@indigoai-us/hq-cloud 6.15.2 → 6.15.4

package/dist/cli/sync.test.js

@@ -1,7 +1,6 @@
 /**
  * Unit tests for hq sync command (VLT-5 US-002).
  */
-import { createHash } from "node:crypto";
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import * as fs from "fs";
 import * as path from "path";
@@ -15,58 +14,37 @@ vi.mock("fs", async (importOriginal) => {
     return { ...actual };
 });
 describe("sync mutation stdin boundary", () => {
-    it("accepts only the exact sidecar command and emits one discriminated recovery result", async () => {
+    it("accepts only the exact sidecar command and emits one discriminated upsert result", async () => {
         expect(SYNC_MUTATION_STDIN_COMMAND).toEqual(["sync", "mutation", "--stdin-json"]);
         expect(isSyncMutationStdinCommand(["sync", "mutation", "--stdin-json"])).toBe(true);
         expect(isSyncMutationStdinCommand(["sync", "mutation"])).toBe(false);
-        const recover = vi.fn().mockResolvedValue({ status: "committed", attemptId: "attempt_1", versionId: "version_1", deltaId: "delta_1" });
+        const bytes = Buffer.from("real immutable bytes\0", "utf8");
+        const submit = vi.fn().mockResolvedValue({ requestDigest: "digest_1", status: { status: "committed", attemptId: "attempt_1", versionId: "version_1", deltaId: "delta_1" } });
         const output = await runSyncMutationStdinJson(JSON.stringify({
-            contractVersion: 2,
-            action: "recover",
-            authorization: { bearer: "token", deviceId: "device_a", capabilityVector: {}, lease: {} },
-            attemptId: "attempt_1",
-        }), { submit: vi.fn(), recover });
-        expect(JSON.parse(output)).toEqual({ contractVersion: 2, action: "recover", status: { status: "committed", attemptId: "attempt_1", versionId: "version_1", deltaId: "delta_1" } });
-        expect(recover).toHaveBeenCalledWith(expect.any(Object), "attempt_1");
-    });
-    it("rejects unknown stdin fields rather than accepting raw S3 coordinates", async () => {
-        await expect(runSyncMutationStdinJson(JSON.stringify({ contractVersion: 2, action: "recover", authorization: {}, attemptId: "attempt_1", bucket: "raw-bucket" }), { submit: vi.fn(), recover: vi.fn() }))
+            canonicalPath: "notes/bytes.md",
+            op: "upsert",
+            contentBase64: bytes.toString("base64"),
+        }), { submit });
+        expect(JSON.parse(output)).toEqual({ contractVersion: 2, action: "submit", requestDigest: "digest_1", status: { status: "committed", attemptId: "attempt_1", versionId: "version_1", deltaId: "delta_1" } });
+        expect(submit).toHaveBeenCalledWith({ canonicalPath: "notes/bytes.md", op: "upsert", bytes: Uint8Array.from(bytes) });
+    });
+    it("rejects unknown stdin fields rather than accepting authorization or raw S3 coordinates", async () => {
+        await expect(runSyncMutationStdinJson(JSON.stringify({ canonicalPath: "notes/a.md", op: "delete", authorization: {}, bucket: "raw-bucket" }), { submit: vi.fn() }))
             .rejects.toThrow("unknown fields");
     });
-    it("decodes contentBase64 into the immutable upsert bytes without changing the V2 request", async () => {
+    it("decodes contentBase64 into an immutable upsert byte snapshot", async () => {
         const bytes = Buffer.from("real immutable bytes\0", "utf8");
         const submit = vi.fn().mockResolvedValue({
             requestDigest: "digest_1",
             status: { status: "committed", attemptId: "attempt_1", versionId: "version_1", deltaId: "delta_1" },
         });
-        const input = {
-            authorization: { bearer: "token", deviceId: "device_a", capabilityVector: {}, lease: {} },
-            request: {
-                contractVersion: 2,
-                deviceId: "device_a",
-                clientMutationId: "mutation_1",
-                canonicalPath: "notes/bytes.md",
-                operation: "upsert",
-                baseVersionId: "version_previous",
-                generation: 7,
-                membershipRevision: "member_1",
-                scopeRevision: "scope_1",
-                source: {
-                    kind: "regular",
-                    mode: 0o644,
-                    sha256: `sha256:${createHash("sha256").update(bytes).digest("hex")}`,
-                    size: bytes.byteLength,
-                },
-            },
-        };
         await expect(runSyncMutationStdinJson(JSON.stringify({
-            contractVersion: 2,
-            action: "submit",
-            input,
+            canonicalPath: "notes/bytes.md",
+            op: "upsert",
             contentBase64: bytes.toString("base64"),
-        }), { submit, recover: vi.fn() })).resolves.toContain('"action":"submit"');
+        }), { submit })).resolves.toContain('"action":"submit"');
         const submitted = submit.mock.calls[0]?.[0];
-        expect(submitted).toMatchObject({ authorization: input.authorization, request: input.request });
+        expect(submitted).toMatchObject({ canonicalPath: "notes/bytes.md", op: "upsert" });
         expect(submitted.bytes).toBeInstanceOf(Uint8Array);
         expect(Buffer.isBuffer(submitted.bytes)).toBe(false);
         expect(Buffer.from(submitted.bytes)).toEqual(bytes);
@@ -77,14 +55,16 @@ describe("sync mutation stdin boundary", () => {
             status: { status: "committed", attemptId: "attempt_delete", versionId: null, deltaId: "delta_delete" },
         });
         await runSyncMutationStdinJson(JSON.stringify({
-            contractVersion: 2,
-            action: "submit",
-            input: {
-                authorization: { bearer: "token", deviceId: "device_a", capabilityVector: {}, lease: {} },
-                request: { operation: "delete" },
-            },
-        }), { submit, recover: vi.fn() });
-        expect(submit.mock.calls[0]?.[0]).not.toHaveProperty("bytes");
+            canonicalPath: "notes/bytes.md",
+            op: "delete",
+        }), { submit });
+        expect(submit).toHaveBeenCalledWith({ canonicalPath: "notes/bytes.md", op: "delete" });
+    });
+    it("requires bytes only for upserts", async () => {
+        await expect(runSyncMutationStdinJson(JSON.stringify({ canonicalPath: "notes/a.md", op: "upsert" }), { submit: vi.fn() }))
+            .rejects.toThrow("upsert requires contentBase64");
+        await expect(runSyncMutationStdinJson(JSON.stringify({ canonicalPath: "notes/a.md", op: "delete", contentBase64: "" }), { submit: vi.fn() }))
+            .rejects.toThrow("delete must not include contentBase64");
     });
 });
 describe("realtime durable apply boundary", () => {
@@ -138,6 +118,7 @@ import * as s3Module from "../s3.js";
 import { reindex } from "./reindex.js";
 import { readSyncProgress } from "../sync-progress.js";
 import { VaultAuthError } from "../vault-client.js";
+import { readJournal, getEntry } from "../journal.js";
 const mockConfig = {
     apiUrl: "https://vault-api.test",
     authToken: "test-jwt-token",
@@ -286,6 +267,158 @@ describe("sync", () => {
         expect(result.filesDownloaded).toBe(2);
         expect(reindex).not.toHaveBeenCalled();
     });
+    it("HQ-DESKTOP-54: a Windows symlink-privilege refusal is a deliberate skip (never type:error) and is left unjournaled", async () => {
+        // On a Windows host without SeCreateSymbolicLinkPrivilege, materializing a
+        // file-flavored vault symlink throws EPERM, which s3 surfaces as a typed
+        // WindowsSymlinkPrivilegeError. downloadOne must downgrade it to the
+        // dedicated skip event — NOT type:"error" — so the runner never counts it
+        // toward errors[] and never exits 2. The refused key must also stay
+        // unjournaled so a later privileged pass retries it.
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/skill-link.md", size: 10, lastModified: new Date(), etag: '"link"' },
+        ]);
+        vi.mocked(s3Module.downloadFile).mockRejectedValueOnce(new s3Module.WindowsSymlinkPrivilegeError("../target.md", "EPERM"));
+        const events = [];
+        const result = await sync({
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipReindex: true,
+            onEvent: (e) => events.push(e),
+        });
+        const skip = events.find((e) => e.type === "skip-symlink-privilege");
+        expect(skip).toMatchObject({
+            type: "skip-symlink-privilege",
+            path: "docs/skill-link.md",
+            target: "../target.md",
+        });
+        expect(skip.remedy).toMatch(/Developer Mode/i);
+        // Crucially, no error event — this is what keeps the runner at exit 0.
+        expect(events.some((e) => e.type === "error")).toBe(false);
+        expect(result.filesSkipped).toBeGreaterThanOrEqual(1);
+        expect(result.filesDownloaded).toBe(0);
+        // Convergence: the refused key is NOT journaled.
+        expect(getEntry(readJournal("acme"), "docs/skill-link.md")).toBeUndefined();
+    });
+    it("HQ-DESKTOP-54 convergence: after a refused pass, the next pass that CAN materialize the link journals it (no manual reset)", async () => {
+        const remote = [
+            { key: "docs/skill-link.md", size: 10, lastModified: new Date(), etag: '"link"' },
+        ];
+        // Pass 1 — privilege refusal: skipped, not journaled.
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce(remote);
+        vi.mocked(s3Module.downloadFile).mockRejectedValueOnce(new s3Module.WindowsSymlinkPrivilegeError("../target.md", "EPERM"));
+        await sync({
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipReindex: true,
+        });
+        expect(getEntry(readJournal("acme"), "docs/skill-link.md")).toBeUndefined();
+        // Pass 2 — the privilege now exists: the symlink materializes and journals.
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce(remote);
+        vi.mocked(s3Module.downloadFile).mockImplementationOnce(async (_ctx, _key, localPath) => {
+            fs.mkdirSync(path.dirname(localPath), { recursive: true });
+            fs.symlinkSync("../target.md", localPath);
+            return { metadata: {} };
+        });
+        const result = await sync({
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipReindex: true,
+        });
+        expect(result.filesDownloaded).toBe(1);
+        const entry = getEntry(readJournal("acme"), "docs/skill-link.md");
+        expect(entry).toBeDefined();
+        expect(entry.kind).toBe("symlink");
+    });
+    it("an unrelated download failure still surfaces as type:error — only the privilege refusal is downgraded", async () => {
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/x.md", size: 10, lastModified: new Date(), etag: '"x"' },
+        ]);
+        vi.mocked(s3Module.downloadFile).mockRejectedValueOnce(new Error("network boom"));
+        const events = [];
+        await sync({
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipReindex: true,
+            onEvent: (e) => events.push(e),
+        });
+        const errs = events.filter((e) => e.type === "error");
+        expect(errs).toHaveLength(1);
+        expect(errs[0].path).toBe("docs/x.md");
+        expect(events.some((e) => e.type === "skip-symlink-privilege")).toBe(false);
+    });
+    it("HQ-DESKTOP-54: a privilege refusal during the conflict-convergence probe is a skip, not an error or a counted conflict", async () => {
+        // The conflict path also materializes the remote object (to compare it
+        // against the diverged local copy). On an unprivileged Windows host that
+        // materialization throws the same typed error; it must be downgraded to the
+        // deliberate skip so the run stays complete and exits 0 — never type:error,
+        // and not counted as an unresolved conflict.
+        const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+        fs.mkdirSync(companyDocs, { recursive: true });
+        fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/handoff.md": {
+                    hash: "old-hash-from-last-sync",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        // Remote changed too → the planner classifies this as a conflict, so the
+        // convergence probe (a downloadFile) runs and refuses with the typed error.
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/handoff.md", size: 20, lastModified: new Date(), etag: '"remote-changed"' },
+        ]);
+        vi.mocked(s3Module.downloadFile).mockRejectedValueOnce(new s3Module.WindowsSymlinkPrivilegeError("../target.md", "EPERM"));
+        const events = [];
+        const result = await sync({
+            company: "acme",
+            onConflict: "keep",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipReindex: true,
+            onEvent: (e) => events.push(e),
+        });
+        expect(events).toContainEqual(expect.objectContaining({
+            type: "skip-symlink-privilege",
+            path: "docs/handoff.md",
+            target: "../target.md",
+        }));
+        expect(events.some((e) => e.type === "error")).toBe(false);
+        // Skipped, so it is NOT tallied as an unresolved conflict.
+        expect(result.conflicts).toBe(0);
+        expect(result.filesSkipped).toBeGreaterThanOrEqual(1);
+    });
+    it("HQ-DESKTOP-54: the default CLI console logger renders the symlink-privilege skip and its remedy", async () => {
+        // With no onEvent (ordinary `hq sync`), the run uses defaultConsoleLogger.
+        // The skipped path and remediation must reach the user, not vanish.
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/skill-link.md", size: 10, lastModified: new Date(), etag: '"link"' },
+        ]);
+        vi.mocked(s3Module.downloadFile).mockRejectedValueOnce(new s3Module.WindowsSymlinkPrivilegeError("../target.md", "EPERM"));
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        try {
+            await sync({
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+                skipReindex: true,
+            });
+            const rendered = warnSpy.mock.calls.map((c) => String(c[0])).join("\n");
+            expect(rendered).toContain("docs/skill-link.md");
+            expect(rendered).toMatch(/Developer Mode/i);
+        }
+        finally {
+            warnSpy.mockRestore();
+        }
+    });
     it("downloads remote files under companies/{slug}/ so two companies don't collide", async () => {
         const result = await sync({
             company: "acme",