@indigoai-us/hq-cloud 6.14.24 → 6.14.26

package/src/company-resolver.test.ts

@@ -75,7 +75,28 @@ describe("buildRepoCompanyMap + resolveCompanyForCwd", () => {
     hqRoot = setupHqRoot();
     const map = await buildRepoCompanyMap(hqRoot);
     expect(resolveCompanyForCwd("/Users/x/random-repo", map)).toBeUndefined();
-    expect(resolveCompanyForCwd(path.join(hqRoot, "companies/indigo"), map)).toBeUndefined();
+    // The HQ root itself is company-agnostic — it belongs to no single tenant.
+    expect(resolveCompanyForCwd(hqRoot, map)).toBeUndefined();
+  });
+
+  /**
+   * Behaviour change (was: `companies/<slug>` resolved to undefined).
+   *
+   * A company's own HQ directory holds its skills, knowledge, and project
+   * files, so work done there is unambiguously that company's work. The prior
+   * repos-only scope dropped it, and in production a large share of sessions
+   * run from inside the HQ root rather than a repo checkout — leaving that work
+   * unattributed and the owner's Projects view empty. Attribution is scoped to
+   * the single tenant that owns the directory, so this widens coverage without
+   * crossing a tenant boundary.
+   */
+  it("attributes a cwd inside the company's own HQ directory", async () => {
+    hqRoot = setupHqRoot();
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(resolveCompanyForCwd(path.join(hqRoot, "companies/indigo"), map)).toBe(INDIGO);
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "companies/hpo/knowledge"), map),
+    ).toBe(HPO);
   });
 
   it("does NOT attribute a company that lacks a cloud_uid (not cloud-backed)", async () => {
@@ -185,3 +206,413 @@ describe("resolveCompanyForSkill", () => {
     expect(resolveCompanyForSkill("", map)).toBeUndefined();
   });
 });
+
+/**
+ * Regression: the real `companies/manifest.yaml` records `repos` as BARE NAMES
+ * (`hq-cloud`), not HQ-root-relative paths (`repos/private/hq-cloud`). The
+ * original resolver did `path.resolve(hqRoot, repo)` and produced
+ * `<hqRoot>/hq-cloud` — a path no checkout lives at — so every entry matched
+ * nothing and NO telemetry event was ever attributed. Verified in prod at the
+ * time of the fix: 0 of 3200 sampled usage events across 9 people carried a
+ * `companyUid`, which left the Team Activity "Projects" tab permanently empty.
+ */
+describe("real-manifest shape: bare repo names + company directories", () => {
+  const ACME = "cmp_01ACME";
+  const BETA = "cmp_01BETA";
+
+  // Mirrors the live manifest: bare repo names, an explicit `path`, and a
+  // company with no cloud_uid (not cloud-backed).
+  const REAL_SHAPE = `companies:
+  acme:
+    name: Acme
+    path: companies/acme
+    repos:
+      - hq-cloud
+      - hq-console
+    cloud_uid: ${ACME}
+  beta:
+    name: Beta
+    path: companies/beta
+    repos:
+      - beta-site
+    cloud_uid: ${BETA}
+  nocloud:
+    name: NoCloud
+    path: companies/nocloud
+    repos:
+      - orphan-repo
+`;
+
+  let hqRoot: string;
+  afterEach(() => {
+    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
+  });
+
+  it("resolves a bare repo name to its repos/private checkout", async () => {
+    hqRoot = setupHqRoot(REAL_SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    const cwd = path.join(hqRoot, "repos/private/hq-console/src/app");
+    expect(resolveCompanyForCwd(cwd, map)).toBe(ACME);
+  });
+
+  it("resolves a bare repo name to its repos/public checkout", async () => {
+    hqRoot = setupHqRoot(REAL_SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    const cwd = path.join(hqRoot, "repos/public/hq-cloud");
+    expect(resolveCompanyForCwd(cwd, map)).toBe(ACME);
+  });
+
+  it("attributes work inside the company's own HQ directory", async () => {
+    hqRoot = setupHqRoot(REAL_SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(resolveCompanyForCwd(path.join(hqRoot, "companies/acme"), map)).toBe(ACME);
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "companies/beta/projects/x"), map),
+    ).toBe(BETA);
+  });
+
+  it("still honours an explicit HQ-root-relative repo path (back-compat)", async () => {
+    hqRoot = setupHqRoot();
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud/src"), map),
+    ).toBe("cmp_01INDIGO");
+  });
+
+  it("leaves a non-cloud-backed company's repos and directory unattributed", async () => {
+    hqRoot = setupHqRoot(REAL_SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "repos/private/orphan-repo"), map),
+    ).toBeUndefined();
+    expect(resolveCompanyForCwd(path.join(hqRoot, "companies/nocloud"), map)).toBeUndefined();
+  });
+
+  /**
+   * Case folding follows the FILESYSTEM, not the OS.
+   *
+   * Where the filesystem folds case, `.../HQ` and `.../hq` are literally the
+   * same directory and a differently-cased cwd must still attribute. Where it
+   * does not, they are different directories and an unattributed event is the
+   * correct (safe) outcome.
+   *
+   * The expectation is derived from the resolver's own probe (`map.foldsCase`),
+   * NOT from `process.platform` — case-sensitive APFS and case-insensitive
+   * volumes mounted on Linux both make the platform a liar, and this test would
+   * fail on them despite the resolver behaving correctly.
+   */
+  it("follows the probed filesystem for a differently-cased path", async () => {
+    hqRoot = setupHqRoot(REAL_SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    const cwd = path.join(hqRoot, "repos/private/hq-console").toUpperCase();
+    expect(resolveCompanyForCwd(cwd, map)).toBe(map.foldsCase ? ACME : undefined);
+  });
+
+  it("always matches an exactly-cased path", async () => {
+    hqRoot = setupHqRoot(REAL_SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-console/src"), map),
+    ).toBe(ACME);
+  });
+
+  it("treats backslash-separated paths as equivalent to forward slashes", async () => {
+    hqRoot = setupHqRoot(REAL_SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    const cwd = path.join(hqRoot, "repos/private/hq-console/src").replace(/\//g, "\\");
+    expect(resolveCompanyForCwd(cwd, map)).toBe(ACME);
+  });
+
+  it("does not let a sibling sharing a string prefix match", async () => {
+    hqRoot = setupHqRoot(REAL_SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-console-other"), map),
+    ).toBeUndefined();
+  });
+
+  it("emits no duplicate match keys", async () => {
+    hqRoot = setupHqRoot(REAL_SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    const keys = map.entries.map((e) => e.matchKey);
+    expect(new Set(keys).size).toBe(keys.length);
+  });
+});
+
+/**
+ * Codex-review follow-ups. Each of these is a real HQ layout that pure lexical
+ * matching against the primary checkout silently misses, leaving the work
+ * unattributed — the same class of gap that left the Projects tab empty.
+ */
+describe("real HQ layouts: worktrees, symlinks, and ambiguity", () => {
+  const ACME = "cmp_01ACME";
+  const BETA = "cmp_01BETA";
+
+  const SHAPE = `companies:
+  acme:
+    name: Acme
+    path: companies/acme
+    repos:
+      - hq-cloud
+    cloud_uid: ${ACME}
+  beta:
+    name: Beta
+    path: companies/beta
+    repos:
+      - beta-site
+    cloud_uid: ${BETA}
+`;
+
+  let hqRoot: string;
+  afterEach(() => {
+    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
+  });
+
+  function mkdirp(...segments: string[]): string {
+    const p = path.join(hqRoot, ...segments);
+    fs.mkdirSync(p, { recursive: true });
+    return p;
+  }
+
+  /**
+   * HQ does most feature work in a sibling git worktree named
+   * `<repo>-wt-<branch>`. The resolver's slash boundary rejects that as a mere
+   * string-prefix sibling of `<repo>`, so without explicit expansion every
+   * worktree session is unattributed.
+   */
+  it("attributes work inside a `<repo>-wt-*` git worktree", async () => {
+    hqRoot = setupHqRoot(SHAPE);
+    mkdirp("repos/private/hq-cloud");
+    const wt = mkdirp("repos/private/hq-cloud-wt-feature-x");
+
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(resolveCompanyForCwd(wt, map)).toBe(ACME);
+    expect(resolveCompanyForCwd(path.join(wt, "src/lib"), map)).toBe(ACME);
+  });
+
+  it("still rejects an unrelated sibling that merely shares the prefix", async () => {
+    hqRoot = setupHqRoot(SHAPE);
+    mkdirp("repos/private/hq-cloud");
+    const other = mkdirp("repos/private/hq-cloud-other");
+
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(resolveCompanyForCwd(other, map)).toBeUndefined();
+  });
+
+  /**
+   * A symlinked checkout reports its PHYSICAL path as cwd, which lives outside
+   * the HQ tree entirely and can never match the lexical root.
+   */
+  it("attributes a symlinked checkout reached by its physical path", async () => {
+    hqRoot = setupHqRoot(SHAPE);
+    const physical = fs.mkdtempSync(path.join(os.tmpdir(), "hq-physical-repo-"));
+    fs.mkdirSync(path.join(hqRoot, "repos/private"), { recursive: true });
+    try {
+      fs.symlinkSync(physical, path.join(hqRoot, "repos/private/hq-cloud"), "dir");
+    } catch {
+      return; // symlinks unavailable (e.g. unprivileged Windows) — skip
+    }
+
+    const map = await buildRepoCompanyMap(hqRoot);
+    try {
+      expect(resolveCompanyForCwd(fs.realpathSync(physical), map)).toBe(ACME);
+      // The lexical path must keep working too.
+      expect(
+        resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud"), map),
+      ).toBe(ACME);
+    } finally {
+      fs.rmSync(physical, { recursive: true, force: true });
+    }
+  });
+
+  /**
+   * Fail CLOSED: when two companies claim the same path, attributing to
+   * whichever the manifest listed first would be a cross-tenant
+   * misattribution. Unattributed is the correct answer.
+   */
+  it("leaves a path claimed by two companies unattributed", async () => {
+    const AMBIGUOUS = `companies:
+  acme:
+    name: Acme
+    repos:
+      - shared-repo
+    cloud_uid: ${ACME}
+  beta:
+    name: Beta
+    repos:
+      - shared-repo
+    cloud_uid: ${BETA}
+`;
+    hqRoot = setupHqRoot(AMBIGUOUS);
+    mkdirp("repos/private/shared-repo");
+
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "repos/private/shared-repo"), map),
+    ).toBeUndefined();
+  });
+
+  it("an ambiguous repo does not poison that company's other repos", async () => {
+    const AMBIGUOUS = `companies:
+  acme:
+    name: Acme
+    repos:
+      - shared-repo
+      - acme-only
+    cloud_uid: ${ACME}
+  beta:
+    name: Beta
+    repos:
+      - shared-repo
+    cloud_uid: ${BETA}
+`;
+    hqRoot = setupHqRoot(AMBIGUOUS);
+    mkdirp("repos/private/shared-repo");
+    mkdirp("repos/private/acme-only");
+
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "repos/private/acme-only"), map),
+    ).toBe(ACME);
+  });
+
+  it("reports the probed case-folding behaviour of the real filesystem", async () => {
+    hqRoot = setupHqRoot(SHAPE);
+    const map = await buildRepoCompanyMap(hqRoot);
+    expect(typeof map.foldsCase).toBe("boolean");
+    // Whatever the probe found, an exactly-cased path always resolves.
+    mkdirp("repos/private/hq-cloud");
+    const fresh = await buildRepoCompanyMap(hqRoot);
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud"), fresh),
+    ).toBe(ACME);
+  });
+});
+
+/**
+ * A worktree that no longer exists on disk.
+ *
+ * `buildRepoCompanyMap` discovers worktrees by reading the directory, which
+ * only sees what exists at build time. Telemetry, though, is read from a
+ * cursor — and a branch worktree is routinely deleted before the next pass,
+ * while pending JSONL rows still carry its cwd. Since a successful POST
+ * advances the cursor permanently, failing to resolve those rows loses the
+ * attribution for good.
+ */
+describe("worktree paths that no longer exist on disk", () => {
+  const ACME = "cmp_01ACME";
+  const SHAPE = `companies:
+  acme:
+    name: Acme
+    path: companies/acme
+    repos:
+      - hq-cloud
+    cloud_uid: ${ACME}
+`;
+
+  let hqRoot: string;
+  afterEach(() => {
+    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
+  });
+
+  it("resolves a deleted worktree's cwd by its documented naming convention", async () => {
+    hqRoot = setupHqRoot(SHAPE);
+    fs.mkdirSync(path.join(hqRoot, "repos/private/hq-cloud"), { recursive: true });
+    // NOTE: the worktree is deliberately NOT created — it was cleaned up before
+    // this telemetry pass, exactly as in the real failure.
+    const map = await buildRepoCompanyMap(hqRoot);
+
+    const gone = path.join(hqRoot, "repos/private/hq-cloud-wt-feature-gone");
+    expect(resolveCompanyForCwd(gone, map)).toBe(ACME);
+    expect(resolveCompanyForCwd(path.join(gone, "src/lib"), map)).toBe(ACME);
+  });
+
+  it("does not let the worktree fallback rescue an unrelated sibling", async () => {
+    hqRoot = setupHqRoot(SHAPE);
+    fs.mkdirSync(path.join(hqRoot, "repos/private/hq-cloud"), { recursive: true });
+    const map = await buildRepoCompanyMap(hqRoot);
+
+    // `-other` is not the `-wt-` convention, so it stays a foreign sibling...
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud-other"), map),
+    ).toBeUndefined();
+    // ...and a `-wt-` suffix on a repo nobody owns resolves to nothing.
+    expect(
+      resolveCompanyForCwd(path.join(hqRoot, "repos/private/stranger-wt-x"), map),
+    ).toBeUndefined();
+  });
+});
+
+/**
+ * Fail-closed must survive the worktree fallback.
+ *
+ * The fallback collapses `<repo>-wt-<branch>` to `<repo>`. If the worktree-
+ * shaped path was itself dropped for ambiguity, collapsing it would hand the
+ * event to whoever owns the base repo — quietly undoing the protection.
+ */
+describe("ambiguity is not escapable via the worktree fallback", () => {
+  const ACME = "cmp_01ACME";
+  const BETA = "cmp_01BETA";
+
+  let hqRoot: string;
+  afterEach(() => {
+    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
+  });
+
+  it("keeps an ambiguous `<repo>-wt-*` path unattributed instead of collapsing it", async () => {
+    // Acme owns `foo`; Beta owns a real repo that happens to be named
+    // `foo-wt-team`, which also looks like a worktree of Acme's `foo`.
+    hqRoot = setupHqRoot(`companies:
+  acme:
+    name: Acme
+    repos:
+      - foo
+    cloud_uid: ${ACME}
+  beta:
+    name: Beta
+    repos:
+      - foo-wt-team
+    cloud_uid: ${BETA}
+`);
+    fs.mkdirSync(path.join(hqRoot, "repos/private/foo"), { recursive: true });
+    fs.mkdirSync(path.join(hqRoot, "repos/private/foo-wt-team"), { recursive: true });
+
+    const map = await buildRepoCompanyMap(hqRoot);
+    const contested = path.join(hqRoot, "repos/private/foo-wt-team");
+
+    expect(resolveCompanyForCwd(contested, map)).toBeUndefined();
+    expect(resolveCompanyForCwd(path.join(contested, "src"), map)).toBeUndefined();
+    // The unambiguous base repo still resolves.
+    expect(resolveCompanyForCwd(path.join(hqRoot, "repos/private/foo"), map)).toBe(ACME);
+  });
+});
+
+/**
+ * `path` is documented as HQ-root-relative, but the manifest is synced and
+ * hand-editable. A path that escapes the root would claim a directory spanning
+ * other tenants and stamp this company's uid on everything beneath it.
+ */
+describe("company paths that escape the HQ root are rejected", () => {
+  const ACME = "cmp_01ACME";
+
+  let hqRoot: string;
+  afterEach(() => {
+    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
+  });
+
+  it.each([["  .."], ["."], ["/"]])("ignores path: %s", async (badPath) => {
+    hqRoot = setupHqRoot(`companies:
+  acme:
+    name: Acme
+    path: "${badPath.trim()}"
+    repos: []
+    cloud_uid: ${ACME}
+`);
+    const map = await buildRepoCompanyMap(hqRoot);
+
+    // Neither the HQ root nor its parent may be claimed.
+    expect(resolveCompanyForCwd(hqRoot, map)).toBeUndefined();
+    expect(resolveCompanyForCwd(path.dirname(hqRoot), map)).toBeUndefined();
+    expect(resolveCompanyForCwd(path.join(hqRoot, "companies/other"), map)).toBeUndefined();
+  });
+});