@indigoai-us/hq-cloud 6.14.45 → 6.14.47

package/dist/cli/share.test.js

@@ -5785,6 +5785,71 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
         ]);
         expect(events.some((e) => e.type === "error")).toBe(false);
     });
+    it("never plans an upload for macOS Finder Icon\\r files — silent skip, valid files still ship", async () => {
+        // The incident: Finder writes an `Icon\r` file into every directory it
+        // renders a custom icon for, and a folder-level cloud-sync agent spreads
+        // them tree-wide. A CR is a control character, so validateVaultUploadKey
+        // throws INVALID_KEY_CONTROL_CHARS inside executeUploads; that throw lands
+        // in the generic catch and emits type:"error". errors[] non-empty makes
+        // the runner return PARTIAL_SYNC_EXIT, so ONE such file marks EVERY sync
+        // pass failed forever. On the reporting machine there were 100+ per run.
+        //
+        // They are excluded during the walk, like .DS_Store, so they never reach
+        // the planner at all — and, being expected noise, without a per-file
+        // "EXCLUDED from sync" warning.
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        fs.mkdirSync(path.join(companyRoot, "docs"), { recursive: true });
+        fs.writeFileSync(path.join(companyRoot, "docs", "good.md"), "good");
+        fs.writeFileSync(path.join(companyRoot, "Icon\r"), "finder cruft");
+        fs.writeFileSync(path.join(companyRoot, "docs", "Icon\r"), "finder cruft");
+        const events = [];
+        const result = await share({
+            paths: [companyRoot],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            onEvent: (e) => events.push(e),
+        });
+        expect(result.aborted).toBe(false);
+        const uploadedKeys = vi.mocked(uploadFile).mock.calls.map((c) => c[2]);
+        expect(uploadedKeys).toEqual(["docs/good.md"]);
+        expect(result.filesUploaded).toBe(1);
+        // The failure class this guards: an error event is what flips the runner
+        // pass to exit 2.
+        expect(events.some((e) => e.type === "error")).toBe(false);
+        // Expected OS noise — excluded without the "review in case this is
+        // unintended" warning that real content would earn.
+        expect(events.some((e) => e.type === "ignore-excluded")).toBe(false);
+    });
+    it("refuses any other control-character key up front — skip event, never an error", async () => {
+        // Belt-and-suspenders for control-char paths that are not the Finder icon
+        // spelling, and for callers that bypass the walker. Symmetric with the
+        // pull leg, which has classified such keys since the same incident.
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        fs.mkdirSync(path.join(companyRoot, "docs"), { recursive: true });
+        fs.writeFileSync(path.join(companyRoot, "docs", "good.md"), "good");
+        fs.writeFileSync(path.join(companyRoot, "docs", "bad\u0001name.md"), "bad");
+        const events = [];
+        const result = await share({
+            paths: [companyRoot],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            onEvent: (e) => events.push(e),
+        });
+        expect(result.aborted).toBe(false);
+        const uploadedKeys = vi.mocked(uploadFile).mock.calls.map((c) => c[2]);
+        expect(uploadedKeys).toEqual(["docs/good.md"]);
+        const skipEvents = events.filter((e) => e.type === "skip-invalid-scoped-key");
+        expect(skipEvents).toEqual([
+            {
+                type: "skip-invalid-scoped-key",
+                path: "docs/bad\u0001name.md",
+                errorCode: "INVALID_KEY_CONTROL_CHARS",
+            },
+        ]);
+        expect(events.some((e) => e.type === "error")).toBe(false);
+    });
     it("tombstones (journal drop, no remote HEAD/DELETE) a companies/ journal key in company mode instead of re-uploading", async () => {
         // Delete-propagation on a poisoned journal entry: HEAD/DeleteObject on a
         // companies/-prefixed key would be rejected by the presign transport's