@indigoai-us/hq-cloud 6.14.40 → 6.14.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cloud",
-  "version": "6.14.40",
+  "version": "6.14.41",
   "description": "HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/cli/sync.test.ts

@@ -931,6 +931,109 @@ describe("sync", () => {
     expect(fs.readFileSync(localPath, "utf-8")).toBe("mock file content");
   });
 
+  it("untracked-local guard: an UNJOURNALED local file is NOT silently clobbered — routes through conflict and preserves local", async () => {
+    // Regression for the 2026-08-01/02 prd.json losses: a locally-edited file
+    // whose key has NO journal entry fell straight through the 3-way merge to
+    // `download` (localChanged and remoteChanged are both gated on
+    // `!!journalEntry`, so both read false). The in-progress local edit was
+    // overwritten with the cloud copy with no conflict, no `.conflict-` mirror,
+    // and no conflict-index record — the loss was invisible.
+    //
+    // A key with no journal entry carries NO evidence that local and remote
+    // ever agreed, so a blind overwrite is never safe. Route it through the
+    // conflict path; the executor's convergence probe still collapses a
+    // byte-identical remote to a silent reconcile (covered by the next test),
+    // so this costs nothing on the common first-pull case.
+    const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+    fs.mkdirSync(companyDocs, { recursive: true });
+    const localPath = path.join(companyDocs, "handoff.md");
+    // Stand-in for the PRD carrying the in-progress 11th story.
+    const localContent = "in-progress local work that must survive\n";
+    fs.writeFileSync(localPath, localContent);
+
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key: "docs/handoff.md", size: 17, lastModified: new Date(), etag: '"cloud-etag"' },
+    ]);
+
+    // Journal has NO entry for this key — the whole point of the regression.
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({ version: "1", lastSync: new Date().toISOString(), files: {} }),
+    );
+
+    const result = await sync({
+      company: "acme",
+      onConflict: "keep",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+    });
+
+    // Surfaced as a conflict, NOT a silent download.
+    expect(result.conflicts).toBe(1);
+    expect(result.conflictPaths).toEqual(["docs/handoff.md"]);
+    expect(result.filesDownloaded).toBe(0);
+    // The local edit is intact.
+    expect(fs.readFileSync(localPath, "utf-8")).toBe(localContent);
+    // Cloud copy preserved alongside it for inspection / `/resolve-conflicts`.
+    const litter = fs
+      .readdirSync(companyDocs)
+      .filter((f) => f.includes(".conflict-"));
+    expect(litter).toHaveLength(1);
+    expect(fs.readFileSync(path.join(companyDocs, litter[0]!), "utf-8")).toBe(
+      "mock file content",
+    );
+    // And a durable record exists so the overwrite can never be silent.
+    const index = JSON.parse(
+      fs.readFileSync(path.join(tmpDir, ".hq-conflicts", "index.json"), "utf-8"),
+    );
+    expect(
+      index.conflicts.some(
+        (c: { originalPath: string }) =>
+          c.originalPath === "companies/acme/docs/handoff.md",
+      ),
+    ).toBe(true);
+  });
+
+  it("untracked-local guard is free on first pull: an unjournaled local file that already MATCHES the cloud reconciles silently", async () => {
+    // The guard must not manufacture conflicts for the common case — a fresh
+    // machine, or a re-created journal, where local and cloud are already
+    // byte-identical. The executor's convergence probe collapses these to a
+    // reconcile: no conflict, no mirror, journal stamped so the next sync is
+    // a plain skip-unchanged.
+    const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+    fs.mkdirSync(companyDocs, { recursive: true });
+    const localPath = path.join(companyDocs, "handoff.md");
+    // Byte-identical to what the downloadFile mock writes.
+    fs.writeFileSync(localPath, "mock file content");
+
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key: "docs/handoff.md", size: 17, lastModified: new Date(), etag: '"cloud-etag"' },
+    ]);
+
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({ version: "1", lastSync: new Date().toISOString(), files: {} }),
+    );
+
+    const result = await sync({
+      company: "acme",
+      onConflict: "keep",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+    });
+
+    expect(result.conflicts).toBe(0);
+    expect(result.conflictPaths).toEqual([]);
+    expect(fs.readFileSync(localPath, "utf-8")).toBe("mock file content");
+    const litter = fs
+      .readdirSync(companyDocs)
+      .filter((f) => f.includes(".conflict-"));
+    expect(litter).toHaveLength(0);
+    // Journal stamped, so the next pass is a plain unchanged-skip.
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["docs/handoff.md"]).toBeDefined();
+  });
+
   it("RF-F02EXEC: refuses a download whose parent symlink appears after planning", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     const outsideRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-sync-escape-"));

package/src/cli/sync.ts

@@ -2903,6 +2903,48 @@ function computePullPlan(
         continue;
       }
 
+      // ── Untracked-local guard (unjournaled local file) ──────────────
+      // Both `localChanged` and `remoteChanged` are gated on `!!journalEntry`,
+      // so a key with NO journal entry reads "clean on both sides" and falls
+      // all the way through to a plain `download` — silently replacing a local
+      // file that exists on disk. There is no conflict, no `.conflict-` mirror
+      // and no conflict-index record, so the loss is invisible unless someone
+      // happens to know what the file should contain.
+      //
+      // This destroyed in-progress edits to
+      // `companies/*/projects/*/prd.json` three times on 2026-08-01/02, but
+      // nothing about it is prd- or project-specific: it fires for ANY synced
+      // path whose journal entry is absent. Absence is common — a file created
+      // on this machine and on a peer under the same key before either pushed,
+      // a journal shard reset/lost/rebuilt (`readJournal` returns an empty
+      // `files` map for a missing shard, so EVERY divergent local file is in
+      // scope), a run under a different `HQ_STATE_DIR`, or an entry dropped by
+      // scope-shrink or rescue.
+      //
+      // No journal entry means no evidence that local and remote ever agreed,
+      // which is exactly when an overwrite is least safe. Route it through the
+      // conflict path instead: the executor's convergence probe fetches the
+      // remote once and, when the bytes already match (the ordinary
+      // fresh-machine / rebuilt-journal case), reconciles silently — no
+      // conflict, no mirror, journal stamped. Only genuine divergence surfaces,
+      // and there local is PRESERVED as-is with the cloud copy written beside
+      // it under `--on-conflict keep`, or the run halts under `abort`.
+      // Cloud-authoritative paths (board.json, ontology/, signals/, …) are
+      // unaffected — the conflict executor short-circuits those back to a
+      // pull-wins download before any mirror is minted.
+      if (!journalEntry) {
+        items.push({
+          action: "conflict",
+          remoteFile,
+          localPath,
+          localHash,
+          localMtime: localLstat!.mtime,
+          localSize: isLocalSymlink ? 0 : localLstat!.size,
+          localSnapshot: plannedLocalSnapshot,
+        });
+        continue;
+      }
+
       // Mirror the original 3-way merge from the inline loop. Tested by
       // `does NOT flag a pull conflict when only local changed since last
       // sync` and `detects conflicts with local changes…`.