@indigoai-us/hq-cloud 6.15.42 → 6.15.44

package/dist/cli/share.test.js

@@ -52,7 +52,7 @@ vi.mock("readline", () => ({
     })),
 }));
 import * as readline from "readline";
-import { share, isForbiddenCompanyVaultKey, ServerOwnedPushPathsError, UnreachablePushPathsError, currentUploadBytes, _testing as shareTesting } from "./share.js";
+import { share, ServerOwnedPushPathsError, UnreachablePushPathsError, currentUploadBytes, _testing as shareTesting } from "./share.js";
 import { deleteRemoteFile, downloadFile, headRemoteFile, primeObjectTransport, primeUploads, uploadFile, uploadSymlink, WindowsSymlinkPrivilegeError, } from "../s3.js";
 import { VaultAuthError } from "../vault-client.js";
 import { hashFile, readJournal, writeJournal } from "../journal.js";
@@ -363,6 +363,9 @@ function setupFetchMock() {
         if (urlStr.includes("/sts/vend")) {
             return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
         }
+        if (urlStr.includes("/v1/files/tombstones")) {
+            return { ok: true, status: 200, json: async () => ({ tombstones: [] }), text: async () => "" };
+        }
         return { ok: false, status: 404, text: async () => "Not found" };
     });
     vi.stubGlobal("fetch", fetchMock);
@@ -2979,7 +2982,6 @@ describe("share", () => {
                     e.type === "scope-excluded" ||
                     e.type === "scope-materialization-gap" ||
                     e.type === "ignore-excluded" ||
-                    e.type === "skip-invalid-scoped-key-summary" ||
                     e.type === "not-shipped" ||
                     e.type === "push-refused-server-owned-summary" ||
                     e.type === "delete-refused-bulk-asymmetry")
@@ -7420,7 +7422,7 @@ describe("currency-gated: journal version 2 fixtures", () => {
         });
     });
 });
-describe("scope-invalid key hardening on push (doubled companies/ tree — incident 2026-07-11)", () => {
+describe("nested companies directories in a company vault", () => {
     let tmpDir;
     let stateDir;
     beforeEach(() => {
@@ -7449,9 +7451,7 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
         fs.rmSync(stateDir, { recursive: true, force: true });
         delete process.env.HQ_STATE_DIR;
     });
-    it("uploads canonical company skill/audit keys but summarizes every doubled-tree key without widening cross-company acceptance", async () => {
-        // A real company file is rooted at companies/<slug>/, so these canonical
-        // paths MUST become bucket-relative keys and be planned for upload.
+    it("plans every nested companies/ file for upload as vault-relative content", async () => {
         const companyRoot = path.join(tmpDir, "companies", "acme");
         const canonicalSkill = path.join(companyRoot, "skills", "signals");
         const canonicalAudit = path.join(companyRoot, "audit", "chat-skills", "review");
@@ -7459,17 +7459,17 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
         fs.mkdirSync(canonicalAudit, { recursive: true });
         fs.writeFileSync(path.join(canonicalSkill, "SKILL.md"), "skill");
         fs.writeFileSync(path.join(canonicalAudit, "SKILL.md"), "audit");
-        // Conversely, a literal companies/<slug>/ segment BELOW the company root
-        // is a stale doubled tree. A different slug is also rejected: accepting it
-        // would permit a cross-company key in acme's already-scoped bucket.
-        const foreign = path.join(companyRoot, "companies", "aardvark", "skills", "foreign");
-        fs.mkdirSync(foreign, { recursive: true });
-        fs.writeFileSync(path.join(foreign, "SKILL.md"), "foreign");
-        for (let index = 0; index < 24; index++) {
-            const doubledAudit = path.join(companyRoot, "companies", "acme", "audit", "chat-skills", `stale-${index.toString().padStart(2, "0")}`);
-            fs.mkdirSync(doubledAudit, { recursive: true });
-            fs.writeFileSync(path.join(doubledAudit, "SKILL.md"), "stale");
+        // This matches the live path shape: a literal `companies/acme/...` below
+        // the acme vault root is content, not a scope selector. All 25 objects
+        // must be planned for upload rather than summarized as invalid.
+        for (let index = 0; index < 25; index++) {
+            const nestedAudit = path.join(companyRoot, "companies", "acme", "audit", "chat-skills", `stale-${index.toString().padStart(2, "0")}`);
+            fs.mkdirSync(nestedAudit, { recursive: true });
+            fs.writeFileSync(path.join(nestedAudit, "SKILL.md"), "nested");
         }
+        const midPath = path.join(companyRoot, "audit", "companies", "notes.md");
+        fs.mkdirSync(path.dirname(midPath), { recursive: true });
+        fs.writeFileSync(midPath, "ordinary segment");
         const events = [];
         const result = await share({
             paths: [companyRoot],
@@ -7479,27 +7479,16 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
             onEvent: (e) => events.push(e),
         });
         expect(result.aborted).toBe(false);
-        expect(result.filesUploaded).toBe(2);
+        expect(result.filesUploaded).toBe(28);
         const uploadedKeys = vi.mocked(uploadFile).mock.calls.map((c) => c[2]);
         expect(uploadedKeys).toEqual(expect.arrayContaining([
             "skills/signals/SKILL.md",
             "audit/chat-skills/review/SKILL.md",
+            "companies/acme/audit/chat-skills/stale-00/SKILL.md",
+            "companies/acme/audit/chat-skills/stale-24/SKILL.md",
+            "audit/companies/notes.md",
         ]));
-        expect(uploadedKeys).not.toContain("companies/aardvark/skills/foreign/SKILL.md");
-        // One bounded summary retains the true total (25) while preventing the
-        // per-path event flood on every watch pass. The foreign key appears in the
-        // sample, pinning the cross-company tenant-boundary rejection directly.
         expect(events.filter((e) => e.type === "skip-invalid-scoped-key")).toEqual([]);
-        expect(events.filter((e) => e.type === "skip-invalid-scoped-key-summary")).toEqual([
-            {
-                type: "skip-invalid-scoped-key-summary",
-                count: 25,
-                samplePaths: expect.arrayContaining([
-                    "companies/aardvark/skills/foreign/SKILL.md",
-                ]),
-                errorCode: "INVALID_KEY_COMPANIES_SCOPED",
-            },
-        ]);
         expect(events.some((e) => e.type === "error")).toBe(false);
     });
     it("never plans an upload for macOS Finder Icon\\r files — silent skip, valid files still ship", async () => {
@@ -7567,11 +7556,9 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
         ]);
         expect(events.some((e) => e.type === "error")).toBe(false);
     });
-    it("tombstones (journal drop, no remote HEAD/DELETE) a companies/ journal key in company mode instead of re-uploading", async () => {
-        // Delete-propagation on a poisoned journal entry: HEAD/DeleteObject on a
-        // companies/-prefixed key would be rejected by the presign transport's
-        // server validator, so the delete plan must route it straight to
-        // toTombstone — journal entry drained, no remote call, no re-upload.
+    it("tombstones an absent nested companies/ key after normal remote verification", async () => {
+        // A nested `companies/` directory is a normal company-vault path, so its
+        // stale journal entry follows the ordinary HEAD-confirmed cleanup path.
         const companyRoot = path.join(tmpDir, "companies", "acme");
         fs.mkdirSync(companyRoot, { recursive: true });
         const journalPath = path.join(stateDir, "sync-journal.acme.json");
@@ -7598,16 +7585,17 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
             propagateDeletePolicy: "currency-gated",
         });
         expect(result.aborted).toBe(false);
-        // Tombstoned: journal entry dropped without any remote HEAD or DELETE.
+        // The remote HEAD confirms this normal vault-relative key is absent, then
+        // the journal entry is tombstoned without re-uploading it.
         expect(result.filesTombstoned).toBe(1);
         expect(result.filesDeleted).toBe(0);
-        expect(headRemoteFile).not.toHaveBeenCalled();
+        expect(headRemoteFile).toHaveBeenCalledWith(expect.anything(), "companies/acme/knowledge/poison.md");
         expect(deleteRemoteFile).not.toHaveBeenCalled();
         expect(uploadFile).not.toHaveBeenCalled();
         const journal = journalAt(journalPath);
         expect(journal.files["companies/acme/knowledge/poison.md"]).toBeUndefined();
     });
-    it("defers an unreadable scope-invalid symlink tombstone without a fatal error", async () => {
+    it("does not follow a nested symlink that points outside the company vault", async () => {
         const companyRoot = path.join(tmpDir, "companies", "acme");
         const linkKey = "companies/acme/knowledge/unreadable-link";
         const linkPath = path.join(companyRoot, ...linkKey.split("/"));
@@ -7629,44 +7617,28 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
                 },
             },
         }));
-        const realReadlinkSync = fs.readlinkSync;
-        let linkReadCount = 0;
-        const readlinkSpy = vi
-            .spyOn(fs, "readlinkSync")
-            .mockImplementation(((candidate) => {
-            if (candidate === linkPath && ++linkReadCount === 2) {
-                throw errnoError("EINVAL");
-            }
-            return realReadlinkSync(candidate);
-        }));
         const events = [];
-        try {
-            const result = await share({
-                paths: [companyRoot],
-                company: "acme",
-                vaultConfig: mockConfig,
-                hqRoot: tmpDir,
-                skipUnchanged: true,
-                propagateDeletes: true,
-                propagateDeletePolicy: "currency-gated",
-                onEvent: (event) => events.push(event),
-            });
-            expect(linkReadCount).toBe(2);
-            expect(result.filesTombstoned).toBe(0);
-            expect(fs.lstatSync(linkPath).isSymbolicLink()).toBe(true);
-            expect(events).toContainEqual({
-                type: "not-shipped",
-                reason: "unreadable-link",
-                count: 1,
-                samplePaths: [linkKey],
-            });
-            expect(events.some((event) => event.type === "error")).toBe(false);
-            const journal = journalAt(journalPath);
-            expect(journal.files[linkKey]).toBeDefined();
-        }
-        finally {
-            readlinkSpy.mockRestore();
-        }
+        const result = await share({
+            paths: [companyRoot],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            skipUnchanged: true,
+            propagateDeletes: true,
+            propagateDeletePolicy: "currency-gated",
+            onEvent: (event) => events.push(event),
+        });
+        expect(result.filesTombstoned).toBe(0);
+        expect(fs.lstatSync(linkPath).isSymbolicLink()).toBe(true);
+        expect(events).toContainEqual({
+            type: "not-shipped",
+            reason: "linked-subtree",
+            count: 1,
+            samplePaths: [linkKey],
+        });
+        expect(events.some((event) => event.type === "error")).toBe(false);
+        const journal = journalAt(journalPath);
+        expect(journal.files[linkKey]).toBeDefined();
     });
     it("personal-mode push still uploads companies/{slug}/ keys (local non-cloud companies are legitimate)", async () => {
         const localCo = path.join(tmpDir, "companies", "localco");
@@ -7688,29 +7660,6 @@ describe("scope-invalid key hardening on push (doubled companies/ tree — incid
         expect(events.filter((e) => e.type === "skip-invalid-scoped-key")).toEqual([]);
     });
 });
-// ── Pure-function unit coverage: isForbiddenCompanyVaultKey ───────────────────
-//
-// Contract: in a COMPANY vault (personalMode=false) any key under `companies/`
-// is a doubly-scoped corrupt object and must be refused; in a PERSONAL vault
-// (personalMode=true) `companies/` keys are legitimate and handled by the
-// dedicated personalMode branch, so this guard must NOT fire there.
-describe("isForbiddenCompanyVaultKey (company-vault double-scope contract)", () => {
-    it.each([
-        // Company vault: companies/* keys are corrupt → forbidden.
-        ["companies/frogbear/drafts/reports/signals-2026-06-15.html", false, true],
-        ["companies/acme/knowledge/readme.md", false, true],
-        ["companies/manifest.yaml", false, true],
-        // Company vault: bucket-relative keys are legitimate → allowed.
-        ["docs/handoff.md", false, false],
-        ["knowledge/readme.md", false, false],
-        // Personal vault: companies/* keys are NOT forbidden here (handled by the
-        // personalMode branch, which carries its own nuanced gating).
-        ["companies/frogbear/drafts/reports/signals-2026-06-15.html", true, false],
-        ["docs/handoff.md", true, false],
-    ])("key=%s personalMode=%s → forbidden=%s", (key, personalMode, expected) => {
-        expect(isForbiddenCompanyVaultKey(key, personalMode)).toBe(expected);
-    });
-});
 // ── delete-refusal rendering ───────────────────────────────────────────────
 //
 // Every refusal cause shares ONE event type (`delete-refused-stale-etag`),