@indigoai-us/hq-cloud 6.15.42 → 6.15.44

package/dist/cli/sync.test.js

@@ -1809,13 +1809,13 @@ describe("sync", () => {
         const sweptJournal = journalAt(journalPath);
         expect(sweptJournal.files[ignoredKey]).toBeDefined();
     });
-    it("tombstone lookup failure does not resurrect a current intent-backed delete", async () => {
+    it("tombstone lookup failure fails closed before a current intent-backed delete can resurrect", async () => {
         const key = "docs/watcher-deleted.md";
         const localPath = path.join(tmpDir, "companies", "acme", key);
         vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
             { key, size: 42, lastModified: new Date(), etag: '"cur123"' },
         ]);
-        setupFetchMock({ tombstoneFailure: true });
+        const fetchMock = setupFetchMock({ tombstoneFailure: true });
         fs.writeFileSync(journalPath, JSON.stringify({
             version: "2",
             lastSync: new Date().toISOString(),
@@ -1837,11 +1837,18 @@ describe("sync", () => {
             },
             pulls: [],
         }));
-        await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+        const log = vi.spyOn(console, "error").mockImplementation(() => { });
+        try {
+            await expect(sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir })).rejects.toThrow("refusing to sync without delete suppression");
+            expect(log).toHaveBeenCalledWith(expect.stringContaining("WARN tombstone fetch attempt 3/3 failed"));
+            expect(fetchMock.mock.calls.filter((call) => String(call[0]).includes("/v1/files/tombstones"))).toHaveLength(3);
+        }
+        finally {
+            log.mockRestore();
+        }
         expect(s3Module.downloadFile).not.toHaveBeenCalledWith(expect.anything(), key, expect.anything(), expect.anything());
         expect(fs.existsSync(localPath)).toBe(false);
-        expect(journalAt(journalPath).files[key]
-            ?.removedReason).toBe("local-delete");
+        expect(journalAt(journalPath).files[key]?.localDeleteIntent).toBeDefined();
     });
     it("pull producer: a BULK disappearance is drift-restored, NOT tombstoned (ridge-incident guard in the pull leg)", async () => {
         // 12 clean files vanish at once (corrupt mirror / bulk rm / checkout). The
@@ -3249,18 +3256,11 @@ describe("sync", () => {
         expect(result.filesDownloaded).toBe(1);
         expect(result.filesExcludedByPolicy).toBeGreaterThanOrEqual(1);
     });
-    it("skips remote keys under companies/<slug>/ in a company vault (doubly-scoped corrupt object — frogbear exit-2 regression)", async () => {
-        // A company vault is already anchored at its company root, so its keys are
-        // bucket-relative. A remote key literally beginning with `companies/...` is
-        // a doubly-scoped corrupt object: the vault-service refuses to presign it
-        // (INVALID_KEY_COMPANIES_SCOPED), so the per-file GET fails and the whole
-        // company wedges at "errored" (runner exit 2) on every run. Verified live
-        // 2026-06-16 against frogbear. The pull planner must refuse it at planning
-        // time — same policy bucket as the malformed-key / ephemeral filters.
-        const corruptKey = "companies/acme/drafts/reports/signals-2026-06-15.html";
+    it("round-trips a companies/ key into the identical nested company-vault path", async () => {
+        const nestedKey = "companies/acme/audit/chat-skills/x.json";
         vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
-            // Doubly-scoped corrupt key — must be filtered, never downloaded.
-            { key: corruptKey, size: 2152, lastModified: new Date(), etag: '"corrupt"' },
+            // `companies/` is an ordinary directory beneath this company's root.
+            { key: nestedKey, size: 2152, lastModified: new Date(), etag: '"nested"' },
             // A legitimate bucket-relative key — must still download.
             { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"ok"' },
         ]);
@@ -3270,17 +3270,12 @@ describe("sync", () => {
             hqRoot: tmpDir,
         });
         const companyRoot = path.join(tmpDir, "companies", "acme");
-        // The corrupt key MUST NOT be materialized at its doubled local path.
-        expect(fs.existsSync(path.join(companyRoot, "companies", "acme", "drafts", "reports", "signals-2026-06-15.html"))).toBe(false);
-        // The vault-service GET must never be attempted for the corrupt key — the
-        // failing presign is the exact symptom this guard removes.
-        for (const call of vi.mocked(s3Module.downloadFile).mock.calls) {
-            expect(call[1]).not.toBe(corruptKey);
-        }
+        // The remote key materializes exactly beneath the selected company root.
+        expect(fs.existsSync(path.join(companyRoot, "companies", "acme", "audit", "chat-skills", "x.json"))).toBe(true);
+        expect(vi.mocked(s3Module.downloadFile).mock.calls.map((call) => call[1])).toContain(nestedKey);
         // The legitimate bucket-relative key MUST still download.
         expect(fs.existsSync(path.join(companyRoot, "docs", "handoff.md"))).toBe(true);
-        expect(result.filesDownloaded).toBe(1);
-        expect(result.filesExcludedByPolicy).toBeGreaterThanOrEqual(1);
+        expect(result.filesDownloaded).toBe(2);
         expect(result.aborted).toBe(false);
     });
     it("F02: rejects traversal remote keys before they can escape the company root", async () => {
@@ -4753,7 +4748,7 @@ describe("reportNewFilesToNotify chunking (server cap = 1000 files/report)", ()
         expect(fetchMock).not.toHaveBeenCalled();
     });
 });
-describe("scope-invalid key hardening (companies/ prefix in a company vault — incident 2026-07-11)", () => {
+describe("nested companies directories in a company vault", () => {
     let tmpDir;
     let stateDir;
     let journalPath;
@@ -4781,15 +4776,15 @@ describe("scope-invalid key hardening (companies/ prefix in a company vault —
         fs.rmSync(stateDir, { recursive: true, force: true });
         delete process.env.HQ_STATE_DIR;
     });
-    it("skips a companies/-prefixed remote key instead of erroring the whole company sync", async () => {
-        // The incident shape: 25 poisoned `companies/indigo/…` objects in the
-        // company bucket; the presign download API rejects them
-        // (INVALID_KEY_COMPANIES_SCOPED), so attempting to download errored the
-        // whole company sync and gated heartbeat toolset refreshes fleet-wide.
-        // One bad object must never take down a company sync.
+    it("downloads the live 25-file nested companies/ shape without a skip event", async () => {
         vi.mocked(s3Module.listRemoteFiles).mockReset();
         vi.mocked(s3Module.listRemoteFiles).mockResolvedValue([
-            { key: "companies/acme/knowledge/poison.md", size: 10, lastModified: new Date(), etag: '"p1"' },
+            ...Array.from({ length: 25 }, (_, index) => ({
+                key: `companies/acme/audit/chat-skills/file-${index.toString().padStart(2, "0")}.json`,
+                size: 10,
+                lastModified: new Date(),
+                etag: `"nested-${index}"`,
+            })),
             { key: "docs/good.md", size: 5, lastModified: new Date(), etag: '"g1"' },
         ]);
         const events = [];
@@ -4799,26 +4794,16 @@ describe("scope-invalid key hardening (companies/ prefix in a company vault —
             hqRoot: tmpDir,
             onEvent: (e) => events.push(e),
         });
-        // The good file syncs; the poisoned key is never downloaded.
         expect(result.aborted).toBe(false);
-        expect(result.filesDownloaded).toBe(1);
+        expect(result.filesDownloaded).toBe(26);
         expect(fs.existsSync(path.join(tmpDir, "companies", "acme", "docs", "good.md"))).toBe(true);
-        expect(fs.existsSync(path.join(tmpDir, "companies", "acme", "companies", "acme", "knowledge", "poison.md"))).toBe(false);
+        expect(fs.existsSync(path.join(tmpDir, "companies", "acme", "companies", "acme", "audit", "chat-skills", "file-24.json"))).toBe(true);
         const downloadedKeys = vi
             .mocked(s3Module.downloadFile)
             .mock.calls.map((c) => c[1]);
-        expect(downloadedKeys).not.toContain("companies/acme/knowledge/poison.md");
-        // Counted as policy-excluded, surfaced as a benign per-key warning event —
-        // deliberately NOT type:"error" (an error event flips the runner to exit 2).
-        expect(result.filesExcludedByPolicy).toBeGreaterThanOrEqual(1);
+        expect(downloadedKeys).toContain("companies/acme/audit/chat-skills/file-00.json");
         const skipEvents = events.filter((e) => e.type === "skip-invalid-scoped-key");
-        expect(skipEvents).toEqual([
-            {
-                type: "skip-invalid-scoped-key",
-                path: "companies/acme/knowledge/poison.md",
-                errorCode: "INVALID_KEY_COMPANIES_SCOPED",
-            },
-        ]);
+        expect(skipEvents).toEqual([]);
         expect(events.filter((e) => e.type === "error")).toEqual([]);
     });
     it("skips a control-character remote key before presigning while transferring valid keys", async () => {
@@ -4861,13 +4846,9 @@ describe("scope-invalid key hardening (companies/ prefix in a company vault —
         ]);
         expect(events.filter((event) => event.type === "error")).toEqual([]);
     });
-    it("cleans a doubled-tree journal entry via tombstone (local delete + journal drop) without HEAD-verifying the invalid key", async () => {
-        // A doubled local tree (companies/acme/companies/acme/…) previously
-        // poisoned the bucket; the poisoned objects were deleted server-side.
-        // The journal entry at the invalid key must drain as a tombstone —
-        // local copy removed, journal entry dropped — and must NOT be
-        // HEAD-verified (the presign transport rejects the key, which would
-        // defer the tombstone forever) and must NOT be re-uploaded.
+    it("tombstones a remote-missing nested companies/ journal entry after HEAD verification", async () => {
+        // A nested `companies/` key follows the same protected journal-tombstone
+        // path as every other vault-relative file.
         const companyRoot = path.join(tmpDir, "companies", "acme");
         const doubled = path.join(companyRoot, "companies", "acme", "knowledge");
         fs.mkdirSync(doubled, { recursive: true });
@@ -4890,25 +4871,25 @@ describe("scope-invalid key hardening (companies/ prefix in a company vault —
                 },
             },
         }));
-        // Remote LIST no longer contains the poisoned key (manual cleanup done).
+        // Remote LIST no longer contains the nested key.
         vi.mocked(s3Module.listRemoteFiles).mockReset();
         vi.mocked(s3Module.listRemoteFiles).mockResolvedValue([]);
+        vi.mocked(s3Module.headRemoteFile).mockResolvedValue(null);
         const result = await sync({
             company: "acme",
             vaultConfig: mockConfig,
             hqRoot: tmpDir,
         });
-        // Cleaned, not re-uploaded: local doubled-tree copy gone, journal dropped.
+        // Cleaned, not re-uploaded: local nested copy gone, journal dropped.
         expect(fs.existsSync(path.join(doubled, "poison.md"))).toBe(false);
         expect(result.filesTombstoned).toBeGreaterThanOrEqual(1);
         const journal = journalAt(journalPath);
         expect(journal.files["companies/acme/knowledge/poison.md"]).toBeUndefined();
-        // No HEAD verify against the invalid key — the server validator would
-        // reject it (INVALID_KEY_COMPANIES_SCOPED) and defer the cleanup forever.
+        // The normal HEAD verification confirms it is safe to tombstone.
         const headKeys = vi
             .mocked(s3Module.headRemoteFile)
             .mock.calls.map((c) => c[1]);
-        expect(headKeys).not.toContain("companies/acme/knowledge/poison.md");
+        expect(headKeys).toContain("companies/acme/knowledge/poison.md");
         // Never re-uploaded.
         expect(vi.mocked(s3Module.uploadFile)).not.toHaveBeenCalled();
     });