@indigoai-us/hq-cloud 6.14.4 → 6.14.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cloud",
-  "version": "6.14.4",
+  "version": "6.14.5",
   "description": "HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/cli/rescue-clone-diagnostics.test.ts

@@ -0,0 +1,120 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { runRescue } from "./rescue-core.js";
+
+function runRescueCapture(argv: string[], env: NodeJS.ProcessEnv) {
+  let stdout = "";
+  let stderr = "";
+  const origOut = process.stdout.write.bind(process.stdout);
+  const origErr = process.stderr.write.bind(process.stderr);
+  process.stdout.write = ((chunk: unknown) => {
+    stdout += String(chunk);
+    return true;
+  }) as typeof process.stdout.write;
+  process.stderr.write = ((chunk: unknown) => {
+    stderr += String(chunk);
+    return true;
+  }) as typeof process.stderr.write;
+  let status: number;
+  try {
+    status = runRescue(argv, { env }).status;
+  } finally {
+    process.stdout.write = origOut;
+    process.stderr.write = origErr;
+  }
+  return { status, stdout, stderr };
+}
+
+describe("rescue clone diagnostics", () => {
+  let workDir: string;
+  let hqRoot: string;
+
+  beforeAll(() => {
+    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-clone-diagnostics-"));
+    hqRoot = path.join(workDir, "hq");
+    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
+    fs.mkdirSync(path.join(hqRoot, "core"), { recursive: true });
+  });
+
+  afterAll(() => {
+    if (workDir) fs.rmSync(workDir, { recursive: true, force: true });
+  });
+
+  function envWithGit(name: string, script: string): NodeJS.ProcessEnv {
+    const shimDir = path.join(workDir, name);
+    fs.mkdirSync(shimDir, { recursive: true });
+    fs.writeFileSync(path.join(shimDir, "git"), script, { mode: 0o755 });
+    return {
+      ...process.env,
+      GH_TOKEN: "ghp_clone_secret_123",
+      PATH: `${shimDir}:${process.env.PATH ?? ""}`,
+    };
+  }
+
+  function rescueArgs(extra: string[] = []): string[] {
+    return [
+      "--hq-root", hqRoot,
+      "--source", "test/repo",
+      "--ref", "main",
+      "--dry-run",
+      "--yes",
+      "--no-backup",
+      ...extra,
+    ];
+  }
+
+  it("surfaces redacted stderr when the full-history clone fails", () => {
+    const env = envWithGit(
+      "full-history",
+      `#!/usr/bin/env bash
+printf 'fatal: clone args: %s\n' "$*" >&2
+printf 'mirror: https://user:url-secret@example.com/repo.git\n' >&2
+printf 'Authorization: Bearer header-secret\n' >&2
+exit 42
+`,
+    );
+
+    const r = runRescueCapture(rescueArgs(), env);
+
+    expect(r.status).toBe(5);
+    expect(r.stderr).toContain("fatal: clone args:");
+    expect(r.stderr).toContain("https://***@github.com/test/repo.git");
+    expect(r.stderr).toContain("mirror: https://***@example.com/repo.git");
+    expect(r.stderr).toContain("Authorization: ***");
+    expect(r.stderr).toContain("error: clone failed");
+    expect(r.stderr.indexOf("fatal: clone args:")).toBeLessThan(
+      r.stderr.indexOf("error: clone failed"),
+    );
+    expect(r.stderr).not.toContain("ghp_clone_secret_123");
+    expect(r.stderr).not.toContain("url-secret");
+    expect(r.stderr).not.toContain("header-secret");
+  });
+
+  it("surfaces stderr from the shallow attempt and stdout from the failed fallback", () => {
+    const env = envWithGit(
+      "shallow-fallback",
+      `#!/usr/bin/env bash
+if [ "$2" = "--depth" ]; then
+  printf 'fatal: shallow clone diagnostic\n' >&2
+  exit 41
+fi
+printf 'fatal: fallback clone diagnostic for %s\n' "$*"
+exit 42
+`,
+    );
+
+    const r = runRescueCapture(rescueArgs(["--no-history-check"]), env);
+
+    expect(r.status).toBe(5);
+    expect(r.stderr).toContain("fatal: shallow clone diagnostic");
+    expect(r.stderr).toContain("fatal: fallback clone diagnostic");
+    expect(r.stderr).toContain("https://***@github.com/test/repo.git");
+    expect(r.stderr).toContain("error: clone failed");
+    expect(r.stderr.indexOf("fatal: fallback clone diagnostic")).toBeLessThan(
+      r.stderr.indexOf("error: clone failed"),
+    );
+    expect(r.stderr).not.toContain("ghp_clone_secret_123");
+  });
+});

package/src/cli/rescue-core.ts

@@ -105,6 +105,14 @@ function run(
   };
 }
 
+function redactGitDiagnostic(output: string, ghToken: string): string {
+  let redacted = output;
+  if (ghToken) redacted = redacted.replaceAll(ghToken, "***");
+  return redacted
+    .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+(?::[^\s/@]*)?@/gi, "$1***@")
+    .replace(/(authorization\s*:\s*)[^\r\n]*/gi, "$1***");
+}
+
 /** `command -v <bin>` — is a binary on PATH? */
 function hasCmd(bin: string, env: NodeJS.ProcessEnv): boolean {
   const r = spawnSync(bin, ["--version"], { env, stdio: "ignore" });
@@ -551,29 +559,45 @@ function doRescue(
     cloneUrlDisplay = cloneUrl;
   }
 
+  const reportGitFailure = (result: ReturnType<typeof run>) => {
+    const diagnostic = result.stderr.trim() || result.stdout.trim();
+    if (diagnostic) err(`${redactGitDiagnostic(diagnostic, ghToken)}\n`);
+  };
+
   out("\n");
   if (cfg.historyCheck) {
     out(`==> Cloning ${cloneUrlDisplay} @${cfg.ref} (full history, blob:none filter) ...\n`);
-    if (run("git", ["clone", "--filter=blob:none", cloneUrl, srcDir], { env }).status !== 0) {
+    const cloneResult = run("git", ["clone", "--filter=blob:none", cloneUrl, srcDir], { env });
+    if (cloneResult.status !== 0) {
+      reportGitFailure(cloneResult);
       err("error: clone failed\n");
       throw new ExitError(5);
     }
-    if (run("git", ["checkout", cfg.ref], { cwd: srcDir, env }).status !== 0) {
+    const checkoutResult = run("git", ["checkout", cfg.ref], { cwd: srcDir, env });
+    if (checkoutResult.status !== 0) {
+      reportGitFailure(checkoutResult);
       err(`error: could not check out ref '${cfg.ref}' from ${cfg.sourceRepo}\n`);
       throw new ExitError(5);
     }
   } else {
     out(`==> Cloning ${cloneUrlDisplay} @${cfg.ref} (shallow) ...\n`);
-    if (
-      run("git", ["clone", "--depth", "1", "--branch", cfg.ref, cloneUrl, srcDir], { env })
-        .status !== 0
-    ) {
+    const shallowCloneResult = run(
+      "git",
+      ["clone", "--depth", "1", "--branch", cfg.ref, cloneUrl, srcDir],
+      { env },
+    );
+    if (shallowCloneResult.status !== 0) {
+      reportGitFailure(shallowCloneResult);
       out("    (shallow branch clone failed; trying full clone + checkout)\n");
-      if (run("git", ["clone", cloneUrl, srcDir], { env }).status !== 0) {
+      const cloneResult = run("git", ["clone", cloneUrl, srcDir], { env });
+      if (cloneResult.status !== 0) {
+        reportGitFailure(cloneResult);
         err("error: clone failed\n");
         throw new ExitError(5);
       }
-      if (run("git", ["checkout", cfg.ref], { cwd: srcDir, env }).status !== 0) {
+      const checkoutResult = run("git", ["checkout", cfg.ref], { cwd: srcDir, env });
+      if (checkoutResult.status !== 0) {
+        reportGitFailure(checkoutResult);
         err(`error: could not check out ref '${cfg.ref}' from ${cfg.sourceRepo}\n`);
         throw new ExitError(5);
       }

package/src/cli/share.test.ts

@@ -684,6 +684,53 @@ describe("share", () => {
     expect(result.filesUploaded).toBe(0);
   });
 
+  it("fresh-install SSE-KMS etag: byte-identical remote is reconciled without a conflict", async () => {
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    const testFile = path.join(companyRoot, "kms-scaffold.md");
+    const scaffoldBytes = "identical-content-encrypted-with-sse-kms";
+    fs.writeFileSync(testFile, scaffoldBytes);
+
+    // A 32-hex SSE-KMS ETag is not the MD5 of the plaintext object.
+    vi.mocked(headRemoteFile).mockResolvedValueOnce({
+      lastModified: new Date(),
+      etag: '"288bfa91684ae21f9ae27c061254d412"',
+      size: scaffoldBytes.length,
+    });
+    vi.mocked(downloadFile).mockImplementationOnce(async (_ctx, _key, dest) => {
+      fs.writeFileSync(dest as string, scaffoldBytes);
+      return undefined as never;
+    });
+
+    const events: unknown[] = [];
+    const result = await share({
+      paths: [testFile],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      onConflict: "keep",
+      onEvent: (e) => events.push(e),
+    });
+
+    expect(result.conflictPaths).toEqual([]);
+    expect(result.filesUploaded).toBe(0);
+    expect(uploadFile).not.toHaveBeenCalled();
+    expect(events).toContainEqual({
+      type: "reconciled",
+      path: "kms-scaffold.md",
+      direction: "push",
+    });
+    expect(fs.readdirSync(companyRoot).filter((name) => name.includes(".conflict-"))).toEqual([]);
+
+    const journal = JSON.parse(
+      fs.readFileSync(path.join(stateDir, "sync-journal.acme.json"), "utf-8"),
+    ) as { files: Record<string, { direction: string; remoteEtag?: string }> };
+    expect(journal.files["kms-scaffold.md"]).toMatchObject({
+      direction: "up",
+      remoteEtag: "288bfa91684ae21f9ae27c061254d412",
+    });
+  });
+
   it("fresh-install multipart collision: byte-identical remote is NOT a conflict (reconciled, no mirror)", async () => {
     // Root cause of "HQ installs with conflicts": on a first push the
     // journal is empty, so the fresh-collision branch decides conflict-vs-

package/src/cli/share.ts

@@ -70,11 +70,11 @@ import { isCloudAuthoritative } from "../lib/cloud-authoritative.js";
  * Push-side fresh-collision convergence probe.
  *
  * For a first push (no journal entry) where the remote object already
- * exists AND was multipart-uploaded, the remote etag (`<md5>-<partCount>`)
- * is not a content hash, so we cannot tell "byte-identical" from "genuine
- * divergence" without looking at the bytes. Fetch the remote object once to
- * a throwaway temp file, hash it the same symlink-aware way the planner
- * hashed local, and report whether the two contents DIFFER.
+ * exists, its etag is a version token rather than a reliable content hash,
+ * so we cannot tell "byte-identical" from "genuine divergence" without
+ * looking at the bytes. Fetch the remote object once to a throwaway temp
+ * file, hash it the same symlink-aware way the planner hashed local, and
+ * report whether the two contents DIFFER.
  *
  * Returns `true` on a genuine difference (a real fresh collision) and
  * `false` when the bytes are identical. Fails safe to `true` on any
@@ -1252,34 +1252,24 @@ async function executeUploads(
       const remoteChanged = !!journalEntry && hasRemoteChanged(remoteMeta, journalEntry);
 
       let isFreshCollision = false;
-      let multipartConverged = false;
+      let freshContentConverged = false;
       if (!journalEntry && item.kind === "symlink") {
         isFreshCollision = true;
       } else if (!journalEntry && item.kind === "file") {
-        const remoteEtagNormalized = normalizeEtag(remoteMeta.etag);
-        const isMultipart = /-\d+$/.test(remoteEtagNormalized);
-        if (!isMultipart) {
-          const localBody = fs.readFileSync(absolutePath);
-          const localMd5 = crypto.createHash("md5").update(localBody).digest("hex");
-          if (localMd5 !== remoteEtagNormalized) {
-            isFreshCollision = true;
-          }
+        const remoteDiffers = await remoteContentDiffers(
+          run.ctx,
+          relativePath,
+          localHash,
+          run.hqRoot,
+        );
+        if (remoteDiffers) {
+          isFreshCollision = true;
         } else {
-          const remoteDiffers = await remoteContentDiffers(
-            run.ctx,
-            relativePath,
-            localHash,
-            run.hqRoot,
-          );
-          if (remoteDiffers) {
-            isFreshCollision = true;
-          } else {
-            multipartConverged = true;
-          }
+          freshContentConverged = true;
         }
       }
 
-      if (multipartConverged) {
+      if (freshContentConverged) {
         const lstat = fs.lstatSync(absolutePath);
         updateEntry(
           run.journal,