@indigoai-us/hq-cloud 6.14.17 → 6.14.19

package/src/cli/share.test.ts

@@ -2008,6 +2008,11 @@ describe("share", () => {
     });
 
     expect(result.filesDeleted).toBe(1);
+    expect(result.pathResults).toContainEqual({
+      path: "knowledge",
+      status: "accepted",
+      operation: "delete",
+    });
     expect(deleteRemoteFile).toHaveBeenCalledWith(expect.anything(), "knowledge");
     const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
     expect(journal.files["knowledge"]).toBeUndefined();
@@ -2198,6 +2203,44 @@ describe("share", () => {
     );
   });
 
+  it("personalMode excludes generated core mirror symlinks but keeps canonical core files", async () => {
+    const packagePolicy = path.join(
+      tmpDir,
+      "core",
+      "packages",
+      "hq-pack-example",
+      "policies",
+      "generated.md",
+    );
+    const generatedMirror = path.join(tmpDir, "core", "policies", "generated.md");
+    const canonicalCoreFile = path.join(tmpDir, "core", "policies", "shipped.md");
+    fs.mkdirSync(path.dirname(packagePolicy), { recursive: true });
+    fs.mkdirSync(path.dirname(generatedMirror), { recursive: true });
+    fs.writeFileSync(packagePolicy, "generated package policy\n");
+    fs.symlinkSync(packagePolicy, generatedMirror);
+    fs.writeFileSync(canonicalCoreFile, "shipped core policy\n");
+
+    const result = await share({
+      paths: [path.join(tmpDir, "core")],
+      entityContext: makeEntityContext({
+        uid: "prs_01PERSONALTEST",
+        slug: "__hq_personal_vault__",
+        bucketName: "hq-vault-prs-01PERSONALTEST",
+      }),
+      hqRoot: tmpDir,
+      personalMode: true,
+      journalSlug: "personal-generated-core-mirror",
+    });
+
+    expect(result.filesExcludedByPolicy).toBe(1);
+    expect(result.filesUploaded).toBe(2);
+    expect(vi.mocked(uploadSymlink)).not.toHaveBeenCalled();
+    expect(vi.mocked(uploadFile).mock.calls.map((call) => call[2]).sort()).toEqual([
+      "core/packages/hq-pack-example/policies/generated.md",
+      "core/policies/shipped.md",
+    ]);
+  });
+
   it(
     "personal-vault override does NOT apply to company vaults: `owned-only` on cmp_ entity still " +
       "refuses to tombstone a direction:'down' entry (multi-user curation intact)",
@@ -3033,7 +3076,7 @@ describe("share", () => {
     });
   });
 
-  it("currency-gated: refuses delete for legacy journal entry with no recorded remoteEtag", async () => {
+  it("daemon-stopped deletion has no watcher intent and is safely refused", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(companyRoot, { recursive: true });
     // Journal entry from before remoteEtag tracking — no etag to compare
@@ -3078,6 +3121,12 @@ describe("share", () => {
       reason: "missing-delete-intent",
     });
     expect(result.filesRefusedStale).toBe(1);
+    expect(result.pathResults).toContainEqual({
+      path: "legacy-no-etag.md",
+      status: "refused",
+      operation: "delete",
+      reason: "missing-delete-intent",
+    });
   });
 
   it("currency-gated: real-world /update-hq scenario — direction:'down' delete propagates when current", async () => {
@@ -3351,6 +3400,58 @@ describe("share", () => {
   // passing in the allowed top-level directories — share() trusts its
   // `paths` input.
 
+  it("plans an intent-backed personal delete from an explicit missing scope root", async () => {
+    const key = "deleted-top-level.md";
+    const journalSlug = "personal-scoped-delete";
+    const journalPath = path.join(
+      stateDir,
+      `sync-journal.${journalSlug}.json`,
+    );
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        pulls: [],
+        files: {
+          [key]: {
+            hash: "captured-hash",
+            size: 8,
+            syncedAt: new Date().toISOString(),
+            direction: "up",
+            remoteEtag: "captured-etag",
+            kind: "file",
+            localDeleteIntent: deleteIntent(
+              "captured-etag",
+              "captured-hash",
+            ),
+          },
+        },
+      }),
+    );
+
+    const result = await share({
+      // computePersonalVaultPaths() has no path to contribute after this
+      // top-level file is gone. The watcher-captured root is the sole scope.
+      paths: [],
+      deleteScopeRoots: [key],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      personalMode: true,
+      journalSlug,
+      skipUnchanged: true,
+      propagateDeletes: true,
+      propagateDeletePolicy: "owned-only",
+    });
+
+    expect(result.filesDeleted).toBe(1);
+    expect(deleteRemoteFile).toHaveBeenCalledWith(expect.anything(), key);
+    expect(
+      JSON.parse(fs.readFileSync(journalPath, "utf8")).files[key],
+    ).toBeUndefined();
+  });
+
   // ── Decommission prefixes ──────────────────────────────────────────────────
   //
   // `decommissionPrefixes` is the "company was promoted to its own team
@@ -4059,10 +4160,12 @@ describe("share", () => {
       total,
       missing,
       direction = "up" as "up" | "down",
+      withIntents = true,
     }: {
       total: number;
       missing: number;
       direction?: "up" | "down";
+      withIntents?: boolean;
     }): { companyRoot: string; journalPath: string } {
       const companyRoot = path.join(tmpDir, "companies", "acme");
       fs.mkdirSync(companyRoot, { recursive: true });
@@ -4075,7 +4178,7 @@ describe("share", () => {
           direction: "up" | "down";
           remoteEtag: string;
           kind: "file";
-          localDeleteIntent: ReturnType<typeof deleteIntent>;
+          localDeleteIntent?: ReturnType<typeof deleteIntent>;
         }
       > = {};
       for (let i = 0; i < total; i++) {
@@ -4087,7 +4190,9 @@ describe("share", () => {
           direction,
           remoteEtag: `etag-${i}`,
           kind: "file",
-          localDeleteIntent: deleteIntent(`etag-${i}`, "h"),
+          ...(withIntents
+            ? { localDeleteIntent: deleteIntent(`etag-${i}`, "h") }
+            : {}),
         };
         if (i >= missing) {
           fs.writeFileSync(path.join(companyRoot, key), "hi");
@@ -4110,7 +4215,11 @@ describe("share", () => {
     });
 
     it("trips at the 11/100 boundary (11% > 10%, abs >= 10): refuses every delete and emits bulk-asymmetry event", async () => {
-      const { companyRoot, journalPath } = setupJournal({ total: 100, missing: 11 });
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+        withIntents: false,
+      });
       // currency-gated: remote HEAD would match every journal etag — guard
       // must trip BEFORE any HEAD round-trip occurs.
       vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
@@ -4166,6 +4275,33 @@ describe("share", () => {
       expect(perKeyRefusals.length).toBe(11);
     });
 
+    it("intent-backed 11/100 subtree disappearance bypasses the breaker and deletes every covered path", async () => {
+      const { companyRoot } = setupJournal({ total: 100, missing: 11 });
+      vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
+        etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
+        lastModified: new Date(),
+        size: 5,
+      }));
+      const events: Array<{ type: string }> = [];
+
+      const result = await share({
+        paths: [companyRoot],
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipUnchanged: true,
+        propagateDeletes: true,
+        propagateDeletePolicy: "currency-gated",
+        onEvent: (e) => events.push(e as { type: string }),
+      });
+
+      expect(result.filesDeleted).toBe(11);
+      expect(deleteRemoteFile).toHaveBeenCalledTimes(11);
+      expect(
+        events.find((e) => e.type === "delete-refused-bulk-asymmetry"),
+      ).toBeUndefined();
+    });
+
     it("does NOT trip at 9/100 (below ratio): all candidates delete normally", async () => {
       const { companyRoot } = setupJournal({ total: 100, missing: 9 });
       vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
@@ -4232,7 +4368,11 @@ describe("share", () => {
     });
 
     it("fully-empty mirror (100/100) trips the guard — the canonical mass-delete failure mode", async () => {
-      const { companyRoot, journalPath } = setupJournal({ total: 50, missing: 50 });
+      const { companyRoot, journalPath } = setupJournal({
+        total: 50,
+        missing: 50,
+        withIntents: false,
+      });
       vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
         etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
         lastModified: new Date(),
@@ -4288,7 +4428,11 @@ describe("share", () => {
     });
 
     it("owned-only policy also goes through the guard: 11/100 missing direction:'up' entries refused", async () => {
-      const { companyRoot, journalPath } = setupJournal({ total: 100, missing: 11 });
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+        withIntents: false,
+      });
 
       const events: Array<{ type: string }> = [];
       const result = await share({

package/src/cli/share.ts

@@ -41,7 +41,10 @@ import {
   wrapFilterWithPersonalVaultDefaults,
   type PersonalVaultExclusion,
 } from "../personal-vault-exclusions.js";
-import { isPersonalVaultDeletionExcluded } from "../personal-vault.js";
+import {
+  isGeneratedCoreMirrorKey,
+  isPersonalVaultDeletionExcluded,
+} from "../personal-vault.js";
 import { resolveConflict } from "./conflict.js";
 import type { ConflictStrategy } from "./conflict.js";
 import type { SyncProgressEvent } from "./sync.js";
@@ -590,6 +593,12 @@ export interface ShareOptions {
    * next push to erase it.
    */
   propagateDeletePolicy?: "currency-gated" | "owned-only" | "all";
+  /**
+   * Explicit vault-relative delete roots captured by a live watcher before a
+   * scoped push. These roots do not need to exist locally; delete execution
+   * still requires a current version-bound intent (or server tombstone).
+   */
+  deleteScopeRoots?: string[];
   /**
    * Hq-root-relative key prefixes whose journal entries should be
    * unconditionally decommissioned from the remote bucket and journal,
@@ -753,9 +762,27 @@ export interface ShareResult {
    * way to runner/UI consumers.
    */
   conflictPaths: string[];
+  /** Uncapped per-path delete outcomes used by scoped watcher publication. */
+  pathResults?: SharePathResult[];
   aborted: boolean;
 }
 
+export type ShareDeleteRefusalReason =
+  | "stale-etag"
+  | "legacy-no-etag"
+  | "bulk-asymmetry"
+  | "divergent-local"
+  | "missing-delete-intent"
+  | "intent-changed"
+  | "transfer-error";
+
+export interface SharePathResult {
+  path: string;
+  status: "accepted" | "refused";
+  operation: "delete" | "tombstone";
+  reason?: ShareDeleteRefusalReason;
+}
+
 /**
  * A conditional-write fence rejection — the SDK's 412 (`name:
  * "PreconditionFailed"`) or the presigned transport's mirror of it. Means
@@ -838,6 +865,7 @@ export async function share(options: ShareOptions): Promise<ShareResult> {
   const counters = createShareCounters();
   const filesRefusedStalePaths: string[] = [];
   const conflictPaths: string[] = [];
+  const pathResults: SharePathResult[] = [];
 
   const plans = await buildSharePlans(run);
   const uploadResult = await executeUploads(
@@ -852,6 +880,7 @@ export async function share(options: ShareOptions): Promise<ShareResult> {
       counters,
       filesRefusedStalePaths,
       uploadResult.abortFlightConflictPaths,
+      pathResults,
       true,
     );
   }
@@ -862,11 +891,19 @@ export async function share(options: ShareOptions): Promise<ShareResult> {
     plans.decommissionPlan,
     counters,
     filesRefusedStalePaths,
+    pathResults,
   );
   finalizeShareJournal(run);
   throwUploadWorkerErrors(uploadResult.workerErrors);
 
-  return buildShareResult(run, counters, filesRefusedStalePaths, conflictPaths, false);
+  return buildShareResult(
+    run,
+    counters,
+    filesRefusedStalePaths,
+    conflictPaths,
+    pathResults,
+    false,
+  );
 }
 
 type DeletePolicy = NonNullable<ShareOptions["propagateDeletePolicy"]>;
@@ -1070,7 +1107,27 @@ async function buildSharePlans(run: PushRunContext): Promise<SharePlans> {
   // `companies/{slug}/…` keys, so this only applies in company mode.
   const filesToShare =
     run.options.personalMode === true
-      ? collected
+      ? collected.filter((entry) => {
+          // `core/<type>` symlinks are generated projections of canonical
+          // personal/package content. Reindex or package wiring owns their
+          // lifecycle, so uploading them creates remote objects that a later
+          // pull can only materialize temporarily before reindex removes them.
+          // Keep ordinary core files eligible: only a symlink is derived.
+          const generatedCoreMirror =
+            entry.kind === "symlink" && isGeneratedCoreMirrorKey(entry.relativePath)
+          if (!generatedCoreMirror) return true;
+
+          // This is a type-aware companion to the path-only personal-vault
+          // default filters. `collectFiles` is the first seam that knows the
+          // entry is a symlink, so record it here for the same summary/result
+          // accounting used by the static exclusions.
+          if (!run.excludedSet.has(entry.relativePath)) {
+            run.excludedSet.add(entry.relativePath);
+            run.excludedById["generated-core-mirror"] =
+              (run.excludedById["generated-core-mirror"] ?? 0) + 1;
+          }
+          return false;
+        })
       : collected.filter((entry) => {
           if (!entry.relativePath.startsWith("companies/")) return true;
           run.emit({
@@ -1085,7 +1142,12 @@ async function buildSharePlans(run: PushRunContext): Promise<SharePlans> {
     run.skipUnchanged === true,
   );
   const deleteScopeRoots = run.propagateDeletes === true
-    ? resolveDeleteScopeRoots(run.paths, run.hqRoot, run.syncRoot)
+    ? resolveDeleteScopeRoots(
+        run.paths,
+        run.hqRoot,
+        run.syncRoot,
+        run.options.deleteScopeRoots,
+      )
     : [];
   const deletePlan: DeletePlan = run.propagateDeletes === true
     ? await computeDeletePlan(
@@ -1522,6 +1584,7 @@ async function executeDeletes(
   decommissionPlan: string[],
   counters: ShareCounters,
   filesRefusedStalePaths: string[],
+  pathResults: SharePathResult[],
 ): Promise<void> {
   const deleteItems = [
     ...deletePlan.toDelete.map((item) => ({ ...item, decommission: false })),
@@ -1543,6 +1606,9 @@ async function executeDeletes(
           entry!.localDeleteIntent!.version !== item.intentVersion ||
           !isLocallyAbsent(path.join(run.syncRoot, relativePath)))
       ) {
+        if (entry?.localDeleteIntent) {
+          delete entry.localDeleteIntent;
+        }
         counters.filesRefusedStale++;
         if (filesRefusedStalePaths.length < REFUSED_STALE_PATH_CAP) {
           filesRefusedStalePaths.push(relativePath);
@@ -1554,6 +1620,12 @@ async function executeDeletes(
           remoteEtag: "<not-checked>",
           reason: "intent-changed",
         });
+        pathResults.push({
+          path: relativePath,
+          status: "refused",
+          operation: "delete",
+          reason: "intent-changed",
+        });
         continue;
       }
       const size = entry?.size ?? 0;
@@ -1566,6 +1638,11 @@ async function executeDeletes(
         bytes: size,
         deleted: true,
       });
+      pathResults.push({
+        path: relativePath,
+        status: "accepted",
+        operation: "delete",
+      });
     } catch (err) {
       if (err instanceof VaultAuthError) throw err;
       run.emit({
@@ -1573,6 +1650,12 @@ async function executeDeletes(
         path: relativePath,
         message: err instanceof Error ? err.message : String(err),
       });
+      pathResults.push({
+        path: relativePath,
+        status: "refused",
+        operation: "delete",
+        reason: "transfer-error",
+      });
     }
   }
   for (const relativePath of deletePlan.toTombstone) {
@@ -1585,6 +1668,11 @@ async function executeDeletes(
       deleted: true,
       message: "tombstone (remote already 404)",
     });
+    pathResults.push({
+      path: relativePath,
+      status: "accepted",
+      operation: "tombstone",
+    });
   }
   const decommissionedSet =
     decommissionPlan.length > 0 ? new Set(decommissionPlan) : null;
@@ -1601,6 +1689,12 @@ async function executeDeletes(
       remoteEtag: refused.remoteEtag,
       reason: refused.reason,
     });
+    pathResults.push({
+      path: refused.key,
+      status: "refused",
+      operation: "delete",
+      reason: refused.reason,
+    });
   }
 }
 
@@ -1669,6 +1763,7 @@ function buildShareResult(
   counters: ShareCounters,
   filesRefusedStalePaths: string[],
   conflictPaths: string[],
+  pathResults: SharePathResult[],
   aborted: boolean,
 ): ShareResult {
   return {
@@ -1684,6 +1779,7 @@ function buildShareResult(
     filesExcludedByScope: run.scopeExcludedSet.size,
     filesExcludedByIgnore: run.ignoreExcludedSet.size,
     conflictPaths,
+    pathResults,
     aborted,
   };
 }
@@ -2043,8 +2139,26 @@ function resolveDeleteScopeRoots(
   paths: string[],
   hqRoot: string,
   syncRoot: string,
+  explicitRoots: readonly string[] = [],
 ): string[] {
   const prefixes = new Set<string>();
+  for (const root of explicitRoots) {
+    const normalized = root
+      .split("\\")
+      .join("/")
+      .replace(/^\.\/+/, "")
+      .replace(/\/+$/, "");
+    if (
+      normalized === "" ||
+      normalized === "." ||
+      path.posix.isAbsolute(normalized) ||
+      normalized === ".." ||
+      normalized.startsWith("../")
+    ) {
+      continue;
+    }
+    prefixes.add(normalized);
+  }
   for (const p of paths) {
     const absolutePath = path.isAbsolute(p) ? p : path.resolve(hqRoot, p);
     if (!fs.existsSync(absolutePath)) continue;
@@ -2296,23 +2410,19 @@ async function computeDeletePlan(
   // and the journal-mutation buckets are already settled before any I/O.
   type HeadCandidate = { key: string; journalEtag: string; intentVersion: 1 };
   const headCandidates: HeadCandidate[] = [];
-  // Litter drain bucket — kept separate from `plan.toDelete` so the
-  // bulk-asymmetry breaker (which moves toDelete + headCandidates into
-  // `refusedStale` when it trips) can't sweep these out. See
+  // Litter drain bucket — kept separate from normal delete candidates so
+  // the bulk-asymmetry accounting cannot sweep these in. See
   // `isVaultLitterArtifact` for the patterns and rationale: by construction
   // these aren't user content losses, so a high ratio of litter must not
   // refuse the drain — that's the whole point of the bypass. Merged into
   // `plan.toDelete` after the breaker check.
   const litterToDelete: string[] = [];
-  // Bulk-asymmetry tracking: count every in-scope journal entry (denominator)
-  // and every entry that would have been a delete-candidate before the guard
-  // (numerator). Numerator = headCandidates + owned-only/all toDelete picks +
-  // legacy-no-etag refusals. We do NOT count "ENOENT but ignore-filtered" or
-  // "ENOENT but ephemeral" — those drop out of the plan entirely on their own
-  // and don't reflect mirror-loss intent — and litter drains (see above),
-  // which are intentional ratchet-cleanup, not mass-delete intent.
+  // Current watcher intents are affirmative evidence of an observed delete,
+  // so only intent-less disappearances contribute to the mirror-loss breaker.
+  // An unmounted/wiped tree produces no intents and still trips it.
   let inScopeJournalEntries = 0;
-  let bulkCandidatePicks = 0;
+  let intentlessDisappearances = 0;
+  const intentlessKeys = new Set<string>();
 
   for (const [relativeKey, entry] of Object.entries(journal.files)) {
     const inScope = scopeRoots.some(
@@ -2399,6 +2509,13 @@ async function computeDeletePlan(
     }
 
     if (!hasCurrentLocalDeleteIntent(entry)) {
+      if (
+        policy === "currency-gated" ||
+        (policy === "owned-only" && entry.direction === "up")
+      ) {
+        intentlessDisappearances++;
+        intentlessKeys.add(relativeKey);
+      }
       plan.refusedStale.push({
         key: relativeKey,
         journalEtag: entry.remoteEtag ?? "<missing-delete-intent>",
@@ -2417,14 +2534,8 @@ async function computeDeletePlan(
       });
       continue;
     }
-    bulkCandidatePicks++;
     if (policy === "owned-only") {
       if (entry.direction !== "up") {
-        // Not a delete candidate under owned-only, but it WAS missing
-        // locally. Don't count it for the bulk guard — direction:'down'
-        // entries that vanish locally are silently ignored by this policy
-        // anyway, so they don't represent intent to mass-delete.
-        bulkCandidatePicks--;
         continue;
       }
       plan.toDelete.push({
@@ -2457,42 +2568,26 @@ async function computeDeletePlan(
   if (
     policy !== "all" &&
     !isBulkAsymmetryOverride() &&
-    bulkCandidatePicks >= BULK_ASYMMETRY_MIN_ABS &&
+    intentlessDisappearances >= BULK_ASYMMETRY_MIN_ABS &&
     inScopeJournalEntries > 0 &&
-    bulkCandidatePicks / inScopeJournalEntries >= BULK_ASYMMETRY_RATIO
+    intentlessDisappearances / inScopeJournalEntries >= BULK_ASYMMETRY_RATIO
   ) {
-    // Move every staged candidate (both already-bucketed toDelete from
-    // owned-only and queued headCandidates from currency-gated) into
-    // refusedStale with reason "bulk-asymmetry". Journal is not mutated;
-    // no DeleteObject is issued.
     const samplePaths: string[] = [];
-    const pushRefused = (key: string): void => {
-      plan.refusedStale.push({
-        key,
-        journalEtag: "<bulk-asymmetry>",
-        remoteEtag: "<not-checked>",
-        reason: "bulk-asymmetry",
-      });
+    for (const refused of plan.refusedStale) {
+      if (!intentlessKeys.has(refused.key)) continue;
+      refused.journalEtag = "<bulk-asymmetry>";
+      refused.remoteEtag = "<not-checked>";
+      refused.reason = "bulk-asymmetry";
       if (samplePaths.length < BULK_ASYMMETRY_SAMPLE_CAP) {
-        samplePaths.push(key);
+        samplePaths.push(refused.key);
       }
-    };
-    for (const item of plan.toDelete) pushRefused(item.key);
-    for (const c of headCandidates) pushRefused(c.key);
-    plan.toDelete = [];
+    }
     plan.bulkAsymmetry = {
-      candidates: bulkCandidatePicks,
+      candidates: intentlessDisappearances,
       inScope: inScopeJournalEntries,
-      ratio: bulkCandidatePicks / inScopeJournalEntries,
+      ratio: intentlessDisappearances / inScopeJournalEntries,
       samplePaths,
     };
-    // Litter still drains even when the breaker trips — see `litterToDelete`
-    // declaration. The breaker protects against corrupt-mirror mass-deletes
-    // of user content; litter cleanup is orthogonal and should never be
-    // refused for the same reason new-litter producer-side exclusions
-    // shouldn't block it.
-    plan.toDelete.push(...litterToDelete.map((key) => ({ key, intentVersion: null })));
-    return plan;
   }
 
   // Stage 2: bounded-parallel HEAD pass. Promise.all over chunks of size