@indigoai-us/hq-cloud 6.15.19 → 6.15.20

package/dist/cli/share.test.js

@@ -1450,6 +1450,304 @@ describe("share", () => {
             // fence then retry — either is consent. Must not leave the file unuploaded.
             expect(uploadFile).toHaveBeenCalled();
         });
+        // ── publish-local: fenced promotion of a kept-local copy ────────────────
+        //
+        // `keep` leaves a file permanently unpublishable: push refuses it on the
+        // localDiverges flag, pull never clears the flag (remote is unchanged), and
+        // `keep` re-arms it every pass. The only existing escape — `overwrite` — is
+        // a blunt force-write that will PUT unfenced after a 412, clobbering a
+        // remote that genuinely advanced.
+        //
+        // `publish-local` is the missing middle: the operator explicitly elects
+        // their local copy as the new authority, and the engine accepts it ONLY
+        // while the remote still sits at the etag recorded when the keep happened.
+        // If the remote moved, consent was given against a version that no longer
+        // exists, so the write must fail closed instead of forcing.
+        it("localDiverges under publish-local: promotes local under an If-Match fence on the journal etag", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(companyRoot, { recursive: true });
+            const testFile = path.join(companyRoot, "publish-divergent.md");
+            const localBytes = "my kept divergent local, now elected authority";
+            fs.writeFileSync(testFile, localBytes);
+            const localHash = hashFile(testFile);
+            const REMOTE = "peer-version-etag";
+            vi.mocked(headRemoteFile).mockResolvedValueOnce({
+                lastModified: new Date(),
+                etag: `"${REMOTE}"`,
+                size: 40,
+            });
+            vi.mocked(uploadFile).mockResolvedValueOnce({ etag: '"published-etag"' });
+            const journalPath = path.join(stateDir, "sync-journal.acme.json");
+            fs.writeFileSync(journalPath, JSON.stringify({
+                version: "1",
+                lastSync: new Date().toISOString(),
+                files: {
+                    "publish-divergent.md": {
+                        hash: localHash,
+                        size: localBytes.length,
+                        syncedAt: new Date().toISOString(),
+                        direction: "down",
+                        remoteEtag: REMOTE,
+                        localDiverges: true,
+                    },
+                },
+            }));
+            const result = await share({
+                paths: [testFile],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                skipUnchanged: false,
+                onConflict: "publish-local",
+            });
+            expect(result.filesUploaded).toBe(1);
+            // Fenced on the etag the keep recorded — never unfenced, never live-HEAD.
+            expect(uploadFile).toHaveBeenCalledTimes(1);
+            expect(vi.mocked(uploadFile).mock.calls[0][4]).toEqual({ ifMatch: REMOTE });
+            // The entry is rewritten as an ordinary upload: local is now authority,
+            // so the journal-honesty flag must be gone rather than re-armed.
+            const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+            expect(journal.files["publish-divergent.md"].direction).toBe("up");
+            expect(journal.files["publish-divergent.md"].localDiverges).toBeFalsy();
+            expect(journal.files["publish-divergent.md"].remoteEtag).toBe("published-etag");
+            expect(fs.readFileSync(testFile, "utf-8")).toBe(localBytes);
+        });
+        it("localDiverges under publish-local: a 412 fails closed and never retries unfenced", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(companyRoot, { recursive: true });
+            const testFile = path.join(companyRoot, "publish-raced.md");
+            const localBytes = "my local, but the remote moved under me";
+            fs.writeFileSync(testFile, localBytes);
+            const localHash = hashFile(testFile);
+            const REMOTE = "etag-at-keep-time";
+            vi.mocked(headRemoteFile).mockResolvedValueOnce({
+                lastModified: new Date(),
+                etag: `"${REMOTE}"`,
+                size: 40,
+            });
+            const precondition = Object.assign(new Error("At least one of the pre-conditions you specified did not hold"), {
+                name: "PreconditionFailed",
+            });
+            vi.mocked(uploadFile).mockRejectedValueOnce(precondition);
+            const journalPath = path.join(stateDir, "sync-journal.acme.json");
+            fs.writeFileSync(journalPath, JSON.stringify({
+                version: "1",
+                lastSync: new Date().toISOString(),
+                files: {
+                    "publish-raced.md": {
+                        hash: localHash,
+                        size: localBytes.length,
+                        syncedAt: new Date().toISOString(),
+                        direction: "down",
+                        remoteEtag: REMOTE,
+                        localDiverges: true,
+                    },
+                },
+            }));
+            const result = await share({
+                paths: [testFile],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                skipUnchanged: false,
+                onConflict: "publish-local",
+            });
+            // Exactly one attempt: the fenced one. The `overwrite` escape hatch of
+            // re-PUTting with no precondition must NOT be reachable from here.
+            expect(uploadFile).toHaveBeenCalledTimes(1);
+            expect(result.filesUploaded).toBe(0);
+            expect(result.conflictPaths).toContain("publish-raced.md");
+            // Consent was for a remote that no longer exists, so the flag stays put
+            // and the operator is asked again rather than silently overruled.
+            const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+            expect(journal.files["publish-raced.md"].localDiverges).toBe(true);
+            expect(fs.readFileSync(testFile, "utf-8")).toBe(localBytes);
+        });
+        // Codex review (PR #356, P1). The sync runner's push leg always calls
+        // share() with `skipUnchanged: true`, and a pull-kept entry stores the
+        // CURRENT local hash — that is exactly what the journal-honesty stamp
+        // records. So `existing.hash === localHash` is true for every stuck file,
+        // classifyPushCandidates() returns `skip-unchanged`, and executeUploads()
+        // never runs: no HEAD, no conflict, no upload. Without this bypass the
+        // whole recovery is a no-op in the one mode that can reach personal-vault
+        // files, and the next pull leaves them stuck again. `hash === journal hash`
+        // means "local is unchanged since the stamp", NOT "local matches remote" —
+        // for a divergent entry those are different claims.
+        it("localDiverges bypasses the skip-unchanged fast path so the recovery can run at all", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(companyRoot, { recursive: true });
+            const testFile = path.join(companyRoot, "stuck-under-skip-unchanged.md");
+            const localBytes = "the body a pull-keep stamped and then refused to publish";
+            fs.writeFileSync(testFile, localBytes);
+            const localHash = hashFile(testFile);
+            const REMOTE = "etag-at-keep-time";
+            vi.mocked(headRemoteFile).mockResolvedValueOnce({
+                lastModified: new Date(),
+                etag: `"${REMOTE}"`,
+                size: 40,
+            });
+            vi.mocked(uploadFile).mockResolvedValueOnce({ etag: '"published-etag"' });
+            const journalPath = path.join(stateDir, "sync-journal.acme.json");
+            fs.writeFileSync(journalPath, JSON.stringify({
+                version: "1",
+                lastSync: new Date().toISOString(),
+                files: {
+                    "stuck-under-skip-unchanged.md": {
+                        // Deliberately the CURRENT local hash: this is what a pull-keep
+                        // writes, and it is what makes the fast path swallow the file.
+                        hash: localHash,
+                        size: localBytes.length,
+                        syncedAt: new Date().toISOString(),
+                        direction: "down",
+                        remoteEtag: REMOTE,
+                        localDiverges: true,
+                    },
+                },
+            }));
+            const result = await share({
+                paths: [testFile],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                skipUnchanged: true,
+                onConflict: "publish-local",
+            });
+            expect(result.filesUploaded).toBe(1);
+            expect(vi.mocked(uploadFile).mock.calls[0][4]).toEqual({ ifMatch: REMOTE });
+            const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+            expect(journal.files["stuck-under-skip-unchanged.md"].direction).toBe("up");
+            expect(journal.files["stuck-under-skip-unchanged.md"].localDiverges).toBeFalsy();
+        });
+        // Codex review (PR #356, P2). A genuine two-sided conflict is not the
+        // localDiverges recovery: the journal etag is stale BY DEFINITION here
+        // (that is what remoteChanged means), so fencing consent on it guarantees a
+        // 412 and the file can never publish. Consent given at this prompt is
+        // consent against the remote the operator was just shown, so the fence must
+        // be the freshly observed etag.
+        it("publish-local on a fresh two-sided conflict fences on the OBSERVED remote etag, not the stale journal one", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(companyRoot, { recursive: true });
+            const testFile = path.join(companyRoot, "two-sided.md");
+            fs.writeFileSync(testFile, "my newer local body");
+            const STALE_JOURNAL_ETAG = "etag-from-last-sync";
+            const OBSERVED_REMOTE_ETAG = "etag-the-peer-just-wrote";
+            vi.mocked(headRemoteFile).mockResolvedValueOnce({
+                lastModified: new Date(),
+                etag: `"${OBSERVED_REMOTE_ETAG}"`,
+                size: 40,
+            });
+            vi.mocked(uploadFile).mockResolvedValueOnce({ etag: '"published-etag"' });
+            const journalPath = path.join(stateDir, "sync-journal.acme.json");
+            fs.writeFileSync(journalPath, JSON.stringify({
+                version: "1",
+                lastSync: new Date().toISOString(),
+                files: {
+                    "two-sided.md": {
+                        hash: "a-hash-that-is-neither-side",
+                        size: 10,
+                        syncedAt: new Date().toISOString(),
+                        direction: "up",
+                        remoteEtag: STALE_JOURNAL_ETAG,
+                    },
+                },
+            }));
+            const result = await share({
+                paths: [testFile],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                skipUnchanged: false,
+                onConflict: "publish-local",
+            });
+            expect(result.filesUploaded).toBe(1);
+            expect(vi.mocked(uploadFile).mock.calls[0][4]).toEqual({
+                ifMatch: OBSERVED_REMOTE_ETAG,
+            });
+        });
+        // Codex review (PR #356, P2). HEAD returning null skips the whole conflict
+        // block, so the precondition becomes If-None-Match:* and the object is
+        // RECREATED. For a divergent entry that silently overrules a peer's
+        // deletion — the remote is emphatically no longer at the recorded etag, so
+        // the strategy's own fence says fail closed. `keep`'s recreate-once
+        // behaviour for non-divergent entries is unaffected.
+        it("publish-local does not resurrect a remote deleted after the keep", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(companyRoot, { recursive: true });
+            const testFile = path.join(companyRoot, "peer-deleted.md");
+            const localBytes = "my divergent local body";
+            fs.writeFileSync(testFile, localBytes);
+            const localHash = hashFile(testFile);
+            vi.mocked(headRemoteFile).mockResolvedValueOnce(null);
+            const journalPath = path.join(stateDir, "sync-journal.acme.json");
+            fs.writeFileSync(journalPath, JSON.stringify({
+                version: "1",
+                lastSync: new Date().toISOString(),
+                files: {
+                    "peer-deleted.md": {
+                        hash: localHash,
+                        size: localBytes.length,
+                        syncedAt: new Date().toISOString(),
+                        direction: "down",
+                        remoteEtag: "etag-before-the-peer-deleted-it",
+                        localDiverges: true,
+                    },
+                },
+            }));
+            const result = await share({
+                paths: [testFile],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                skipUnchanged: false,
+                onConflict: "publish-local",
+            });
+            expect(uploadFile).not.toHaveBeenCalled();
+            expect(result.filesUploaded).toBe(0);
+            expect(result.conflictPaths).toContain("peer-deleted.md");
+            const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+            expect(journal.files["peer-deleted.md"].localDiverges).toBe(true);
+            expect(fs.readFileSync(testFile, "utf-8")).toBe(localBytes);
+        });
+        it("publish-local on a non-divergent file behaves like an ordinary fenced upload", async () => {
+            const companyRoot = path.join(tmpDir, "companies", "acme");
+            fs.mkdirSync(companyRoot, { recursive: true });
+            const testFile = path.join(companyRoot, "ordinary.md");
+            fs.writeFileSync(testFile, "locally edited since last sync");
+            const REMOTE = "unchanged-remote-etag";
+            vi.mocked(headRemoteFile).mockResolvedValueOnce({
+                lastModified: new Date(),
+                etag: `"${REMOTE}"`,
+                size: 10,
+            });
+            vi.mocked(uploadFile).mockResolvedValueOnce({ etag: '"next-etag"' });
+            const journalPath = path.join(stateDir, "sync-journal.acme.json");
+            fs.writeFileSync(journalPath, JSON.stringify({
+                version: "1",
+                lastSync: new Date().toISOString(),
+                files: {
+                    "ordinary.md": {
+                        hash: "stale-hash-from-a-previous-body",
+                        size: 10,
+                        syncedAt: new Date().toISOString(),
+                        direction: "up",
+                        remoteEtag: REMOTE,
+                    },
+                },
+            }));
+            const result = await share({
+                paths: [testFile],
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                skipUnchanged: false,
+                onConflict: "publish-local",
+            });
+            // No localDiverges flag means no special casing: the normal push fence
+            // applies and the file uploads without being routed through conflict.
+            expect(result.filesUploaded).toBe(1);
+            expect(result.conflictPaths ?? []).not.toContain("ordinary.md");
+            expect(vi.mocked(uploadFile).mock.calls[0][4]).toEqual({ ifMatch: REMOTE });
+        });
         // Journal still carries remoteEtag from a prior sync, but the remote key
         // is gone (HEAD null) — e.g. peer delete or operator purge. Recreation
         // must use If-None-Match:* (create-only), NOT If-Match on the stale