@indigoai-us/hq-cloud 6.14.36 → 6.14.39

package/dist/cli/sync.test.js

@@ -7,6 +7,12 @@ import * as path from "path";
 import * as os from "os";
 import { clearContextCache } from "../context.js";
 import { lockPathFor } from "../operation-lock.js";
+// Re-export node:fs as a mutable module so unreadable-link regressions can
+// inject a win32 EINVAL without needing a real Windows reparse point.
+vi.mock("fs", async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual };
+});
 // Mock s3 module at the top level
 vi.mock("../s3.js", async (importOriginal) => {
     const actual = await importOriginal();
@@ -53,6 +59,11 @@ const mockConfig = {
     authToken: "test-jwt-token",
     region: "us-east-1",
 };
+function errnoError(code) {
+    const err = new Error(`${code}: invalid argument, readlink`);
+    err.code = code;
+    return err;
+}
 const mockEntity = {
     uid: "cmp_01ABCDEF",
     slug: "acme",
@@ -312,6 +323,49 @@ describe("sync", () => {
         const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
         expect(journal.files["docs/handoff.md"]?.localDiverges).toBeFalsy();
     });
+    it("leaves a downloaded unreadable link unjournaled without emitting a fatal error", async () => {
+        const linkKey = "policies/downloaded-unreadable-link";
+        const linkPath = path.join(tmpDir, "companies", "acme", linkKey);
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: linkKey, size: 0, lastModified: new Date(), etag: '"link-etag"' },
+        ]);
+        vi.mocked(s3Module.downloadFile).mockImplementationOnce(async (_ctx, _key, localPath) => {
+            fs.mkdirSync(path.dirname(localPath), { recursive: true });
+            fs.symlinkSync("missing-target.md", localPath);
+            return { metadata: {} };
+        });
+        const realReadlinkSync = fs.readlinkSync;
+        const readlinkSpy = vi
+            .spyOn(fs, "readlinkSync")
+            .mockImplementation(((candidate) => {
+            if (candidate === linkPath)
+                throw errnoError("EINVAL");
+            return realReadlinkSync(candidate);
+        }));
+        const events = [];
+        try {
+            const result = await sync({
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                onEvent: (event) => events.push(event),
+            });
+            expect(result.filesDownloaded).toBe(0);
+            expect(result.filesSkipped).toBe(1);
+            expect(events).toContainEqual({
+                type: "not-shipped",
+                reason: "unreadable-link",
+                count: 1,
+                samplePaths: [linkKey],
+            });
+            expect(events.some((event) => event.type === "error")).toBe(false);
+            const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+            expect(journal.files[linkKey]).toBeUndefined();
+        }
+        finally {
+            readlinkSpy.mockRestore();
+        }
+    });
     it("emits a conflict event with path + resolution on hash mismatch", async () => {
         const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
         fs.mkdirSync(companyDocs, { recursive: true });
@@ -407,6 +461,67 @@ describe("sync", () => {
         expect(journalAfter.files["docs/handoff.md"].hash).not.toBe("stale-hash");
         expect(journalAfter.files["docs/handoff.md"].remoteEtag).toBeTruthy();
     });
+    it("defers a conflict whose downloaded link target cannot be read", async () => {
+        const linkKey = "docs/handoff.md";
+        const localPath = path.join(tmpDir, "companies", "acme", linkKey);
+        fs.mkdirSync(path.dirname(localPath), { recursive: true });
+        fs.writeFileSync(localPath, "local version");
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: linkKey, size: 0, lastModified: new Date(), etag: '"remote-link"' },
+        ]);
+        let mirrorPath = "";
+        vi.mocked(s3Module.downloadFile).mockImplementationOnce(async (_ctx, _key, destination) => {
+            mirrorPath = destination;
+            fs.mkdirSync(path.dirname(destination), { recursive: true });
+            fs.symlinkSync("missing-target.md", destination);
+            return { metadata: {} };
+        });
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                [linkKey]: {
+                    hash: "stale-hash",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        const realReadlinkSync = fs.readlinkSync;
+        const readlinkSpy = vi
+            .spyOn(fs, "readlinkSync")
+            .mockImplementation(((candidate) => {
+            if (candidate === mirrorPath)
+                throw errnoError("EINVAL");
+            return realReadlinkSync(candidate);
+        }));
+        const events = [];
+        try {
+            const result = await sync({
+                company: "acme",
+                onConflict: "keep",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                onEvent: (event) => events.push(event),
+            });
+            expect(result.conflicts).toBe(0);
+            expect(result.filesSkipped).toBeGreaterThanOrEqual(1);
+            expect(events).toContainEqual({
+                type: "not-shipped",
+                reason: "unreadable-link",
+                count: 1,
+                samplePaths: [linkKey],
+            });
+            expect(events.some((event) => event.type === "error")).toBe(false);
+            expect(fs.readFileSync(localPath, "utf-8")).toBe("local version");
+            const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+            expect(journal.files[linkKey].hash).toBe("stale-hash");
+        }
+        finally {
+            readlinkSpy.mockRestore();
+        }
+    });
     it("still writes a `.conflict-*` mirror when remote genuinely diverges from local", async () => {
         // Guard the other side of the convergence branch: when the probe bytes
         // differ from local, it remains a real conflict — counted, kept, and the
@@ -2319,6 +2434,40 @@ describe("sync", () => {
         expect(result.filesDownloaded).toBe(1);
         expect(result.filesExcludedByPolicy).toBeGreaterThanOrEqual(1);
     });
+    it("skips remote keys under companies/<slug>/ in a company vault (doubly-scoped corrupt object — frogbear exit-2 regression)", async () => {
+        // A company vault is already anchored at its company root, so its keys are
+        // bucket-relative. A remote key literally beginning with `companies/...` is
+        // a doubly-scoped corrupt object: the vault-service refuses to presign it
+        // (INVALID_KEY_COMPANIES_SCOPED), so the per-file GET fails and the whole
+        // company wedges at "errored" (runner exit 2) on every run. Verified live
+        // 2026-06-16 against frogbear. The pull planner must refuse it at planning
+        // time — same policy bucket as the malformed-key / ephemeral filters.
+        const corruptKey = "companies/acme/drafts/reports/signals-2026-06-15.html";
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            // Doubly-scoped corrupt key — must be filtered, never downloaded.
+            { key: corruptKey, size: 2152, lastModified: new Date(), etag: '"corrupt"' },
+            // A legitimate bucket-relative key — must still download.
+            { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"ok"' },
+        ]);
+        const result = await sync({
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        // The corrupt key MUST NOT be materialized at its doubled local path.
+        expect(fs.existsSync(path.join(companyRoot, "companies", "acme", "drafts", "reports", "signals-2026-06-15.html"))).toBe(false);
+        // The vault-service GET must never be attempted for the corrupt key — the
+        // failing presign is the exact symptom this guard removes.
+        for (const call of vi.mocked(s3Module.downloadFile).mock.calls) {
+            expect(call[1]).not.toBe(corruptKey);
+        }
+        // The legitimate bucket-relative key MUST still download.
+        expect(fs.existsSync(path.join(companyRoot, "docs", "handoff.md"))).toBe(true);
+        expect(result.filesDownloaded).toBe(1);
+        expect(result.filesExcludedByPolicy).toBeGreaterThanOrEqual(1);
+        expect(result.aborted).toBe(false);
+    });
     it("F02: rejects traversal remote keys before they can escape the company root", async () => {
         const escapeName = `${path.basename(tmpDir)}-escaped.md`;
         const traversalKey = `../../../${escapeName}`;
@@ -3433,6 +3582,45 @@ describe("sync", () => {
         expect(result.filesSkipped).toBe(1);
         expect(result.conflicts).toBe(0);
     });
+    it("defers an unreadable local symlink instead of aborting the pull plan", async () => {
+        const linkKey = "policies/unreadable-link";
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        const linkPath = path.join(companyRoot, linkKey);
+        fs.mkdirSync(path.dirname(linkPath), { recursive: true });
+        fs.symlinkSync("target.md", linkPath);
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: linkKey, size: 0, lastModified: new Date(), etag: '"link-etag"' },
+        ]);
+        const realReadlinkSync = fs.readlinkSync;
+        const readlinkSpy = vi
+            .spyOn(fs, "readlinkSync")
+            .mockImplementation(((candidate) => {
+            if (candidate === linkPath)
+                throw errnoError("EINVAL");
+            return realReadlinkSync(candidate);
+        }));
+        try {
+            const events = [];
+            const result = await sync({
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                onEvent: (event) => events.push(event),
+            });
+            expect(result.filesDownloaded).toBe(0);
+            expect(result.filesSkipped).toBe(1);
+            expect(s3Module.downloadFile).not.toHaveBeenCalled();
+            expect(events).toContainEqual({
+                type: "not-shipped",
+                reason: "unreadable-link",
+                count: 1,
+                samplePaths: [linkKey],
+            });
+        }
+        finally {
+            readlinkSpy.mockRestore();
+        }
+    });
     it("classifies a dangling-symlink + remote-change as a conflict without crashing on statSync", async () => {
         // Codex round-11 P2 follow-up: pre-fix, the conflict executor
         // built the resolveConflict prompt with `fs.statSync(localPath).