@indigoai-us/hq-cloud 6.14.39 → 6.14.41

package/src/cli/sync.test.ts

@@ -931,6 +931,109 @@ describe("sync", () => {
     expect(fs.readFileSync(localPath, "utf-8")).toBe("mock file content");
   });
 
+  it("untracked-local guard: an UNJOURNALED local file is NOT silently clobbered — routes through conflict and preserves local", async () => {
+    // Regression for the 2026-08-01/02 prd.json losses: a locally-edited file
+    // whose key has NO journal entry fell straight through the 3-way merge to
+    // `download` (localChanged and remoteChanged are both gated on
+    // `!!journalEntry`, so both read false). The in-progress local edit was
+    // overwritten with the cloud copy with no conflict, no `.conflict-` mirror,
+    // and no conflict-index record — the loss was invisible.
+    //
+    // A key with no journal entry carries NO evidence that local and remote
+    // ever agreed, so a blind overwrite is never safe. Route it through the
+    // conflict path; the executor's convergence probe still collapses a
+    // byte-identical remote to a silent reconcile (covered by the next test),
+    // so this costs nothing on the common first-pull case.
+    const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+    fs.mkdirSync(companyDocs, { recursive: true });
+    const localPath = path.join(companyDocs, "handoff.md");
+    // Stand-in for the PRD carrying the in-progress 11th story.
+    const localContent = "in-progress local work that must survive\n";
+    fs.writeFileSync(localPath, localContent);
+
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key: "docs/handoff.md", size: 17, lastModified: new Date(), etag: '"cloud-etag"' },
+    ]);
+
+    // Journal has NO entry for this key — the whole point of the regression.
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({ version: "1", lastSync: new Date().toISOString(), files: {} }),
+    );
+
+    const result = await sync({
+      company: "acme",
+      onConflict: "keep",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+    });
+
+    // Surfaced as a conflict, NOT a silent download.
+    expect(result.conflicts).toBe(1);
+    expect(result.conflictPaths).toEqual(["docs/handoff.md"]);
+    expect(result.filesDownloaded).toBe(0);
+    // The local edit is intact.
+    expect(fs.readFileSync(localPath, "utf-8")).toBe(localContent);
+    // Cloud copy preserved alongside it for inspection / `/resolve-conflicts`.
+    const litter = fs
+      .readdirSync(companyDocs)
+      .filter((f) => f.includes(".conflict-"));
+    expect(litter).toHaveLength(1);
+    expect(fs.readFileSync(path.join(companyDocs, litter[0]!), "utf-8")).toBe(
+      "mock file content",
+    );
+    // And a durable record exists so the overwrite can never be silent.
+    const index = JSON.parse(
+      fs.readFileSync(path.join(tmpDir, ".hq-conflicts", "index.json"), "utf-8"),
+    );
+    expect(
+      index.conflicts.some(
+        (c: { originalPath: string }) =>
+          c.originalPath === "companies/acme/docs/handoff.md",
+      ),
+    ).toBe(true);
+  });
+
+  it("untracked-local guard is free on first pull: an unjournaled local file that already MATCHES the cloud reconciles silently", async () => {
+    // The guard must not manufacture conflicts for the common case — a fresh
+    // machine, or a re-created journal, where local and cloud are already
+    // byte-identical. The executor's convergence probe collapses these to a
+    // reconcile: no conflict, no mirror, journal stamped so the next sync is
+    // a plain skip-unchanged.
+    const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+    fs.mkdirSync(companyDocs, { recursive: true });
+    const localPath = path.join(companyDocs, "handoff.md");
+    // Byte-identical to what the downloadFile mock writes.
+    fs.writeFileSync(localPath, "mock file content");
+
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key: "docs/handoff.md", size: 17, lastModified: new Date(), etag: '"cloud-etag"' },
+    ]);
+
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({ version: "1", lastSync: new Date().toISOString(), files: {} }),
+    );
+
+    const result = await sync({
+      company: "acme",
+      onConflict: "keep",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+    });
+
+    expect(result.conflicts).toBe(0);
+    expect(result.conflictPaths).toEqual([]);
+    expect(fs.readFileSync(localPath, "utf-8")).toBe("mock file content");
+    const litter = fs
+      .readdirSync(companyDocs)
+      .filter((f) => f.includes(".conflict-"));
+    expect(litter).toHaveLength(0);
+    // Journal stamped, so the next pass is a plain unchanged-skip.
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["docs/handoff.md"]).toBeDefined();
+  });
+
   it("RF-F02EXEC: refuses a download whose parent symlink appears after planning", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     const outsideRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-sync-escape-"));

package/src/cli/sync.ts

@@ -2903,6 +2903,48 @@ function computePullPlan(
         continue;
       }
 
+      // ── Untracked-local guard (unjournaled local file) ──────────────
+      // Both `localChanged` and `remoteChanged` are gated on `!!journalEntry`,
+      // so a key with NO journal entry reads "clean on both sides" and falls
+      // all the way through to a plain `download` — silently replacing a local
+      // file that exists on disk. There is no conflict, no `.conflict-` mirror
+      // and no conflict-index record, so the loss is invisible unless someone
+      // happens to know what the file should contain.
+      //
+      // This destroyed in-progress edits to
+      // `companies/*/projects/*/prd.json` three times on 2026-08-01/02, but
+      // nothing about it is prd- or project-specific: it fires for ANY synced
+      // path whose journal entry is absent. Absence is common — a file created
+      // on this machine and on a peer under the same key before either pushed,
+      // a journal shard reset/lost/rebuilt (`readJournal` returns an empty
+      // `files` map for a missing shard, so EVERY divergent local file is in
+      // scope), a run under a different `HQ_STATE_DIR`, or an entry dropped by
+      // scope-shrink or rescue.
+      //
+      // No journal entry means no evidence that local and remote ever agreed,
+      // which is exactly when an overwrite is least safe. Route it through the
+      // conflict path instead: the executor's convergence probe fetches the
+      // remote once and, when the bytes already match (the ordinary
+      // fresh-machine / rebuilt-journal case), reconciles silently — no
+      // conflict, no mirror, journal stamped. Only genuine divergence surfaces,
+      // and there local is PRESERVED as-is with the cloud copy written beside
+      // it under `--on-conflict keep`, or the run halts under `abort`.
+      // Cloud-authoritative paths (board.json, ontology/, signals/, …) are
+      // unaffected — the conflict executor short-circuits those back to a
+      // pull-wins download before any mirror is minted.
+      if (!journalEntry) {
+        items.push({
+          action: "conflict",
+          remoteFile,
+          localPath,
+          localHash,
+          localMtime: localLstat!.mtime,
+          localSize: isLocalSymlink ? 0 : localLstat!.size,
+          localSnapshot: plannedLocalSnapshot,
+        });
+        continue;
+      }
+
       // Mirror the original 3-way merge from the inline loop. Tested by
       // `does NOT flag a pull conflict when only local changed since last
       // sync` and `detects conflicts with local changes…`.

package/src/skill-telemetry.test.ts

@@ -11,6 +11,7 @@ import {
   parseCodexSessionMeta,
   collectAndSendSkillTelemetry,
   computeSkillVersion,
+  MAX_DECODE_BYTES,
   readFileRegion,
 } from "./skill-telemetry.js";
 import { encodeLocalVaultSegment } from "./local-path-codec.js";
@@ -758,6 +759,244 @@ describe("collectAndSendSkillTelemetry — hqRoot scoping", () => {
     await fs.rm(tmp, { recursive: true, force: true });
   });
 
+  it("HQ-DESKTOP-47: settles at complete UTF-8 lines and drains a bounded backlog without gaps", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-bounded-"));
+    const projects = path.join(tmp, "projects");
+    const dir = path.join(projects, "-p");
+    await fs.mkdir(dir, { recursive: true });
+    const file = path.join(dir, "s.jsonl");
+    const lines = [
+      row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T10:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }),
+      row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T10:01:00Z", cwd: "/x", uuid: "u2", message: { role: "user", content: "<command-name>/plán</command-name>" } }),
+      row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T10:02:00Z", cwd: "/x", uuid: "u3", message: { role: "user", content: "<command-name>/ship</command-name>" } }),
+    ];
+    await fs.writeFile(file, `${lines.join("\n")}\n`, "utf-8");
+
+    const cursorPath = path.join(tmp, "cursor.json");
+    const captured: SkillInvocationBatch[] = [];
+    const client = stubClient(captured);
+    const base = {
+      client,
+      machineId: "m",
+      installerVersion: "t",
+      claudeProjectsRoot: projects,
+      codexSessionsRoot: path.join(tmp, "codex"),
+      cursorPath,
+    };
+    const cursorOffset = async (): Promise<number> => {
+      const cursor = JSON.parse(await fs.readFile(cursorPath, "utf-8")) as {
+        files: Record<string, { offset: number }>;
+      };
+      return cursor.files[file]?.offset ?? 0;
+    };
+
+    // Stop in the middle of the two-byte á. The first pass must commit only
+    // the preceding complete line rather than a character-counted position.
+    const accentOffset = lines[1].indexOf("á");
+    const firstBudget =
+      Buffer.byteLength(`${lines[0]}\n${lines[1].slice(0, accentOffset)}`, "utf-8") + 1;
+    const logs: string[] = [];
+    const first = await collectAndSendSkillTelemetry({
+      ...base,
+      maxScanBytesPerSource: firstBudget,
+      log: (message) => logs.push(message),
+    });
+    const afterFirst = await cursorOffset();
+    expect(first.eventsSent).toBe(1);
+    expect(afterFirst).toBe(Buffer.byteLength(`${lines[0]}\n`, "utf-8"));
+    expect(logs.some((message) => message.includes("scan budget reached"))).toBe(true);
+
+    // The second pass reaches the next complete line but not the third; the
+    // third drains the remainder. Together they must equal an unbounded scan.
+    const second = await collectAndSendSkillTelemetry({
+      ...base,
+      maxScanBytesPerSource: Buffer.byteLength(`${lines[1]}\n`, "utf-8") + 1,
+    });
+    const afterSecond = await cursorOffset();
+    const third = await collectAndSendSkillTelemetry({
+      ...base,
+      maxScanBytesPerSource: 1024 * 1024,
+    });
+    const afterThird = await cursorOffset();
+
+    expect(second.eventsSent).toBe(1);
+    expect(third.eventsSent).toBe(1);
+    expect(afterFirst).toBeLessThan(afterSecond);
+    expect(afterSecond).toBeLessThan(afterThird);
+    expect(afterThird).toBe(Buffer.byteLength(`${lines.join("\n")}\n`, "utf-8"));
+    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toEqual([
+      "deploy",
+      "plán",
+      "ship",
+    ]);
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("HQ-DESKTOP-47: a transcript below the injected budget keeps the one-pass EOF behaviour", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-small-budget-"));
+    const projects = path.join(tmp, "projects");
+    const dir = path.join(projects, "-p");
+    await fs.mkdir(dir, { recursive: true });
+    const file = path.join(dir, "s.jsonl");
+    const transcript = row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T11:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }) + "\n";
+    await fs.writeFile(file, transcript, "utf-8");
+
+    const cursorPath = path.join(tmp, "cursor.json");
+    const captured: SkillInvocationBatch[] = [];
+    const result = await collectAndSendSkillTelemetry({
+      client: stubClient(captured),
+      machineId: "m",
+      installerVersion: "t",
+      claudeProjectsRoot: projects,
+      codexSessionsRoot: path.join(tmp, "codex"),
+      cursorPath,
+      maxScanBytesPerSource: Buffer.byteLength(transcript, "utf-8") + 1,
+    });
+    const cursor = JSON.parse(await fs.readFile(cursorPath, "utf-8")) as {
+      files: Record<string, { offset: number }>;
+    };
+
+    expect(result.eventsSent).toBe(1);
+    expect(cursor.files[file]?.offset).toBe(Buffer.byteLength(transcript, "utf-8"));
+    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toEqual([
+      "deploy",
+    ]);
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("HQ-DESKTOP-47: a truncated bounded backlog resets to the replacement file", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-budget-rotate-"));
+    const projects = path.join(tmp, "projects");
+    const dir = path.join(projects, "-p");
+    await fs.mkdir(dir, { recursive: true });
+    const file = path.join(dir, "s.jsonl");
+    const oldLine = row({ type: "user", sessionId: "old", timestamp: "2026-08-02T12:00:00Z", cwd: "/x", uuid: "old-1", message: { role: "user", content: "<command-name>/deploy</command-name>" } });
+    const oldTail = row({ type: "user", sessionId: "old", timestamp: "2026-08-02T12:01:00Z", cwd: "/x", uuid: "old-2", message: { role: "user", content: "<command-name>/ship</command-name>" } });
+    await fs.writeFile(file, `${oldLine}\n${oldTail}\n`, "utf-8");
+
+    const cursorPath = path.join(tmp, "cursor.json");
+    const captured: SkillInvocationBatch[] = [];
+    const base = {
+      client: stubClient(captured),
+      machineId: "m",
+      installerVersion: "t",
+      claudeProjectsRoot: projects,
+      codexSessionsRoot: path.join(tmp, "codex"),
+      cursorPath,
+    };
+    await collectAndSendSkillTelemetry({
+      ...base,
+      maxScanBytesPerSource: Buffer.byteLength(`${oldLine}\n`, "utf-8") + 1,
+    });
+
+    const replacement = row({ type: "user", sessionId: "new", timestamp: "2026-08-02T12:02:00Z", cwd: "/x", uuid: "new-1", message: { role: "user", content: "<command-name>/land</command-name>" } }) + "\n";
+    expect(Buffer.byteLength(replacement, "utf-8")).toBeLessThan(
+      Buffer.byteLength(`${oldLine}\n`, "utf-8"),
+    );
+    await fs.writeFile(file, replacement, "utf-8");
+
+    const result = await collectAndSendSkillTelemetry({
+      ...base,
+      maxScanBytesPerSource: 1024 * 1024,
+    });
+    const cursor = JSON.parse(await fs.readFile(cursorPath, "utf-8")) as {
+      files: Record<string, { offset: number }>;
+    };
+
+    expect(result.eventsSent).toBe(1);
+    expect(cursor.files[file]?.offset).toBe(Buffer.byteLength(replacement, "utf-8"));
+    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toEqual([
+      "deploy",
+      "land",
+    ]);
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("HQ-DESKTOP-47: continues past a single JSONL record larger than the scan budget", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-large-line-"));
+    const projects = path.join(tmp, "projects");
+    const dir = path.join(projects, "-p");
+    await fs.mkdir(dir, { recursive: true });
+    const file = path.join(dir, "s.jsonl");
+    const oversized = row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T13:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: `<command-name>/deploy</command-name><command-args>${"x".repeat(900)}</command-args>` } });
+    const tail = row({ type: "user", sessionId: "s1", timestamp: "2026-08-02T13:01:00Z", cwd: "/x", uuid: "u2", message: { role: "user", content: "<command-name>/land</command-name>" } });
+    await fs.writeFile(file, `${oversized}\n${tail}\n`, "utf-8");
+
+    const cursorPath = path.join(tmp, "cursor.json");
+    const captured: SkillInvocationBatch[] = [];
+    const base = {
+      client: stubClient(captured),
+      machineId: "m",
+      installerVersion: "t",
+      claudeProjectsRoot: projects,
+      codexSessionsRoot: path.join(tmp, "codex"),
+      cursorPath,
+      maxScanBytesPerSource: 128,
+    };
+    const offsets: number[] = [];
+    for (let pass = 0; pass < 12; pass++) {
+      await collectAndSendSkillTelemetry(base);
+      const cursor = JSON.parse(await fs.readFile(cursorPath, "utf-8")) as {
+        files: Record<string, { offset: number; pendingLine?: { scannedOffset: number } }>;
+      };
+      offsets.push(cursor.files[file]?.offset ?? 0);
+    }
+
+    expect(offsets.some((offset) => offset > 0)).toBe(true);
+    expect(offsets[0]).toBe(0); // first pass only discovers a partial record
+    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toEqual([
+      "deploy",
+      "land",
+    ]);
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("HQ-DESKTOP-47: rotates a shared runtime budget so a backlog cannot starve a later session", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-fair-"));
+    const projects = path.join(tmp, "projects");
+    const backlogDir = path.join(projects, "a-backlog");
+    const currentDir = path.join(projects, "b-current");
+    await fs.mkdir(backlogDir, { recursive: true });
+    await fs.mkdir(currentDir, { recursive: true });
+    const backlogLine = row({ type: "user", sessionId: "old", timestamp: "2026-08-02T14:00:00Z", cwd: "/x", uuid: "old-1", message: { role: "user", content: "<command-name>/deploy</command-name>" } });
+    await fs.writeFile(
+      path.join(backlogDir, "old.jsonl"),
+      `${Array.from({ length: 4 }, () => backlogLine).join("\n")}\n`,
+      "utf-8",
+    );
+    await fs.writeFile(
+      path.join(currentDir, "current.jsonl"),
+      row({ type: "user", sessionId: "new", timestamp: "2026-08-02T14:01:00Z", cwd: "/x", uuid: "new-1", message: { role: "user", content: "<command-name>/land</command-name>" } }) + "\n",
+      "utf-8",
+    );
+
+    const captured: SkillInvocationBatch[] = [];
+    const cursorPath = path.join(tmp, "cursor.json");
+    const budget = Buffer.byteLength(`${backlogLine}\n`, "utf-8") + 1;
+    const base = {
+      client: stubClient(captured),
+      machineId: "m",
+      installerVersion: "t",
+      claudeProjectsRoot: projects,
+      codexSessionsRoot: path.join(tmp, "codex"),
+      cursorPath,
+      maxScanBytesPerSource: budget,
+    };
+
+    await collectAndSendSkillTelemetry(base);
+    await collectAndSendSkillTelemetry(base);
+
+    expect(captured.flatMap((batch) => batch.events.map((event) => event.skill))).toContain(
+      "land",
+    );
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
   it("captures every project when hqRoot is omitted", async () => {
     const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
     const projects = path.join(tmp, "projects");
@@ -1031,6 +1270,49 @@ describe("collectAndSendSkillTelemetry — hqRoot scoping", () => {
     await fs.rm(tmp, { recursive: true, force: true });
   });
 
+  it("HQ-DESKTOP-47: preserves Codex turn dedup across a bounded resume", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-codex-budget-"));
+    const codex = path.join(tmp, "sessions", "2026", "08", "02");
+    await fs.mkdir(codex, { recursive: true });
+    const hqRoot = "/home/ec2-user/hq";
+    const lines = [
+      row({ timestamp: "2026-08-02T15:00:00.000Z", type: "session_meta", payload: { id: "sess-budget", cwd: hqRoot } }),
+      row({ timestamp: "2026-08-02T15:00:01.000Z", type: "turn_context", payload: { turn_id: "turn-budget", cwd: hqRoot } }),
+      row({ timestamp: "2026-08-02T15:00:02.000Z", type: "response_item", payload: { type: "function_call", name: "exec_command", arguments: JSON.stringify({ cmd: "sed -n '1,80p' .claude/skills/deploy/SKILL.md", workdir: hqRoot }) } }),
+      row({ timestamp: "2026-08-02T15:00:03.000Z", type: "response_item", payload: { type: "function_call", name: "exec_command", arguments: JSON.stringify({ cmd: "wc -l .claude/skills/deploy/SKILL.md", workdir: hqRoot }) } }),
+    ];
+    const file = path.join(codex, "rollout-budget.jsonl");
+    await fs.writeFile(file, `${lines.join("\n")}\n`, "utf-8");
+
+    const captured: SkillInvocationBatch[] = [];
+    const cursorPath = path.join(tmp, "cursor.json");
+    const base = {
+      client: stubClient(captured),
+      machineId: "m",
+      installerVersion: "t",
+      hqRoot,
+      claudeProjectsRoot: path.join(tmp, "no-claude"),
+      codexSessionsRoot: path.join(tmp, "sessions"),
+      cursorPath,
+    };
+    // Commit the turn_context but stop in the next function_call row.
+    await collectAndSendSkillTelemetry({
+      ...base,
+      maxScanBytesPerSource: Buffer.byteLength(`${lines[0]}\n${lines[1]}\n`, "utf-8") + 1,
+    });
+    await collectAndSendSkillTelemetry({ ...base, maxScanBytesPerSource: 1024 * 1024 });
+    await collectAndSendSkillTelemetry({ ...base, maxScanBytesPerSource: 1024 * 1024 });
+
+    const events = captured.flatMap((batch) => batch.events);
+    expect(events).toHaveLength(1);
+    expect(events[0]).toMatchObject({
+      skill: "deploy",
+      uuid: "codex:skill:sess-budget:turn-budget:deploy",
+    });
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
   it("does not count SKILL.md edits (apply_patch / write) as skill usage", async () => {
     const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-edit-"));
     const codex = path.join(tmp, "sessions", "2026", "06", "08");
@@ -1248,6 +1530,10 @@ describe("collectAndSendSkillTelemetry — companyUid attribution", () => {
 describe("readFileRegion — HQ-SYNC-WEB-15 (SIGABRT on >2GiB single read)", () => {
   const INT32_MAX = 2 ** 31 - 1;
 
+  it("keeps the skill scanner's decode ceiling below V8's fatal 2 GiB boundary", () => {
+    expect(MAX_DECODE_BYTES).toBeLessThan(2 ** 31);
+  });
+
   it("never issues a single read whose length exceeds Int32, even for a multi-GiB region", async () => {
     // The original code did `fh.read(buf, 0, currentSize - offset, offset)` in
     // one shot. Once a session log's unread tail passed ~2 GiB, the length