@indigoai-us/hq-cloud 6.14.1 → 6.14.3

package/dist/cli/share.test.js

@@ -1060,8 +1060,8 @@ describe("share", () => {
         expect(events.some((e) => e.type === "error")).toBe(false);
     });
     it("a file over the size limit is a benign skip-size-limit event, NEVER an error (HQ-SYNC-4 exit-2 flood)", async () => {
-        // Regression for the fleet-wide "auto-sync watcher exited unexpectedly
-        // (code=Some(2))" flood (HQ-SYNC-4, ~93k events across 60+ machines). An
+        // Regression for the "auto-sync watcher exited unexpectedly
+        // (code=Some(2))" flood (HQ-SYNC-4, ~93k events across 60+ user machines). An
         // oversized file is a permanent, benign skip — it exceeds the 50 MB cap on
         // EVERY pass, forever. Emitting it as `type: "error"` pushed it into the
         // runner's `errors[]`, so the pass returned exit 2, which the menubar
@@ -4153,4 +4153,125 @@ describe("currency-gated: journal version 2 fixtures", () => {
         });
     });
 });
+describe("scope-invalid key hardening on push (doubled companies/ tree — incident 2026-07-11)", () => {
+    let tmpDir;
+    let stateDir;
+    beforeEach(() => {
+        clearContextCache();
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-share-poison-test-"));
+        stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-state-poison-test-"));
+        process.env.HQ_STATE_DIR = stateDir;
+        setupFetchMock();
+        // Earlier describes in this file don't all clear call history; reset it
+        // here so uploaded-key assertions below are order-independent.
+        vi.mocked(uploadFile).mockClear();
+        vi.mocked(uploadSymlink).mockClear();
+        vi.mocked(headRemoteFile).mockClear();
+        vi.mocked(deleteRemoteFile).mockClear();
+        vi.mocked(uploadFile).mockResolvedValue({ etag: '"upload-etag"' });
+        vi.mocked(uploadSymlink).mockResolvedValue({ etag: '"upload-symlink-etag"' });
+        vi.mocked(headRemoteFile).mockResolvedValue(null);
+    });
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.clearAllMocks();
+        vi.mocked(uploadFile).mockResolvedValue({ etag: '"upload-etag"' });
+        vi.mocked(uploadSymlink).mockResolvedValue({ etag: '"upload-symlink-etag"' });
+        vi.mocked(headRemoteFile).mockResolvedValue(null);
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+        fs.rmSync(stateDir, { recursive: true, force: true });
+        delete process.env.HQ_STATE_DIR;
+    });
+    it("refuses to upload doubled-tree companies/ keys in company mode — clear per-key warning, never an error", async () => {
+        // The incident writer: a stale doubled local tree
+        // companies/acme/companies/acme/… would push literal `companies/…` keys
+        // via the direct-S3 STS transport, poisoning the bucket with keys the
+        // presign download API rejects (INVALID_KEY_COMPANIES_SCOPED) for every
+        // other machine. The push planner must refuse them up front.
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        const doubled = path.join(companyRoot, "companies", "acme", "knowledge");
+        fs.mkdirSync(doubled, { recursive: true });
+        fs.writeFileSync(path.join(doubled, "poison.md"), "poison");
+        fs.mkdirSync(path.join(companyRoot, "docs"), { recursive: true });
+        fs.writeFileSync(path.join(companyRoot, "docs", "good.md"), "good");
+        const events = [];
+        const result = await share({
+            paths: [companyRoot],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            onEvent: (e) => events.push(e),
+        });
+        expect(result.aborted).toBe(false);
+        expect(result.filesUploaded).toBe(1);
+        const uploadedKeys = vi.mocked(uploadFile).mock.calls.map((c) => c[2]);
+        expect(uploadedKeys).toEqual(["docs/good.md"]);
+        // Per-key warning on the existing event channel, never type:"error"
+        // (an error event flips the runner pass to exit 2 — the flood class).
+        const skipEvents = events.filter((e) => e.type === "skip-invalid-scoped-key");
+        expect(skipEvents.map((e) => e.path)).toEqual([
+            "companies/acme/knowledge/poison.md",
+        ]);
+        expect(events.some((e) => e.type === "error")).toBe(false);
+    });
+    it("tombstones (journal drop, no remote HEAD/DELETE) a companies/ journal key in company mode instead of re-uploading", async () => {
+        // Delete-propagation on a poisoned journal entry: HEAD/DeleteObject on a
+        // companies/-prefixed key would be rejected by the presign transport's
+        // server validator, so the delete plan must route it straight to
+        // toTombstone — journal entry drained, no remote call, no re-upload.
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        fs.mkdirSync(companyRoot, { recursive: true });
+        const journalPath = path.join(stateDir, "sync-journal.acme.json");
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "companies/acme/knowledge/poison.md": {
+                    hash: "poison-hash",
+                    size: 6,
+                    syncedAt: new Date().toISOString(),
+                    direction: "up",
+                    remoteEtag: "poison-etag",
+                },
+            },
+        }));
+        const result = await share({
+            paths: [companyRoot],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipUnchanged: true,
+            propagateDeletes: true,
+            propagateDeletePolicy: "currency-gated",
+        });
+        expect(result.aborted).toBe(false);
+        // Tombstoned: journal entry dropped without any remote HEAD or DELETE.
+        expect(result.filesTombstoned).toBe(1);
+        expect(result.filesDeleted).toBe(0);
+        expect(headRemoteFile).not.toHaveBeenCalled();
+        expect(deleteRemoteFile).not.toHaveBeenCalled();
+        expect(uploadFile).not.toHaveBeenCalled();
+        const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+        expect(journal.files["companies/acme/knowledge/poison.md"]).toBeUndefined();
+    });
+    it("personal-mode push still uploads companies/{slug}/ keys (local non-cloud companies are legitimate)", async () => {
+        const localCo = path.join(tmpDir, "companies", "localco");
+        fs.mkdirSync(localCo, { recursive: true });
+        fs.writeFileSync(path.join(localCo, "notes.md"), "n");
+        const events = [];
+        const result = await share({
+            paths: [localCo],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            personalMode: true,
+            journalSlug: "personal-vault",
+            onEvent: (e) => events.push(e),
+        });
+        expect(result.aborted).toBe(false);
+        const uploadedKeys = vi.mocked(uploadFile).mock.calls.map((c) => c[2]);
+        expect(uploadedKeys).toContain("companies/localco/notes.md");
+        expect(events.filter((e) => e.type === "skip-invalid-scoped-key")).toEqual([]);
+    });
+});
 //# sourceMappingURL=share.test.js.map