@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/company-resolver.test.ts

@@ -1,618 +0,0 @@
-/**
- * Tests for the cwd → owning-company resolver (surface-hq-console-telemetry
- * US-002). Covers manifest parsing, cmp_* extraction, longest-prefix matching,
- * the trailing-slash sibling boundary, and the unattributed (no-match) path.
- */
-
-import { describe, it, expect, afterEach } from "vitest";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import {
-  buildRepoCompanyMap,
-  resolveCompanyForCwd,
-  resolveCompanyForSkill,
-} from "./company-resolver.js";
-
-const INDIGO = "cmp_01INDIGO";
-const HPO = "cmp_01HPO";
-
-const MANIFEST = `companies:
-  personal:
-    name: Personal
-    repos: []
-  indigo:
-    name: Indigo
-    repos:
-      - repos/private/hq-cloud
-      - repos/public/hq-core
-    cloud_uid: ${INDIGO}
-  hpo:
-    name: HPO
-    repos:
-      - repos/private/hpo-jobs
-    cloud_uid: ${HPO}
-  liverecover:
-    name: LiveRecover
-    repos:
-      - repos/private/liverecover-site
-`;
-
-function setupHqRoot(manifest: string = MANIFEST): string {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-resolver-test-"));
-  fs.mkdirSync(path.join(root, "companies"), { recursive: true });
-  fs.writeFileSync(path.join(root, "companies", "manifest.yaml"), manifest);
-  return root;
-}
-
-describe("buildRepoCompanyMap + resolveCompanyForCwd", () => {
-  let hqRoot: string;
-  afterEach(() => {
-    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  it("resolves a cwd inside a company repo to that company's cmp_ uid", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    const cwd = path.join(hqRoot, "repos/private/hq-cloud/src");
-    expect(resolveCompanyForCwd(cwd, map)).toBe(INDIGO);
-  });
-
-  it("resolves the repo root itself (exact match, no trailing slash)", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    const cwd = path.join(hqRoot, "repos/public/hq-core");
-    expect(resolveCompanyForCwd(cwd, map)).toBe(INDIGO);
-  });
-
-  it("maps each repo to its own company", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForCwd(path.join(hqRoot, "repos/private/hpo-jobs/x"), map)).toBe(HPO);
-  });
-
-  it("returns undefined for a cwd outside any company repo (unattributed)", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForCwd("/Users/x/random-repo", map)).toBeUndefined();
-    // The HQ root itself is company-agnostic — it belongs to no single tenant.
-    expect(resolveCompanyForCwd(hqRoot, map)).toBeUndefined();
-  });
-
-  /**
-   * Behaviour change (was: `companies/<slug>` resolved to undefined).
-   *
-   * A company's own HQ directory holds its skills, knowledge, and project
-   * files, so work done there is unambiguously that company's work. The prior
-   * repos-only scope dropped it, and in production a large share of sessions
-   * run from inside the HQ root rather than a repo checkout — leaving that work
-   * unattributed and the owner's Projects view empty. Attribution is scoped to
-   * the single tenant that owns the directory, so this widens coverage without
-   * crossing a tenant boundary.
-   */
-  it("attributes a cwd inside the company's own HQ directory", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForCwd(path.join(hqRoot, "companies/indigo"), map)).toBe(INDIGO);
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "companies/hpo/knowledge"), map),
-    ).toBe(HPO);
-  });
-
-  it("does NOT attribute a company that lacks a cloud_uid (not cloud-backed)", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    // liverecover-site has no cloud_uid → unattributed.
-    expect(resolveCompanyForCwd(path.join(hqRoot, "repos/private/liverecover-site"), map)).toBeUndefined();
-  });
-
-  it("does not match a sibling that merely shares a path prefix", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    // `<repo>-other` shares the string prefix but must NOT match (slash boundary).
-    expect(resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud-other"), map)).toBeUndefined();
-  });
-
-  it("handles a trailing slash on the cwd", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud") + "/", map)).toBe(INDIGO);
-  });
-
-  it("returns undefined for an undefined/empty cwd", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForCwd(undefined, map)).toBeUndefined();
-    expect(resolveCompanyForCwd("", map)).toBeUndefined();
-  });
-
-  it("never returns the reserved 'unattributed' sentinel", async () => {
-    hqRoot = setupHqRoot(`companies:
-  bad:
-    repos:
-      - repos/x
-    cloud_uid: unattributed
-`);
-    const map = await buildRepoCompanyMap(hqRoot);
-    // `unattributed` is not a cmp_* uid → not added to the map → no match.
-    expect(map.entries).toHaveLength(0);
-    expect(resolveCompanyForCwd(path.join(hqRoot, "repos/x"), map)).toBeUndefined();
-  });
-
-  it("yields an empty map for a missing manifest", async () => {
-    const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-resolver-empty-"));
-    try {
-      const map = await buildRepoCompanyMap(root);
-      expect(map.entries).toHaveLength(0);
-      expect(resolveCompanyForCwd(path.join(root, "repos/private/hq-cloud"), map)).toBeUndefined();
-    } finally {
-      fs.rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  it("yields an empty map for an unparseable manifest", async () => {
-    hqRoot = setupHqRoot(":\n  not: [valid: yaml");
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(map.entries).toHaveLength(0);
-    expect(map.bySlug.size).toBe(0);
-  });
-});
-
-describe("resolveCompanyForSkill", () => {
-  let hqRoot: string;
-  afterEach(() => {
-    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  it("attributes a company-namespaced skill to its company, regardless of cwd", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    // The slug map is populated from the manifest keys with a cloud_uid.
-    expect(resolveCompanyForSkill("indigo:signals", map)).toBe(INDIGO);
-    expect(resolveCompanyForSkill("hpo:some-skill", map)).toBe(HPO);
-    // Multi-segment skill name: only the leading slug is the company.
-    expect(resolveCompanyForSkill("indigo:hq-dev-thread", map)).toBe(INDIGO);
-  });
-
-  it("returns undefined for a core (un-namespaced) skill", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForSkill("startwork", map)).toBeUndefined();
-    expect(resolveCompanyForSkill("review", map)).toBeUndefined();
-  });
-
-  it("returns undefined for a non-company namespace (personal/pack) and a leading colon", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    // `personal` has no cloud_uid → not in the slug map.
-    expect(resolveCompanyForSkill("personal:startwork", map)).toBeUndefined();
-    expect(
-      resolveCompanyForSkill("hq-pack-engineering:review", map),
-    ).toBeUndefined();
-    expect(resolveCompanyForSkill(":oops", map)).toBeUndefined();
-  });
-
-  it("returns undefined for a slug whose company is not cloud-backed", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    // `liverecover` is in the manifest but carries no cloud_uid.
-    expect(resolveCompanyForSkill("liverecover:foo", map)).toBeUndefined();
-  });
-
-  it("handles a missing/undefined skill safely", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForSkill(undefined, map)).toBeUndefined();
-    expect(resolveCompanyForSkill("", map)).toBeUndefined();
-  });
-});
-
-/**
- * Regression: the real `companies/manifest.yaml` records `repos` as BARE NAMES
- * (`hq-cloud`), not HQ-root-relative paths (`repos/private/hq-cloud`). The
- * original resolver did `path.resolve(hqRoot, repo)` and produced
- * `<hqRoot>/hq-cloud` — a path no checkout lives at — so every entry matched
- * nothing and NO telemetry event was ever attributed. Verified in prod at the
- * time of the fix: 0 of 3200 sampled usage events across 9 people carried a
- * `companyUid`, which left the Team Activity "Projects" tab permanently empty.
- */
-describe("real-manifest shape: bare repo names + company directories", () => {
-  const ACME = "cmp_01ACME";
-  const BETA = "cmp_01BETA";
-
-  // Mirrors the live manifest: bare repo names, an explicit `path`, and a
-  // company with no cloud_uid (not cloud-backed).
-  const REAL_SHAPE = `companies:
-  acme:
-    name: Acme
-    path: companies/acme
-    repos:
-      - hq-cloud
-      - hq-console
-    cloud_uid: ${ACME}
-  beta:
-    name: Beta
-    path: companies/beta
-    repos:
-      - beta-site
-    cloud_uid: ${BETA}
-  nocloud:
-    name: NoCloud
-    path: companies/nocloud
-    repos:
-      - orphan-repo
-`;
-
-  let hqRoot: string;
-  afterEach(() => {
-    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  it("resolves a bare repo name to its repos/private checkout", async () => {
-    hqRoot = setupHqRoot(REAL_SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    const cwd = path.join(hqRoot, "repos/private/hq-console/src/app");
-    expect(resolveCompanyForCwd(cwd, map)).toBe(ACME);
-  });
-
-  it("resolves a bare repo name to its repos/public checkout", async () => {
-    hqRoot = setupHqRoot(REAL_SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    const cwd = path.join(hqRoot, "repos/public/hq-cloud");
-    expect(resolveCompanyForCwd(cwd, map)).toBe(ACME);
-  });
-
-  it("attributes work inside the company's own HQ directory", async () => {
-    hqRoot = setupHqRoot(REAL_SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForCwd(path.join(hqRoot, "companies/acme"), map)).toBe(ACME);
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "companies/beta/projects/x"), map),
-    ).toBe(BETA);
-  });
-
-  it("still honours an explicit HQ-root-relative repo path (back-compat)", async () => {
-    hqRoot = setupHqRoot();
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud/src"), map),
-    ).toBe("cmp_01INDIGO");
-  });
-
-  it("leaves a non-cloud-backed company's repos and directory unattributed", async () => {
-    hqRoot = setupHqRoot(REAL_SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "repos/private/orphan-repo"), map),
-    ).toBeUndefined();
-    expect(resolveCompanyForCwd(path.join(hqRoot, "companies/nocloud"), map)).toBeUndefined();
-  });
-
-  /**
-   * Case folding follows the FILESYSTEM, not the OS.
-   *
-   * Where the filesystem folds case, `.../HQ` and `.../hq` are literally the
-   * same directory and a differently-cased cwd must still attribute. Where it
-   * does not, they are different directories and an unattributed event is the
-   * correct (safe) outcome.
-   *
-   * The expectation is derived from the resolver's own probe (`map.foldsCase`),
-   * NOT from `process.platform` — case-sensitive APFS and case-insensitive
-   * volumes mounted on Linux both make the platform a liar, and this test would
-   * fail on them despite the resolver behaving correctly.
-   */
-  it("follows the probed filesystem for a differently-cased path", async () => {
-    hqRoot = setupHqRoot(REAL_SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    const cwd = path.join(hqRoot, "repos/private/hq-console").toUpperCase();
-    expect(resolveCompanyForCwd(cwd, map)).toBe(map.foldsCase ? ACME : undefined);
-  });
-
-  it("always matches an exactly-cased path", async () => {
-    hqRoot = setupHqRoot(REAL_SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-console/src"), map),
-    ).toBe(ACME);
-  });
-
-  it("treats backslash-separated paths as equivalent to forward slashes", async () => {
-    hqRoot = setupHqRoot(REAL_SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    const cwd = path.join(hqRoot, "repos/private/hq-console/src").replace(/\//g, "\\");
-    expect(resolveCompanyForCwd(cwd, map)).toBe(ACME);
-  });
-
-  it("does not let a sibling sharing a string prefix match", async () => {
-    hqRoot = setupHqRoot(REAL_SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-console-other"), map),
-    ).toBeUndefined();
-  });
-
-  it("emits no duplicate match keys", async () => {
-    hqRoot = setupHqRoot(REAL_SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    const keys = map.entries.map((e) => e.matchKey);
-    expect(new Set(keys).size).toBe(keys.length);
-  });
-});
-
-/**
- * Codex-review follow-ups. Each of these is a real HQ layout that pure lexical
- * matching against the primary checkout silently misses, leaving the work
- * unattributed — the same class of gap that left the Projects tab empty.
- */
-describe("real HQ layouts: worktrees, symlinks, and ambiguity", () => {
-  const ACME = "cmp_01ACME";
-  const BETA = "cmp_01BETA";
-
-  const SHAPE = `companies:
-  acme:
-    name: Acme
-    path: companies/acme
-    repos:
-      - hq-cloud
-    cloud_uid: ${ACME}
-  beta:
-    name: Beta
-    path: companies/beta
-    repos:
-      - beta-site
-    cloud_uid: ${BETA}
-`;
-
-  let hqRoot: string;
-  afterEach(() => {
-    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  function mkdirp(...segments: string[]): string {
-    const p = path.join(hqRoot, ...segments);
-    fs.mkdirSync(p, { recursive: true });
-    return p;
-  }
-
-  /**
-   * HQ does most feature work in a sibling git worktree named
-   * `<repo>-wt-<branch>`. The resolver's slash boundary rejects that as a mere
-   * string-prefix sibling of `<repo>`, so without explicit expansion every
-   * worktree session is unattributed.
-   */
-  it("attributes work inside a `<repo>-wt-*` git worktree", async () => {
-    hqRoot = setupHqRoot(SHAPE);
-    mkdirp("repos/private/hq-cloud");
-    const wt = mkdirp("repos/private/hq-cloud-wt-feature-x");
-
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForCwd(wt, map)).toBe(ACME);
-    expect(resolveCompanyForCwd(path.join(wt, "src/lib"), map)).toBe(ACME);
-  });
-
-  it("still rejects an unrelated sibling that merely shares the prefix", async () => {
-    hqRoot = setupHqRoot(SHAPE);
-    mkdirp("repos/private/hq-cloud");
-    const other = mkdirp("repos/private/hq-cloud-other");
-
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(resolveCompanyForCwd(other, map)).toBeUndefined();
-  });
-
-  /**
-   * A symlinked checkout reports its PHYSICAL path as cwd, which lives outside
-   * the HQ tree entirely and can never match the lexical root.
-   */
-  it("attributes a symlinked checkout reached by its physical path", async () => {
-    hqRoot = setupHqRoot(SHAPE);
-    const physical = fs.mkdtempSync(path.join(os.tmpdir(), "hq-physical-repo-"));
-    fs.mkdirSync(path.join(hqRoot, "repos/private"), { recursive: true });
-    try {
-      fs.symlinkSync(physical, path.join(hqRoot, "repos/private/hq-cloud"), "dir");
-    } catch {
-      return; // symlinks unavailable (e.g. unprivileged Windows) — skip
-    }
-
-    const map = await buildRepoCompanyMap(hqRoot);
-    try {
-      expect(resolveCompanyForCwd(fs.realpathSync(physical), map)).toBe(ACME);
-      // The lexical path must keep working too.
-      expect(
-        resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud"), map),
-      ).toBe(ACME);
-    } finally {
-      fs.rmSync(physical, { recursive: true, force: true });
-    }
-  });
-
-  /**
-   * Fail CLOSED: when two companies claim the same path, attributing to
-   * whichever the manifest listed first would be a cross-tenant
-   * misattribution. Unattributed is the correct answer.
-   */
-  it("leaves a path claimed by two companies unattributed", async () => {
-    const AMBIGUOUS = `companies:
-  acme:
-    name: Acme
-    repos:
-      - shared-repo
-    cloud_uid: ${ACME}
-  beta:
-    name: Beta
-    repos:
-      - shared-repo
-    cloud_uid: ${BETA}
-`;
-    hqRoot = setupHqRoot(AMBIGUOUS);
-    mkdirp("repos/private/shared-repo");
-
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "repos/private/shared-repo"), map),
-    ).toBeUndefined();
-  });
-
-  it("an ambiguous repo does not poison that company's other repos", async () => {
-    const AMBIGUOUS = `companies:
-  acme:
-    name: Acme
-    repos:
-      - shared-repo
-      - acme-only
-    cloud_uid: ${ACME}
-  beta:
-    name: Beta
-    repos:
-      - shared-repo
-    cloud_uid: ${BETA}
-`;
-    hqRoot = setupHqRoot(AMBIGUOUS);
-    mkdirp("repos/private/shared-repo");
-    mkdirp("repos/private/acme-only");
-
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "repos/private/acme-only"), map),
-    ).toBe(ACME);
-  });
-
-  it("reports the probed case-folding behaviour of the real filesystem", async () => {
-    hqRoot = setupHqRoot(SHAPE);
-    const map = await buildRepoCompanyMap(hqRoot);
-    expect(typeof map.foldsCase).toBe("boolean");
-    // Whatever the probe found, an exactly-cased path always resolves.
-    mkdirp("repos/private/hq-cloud");
-    const fresh = await buildRepoCompanyMap(hqRoot);
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud"), fresh),
-    ).toBe(ACME);
-  });
-});
-
-/**
- * A worktree that no longer exists on disk.
- *
- * `buildRepoCompanyMap` discovers worktrees by reading the directory, which
- * only sees what exists at build time. Telemetry, though, is read from a
- * cursor — and a branch worktree is routinely deleted before the next pass,
- * while pending JSONL rows still carry its cwd. Since a successful POST
- * advances the cursor permanently, failing to resolve those rows loses the
- * attribution for good.
- */
-describe("worktree paths that no longer exist on disk", () => {
-  const ACME = "cmp_01ACME";
-  const SHAPE = `companies:
-  acme:
-    name: Acme
-    path: companies/acme
-    repos:
-      - hq-cloud
-    cloud_uid: ${ACME}
-`;
-
-  let hqRoot: string;
-  afterEach(() => {
-    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  it("resolves a deleted worktree's cwd by its documented naming convention", async () => {
-    hqRoot = setupHqRoot(SHAPE);
-    fs.mkdirSync(path.join(hqRoot, "repos/private/hq-cloud"), { recursive: true });
-    // NOTE: the worktree is deliberately NOT created — it was cleaned up before
-    // this telemetry pass, exactly as in the real failure.
-    const map = await buildRepoCompanyMap(hqRoot);
-
-    const gone = path.join(hqRoot, "repos/private/hq-cloud-wt-feature-gone");
-    expect(resolveCompanyForCwd(gone, map)).toBe(ACME);
-    expect(resolveCompanyForCwd(path.join(gone, "src/lib"), map)).toBe(ACME);
-  });
-
-  it("does not let the worktree fallback rescue an unrelated sibling", async () => {
-    hqRoot = setupHqRoot(SHAPE);
-    fs.mkdirSync(path.join(hqRoot, "repos/private/hq-cloud"), { recursive: true });
-    const map = await buildRepoCompanyMap(hqRoot);
-
-    // `-other` is not the `-wt-` convention, so it stays a foreign sibling...
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "repos/private/hq-cloud-other"), map),
-    ).toBeUndefined();
-    // ...and a `-wt-` suffix on a repo nobody owns resolves to nothing.
-    expect(
-      resolveCompanyForCwd(path.join(hqRoot, "repos/private/stranger-wt-x"), map),
-    ).toBeUndefined();
-  });
-});
-
-/**
- * Fail-closed must survive the worktree fallback.
- *
- * The fallback collapses `<repo>-wt-<branch>` to `<repo>`. If the worktree-
- * shaped path was itself dropped for ambiguity, collapsing it would hand the
- * event to whoever owns the base repo — quietly undoing the protection.
- */
-describe("ambiguity is not escapable via the worktree fallback", () => {
-  const ACME = "cmp_01ACME";
-  const BETA = "cmp_01BETA";
-
-  let hqRoot: string;
-  afterEach(() => {
-    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  it("keeps an ambiguous `<repo>-wt-*` path unattributed instead of collapsing it", async () => {
-    // Acme owns `foo`; Beta owns a real repo that happens to be named
-    // `foo-wt-team`, which also looks like a worktree of Acme's `foo`.
-    hqRoot = setupHqRoot(`companies:
-  acme:
-    name: Acme
-    repos:
-      - foo
-    cloud_uid: ${ACME}
-  beta:
-    name: Beta
-    repos:
-      - foo-wt-team
-    cloud_uid: ${BETA}
-`);
-    fs.mkdirSync(path.join(hqRoot, "repos/private/foo"), { recursive: true });
-    fs.mkdirSync(path.join(hqRoot, "repos/private/foo-wt-team"), { recursive: true });
-
-    const map = await buildRepoCompanyMap(hqRoot);
-    const contested = path.join(hqRoot, "repos/private/foo-wt-team");
-
-    expect(resolveCompanyForCwd(contested, map)).toBeUndefined();
-    expect(resolveCompanyForCwd(path.join(contested, "src"), map)).toBeUndefined();
-    // The unambiguous base repo still resolves.
-    expect(resolveCompanyForCwd(path.join(hqRoot, "repos/private/foo"), map)).toBe(ACME);
-  });
-});
-
-/**
- * `path` is documented as HQ-root-relative, but the manifest is synced and
- * hand-editable. A path that escapes the root would claim a directory spanning
- * other tenants and stamp this company's uid on everything beneath it.
- */
-describe("company paths that escape the HQ root are rejected", () => {
-  const ACME = "cmp_01ACME";
-
-  let hqRoot: string;
-  afterEach(() => {
-    if (hqRoot) fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  it.each([["  .."], ["."], ["/"]])("ignores path: %s", async (badPath) => {
-    hqRoot = setupHqRoot(`companies:
-  acme:
-    name: Acme
-    path: "${badPath.trim()}"
-    repos: []
-    cloud_uid: ${ACME}
-`);
-    const map = await buildRepoCompanyMap(hqRoot);
-
-    // Neither the HQ root nor its parent may be claimed.
-    expect(resolveCompanyForCwd(hqRoot, map)).toBeUndefined();
-    expect(resolveCompanyForCwd(path.dirname(hqRoot), map)).toBeUndefined();
-    expect(resolveCompanyForCwd(path.join(hqRoot, "companies/other"), map)).toBeUndefined();
-  });
-});