@indigoai-us/hq-cloud 6.15.24 → 6.15.26

package/dist/cli/share.test.js

@@ -88,6 +88,14 @@ function journalAt(journalPath) {
         .replace(/\.json$/, "");
     return readJournal(slug);
 }
+function sidecarIn(dir) {
+    const found = fs.readdirSync(dir).filter((name) => name.includes(".conflict-"));
+    expect(found).toHaveLength(1);
+    return path.join(dir, found[0]);
+}
+function conflictIndexAt(hqRoot) {
+    return JSON.parse(fs.readFileSync(path.join(hqRoot, ".hq-conflicts", "index.json"), "utf-8"));
+}
 const mockConfig = {
     apiUrl: "https://vault-api.test",
     authToken: "test-jwt-token",
@@ -743,7 +751,7 @@ describe("share", () => {
             expect(entry.ctimeMs).toBe(stat.ctimeMs);
         });
         it("never lets the fast path skip a localDiverges entry", async () => {
-            // A pull-kept divergent entry stores the LOCAL hash and local stat, so
+            // A pull-held divergent entry stores the LOCAL hash and local stat, so
             // every field matches by construction. Skipping on that asserts "local
             // matches remote", which is exactly what the flag exists to deny.
             const abs = writeFile("divergent.md", CONTENT_A);
@@ -988,6 +996,10 @@ describe("share", () => {
             etag: '"remote-new-etag"',
             size: 99,
         });
+        vi.mocked(downloadFile).mockImplementationOnce(async (_ctx, _key, dest) => {
+            fs.writeFileSync(dest, "remote edit");
+            return undefined;
+        });
         const journalPath = path.join(stateDir, "sync-journal.acme.json");
         seedJournalAt(journalPath, ({
             version: "1",
@@ -1020,6 +1032,24 @@ describe("share", () => {
             direction: "push",
             resolution: "keep",
         });
+        // `keep` is cloud-wins on the push leg too: remote takes the working
+        // name, while the displaced local body remains recoverable beside it.
+        expect(fs.readFileSync(testFile, "utf-8")).toBe("remote edit");
+        expect(fs.readFileSync(sidecarIn(companyRoot), "utf-8")).toBe("local edit");
+        const journal = journalAt(journalPath);
+        expect(journal.files["drifted.md"]).toMatchObject({
+            hash: hashFile(testFile),
+            remoteEtag: "remote-new-etag",
+            direction: "down",
+        });
+        const index = conflictIndexAt(tmpDir);
+        expect(index.conflicts).toHaveLength(1);
+        expect(index.conflicts[0]).toMatchObject({
+            originalPath: "companies/acme/drifted.md",
+            preserved: "local",
+        });
+        expect(fs.readFileSync(path.join(tmpDir, index.conflicts[0].conflictPath), "utf-8"))
+            .toBe("local edit");
     });
     it("cloud-authoritative: never pushes a stale local ontology/.last-run over the server value (one-sided-change clobber guard)", async () => {
         // Regression for the gardener watermark clobber. A second HQ root sharing this
@@ -1087,9 +1117,9 @@ describe("share", () => {
         //
         // Fix: even on first-time upload, if HEAD shows remote exists and
         // its content (etag) differs from what we'd put, emit a conflict.
-        // Under keep, the existing pull-side mirror routine downloads the
-        // remote bytes to \`<orig>.conflict-<ts>-<short>\` so both versions
-        // survive on disk; under abort, the company aborts before PUT.
+        // Under keep, cloud takes the original name and local moves to
+        // \`<orig>.conflict-<ts>-<short>\` so both versions survive on disk;
+        // under abort, the company aborts before PUT.
         const companyRoot = path.join(tmpDir, "companies", "acme");
         fs.mkdirSync(companyRoot, { recursive: true });
         const testFile = path.join(companyRoot, "v7b-fresh.txt");
@@ -1101,6 +1131,10 @@ describe("share", () => {
             etag: '"remote-version-etag"',
             size: 40,
         });
+        vi.mocked(downloadFile).mockImplementation(async (_ctx, _key, dest) => {
+            fs.writeFileSync(dest, "peer remote content");
+            return undefined;
+        });
         // No journal file written — first-time upload contract.
         const events = [];
         const result = await share({
@@ -1112,14 +1146,19 @@ describe("share", () => {
             onEvent: (e) => events.push(e),
         });
         expect(result.conflictPaths).toEqual(["v7b-fresh.txt"]);
-        // Under keep, local stays as-is (no upload) and the mirror records
-        // the remote bytes so neither version is lost.
+        // Under keep, no upload occurs: the remote bytes take the working name
+        // and the local body is preserved beside them.
         expect(result.filesUploaded).toBe(0);
         const conflicts = events.filter((e) => typeof e === "object" && e !== null && e.type === "conflict");
         expect(conflicts).toHaveLength(1);
         expect(conflicts[0].path).toBe("v7b-fresh.txt");
-        // Local file unmodified — it must still contain the local content.
-        expect(fs.readFileSync(testFile, "utf-8")).toBe("macos-fresh-collision-content");
+        expect(fs.readFileSync(testFile, "utf-8")).toBe("peer remote content");
+        expect(fs.readFileSync(sidecarIn(companyRoot), "utf-8")).toBe("macos-fresh-collision-content");
+        const index = conflictIndexAt(tmpDir);
+        expect(index.conflicts[0]).toMatchObject({
+            originalPath: "companies/acme/v7b-fresh.txt",
+            preserved: "local",
+        });
     });
     it("first-time-upload-with-cloud-collision: aborts company under --on-conflict abort (Bug #7)", async () => {
         // Symmetric to the keep case: when --on-conflict abort is passed, a
@@ -1147,11 +1186,11 @@ describe("share", () => {
         expect(result.filesUploaded).toBe(0);
     });
     it("HQ-DESKTOP-54: a privilege refusal while writing the push conflict mirror is a skip, not an error", async () => {
-        // The keep-mirror also materializes the remote object (to a .conflict-*
-        // file). On an unprivileged Windows host that throws the typed privilege
+        // Push keep also materializes the remote object (at the original name).
+        // On an unprivileged Windows host that throws the typed privilege
         // error; it must be downgraded to the deliberate skip so the push stays
         // complete and the runner exits 0 — never type:error. The conflict itself
-        // is still recorded and the local file is untouched.
+        // is still surfaced and the local rename is rolled back.
         const companyRoot = path.join(tmpDir, "companies", "acme");
         fs.mkdirSync(companyRoot, { recursive: true });
         const testFile = path.join(companyRoot, "v7b-priv.txt");
@@ -1162,7 +1201,7 @@ describe("share", () => {
             size: 40,
         });
         // On a real unprivileged host BOTH the fresh-collision reconciled probe and
-        // the keep-mirror materialize the remote symlink, so both downloadFile calls
+        // the keep adoption materialize the remote symlink, so both downloadFile calls
         // refuse. The probe's catch returns "differs" (conflict) without erroring;
         // the mirror must downgrade the refusal to the deliberate skip.
         vi.mocked(downloadFile)
@@ -1183,7 +1222,7 @@ describe("share", () => {
             target: "../target.md",
         }));
         expect(events.some((e) => e.type === "error")).toBe(false);
-        // The conflict is still recorded; the local file is preserved.
+        // The conflict is still surfaced; the failed adoption restores local.
         expect(result.conflictPaths).toEqual(["v7b-priv.txt"]);
         expect(fs.readFileSync(testFile, "utf-8")).toBe("local-collision-content");
     });
@@ -1295,7 +1334,7 @@ describe("share", () => {
             etag: '"0123456789abcdef0123456789abcdef-3"',
             size: 32,
         });
-        // The probe (and the subsequent keep-mirror download) return DIFFERENT
+        // The probe (and the subsequent keep adoption download) return DIFFERENT
         // remote bytes.
         vi.mocked(downloadFile).mockImplementation(async (_ctx, _key, dest) => {
             fs.writeFileSync(dest, "a-peers-different-version");
@@ -1314,8 +1353,8 @@ describe("share", () => {
         expect(result.filesUploaded).toBe(0);
         const conflicts = events.filter((e) => typeof e === "object" && e !== null && e.type === "conflict");
         expect(conflicts).toHaveLength(1);
-        // Local file untouched under keep.
-        expect(fs.readFileSync(testFile, "utf-8")).toBe("my-local-version");
+        expect(fs.readFileSync(testFile, "utf-8")).toBe("a-peers-different-version");
+        expect(fs.readFileSync(sidecarIn(companyRoot), "utf-8")).toBe("my-local-version");
     });
     describe("conditional-write fence (If-Match / If-None-Match / 412)", () => {
         const fence412 = () => Object.assign(new Error("Precondition failed"), {
@@ -1375,12 +1414,18 @@ describe("share", () => {
             });
             expect(uploadFile).toHaveBeenCalledWith(expect.anything(), testFile, "brand-new.md", undefined, { ifNoneMatch: "*" });
         });
-        it("412 under keep: conflict event + remote mirrored + ledger entry + NO journal stamp", async () => {
+        it("412 under keep: adopts the racing remote, preserves local, and converges the journal", async () => {
             const companyRoot = path.join(tmpDir, "companies", "acme");
             fs.mkdirSync(companyRoot, { recursive: true });
             const testFile = path.join(companyRoot, "raced.md");
             fs.writeFileSync(testFile, "my local bytes");
-            vi.mocked(headRemoteFile).mockResolvedValueOnce(null);
+            vi.mocked(headRemoteFile)
+                .mockResolvedValueOnce(null)
+                .mockResolvedValueOnce({
+                lastModified: new Date(),
+                etag: '"racing-peer-etag"',
+                size: 23,
+            });
             vi.mocked(uploadFile).mockRejectedValueOnce(fence412());
             vi.mocked(downloadFile).mockImplementationOnce(async (_ctx, _key, dest) => {
                 fs.writeFileSync(dest, "the racing peer version");
@@ -1400,19 +1445,22 @@ describe("share", () => {
             expect(result.filesUploaded).toBe(0);
             expect(result.aborted).toBe(false);
             expect(events.some((e) => e.type === "conflict" && e.path === "raced.md")).toBe(true);
-            // The racing remote bytes were preserved next to the local copy.
-            const mirrors = fs
-                .readdirSync(companyRoot)
-                .filter((f) => f.includes(".conflict-"));
-            expect(mirrors).toHaveLength(1);
-            // Local copy untouched.
-            expect(fs.readFileSync(testFile, "utf-8")).toBe("my local bytes");
-            // No journal stamp for the failed PUT — next pass re-evaluates fresh.
+            // The racing remote wins the working name; local remains recoverable.
+            expect(fs.readFileSync(testFile, "utf-8")).toBe("the racing peer version");
+            expect(fs.readFileSync(sidecarIn(companyRoot), "utf-8")).toBe("my local bytes");
+            // The pull-shaped result is journalled as the remote body, so the next
+            // pass does not revive the same resolved conflict.
             const journalPath = path.join(stateDir, "sync-journal.acme.json");
-            if (fs.existsSync(journalPath)) {
-                const journal = journalAt(journalPath);
-                expect(journal.files?.["raced.md"]).toBeUndefined();
-            }
+            const journal = journalAt(journalPath);
+            expect(journal.files["raced.md"]).toMatchObject({
+                hash: hashFile(testFile),
+                remoteEtag: "racing-peer-etag",
+                direction: "down",
+            });
+            expect(conflictIndexAt(tmpDir).conflicts[0]).toMatchObject({
+                originalPath: "companies/acme/raced.md",
+                preserved: "local",
+            });
         });
         it("412 under overwrite: retries exactly once WITHOUT the fence (explicit consent)", async () => {
             const companyRoot = path.join(tmpDir, "companies", "acme");
@@ -1491,6 +1539,10 @@ describe("share", () => {
                 }
                 return { etag: '"should-not-land"' };
             });
+            vi.mocked(downloadFile).mockImplementationOnce(async (_ctx, _key, dest) => {
+                fs.writeFileSync(dest, "reviewed peer body");
+                return undefined;
+            });
             const journalPath = path.join(stateDir, "sync-journal.acme.json");
             seedJournalAt(journalPath, ({
                 version: "1",
@@ -1535,8 +1587,9 @@ describe("share", () => {
             }
             // No unfenced retry under keep.
             expect(vi.mocked(uploadFile).mock.calls.some((c) => c[4] === undefined)).toBe(false);
-            // Local stale bytes preserved on disk (keep does not pull).
-            expect(fs.readFileSync(testFile, "utf-8")).toBe(staleBytes);
+            // Keep adopts the peer body but retains the stale local body beside it.
+            expect(fs.readFileSync(testFile, "utf-8")).toBe("reviewed peer body");
+            expect(fs.readFileSync(sidecarIn(path.dirname(testFile)), "utf-8")).toBe(staleBytes);
         });
         it("legitimate local-ahead still uploads when remote remains at journal baseline", async () => {
             const companyRoot = path.join(tmpDir, "companies", "acme");
@@ -1586,6 +1639,10 @@ describe("share", () => {
                 etag: '"remote-concurrent"',
                 size: 20,
             });
+            vi.mocked(downloadFile).mockImplementationOnce(async (_ctx, _key, dest) => {
+                fs.writeFileSync(dest, "remote concurrent");
+                return undefined;
+            });
             const journalPath = path.join(stateDir, "sync-journal.acme.json");
             seedJournalAt(journalPath, ({
                 version: "1",
@@ -1610,12 +1667,14 @@ describe("share", () => {
             expect(result.conflictPaths).toEqual(["both-changed.md"]);
             expect(result.filesUploaded).toBe(0);
             expect(uploadFile).not.toHaveBeenCalled();
-        });
-        it("localDiverges under keep: pull-kept divergent local cannot silently become write authority", async () => {
-            // After pull --on-conflict keep, journal stamps remoteEtag of the peer
-            // version AND localDiverges=true (local never matched that etag). A later
-            // push must not treat "remote still at stamped etag" as license to PUT
-            // the divergent local body (journal-baseline If-Match would succeed).
+            expect(fs.readFileSync(testFile, "utf-8")).toBe("remote concurrent");
+            expect(fs.readFileSync(sidecarIn(companyRoot), "utf-8")).toBe("local concurrent");
+        });
+        it("localDiverges under keep: a pull-held divergent local yields to cloud without becoming write authority", async () => {
+            // After a pull-side hold (`skip` or pull-leg `publish-local`), the journal
+            // stamps the peer remoteEtag and localDiverges=true because local never
+            // matched that etag. A later push must not treat "remote still at stamped
+            // etag" as license to PUT the divergent local body.
             const companyRoot = path.join(tmpDir, "companies", "acme");
             fs.mkdirSync(companyRoot, { recursive: true });
             const testFile = path.join(companyRoot, "kept-divergent.md");
@@ -1628,6 +1687,10 @@ describe("share", () => {
                 etag: `"${REMOTE}"`,
                 size: 40,
             });
+            vi.mocked(downloadFile).mockImplementationOnce(async (_ctx, _key, dest) => {
+                fs.writeFileSync(dest, "peer remote body");
+                return undefined;
+            });
             const journalPath = path.join(stateDir, "sync-journal.acme.json");
             seedJournalAt(journalPath, ({
                 version: "1",
@@ -1659,7 +1722,10 @@ describe("share", () => {
             expect(events.some((e) => e.type === "conflict" &&
                 e.path === "kept-divergent.md" &&
                 e.resolution === "keep")).toBe(true);
-            expect(fs.readFileSync(testFile, "utf-8")).toBe(localBytes);
+            expect(fs.readFileSync(testFile, "utf-8")).toBe("peer remote body");
+            expect(fs.readFileSync(sidecarIn(companyRoot), "utf-8")).toBe(localBytes);
+            expect(journalAt(journalPath).files["kept-divergent.md"]?.localDiverges)
+                .toBeFalsy();
         });
         it("localDiverges under overwrite: explicit intent may force-write", async () => {
             const companyRoot = path.join(tmpDir, "companies", "acme");
@@ -1816,7 +1882,7 @@ describe("share", () => {
             expect(fs.readFileSync(testFile, "utf-8")).toBe(localBytes);
         });
         // Codex review (PR #356, P1). The sync runner's push leg always calls
-        // share() with `skipUnchanged: true`, and a pull-kept entry stores the
+        // share() with `skipUnchanged: true`, and a pull-held entry stores the
         // CURRENT local hash — that is exactly what the journal-honesty stamp
         // records. So `existing.hash === localHash` is true for every stuck file,
         // classifyPushCandidates() returns `skip-unchanged`, and executeUploads()
@@ -1829,7 +1895,7 @@ describe("share", () => {
             const companyRoot = path.join(tmpDir, "companies", "acme");
             fs.mkdirSync(companyRoot, { recursive: true });
             const testFile = path.join(companyRoot, "stuck-under-skip-unchanged.md");
-            const localBytes = "the body a pull-keep stamped and then refused to publish";
+            const localBytes = "the body a pull hold stamped and then refused to publish";
             fs.writeFileSync(testFile, localBytes);
             const localHash = hashFile(testFile);
             const REMOTE = "etag-at-keep-time";
@@ -1845,7 +1911,7 @@ describe("share", () => {
                 lastSync: new Date().toISOString(),
                 files: {
                     "stuck-under-skip-unchanged.md": {
-                        // Deliberately the CURRENT local hash: this is what a pull-keep
+                        // Deliberately the CURRENT local hash: this is what a pull hold
                         // writes, and it is what makes the fast path swallow the file.
                         hash: localHash,
                         size: localBytes.length,
@@ -2054,14 +2120,20 @@ describe("share", () => {
                 direction: "up",
             });
         });
-        it("deleted journaled remote + concurrent create 412 under keep: existing conflict semantics", async () => {
+        it("deleted journaled remote + concurrent create 412 under keep: adopts the winner and preserves local", async () => {
             // Same setup as recreation, but a peer creates the key between HEAD and
-            // PUT → If-None-Match:* 412s → keep surfaces conflict, no journal stamp.
+            // PUT → If-None-Match:* 412s → keep adopts the peer's winning create.
             const companyRoot = path.join(tmpDir, "companies", "acme");
             fs.mkdirSync(companyRoot, { recursive: true });
             const testFile = path.join(companyRoot, "race-recreate.md");
             fs.writeFileSync(testFile, "my recreated local");
-            vi.mocked(headRemoteFile).mockResolvedValueOnce(null);
+            vi.mocked(headRemoteFile)
+                .mockResolvedValueOnce(null)
+                .mockResolvedValueOnce({
+                lastModified: new Date(),
+                etag: '"peer-created-etag"',
+                size: 18,
+            });
             vi.mocked(uploadFile).mockRejectedValueOnce(fence412());
             vi.mocked(downloadFile).mockImplementationOnce(async (_ctx, _key, dest) => {
                 fs.writeFileSync(dest, "peer created first");
@@ -2098,12 +2170,15 @@ describe("share", () => {
             // First (only) attempt must be create-fenced; no unfenced retry under keep.
             expect(uploadFile).toHaveBeenCalledTimes(1);
             expect(vi.mocked(uploadFile).mock.calls[0][4]).toEqual({ ifNoneMatch: "*" });
-            // Journal not advanced to a successful upload etag (entry may still be
-            // the prior baseline — next pass re-evaluates).
+            // Journal now describes the peer body at the original name.
             const journal = journalAt(journalPath);
-            expect(journal.files["race-recreate.md"]?.remoteEtag).toBe("etag-before-delete");
-            expect(journal.files["race-recreate.md"]?.hash).toBe("old-hash");
-            expect(fs.readFileSync(testFile, "utf-8")).toBe("my recreated local");
+            expect(journal.files["race-recreate.md"]).toMatchObject({
+                remoteEtag: "peer-created-etag",
+                hash: hashFile(testFile),
+                direction: "down",
+            });
+            expect(fs.readFileSync(testFile, "utf-8")).toBe("peer created first");
+            expect(fs.readFileSync(sidecarIn(companyRoot), "utf-8")).toBe("my recreated local");
         });
     });
     it("scoped push (plan-exceeds-grant): syncs the in-scope subset, skips out-of-scope paths, never aborts (feedback_ded09d56)", async () => {