@indigoai-us/hq-cloud 6.14.4 → 6.14.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cloud",
-  "version": "6.14.4",
+  "version": "6.14.6",
   "description": "HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/cli/rescue-clone-diagnostics.test.ts

@@ -0,0 +1,120 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { runRescue } from "./rescue-core.js";
+
+function runRescueCapture(argv: string[], env: NodeJS.ProcessEnv) {
+  let stdout = "";
+  let stderr = "";
+  const origOut = process.stdout.write.bind(process.stdout);
+  const origErr = process.stderr.write.bind(process.stderr);
+  process.stdout.write = ((chunk: unknown) => {
+    stdout += String(chunk);
+    return true;
+  }) as typeof process.stdout.write;
+  process.stderr.write = ((chunk: unknown) => {
+    stderr += String(chunk);
+    return true;
+  }) as typeof process.stderr.write;
+  let status: number;
+  try {
+    status = runRescue(argv, { env }).status;
+  } finally {
+    process.stdout.write = origOut;
+    process.stderr.write = origErr;
+  }
+  return { status, stdout, stderr };
+}
+
+describe("rescue clone diagnostics", () => {
+  let workDir: string;
+  let hqRoot: string;
+
+  beforeAll(() => {
+    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-clone-diagnostics-"));
+    hqRoot = path.join(workDir, "hq");
+    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
+    fs.mkdirSync(path.join(hqRoot, "core"), { recursive: true });
+  });
+
+  afterAll(() => {
+    if (workDir) fs.rmSync(workDir, { recursive: true, force: true });
+  });
+
+  function envWithGit(name: string, script: string): NodeJS.ProcessEnv {
+    const shimDir = path.join(workDir, name);
+    fs.mkdirSync(shimDir, { recursive: true });
+    fs.writeFileSync(path.join(shimDir, "git"), script, { mode: 0o755 });
+    return {
+      ...process.env,
+      GH_TOKEN: "ghp_clone_secret_123",
+      PATH: `${shimDir}:${process.env.PATH ?? ""}`,
+    };
+  }
+
+  function rescueArgs(extra: string[] = []): string[] {
+    return [
+      "--hq-root", hqRoot,
+      "--source", "test/repo",
+      "--ref", "main",
+      "--dry-run",
+      "--yes",
+      "--no-backup",
+      ...extra,
+    ];
+  }
+
+  it("surfaces redacted stderr when the full-history clone fails", () => {
+    const env = envWithGit(
+      "full-history",
+      `#!/usr/bin/env bash
+printf 'fatal: clone args: %s\n' "$*" >&2
+printf 'mirror: https://user:url-secret@example.com/repo.git\n' >&2
+printf 'Authorization: Bearer header-secret\n' >&2
+exit 42
+`,
+    );
+
+    const r = runRescueCapture(rescueArgs(), env);
+
+    expect(r.status).toBe(5);
+    expect(r.stderr).toContain("fatal: clone args:");
+    expect(r.stderr).toContain("https://***@github.com/test/repo.git");
+    expect(r.stderr).toContain("mirror: https://***@example.com/repo.git");
+    expect(r.stderr).toContain("Authorization: ***");
+    expect(r.stderr).toContain("error: clone failed");
+    expect(r.stderr.indexOf("fatal: clone args:")).toBeLessThan(
+      r.stderr.indexOf("error: clone failed"),
+    );
+    expect(r.stderr).not.toContain("ghp_clone_secret_123");
+    expect(r.stderr).not.toContain("url-secret");
+    expect(r.stderr).not.toContain("header-secret");
+  });
+
+  it("surfaces stderr from the shallow attempt and stdout from the failed fallback", () => {
+    const env = envWithGit(
+      "shallow-fallback",
+      `#!/usr/bin/env bash
+if [ "$2" = "--depth" ]; then
+  printf 'fatal: shallow clone diagnostic\n' >&2
+  exit 41
+fi
+printf 'fatal: fallback clone diagnostic for %s\n' "$*"
+exit 42
+`,
+    );
+
+    const r = runRescueCapture(rescueArgs(["--no-history-check"]), env);
+
+    expect(r.status).toBe(5);
+    expect(r.stderr).toContain("fatal: shallow clone diagnostic");
+    expect(r.stderr).toContain("fatal: fallback clone diagnostic");
+    expect(r.stderr).toContain("https://***@github.com/test/repo.git");
+    expect(r.stderr).toContain("error: clone failed");
+    expect(r.stderr.indexOf("fatal: fallback clone diagnostic")).toBeLessThan(
+      r.stderr.indexOf("error: clone failed"),
+    );
+    expect(r.stderr).not.toContain("ghp_clone_secret_123");
+  });
+});

package/src/cli/rescue-core.ts

@@ -105,6 +105,14 @@ function run(
   };
 }
 
+function redactGitDiagnostic(output: string, ghToken: string): string {
+  let redacted = output;
+  if (ghToken) redacted = redacted.replaceAll(ghToken, "***");
+  return redacted
+    .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+(?::[^\s/@]*)?@/gi, "$1***@")
+    .replace(/(authorization\s*:\s*)[^\r\n]*/gi, "$1***");
+}
+
 /** `command -v <bin>` — is a binary on PATH? */
 function hasCmd(bin: string, env: NodeJS.ProcessEnv): boolean {
   const r = spawnSync(bin, ["--version"], { env, stdio: "ignore" });
@@ -551,29 +559,45 @@ function doRescue(
     cloneUrlDisplay = cloneUrl;
   }
 
+  const reportGitFailure = (result: ReturnType<typeof run>) => {
+    const diagnostic = result.stderr.trim() || result.stdout.trim();
+    if (diagnostic) err(`${redactGitDiagnostic(diagnostic, ghToken)}\n`);
+  };
+
   out("\n");
   if (cfg.historyCheck) {
     out(`==> Cloning ${cloneUrlDisplay} @${cfg.ref} (full history, blob:none filter) ...\n`);
-    if (run("git", ["clone", "--filter=blob:none", cloneUrl, srcDir], { env }).status !== 0) {
+    const cloneResult = run("git", ["clone", "--filter=blob:none", cloneUrl, srcDir], { env });
+    if (cloneResult.status !== 0) {
+      reportGitFailure(cloneResult);
       err("error: clone failed\n");
       throw new ExitError(5);
     }
-    if (run("git", ["checkout", cfg.ref], { cwd: srcDir, env }).status !== 0) {
+    const checkoutResult = run("git", ["checkout", cfg.ref], { cwd: srcDir, env });
+    if (checkoutResult.status !== 0) {
+      reportGitFailure(checkoutResult);
       err(`error: could not check out ref '${cfg.ref}' from ${cfg.sourceRepo}\n`);
       throw new ExitError(5);
     }
   } else {
     out(`==> Cloning ${cloneUrlDisplay} @${cfg.ref} (shallow) ...\n`);
-    if (
-      run("git", ["clone", "--depth", "1", "--branch", cfg.ref, cloneUrl, srcDir], { env })
-        .status !== 0
-    ) {
+    const shallowCloneResult = run(
+      "git",
+      ["clone", "--depth", "1", "--branch", cfg.ref, cloneUrl, srcDir],
+      { env },
+    );
+    if (shallowCloneResult.status !== 0) {
+      reportGitFailure(shallowCloneResult);
       out("    (shallow branch clone failed; trying full clone + checkout)\n");
-      if (run("git", ["clone", cloneUrl, srcDir], { env }).status !== 0) {
+      const cloneResult = run("git", ["clone", cloneUrl, srcDir], { env });
+      if (cloneResult.status !== 0) {
+        reportGitFailure(cloneResult);
         err("error: clone failed\n");
         throw new ExitError(5);
       }
-      if (run("git", ["checkout", cfg.ref], { cwd: srcDir, env }).status !== 0) {
+      const checkoutResult = run("git", ["checkout", cfg.ref], { cwd: srcDir, env });
+      if (checkoutResult.status !== 0) {
+        reportGitFailure(checkoutResult);
         err(`error: could not check out ref '${cfg.ref}' from ${cfg.sourceRepo}\n`);
         throw new ExitError(5);
       }

package/src/cli/share.test.ts

@@ -595,6 +595,60 @@ describe("share", () => {
     });
   });
 
+  it("cloud-authoritative: never pushes a stale local ontology/.last-run over the server value (one-sided-change clobber guard)", async () => {
+    // Regression for the gardener watermark clobber. A second HQ root sharing this
+    // machine's sync journal can leave the local mirror holding a STALE value A while
+    // the shared journal has already been advanced to the gardener's value B (etag EB).
+    // On this root's push leg that reads as localChanged (A != journal B) &&
+    // !remoteChanged (remote etag EB == journal remoteEtag EB). Previously that
+    // one-sided combination slipped past the CONFLICT-scoped isCloudAuthoritative
+    // fence and PUT the stale local value back over the server's — rewinding it. The
+    // fence now runs at the TOP of processUploadItem, so any ontology/ (server-owned)
+    // path is skipped before HEAD/upload regardless of the divergence shape.
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(path.join(companyRoot, "ontology"), { recursive: true });
+    const testFile = path.join(companyRoot, "ontology", ".last-run");
+    fs.writeFileSync(testFile, "1782275168000"); // stale value A
+
+    // The journal is already advanced to the gardener's value B (a sibling HQ root's
+    // pull stamped the shared journal), so localChanged=true. The fence skips the file
+    // BEFORE any HEAD/upload, so we deliberately queue NO headRemoteFile response and
+    // assert it is never consulted below — the skip is cheap, and a leftover
+    // mockResolvedValueOnce would otherwise leak into a later test's HEAD queue.
+    const journalPath = path.join(stateDir, "sync-journal.acme.json");
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "1",
+        lastSync: new Date().toISOString(),
+        files: {
+          "ontology/.last-run": {
+            hash: "advanced-value-B-hash", // != hash(A) → localChanged=true
+            size: 13,
+            syncedAt: new Date().toISOString(),
+            direction: "up",
+            remoteEtag: "eb-advanced-etag", // == remote → remoteChanged=false
+          },
+        },
+      }),
+    );
+
+    const result = await share({
+      paths: [testFile],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+    });
+
+    // Server-owned file: push is skipped BEFORE HEAD, the stale local value is NEVER
+    // uploaded (the pull leg refreshes local from cloud instead), and it is not a conflict.
+    expect(uploadFile).not.toHaveBeenCalled();
+    expect(headRemoteFile).not.toHaveBeenCalled();
+    expect(result.filesUploaded).toBe(0);
+    expect(result.filesSkipped).toBeGreaterThanOrEqual(1);
+    expect(result.conflictPaths).toEqual([]);
+  });
+
   it("first-time-upload-with-cloud-collision: emits conflict + writes mirror under --on-conflict keep (Bug #7)", async () => {
     // Bug #7 (data-loss class) from the 5.33.0 deep test: when a file has
     // NO prior journal entry (fresh upload from this machine) but the
@@ -684,6 +738,53 @@ describe("share", () => {
     expect(result.filesUploaded).toBe(0);
   });
 
+  it("fresh-install SSE-KMS etag: byte-identical remote is reconciled without a conflict", async () => {
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    const testFile = path.join(companyRoot, "kms-scaffold.md");
+    const scaffoldBytes = "identical-content-encrypted-with-sse-kms";
+    fs.writeFileSync(testFile, scaffoldBytes);
+
+    // A 32-hex SSE-KMS ETag is not the MD5 of the plaintext object.
+    vi.mocked(headRemoteFile).mockResolvedValueOnce({
+      lastModified: new Date(),
+      etag: '"288bfa91684ae21f9ae27c061254d412"',
+      size: scaffoldBytes.length,
+    });
+    vi.mocked(downloadFile).mockImplementationOnce(async (_ctx, _key, dest) => {
+      fs.writeFileSync(dest as string, scaffoldBytes);
+      return undefined as never;
+    });
+
+    const events: unknown[] = [];
+    const result = await share({
+      paths: [testFile],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      onConflict: "keep",
+      onEvent: (e) => events.push(e),
+    });
+
+    expect(result.conflictPaths).toEqual([]);
+    expect(result.filesUploaded).toBe(0);
+    expect(uploadFile).not.toHaveBeenCalled();
+    expect(events).toContainEqual({
+      type: "reconciled",
+      path: "kms-scaffold.md",
+      direction: "push",
+    });
+    expect(fs.readdirSync(companyRoot).filter((name) => name.includes(".conflict-"))).toEqual([]);
+
+    const journal = JSON.parse(
+      fs.readFileSync(path.join(stateDir, "sync-journal.acme.json"), "utf-8"),
+    ) as { files: Record<string, { direction: string; remoteEtag?: string }> };
+    expect(journal.files["kms-scaffold.md"]).toMatchObject({
+      direction: "up",
+      remoteEtag: "288bfa91684ae21f9ae27c061254d412",
+    });
+  });
+
   it("fresh-install multipart collision: byte-identical remote is NOT a conflict (reconciled, no mirror)", async () => {
     // Root cause of "HQ installs with conflicts": on a first push the
     // journal is empty, so the fresh-collision branch decides conflict-vs-

package/src/cli/share.ts

@@ -70,11 +70,11 @@ import { isCloudAuthoritative } from "../lib/cloud-authoritative.js";
  * Push-side fresh-collision convergence probe.
  *
  * For a first push (no journal entry) where the remote object already
- * exists AND was multipart-uploaded, the remote etag (`<md5>-<partCount>`)
- * is not a content hash, so we cannot tell "byte-identical" from "genuine
- * divergence" without looking at the bytes. Fetch the remote object once to
- * a throwaway temp file, hash it the same symlink-aware way the planner
- * hashed local, and report whether the two contents DIFFER.
+ * exists, its etag is a version token rather than a reliable content hash,
+ * so we cannot tell "byte-identical" from "genuine divergence" without
+ * looking at the bytes. Fetch the remote object once to a throwaway temp
+ * file, hash it the same symlink-aware way the planner hashed local, and
+ * report whether the two contents DIFFER.
  *
  * Returns `true` on a genuine difference (a real fresh collision) and
  * `false` when the bytes are identical. Fails safe to `true` on any
@@ -1232,6 +1232,19 @@ async function executeUploads(
     if (aborted) return;
     const { absolutePath, relativePath, localHash } = item;
 
+    // Cloud-authoritative paths (server-regenerated: company-brief.md, board.json,
+    // ontology/ signals/ sources/) are PULL-WINS and server-owned. The push leg must
+    // NEVER upload the local copy over them — not just on a two-sided conflict, but on
+    // ANY divergence, including a one-sided local change. A stale local mirror (e.g. a
+    // second HQ root that shares this machine's sync journal) would otherwise read as
+    // `localChanged && !remoteChanged`, slip past the conflict-scoped guard below, and
+    // rewind the server's value — the `.last-run` watermark clobber. Skip before HEAD.
+    if (isCloudAuthoritative(relativePath)) {
+      run.emit({ type: "reconciled", path: relativePath, direction: "push" });
+      counters.filesSkipped++;
+      return;
+    }
+
     if (run.vaultConfig && isExpiringSoon(run.ctx.expiresAt)) {
       run.ctx = await refreshEntityContext(run.companyRef, run.vaultConfig);
     }
@@ -1252,34 +1265,24 @@ async function executeUploads(
       const remoteChanged = !!journalEntry && hasRemoteChanged(remoteMeta, journalEntry);
 
       let isFreshCollision = false;
-      let multipartConverged = false;
+      let freshContentConverged = false;
       if (!journalEntry && item.kind === "symlink") {
         isFreshCollision = true;
       } else if (!journalEntry && item.kind === "file") {
-        const remoteEtagNormalized = normalizeEtag(remoteMeta.etag);
-        const isMultipart = /-\d+$/.test(remoteEtagNormalized);
-        if (!isMultipart) {
-          const localBody = fs.readFileSync(absolutePath);
-          const localMd5 = crypto.createHash("md5").update(localBody).digest("hex");
-          if (localMd5 !== remoteEtagNormalized) {
-            isFreshCollision = true;
-          }
+        const remoteDiffers = await remoteContentDiffers(
+          run.ctx,
+          relativePath,
+          localHash,
+          run.hqRoot,
+        );
+        if (remoteDiffers) {
+          isFreshCollision = true;
         } else {
-          const remoteDiffers = await remoteContentDiffers(
-            run.ctx,
-            relativePath,
-            localHash,
-            run.hqRoot,
-          );
-          if (remoteDiffers) {
-            isFreshCollision = true;
-          } else {
-            multipartConverged = true;
-          }
+          freshContentConverged = true;
         }
       }
 
-      if (multipartConverged) {
+      if (freshContentConverged) {
         const lstat = fs.lstatSync(absolutePath);
         updateEntry(
           run.journal,
@@ -1296,16 +1299,9 @@ async function executeUploads(
       }
 
       if ((localChanged && remoteChanged) || isFreshCollision) {
-        // Cloud-authoritative paths (server-regenerated: company-brief.md,
-        // board.json, ontology/ signals/ sources/) are PULL-WINS. Never push the
-        // local copy over the server-owned version and never mint a `.conflict-`
-        // mirror — the pull leg overwrites local from cloud. Declining here is
-        // what stops the per-sync conflict-mirror loop on these files.
-        if (isCloudAuthoritative(relativePath)) {
-          run.emit({ type: "reconciled", path: relativePath, direction: "push" });
-          counters.filesSkipped++;
-          return;
-        }
+        // Cloud-authoritative paths are already skipped at the top of
+        // processUploadItem (before HEAD), so anything reaching here is a genuine
+        // conflict on a client-owned file.
         conflictPaths.push(relativePath);
 
         const resolution = await resolveConflictSerialized({