true,
             }),
         }), "cmp_a", "acme");
-        expect(scope).toEqual({ syncMode: "all" });
+        expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     });
     it("returns all for an AGENT membership WITHOUT calling sync-config (HQ-1R: agents own no person entity → server 403s the person-gate)", async () => {
         let called = false;
@@ -3500,7 +3638,7 @@ describe("resolvePullScope", () => {
             },
         }), "cmp_a", "acme");
         expect(called).toBe(false); // never hit the always-403 endpoint for an agent
-        expect(scope).toEqual({ syncMode: "all" });
+        expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     });
     it("coalesces explicit grants for a shared-mode membership", async () => {
         const scope = await resolvePullScope(stubClient({
@@ -3597,7 +3735,7 @@ describe("resolvePullScope", () => {
         // A `*` grant = everything. Because coalescePrefixes drops the empty
         // prefix (which would otherwise collapse to "nothing" and prune the
         // tree), an everything-scope resolves to full-access `all`.
-        expect(scope).toEqual({ syncMode: "all" });
+        expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     });
     it("uses customPaths for a custom-mode membership", async () => {
         const scope = await resolvePullScope(stubClient({
@@ -3622,7 +3760,7 @@ describe("resolvePullScope", () => {
             }),
             // listMyExplicitGrants intentionally absent.
         }), "cmp_a", "acme");
-        expect(scope).toEqual({ syncMode: "all" });
+        expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     });
     it("allows a genuinely-empty shared scope (grants method present, returns [])", async () => {
         const scope = await resolvePullScope(stubClient({
@@ -3634,7 +3772,7 @@ describe("resolvePullScope", () => {
             }),
             listMyExplicitGrants: async () => [],
         }), "cmp_a", "acme");
-        expect(scope).toEqual({ syncMode: "shared", prefixSet: [] });
+        expect(scope).toEqual({ syncMode: "shared", prefixSet: [], excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     });
     it("degrades to all when the membership is not found", async () => {
         const scope = await resolvePullScope(stubClient({
@@ -3643,7 +3781,7 @@ describe("resolvePullScope", () => {
                 throw new Error("should not be called");
             },
         }), "cmp_a", "acme");
-        expect(scope).toEqual({ syncMode: "all" });
+        expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     });
     it("degrades to all when sync-config resolution throws (never prune on error)", async () => {
         const scope = await resolvePullScope(stubClient({
@@ -3652,7 +3790,7 @@ describe("resolvePullScope", () => {
                 throw new Error("network blip");
             },
         }), "cmp_a", "acme");
-        expect(scope).toEqual({ syncMode: "all" });
+        expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     });
     // ── pin union (Phase C: hq files get) ──────────────────────────────────────
     it("unions pinned prefixes into a shared-mode scope", async () => {