@indigoai-us/hq-cloud 6.14.50 → 6.15.1

package/test/joiner-manifest-reconcile.integration.test.ts

@@ -1,322 +0,0 @@
-/**
- * Joiner manifest reconciliation — end-to-end regression (indigo/joiner-manifest-reconcile).
- *
- * Reproduces michelle@boringecom.com's exact state: an active company
- * membership on the server, and a local `companies/manifest.yaml` that is still
- * the stock empty template because a joiner only ever receives the manifest as
- * a synced file from their personal vault. /setup grepped that file, concluded
- * "solo", and routed her to /newcompany for a company she already belonged to.
- *
- * These drive the REAL runner with the REAL reconciler and the REAL activeCompany
- * seeder — no stubs on the code under test. That matters: every stubbed
- * assertion in sync-runner.test.ts passed while the end-to-end path was broken,
- * because the stub is exactly what hid the defect.
- *
- * Reverting US-001/US-002 (the reconciler and its wiring) turns "restores the
- * manifest entry" and "seeds activeCompany" red — verified locally by reverting
- * both and re-running; the failure is recorded in the PR body.
- */
-
-import { afterEach, describe, expect, it, vi } from "vitest";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import yaml from "js-yaml";
-
-import { runRunner } from "../src/bin/sync-runner.js";
-import type { RunnerDeps, VaultClientSurface } from "../src/bin/sync-runner.js";
-import type { EntityInfo, Membership } from "../src/vault-client.js";
-
-// The template a fresh HQ install ships, and what a joiner's personal vault
-// hands them. 298 bytes of nothing, which is what made her look solo.
-const EMPTY_MANIFEST_TEMPLATE = `# HQ company manifest.
-# Source of truth for which company slugs this HQ root routes.
-# Edited by humans; reconciled by hq-sync. Keep this header.
-companies: {}
-`;
-
-let hqRoot: string | undefined;
-
-afterEach(() => {
-  if (hqRoot) {
-    fs.rmSync(hqRoot, { recursive: true, force: true });
-    hqRoot = undefined;
-  }
-});
-
-interface CompanyFixture {
-  uid: string;
-  slug: string;
-  name: string;
-}
-
-function makeJoinerRoot(
-  companies: readonly CompanyFixture[],
-  opts: { createCompanyDirs?: boolean } = {},
-): string {
-  const createCompanyDirs = opts.createCompanyDirs ?? true;
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-joiner-"));
-  fs.mkdirSync(path.join(root, "companies"), { recursive: true });
-  // The pull materializes the company directory; the manifest entry is the
-  // thing that was missing. When `createCompanyDirs` is false we DON'T
-  // pre-create them — that models a company with zero shared files, where the
-  // runner itself must materialize the directory (see the zero-file test).
-  if (createCompanyDirs) {
-    for (const c of companies) {
-      fs.mkdirSync(path.join(root, "companies", c.slug), { recursive: true });
-    }
-  }
-  fs.writeFileSync(
-    path.join(root, "companies", "manifest.yaml"),
-    EMPTY_MANIFEST_TEMPLATE,
-    "utf8",
-  );
-  return root;
-}
-
-function readManifest(root: string): Record<string, Record<string, unknown>> {
-  const doc = yaml.load(
-    fs.readFileSync(path.join(root, "companies", "manifest.yaml"), "utf8"),
-  ) as { companies?: Record<string, Record<string, unknown>> };
-  return doc.companies ?? {};
-}
-
-function readConfig(root: string): Record<string, unknown> {
-  const p = path.join(root, ".hq", "config.json");
-  if (!fs.existsSync(p)) return {};
-  return JSON.parse(fs.readFileSync(p, "utf8")) as Record<string, unknown>;
-}
-
-function makeWriter(): {
-  write: (chunk: string) => boolean;
-  raw: () => string;
-} {
-  let buf = "";
-  return {
-    write: (chunk: string) => {
-      buf += chunk;
-      return true;
-    },
-    raw: () => buf,
-  };
-}
-
-/**
- * A vault client for a user who genuinely belongs to `companies` — the server
- * side is correct and untouched by this project.
- */
-function joinerVaultClient(companies: readonly CompanyFixture[]): VaultClientSurface {
-  const byUid = new Map(companies.map((c) => [c.uid, c]));
-  return {
-    listMyMemberships: () =>
-      Promise.resolve(
-        companies.map((c) => ({ companyUid: c.uid })) as Membership[],
-      ),
-    listMyPendingInvitesByEmail: () => Promise.resolve([]),
-    claimPendingInvitesByEmail: () => Promise.resolve(undefined),
-    ensureMyPersonEntity: () =>
-      Promise.resolve({
-        uid: "prs_01KY0B91T726CBRKT16P5H9TRX",
-        type: "person",
-        slug: "michelle",
-        status: "active",
-      } as unknown as EntityInfo),
-    entity: {
-      get: (uid: string) => {
-        const c = byUid.get(uid);
-        if (!c) return Promise.resolve(undefined as unknown as EntityInfo);
-        return Promise.resolve({
-          uid: c.uid,
-          slug: c.slug,
-          name: c.name,
-          type: "company",
-          status: "active",
-          bucketName: `hq-vault-${c.slug}`,
-          createdAt: "2026-01-01T00:00:00Z",
-        } as unknown as EntityInfo);
-      },
-      listByType: () => Promise.resolve([]),
-    },
-  } as unknown as VaultClientSurface;
-}
-
-function makeDeps(
-  companies: readonly CompanyFixture[],
-): RunnerDeps & { stdout: ReturnType<typeof makeWriter>; stderr: ReturnType<typeof makeWriter> } {
-  const stdout = makeWriter();
-  const stderr = makeWriter();
-  return {
-    getAccessToken: vi.fn().mockResolvedValue("test-access-token"),
-    clearSession: vi.fn(),
-    getIdTokenClaims: vi.fn().mockReturnValue(null),
-    createVaultClient: vi.fn(() => joinerVaultClient(companies)),
-    sync: vi.fn().mockResolvedValue({
-      filesDownloaded: 0,
-      bytesDownloaded: 0,
-      filesSkipped: 0,
-      conflicts: 0,
-      conflictPaths: [],
-      aborted: false,
-      newFiles: [],
-      newFilesCount: 0,
-      filesExcludedByPolicy: 0,
-      filesTombstoned: 0,
-      filesOutOfScope: 0,
-      scopeOrphansRemoved: 0,
-      scopeOrphansBlocked: 0,
-      changedPaths: [],
-    }),
-    reindex: vi.fn(() => ({ status: 0 })),
-    qmdReindex: vi.fn(() => ({
-      qmdAvailable: true,
-      collectionsAdded: [],
-      updated: true,
-      embedded: false,
-      pendingDirty: false,
-    })),
-    // NOTE: reconcileManifest and seedActiveCompany are deliberately NOT
-    // stubbed. Stubbing them is what let this defect hide.
-    stdout,
-    stderr,
-  } as unknown as RunnerDeps & {
-    stdout: ReturnType<typeof makeWriter>;
-    stderr: ReturnType<typeof makeWriter>;
-  };
-}
-
-const BORING_ECOM: CompanyFixture = {
-  uid: "cmp_01KR1QTBSATVKFRTZ5CFNEYA0Q",
-  slug: "boring-ecom",
-  name: "Boring Ecom",
-};
-
-describe("joiner manifest reconciliation (end to end)", () => {
-  it("restores the manifest entry and seeds activeCompany for a single-company joiner", async () => {
-    hqRoot = makeJoinerRoot([BORING_ECOM]);
-    const deps = makeDeps([BORING_ECOM]);
-
-    expect(await runRunner(["--companies", "--hq-root", hqRoot], deps)).toBe(0);
-
-    // The entry she was missing — with the real cloud_uid, not an invented one.
-    const companies = readManifest(hqRoot);
-    expect(Object.keys(companies)).toEqual(["boring-ecom"]);
-    expect(companies["boring-ecom"]).toEqual({
-      name: "Boring Ecom",
-      cloud_uid: "cmp_01KR1QTBSATVKFRTZ5CFNEYA0Q",
-      bucket_name: "hq-vault-boring-ecom",
-    });
-
-    // ...and HQ now knows which company is current, so she is not left unrouted.
-    expect(readConfig(hqRoot).activeCompany).toBe("boring-ecom");
-  });
-
-  it("materializes the company directory and writes the manifest entry even when zero files are shared", async () => {
-    // The agency/client-sharing case: a member genuinely belongs to a company,
-    // but nothing has been shared into their scope yet, so the pull downloads
-    // zero files and never creates `companies/<slug>/`. Before the fix the
-    // reconciler (which gates on that directory) skipped the slug and HQ never
-    // learned about the company. The runner now materializes the directory on a
-    // completed pull leg regardless of file count, so the manifest entry lands.
-    hqRoot = makeJoinerRoot([BORING_ECOM], { createCompanyDirs: false });
-    const deps = makeDeps([BORING_ECOM]);
-
-    // Precondition: the directory does NOT exist yet.
-    expect(fs.existsSync(path.join(hqRoot, "companies", "boring-ecom"))).toBe(
-      false,
-    );
-
-    expect(await runRunner(["--companies", "--hq-root", hqRoot], deps)).toBe(0);
-
-    // The runner created the directory even though the pull shared nothing...
-    expect(fs.existsSync(path.join(hqRoot, "companies", "boring-ecom"))).toBe(
-      true,
-    );
-    // ...and the manifest entry is present, so HQ now knows about the company.
-    const companies = readManifest(hqRoot);
-    expect(companies["boring-ecom"]).toEqual({
-      name: "Boring Ecom",
-      cloud_uid: "cmp_01KR1QTBSATVKFRTZ5CFNEYA0Q",
-      bucket_name: "hq-vault-boring-ecom",
-    });
-    expect(readConfig(hqRoot).activeCompany).toBe("boring-ecom");
-  });
-
-  it("writes both entries but refuses to guess activeCompany for a two-company member", async () => {
-    const acme: CompanyFixture = { uid: "cmp_acme", slug: "acme", name: "Acme" };
-    hqRoot = makeJoinerRoot([BORING_ECOM, acme]);
-    const deps = makeDeps([BORING_ECOM, acme]);
-
-    expect(await runRunner(["--companies", "--hq-root", hqRoot], deps)).toBe(0);
-
-    const companies = readManifest(hqRoot);
-    expect(Object.keys(companies).sort()).toEqual(["acme", "boring-ecom"]);
-    expect(companies["acme"]).toMatchObject({ cloud_uid: "cmp_acme" });
-
-    // Two companies is a real choice and it is hers. Picking one would route
-    // her somewhere arbitrary.
-    expect(readConfig(hqRoot).activeCompany).toBeUndefined();
-  });
-
-  // The conflict-loop guard. manifest.yaml rides in the personal vault, so an
-  // unconditional rewrite would be pushed on every sync and re-create the
-  // documented conflict loop for every user on every machine.
-  it("performs no manifest write on a second, steady-state sync", async () => {
-    hqRoot = makeJoinerRoot([BORING_ECOM]);
-
-    expect(
-      await runRunner(["--companies", "--hq-root", hqRoot], makeDeps([BORING_ECOM])),
-    ).toBe(0);
-
-    const manifestPath = path.join(hqRoot, "companies", "manifest.yaml");
-    const afterFirst = fs.readFileSync(manifestPath, "utf8");
-    // Freeze the mtime far enough back that any rewrite is unmistakable.
-    const frozen = new Date("2020-01-01T00:00:00.000Z");
-    fs.utimesSync(manifestPath, frozen, frozen);
-
-    const second = makeDeps([BORING_ECOM]);
-    expect(await runRunner(["--companies", "--hq-root", hqRoot], second)).toBe(0);
-
-    expect(fs.readFileSync(manifestPath, "utf8")).toBe(afterFirst);
-    expect(fs.statSync(manifestPath).mtimeMs).toBe(frozen.getTime());
-    // Silence is the contract: a steady-state sync that reports a reconcile is
-    // the signal that skip-if-unchanged has regressed.
-    expect(second.stderr.raw()).not.toContain("manifest-reconciled");
-  });
-
-  it("never overwrites an activeCompany the user already chose", async () => {
-    hqRoot = makeJoinerRoot([BORING_ECOM]);
-    fs.mkdirSync(path.join(hqRoot, ".hq"), { recursive: true });
-    fs.writeFileSync(
-      path.join(hqRoot, ".hq", "config.json"),
-      JSON.stringify({ activeCompany: "chosen-by-user" }),
-      "utf8",
-    );
-
-    expect(
-      await runRunner(["--companies", "--hq-root", hqRoot], makeDeps([BORING_ECOM])),
-    ).toBe(0);
-
-    expect(readConfig(hqRoot).activeCompany).toBe("chosen-by-user");
-    // The manifest repair still happens — the two are independent.
-    expect(Object.keys(readManifest(hqRoot))).toEqual(["boring-ecom"]);
-  });
-
-  it("preserves the manifest header comment through the first write", async () => {
-    hqRoot = makeJoinerRoot([BORING_ECOM]);
-
-    expect(
-      await runRunner(["--companies", "--hq-root", hqRoot], makeDeps([BORING_ECOM])),
-    ).toBe(0);
-
-    const raw = fs.readFileSync(
-      path.join(hqRoot, "companies", "manifest.yaml"),
-      "utf8",
-    );
-    expect(Object.keys(readManifest(hqRoot))).toEqual(["boring-ecom"]);
-    // Documents the CURRENT behaviour: the write re-dumps the document, so the
-    // human-authored header does not survive. Tracked as a follow-up (see
-    // review-findings P1) — this assertion exists so a fix flips it loudly
-    // rather than silently.
-    expect(raw).not.toContain("# HQ company manifest.");
-  });
-});

package/test/share-sync.integration.test.ts

@@ -1,213 +0,0 @@
-/**
- * Integration test: laptop → vault → mini share/sync lifecycle (VLT-5 US-003).
- *
- * Exercises the full share/sync cycle against a real dev-stage company entity
- * using real STS vending (VLT-3). Requires:
- *   - VAULT_API_URL env var (vault-service API endpoint)
- *   - VAULT_AUTH_TOKEN env var (Cognito JWT for an active member)
- *   - VAULT_TEST_COMPANY env var (company slug with an active entity + bucket)
- *
- * Run: pnpm test:e2e:laptop-mini
- *
- * This test:
- *   1. Laptop shares a handoff into the vault
- *   2. Mini (same membership, separate local root) syncs and receives it
- *   3. Mini shares a finding back through the vault
- *   4. Laptop syncs and receives it
- *   5. Laptop keeps a local edit when Mini pushes a divergent update
- *
- * This deliberately exercises the vault transport only. The optional git
- * handoff mirror is a separate subsystem and is not required for this path.
- *
- * Cleanup: all shared files are deleted from S3 on teardown.
- */
-
-import { describe, it, expect, afterAll } from "vitest";
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
-import {
-  resolveEntityContext,
-  clearContextCache,
-  deleteRemoteFile,
-  listRemoteFiles,
-} from "../src/index.js";
-import { share } from "../src/cli/share.js";
-import { sync } from "../src/cli/sync.js";
-import type { VaultServiceConfig, EntityContext } from "../src/types.js";
-
-// Skip if env vars not set
-const VAULT_API_URL = process.env.VAULT_API_URL;
-const VAULT_AUTH_TOKEN = process.env.VAULT_AUTH_TOKEN;
-const VAULT_TEST_COMPANY = process.env.VAULT_TEST_COMPANY;
-
-const canRun = VAULT_API_URL && VAULT_AUTH_TOKEN && VAULT_TEST_COMPANY;
-
-const TEST_PREFIX = `__integration-test-${Date.now()}`;
-
-describe.skipIf(!canRun)("laptop-vault-mini share-sync integration", () => {
-  let vaultConfig: VaultServiceConfig;
-  let m1Root: string;
-  let m2Root: string;
-  let ctx: EntityContext;
-
-  // Track files to clean up
-  const sharedKeys: string[] = [];
-
-  // Create two simulated machine roots
-  const setup = async () => {
-    vaultConfig = {
-      apiUrl: VAULT_API_URL!,
-      authToken: VAULT_AUTH_TOKEN!,
-      region: "us-east-1",
-    };
-
-    m1Root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-integ-m1-"));
-    m2Root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-integ-m2-"));
-
-    // Resolve entity context to verify connectivity
-    clearContextCache();
-    ctx = await resolveEntityContext(VAULT_TEST_COMPANY!, vaultConfig);
-
-    console.log(`Integration test: entity=${ctx.uid}, bucket=${ctx.bucketName}`);
-    console.log(`M1 root: ${m1Root}`);
-    console.log(`M2 root: ${m2Root}`);
-  };
-
-  afterAll(async () => {
-    // Cleanup: delete all test files from S3
-    try {
-      if (ctx) {
-        for (const key of sharedKeys) {
-          try {
-            await deleteRemoteFile(ctx, key);
-          } catch {
-            // Best-effort cleanup
-          }
-        }
-
-        // Also scan for any orphaned test files
-        const remoteFiles = await listRemoteFiles(ctx, TEST_PREFIX);
-        for (const file of remoteFiles) {
-          try {
-            await deleteRemoteFile(ctx, file.key);
-          } catch {
-            // Best-effort
-          }
-        }
-      }
-    } finally {
-      // Clean up temp directories
-      if (m1Root) fs.rmSync(m1Root, { recursive: true, force: true });
-      if (m2Root) fs.rmSync(m2Root, { recursive: true, force: true });
-    }
-  });
-
-  it("moves a handoff laptop → vault → mini and a finding back", async () => {
-    await setup();
-
-    // --- Step 1: M1 shares file A ---
-    const fileA = `${TEST_PREFIX}/docs/handoff.md`;
-    const fileALocal = path.join(m1Root, fileA);
-    fs.mkdirSync(path.dirname(fileALocal), { recursive: true });
-    fs.writeFileSync(fileALocal, "# Handoff from M1\n\nDiscovery notes here.");
-    sharedKeys.push(fileA);
-
-    const shareResult1 = await share({
-      paths: [fileALocal],
-      company: VAULT_TEST_COMPANY!,
-      message: "Initial handoff notes",
-      vaultConfig,
-      hqRoot: m1Root,
-    });
-
-    expect(shareResult1.filesUploaded).toBe(1);
-    expect(shareResult1.aborted).toBe(false);
-    console.log("Step 1 PASS: M1 shared file A");
-
-    // --- Step 2: M2 syncs → receives A ---
-    clearContextCache();
-
-    const syncResult1 = await sync({
-      company: VAULT_TEST_COMPANY!,
-      vaultConfig,
-      hqRoot: m2Root,
-    });
-
-    expect(syncResult1.filesDownloaded).toBeGreaterThanOrEqual(1);
-    expect(syncResult1.aborted).toBe(false);
-
-    const m2FileA = path.join(m2Root, fileA);
-    expect(fs.existsSync(m2FileA)).toBe(true);
-    expect(fs.readFileSync(m2FileA, "utf-8")).toContain("Handoff from M1");
-    console.log("Step 2 PASS: M2 synced and received file A");
-
-    // --- Step 3: M2 shares file B ---
-    const fileB = `${TEST_PREFIX}/knowledge/findings.md`;
-    const fileBLocal = path.join(m2Root, fileB);
-    fs.mkdirSync(path.dirname(fileBLocal), { recursive: true });
-    fs.writeFileSync(fileBLocal, "# Findings from M2\n\nNew discovery.");
-    sharedKeys.push(fileB);
-
-    const shareResult2 = await share({
-      paths: [fileBLocal],
-      company: VAULT_TEST_COMPANY!,
-      message: "Research findings",
-      vaultConfig,
-      hqRoot: m2Root,
-    });
-
-    expect(shareResult2.filesUploaded).toBe(1);
-    console.log("Step 3 PASS: M2 shared file B");
-
-    // --- Step 4: M1 syncs → receives B ---
-    clearContextCache();
-
-    const syncResult2 = await sync({
-      company: VAULT_TEST_COMPANY!,
-      vaultConfig,
-      hqRoot: m1Root,
-    });
-
-    expect(syncResult2.filesDownloaded).toBeGreaterThanOrEqual(1);
-
-    const m1FileB = path.join(m1Root, fileB);
-    expect(fs.existsSync(m1FileB)).toBe(true);
-    expect(fs.readFileSync(m1FileB, "utf-8")).toContain("Findings from M2");
-    console.log("Step 4 PASS: M1 synced and received file B");
-
-    // --- Step 5: Conflict — M1 edits A locally, M2 pushes newer A, M1 syncs with keep ---
-    // M1 edits locally
-    fs.writeFileSync(fileALocal, "# Handoff from M1\n\nEDITED LOCALLY by M1.");
-
-    // M2 pushes newer version
-    fs.writeFileSync(m2FileA, "# Handoff from M1\n\nUPDATED by M2.");
-    clearContextCache();
-
-    await share({
-      paths: [m2FileA],
-      company: VAULT_TEST_COMPANY!,
-      onConflict: "overwrite",
-      vaultConfig,
-      hqRoot: m2Root,
-    });
-
-    // M1 syncs with --on-conflict=keep
-    clearContextCache();
-
-    await sync({
-      company: VAULT_TEST_COMPANY!,
-      onConflict: "keep",
-      vaultConfig,
-      hqRoot: m1Root,
-    });
-
-    // M1's local version should be preserved
-    const m1Content = fs.readFileSync(fileALocal, "utf-8");
-    expect(m1Content).toContain("EDITED LOCALLY by M1");
-    expect(m1Content).not.toContain("UPDATED by M2");
-    console.log("Step 5 PASS: M1 kept local version on conflict");
-
-    console.log("\n=== All 5 lifecycle steps passed ===");
-  }, 60_000); // 60s timeout for network ops
-});

package/tsconfig.json

@@ -1,19 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "lib": ["ES2022"],
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "declaration": true,
-    "declarationMap": true,
-    "sourceMap": true,
-    "resolveJsonModule": true,
-    "outDir": "dist",
-    "rootDir": "src"
-  },
-  "include": ["src"]
-}

package/vitest.config.ts

@@ -1,22 +0,0 @@
-import { defineConfig } from "vitest/config";
-
-// Vitest defaults to a 5_000ms per-test timeout and 10_000ms hook timeout.
-// That is comfortable for the unit suite, but the `rescue-*.test.ts`
-// integration suites build a real git repository in `beforeAll` and then shell
-// out to `git` (and the rescue CLI, which itself spawns several `git`
-// subprocesses) inside each `it`. Measured cold these tests run ~4–5s each;
-// under full file-parallelism they contend for CPU and disk and routinely
-// cross the 5s default, producing flaky "Test timed out in 5000ms" failures
-// that have nothing to do with the code under test.
-//
-// Raise the global ceilings to give those git-bound tests headroom. The values
-// are still tight enough to catch a genuinely hung test (an unresolved promise
-// or a deadlocked subprocess) — they just stop punishing legitimately-slow
-// integration work. Keep this central rather than sprinkling per-test timeouts
-// so future git-heavy suites inherit the headroom automatically.
-export default defineConfig({
-  test: {
-    testTimeout: 20_000,
-    hookTimeout: 30_000,
-  },
-});