@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/ignore.test.ts

@@ -1,466 +0,0 @@
-/**
- * Unit tests for createIgnoreFilter.
- *
- * Covers both modes: legacy permissive (no .hqinclude) and allowlist mode
- * (.hqinclude present). The allowlist tests guard against accidentally
- * leaking sensitive subtrees like data/ or workers/ to S3 — a regression
- * here would silently push private content on the next sync.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { createIgnoreFilter, isExpectedIgnore } from "./ignore.js";
-import { wrapFilterWithIgnoreVisibility } from "./cli/share.js";
-
-describe("isExpectedIgnore", () => {
-  it("classifies top-level HQ-managed roots as expected", () => {
-    expect(isExpectedIgnore("repos")).toBe(true);
-    expect(isExpectedIgnore("repos/private/x.ts")).toBe(true);
-    expect(isExpectedIgnore("workspace/tmp/file.md")).toBe(true);
-  });
-
-  it("classifies build, VCS, cache, and known basename noise as expected", () => {
-    expect(isExpectedIgnore("node_modules/react/index.js")).toBe(true);
-    expect(isExpectedIgnore("apps/web/node_modules/react/index.js")).toBe(true);
-    expect(isExpectedIgnore(".git/config")).toBe(true);
-    expect(isExpectedIgnore(".DS_Store")).toBe(true);
-    expect(isExpectedIgnore("x/.env")).toBe(true);
-    expect(isExpectedIgnore("a/b/.hq-sync.pid")).toBe(true);
-    expect(isExpectedIgnore("y/foo.pyc")).toBe(true);
-    // Cloud-only skill hero images (US-014) are an expected by-design exclusion.
-    expect(isExpectedIgnore(".claude/skills/foo/.skill-media/hero.png")).toBe(true);
-  });
-
-  it("classifies macOS Finder Icon\\r files as expected noise", () => {
-    // Finder scatters one into every directory it renders a custom icon for,
-    // and a folder-level cloud-sync agent propagates them tree-wide. Treated
-    // exactly like .DS_Store so a seeded tree stays silent rather than firing
-    // the "EXCLUDED from sync — review in case this is unintended" warning
-    // once per file.
-    expect(isExpectedIgnore("Icon\r")).toBe(true);
-    expect(isExpectedIgnore("companies/indigo/Icon\r")).toBe(true);
-  });
-
-  it("keeps a real file named Icons noteworthy (no `Icon?` over-match)", () => {
-    // The `Icon?` gitignore workaround would swallow these. Dropping real
-    // user content is a worse failure than the cruft being excluded.
-    expect(isExpectedIgnore("companies/indigo/Icons")).toBe(false);
-    expect(isExpectedIgnore("companies/indigo/Icon")).toBe(false);
-    expect(isExpectedIgnore("companies/indigo/Icons.md")).toBe(false);
-  });
-
-  it("keeps nested repos/workspace and ordinary content noteworthy", () => {
-    expect(isExpectedIgnore("companies/indigo/knowledge/repos/foo/notes.md")).toBe(false);
-    expect(isExpectedIgnore("companies/indigo/knowledge/overview.md")).toBe(false);
-  });
-});
-
-describe("createIgnoreFilter", () => {
-  let hqRoot: string;
-
-  beforeEach(() => {
-    hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-ignore-test-"));
-  });
-
-  afterEach(() => {
-    fs.rmSync(hqRoot, { recursive: true, force: true });
-  });
-
-  it("permissive mode: regular files sync, defaults are ignored", () => {
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/notes.md"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, "node_modules/foo/x.js"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".env"))).toBe(false);
-  });
-
-  it("permissive mode: project-local .qmd index is ignored by default", () => {
-    // feedback_332c7ccc / sqlite-vec#297 — never round-trip a project-local
-    // qmd index through the vault.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, ".qmd"), true)).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".qmd/index.sqlite"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".qmd/index.sqlite-wal"))).toBe(false);
-    expect(isExpectedIgnore(".qmd/index.sqlite")).toBe(true);
-  });
-
-  it("permissive mode: pnpm content-addressed store is ignored by default", () => {
-    // .pnpm-store/ is pnpm's content-addressed package store. Like
-    // node_modules/ it is large and machine-local and must never sync — a
-    // synced store writes a `.conflict-` copy of every blob each cycle, which
-    // then re-syncs and amplifies into tens of thousands of files. Regression
-    // guard for that storm.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    // The store directory and everything beneath it is excluded.
-    expect(shouldSync(path.join(hqRoot, ".pnpm-store"), true)).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".pnpm-store/v10/files/00/abc123"))).toBe(false);
-    // Caught at any depth — a project store nested under a synced subtree.
-    expect(
-      shouldSync(path.join(hqRoot, "companies/indigo/repos/x/.pnpm-store/v10/blob")),
-    ).toBe(false);
-    // node_modules/ is already covered; asserted here so the pair travels together.
-    expect(shouldSync(path.join(hqRoot, "node_modules/react/index.js"))).toBe(false);
-  });
-
-  it("permissive mode: macOS Finder Icon\\r files never enter the walk", () => {
-    // A CR is a control character, so the vault key validator rejects the key
-    // (INVALID_KEY_CONTROL_CHARS) and the upload can only ever throw. Dropping
-    // them during the walk is what keeps them off the upload path entirely.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "Icon\r"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/Icon\r"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".agents/Icon\r"))).toBe(false);
-    // Caught at any depth, like the other OS-cruft exclusions.
-    expect(shouldSync(path.join(hqRoot, "a/b/c/d/Icon\r"))).toBe(false);
-  });
-
-  it("permissive mode: a real file named Icons still syncs", () => {
-    // Regression guard for the `Icon?` gitignore workaround, whose `?`
-    // single-char wildcard also matches Icons / Icon1 / IconX. This exclusion
-    // matches the exact Finder byte sequence instead, so real content survives.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/Icons"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/Icon"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/Icon1"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/Icons.md"))).toBe(true);
-  });
-
-  it("a literal Icon+CR line in .gitignore does NOT reach the ignore lib", () => {
-    // This is why the exclusion is a predicate and not a DEFAULT_IGNORES
-    // entry. ignore@5 strips a trailing CR from a pattern line, so the
-    // spelling git itself requires silently never matches. Pinning the
-    // upstream behavior here means a future ignore-lib bump that changes it
-    // surfaces as a failing test rather than a silent double-exclusion.
-    fs.writeFileSync(path.join(hqRoot, ".gitignore"), "Icon\r\n");
-    const shouldSync = createIgnoreFilter(hqRoot);
-    // Still excluded — by the predicate, not by the pattern.
-    expect(shouldSync(path.join(hqRoot, "Icon\r"))).toBe(false);
-    // Proof the pattern itself is inert: it did not take `Icons` with it.
-    expect(shouldSync(path.join(hqRoot, "Icons"))).toBe(true);
-  });
-
-  it("repos/ exclusion is root-anchored to hqRoot (DEV-1791)", () => {
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "repos/private/hq-cloud/src/x.ts"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "repos/public/hq-core/README.md"))).toBe(false);
-    expect(
-      shouldSync(path.join(hqRoot, "companies/lutiq/knowledge/repos/dev-docs-mcp/overview.md")),
-    ).toBe(true);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/knowledge/repos/foo/notes.md"))).toBe(
-      true,
-    );
-    expect(shouldSync(path.join(hqRoot, "companies/lutiq/knowledge/repos"), true)).toBe(true);
-  });
-
-  it("permissive mode: .hqignore patterns are honored", () => {
-    fs.writeFileSync(path.join(hqRoot, ".hqignore"), "companies/*/data/\n");
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/data/x.csv"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/notes.md"))).toBe(true);
-  });
-
-  it("visibility fires on an OVER-BROAD exclusion (real filter + recorder, DEV-1791)", () => {
-    // Simulate the regressed over-broad bug: an un-anchored `repos/` in
-    // .hqignore that matches ANY nested repos segment — exactly what
-    // silently ate /discover knowledge under companies/*/knowledge/repos/
-    // before the root-anchor fix. The visibility recorder must surface the
-    // dropped knowledge as NOTEWORTHY while staying quiet on build noise.
-    fs.writeFileSync(path.join(hqRoot, ".hqignore"), "repos/\n");
-    const ignoreFilter = createIgnoreFilter(hqRoot);
-    const noteworthy: string[] = [];
-    let total = 0;
-    const recorded = wrapFilterWithIgnoreVisibility(
-      ignoreFilter,
-      hqRoot,
-      (rel) => { noteworthy.push(rel); },
-      () => { total++; },
-    );
-
-    // Knowledge under a nested repos/ is dropped by the over-broad rule and
-    // is genuine content → captured as noteworthy.
-    expect(recorded(path.join(hqRoot, "companies/indigo/knowledge/repos/foo/notes.md"))).toBe(false);
-    // Build noise is also excluded but is EXPECTED → counted, not noteworthy.
-    expect(recorded(path.join(hqRoot, "node_modules/react/index.js"))).toBe(false);
-    // Ordinary knowledge that the filter ALLOWS fires nothing.
-    expect(recorded(path.join(hqRoot, "companies/indigo/knowledge/overview.md"))).toBe(true);
-
-    expect(noteworthy).toEqual(["companies/indigo/knowledge/repos/foo/notes.md"]);
-    expect(total).toBe(2); // both exclusions counted; only one is noteworthy
-  });
-
-  it("v15+ layout (core/core.yaml present): root core.yaml is ignored, nested core/core.yaml syncs", () => {
-    // On v15+ the scaffold/version manifest lives at `core/core.yaml` (a real
-    // project file that DOES sync). Any root-level `core.yaml` here is a stale
-    // per-machine duplicate that must never round-trip — pulling another
-    // machine's marker would corrupt root discovery. The exclusion is anchored
-    // (`/core.yaml`) so it never touches `core/core.yaml`.
-    fs.mkdirSync(path.join(hqRoot, "core"), { recursive: true });
-    fs.writeFileSync(path.join(hqRoot, "core/core.yaml"), 'version: 1\nhqVersion: "15.0.12"\n');
-    fs.writeFileSync(path.join(hqRoot, "core.yaml"), 'version: 1\nhqVersion: "15.0.12"\n');
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "core.yaml"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "core/core.yaml"))).toBe(true);
-  });
-
-  it("v12–v14 layout (no core/core.yaml): root core.yaml IS the manifest and MUST sync", () => {
-    // Regression for DEV-1729 / the ~98 "no core.yaml in vault, version
-    // undetectable" sync users. On v12–v14 roots there is NO `core/core.yaml`
-    // — the ROOT `core.yaml` is the scaffold/version manifest. The old
-    // unconditional `/core.yaml` exclusion silently dropped it (while
-    // computePersonalVaultPaths still enumerated it), so the vault never
-    // received a version marker. With no `core/core.yaml` on disk, the root
-    // `core.yaml` must round-trip like any other top-level file.
-    fs.writeFileSync(path.join(hqRoot, "core.yaml"), 'version: 1\nhqVersion: "14.0.0"\n');
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "core.yaml"))).toBe(true);
-  });
-
-  it("permissive mode: modules/modules.yaml manifest is ignored", () => {
-    // modules.yaml is the local modules-resolution manifest. Per-machine
-    // state, never synced.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "modules/modules.yaml"))).toBe(false);
-  });
-
-  it("permissive mode: per-company company.yaml is ignored", () => {
-    // company.yaml is written locally on first sync from the entity context.
-    // Round-tripping it would let one machine's identity overwrite another's.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/company.yaml"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "company.yaml"))).toBe(false);
-  });
-
-  it("permissive mode: INDEX.md and policies/_digest.md are ignored", () => {
-    // Both are auto-generated locally — INDEX.md by the tools indexer and
-    // policies/_digest.md by the policies digest builder.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, "INDEX.md"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/ghq/tools/INDEX.md"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "policies/_digest.md"))).toBe(false);
-  });
-
-  it("permissive mode: .claude/worktrees/ is ignored", () => {
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, ".claude/worktrees/foo/file.ts"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/.claude/worktrees/bar/x.md"))).toBe(false);
-    // The .claude/ dir itself (commands, skills, hooks) still syncs.
-    expect(shouldSync(path.join(hqRoot, ".claude/skills/foo/SKILL.md"))).toBe(true);
-  });
-
-  it("permissive mode: .skill-media/ (cloud-only skill images) is ignored (US-014)", () => {
-    const shouldSync = createIgnoreFilter(hqRoot);
-    // Skill hero images are cloud-only — excluded from push AND pull at any depth.
-    expect(
-      shouldSync(path.join(hqRoot, ".claude/skills/lead-qualifier/.skill-media/hero.png")),
-    ).toBe(false);
-    expect(
-      shouldSync(path.join(hqRoot, "companies/indigo/skills/foo/.skill-media/cover.jpg")),
-    ).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "skills/bar/.skill-media"), true)).toBe(false);
-    // The skill's SKILL.md and other content still sync — the rule is scoped to
-    // the media dir only, never the skill.
-    expect(shouldSync(path.join(hqRoot, ".claude/skills/lead-qualifier/SKILL.md"))).toBe(true);
-  });
-
-  it("permissive mode: .hq-* internal state is ignored, .hqignore family still sync", () => {
-    const shouldSync = createIgnoreFilter(hqRoot);
-    // Internal state files that must never round-trip through the bucket.
-    expect(shouldSync(path.join(hqRoot, ".hq-sync.pid"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".hq-sync-journal.json"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".hq-sync-state.json"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".hq-embeddings-pending.json"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/.hq-foo.json"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".hq-cache/blob.bin"))).toBe(false);
-    // Sync-config files still sync (no hyphen, doesn't match `.hq-*`).
-    expect(shouldSync(path.join(hqRoot, ".hqignore"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, ".hqsyncignore"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, ".hqinclude"))).toBe(true);
-  });
-
-  it("permissive mode: .claude/state/ and .claude/audit/ are per-host, never synced", () => {
-    // 5.34.0 live cross-machine sync test (macOS ↔ Lightsail) wrote
-    // ~25 of the 30 conflict mirrors directly to these paths. They're
-    // session-/host-scoped by design:
-    //   - .claude/state/active-session-project: the active project
-    //     pointer for the currently-foregrounded Claude Code session.
-    //   - .claude/state/auto-session-project-<sessionUuid>: one
-    //     marker per spawned session; entirely host-local.
-    //   - .claude/audit/: hook-decision audit log + suppressions
-    //     config; host-specific by nature.
-    // Syncing produces guaranteed conflicts per machine per session.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, ".claude/state/active-session-project"))).toBe(false);
-    expect(
-      shouldSync(
-        path.join(hqRoot, ".claude/state/auto-session-project-571177ff-59bb-4728-8670-0bf66a6410a5"),
-      ),
-    ).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".claude/audit/instructions.md"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".claude/audit/suppressions.yaml"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".claude/state"), true)).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".claude/audit"), true)).toBe(false);
-    // Nested .claude/ inside a company also stays local — same anchor
-    // shape as the .claude/worktrees/ rule directly above.
-    expect(
-      shouldSync(path.join(hqRoot, "companies/indigo/.claude/state/active-session-project")),
-    ).toBe(false);
-    expect(
-      shouldSync(path.join(hqRoot, "companies/indigo/.claude/audit/instructions.md")),
-    ).toBe(false);
-    // The .claude/ dir's other contents (commands, skills, hooks) still
-    // sync — the rule MUST NOT broaden to .claude/.
-    expect(shouldSync(path.join(hqRoot, ".claude/skills/foo/SKILL.md"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, ".claude/hooks/foo.sh"))).toBe(true);
-  });
-
-  it("permissive mode: .claude/settings*.json is machine-local, never synced (qmd PATH regression)", () => {
-    // 2026-07-01 e2e-mac report (20260701-qmd-path): cloud sync pulled the
-    // operator's .claude/settings.json over a fresh install's copy ~40s
-    // after install, byte-identical to the source machine — reverting the
-    // installer's day-one env.PATH fix and propagating one host's PATH
-    // snapshot to every machine/teammate. This is the recurrence mechanism
-    // behind the recurring "qmd: command not found" reports. Settings are
-    // machine-local (PATH snapshot, model prefs) and must never round-trip
-    // in EITHER direction — the pull planner consults this same filter, so
-    // an existing vault copy is also never applied locally.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, ".claude/settings.json"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".claude/settings.local.json"))).toBe(false);
-    // Nested .claude/ inside a company stays local too — same anchor shape
-    // as the state/audit rules above.
-    expect(
-      shouldSync(path.join(hqRoot, "companies/indigo/.claude/settings.json")),
-    ).toBe(false);
-    // Siblings still sync — the rule must not broaden past settings files.
-    expect(shouldSync(path.join(hqRoot, ".claude/skills/foo/SKILL.md"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, ".claude/hooks/foo.sh"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, ".claude/CLAUDE.md"))).toBe(true);
-  });
-
-  it("permissive mode: .hq/ directory is per-host state, never synced (Bug #1/#6/#8)", () => {
-    // Bug catalog: `.hq/install-manifest.json`, `.hq/machine-id`, and
-    // `.hq/machine.json` are per-host source-of-truth files. The original
-    // `DEFAULT_IGNORES` only covered the `.hq-*` wildcard (with hyphen) and
-    // explicitly left the `.hq/` directory unaffected — so the install
-    // manifest and machine-id round-tripped through S3 between hosts,
-    // breaking the per-machine identity contract that the 5.33.0
-    // machine-id fix relies on.
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(shouldSync(path.join(hqRoot, ".hq/install-manifest.json"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".hq/machine-id"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".hq/machine.json"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".hq/config.json"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, ".hq"), true)).toBe(false);
-    // Nested .hq/ inside a company also stays local (per-host scoping).
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/.hq/config.json"))).toBe(false);
-  });
-
-  it("allowlist mode: presence of .hqinclude switches to opt-in", () => {
-    fs.writeFileSync(
-      path.join(hqRoot, ".hqinclude"),
-      "companies/*/knowledge/\ncompanies/*/projects/\n",
-    );
-    const shouldSync = createIgnoreFilter(hqRoot);
-    // Allowlisted paths sync.
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/knowledge/foo.md"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/projects/p1/prd.json"))).toBe(true);
-    // Anything else stays local — this is the privacy guarantee.
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/data/leads.csv"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/workers/cmo/skill.md"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/settings/aws.json"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "personal/journal/2026-04-26.md"))).toBe(false);
-  });
-
-  it("allowlist mode: directory entries match dir-suffix include patterns (walker descent)", () => {
-    // Regression: walkDir tests directory entries when deciding whether to
-    // descend. The `ignore` lib only matches dir-only patterns like
-    // `companies/*/knowledge/` against paths that end with `/`. The filter
-    // accepts an `isDir` hint and appends the trailing slash before probing,
-    // mirroring how git itself decides (it knows from the index whether
-    // each entry is a tree or a blob). Without the hint the walker would
-    // see `companies/indigo/knowledge` -> not allowed -> never descend ->
-    // entire subtree silently lost. Files inside still work because
-    // `ignore` walks ancestors internally; the bug only bites the descent
-    // decision for directory entries.
-    fs.writeFileSync(
-      path.join(hqRoot, ".hqinclude"),
-      "companies/*/knowledge/\ncompanies/*/projects/\n.claude/\n",
-    );
-    const shouldSync = createIgnoreFilter(hqRoot);
-    // Directory entries must be allowed when the caller hints isDir=true.
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/knowledge"), true)).toBe(true);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/projects"), true)).toBe(true);
-    expect(shouldSync(path.join(hqRoot, ".claude"), true)).toBe(true);
-    // Files inside still resolve correctly without the hint.
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/knowledge/x.md"))).toBe(true);
-    expect(shouldSync(path.join(hqRoot, ".claude/skills/foo/SKILL.md"))).toBe(true);
-    // Machine-local settings stay excluded even inside an allowlisted
-    // subtree — exclusion layers subtract on top of the allowlist.
-    expect(shouldSync(path.join(hqRoot, ".claude/settings.json"))).toBe(false);
-    // Non-allowlisted siblings stay excluded — privacy guarantee intact.
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/data"), true)).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/workers"), true)).toBe(false);
-  });
-
-  it("allowlist mode: walker descends through intermediate ancestor dirs", () => {
-    // Full gitignore semantics: a walker starting at hqRoot must be able to
-    // descend through `companies/` and `companies/indigo/` to reach the
-    // allowlisted leaf `companies/*/knowledge/`. The ancestor matcher
-    // permits this for dir-mode queries while keeping files directly inside
-    // those intermediate dirs excluded — privacy invariant intact.
-    fs.writeFileSync(
-      path.join(hqRoot, ".hqinclude"),
-      "companies/*/knowledge/\n",
-    );
-    const shouldSync = createIgnoreFilter(hqRoot);
-    // Intermediate directories along the path to the leaf are descent-allowed.
-    expect(shouldSync(path.join(hqRoot, "companies"), true)).toBe(true);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo"), true)).toBe(true);
-    // The leaf itself is allowed.
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/knowledge"), true)).toBe(true);
-    // Files directly inside intermediate dirs are still excluded — only the
-    // dir is descent-allowed, the dir's loose files are not.
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/notes.md"))).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/README.md"))).toBe(false);
-    // Files inside the allowlisted leaf still sync.
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/knowledge/x.md"))).toBe(true);
-  });
-
-  it("dir-only ignore patterns honor the isDir hint symmetrically", () => {
-    // Gitignore semantics: a trailing-slash pattern (`foo/`) matches only
-    // directories, never files of the same name. The filter applies this
-    // on BOTH layers — exclude and include — by appending `/` to the probe
-    // when the caller passes isDir=true, and leaving it as-is otherwise.
-    // This guarantees:
-    //   - a directory `node_modules` is excluded (descent skipped),
-    //   - but a regular file literally named `node_modules` is NOT
-    //     mistakenly excluded by the dir-only pattern.
-    fs.writeFileSync(path.join(hqRoot, ".hqignore"), "build/\n");
-    const shouldSync = createIgnoreFilter(hqRoot);
-    // Directory `build` matches the dir-only exclusion.
-    expect(shouldSync(path.join(hqRoot, "build"), true)).toBe(false);
-    // A file literally named `build` (not a dir) does NOT match `build/`.
-    // This is the asymmetry that previous PR comments warned about and
-    // that the isDir hint resolves cleanly.
-    expect(shouldSync(path.join(hqRoot, "build"), false)).toBe(true);
-    // Default-call (no hint) is treated as "not a directory" — matches
-    // gitignore's blob-default and preserves the file-side guarantee.
-    expect(shouldSync(path.join(hqRoot, "build"))).toBe(true);
-  });
-
-  it("allowlist mode: exclusion layers still subtract on top", () => {
-    // Even when a subtree is allowlisted, default ignores like node_modules/
-    // and .env must still apply. Otherwise an allowlisted subdir would sync
-    // gigabytes of dependency junk or leak secret env files.
-    fs.writeFileSync(path.join(hqRoot, ".hqinclude"), "companies/*/projects/\n");
-    const shouldSync = createIgnoreFilter(hqRoot);
-    expect(
-      shouldSync(path.join(hqRoot, "companies/indigo/projects/p1/prd.json")),
-    ).toBe(true);
-    expect(
-      shouldSync(path.join(hqRoot, "companies/indigo/projects/p1/node_modules/react/index.js")),
-    ).toBe(false);
-    expect(shouldSync(path.join(hqRoot, "companies/indigo/projects/p1/.env"))).toBe(false);
-  });
-});