@indigoai-us/hq-cloud 6.14.19 → 6.14.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cloud",
-  "version": "6.14.19",
+  "version": "6.14.20",
   "description": "HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/bin/sync-runner-planning.test.ts

@@ -87,6 +87,159 @@ describe("resolveMembershipsForRun — setup-needed reasons", () => {
 });
 
 describe("buildFanoutPlan — setup-needed reasons", () => {
+  it("resolves an agent machine identity to only its claimed personal vault", async () => {
+    const agentUid = "agt_01J9AGENTSELF0000000000000";
+    const listByType = vi.fn((type: string) =>
+      Promise.resolve(
+        type === "agent"
+          ? [
+              {
+                uid: agentUid,
+                slug: "agent-self",
+                type: "agent",
+                status: "active",
+                bucketName: `hq-vault-${agentUid}`,
+              },
+            ]
+          : [],
+      ),
+    );
+    const result = await buildFanoutPlan({
+      memberships: [],
+      companies: false,
+      personal: true,
+      skipPersonal: false,
+      client: clientStub({
+        entity: { get: () => Promise.resolve(undefined), listByType },
+      }),
+      claims: {
+        "custom:entityType": "agent",
+        "custom:entityUid": agentUid,
+      },
+      resolveSkipPersonal: () => false,
+    });
+
+    expect(listByType).toHaveBeenCalledWith("agent");
+    expect(result).toEqual({
+      status: "plan",
+      plan: [
+        {
+          slug: "personal",
+          uid: agentUid,
+          bucketName: `hq-vault-${agentUid}`,
+          personalMode: true,
+          journalSlug: "__hq_personal_vault__",
+        },
+      ],
+    });
+  });
+
+  it("does not let an agent machine identity fall back to a person vault", async () => {
+    const listByType = vi.fn(() => Promise.resolve([]));
+    const result = await buildFanoutPlan({
+      memberships: [],
+      companies: false,
+      personal: true,
+      skipPersonal: false,
+      client: clientStub({
+        entity: { get: () => Promise.resolve(undefined), listByType },
+      }),
+      claims: {
+        "custom:entityType": "agent",
+        "custom:entityUid": "agt_01J9AGENTSELF0000000000000",
+      },
+      resolveSkipPersonal: () => false,
+    });
+
+    expect(listByType).toHaveBeenCalledWith("agent");
+    expect(result).toEqual({ status: "setup-needed", reason: "no-person-entity" });
+  });
+
+  it("folds the same agent personal target into a --companies plan", async () => {
+    const agentUid = "agt_01J9AGENTSELF0000000000000";
+    const result = await buildFanoutPlan({
+      memberships: [{ companyUid: "cmp_team" }],
+      companies: true,
+      personal: false,
+      skipPersonal: false,
+      client: clientStub({
+        entity: {
+          get: () =>
+            Promise.resolve({
+              uid: "cmp_team",
+              slug: "team",
+              type: "company",
+              status: "active",
+              bucketName: "hq-vault-cmp-team",
+            }),
+          listByType: (type: string) => {
+            expect(type).toBe("agent");
+            return Promise.resolve([
+              {
+                uid: agentUid,
+                slug: "agent-self",
+                type: "agent",
+                status: "active",
+                bucketName: `hq-vault-${agentUid}`,
+              },
+            ]);
+          },
+        },
+      }),
+      claims: {
+        "custom:entityType": "agent",
+        "custom:entityUid": agentUid,
+      },
+      resolveSkipPersonal: () => false,
+    });
+
+    expect(result).toMatchObject({
+      status: "plan",
+      plan: [
+        { uid: "cmp_team", slug: "team" },
+        {
+          uid: agentUid,
+          slug: "personal",
+          bucketName: `hq-vault-${agentUid}`,
+          personalMode: true,
+        },
+      ],
+    });
+  });
+
+  it("keeps the human personal target on the person collection", async () => {
+    const personUid = "prs_01J9PERSONSELF000000000000";
+    const listByType = vi.fn(() =>
+      Promise.resolve([
+        {
+          uid: personUid,
+          slug: "person-self",
+          type: "person",
+          status: "active",
+          bucketName: `hq-vault-${personUid}`,
+          createdAt: "2026-01-01T00:00:00.000Z",
+        },
+      ]),
+    );
+    const result = await buildFanoutPlan({
+      memberships: [],
+      companies: false,
+      personal: true,
+      skipPersonal: false,
+      client: clientStub({
+        entity: { get: () => Promise.resolve(undefined), listByType },
+      }),
+      claims: { sub: "human-sub" },
+      resolveSkipPersonal: () => false,
+    });
+
+    expect(listByType).toHaveBeenCalledWith("person");
+    expect(result).toMatchObject({
+      status: "plan",
+      plan: [{ uid: personUid, bucketName: `hq-vault-${personUid}` }],
+    });
+  });
+
   it("reports no-person-entity when --personal has no resolvable personal target", async () => {
     const result = await buildFanoutPlan({
       memberships: [],

package/src/bin/sync-runner-planning.ts

@@ -177,26 +177,19 @@ export async function buildFanoutPlan(options: {
     (options.companies || options.personal) &&
     !options.resolveSkipPersonal(options.skipPersonal)
   ) {
-    // Self-entity listing. For a person identity this returns the caller's
-    // person entit(ies); for an agent machine identity (idToken
-    // `custom:entityType=agent`) the server scopes it to the agent's OWN
-    // entity (type: "agent"). `listByType("person")` is the same orphan-safe
-    // self-listing call in both cases — the server resolves the caller from
-    // the JWT, so an agent box gets back its own agt_ entity here.
-    const persons = await options.client.entity.listByType("person");
-
-    // Agent-aware target selection (US-013, unblocks US-004): when the runner
-    // is an agent machine identity, the person-only canonical pick drops the
-    // agent's own `type: "agent"` entity — so resolve the agent's OWN entity
-    // by its claimed self-uid instead. Falls back to the person-only pick for
-    // a person identity (or an agent whose self-entity didn't list), so the
-    // prs_* `--personal` path is unchanged.
+    // Self-entity listing. `/entity/by-type/:type` is type-filtered: querying
+    // `person` for an agent JWT returns no agent entity in production.  Query
+    // the caller-scoped agent collection for a machine identity instead, then
+    // require the JWT-bound UID below.  A machine caller must never fall back
+    // to a person entity, which could otherwise select somebody else's vault.
     const isAgentIdentity = options.claims?.["custom:entityType"] === "agent";
     const agentSelfUid = options.claims?.["custom:entityUid"] ?? "";
+    const selfEntities = await options.client.entity.listByType(
+      isAgentIdentity ? "agent" : "person",
+    );
     const pick = isAgentIdentity
-      ? (pickAgentSelfEntity(persons, agentSelfUid) ??
-          pickCanonicalPersonEntity(persons))
-      : pickCanonicalPersonEntity(persons);
+      ? pickAgentSelfEntity(selfEntities, agentSelfUid)
+      : pickCanonicalPersonEntity(selfEntities);
     if (pick?.bucketName) {
       plan.push({
         slug: "personal",

package/src/bin/sync-runner.test.ts

@@ -6459,6 +6459,77 @@ describe("US-004 — --personal for an AGENT machine identity (HARD GATE)", () =
     "custom:entityUid": AGENT_UID,
   };
 
+  it("uses the newly minted machine ID token for --personal claims when no cache claims are available", async () => {
+    const machineIdToken = `header.${Buffer.from(JSON.stringify(agentClaims)).toString("base64url")}.signature`;
+    const listByType = vi.fn((type: string) =>
+      Promise.resolve(type === "agent" ? [agentSelfEntity] : []),
+    );
+    const syncSpy = vi.fn().mockResolvedValue(defaultSyncResult());
+    const deps = makeDeps({
+      getAccessToken: vi.fn().mockResolvedValue(machineIdToken),
+      // Simulate a newly minted token before any cache read is available.
+      getIdTokenClaims: () => null,
+      sync: syncSpy as unknown as RunnerDeps["sync"],
+      createVaultClient: () => ({
+        ...makeVaultStub(),
+        entity: { get: () => Promise.resolve(undefined as never), listByType },
+      }),
+    });
+
+    expect(await runRunner(["--personal"], deps)).toBe(0);
+    expect(listByType).toHaveBeenCalledWith("agent");
+    expect(syncSpy).toHaveBeenCalledTimes(1);
+    expect(deps.stderr.events().some((event) => event.type === "auth-error")).toBe(false);
+  });
+
+  it("uses the freshly authenticated machine claims over a stale human cache for --companies", async () => {
+    const machineIdToken = `header.${Buffer.from(JSON.stringify(agentClaims)).toString("base64url")}.signature`;
+    const listByType = vi.fn((type: string) =>
+      Promise.resolve(type === "agent" ? [agentSelfEntity] : []),
+    );
+    const syncSpy = vi.fn().mockResolvedValue(defaultSyncResult());
+    const deps = makeDeps({
+      getAccessToken: vi.fn().mockResolvedValue(machineIdToken),
+      // A pre-bootstrap human token must not make this machine run select a
+      // person vault (or drop its own personal target altogether).
+      getIdTokenClaims: () => ({ sub: "human-sub" }),
+      sync: syncSpy as unknown as RunnerDeps["sync"],
+      createVaultClient: () => ({
+        ...makeVaultStub({ memberships: [{ companyUid: "cmp_team" }] }),
+        entity: {
+          get: (uid: string) =>
+            Promise.resolve(
+              uid === "cmp_team"
+                ? ({
+                    uid,
+                    type: "company",
+                    slug: "team",
+                    bucketName: "hq-vault-cmp-team",
+                    status: "active",
+                  } as EntityInfo)
+                : (undefined as never),
+            ),
+          listByType,
+        },
+      }),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(listByType).toHaveBeenCalledWith("agent");
+    expect(syncSpy).toHaveBeenCalledTimes(2);
+    const plan = deps.stdout.events().find((event) => event.type === "fanout-plan") as Extract<
+      RunnerEvent,
+      { type: "fanout-plan" }
+    >;
+    expect(plan.companies).toContainEqual(
+      expect.objectContaining({
+        uid: AGENT_UID,
+        slug: "personal",
+        personalMode: true,
+      }),
+    );
+  });
+
   // -----------------------------------------------------------------------
   // (1) RESOLUTION — UNBLOCKED by US-013.
   //

package/src/bin/sync-runner.ts

@@ -1203,8 +1203,9 @@ export async function runRunner(
     (() => getValidAccessToken(DEFAULT_COGNITO, { interactive: false }));
   const clearSession =
     deps.clearSession ?? invalidateCachedTokensByFingerprint;
+  let initialAuthToken: string;
   try {
-    await getAccessToken();
+    initialAuthToken = await getAccessToken();
   } catch (err) {
     if (
       (err instanceof CognitoRefreshError && !err.requiresReauth) ||
@@ -1251,7 +1252,19 @@ export async function runRunner(
   // Resolved here (not inside `parsed.companies`) so single-company runs also
   // get author attribution. `null` is fine — share() simply omits the metadata.
   const getClaims = deps.getIdTokenClaims ?? defaultGetIdTokenClaims;
-  const claims = getClaims();
+  // A machine token is minted immediately above and is an ID token. Make its
+  // entity binding authoritative for this run: a stale human token cache can
+  // otherwise make an authenticated agent look like a person during fanout
+  // planning, which drops the agent's own personal-vault target. Human callers
+  // still retain the cache as their primary claims source because their bearer
+  // is normally an access token without the full ID-token profile.
+  const authenticatedClaims = decodeJwtClaims(initialAuthToken);
+  const authenticatedMachineClaims =
+    authenticatedClaims?.["custom:entityType"] === "agent" &&
+    typeof authenticatedClaims["custom:entityUid"] === "string"
+      ? authenticatedClaims
+      : null;
+  const claims = authenticatedMachineClaims ?? getClaims() ?? authenticatedClaims;
   const uploadAuthor: UploadAuthor | undefined =
     claims?.sub && claims?.email
       ? { userSub: claims.sub, email: claims.email }