@indigoai-us/hq-cloud 6.14.50 → 6.15.1

package/src/personal-vault.test.ts

@@ -1,756 +0,0 @@
-/**
- * Unit tests for the personal-vault path-discovery helpers.
- *
- * These cover the column-anchored `cloud: true` exclusion-marker regex and
- * the `companies/{slug}/` enumeration filter — both are pure functions over
- * disk + caller-supplied option sets, so we exercise them against tmp
- * directories rather than mocking fs. Local (non-cloud) companies sync to
- * the personal vault by DEFAULT: a missing/markerless `company.yaml` is
- * INCLUDED; only an explicit `cloud: true` marker, membership via
- * `teamSyncedSlugs`, or a `cloud_uid: cmp_*` entry in
- * `companies/manifest.yaml` opts a company out.
- *
- * The sync-runner-level integration (team-synced slug derivation,
- * decommission of cloud-promoted companies, end-to-end share() invocation)
- * lives in `bin/sync-runner.test.ts` — tests G, H, I.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import {
-  computeContinuityPointerPaths,
-  computePersonalCompanySubdirs,
-  computePersonalVaultPaths,
-  readCloudBackedSlugsFromManifest,
-  CONTINUITY_POINTER_REL,
-  computeAgencySyncPaths,
-  AGENCY_SYNC_REL,
-  computeSessionLogsSyncPaths,
-  SESSION_LOGS_SYNC_REL,
-  PERSONAL_VAULT_COMPANY_EXCLUDED_SLUGS,
-  PERSONAL_VAULT_EXCLUDED_TOP_LEVEL,
-  isPersonalVaultDeletionExcluded,
-} from "./personal-vault.js";
-
-describe("personal-vault helpers", () => {
-  let hqRoot: string;
-
-  beforeEach(() => {
-    hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-pv-test-"));
-  });
-
-  afterEach(() => {
-    fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  /** Helper: write `companies/{slug}/company.yaml` with arbitrary content. */
-  function writeCompany(slug: string, yaml: string | null): void {
-    const dir = path.join(hqRoot, "companies", slug);
-    fs.mkdirSync(dir, { recursive: true });
-    if (yaml !== null) fs.writeFileSync(path.join(dir, "company.yaml"), yaml);
-  }
-
-  /** Helper: relative-paths-sorted projection of an absolute-path list. */
-  function rel(abs: string[]): string[] {
-    return abs.map((p) => path.relative(hqRoot, p)).sort();
-  }
-
-  // ── Exported constants ─────────────────────────────────────────────────
-  it("constants: PERSONAL_VAULT_EXCLUDED_TOP_LEVEL contains the canonical four names", () => {
-    expect([...PERSONAL_VAULT_EXCLUDED_TOP_LEVEL].sort()).toEqual([
-      ".git",
-      "companies",
-      "repos",
-      "workspace",
-    ]);
-  });
-
-  it("constants: PERSONAL_VAULT_COMPANY_EXCLUDED_SLUGS hard-lists `_template`", () => {
-    expect(PERSONAL_VAULT_COMPANY_EXCLUDED_SLUGS).toContain("_template");
-  });
-
-  // ── computePersonalCompanySubdirs: default inclusion ───────────────────
-  // Local companies sync to the personal vault by default. A missing or
-  // markerless company.yaml is INCLUDED — only an explicit `cloud: true`
-  // marker (or membership) opts a company OUT.
-  it("default: includes a company with NO company.yaml", () => {
-    writeCompany("foo", null);
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-  });
-
-  it("default: includes a company with an empty company.yaml", () => {
-    writeCompany("foo", "");
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-  });
-
-  it("default: includes a company explicitly marked `cloud: false`", () => {
-    writeCompany("foo", "cloud: false\nname: Foo\n");
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-  });
-
-  it("default: includes a company.yaml with no `cloud:` key at all", () => {
-    writeCompany("foo", "name: Foo\nslug: foo\n");
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-  });
-
-  // ── computePersonalCompanySubdirs: `cloud: true` exclusion-marker ──────
-  it("marker: excludes canonical `cloud: true` at column 0", () => {
-    writeCompany("foo", "cloud: true\nname: Foo\n");
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
-  });
-
-  it("marker: excludes `cloud:true` (no space after colon)", () => {
-    writeCompany("foo", "cloud:true\n");
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
-  });
-
-  it("marker: excludes with a trailing comment after `cloud: true`", () => {
-    writeCompany("foo", "cloud: true   # cloud-backed, synced to team bucket\n");
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
-  });
-
-  it("marker: excludes with CRLF line endings", () => {
-    writeCompany("foo", "cloud: true\r\nname: Foo\r\n");
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
-  });
-
-  it("marker: excludes `cloud: true` even when it is NOT the first line", () => {
-    writeCompany("foo", "name: Foo\nslug: foo\ncloud: true\n");
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
-  });
-
-  // ── computePersonalCompanySubdirs: marker fails OPEN (still included) ───
-  // A marker that isn't the canonical column-0 lowercase `cloud: true`
-  // shape `/designate-team` emits does NOT exclude — the company stays in
-  // the personal vault, which is the safe default.
-  it("marker: nested `cloud: true` does NOT exclude (column-0 anchor)", () => {
-    writeCompany("foo", "meta:\n  cloud: true\n");
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-  });
-
-  it("marker: list-item style `- cloud: true` does NOT exclude", () => {
-    writeCompany("foo", "tags:\n- cloud: true\n");
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-  });
-
-  it("marker: flow-mapping `{ cloud: true }` does NOT exclude", () => {
-    writeCompany("foo", "{ cloud: true }\n");
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-  });
-
-  it("marker: YAML-alt boolean spellings (True, TRUE, yes, on) do NOT exclude", () => {
-    for (const variant of ["cloud: True\n", "cloud: TRUE\n", "cloud: yes\n", "cloud: on\n"]) {
-      writeCompany("foo", variant);
-      expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-        path.join("companies", "foo"),
-      ]);
-      fs.rmSync(path.join(hqRoot, "companies", "foo"), { recursive: true });
-    }
-  });
-
-  it("marker: quoted `cloud: \"true\"` does NOT exclude (quote breaks the literal-true match)", () => {
-    writeCompany("foo", 'cloud: "true"\n');
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-  });
-
-  it("marker: `cloud: truthy` does NOT exclude (word-boundary guard)", () => {
-    writeCompany("foo", "cloud: truthy\n");
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-  });
-
-  // ── Subdir-level filters ───────────────────────────────────────────────
-  it("filter: skips _template even when it would otherwise be included", () => {
-    writeCompany("_template", null);
-    writeCompany("real", null);
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "real"),
-    ]);
-  });
-
-  it("filter: skips slugs in the teamSyncedSlugs set (cloud-backed)", () => {
-    writeCompany("free", null);
-    writeCompany("team-acme", null);
-    expect(
-      rel(computePersonalCompanySubdirs(hqRoot, new Set(["team-acme"]))),
-    ).toEqual([path.join("companies", "free")]);
-  });
-
-  // Manifest cloud_uid is the durable cloud-backed signal when the runner
-  // has no membership fanout (agent `--personal` ritual). Without this,
-  // multi-GB team trees re-enter the personal vault every cycle.
-  it("filter: skips slugs with cloud_uid in companies/manifest.yaml", () => {
-    writeCompany("local-only", null);
-    writeCompany("indigo", null); // no company.yaml cloud:true
-    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
-    fs.writeFileSync(
-      path.join(hqRoot, "companies", "manifest.yaml"),
-      [
-        "companies:",
-        "  indigo:",
-        "    name: Indigo",
-        "    cloud_uid: cmp_01KQ2RYAHXHDPCTY9GPQPTH3DG",
-        "    bucket_name: hq-vault-cmp-01kq2ryahxhdpcty9gpqpth3dg",
-        "  local-only:",
-        "    name: Local Only",
-        "",
-      ].join("\n"),
-    );
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "local-only"),
-    ]);
-    expect([...readCloudBackedSlugsFromManifest(hqRoot)].sort()).toEqual([
-      "indigo",
-    ]);
-  });
-
-  it("filter: missing/unreadable manifest fails open (local companies still included)", () => {
-    writeCompany("foo", null);
-    // no companies/manifest.yaml
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "foo"),
-    ]);
-    expect(readCloudBackedSlugsFromManifest(hqRoot).size).toBe(0);
-  });
-
-  it("filter: skips stray files under companies/ (only directories considered)", () => {
-    // Hypothetical: someone drops a README.md at companies/. Should not
-    // crash, should not be enumerated as a company subdir.
-    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
-    fs.writeFileSync(path.join(hqRoot, "companies", "README.md"), "# README");
-    writeCompany("real", null);
-    expect(rel(computePersonalCompanySubdirs(hqRoot))).toEqual([
-      path.join("companies", "real"),
-    ]);
-  });
-
-  it("filter: missing hqRoot/companies/ returns []", () => {
-    // No `companies/` dir at all (fresh install or atypical layout).
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
-  });
-
-  // ── computePersonalVaultPaths: top-level + company-subdir composition ──
-  it("composition: local company subdirs are included by default (no opt-in flag)", () => {
-    fs.mkdirSync(path.join(hqRoot, ".claude"));
-    fs.mkdirSync(path.join(hqRoot, "knowledge"));
-    writeCompany("foo", null);
-    writeCompany("bar", "cloud: true\n");
-
-    const out = rel(computePersonalVaultPaths(hqRoot));
-    // Top-level entries present.
-    expect(out).toContain(".claude");
-    expect(out).toContain("knowledge");
-    // Local (non-cloud) company included; cloud-marked one excluded.
-    expect(out).toContain(path.join("companies", "foo"));
-    expect(out).not.toContain(path.join("companies", "bar"));
-    // The companies/ top-level entry itself is never present — only specific
-    // eligible subdirs. Preserves the invariant that share() never walks
-    // the whole companies/ tree under personalMode.
-    expect(out).not.toContain("companies");
-  });
-
-  it("composition: teamSyncedSlugs filter excludes cloud-backed companies", () => {
-    writeCompany("foo", null);
-    writeCompany("synced", null);
-
-    const out = rel(
-      computePersonalVaultPaths(hqRoot, {
-        teamSyncedSlugs: new Set(["synced"]),
-      }),
-    );
-    expect(out).toContain(path.join("companies", "foo"));
-    expect(out).not.toContain(path.join("companies", "synced"));
-  });
-
-  it("composition: missing hqRoot returns []", () => {
-    fs.rmSync(hqRoot, { recursive: true });
-    expect(computePersonalVaultPaths(hqRoot)).toEqual([]);
-  });
-
-  // ── companies/manifest.yaml inclusion ─────────────────────────────────
-  //
-  // The manifest is the routing source-of-truth (which slugs exist, which
-  // are cloud-backed, what their company UIDs are). The vault needs a
-  // single canonical copy: without it, a fresh machine joining the
-  // personal vault has no way to enumerate which non-cloud companies it
-  // expects to pull. Special-cased because companies/ itself is in
-  // PERSONAL_VAULT_EXCLUDED_TOP_LEVEL.
-  it("manifest: includes companies/manifest.yaml when present (default opts)", () => {
-    fs.mkdirSync(path.join(hqRoot, "companies"));
-    fs.writeFileSync(
-      path.join(hqRoot, "companies", "manifest.yaml"),
-      "companies:\n  foo: {}\n",
-    );
-    fs.mkdirSync(path.join(hqRoot, ".claude"));
-
-    const out = rel(computePersonalVaultPaths(hqRoot));
-    expect(out).toContain(path.join("companies", "manifest.yaml"));
-    expect(out).toContain(".claude");
-  });
-
-  it("manifest: included even when there are no eligible company subdirs", () => {
-    fs.mkdirSync(path.join(hqRoot, "companies"));
-    fs.writeFileSync(
-      path.join(hqRoot, "companies", "manifest.yaml"),
-      "companies: {}\n",
-    );
-
-    const out = rel(computePersonalVaultPaths(hqRoot));
-    expect(out).toContain(path.join("companies", "manifest.yaml"));
-  });
-
-  it("manifest: absent file is not included (no crash, no phantom entry)", () => {
-    fs.mkdirSync(path.join(hqRoot, "companies"));
-    // No manifest.yaml written.
-
-    const out = rel(computePersonalVaultPaths(hqRoot));
-    expect(out).not.toContain(path.join("companies", "manifest.yaml"));
-  });
-
-  it("manifest: missing companies/ directory entirely is not an error", () => {
-    // Fresh install or atypical layout: no companies/ dir at all.
-    fs.mkdirSync(path.join(hqRoot, ".claude"));
-    expect(() => computePersonalVaultPaths(hqRoot)).not.toThrow();
-    const out = rel(computePersonalVaultPaths(hqRoot));
-    expect(out).toContain(".claude");
-    expect(out).not.toContain(path.join("companies", "manifest.yaml"));
-  });
-
-  it("manifest: ONLY manifest.yaml is special-cased — other companies/ root files stay excluded", () => {
-    // Anti-test: only manifest.yaml gets the bypass. A stray README.md at
-    // companies/ root or a directory called `_template` must still be
-    // filtered (the latter by company-eligibility, the former silently).
-    fs.mkdirSync(path.join(hqRoot, "companies"));
-    fs.writeFileSync(
-      path.join(hqRoot, "companies", "manifest.yaml"),
-      "companies: {}\n",
-    );
-    fs.writeFileSync(
-      path.join(hqRoot, "companies", "README.md"),
-      "# companies tree",
-    );
-
-    const out = rel(computePersonalVaultPaths(hqRoot));
-    expect(out).toContain(path.join("companies", "manifest.yaml"));
-    expect(out).not.toContain(path.join("companies", "README.md"));
-  });
-
-  it("manifest: composes with local company subdirs", () => {
-    fs.mkdirSync(path.join(hqRoot, "companies"));
-    fs.writeFileSync(
-      path.join(hqRoot, "companies", "manifest.yaml"),
-      "companies:\n  foo: {cloud_uid: null}\n  team-acme: {cloud_uid: cmp_01XYZ}\n",
-    );
-    writeCompany("foo", null);
-    writeCompany("team-acme", "cloud: true\n");
-
-    const out = rel(
-      computePersonalVaultPaths(hqRoot, {
-        teamSyncedSlugs: new Set(["team-acme"]),
-      }),
-    );
-    // Manifest + non-cloud subdir, NOT team-acme.
-    expect(out).toContain(path.join("companies", "manifest.yaml"));
-    expect(out).toContain(path.join("companies", "foo"));
-    expect(out).not.toContain(path.join("companies", "team-acme"));
-  });
-
-  it("manifest: stray `manifest.yaml.conflict-*` litter is never enumerated as a company", () => {
-    // Regression guard for DEV-1719's secondary symptom: when the personal
-    // push accumulated `companies/manifest.yaml.conflict-<ts>.yaml` mirror
-    // files, those FILES must never be mis-counted as company subdirs (they
-    // are not directories) nor leak into the push set. The real manifest.yaml
-    // is still included; the conflict litter is not.
-    fs.mkdirSync(path.join(hqRoot, "companies"));
-    fs.writeFileSync(
-      path.join(hqRoot, "companies", "manifest.yaml"),
-      "companies: {}\n",
-    );
-    fs.writeFileSync(
-      path.join(hqRoot, "companies", "manifest.yaml.conflict-2026-06-08T10-00-00Z-ab12cd.yaml"),
-      "companies: {}\n",
-    );
-
-    // Not treated as a company subdir (only directories are eligible).
-    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
-
-    // Push set carries the real manifest, never the conflict litter.
-    const out = rel(computePersonalVaultPaths(hqRoot));
-    expect(out).toContain(path.join("companies", "manifest.yaml"));
-    expect(
-      out.some((p) => p.includes("manifest.yaml.conflict-")),
-    ).toBe(false);
-  });
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// DEV-1778 — session-continuity pointer carve-out.
-//
-// `workspace/` is in PERSONAL_VAULT_EXCLUDED_TOP_LEVEL (machine-local by
-// design). The ONE exception is the session pointer
-// `workspace/threads/handoff.json` + the single thread file it references via
-// `thread_path`, so a `/handoff` on one machine reaches a second machine.
-// Mirrors the companies/manifest.yaml special-case: a narrow file-level
-// re-include that never broadens the rest of workspace/.
-// ─────────────────────────────────────────────────────────────────────────
-describe("personal-vault: continuity-pointer carve-out", () => {
-  let hqRoot: string;
-
-  beforeEach(() => {
-    hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-cont-test-"));
-  });
-
-  afterEach(() => {
-    fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  /** Helper: relative-paths-sorted projection of an absolute-path list. */
-  function rel(abs: string[]): string[] {
-    return abs.map((p) => path.relative(hqRoot, p)).sort();
-  }
-
-  const THREADS = path.join("workspace", "threads");
-
-  /** Write workspace/threads/handoff.json with the given object. */
-  function writeHandoff(obj: unknown, raw?: string): void {
-    const dir = path.join(hqRoot, THREADS);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(
-      path.join(dir, "handoff.json"),
-      raw !== undefined ? raw : JSON.stringify(obj),
-    );
-  }
-
-  /** Write a thread file under workspace/threads/ and return its rel path. */
-  function writeThread(name: string): string {
-    const dir = path.join(hqRoot, THREADS);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, name), "{}");
-    return path.join(THREADS, name).split(path.sep).join("/");
-  }
-
-  it("constant: CONTINUITY_POINTER_REL is the canonical pointer path", () => {
-    expect(CONTINUITY_POINTER_REL).toBe("workspace/threads/handoff.json");
-  });
-
-  it("includes handoff.json + the thread file it points to", () => {
-    const threadRel = writeThread("T-20260617-1200-demo.json");
-    writeHandoff({ thread_path: threadRel });
-
-    expect(rel(computeContinuityPointerPaths(hqRoot))).toEqual(
-      [
-        path.join(THREADS, "T-20260617-1200-demo.json"),
-        path.join(THREADS, "handoff.json"),
-      ].sort(),
-    );
-  });
-
-  it("carve-out composes into computePersonalVaultPaths", () => {
-    const threadRel = writeThread("T-20260617-1200-demo.json");
-    writeHandoff({ thread_path: threadRel });
-    fs.mkdirSync(path.join(hqRoot, ".claude"));
-
-    const out = rel(computePersonalVaultPaths(hqRoot));
-    expect(out).toContain(path.join(THREADS, "handoff.json"));
-    expect(out).toContain(path.join(THREADS, "T-20260617-1200-demo.json"));
-    // Sibling top-level dirs still travel; the rest of workspace/ does not.
-    expect(out).toContain(".claude");
-  });
-
-  it("does NOT broaden the rest of workspace/ (siblings/other threads stay local)", () => {
-    const threadRel = writeThread("T-active.json");
-    writeThread("T-old.json"); // an inactive thread — must NOT sync
-    writeHandoff({ thread_path: threadRel });
-    // Unrelated workspace litter that must stay machine-local.
-    fs.mkdirSync(path.join(hqRoot, "workspace", "locks"), { recursive: true });
-    fs.writeFileSync(path.join(hqRoot, "workspace", "locks", "x.lock"), "1");
-    fs.writeFileSync(path.join(hqRoot, "workspace", "threads", "INDEX.md"), "#");
-
-    const out = rel(computePersonalVaultPaths(hqRoot));
-    expect(out).toContain(path.join(THREADS, "handoff.json"));
-    expect(out).toContain(path.join(THREADS, "T-active.json"));
-    expect(out).not.toContain(path.join(THREADS, "T-old.json"));
-    expect(out).not.toContain(path.join(THREADS, "INDEX.md"));
-    expect(out.some((p) => p.startsWith(path.join("workspace", "locks")))).toBe(
-      false,
-    );
-  });
-
-  it("handoff.json present but thread_path absent → only the pointer", () => {
-    writeHandoff({ message: "no pointer field" });
-    expect(rel(computeContinuityPointerPaths(hqRoot))).toEqual([
-      path.join(THREADS, "handoff.json"),
-    ]);
-  });
-
-  it("handoff.json points to a non-existent thread file → only the pointer", () => {
-    writeHandoff({ thread_path: "workspace/threads/T-ghost.json" });
-    expect(rel(computeContinuityPointerPaths(hqRoot))).toEqual([
-      path.join(THREADS, "handoff.json"),
-    ]);
-  });
-
-  it("no handoff.json at all → empty (nothing to carry)", () => {
-    fs.mkdirSync(path.join(hqRoot, THREADS), { recursive: true });
-    expect(computeContinuityPointerPaths(hqRoot)).toEqual([]);
-  });
-
-  it("malformed handoff.json → fail-soft to pointer only (no throw)", () => {
-    writeHandoff(null, "{ this is : not json ]");
-    expect(() => computeContinuityPointerPaths(hqRoot)).not.toThrow();
-    expect(rel(computeContinuityPointerPaths(hqRoot))).toEqual([
-      path.join(THREADS, "handoff.json"),
-    ]);
-  });
-
-  // ── Security: thread_path must never escape workspace/threads/ ──────────
-  it("rejects an absolute thread_path (only the pointer is included)", () => {
-    // Put a real file at the absolute target so the ONLY thing rejecting it
-    // is the containment guard, not a missing-file fallthrough.
-    const evil = path.join(hqRoot, "secret.txt");
-    fs.writeFileSync(evil, "top secret");
-    writeHandoff({ thread_path: evil });
-    expect(rel(computeContinuityPointerPaths(hqRoot))).toEqual([
-      path.join(THREADS, "handoff.json"),
-    ]);
-  });
-
-  it("rejects a traversal thread_path (../../.env) — no smuggling out of threads/", () => {
-    fs.writeFileSync(path.join(hqRoot, ".env"), "SECRET=1");
-    writeHandoff({ thread_path: "workspace/threads/../../.env" });
-    const out = rel(computeContinuityPointerPaths(hqRoot));
-    expect(out).toEqual([path.join(THREADS, "handoff.json")]);
-    expect(out.some((p) => p.endsWith(".env"))).toBe(false);
-  });
-
-  it("rejects a thread_path under workspace/ but outside threads/", () => {
-    fs.mkdirSync(path.join(hqRoot, "workspace", "reports"), {
-      recursive: true,
-    });
-    fs.writeFileSync(
-      path.join(hqRoot, "workspace", "reports", "secret.md"),
-      "x",
-    );
-    writeHandoff({ thread_path: "workspace/reports/secret.md" });
-    expect(rel(computeContinuityPointerPaths(hqRoot))).toEqual([
-      path.join(THREADS, "handoff.json"),
-    ]);
-  });
-
-  it("rejects a symlink that escapes threads/ (realpath containment)", () => {
-    // A thread_path that names an in-threads symlink whose target is OUTSIDE
-    // threads/ must be rejected by the realpath re-check.
-    fs.writeFileSync(path.join(hqRoot, "outside.txt"), "secret");
-    fs.mkdirSync(path.join(hqRoot, THREADS), { recursive: true });
-    const link = path.join(hqRoot, THREADS, "escape.json");
-    try {
-      fs.symlinkSync(path.join(hqRoot, "outside.txt"), link);
-    } catch {
-      // Platform without symlink support — skip the assertion gracefully.
-      return;
-    }
-    writeHandoff({ thread_path: "workspace/threads/escape.json" });
-    expect(rel(computeContinuityPointerPaths(hqRoot))).toEqual([
-      path.join(THREADS, "handoff.json"),
-    ]);
-  });
-
-  it("R-F35: rejects threads symlinks below hqRoot while allowing symlinked hqRoot ancestors", () => {
-    const privateThreads = path.join(hqRoot, "repos", "private");
-    fs.mkdirSync(privateThreads, { recursive: true });
-    fs.mkdirSync(path.join(hqRoot, "workspace"), { recursive: true });
-    fs.writeFileSync(path.join(privateThreads, "handoff.json"), JSON.stringify({
-      thread_path: "workspace/threads/T-private.json",
-    }));
-    fs.writeFileSync(path.join(privateThreads, "T-private.json"), "{}");
-    fs.symlinkSync(privateThreads, path.join(hqRoot, THREADS), "dir");
-
-    expect(rel(computeContinuityPointerPaths(hqRoot))).toEqual([
-      path.join(THREADS, "handoff.json"),
-    ]);
-
-    const realParent = fs.mkdtempSync(path.join(os.tmpdir(), "hq-cont-real-"));
-    const aliasParent = fs.mkdtempSync(path.join(os.tmpdir(), "hq-cont-alias-"));
-    const realRoot = path.join(realParent, "root");
-    const aliasRoot = path.join(aliasParent, "root-link");
-    try {
-      fs.mkdirSync(path.join(realRoot, THREADS), { recursive: true });
-      fs.writeFileSync(
-        path.join(realRoot, THREADS, "handoff.json"),
-        JSON.stringify({ thread_path: "workspace/threads/T-active.json" }),
-      );
-      fs.writeFileSync(path.join(realRoot, THREADS, "T-active.json"), "{}");
-      fs.symlinkSync(realRoot, aliasRoot, "dir");
-
-      const aliasRel = computeContinuityPointerPaths(aliasRoot)
-        .map((p) => path.relative(aliasRoot, p))
-        .sort();
-      expect(aliasRel).toEqual(
-        [
-          path.join(THREADS, "T-active.json"),
-          path.join(THREADS, "handoff.json"),
-        ].sort(),
-      );
-    } finally {
-      fs.rmSync(realParent, { recursive: true, force: true });
-      fs.rmSync(aliasParent, { recursive: true, force: true });
-    }
-  });
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// workspace/agency carve-out — sync the agency-team workspace across machines.
-//
-// Like the continuity pointer, this pierces the workspace/ top-level exclusion
-// for ONE subtree: workspace/agency/<company>/<team>/ (hq-pack-agency chat
-// inboxes + roster/state), so an agency team picked up on a second machine sees
-// the same conversation it had on the first. The rest of workspace/ stays local.
-// ─────────────────────────────────────────────────────────────────────────
-describe("personal-vault: agency-workspace carve-out", () => {
-  let hqRoot: string;
-  beforeEach(() => {
-    hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-agency-test-"));
-  });
-  afterEach(() => {
-    fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-  const relAll = (abs: string[]): string[] =>
-    abs.map((p) => path.relative(hqRoot, p)).sort();
-
-  it("constant: AGENCY_SYNC_REL is workspace/agency", () => {
-    expect(AGENCY_SYNC_REL).toBe("workspace/agency");
-  });
-
-  it("includes workspace/agency when it exists", () => {
-    fs.mkdirSync(path.join(hqRoot, "workspace", "agency", "acme", "growth"), {
-      recursive: true,
-    });
-    expect(relAll(computeAgencySyncPaths(hqRoot))).toEqual([
-      path.join("workspace", "agency"),
-    ]);
-  });
-
-  it("empty when workspace/agency is absent (fail-soft)", () => {
-    fs.mkdirSync(path.join(hqRoot, "workspace"), { recursive: true });
-    expect(computeAgencySyncPaths(hqRoot)).toEqual([]);
-  });
-
-  it("composes into computePersonalVaultPaths without broadening workspace/", () => {
-    fs.mkdirSync(path.join(hqRoot, "workspace", "agency", "acme", "growth"), {
-      recursive: true,
-    });
-    fs.mkdirSync(path.join(hqRoot, "workspace", "locks"), { recursive: true });
-    fs.writeFileSync(path.join(hqRoot, "workspace", "locks", "x.lock"), "1");
-    fs.mkdirSync(path.join(hqRoot, ".claude"), { recursive: true });
-
-    const out = relAll(computePersonalVaultPaths(hqRoot));
-    expect(out).toContain(path.join("workspace", "agency"));
-    expect(out).toContain(".claude");
-    expect(out.some((p) => p.startsWith(path.join("workspace", "locks")))).toBe(
-      false,
-    );
-  });
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// Session-logs carve-out (workspace/.session-logs) — reindex-captured Claude
-// Code transcripts pierce the workspace/ exclusion and round-trip to the vault.
-// ─────────────────────────────────────────────────────────────────────────
-describe("personal-vault: session-logs carve-out", () => {
-  let hqRoot: string;
-  beforeEach(() => {
-    hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-sesslog-test-"));
-  });
-  afterEach(() => {
-    fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-  const relAll = (abs: string[]): string[] =>
-    abs.map((p) => path.relative(hqRoot, p)).sort();
-
-  it("constant: SESSION_LOGS_SYNC_REL is workspace/.session-logs", () => {
-    expect(SESSION_LOGS_SYNC_REL).toBe("workspace/.session-logs");
-  });
-
-  it("includes workspace/.session-logs when it exists", () => {
-    fs.mkdirSync(path.join(hqRoot, "workspace", ".session-logs", "tool-results"), {
-      recursive: true,
-    });
-    expect(relAll(computeSessionLogsSyncPaths(hqRoot))).toEqual([
-      path.join("workspace", ".session-logs"),
-    ]);
-  });
-
-  it("empty when workspace/.session-logs is absent (fail-soft)", () => {
-    fs.mkdirSync(path.join(hqRoot, "workspace"), { recursive: true });
-    expect(computeSessionLogsSyncPaths(hqRoot)).toEqual([]);
-  });
-
-  it("composes into computePersonalVaultPaths without broadening workspace/", () => {
-    fs.mkdirSync(path.join(hqRoot, "workspace", ".session-logs"), { recursive: true });
-    fs.writeFileSync(
-      path.join(hqRoot, "workspace", ".session-logs", "session.jsonl"),
-      "l\n",
-    );
-    // A sibling under workspace/ that must STAY local.
-    fs.mkdirSync(path.join(hqRoot, "workspace", "locks"), { recursive: true });
-    fs.writeFileSync(path.join(hqRoot, "workspace", "locks", "x.lock"), "1");
-    fs.mkdirSync(path.join(hqRoot, ".claude"), { recursive: true });
-
-    const out = relAll(computePersonalVaultPaths(hqRoot));
-    expect(out).toContain(path.join("workspace", ".session-logs"));
-    expect(out).toContain(".claude");
-    // The carve-out is exactly the .session-logs subtree — no other workspace/
-    // sibling is pulled in.
-    expect(out.some((p) => p.startsWith(path.join("workspace", "locks")))).toBe(
-      false,
-    );
-  });
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-describe("personal-vault: isPersonalVaultDeletionExcluded", () => {
-  it("protects release scaffold + reindex-generated skill wrappers", () => {
-    expect(isPersonalVaultDeletionExcluded("core")).toBe(true);
-    expect(isPersonalVaultDeletionExcluded("core/policies/x.md")).toBe(true);
-    expect(isPersonalVaultDeletionExcluded(".claude/skills")).toBe(true);
-    expect(isPersonalVaultDeletionExcluded(".claude/skills/core:demo/SKILL.md")).toBe(true);
-  });
-
-  it("protects reindex-generated command links from delete-propagation", () => {
-    // The generated <ns>:<cmd>.md links reindex surfaces — recreated locally by
-    // `hq reindex`, so a local absence is not user intent.
-    expect(isPersonalVaultDeletionExcluded(".claude/commands/core:demo.md")).toBe(true);
-    expect(isPersonalVaultDeletionExcluded(".claude/commands/indigo:signals.md")).toBe(true);
-    expect(isPersonalVaultDeletionExcluded(".claude/commands/hq-pack-demo:hello.md")).toBe(true);
-    // Win32-encoded colon form is protected too.
-    expect(isPersonalVaultDeletionExcluded(".claude/commands/indigo%3Asignals.md")).toBe(true);
-  });
-
-  it("does NOT protect hand-authored native commands (deletion IS user intent)", () => {
-    // A non-namespaced native slash command the user authored directly under
-    // .claude/commands/ must still delete-propagate, unlike the skill farm.
-    expect(isPersonalVaultDeletionExcluded(".claude/commands/deploy.md")).toBe(false);
-    expect(isPersonalVaultDeletionExcluded(".claude/commands")).toBe(false);
-    // And an ordinary user file is never protected.
-    expect(isPersonalVaultDeletionExcluded("knowledge/notes.md")).toBe(false);
-  });
-});