@indigoai-us/hq-cloud 6.14.36 → 6.14.37

package/src/cli/sync.test.ts

@@ -2782,6 +2782,48 @@ describe("sync", () => {
     expect(result.filesExcludedByPolicy).toBeGreaterThanOrEqual(1);
   });
 
+  it("skips remote keys under companies/<slug>/ in a company vault (doubly-scoped corrupt object — frogbear exit-2 regression)", async () => {
+    // A company vault is already anchored at its company root, so its keys are
+    // bucket-relative. A remote key literally beginning with `companies/...` is
+    // a doubly-scoped corrupt object: the vault-service refuses to presign it
+    // (INVALID_KEY_COMPANIES_SCOPED), so the per-file GET fails and the whole
+    // company wedges at "errored" (runner exit 2) on every run. Verified live
+    // 2026-06-16 against frogbear. The pull planner must refuse it at planning
+    // time — same policy bucket as the malformed-key / ephemeral filters.
+    const corruptKey = "companies/acme/drafts/reports/signals-2026-06-15.html";
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      // Doubly-scoped corrupt key — must be filtered, never downloaded.
+      { key: corruptKey, size: 2152, lastModified: new Date(), etag: '"corrupt"' },
+      // A legitimate bucket-relative key — must still download.
+      { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"ok"' },
+    ]);
+
+    const result = await sync({
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+    });
+
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    // The corrupt key MUST NOT be materialized at its doubled local path.
+    expect(
+      fs.existsSync(
+        path.join(companyRoot, "companies", "acme", "drafts", "reports", "signals-2026-06-15.html"),
+      ),
+    ).toBe(false);
+    // The vault-service GET must never be attempted for the corrupt key — the
+    // failing presign is the exact symptom this guard removes.
+    for (const call of vi.mocked(s3Module.downloadFile).mock.calls) {
+      expect(call[1]).not.toBe(corruptKey);
+    }
+    // The legitimate bucket-relative key MUST still download.
+    expect(fs.existsSync(path.join(companyRoot, "docs", "handoff.md"))).toBe(true);
+
+    expect(result.filesDownloaded).toBe(1);
+    expect(result.filesExcludedByPolicy).toBeGreaterThanOrEqual(1);
+    expect(result.aborted).toBe(false);
+  });
+
   it("F02: rejects traversal remote keys before they can escape the company root", async () => {
     const escapeName = `${path.basename(tmpDir)}-escaped.md`;
     const traversalKey = `../../../${escapeName}`;

package/src/cli/sync.ts

@@ -78,7 +78,7 @@ import {
   resolveActiveCompany,
   resolveTransferConcurrency,
 } from "../sync-core.js";
-import { isEphemeralPath, isMalformedVaultKey } from "./share.js";
+import { isEphemeralPath, isForbiddenCompanyVaultKey, isMalformedVaultKey } from "./share.js";
 import { resolveConflict } from "./conflict.js";
 import type { ConflictStrategy, ConflictResolution } from "./conflict.js";
 import {
@@ -433,6 +433,31 @@ export type SyncProgressEvent =
       path: string;
       /** The already-journaled spelling that owns this logical path. */
       journaledKey: string;
+    }
+  | {
+      /**
+       * Emitted at most ONCE per `reason` per `share()` push leg when local
+       * content the walk saw was deliberately NOT uploaded and would otherwise
+       * vanish from every push bucket without a trace (feedback_258e4a86 /
+       * feedback_a51cb63d — an hour lost because a "Pushed 0 file(s)" success
+       * named nothing that was skipped). `reason` distinguishes the cause:
+       *
+       *   - `"unreachable-path"`: a path the caller EXPLICITLY named exists on
+       *     disk but the resolver could not place it under the company folder,
+       *     or could not find it under any base. This is actionable signal — the
+       *     named target was NOT shipped — so the CLI may treat it as an error.
+       *   - `"linked-subtree"`: a directory symlink whose target lives OUTSIDE
+       *     the company folder was recorded as a link but its contents were not
+       *     descended/uploaded. They sync via their own repo, not the vault;
+       *     this is informational, not an error.
+       *
+       * `count` is the number of distinct paths for that reason; `samplePaths`
+       * carries up to 10 for display. Not emitted when `count === 0`.
+       */
+      type: "not-shipped";
+      reason: "unreachable-path" | "linked-subtree";
+      count: number;
+      samplePaths: string[];
     };
 
 export interface SyncOptions {
@@ -2432,6 +2457,19 @@ function computePullPlan(
       continue;
     }
 
+    // Company-vault double-scoped-key filter. A company vault is already
+    // anchored at its company root, so a remote key under `companies/...` is a
+    // corrupt doubly-scoped object the vault-service refuses to presign
+    // (INVALID_KEY_COMPANIES_SCOPED). Without this, the puller enqueues it, the
+    // per-file GET fails, and the whole company wedges at "errored" (runner
+    // exit 2) on every run (frogbear, 2026-06-16). Refuse at plan time,
+    // symmetric with the malformed/ephemeral filters above. Personal vaults
+    // handle `companies/...` keys in the dedicated branch below.
+    if (isForbiddenCompanyVaultKey(remoteFile.key, personalMode)) {
+      items.push({ action: "skip-excluded-policy", remoteFile, localPath });
+      continue;
+    }
+
     // Personal-vault policy must be symmetric across both transfer legs.
     // The push walker refuses derived/machine-local/sensitive paths, but old
     // objects can remain in the bucket from clients that predate an exclusion.
@@ -3085,6 +3123,13 @@ function computePullPlan(
     }
     const localPath = resolveContainedVaultPath(companyRoot, key);
     if (localPath === null) continue;
+    // Scope-invalid journal keys (company mode, `companies/…` prefix): the
+    // download branch skips them (presign rejects), but a journaled entry whose
+    // key is absent from the remote LIST is doubled-tree poison that must
+    // drain — local copy under companies/{slug}/companies/{slug}/… removed and
+    // journal dropped. HEAD verify is skipped in verifyPlannedJournalTombstones
+    // (presign would reject); see the auto-verified branch there.
+    const scopeInvalidJournalKey = isForbiddenCompanyVaultKey(key, personalMode);
     // PersonalMode key gating — mirror the download branch. Local (non-cloud)
     // company keys are tombstone-eligible (a peer's delete should propagate),
     // but team-synced orphans are left alone (the team-bucket pull owns those
@@ -3101,8 +3146,15 @@ function computePullPlan(
     if (isEphemeralPath(key)) continue;
     // Honor the current ignore filter — if a path was previously synced
     // but is now ignored (operator edited .hqignore), do NOT delete
-    // the local copy. They're keeping it deliberately.
-    if (!shouldSync(localPath, false) && !shouldSync(localPath, true)) continue;
+    // the local copy. They're keeping it deliberately. Scope-invalid poison
+    // bypasses this: the doubled-tree copy must not survive silently.
+    if (
+      !scopeInvalidJournalKey &&
+      !shouldSync(localPath, false) &&
+      !shouldSync(localPath, true)
+    ) {
+      continue;
+    }
     // Codex P1 (PR #24 round 3): detect local edits before tombstoning.
     // Delete-vs-local-edit race: peer deleted the file remotely while
     // this machine edited it locally before the next sync. Without
@@ -3272,5 +3324,28 @@ function defaultConsoleLogger(event: SyncProgressEvent): void {
     console.warn(
       `  ! ${event.path} skipped — junk key spelling; this logical path is already synced as ${event.journaledKey} (mixed-version peer artifact; the vault doctor collapses the family)`,
     );
+  } else if (event.type === "not-shipped") {
+    if (event.reason === "unreachable-path") {
+      console.warn(
+        `  ! ${event.count} named path${event.count === 1 ? "" : "s"} could NOT be pushed — the file exists but is not reachable under the company folder (nothing was uploaded for ${event.count === 1 ? "it" : "them"}):`,
+      );
+    } else {
+      console.warn(
+        `  ! ${event.count} linked subtree${event.count === 1 ? "" : "s"} recorded but NOT uploaded — contents sync via their own repo, not the vault:`,
+      );
+    }
+    for (const p of event.samplePaths) {
+      console.warn(`    · ${p}`);
+    }
+    if (event.count > event.samplePaths.length) {
+      console.warn(`    ... and ${event.count - event.samplePaths.length} more`);
+    }
+    if (event.reason === "linked-subtree") {
+      console.warn(
+        `    To put a file from a linked subtree in the vault, push it by name:\n` +
+        `      hq sync push <path> --company <slug>\n` +
+        `    That uploads a point-in-time copy; re-run it after each edit (regular sync will not track or update it).`,
+      );
+    }
   }
 }