@indigoai-us/hq-cloud 6.15.41 → 6.15.43

package/dist/cli/share.test.js

@@ -52,7 +52,7 @@ vi.mock("readline", () => ({
     })),
 }));
 import * as readline from "readline";
-import { share, isForbiddenCompanyVaultKey, ServerOwnedPushPathsError, UnreachablePushPathsError, currentUploadBytes, _testing as shareTesting } from "./share.js";
+import { share, ServerOwnedPushPathsError, UnreachablePushPathsError, currentUploadBytes, _testing as shareTesting } from "./share.js";
 import { deleteRemoteFile, downloadFile, headRemoteFile, primeObjectTransport, primeUploads, uploadFile, uploadSymlink, WindowsSymlinkPrivilegeError, } from "../s3.js";
 import { VaultAuthError } from "../vault-client.js";
 import { hashFile, readJournal, writeJournal } from "../journal.js";
@@ -7419,7 +7419,7 @@ describe("currency-gated: journal version 2 fixtures", () => {
         });
     });
 });
-describe("scope-invalid key hardening on push (doubled companies/ tree — incident 2026-07-11)", () => {
+describe("nested companies directories in a company vault", () => {
     let tmpDir;
     let stateDir;
     beforeEach(() => {
@@ -7448,18 +7448,25 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
         fs.rmSync(stateDir, { recursive: true, force: true });
         delete process.env.HQ_STATE_DIR;
     });
-    it("refuses to upload doubled-tree companies/ keys in company mode — clear per-key warning, never an error", async () => {
-        // The incident writer: a stale doubled local tree
-        // companies/acme/companies/acme/… would push literal `companies/…` keys
-        // via the direct-S3 STS transport, poisoning the bucket with keys the
-        // presign download API rejects (INVALID_KEY_COMPANIES_SCOPED) for every
-        // other machine. The push planner must refuse them up front.
+    it("plans every nested companies/ file for upload as vault-relative content", async () => {
         const companyRoot = path.join(tmpDir, "companies", "acme");
-        const doubled = path.join(companyRoot, "companies", "acme", "knowledge");
-        fs.mkdirSync(doubled, { recursive: true });
-        fs.writeFileSync(path.join(doubled, "poison.md"), "poison");
-        fs.mkdirSync(path.join(companyRoot, "docs"), { recursive: true });
-        fs.writeFileSync(path.join(companyRoot, "docs", "good.md"), "good");
+        const canonicalSkill = path.join(companyRoot, "skills", "signals");
+        const canonicalAudit = path.join(companyRoot, "audit", "chat-skills", "review");
+        fs.mkdirSync(canonicalSkill, { recursive: true });
+        fs.mkdirSync(canonicalAudit, { recursive: true });
+        fs.writeFileSync(path.join(canonicalSkill, "SKILL.md"), "skill");
+        fs.writeFileSync(path.join(canonicalAudit, "SKILL.md"), "audit");
+        // This matches the live path shape: a literal `companies/acme/...` below
+        // the acme vault root is content, not a scope selector. All 25 objects
+        // must be planned for upload rather than summarized as invalid.
+        for (let index = 0; index < 25; index++) {
+            const nestedAudit = path.join(companyRoot, "companies", "acme", "audit", "chat-skills", `stale-${index.toString().padStart(2, "0")}`);
+            fs.mkdirSync(nestedAudit, { recursive: true });
+            fs.writeFileSync(path.join(nestedAudit, "SKILL.md"), "nested");
+        }
+        const midPath = path.join(companyRoot, "audit", "companies", "notes.md");
+        fs.mkdirSync(path.dirname(midPath), { recursive: true });
+        fs.writeFileSync(midPath, "ordinary segment");
         const events = [];
         const result = await share({
             paths: [companyRoot],
@@ -7469,15 +7476,16 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
             onEvent: (e) => events.push(e),
         });
         expect(result.aborted).toBe(false);
-        expect(result.filesUploaded).toBe(1);
+        expect(result.filesUploaded).toBe(28);
         const uploadedKeys = vi.mocked(uploadFile).mock.calls.map((c) => c[2]);
-        expect(uploadedKeys).toEqual(["docs/good.md"]);
-        // Per-key warning on the existing event channel, never type:"error"
-        // (an error event flips the runner pass to exit 2 — the flood class).
-        const skipEvents = events.filter((e) => e.type === "skip-invalid-scoped-key");
-        expect(skipEvents.map((e) => e.path)).toEqual([
-            "companies/acme/knowledge/poison.md",
-        ]);
+        expect(uploadedKeys).toEqual(expect.arrayContaining([
+            "skills/signals/SKILL.md",
+            "audit/chat-skills/review/SKILL.md",
+            "companies/acme/audit/chat-skills/stale-00/SKILL.md",
+            "companies/acme/audit/chat-skills/stale-24/SKILL.md",
+            "audit/companies/notes.md",
+        ]));
+        expect(events.filter((e) => e.type === "skip-invalid-scoped-key")).toEqual([]);
         expect(events.some((e) => e.type === "error")).toBe(false);
     });
     it("never plans an upload for macOS Finder Icon\\r files — silent skip, valid files still ship", async () => {
@@ -7545,11 +7553,9 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
         ]);
         expect(events.some((e) => e.type === "error")).toBe(false);
     });
-    it("tombstones (journal drop, no remote HEAD/DELETE) a companies/ journal key in company mode instead of re-uploading", async () => {
-        // Delete-propagation on a poisoned journal entry: HEAD/DeleteObject on a
-        // companies/-prefixed key would be rejected by the presign transport's
-        // server validator, so the delete plan must route it straight to
-        // toTombstone — journal entry drained, no remote call, no re-upload.
+    it("tombstones an absent nested companies/ key after normal remote verification", async () => {
+        // A nested `companies/` directory is a normal company-vault path, so its
+        // stale journal entry follows the ordinary HEAD-confirmed cleanup path.
         const companyRoot = path.join(tmpDir, "companies", "acme");
         fs.mkdirSync(companyRoot, { recursive: true });
         const journalPath = path.join(stateDir, "sync-journal.acme.json");
@@ -7576,16 +7582,17 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
             propagateDeletePolicy: "currency-gated",
         });
         expect(result.aborted).toBe(false);
-        // Tombstoned: journal entry dropped without any remote HEAD or DELETE.
+        // The remote HEAD confirms this normal vault-relative key is absent, then
+        // the journal entry is tombstoned without re-uploading it.
         expect(result.filesTombstoned).toBe(1);
         expect(result.filesDeleted).toBe(0);
-        expect(headRemoteFile).not.toHaveBeenCalled();
+        expect(headRemoteFile).toHaveBeenCalledWith(expect.anything(), "companies/acme/knowledge/poison.md");
         expect(deleteRemoteFile).not.toHaveBeenCalled();
         expect(uploadFile).not.toHaveBeenCalled();
         const journal = journalAt(journalPath);
         expect(journal.files["companies/acme/knowledge/poison.md"]).toBeUndefined();
     });
-    it("defers an unreadable scope-invalid symlink tombstone without a fatal error", async () => {
+    it("does not follow a nested symlink that points outside the company vault", async () => {
         const companyRoot = path.join(tmpDir, "companies", "acme");
         const linkKey = "companies/acme/knowledge/unreadable-link";
         const linkPath = path.join(companyRoot, ...linkKey.split("/"));
@@ -7607,44 +7614,28 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
                 },
             },
         }));
-        const realReadlinkSync = fs.readlinkSync;
-        let linkReadCount = 0;
-        const readlinkSpy = vi
-            .spyOn(fs, "readlinkSync")
-            .mockImplementation(((candidate) => {
-            if (candidate === linkPath && ++linkReadCount === 2) {
-                throw errnoError("EINVAL");
-            }
-            return realReadlinkSync(candidate);
-        }));
         const events = [];
-        try {
-            const result = await share({
-                paths: [companyRoot],
-                company: "acme",
-                vaultConfig: mockConfig,
-                hqRoot: tmpDir,
-                skipUnchanged: true,
-                propagateDeletes: true,
-                propagateDeletePolicy: "currency-gated",
-                onEvent: (event) => events.push(event),
-            });
-            expect(linkReadCount).toBe(2);
-            expect(result.filesTombstoned).toBe(0);
-            expect(fs.lstatSync(linkPath).isSymbolicLink()).toBe(true);
-            expect(events).toContainEqual({
-                type: "not-shipped",
-                reason: "unreadable-link",
-                count: 1,
-                samplePaths: [linkKey],
-            });
-            expect(events.some((event) => event.type === "error")).toBe(false);
-            const journal = journalAt(journalPath);
-            expect(journal.files[linkKey]).toBeDefined();
-        }
-        finally {
-            readlinkSpy.mockRestore();
-        }
+        const result = await share({
+            paths: [companyRoot],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipUnchanged: true,
+            propagateDeletes: true,
+            propagateDeletePolicy: "currency-gated",
+            onEvent: (event) => events.push(event),
+        });
+        expect(result.filesTombstoned).toBe(0);
+        expect(fs.lstatSync(linkPath).isSymbolicLink()).toBe(true);
+        expect(events).toContainEqual({
+            type: "not-shipped",
+            reason: "linked-subtree",
+            count: 1,
+            samplePaths: [linkKey],
+        });
+        expect(events.some((event) => event.type === "error")).toBe(false);
+        const journal = journalAt(journalPath);
+        expect(journal.files[linkKey]).toBeDefined();
     });
     it("personal-mode push still uploads companies/{slug}/ keys (local non-cloud companies are legitimate)", async () => {
         const localCo = path.join(tmpDir, "companies", "localco");
@@ -7666,29 +7657,6 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
         expect(events.filter((e) => e.type === "skip-invalid-scoped-key")).toEqual([]);
     });
 });
-// ── Pure-function unit coverage: isForbiddenCompanyVaultKey ───────────────────
-//
-// Contract: in a COMPANY vault (personalMode=false) any key under `companies/`
-// is a doubly-scoped corrupt object and must be refused; in a PERSONAL vault
-// (personalMode=true) `companies/` keys are legitimate and handled by the
-// dedicated personalMode branch, so this guard must NOT fire there.
-describe("isForbiddenCompanyVaultKey (company-vault double-scope contract)", () => {
-    it.each([
-        // Company vault: companies/* keys are corrupt → forbidden.
-        ["companies/frogbear/drafts/reports/signals-2026-06-15.html", false, true],
-        ["companies/acme/knowledge/readme.md", false, true],
-        ["companies/manifest.yaml", false, true],
-        // Company vault: bucket-relative keys are legitimate → allowed.
-        ["docs/handoff.md", false, false],
-        ["knowledge/readme.md", false, false],
-        // Personal vault: companies/* keys are NOT forbidden here (handled by the
-        // personalMode branch, which carries its own nuanced gating).
-        ["companies/frogbear/drafts/reports/signals-2026-06-15.html", true, false],
-        ["docs/handoff.md", true, false],
-    ])("key=%s personalMode=%s → forbidden=%s", (key, personalMode, expected) => {
-        expect(isForbiddenCompanyVaultKey(key, personalMode)).toBe(expected);
-    });
-});
 // ── delete-refusal rendering ───────────────────────────────────────────────
 //
 // Every refusal cause shares ONE event type (`delete-refused-stale-etag`),