@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/cli/rescue-classify-ordering.test.ts

@@ -1,548 +0,0 @@
-/**
- * Integration tests for the rescue classifier's fail-safe ordering and its
- * handling of nested directory symlinks (src/cli/rescue-core.ts).
- *
- * Regression for DEV-1767 (feedback_aa768683): `hq rescue` choked on a
- * symlinked DIRECTORY under core/ — a reindex artifact such as
- * `core/knowledge/ad-creative-engine -> ../../personal/knowledge/...` — throwing
- * `Error: Path is a directory` mid-pass *after* it had already deleted ~10 core
- * scaffold files, leaving HQ half-applied. `--check` classified the same tree
- * cleanly, so the dry-run gave false confidence.
- *
- * Two invariants are locked here:
- *   1. A directory symlink under core/ is classified as a droppable reindex
- *      symlink (never followed, never file-read, never a crash) — exactly like
- *      a file symlink. The personal/ target it points at is left untouched.
- *   2. Classification is read-only and runs to completion BEFORE any destructive
- *      apply. A classifier exception therefore deletes NOTHING (no half-applied
- *      wipe), and the same classify code path backs both the live run and the
- *      `--dry-run` plan (parity).
- *
- * Like the sibling rescue tests, the source clone is shimmed to a local fixture
- * repo and the rescue runs in-process so we can assert its on-disk effects.
- */
-import { describe, it, expect, beforeAll, afterAll } from "vitest";
-import { execFileSync } from "child_process";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { runRescue } from "./rescue-core.js";
-
-function hasGit(): boolean {
-  try {
-    execFileSync("git", ["--version"], { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-const gitAvailable = hasGit();
-
-function runRescueCapture(argv: string[], env: NodeJS.ProcessEnv) {
-  let stdout = "";
-  let stderr = "";
-  const origOut = process.stdout.write.bind(process.stdout);
-  const origErr = process.stderr.write.bind(process.stderr);
-  process.stdout.write = ((chunk: unknown) => {
-    stdout += String(chunk);
-    return true;
-  }) as typeof process.stdout.write;
-  process.stderr.write = ((chunk: unknown) => {
-    stderr += String(chunk);
-    return true;
-  }) as typeof process.stderr.write;
-  let status: number | undefined;
-  let threw: unknown;
-  try {
-    status = runRescue(argv, { env }).status;
-  } catch (e) {
-    threw = e;
-  } finally {
-    process.stdout.write = origOut;
-    process.stderr.write = origErr;
-  }
-  return { status, stdout, stderr, threw };
-}
-
-const lexists = (p: string) => {
-  try {
-    fs.lstatSync(p);
-    return true;
-  } catch {
-    return false;
-  }
-};
-
-function hasRecoveryManifestFor(root: string, rel: string): boolean {
-  let found = false;
-  const interesting = /(recover|recovery|rollback|transaction|manifest|resume|rescue)/i;
-  const walk = (dir: string) => {
-    if (found) return;
-    let entries: fs.Dirent[];
-    try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-    for (const ent of entries) {
-      if (found) return;
-      const abs = path.join(dir, ent.name);
-      if (ent.isDirectory()) {
-        walk(abs);
-        continue;
-      }
-      if (!ent.isFile()) continue;
-      const relPath = abs.slice(root.length + 1);
-      if (!interesting.test(relPath)) continue;
-      let body = "";
-      try {
-        body = fs.readFileSync(abs, "utf-8");
-      } catch {
-        body = "";
-      }
-      found = body.includes(rel) && interesting.test(`${relPath}\n${body}`);
-    }
-  };
-  walk(root);
-  return found;
-}
-
-describe.skipIf(!gitAvailable)("rescue classify-before-delete + dir-symlink handling", () => {
-  let workDir: string;
-  let upstream: string;
-  let shimDir: string;
-  let floorSha: string;
-  let baseEnv: NodeJS.ProcessEnv;
-  let caseSeq = 0;
-
-  const git = (cwd: string, ...args: string[]) =>
-    execFileSync("git", args, {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: {
-        ...process.env,
-        GIT_AUTHOR_NAME: "t",
-        GIT_AUTHOR_EMAIL: "t@t",
-        GIT_COMMITTER_NAME: "t",
-        GIT_COMMITTER_EMAIL: "t@t",
-      },
-    })
-      .toString()
-      .trim();
-
-  beforeAll(() => {
-    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-ordering-"));
-
-    // Upstream: floor has core/a.md="v1"; HEAD advances it to "v2". core/b.md is
-    // stable across both. The symlink fixtures never appear upstream — they only
-    // exist in the local HQ root as reindex artifacts.
-    upstream = path.join(workDir, "upstream");
-    fs.mkdirSync(path.join(upstream, "core"), { recursive: true });
-    git(workDir, "init", "-b", "main", "upstream");
-    fs.writeFileSync(path.join(upstream, "core/a.md"), "v1\n");
-    fs.writeFileSync(path.join(upstream, "core/b.md"), "beta\n");
-    // `.claude/settings.json` is intentionally not supplied by a personal
-    // vault pull. Rescue must lay it down from the release scaffold instead.
-    fs.mkdirSync(path.join(upstream, ".claude"), { recursive: true });
-    fs.writeFileSync(path.join(upstream, ".claude/settings.json"), '{"release":true}\n');
-    fs.mkdirSync(path.join(upstream, "core/blocker"), { recursive: true });
-    fs.writeFileSync(path.join(upstream, "core/blocker/second.md"), "upstream\n");
-    git(upstream, "add", "-A");
-    git(upstream, "commit", "-m", "floor");
-    floorSha = git(upstream, "rev-parse", "HEAD");
-    fs.writeFileSync(path.join(upstream, "core/a.md"), "v2\n");
-    git(upstream, "add", "-A");
-    git(upstream, "commit", "-m", "head");
-
-    const realGit =
-      execFileSync("bash", ["-lc", "command -v git"]).toString().trim() || "/usr/bin/git";
-    shimDir = path.join(workDir, "shim");
-    fs.mkdirSync(shimDir, { recursive: true });
-    const shim = `#!/usr/bin/env bash
-if [ "$1" = "clone" ]; then
-  args=()
-  for a in "$@"; do
-    case "$a" in
-      https://github.com/*) a=${JSON.stringify(upstream)} ;;
-    esac
-    args+=("$a")
-  done
-  exec ${JSON.stringify(realGit)} "\${args[@]}"
-fi
-exec ${JSON.stringify(realGit)} "$@"
-`;
-    fs.writeFileSync(path.join(shimDir, "git"), shim, { mode: 0o755 });
-    baseEnv = { ...process.env, PATH: `${shimDir}:${process.env.PATH ?? ""}` };
-  });
-
-  afterAll(() => {
-    if (workDir) fs.rmSync(workDir, { recursive: true, force: true });
-  });
-
-  /**
-   * Fresh HQ root per case (live runs mutate). core/a.md matches the floor
-   * (unchanged vs baseline, differs from HEAD -> "delete + replace"); core/b.md
-   * is byte-identical to upstream ("unchanged, preserved in place"). The caller
-   * adds whatever symlink/extra files the case needs.
-   */
-  function makeHqRoot(): string {
-    caseSeq += 1;
-    const hqRoot = path.join(workDir, `hq-${caseSeq}`);
-    fs.mkdirSync(path.join(hqRoot, "core"), { recursive: true });
-    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
-    fs.mkdirSync(path.join(hqRoot, "personal/knowledge"), { recursive: true });
-    fs.writeFileSync(path.join(hqRoot, "core/a.md"), "v1\n");
-    fs.writeFileSync(path.join(hqRoot, "core/b.md"), "beta\n");
-    return hqRoot;
-  }
-
-  const liveArgs = (hqRoot: string, extra: string[] = []) => [
-    "--hq-root", hqRoot,
-    "--source", "test/repo",
-    "--ref", "main",
-    "--floor-sha", floorSha,
-    "--paths", "core",
-    "--yes",
-    "--no-backup",
-    ...extra,
-  ];
-
-  it("drops a DIRECTORY symlink under core/ as a reindex artifact (no crash, no half-apply)", () => {
-    const hqRoot = makeHqRoot();
-    // The exact DEV-1767 shape: a directory symlink nested under core/ pointing
-    // into personal/. Its target exists and must survive untouched.
-    const target = path.join(hqRoot, "personal/knowledge/ad-creative-engine");
-    fs.mkdirSync(target, { recursive: true });
-    fs.writeFileSync(path.join(target, "keep.md"), "owned by personal\n");
-    fs.mkdirSync(path.join(hqRoot, "core/knowledge"), { recursive: true });
-    const link = path.join(hqRoot, "core/knowledge/ad-creative-engine");
-    fs.symlinkSync("../../personal/knowledge/ad-creative-engine", link);
-
-    const r = runRescueCapture(liveArgs(hqRoot), baseEnv);
-    const out = `${r.stdout}\n${r.stderr}`;
-
-    expect(r.threw, out).toBeUndefined();
-    expect(r.status, out).toBe(0);
-    // The bash-era failure signature must never appear.
-    expect(out).not.toMatch(/Path is a directory/);
-    expect(out).not.toMatch(/EISDIR/);
-    // Classified + dropped as exactly one reindex symlink.
-    expect(out).toMatch(/reindex symlinks dropped:\s+1 entries/);
-    // Symlink itself is gone; its personal/ target is untouched.
-    expect(lexists(link)).toBe(false);
-    expect(fs.readFileSync(path.join(target, "keep.md"), "utf-8")).toBe("owned by personal\n");
-    // Real core files still classified correctly around it.
-    expect(fs.existsSync(path.join(hqRoot, "core/a.md"))).toBe(true);
-    expect(fs.existsSync(path.join(hqRoot, "core/b.md"))).toBe(true);
-  });
-
-  it("classifies a NON-personal DIRECTORY symlink under core/ without following it (no crash, left in place)", () => {
-    // A directory symlink whose target is NOT a reindex/personal artifact —
-    // e.g. a user-made alias `core/aliasdir -> realdir`. It is not a
-    // master-sync symlink, so rescue must NOT drop it, but it also must never
-    // be followed/read (the EISDIR / "Path is a directory" trap from DEV-1767
-    // applies to ANY directory symlink the walk meets, not just personal ones).
-    const hqRoot = makeHqRoot();
-    fs.mkdirSync(path.join(hqRoot, "core/realdir"), { recursive: true });
-    fs.writeFileSync(path.join(hqRoot, "core/realdir/x.md"), "real\n");
-    const link = path.join(hqRoot, "core/aliasdir");
-    fs.symlinkSync("realdir", link); // points at a sibling DIRECTORY
-
-    const r = runRescueCapture(liveArgs(hqRoot), baseEnv);
-    const out = `${r.stdout}\n${r.stderr}`;
-
-    expect(r.threw, out).toBeUndefined();
-    expect(r.status, out).toBe(0);
-    // The crash signatures must never appear for a dir-symlink of any flavour.
-    expect(out).not.toMatch(/Path is a directory/);
-    expect(out).not.toMatch(/EISDIR/);
-    // Not a reindex artifact → not counted as a dropped symlink, left on disk,
-    // and its directory target is untouched.
-    expect(out).toMatch(/reindex symlinks dropped:\s+0 entries/);
-    expect(lexists(link)).toBe(true);
-    expect(fs.lstatSync(link).isSymbolicLink()).toBe(true);
-    expect(fs.readFileSync(path.join(hqRoot, "core/realdir/x.md"), "utf-8")).toBe("real\n");
-  });
-
-  it("drops a FILE symlink under core/ the same way (file-symlink behavior unchanged)", () => {
-    const hqRoot = makeHqRoot();
-    fs.writeFileSync(path.join(hqRoot, "personal/knowledge/note.md"), "personal note\n");
-    const link = path.join(hqRoot, "core/note.md");
-    fs.symlinkSync("../personal/knowledge/note.md", link);
-
-    const r = runRescueCapture(liveArgs(hqRoot), baseEnv);
-    const out = `${r.stdout}\n${r.stderr}`;
-
-    expect(r.threw, out).toBeUndefined();
-    expect(r.status, out).toBe(0);
-    expect(out).toMatch(/reindex symlinks dropped:\s+1 entries/);
-    expect(lexists(link)).toBe(false);
-    expect(fs.readFileSync(path.join(hqRoot, "personal/knowledge/note.md"), "utf-8")).toBe(
-      "personal note\n",
-    );
-  });
-
-  it("a classifier exception deletes NOTHING (classify fully before any destructive apply)", () => {
-    const hqRoot = makeHqRoot();
-    // core/a.md is classified BEFORE core/zzz.md (sorted walk) as a
-    // "delete + replace". core/zzz.md then throws during classification. If the
-    // wipe were interleaved (old behavior), a.md would already be gone.
-    fs.writeFileSync(path.join(hqRoot, "core/zzz.md"), "trigger\n");
-
-    const r = runRescueCapture(liveArgs(hqRoot), {
-      ...baseEnv,
-      HQ_RESCUE_FAULT_AT_REL: "core/zzz.md",
-    });
-    const out = `${r.stdout}\n${r.stderr}`;
-
-    // The injected classifier fault aborts the run.
-    expect(r.threw, out).toBeDefined();
-    expect(String(r.threw)).toMatch(/fault injected at core\/zzz\.md/);
-    // Crucially: the file that was already classified for deletion still exists,
-    // untouched — no half-applied wipe.
-    expect(fs.existsSync(path.join(hqRoot, "core/a.md"))).toBe(true);
-    expect(fs.readFileSync(path.join(hqRoot, "core/a.md"), "utf-8")).toBe("v1\n");
-    expect(fs.existsSync(path.join(hqRoot, "core/b.md"))).toBe(true);
-    expect(fs.existsSync(path.join(hqRoot, "core/zzz.md"))).toBe(true);
-  });
-
-  it("dry-run emits prior plan lines before a classifier fault aborts the walk", () => {
-    const hqRoot = makeHqRoot();
-    fs.writeFileSync(path.join(hqRoot, "core/zzz.md"), "trigger\n");
-
-    const r = runRescueCapture(liveArgs(hqRoot, ["--dry-run"]), {
-      ...baseEnv,
-      HQ_RESCUE_FAULT_AT_REL: "core/zzz.md",
-    });
-    const out = `${r.stdout}\n${r.stderr}`;
-
-    expect(r.threw, out).toBeDefined();
-    expect(String(r.threw)).toMatch(/fault injected at core\/zzz\.md/);
-    expect(out).toContain("unchanged (delete + replace): core/a.md");
-    expect(out).toContain("unchanged (preserved in place): core/b.md");
-    expect(out).not.toMatch(/DRY RUN classification summary/);
-    expect(fs.existsSync(path.join(hqRoot, "core/a.md"))).toBe(true);
-    expect(fs.readFileSync(path.join(hqRoot, "core/a.md"), "utf-8")).toBe("v1\n");
-    expect(fs.existsSync(path.join(hqRoot, "core/zzz.md"))).toBe(true);
-  });
-
-  it("F12: rolls back or records recovery when an apply action fails after earlier destructive actions", () => {
-    const hqRoot = makeHqRoot();
-    fs.mkdirSync(path.join(hqRoot, "core/blocker"), { recursive: true });
-    fs.writeFileSync(path.join(hqRoot, "core/blocker/second.md"), "local edit\n");
-    fs.writeFileSync(path.join(hqRoot, "personal/blocker"), "not a directory\n");
-
-    const firstDeletedByApply = path.join(hqRoot, "core/a.md");
-    const firstOriginal = fs.readFileSync(firstDeletedByApply, "utf-8");
-    const r = runRescueCapture(liveArgs(hqRoot), baseEnv);
-    const out = `${r.stdout}\n${r.stderr}\n${String(r.threw ?? "")}`;
-
-    const applyFailed = r.threw !== undefined || (r.status !== undefined && r.status !== 0);
-    expect(applyFailed, out).toBe(true);
-    expect(fs.existsSync(path.join(hqRoot, "core/blocker/second.md")), out).toBe(true);
-
-    const firstActionRolledBack =
-      fs.existsSync(firstDeletedByApply) &&
-      fs.readFileSync(firstDeletedByApply, "utf-8") === firstOriginal;
-    expect(
-      firstActionRolledBack || hasRecoveryManifestFor(hqRoot, "core/a.md"),
-      `${out}\ncore/a.md was deleted without rollback or a recovery/transaction manifest`,
-    ).toBe(true);
-  });
-
-  it("dry-run classifies the dir-symlink identically to the live run and changes nothing", () => {
-    const hqRoot = makeHqRoot();
-    const target = path.join(hqRoot, "personal/knowledge/ad-creative-engine");
-    fs.mkdirSync(target, { recursive: true });
-    fs.mkdirSync(path.join(hqRoot, "core/knowledge"), { recursive: true });
-    const link = path.join(hqRoot, "core/knowledge/ad-creative-engine");
-    fs.symlinkSync("../../personal/knowledge/ad-creative-engine", link);
-
-    const r = runRescueCapture(liveArgs(hqRoot, ["--dry-run"]), baseEnv);
-    const out = `${r.stdout}\n${r.stderr}`;
-
-    expect(r.threw, out).toBeUndefined();
-    expect(r.status, out).toBe(0);
-    // Dry-run surfaces the SAME classification the live pass acts on.
-    expect(out).toContain("drop reindex symlink: core/knowledge/ad-creative-engine");
-    expect(out).toMatch(/reindex symlinks dropped:\s+1 entries/);
-    expect(out).toMatch(/DRY RUN complete\. No filesystem changes made\./);
-    // ...but touches nothing: the symlink (and everything else) is still on disk.
-    expect(lexists(link)).toBe(true);
-    expect(fs.existsSync(path.join(hqRoot, "core/a.md"))).toBe(true);
-  });
-
-  it("fails with a typed state-change error when reindex replaces a classified symlink before apply", () => {
-    const hqRoot = makeHqRoot();
-    const target = path.join(hqRoot, "personal/skills/foreman/tests");
-    fs.mkdirSync(target, { recursive: true });
-    const link = path.join(hqRoot, ".claude/skills/personal:foreman/tests");
-    fs.mkdirSync(path.dirname(link), { recursive: true });
-    fs.symlinkSync("../../../personal/skills/foreman/tests", link);
-
-    const args = [
-      "--hq-root", hqRoot,
-      "--source", "test/repo",
-      "--ref", "main",
-      "--floor-sha", floorSha,
-      "--yes",
-      "--no-backup",
-    ];
-    const r = runRescueCapture(args, {
-      ...baseEnv,
-      HQ_RESCUE_FAULT_BEFORE_APPLY_REL: ".claude/skills/personal:foreman/tests",
-      HQ_RESCUE_FAULT_BEFORE_APPLY_KIND: "directory",
-    });
-    const out = `${r.stdout}\n${r.stderr}\n${String(r.threw ?? "")}`;
-
-    expect(r.threw, out).toBeInstanceOf(Error);
-    expect(out).toContain("changed after classification");
-    expect(out).toContain("expected symlink, found directory");
-    expect(out).not.toContain("EISDIR");
-    expect(fs.readFileSync(path.join(hqRoot, "core/a.md"), "utf-8")).toBe("v1\n");
-  });
-
-  it("keeps the full default wipe set out of worktrees and omits transient build state from the snapshot", () => {
-    const hqRoot = makeHqRoot();
-    const backupRoot = path.join(workDir, `backups-${caseSeq}`);
-    const writeTransient = (rel: string) => {
-      const dest = path.join(hqRoot, rel, "large.bin");
-      fs.mkdirSync(path.dirname(dest), { recursive: true });
-      fs.writeFileSync(dest, "reproducible\n");
-    };
-    for (const rel of [
-      "worktrees/repo",
-      ".worktrees/repo",
-      ".sst-sandbox-home/runtime",
-      ".tmp-codex-asar/cache",
-      ".claude/worktrees/agent/repo",
-      ".claude/skills/demo/node_modules/pkg",
-      ".claude/skills/demo/.pnpm-store/v3",
-      ".claude/skills/demo/.sst/build",
-      ".claude/skills/demo/.next/cache",
-      ".claude/skills/demo/target/debug",
-    ]) {
-      writeTransient(rel);
-    }
-
-    const r = runRescueCapture(
-      [
-        "--hq-root", hqRoot,
-        "--source", "test/repo",
-        "--ref", "main",
-        "--floor-sha", floorSha,
-        "--backup-dir", backupRoot,
-        "--yes",
-      ],
-      baseEnv,
-    );
-    const out = `${r.stdout}\n${r.stderr}\n${String(r.threw ?? "")}`;
-
-    expect(r.threw, out).toBeUndefined();
-    expect(r.status, out).toBe(0);
-    for (const rel of ["worktrees", ".worktrees", ".sst-sandbox-home", ".tmp-codex-asar"]) {
-      expect(fs.existsSync(path.join(hqRoot, rel, "repo", "large.bin")) ||
-        fs.existsSync(path.join(hqRoot, rel, "runtime", "large.bin")) ||
-        fs.existsSync(path.join(hqRoot, rel, "cache", "large.bin")), rel).toBe(true);
-    }
-
-    const snapshots = fs.readdirSync(backupRoot).filter((name) => name.startsWith("pre-update-"));
-    expect(snapshots).toHaveLength(1);
-    const snapshot = path.join(backupRoot, snapshots[0]);
-    expect(fs.existsSync(path.join(snapshot, "core/a.md"))).toBe(true);
-    expect(fs.existsSync(path.join(snapshot, "RECOVERY.md"))).toBe(true);
-    for (const rel of [
-      "worktrees",
-      ".worktrees",
-      ".sst-sandbox-home",
-      ".tmp-codex-asar",
-      ".claude/worktrees",
-      ".claude/skills/demo/node_modules",
-      ".claude/skills/demo/.pnpm-store",
-      ".claude/skills/demo/.sst",
-      ".claude/skills/demo/.next",
-      ".claude/skills/demo/target",
-    ]) {
-      expect(lexists(path.join(snapshot, rel)), `snapshot unexpectedly contains ${rel}`).toBe(false);
-    }
-  });
-
-  it("preserves unreadable machine-local state while overlaying release-owned .claude files", () => {
-    const hqRoot = makeHqRoot();
-    const backupRoot = path.join(workDir, `local-state-backups-${caseSeq}`);
-    const deviceId = path.join(hqRoot, ".local/state/gh/device-id");
-    fs.mkdirSync(path.dirname(deviceId), { recursive: true });
-    fs.writeFileSync(deviceId, "machine-specific\n");
-    // SSM previously ran as root with an empty HOME, so gh could leave this
-    // exact path root-owned and unreadable to the outpost user. A mode-000
-    // fixture exercises the same copy failure without requiring root in CI.
-    fs.chmodSync(deviceId, 0o000);
-
-    try {
-      const r = runRescueCapture(
-        [
-          "--hq-root", hqRoot,
-          "--source", "test/repo",
-          "--ref", "main",
-          "--floor-sha", floorSha,
-          "--backup-dir", backupRoot,
-          "--yes",
-        ],
-        baseEnv,
-      );
-      const out = `${r.stdout}\n${r.stderr}\n${String(r.threw ?? "")}`;
-
-      expect(r.threw, out).toBeUndefined();
-      expect(r.status, out).toBe(0);
-      // The core fixture proves a real rescue apply occurred, while this
-      // release-owned setting proves `.claude` reached the outpost. The
-      // post-overlay settings reconcile keeps the release baseline (`release:
-      // true`) and additionally composes the machine env.PATH onto it (see
-      // reconcileClaudeSettings), so the file is the release marker plus a
-      // machine-specific env.PATH rather than the verbatim template.
-      expect(fs.readFileSync(path.join(hqRoot, "core/a.md"), "utf-8")).toBe("v2\n");
-      const laidSettings = JSON.parse(
-        fs.readFileSync(path.join(hqRoot, ".claude/settings.json"), "utf-8"),
-      );
-      expect(laidSettings.release).toBe(true);
-      expect(typeof laidSettings.env?.PATH).toBe("string");
-      // `.local` survives untouched and is not copied into the safety snapshot.
-      expect(fs.statSync(deviceId).mode & 0o777).toBe(0o000);
-      const snapshots = fs.readdirSync(backupRoot).filter((name) => name.startsWith("pre-update-"));
-      expect(snapshots).toHaveLength(1);
-      expect(lexists(path.join(backupRoot, snapshots[0], ".local"))).toBe(false);
-    } finally {
-      // The fixture is owned by the test process, so restore readability before
-      // the enclosing temp-tree cleanup even when an assertion fails.
-      fs.chmodSync(deviceId, 0o600);
-    }
-  });
-
-  it("dry-run never allocates or prunes snapshots", () => {
-    const hqRoot = makeHqRoot();
-    const backupRoot = path.join(workDir, `dry-backups-${caseSeq}`);
-    const existing = path.join(backupRoot, "pre-update-existing");
-    fs.mkdirSync(existing, { recursive: true });
-    fs.writeFileSync(path.join(existing, "keep.txt"), "do not prune\n");
-
-    const r = runRescueCapture(
-      [
-        "--hq-root", hqRoot,
-        "--source", "test/repo",
-        "--ref", "main",
-        "--floor-sha", floorSha,
-        "--backup-dir", backupRoot,
-        "--dry-run",
-      ],
-      baseEnv,
-    );
-    const out = `${r.stdout}\n${r.stderr}\n${String(r.threw ?? "")}`;
-
-    expect(r.threw, out).toBeUndefined();
-    expect(r.status, out).toBe(0);
-    expect(fs.readdirSync(backupRoot)).toEqual(["pre-update-existing"]);
-    expect(fs.readFileSync(path.join(existing, "keep.txt"), "utf-8")).toBe("do not prune\n");
-  });
-});

package/src/cli/rescue-clone-diagnostics.test.ts

@@ -1,120 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { runRescue } from "./rescue-core.js";
-
-function runRescueCapture(argv: string[], env: NodeJS.ProcessEnv) {
-  let stdout = "";
-  let stderr = "";
-  const origOut = process.stdout.write.bind(process.stdout);
-  const origErr = process.stderr.write.bind(process.stderr);
-  process.stdout.write = ((chunk: unknown) => {
-    stdout += String(chunk);
-    return true;
-  }) as typeof process.stdout.write;
-  process.stderr.write = ((chunk: unknown) => {
-    stderr += String(chunk);
-    return true;
-  }) as typeof process.stderr.write;
-  let status: number;
-  try {
-    status = runRescue(argv, { env }).status;
-  } finally {
-    process.stdout.write = origOut;
-    process.stderr.write = origErr;
-  }
-  return { status, stdout, stderr };
-}
-
-describe("rescue clone diagnostics", () => {
-  let workDir: string;
-  let hqRoot: string;
-
-  beforeAll(() => {
-    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-clone-diagnostics-"));
-    hqRoot = path.join(workDir, "hq");
-    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
-    fs.mkdirSync(path.join(hqRoot, "core"), { recursive: true });
-  });
-
-  afterAll(() => {
-    if (workDir) fs.rmSync(workDir, { recursive: true, force: true });
-  });
-
-  function envWithGit(name: string, script: string): NodeJS.ProcessEnv {
-    const shimDir = path.join(workDir, name);
-    fs.mkdirSync(shimDir, { recursive: true });
-    fs.writeFileSync(path.join(shimDir, "git"), script, { mode: 0o755 });
-    return {
-      ...process.env,
-      GH_TOKEN: "ghp_clone_secret_123",
-      PATH: `${shimDir}:${process.env.PATH ?? ""}`,
-    };
-  }
-
-  function rescueArgs(extra: string[] = []): string[] {
-    return [
-      "--hq-root", hqRoot,
-      "--source", "test/repo",
-      "--ref", "main",
-      "--dry-run",
-      "--yes",
-      "--no-backup",
-      ...extra,
-    ];
-  }
-
-  it("surfaces redacted stderr when the full-history clone fails", () => {
-    const env = envWithGit(
-      "full-history",
-      `#!/usr/bin/env bash
-printf 'fatal: clone args: %s\n' "$*" >&2
-printf 'mirror: https://user:url-secret@example.com/repo.git\n' >&2
-printf 'Authorization: Bearer header-secret\n' >&2
-exit 42
-`,
-    );
-
-    const r = runRescueCapture(rescueArgs(), env);
-
-    expect(r.status).toBe(5);
-    expect(r.stderr).toContain("fatal: clone args:");
-    expect(r.stderr).toContain("https://***@github.com/test/repo.git");
-    expect(r.stderr).toContain("mirror: https://***@example.com/repo.git");
-    expect(r.stderr).toContain("Authorization: ***");
-    expect(r.stderr).toContain("error: clone failed");
-    expect(r.stderr.indexOf("fatal: clone args:")).toBeLessThan(
-      r.stderr.indexOf("error: clone failed"),
-    );
-    expect(r.stderr).not.toContain("ghp_clone_secret_123");
-    expect(r.stderr).not.toContain("url-secret");
-    expect(r.stderr).not.toContain("header-secret");
-  });
-
-  it("surfaces stderr from the shallow attempt and stdout from the failed fallback", () => {
-    const env = envWithGit(
-      "shallow-fallback",
-      `#!/usr/bin/env bash
-if [ "$2" = "--depth" ]; then
-  printf 'fatal: shallow clone diagnostic\n' >&2
-  exit 41
-fi
-printf 'fatal: fallback clone diagnostic for %s\n' "$*"
-exit 42
-`,
-    );
-
-    const r = runRescueCapture(rescueArgs(["--no-history-check"]), env);
-
-    expect(r.status).toBe(5);
-    expect(r.stderr).toContain("fatal: shallow clone diagnostic");
-    expect(r.stderr).toContain("fatal: fallback clone diagnostic");
-    expect(r.stderr).toContain("https://***@github.com/test/repo.git");
-    expect(r.stderr).toContain("error: clone failed");
-    expect(r.stderr.indexOf("fatal: fallback clone diagnostic")).toBeLessThan(
-      r.stderr.indexOf("error: clone failed"),
-    );
-    expect(r.stderr).not.toContain("ghp_clone_secret_123");
-  });
-});