@indigoai-us/hq-cloud 6.15.78 → 6.15.80

package/dist/cli/share.js

@@ -26,6 +26,7 @@ import { isCloudAuthoritative } from "../lib/cloud-authoritative.js";
 import { VaultAuthError, VaultClient, } from "../vault-client.js";
 import { describeError } from "../lib/describe-error.js";
 import { readlinkOrNull } from "../lib/readlink-safe.js";
+import { checkpointReconcileApply } from "../sync/reconcile-cursor.js";
 /**
  * Push-side fresh-collision convergence probe.
  *
@@ -686,6 +687,20 @@ export async function share(options) {
     await executeDeletes(run, plans.deletePlan, plans.decommissionPlan, counters, filesRefusedStalePaths, pathResults, !uploadResult.hadUploadFailure && uploadResult.workerErrors.length === 0);
     finalizeShareJournal(run);
     throwUploadWorkerErrors(uploadResult.workerErrors);
+    // A reconcile cursor is an all-or-nothing boundary for this bounded apply
+    // slice. Upload and delete errors are intentionally reported per-path so an
+    // ordinary runner can continue, but none of those retryable outcomes may
+    // move the cursor beyond the failed mutation.
+    if (!uploadResult.hadUploadFailure &&
+        uploadResult.workerErrors.length === 0 &&
+        !pathResults.some((result) => result.status === "refused")) {
+        checkpointReconcileApply(options.reconcileApply, [
+            ...plans.pushPlan.items.map((item) => item.relativePath),
+            ...plans.deletePlan.toDelete.map((item) => item.key),
+            ...plans.deletePlan.toTombstone,
+            ...plans.decommissionPlan,
+        ]);
+    }
     return buildShareResult(run, counters, filesRefusedStalePaths, conflictPaths, pathResults, false);
 }
 /**
@@ -899,7 +914,11 @@ function skillRegistrarForRun(run) {
     if (!run.vaultConfig)
         return undefined;
     const client = new VaultClient(run.vaultConfig);
-    return ({ companySlug, path: skillPath, content }) => client.registerCompanySkill(companySlug, { path: skillPath, content });
+    return ({ companySlug, path: skillPath, content, landed }) => client.registerCompanySkill(companySlug, {
+        path: skillPath,
+        content,
+        ...(landed === true ? { landed: true } : {}),
+    });
 }
 function assertValidSkillRegistration(result, expectedPath) {
     const stampedUid = parseRegisteredCompanySkillUid(result.content);
@@ -943,18 +962,106 @@ async function registerOneCompanySkill(run, entry, registrar) {
 async function preflightCompanySkillIdentities(run, entries) {
     if (run.options.personalMode === true || run.ctx.uid.startsWith("prs_"))
         return;
-    const unstamped = entries.filter((entry) => entry.kind === "file" &&
-        CANONICAL_COMPANY_SKILL_RE.test(entry.relativePath) &&
-        !parseRegisteredCompanySkillUid(fs.readFileSync(entry.absolutePath, "utf8")));
-    if (unstamped.length === 0)
+    const canonical = entries.filter((entry) => entry.kind === "file" &&
+        CANONICAL_COMPANY_SKILL_RE.test(entry.relativePath));
+    const unstamped = canonical.filter((entry) => !parseRegisteredCompanySkillUid(fs.readFileSync(entry.absolutePath, "utf8")));
+    const pending = canonical.filter((entry) => {
+        const journalEntry = run.journal.files[entry.relativePath];
+        return (journalEntry?.skillMetadataPending === true &&
+            journalEntry.hash === hashFile(entry.absolutePath));
+    });
+    if (unstamped.length === 0 && pending.length === 0)
         return;
     const registrar = skillRegistrarForRun(run);
     if (!registrar) {
-        throw new UnregisteredCompanySkillError(unstamped.map((entry) => entry.relativePath));
+        if (unstamped.length > 0) {
+            throw new UnregisteredCompanySkillError(unstamped.map((entry) => entry.relativePath));
+        }
+        return;
     }
     for (const entry of unstamped) {
         await registerOneCompanySkill(run, entry, registrar);
     }
+    for (const entry of pending) {
+        const journalEntry = run.journal.files[entry.relativePath];
+        run.options.onHeartbeat?.();
+        const remote = await headRemoteFile(run.ctx, entry.relativePath);
+        if (!remote) {
+            // The upload this marker referred to no longer exists. Drop the stale
+            // baseline so the normal planner cannot skip the local file as unchanged
+            // and will upload it again on this pass.
+            delete run.journal.files[entry.relativePath];
+            flushShareJournal(run);
+            continue;
+        }
+        if (!journalEntry?.remoteEtag ||
+            normalizeEtag(remote.etag) !== normalizeEtag(journalEntry.remoteEtag)) {
+            // The successful PUT this marker describes is no longer the live remote
+            // object. Reconcile the current remote bytes instead of stranding the old
+            // marker behind skipUnchanged; the backend independently revalidates this
+            // exact content against S3 before accepting its metadata.
+            // Invalidate the stale baseline before any network work. If recovery
+            // fails, the next pass must still see a real divergence rather than
+            // classifying the local file as unchanged forever.
+            delete run.journal.files[entry.relativePath];
+            flushShareJournal(run);
+            const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-skill-metadata-"));
+            const tempFile = path.join(tempDir, "SKILL.md");
+            try {
+                await downloadFile(run.ctx, entry.relativePath, tempFile);
+                await reconcileLandedCompanySkill(run, entry.relativePath, fs.readFileSync(tempFile, "utf8"));
+            }
+            finally {
+                fs.rmSync(tempDir, { recursive: true, force: true });
+            }
+            continue;
+        }
+        const landedBytes = fs.readFileSync(entry.absolutePath);
+        const landedHash = crypto
+            .createHash("sha256")
+            .update(landedBytes)
+            .digest("hex");
+        if (landedHash !== journalEntry.hash) {
+            // The editor saved after this entry was classified but before the
+            // remote proof returned. Reconcile only the single local snapshot that
+            // produced the journaled upload; the newer edit belongs to the planner.
+            continue;
+        }
+        await reconcileLandedCompanySkill(run, entry.relativePath, landedBytes.toString("utf8"));
+        delete run.journal.files[entry.relativePath]?.skillMetadataPending;
+        checkpointShareJournal(run);
+    }
+}
+/**
+ * Reconcile metadata only after the canonical bytes have landed. Identity
+ * reservation happens before upload; tags and other source-authored metadata
+ * must not become authoritative until the S3 write succeeds.
+ */
+async function reconcileLandedCompanySkill(run, relativePath, content) {
+    if (run.options.personalMode === true ||
+        run.ctx.uid.startsWith("prs_") ||
+        !CANONICAL_COMPANY_SKILL_RE.test(relativePath)) {
+        return;
+    }
+    const registrar = skillRegistrarForRun(run);
+    if (!registrar) {
+        return;
+    }
+    const localUid = parseRegisteredCompanySkillUid(content);
+    if (!localUid) {
+        throw new UnregisteredCompanySkillError([relativePath]);
+    }
+    run.options.onHeartbeat?.();
+    const result = await registrar({
+        companySlug: run.ctx.slug,
+        path: relativePath,
+        content,
+        landed: true,
+    });
+    assertValidSkillRegistration(result, relativePath);
+    if (result.skillUid !== localUid) {
+        throw new Error(`Skill registration returned identity '${result.skillUid}' for '${relativePath}', but the landed file is stamped '${localUid}'.`);
+    }
 }
 async function buildSharePlans(run) {
     const collected = collectFiles(run.paths, run.hqRoot, run.syncRoot, run.shouldSync, {
@@ -1324,12 +1431,41 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
                 }
             }
             if (freshContentConverged) {
+                // The equality probe is an await boundary. Confirm that the local body
+                // still matches the bytes we proved are already remote before recording
+                // convergence or reconciling source-authored metadata.
+                const afterProbe = refreshUploadItem();
+                if (afterProbe === null)
+                    return;
+                if (!uploadBodyMatchesPlan(item, afterProbe)) {
+                    await restartForChangedBody(afterProbe);
+                    return;
+                }
+                const shouldReconcileSkill = item.kind === "file" &&
+                    CANONICAL_COMPANY_SKILL_RE.test(relativePath) &&
+                    skillRegistrarForRun(run) !== undefined;
+                const skillBytes = shouldReconcileSkill
+                    ? fs.readFileSync(absolutePath)
+                    : undefined;
+                if (skillBytes !== undefined &&
+                    crypto.createHash("sha256").update(skillBytes).digest("hex") !== localHash) {
+                    // The editor saved after the equality proof. Re-run the normal
+                    // remote decision for those new bytes rather than claiming they have
+                    // already landed and letting their metadata get ahead of S3.
+                    const afterSkillRead = refreshUploadItem();
+                    if (afterSkillRead === null)
+                        return;
+                    await restartForChangedBody(afterSkillRead);
+                    return;
+                }
+                const skillContent = skillBytes?.toString("utf8");
                 const lstat = fs.lstatSync(absolutePath);
                 updateEntry(run.journal, relativePath, localHash, lstat.size, "up", absolutePath, {
                     remoteEtag: remoteMeta.etag,
                     mtimeMs: lstat.mtimeMs,
                     ctimeMs: ctimeToStamp(item.kind === "file" ? item.statAtHash : undefined, lstat),
                     kind: item.kind,
+                    skillMetadataPending: skillContent !== undefined,
                 });
                 // Same checkpoint contract as an actual upload. After repeated
                 // interrupted passes most of a large vault is already present remotely
@@ -1337,6 +1473,14 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
                 // through performUpload. Without this, that pass could reconcile
                 // hundreds of thousands of entries purely in memory, be interrupted,
                 // and persist none of them — the exact loop this change exists to end.
+                if (skillContent !== undefined) {
+                    // This is the crash-recovery path for a PUT that completed before its
+                    // journal row was persisted. Make the retry marker durable before the
+                    // registry call so another interruption remains recoverable.
+                    flushShareJournal(run);
+                    await reconcileLandedCompanySkill(run, relativePath, skillContent);
+                    delete run.journal.files[relativePath]?.skillMetadataPending;
+                }
                 checkpointShareJournal(run);
                 run.emit({ type: "reconciled", path: relativePath, direction: "push" });
                 counters.filesSkipped++;
@@ -1437,10 +1581,24 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
             const size = isSymlinkUpload ? 0 : lstat.size;
             const mtimeMs = lstat.mtimeMs;
             const ctimeMs = ctimeToStamp(item.kind === "file" ? item.statAtHash : undefined, lstat);
+            // Capture the candidate metadata bytes immediately before uploadFile's
+            // own synchronous read. If an editor saves while the network request is
+            // in flight, the comparison below suppresses reconciliation; that newer
+            // version will upload and reconcile on the next pass.
+            const skillContentAtPut = !isSymlinkUpload && CANONICAL_COMPANY_SKILL_RE.test(relativePath)
+                ? fs.readFileSync(absolutePath, "utf8")
+                : undefined;
             const { etag } = isSymlinkUpload
                 ? await uploadSymlink(run.ctx, item.target, relativePath, run.options.author, pc)
                 : await uploadFile(run.ctx, absolutePath, relativePath, run.options.author, pc);
-            updateEntry(run.journal, relativePath, localHash, size, "up", absolutePath, { remoteEtag: etag, mtimeMs, ctimeMs, kind: item.kind });
+            updateEntry(run.journal, relativePath, localHash, size, "up", absolutePath, {
+                remoteEtag: etag,
+                mtimeMs,
+                ctimeMs,
+                kind: item.kind,
+                skillMetadataPending: skillContentAtPut !== undefined &&
+                    skillRegistrarForRun(run) !== undefined,
+            });
             if (run.message) {
                 run.journal.files[relativePath] = {
                     ...run.journal.files[relativePath],
@@ -1449,9 +1607,25 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
             }
             counters.filesUploaded++;
             counters.bytesUploaded += size;
-            // Strictly after the PUT returned and the entry was applied, so an
-            // interrupted pass can only ever re-upload a file, never skip one.
-            checkpointShareJournal(run);
+            // A landed company skill needs a durable retry marker before the registry
+            // call. The ordinary cadence is intentionally sparse for large vaults,
+            // but losing this row can strand tags after a crash between PUT and
+            // reconciliation.
+            if (run.journal.files[relativePath]?.skillMetadataPending === true) {
+                flushShareJournal(run);
+            }
+            else {
+                // Strictly after the PUT returned and the entry was applied, so an
+                // interrupted pass can only ever re-upload a file, never skip one.
+                checkpointShareJournal(run);
+            }
+            if (skillContentAtPut !== undefined &&
+                skillRegistrarForRun(run) !== undefined &&
+                fs.readFileSync(absolutePath, "utf8") === skillContentAtPut) {
+                await reconcileLandedCompanySkill(run, relativePath, skillContentAtPut);
+                delete run.journal.files[relativePath]?.skillMetadataPending;
+                checkpointShareJournal(run);
+            }
             run.emit({
                 type: "progress",
                 path: relativePath,