@indigoai-us/hq-cloud 6.14.33 → 6.14.35

package/src/cli/share.test.ts

@@ -4222,12 +4222,16 @@ describe("share", () => {
       missing,
       direction = "up" as "up" | "down",
       withIntents = true,
+      intentFor,
     }: {
       total: number;
       missing: number;
       direction?: "up" | "down";
       withIntents?: boolean;
+      /** Per-entry override of `withIntents`, for mixed-bucket cases. */
+      intentFor?: (index: number) => boolean;
     }): { companyRoot: string; journalPath: string } {
+      const hasIntent = intentFor ?? ((): boolean => withIntents);
       const companyRoot = path.join(tmpDir, "companies", "acme");
       fs.mkdirSync(companyRoot, { recursive: true });
       const files: Record<
@@ -4251,7 +4255,7 @@ describe("share", () => {
           direction,
           remoteEtag: `etag-${i}`,
           kind: "file",
-          ...(withIntents
+          ...(hasIntent(i)
             ? { localDeleteIntent: deleteIntent(`etag-${i}`, "h") }
             : {}),
         };
@@ -4336,14 +4340,25 @@ describe("share", () => {
       expect(perKeyRefusals.length).toBe(11);
     });
 
-    it("intent-backed 11/100 subtree disappearance bypasses the breaker and deletes every covered path", async () => {
-      const { companyRoot } = setupJournal({ total: 100, missing: 11 });
+    // Regression: hq-cloud #227 (v6.14.19) narrowed the breaker numerator to
+    // intent-less disappearances and, in the same change, shipped the watcher
+    // producer that stamps one intent per descendant of a vanished directory.
+    // The assertion this replaces ("intent-backed 11/100 bypasses the breaker
+    // and deletes every covered path") is that PR's own seven-day-old
+    // assertion, not established contract; it is what the 2026-07-30
+    // 1,108-file mass deletion looked like in test form. Intent currency is a
+    // per-file property and cannot stand in for whole-set health.
+    it("intent-backed 11/100 subtree disappearance ALSO trips the breaker: no delete is issued", async () => {
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+      });
       vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
         etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
         lastModified: new Date(),
         size: 5,
       }));
-      const events: Array<{ type: string }> = [];
+      const events: Array<{ type: string; [k: string]: unknown }> = [];
 
       const result = await share({
         paths: [companyRoot],
@@ -4356,11 +4371,147 @@ describe("share", () => {
         onEvent: (e) => events.push(e as { type: string }),
       });
 
-      expect(result.filesDeleted).toBe(11);
-      expect(deleteRemoteFile).toHaveBeenCalledTimes(11);
+      expect(result.filesDeleted).toBe(0);
+      expect(deleteRemoteFile).not.toHaveBeenCalled();
+      const summary = events.find(
+        (e) => e.type === "delete-refused-bulk-asymmetry",
+      ) as { candidates: number; inScope: number; ratio: number } | undefined;
+      expect(summary).toBeDefined();
+      expect(summary!.candidates).toBe(11);
+      expect(summary!.inScope).toBe(100);
+      // No HEAD for the would-be delete candidates — the trip short-circuits
+      // Stage 2 exactly as it does for intent-less disappearances.
+      const headedKeys = vi
+        .mocked(headRemoteFile)
+        .mock.calls.map((c) => c[1] as string);
+      for (let i = 0; i < 11; i++) {
+        expect(headedKeys).not.toContain(`f-${i.toString().padStart(4, "0")}.md`);
+      }
+      // Journal untouched — the entries stay recoverable.
+      const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+      expect(Object.keys(journal.files).length).toBe(100);
+    });
+
+    // The core of the #227 regression, isolated: pre-#227 a trip emptied
+    // `plan.toDelete`; #227 replaced that with an in-place re-label of entries
+    // already in `refusedStale`, so the breaker stopped stopping anything it
+    // had not already refused for another reason. owned-only stages its picks
+    // directly into `toDelete` (no HEAD pass), so it is the sharpest probe of
+    // that one line.
+    it("a trip empties plan.toDelete: owned-only intent-backed 11/100 issues no DeleteObject", async () => {
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+      });
+
+      const events: Array<{ type: string; [k: string]: unknown }> = [];
+      const result = await share({
+        paths: [companyRoot],
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipUnchanged: true,
+        propagateDeletes: true,
+        propagateDeletePolicy: "owned-only",
+        onEvent: (e) => events.push(e as { type: string }),
+      });
+
+      expect(result.filesDeleted).toBe(0);
+      expect(deleteRemoteFile).not.toHaveBeenCalled();
+      expect(result.filesRefusedStale).toBe(11);
+      const perKeyRefusals = events.filter(
+        (e) =>
+          e.type === "delete-refused-stale-etag" &&
+          e.reason === "bulk-asymmetry",
+      );
+      expect(perKeyRefusals.length).toBe(11);
+      const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+      expect(Object.keys(journal.files).length).toBe(100);
+    });
+
+    it("vault litter still drains when the breaker trips", async () => {
+      // The trip short-circuits the Stage-2 HEAD pass, so the litter merge has
+      // to happen on that path too. Litter is never a user content loss, and
+      // refusing the ratchet-drain would leave conflict mirrors stuck in the
+      // vault for as long as the mirror looks unhealthy.
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+        withIntents: false,
+      });
+      const litterKey = "CLAUDE.md.conflict-2026-05-13T19-40-40Z-e5797a.md";
+      const seeded = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+      seeded.files[litterKey] = {
+        hash: "h",
+        size: 5,
+        syncedAt: new Date().toISOString(),
+        direction: "up",
+        remoteEtag: "litter-etag",
+        kind: "file",
+      };
+      fs.writeFileSync(journalPath, JSON.stringify(seeded));
+      vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
+        etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
+        lastModified: new Date(),
+        size: 5,
+      }));
+
+      const events: Array<{ type: string }> = [];
+      const result = await share({
+        paths: [companyRoot],
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipUnchanged: true,
+        propagateDeletes: true,
+        propagateDeletePolicy: "currency-gated",
+        onEvent: (e) => events.push(e as { type: string }),
+      });
+
       expect(
         events.find((e) => e.type === "delete-refused-bulk-asymmetry"),
-      ).toBeUndefined();
+      ).toBeDefined();
+      expect(result.filesDeleted).toBe(1);
+      expect(deleteRemoteFile).toHaveBeenCalledTimes(1);
+      expect(deleteRemoteFile).toHaveBeenCalledWith(
+        expect.anything(),
+        litterKey,
+      );
+    });
+
+    it("intent-backed and intent-less disappearances share one numerator: 6 + 5 of 100 trips", async () => {
+      const { companyRoot } = setupJournal({
+        total: 100,
+        missing: 11,
+        intentFor: (i) => i < 6,
+      });
+      vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
+        etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
+        lastModified: new Date(),
+        size: 5,
+      }));
+
+      const events: Array<{ type: string; [k: string]: unknown }> = [];
+      const result = await share({
+        paths: [companyRoot],
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipUnchanged: true,
+        propagateDeletes: true,
+        propagateDeletePolicy: "currency-gated",
+        onEvent: (e) => events.push(e as { type: string }),
+      });
+
+      expect(result.filesDeleted).toBe(0);
+      expect(deleteRemoteFile).not.toHaveBeenCalled();
+      const summary = events.find(
+        (e) => e.type === "delete-refused-bulk-asymmetry",
+      ) as { candidates: number } | undefined;
+      expect(summary).toBeDefined();
+      // Neither bucket reaches MIN_ABS alone; together they are the whole
+      // prospective destructive set and must be counted as one.
+      expect(summary!.candidates).toBe(11);
     });
 
     it("does NOT trip at 9/100 (below ratio): all candidates delete normally", async () => {
@@ -4388,6 +4539,9 @@ describe("share", () => {
       expect(events.find((e) => e.type === "delete-refused-bulk-asymmetry")).toBeUndefined();
     });
 
+    // The two bypasses below are the sanctioned route for a genuinely
+    // intentional mass delete now that intent-backed candidates count toward
+    // the numerator. Both journals here carry current delete intents.
     it("HQ_SYNC_DELETE_BULK_OVERRIDE=1 bypasses the guard: 11/100 deletes proceed", async () => {
       process.env.HQ_SYNC_DELETE_BULK_OVERRIDE = "1";
       const { companyRoot } = setupJournal({ total: 100, missing: 11 });

package/src/cli/share.ts

@@ -2233,6 +2233,12 @@ type RefusedStaleReason =
  *   - `candidates / inScope >= BULK_ASYMMETRY_RATIO` (default 10%).
  *   - `candidates >= BULK_ASYMMETRY_MIN_ABS` (default 10).
  *
+ * `candidates` is the whole prospective destructive set, whether or not each
+ * entry carries a current watcher delete-intent. A live watcher stamps one
+ * intent per descendant when a directory disappears, so intent presence says
+ * nothing about whether the disappearance was deliberate — see the numerator
+ * comment in `computeDeletePlan` and the 2026-07-30 incident.
+ *
  * The MIN_ABS floor is what lets small intentional deletes through —
  * `rm 1 file` from a 5-entry mirror is 20% but 1 absolute candidate; never
  * tripped. The RATIO is what lets large intentional uploads-then-deletes
@@ -2431,18 +2437,37 @@ async function computeDeletePlan(
   // and the journal-mutation buckets are already settled before any I/O.
   type HeadCandidate = { key: string; journalEtag: string; intentVersion: 1 };
   const headCandidates: HeadCandidate[] = [];
-  // Litter drain bucket — kept separate from normal delete candidates so
-  // the bulk-asymmetry accounting cannot sweep these in. See
+  // Litter drain bucket — kept separate from `plan.toDelete` so the
+  // bulk-asymmetry breaker (which moves toDelete + headCandidates into
+  // `refusedStale` when it trips) can't sweep these out. See
   // `isVaultLitterArtifact` for the patterns and rationale: by construction
   // these aren't user content losses, so a high ratio of litter must not
   // refuse the drain — that's the whole point of the bypass. Merged into
   // `plan.toDelete` after the breaker check.
   const litterToDelete: string[] = [];
-  // Current watcher intents are affirmative evidence of an observed delete,
-  // so only intent-less disappearances contribute to the mirror-loss breaker.
-  // An unmounted/wiped tree produces no intents and still trips it.
+  // Bulk-asymmetry tracking: count every in-scope journal entry (denominator)
+  // and every entry that would have been a delete-candidate before the guard
+  // (numerator). The numerator is the WHOLE prospective destructive set:
+  // intent-backed picks (owned-only/all toDelete, currency-gated
+  // headCandidates, legacy-no-etag refusals) AND intent-less disappearances.
+  //
+  // 6.14.19 (#227) narrowed it to intent-less disappearances only, on the
+  // premise that a current watcher intent is affirmative evidence of a
+  // deliberate delete. A wiped, swapped, unmounted or partially-restored tree
+  // observed by a live watcher mints an intent per descendant, so that premise
+  // does not hold and the breaker stopped covering the exact failure mode it
+  // exists for (incident 2026-07-30: 1,108 intent-backed deletions in one
+  // push). Intent currency is a per-file property; the breaker is a whole-set
+  // health check, and the two must not be conflated.
+  //
+  // We do NOT count "ENOENT but ignore-filtered" or "ENOENT but ephemeral" —
+  // those drop out of the plan entirely on their own and don't reflect
+  // mirror-loss intent — nor litter drains (see above), which are intentional
+  // ratchet-cleanup, not mass-delete intent.
   let inScopeJournalEntries = 0;
-  let intentlessDisappearances = 0;
+  let bulkCandidatePicks = 0;
+  // Intent-less candidates already parked in `refusedStale`. On a trip they are
+  // re-labelled `bulk-asymmetry` in place rather than refused twice.
   const intentlessKeys = new Set<string>();
 
   for (const [relativeKey, entry] of Object.entries(journal.files)) {
@@ -2534,7 +2559,7 @@ async function computeDeletePlan(
         policy === "currency-gated" ||
         (policy === "owned-only" && entry.direction === "up")
       ) {
-        intentlessDisappearances++;
+        bulkCandidatePicks++;
         intentlessKeys.add(relativeKey);
       }
       plan.refusedStale.push({
@@ -2546,6 +2571,7 @@ async function computeDeletePlan(
       continue;
     }
 
+    bulkCandidatePicks++;
     if (policy === "all") {
       // policy:"all" is the explicit-opt-out emergency-reconcile mode; the
       // bulk-asymmetry guard skips this branch (caller asserted intent).
@@ -2557,6 +2583,11 @@ async function computeDeletePlan(
     }
     if (policy === "owned-only") {
       if (entry.direction !== "up") {
+        // Not a delete candidate under owned-only, but it WAS missing
+        // locally. Don't count it for the bulk guard — direction:'down'
+        // entries that vanish locally are silently ignored by this policy
+        // anyway, so they don't represent intent to mass-delete.
+        bulkCandidatePicks--;
         continue;
       }
       plan.toDelete.push({
@@ -2589,26 +2620,54 @@ async function computeDeletePlan(
   if (
     policy !== "all" &&
     !isBulkAsymmetryOverride() &&
-    intentlessDisappearances >= BULK_ASYMMETRY_MIN_ABS &&
+    bulkCandidatePicks >= BULK_ASYMMETRY_MIN_ABS &&
     inScopeJournalEntries > 0 &&
-    intentlessDisappearances / inScopeJournalEntries >= BULK_ASYMMETRY_RATIO
+    bulkCandidatePicks / inScopeJournalEntries >= BULK_ASYMMETRY_RATIO
   ) {
+    // Move every staged candidate (both already-bucketed toDelete from
+    // owned-only and queued headCandidates from currency-gated) into
+    // refusedStale with reason "bulk-asymmetry", and re-label the intent-less
+    // entries already parked there. Journal is not mutated; no DeleteObject is
+    // issued; the Stage-2 HEAD pass never runs.
     const samplePaths: string[] = [];
+    const noteSample = (key: string): void => {
+      if (samplePaths.length < BULK_ASYMMETRY_SAMPLE_CAP) samplePaths.push(key);
+    };
     for (const refused of plan.refusedStale) {
       if (!intentlessKeys.has(refused.key)) continue;
       refused.journalEtag = "<bulk-asymmetry>";
       refused.remoteEtag = "<not-checked>";
       refused.reason = "bulk-asymmetry";
-      if (samplePaths.length < BULK_ASYMMETRY_SAMPLE_CAP) {
-        samplePaths.push(refused.key);
-      }
+      noteSample(refused.key);
     }
+    const pushRefused = (key: string): void => {
+      plan.refusedStale.push({
+        key,
+        journalEtag: "<bulk-asymmetry>",
+        remoteEtag: "<not-checked>",
+        reason: "bulk-asymmetry",
+      });
+      noteSample(key);
+    };
+    for (const item of plan.toDelete) pushRefused(item.key);
+    for (const c of headCandidates) pushRefused(c.key);
+    // Emptying the delete list is what makes the trip a refusal rather than a
+    // label. #227 dropped this line, so a tripped breaker stopped nothing it
+    // had not already refused for another reason.
+    plan.toDelete = [];
     plan.bulkAsymmetry = {
-      candidates: intentlessDisappearances,
+      candidates: bulkCandidatePicks,
       inScope: inScopeJournalEntries,
-      ratio: intentlessDisappearances / inScopeJournalEntries,
+      ratio: bulkCandidatePicks / inScopeJournalEntries,
       samplePaths,
     };
+    // Litter still drains even when the breaker trips — see `litterToDelete`
+    // declaration. The breaker protects against corrupt-mirror mass-deletes
+    // of user content; litter cleanup is orthogonal and should never be
+    // refused for the same reason new-litter producer-side exclusions
+    // shouldn't block it.
+    plan.toDelete.push(...litterToDelete.map((key) => ({ key, intentVersion: null })));
+    return plan;
   }
 
   // Stage 2: bounded-parallel HEAD pass. Promise.all over chunks of size