@indigoai-us/hq-cloud 6.18.44-alpha.8 → 6.18.44

package/dist/cli/rescue-snapshot-copy.test.js

@@ -1,790 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { execFileSync } from "child_process";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { SNAPSHOT_FILE } from "../backup-prune.js";
-// Node's ESM namespace is immutable; use a mutable facade to model Windows
-// link privilege and macOS file-provider errors on every test platform.
-vi.mock("fs", async (importOriginal) => {
-    const actual = await importOriginal();
-    return { ...actual };
-});
-import * as rescueCore from "./rescue-core.js";
-const { runRescue } = rescueCore;
-function errnoError(code, message) {
-    const error = new Error(message);
-    error.code = code;
-    error.errno = code === "EDEADLK" ? 11 : undefined;
-    return error;
-}
-function withPlatform(platform, run) {
-    const descriptor = Object.getOwnPropertyDescriptor(process, "platform");
-    if (!descriptor)
-        throw new Error("process.platform descriptor is unavailable");
-    Object.defineProperty(process, "platform", { value: platform, configurable: true });
-    try {
-        return run();
-    }
-    finally {
-        Object.defineProperty(process, "platform", descriptor);
-    }
-}
-function captureRescue(argv, env, opts = {}) {
-    let stdout = "";
-    let stderr = "";
-    const originalOut = process.stdout.write.bind(process.stdout);
-    const originalErr = process.stderr.write.bind(process.stderr);
-    process.stdout.write = ((chunk) => {
-        stdout += String(chunk);
-        return true;
-    });
-    process.stderr.write = ((chunk) => {
-        stderr += String(chunk);
-        return true;
-    });
-    let status;
-    let threw;
-    try {
-        status =
-            runRescue(argv, {
-                env,
-                backupCapacityStatfsSync: (() => ({
-                    bavail: 1_000_000_000_000,
-                    bsize: 1,
-                    blocks: 1_000_000_000_000,
-                })),
-                ...opts,
-            }).status;
-    }
-    catch (error) {
-        threw = error;
-    }
-    finally {
-        process.stdout.write = originalOut;
-        process.stderr.write = originalErr;
-    }
-    return { status, stdout, stderr, threw };
-}
-describe("rescue safety snapshot copy", () => {
-    let workDir;
-    let hqRoot;
-    let backupRoot;
-    let upstream;
-    let env;
-    beforeEach(() => {
-        workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-snapshot-copy-"));
-        hqRoot = path.join(workDir, "hq");
-        backupRoot = path.join(workDir, "backups");
-        upstream = path.join(workDir, "upstream");
-        fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
-        fs.mkdirSync(path.join(hqRoot, "core"), { recursive: true });
-        fs.writeFileSync(path.join(hqRoot, "core", "release.txt"), "old release\n");
-        fs.mkdirSync(backupRoot, { recursive: true });
-        fs.mkdirSync(path.join(upstream, "core"), { recursive: true });
-        fs.writeFileSync(path.join(upstream, "core", "release.txt"), "new release\n");
-        fs.writeFileSync(path.join(upstream, "core", "unsafe-link"), "new upstream file\n");
-        execFileSync("git", ["init", "-b", "main", upstream], { stdio: "ignore" });
-        execFileSync("git", ["-C", upstream, "add", "."], { stdio: "ignore" });
-        execFileSync("git", [
-            "-C",
-            upstream,
-            "-c",
-            "user.name=test",
-            "-c",
-            "user.email=test@example.com",
-            "commit",
-            "-m",
-            "fixture",
-        ], { stdio: "ignore" });
-        const realGit = execFileSync("bash", ["-lc", "command -v git"]).toString().trim();
-        const shimDir = path.join(workDir, "bin");
-        fs.mkdirSync(shimDir, { recursive: true });
-        fs.writeFileSync(path.join(shimDir, "git"), `#!/usr/bin/env bash
-if [ "$1" = "clone" ] || [ "$1" = "ls-remote" ]; then
-  args=()
-  for arg in "$@"; do
-    case "$arg" in
-      https://github.com/test/repo.git) arg=${JSON.stringify(upstream)} ;;
-    esac
-    args+=("$arg")
-  done
-  exec ${JSON.stringify(realGit)} "\${args[@]}"
-fi
-exec ${JSON.stringify(realGit)} "$@"
-`, { mode: 0o755 });
-        env = { ...process.env, PATH: `${shimDir}:${process.env.PATH ?? ""}` };
-    });
-    afterEach(() => {
-        vi.restoreAllMocks();
-        fs.rmSync(workDir, { recursive: true, force: true });
-    });
-    function updateArgs(paths = "core") {
-        return [
-            "--hq-root",
-            hqRoot,
-            "--source",
-            "test/repo",
-            "--ref",
-            "main",
-            "--paths",
-            paths,
-            "--no-history-check",
-            "--backup-dir",
-            backupRoot,
-            "--yes",
-        ];
-    }
-    function recoveryArgs() {
-        return ["--recover-snapshots", "--hq-root", hqRoot, "--backup-dir", backupRoot];
-    }
-    function snapshotDir() {
-        const names = fs.readdirSync(backupRoot).filter((name) => name.startsWith("pre-update-"));
-        expect(names).toHaveLength(1);
-        return path.join(backupRoot, names[0]);
-    }
-    function readManifest(dir) {
-        return JSON.parse(fs.readFileSync(path.join(dir, SNAPSHOT_FILE), "utf8"));
-    }
-    function writeMalformedRecoveryManifest(snapshot, symlinks) {
-        const manifest = {
-            ...readManifest(snapshot),
-            status: "recovery-required",
-            symlinks,
-        };
-        fs.writeFileSync(path.join(snapshot, SNAPSHOT_FILE), JSON.stringify(manifest));
-        return manifest;
-    }
-    function expectMalformedRecoverySnapshotToBeRetained(snapshot) {
-        const verified = captureRescue([...recoveryArgs(), "--verify-restored-snapshot", path.basename(snapshot)], env);
-        expect(verified.threw, `${verified.stdout}\n${verified.stderr}`).toBeUndefined();
-        expect(verified.status, `${verified.stdout}\n${verified.stderr}`).toBe(1);
-        expect(verified.stderr).toContain("not an unresolved recovery-required snapshot");
-        expect(verified.stderr).not.toContain("TypeError");
-        expect(fs.existsSync(snapshot)).toBe(true);
-    }
-    function restoreSnapshotPath() {
-        const restore = rescueCore.restoreSnapshotPath;
-        expect(restore).toBeTypeOf("function");
-        return restore;
-    }
-    it("records a Windows-privileged symlink instead of creating one in the snapshot", () => {
-        fs.symlinkSync("release.txt", path.join(hqRoot, "core", "linked-release"));
-        const symlinkSpy = vi.spyOn(fs, "symlinkSync").mockImplementation(() => {
-            throw errnoError("EPERM", "operation not permitted, symlink");
-        });
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        expect(result.threw).toBeUndefined();
-        expect(symlinkSpy).not.toHaveBeenCalled();
-        expect(readManifest(snapshotDir()).symlinks).toEqual([
-            { path: "core/linked-release", target: "release.txt" },
-        ]);
-    });
-    it("requests a copy-on-write clone for regular snapshot files", () => {
-        const copyFile = vi.spyOn(fs, "copyFileSync");
-        const result = captureRescue(updateArgs(), env, {
-            backupCapacityStatfsSync: (() => ({
-                bavail: 100_000_000_000,
-                bsize: 1,
-                blocks: 100_000_000_000,
-            })),
-        });
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        expect(copyFile).toHaveBeenCalledWith(fs.realpathSync(path.join(hqRoot, "core", "release.txt")), path.join(snapshotDir(), "core", "release.txt"), fs.constants.COPYFILE_FICLONE);
-    });
-    it("restores independent file data from a cloned safety snapshot", () => {
-        const result = captureRescue(updateArgs(), env, {
-            backupCapacityStatfsSync: (() => ({
-                bavail: 100_000_000_000,
-                bsize: 1,
-                blocks: 100_000_000_000,
-            })),
-        });
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const manifest = readManifest(snapshot);
-        const snapshotFile = path.join(snapshot, "core", "release.txt");
-        const liveFile = path.join(hqRoot, "core", "release.txt");
-        fs.rmSync(path.join(hqRoot, "core"), { recursive: true, force: true });
-        restoreSnapshotPath()(snapshot, hqRoot, "core", manifest);
-        fs.writeFileSync(liveFile, "restored then edited\n");
-        expect(fs.readFileSync(snapshotFile, "utf8")).toBe("old release\n");
-        fs.writeFileSync(snapshotFile, "snapshot edited\n");
-        expect(fs.readFileSync(liveFile, "utf8")).toBe("restored then edited\n");
-    });
-    it("uses a copy-on-write clone for preserve-subpath shuttle files", () => {
-        const copyFile = vi.spyOn(fs, "copyFileSync");
-        const result = captureRescue([...updateArgs(), "--preserve-subpath", "core/release.txt"], env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        expect(copyFile).toHaveBeenCalledWith(fs.realpathSync(path.join(hqRoot, "core", "release.txt")), expect.stringContaining(`${path.sep}preserve${path.sep}`), fs.constants.COPYFILE_FICLONE);
-        expect(fs.readFileSync(path.join(hqRoot, "core", "release.txt"), "utf8")).toBe("old release\n");
-    });
-    it("restores recorded symlinks after copying the snapshot's regular files", () => {
-        fs.symlinkSync("release.txt", path.join(hqRoot, "core", "linked-release"));
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const manifest = readManifest(snapshot);
-        fs.rmSync(path.join(hqRoot, "core"), { recursive: true, force: true });
-        const restoreSnapshotPath = rescueCore.restoreSnapshotPath;
-        expect(restoreSnapshotPath).toBeTypeOf("function");
-        restoreSnapshotPath(snapshot, hqRoot, "core", manifest);
-        expect(fs.readFileSync(path.join(hqRoot, "core", "release.txt"), "utf8")).toBe("old release\n");
-        expect(fs.lstatSync(path.join(hqRoot, "core", "linked-release")).isSymbolicLink()).toBe(true);
-        expect(fs.readlinkSync(path.join(hqRoot, "core", "linked-release"))).toBe("release.txt");
-    });
-    it("rejects recorded symlinks that would resolve outside the HQ root before restoring", () => {
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const manifest = readManifest(snapshot);
-        const unsafe = {
-            ...manifest,
-            symlinks: [{ path: "core/unsafe", target: "../../outside" }],
-        };
-        const restoreSnapshotPath = rescueCore.restoreSnapshotPath;
-        expect(() => restoreSnapshotPath(snapshot, hqRoot, "core", unsafe)).toThrow("outside the HQ root");
-        expect(fs.readFileSync(path.join(hqRoot, "core", "release.txt"), "utf8")).toBe("new release\n");
-        expect(fs.existsSync(path.join(workDir, "outside"))).toBe(false);
-    });
-    it("rejects symlink metadata that collides with copied snapshot data", () => {
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const manifest = {
-            ...readManifest(snapshot),
-            symlinks: [{ path: "core/release.txt", target: "release.txt" }],
-        };
-        const restoreSnapshotPath = rescueCore.restoreSnapshotPath;
-        expect(() => restoreSnapshotPath(snapshot, hqRoot, "core", manifest)).toThrow("alongside copied data");
-        expect(fs.readFileSync(path.join(hqRoot, "core", "release.txt"), "utf8")).toBe("new release\n");
-    });
-    it("does not follow a live parent symlink outside the HQ root during restore", () => {
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const outside = path.join(workDir, "outside");
-        fs.mkdirSync(outside);
-        fs.writeFileSync(path.join(outside, "release.txt"), "outside release\n");
-        fs.rmSync(path.join(hqRoot, "core"), { recursive: true, force: true });
-        fs.symlinkSync(outside, path.join(hqRoot, "core"));
-        const restoreSnapshotPath = rescueCore.restoreSnapshotPath;
-        expect(() => restoreSnapshotPath(snapshot, hqRoot, "core/release.txt", readManifest(snapshot))).toThrow("not a directory inside the HQ root");
-        expect(fs.readFileSync(path.join(outside, "release.txt"), "utf8")).toBe("outside release\n");
-    });
-    it("includes recorded symlinks when verifying a restored recovery snapshot", () => {
-        fs.symlinkSync("release.txt", path.join(hqRoot, "core", "linked-release"));
-        const updated = captureRescue(updateArgs(), env);
-        expect(updated.status, `${updated.stdout}\n${updated.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const manifestPath = path.join(snapshot, SNAPSHOT_FILE);
-        const manifest = {
-            ...readManifest(snapshot),
-            status: "recovery-required",
-        };
-        fs.writeFileSync(manifestPath, JSON.stringify(manifest));
-        fs.rmSync(path.join(hqRoot, "core"), { recursive: true, force: true });
-        const restoreSnapshotPath = rescueCore.restoreSnapshotPath;
-        restoreSnapshotPath(snapshot, hqRoot, "core", manifest);
-        const verified = captureRescue([...recoveryArgs(), "--verify-restored-snapshot", path.basename(snapshot)], env);
-        expect(verified.status, `${verified.stdout}\n${verified.stderr}`).toBe(0);
-        expect(verified.stdout).toContain("Verified restored snapshot");
-    });
-    it("falls back to a full copy when the clone-style copy reports macOS EDEADLK", () => {
-        const source = fs.realpathSync(path.join(hqRoot, "core", "release.txt"));
-        const realCopyFileSync = fs.copyFileSync;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            if (path.resolve(String(from)) === fs.realpathSync(source) &&
-                mode === fs.constants.COPYFILE_FICLONE) {
-                throw errnoError("EDEADLK", "Unknown system error -11, copyfile");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        expect(result.threw).toBeUndefined();
-        expect(fs.readFileSync(path.join(snapshotDir(), "core", "release.txt"), "utf8")).toBe("old release\n");
-    });
-    it("skips an unreadable cloud-placeholder file, protects it from overlay, and records an incomplete snapshot", () => {
-        const source = fs.realpathSync(path.join(hqRoot, "core", "release.txt"));
-        // Keep one independently readable entry so this exercises a partial
-        // snapshot. A root whose every descendant is unreadable must abort.
-        fs.writeFileSync(path.join(hqRoot, "core", "still-readable.txt"), "captured alongside the skipped file\n");
-        const realCopyFileSync = fs.copyFileSync;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            if (path.resolve(String(from)) === fs.realpathSync(source) &&
-                path.resolve(String(to)).startsWith(`${path.resolve(backupRoot)}${path.sep}`) &&
-                path.resolve(String(to)).includes(`${path.sep}pre-update-`)) {
-                throw errnoError("EDEADLK", "Unknown system error -11, read");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        expect(result.threw).toBeUndefined();
-        expect(result.stdout).toContain("==> Done.");
-        expect(result.stderr).toContain("HQ_RESCUE_SKIPPED_KIND=snapshot-copy-unreadable");
-        expect(result.stderr).not.toContain("HQ_RESCUE_FAILURE_KIND=");
-        expect(result.stderr).toContain("HQ_RESCUE_SNAPSHOT_COPY_CODE=EDEADLK");
-        expect(result.stderr).toContain(`warning: snapshot skipped ${source}`);
-        expect(result.stderr).not.toContain("safety snapshot could not");
-        expect(result.stderr).toContain(source);
-        expect(result.stderr).toContain("core/release.txt");
-        expect(result.stderr).toContain("not backed up and was left untouched");
-        expect(result.stderr).toContain("The update continued.");
-        expect(result.stderr).toContain("iCloud Drive or another cloud provider");
-        expect(fs.readFileSync(source, "utf8")).toBe("old release\n");
-        const manifest = readManifest(snapshotDir());
-        expect(manifest.status).toBe("incomplete");
-        expect(manifest.skippedEntries).toEqual([
-            expect.objectContaining({
-                relativePath: "core/release.txt",
-                code: "EDEADLK",
-                operation: "read",
-            }),
-        ]);
-        const inspected = captureRescue(recoveryArgs(), env);
-        expect(inspected.status, `${inspected.stdout}\n${inspected.stderr}`).toBe(0);
-        expect(inspected.stdout).toContain("incomplete");
-        expect(inspected.stdout).not.toContain("complete recovery is available");
-        expect(inspected.stdout).toContain("incomplete snapshots were retained");
-        expect(inspected.stdout).not.toContain("every eligible recovery snapshot was positively verified");
-    });
-    it("skips an external symlink and preserves it through the overlay", () => {
-        const outside = path.join(workDir, "outside");
-        fs.writeFileSync(outside, "outside data\n");
-        const unsafeLink = path.join(fs.realpathSync(hqRoot), "core", "unsafe-link");
-        fs.symlinkSync("../../outside", unsafeLink);
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        expect(result.threw).toBeUndefined();
-        expect(result.stderr).toContain("HQ_RESCUE_SKIPPED_KIND=snapshot-copy-failed");
-        expect(result.stderr).not.toContain("HQ_RESCUE_FAILURE_KIND=");
-        expect(result.stderr).toContain(`warning: snapshot skipped ${unsafeLink}`);
-        expect(result.stderr).not.toContain("safety snapshot could not");
-        expect(result.stderr).toContain("core/unsafe-link");
-        expect(result.stderr).toContain("not backed up and was left untouched");
-        expect(result.stderr).toContain("The update continued.");
-        expect(fs.lstatSync(unsafeLink).isSymbolicLink()).toBe(true);
-        expect(fs.readlinkSync(unsafeLink)).toBe("../../outside");
-        expect(fs.readFileSync(outside, "utf8")).toBe("outside data\n");
-        expect(readManifest(snapshotDir()).skippedEntries).toEqual([
-            expect.objectContaining({
-                relativePath: "core/unsafe-link",
-                operation: "metadata",
-            }),
-        ]);
-    });
-    it("treats wildcard characters in skipped paths as literal rsync excludes", () => {
-        const skipped = path.join(hqRoot, "core", "literal*.txt");
-        const sibling = path.join(hqRoot, "core", "literal-other.txt");
-        fs.writeFileSync(skipped, "keep wildcard path\n");
-        fs.writeFileSync(sibling, "old sibling\n");
-        fs.writeFileSync(path.join(upstream, "core", "literal*.txt"), "new skipped path\n");
-        fs.writeFileSync(path.join(upstream, "core", "literal-other.txt"), "new sibling\n");
-        execFileSync("git", ["-C", upstream, "add", "."], { stdio: "ignore" });
-        execFileSync("git", [
-            "-C",
-            upstream,
-            "-c",
-            "user.name=test",
-            "-c",
-            "user.email=test@example.com",
-            "commit",
-            "-m",
-            "add wildcard fixture",
-        ], { stdio: "ignore" });
-        const realCopyFileSync = fs.copyFileSync;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            if (path.resolve(String(from)) === fs.realpathSync(skipped) &&
-                path.resolve(String(to)).startsWith(`${path.resolve(backupRoot)}${path.sep}`) &&
-                path.resolve(String(to)).includes(`${path.sep}pre-update-`)) {
-                throw errnoError("EDEADLK", "cloud file was not downloaded");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        expect(fs.readFileSync(skipped, "utf8")).toBe("keep wildcard path\n");
-        expect(fs.readFileSync(sibling, "utf8")).toBe("new sibling\n");
-    });
-    it("keeps a newline-named skipped path protected by the rsync exclude list", () => {
-        const name = "literal\nnewline.txt";
-        const skipped = path.join(hqRoot, "core", name);
-        fs.writeFileSync(skipped, "keep newline path\n");
-        fs.writeFileSync(path.join(upstream, "core", name), "new newline path\n");
-        execFileSync("git", ["-C", upstream, "add", "."], { stdio: "ignore" });
-        execFileSync("git", [
-            "-C",
-            upstream,
-            "-c",
-            "user.name=test",
-            "-c",
-            "user.email=test@example.com",
-            "commit",
-            "-m",
-            "add newline fixture",
-        ], { stdio: "ignore" });
-        const realCopyFileSync = fs.copyFileSync;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            if (path.resolve(String(from)) === fs.realpathSync(skipped) &&
-                path.resolve(String(to)).startsWith(`${path.resolve(backupRoot)}${path.sep}`) &&
-                path.resolve(String(to)).includes(`${path.sep}pre-update-`)) {
-                throw errnoError("EDEADLK", "cloud file was not downloaded");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        expect(fs.readFileSync(skipped, "utf8")).toBe("keep newline path\n");
-    });
-    it("does not write through a skipped external settings symlink after the overlay", () => {
-        const outside = path.join(workDir, "outside-settings.json");
-        const outsideBytes = '{"env":{"PATH":"/outside"},"outside":true}\n';
-        fs.writeFileSync(outside, outsideBytes);
-        fs.mkdirSync(path.join(hqRoot, ".claude"), { recursive: true });
-        const settingsPath = path.join(hqRoot, ".claude", "settings.json");
-        fs.symlinkSync("../../outside-settings.json", settingsPath);
-        fs.mkdirSync(path.join(upstream, ".claude"), { recursive: true });
-        fs.writeFileSync(path.join(upstream, ".claude", "settings.json"), '{"env":{"PATH":"/upstream"},"release":true}\n');
-        execFileSync("git", ["-C", upstream, "add", "."], { stdio: "ignore" });
-        execFileSync("git", [
-            "-C",
-            upstream,
-            "-c",
-            "user.name=test",
-            "-c",
-            "user.email=test@example.com",
-            "commit",
-            "-m",
-            "add settings fixture",
-        ], { stdio: "ignore" });
-        const result = captureRescue(updateArgs("core,.claude"), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
-        expect(result.stderr).toContain("HQ_RESCUE_SKIPPED_KIND=snapshot-copy-failed");
-        expect(fs.lstatSync(settingsPath).isSymbolicLink()).toBe(true);
-        expect(fs.readFileSync(outside, "utf8")).toBe(outsideBytes);
-    });
-    it("classifies an unreadable snapshot source as a read failure at the source path", () => {
-        const source = fs.realpathSync(path.join(hqRoot, "core", "release.txt"));
-        const realCopyFileSync = fs.copyFileSync;
-        const realOpenSync = fs.openSync;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            if (path.resolve(String(from)) === source &&
-                path.resolve(String(to)).startsWith(`${path.resolve(backupRoot)}${path.sep}`)) {
-                throw errnoError("EACCES", "permission denied reading snapshot source");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        vi.spyOn(fs, "openSync").mockImplementation(((file, flags, mode) => {
-            if (path.resolve(String(file)) === source && flags === "r") {
-                throw errnoError("EACCES", "permission denied reading snapshot source");
-            }
-            return realOpenSync(file, flags, mode);
-        }));
-        const result = captureRescue(updateArgs(), env, { backupCapacityCloneProbe: () => true });
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(1);
-        expect(result.stderr).toContain("HQ_RESCUE_FAILURE_KIND=snapshot-copy-unreadable");
-        expect(result.stderr).toContain(`safety snapshot could not read ${source} (EACCES)`);
-        expect(readManifest(snapshotDir()).skippedEntries).toEqual(expect.arrayContaining([
-            expect.objectContaining({
-                relativePath: "core/release.txt",
-                operation: "read",
-                code: "EACCES",
-            }),
-        ]));
-    });
-    it("keeps an EACCES destination copy failure classified as a write", () => {
-        const source = fs.realpathSync(path.join(hqRoot, "core", "release.txt"));
-        let destination = "";
-        const realCopyFileSync = fs.copyFileSync;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            const target = path.resolve(String(to));
-            if (path.resolve(String(from)) === source &&
-                target.startsWith(`${path.resolve(backupRoot)}${path.sep}`)) {
-                destination = target;
-                throw errnoError("EACCES", "permission denied writing snapshot destination");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        const result = captureRescue(updateArgs(), env, { backupCapacityCloneProbe: () => true });
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(1);
-        expect(result.stderr).toContain("HQ_RESCUE_FAILURE_KIND=snapshot-copy-failed");
-        expect(result.stderr).toContain(`safety snapshot could not write ${destination} (EACCES)`);
-        expect(readManifest(snapshotDir()).skippedEntries).toEqual(expect.arrayContaining([
-            expect.objectContaining({
-                relativePath: "core/release.txt",
-                operation: "write",
-                code: "EACCES",
-            }),
-        ]));
-    });
-    it("aborts when every requested top-level entry fails to snapshot", () => {
-        const realMkdirSync = fs.mkdirSync;
-        vi.spyOn(fs, "mkdirSync").mockImplementation(((target, options) => {
-            const candidate = path.resolve(String(target));
-            if (candidate.startsWith(path.resolve(backupRoot) + path.sep) &&
-                candidate.includes(`${path.sep}pre-update-`) &&
-                candidate.endsWith(`${path.sep}core`)) {
-                throw errnoError("EACCES", "snapshot root cannot be created");
-            }
-            return realMkdirSync(target, options);
-        }));
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(1);
-        expect(result.threw).toBeUndefined();
-        expect(result.stderr).toContain("HQ_RESCUE_FAILURE_KIND=snapshot-copy-failed");
-        expect(result.stderr).not.toContain("HQ_RESCUE_SKIPPED_KIND=");
-        expect(result.stderr).toContain("HQ_RESCUE_SNAPSHOT_COPY_CODE=EACCES");
-        expect(fs.readFileSync(path.join(hqRoot, "core", "release.txt"), "utf8")).toBe("old release\n");
-        expect(readManifest(snapshotDir()).status).toBe("failed-pre-mutation");
-    });
-    it("classifies an ENOSPC snapshot write as disk_full", () => {
-        const release = path.join(hqRoot, "core", "release.txt");
-        fs.mkdirSync(path.join(hqRoot, "packages"), { recursive: true });
-        fs.writeFileSync(path.join(hqRoot, "packages", "local.txt"), "keep this file\n");
-        const realCopyFileSync = fs.copyFileSync;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            if (path.resolve(String(to)).startsWith(path.resolve(backupRoot) + path.sep) &&
-                path.resolve(String(to)).endsWith(`${path.sep}core${path.sep}release.txt`)) {
-                throw errnoError("ENOSPC", "no space left on device");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        const result = captureRescue(updateArgs("core,packages"), env);
-        const output = `${result.stdout}\n${result.stderr}\n${String(result.threw ?? "")}`;
-        expect(result.threw, output).toBeUndefined();
-        expect(result.status, output).toBe(1);
-        expect(result.stderr).toContain("HQ_RESCUE_FAILURE_KIND=disk_full");
-        expect(result.stderr).toContain("HQ_RESCUE_SNAPSHOT_COPY_CODE=ENOSPC");
-        expect(fs.readFileSync(release, "utf8")).toBe("old release\n");
-        expect(fs.readFileSync(path.join(hqRoot, "packages", "local.txt"), "utf8")).toBe("keep this file\n");
-        expect(readManifest(snapshotDir()).status).toBe("failed-pre-mutation");
-    });
-    it("returns the disk_full exit when ENOSPC also prevents failure-manifest bookkeeping", () => {
-        const realCopyFileSync = fs.copyFileSync;
-        const realWriteFileSync = fs.writeFileSync;
-        let copyFailed = false;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            const candidate = path.resolve(String(to));
-            if (candidate.startsWith(path.resolve(backupRoot) + path.sep) &&
-                candidate.endsWith(`${path.sep}core${path.sep}release.txt`)) {
-                copyFailed = true;
-                throw errnoError("ENOSPC", "no space left on device");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        vi.spyOn(fs, "writeFileSync").mockImplementation(((file, data, options) => {
-            const candidate = path.resolve(String(file));
-            if (copyFailed &&
-                candidate.startsWith(path.resolve(backupRoot) + path.sep) &&
-                candidate.includes("SNAPSHOT.json.") &&
-                candidate.endsWith(".tmp")) {
-                throw errnoError("ENOSPC", "no space left on device");
-            }
-            return realWriteFileSync(file, data, options);
-        }));
-        const result = captureRescue(updateArgs(), env);
-        const output = `${result.stdout}\n${result.stderr}\n${String(result.threw ?? "")}`;
-        expect(result.threw, output).toBeUndefined();
-        expect(result.status, output).toBe(1);
-        expect(result.stderr).toContain("HQ_RESCUE_FAILURE_KIND=disk_full");
-        expect(result.stderr).toContain("HQ_RESCUE_MANIFEST_UPDATE_FAILED=1");
-        expect(readManifest(snapshotDir()).status).toBe("copying");
-        expect(fs.readFileSync(path.join(hqRoot, "core", "release.txt"), "utf8")).toBe("old release\n");
-    });
-    it("aborts when every descendant of a requested root fails to snapshot", () => {
-        const first = path.join(hqRoot, "core", "release.txt");
-        const second = path.join(hqRoot, "core", "second.txt");
-        fs.writeFileSync(second, "second local release file\n");
-        const realCopyFileSync = fs.copyFileSync;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            if ([first, second].some((item) => fs.realpathSync(item) === path.resolve(String(from))) &&
-                path.resolve(String(to)).startsWith(`${path.resolve(backupRoot)}${path.sep}`) &&
-                path.resolve(String(to)).includes(`${path.sep}pre-update-`)) {
-                throw errnoError("EDEADLK", "cloud file was not downloaded");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        const result = captureRescue(updateArgs(), env);
-        expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(1);
-        expect(result.threw).toBeUndefined();
-        expect(result.stderr).toContain("HQ_RESCUE_FAILURE_KIND=snapshot-copy-unreadable");
-        expect(fs.readFileSync(first, "utf8")).toBe("old release\n");
-        expect(fs.readFileSync(second, "utf8")).toBe("second local release file\n");
-        const manifest = readManifest(snapshotDir());
-        expect(manifest.status).toBe("failed-pre-mutation");
-        expect(manifest.skippedEntries).toEqual(expect.arrayContaining([
-            expect.objectContaining({ relativePath: "core/release.txt", operation: "read" }),
-            expect.objectContaining({ relativePath: "core/second.txt", operation: "read" }),
-        ]));
-    });
-    it("marks the snapshot failed before mutation when the preserve shuttle copy fails", () => {
-        const source = fs.realpathSync(path.join(hqRoot, "core", "release.txt"));
-        fs.writeFileSync(path.join(hqRoot, "core", "other.txt"), "old other file\n");
-        fs.writeFileSync(path.join(upstream, "core", "other.txt"), "new other file\n");
-        execFileSync("git", ["-C", upstream, "add", "."], { stdio: "ignore" });
-        execFileSync("git", [
-            "-C",
-            upstream,
-            "-c",
-            "user.name=test",
-            "-c",
-            "user.email=test@example.com",
-            "commit",
-            "-m",
-            "add shuttle failure fixture",
-        ], { stdio: "ignore" });
-        const realCopyFileSync = fs.copyFileSync;
-        vi.spyOn(fs, "copyFileSync").mockImplementation(((from, to, mode) => {
-            if (path.resolve(String(from)) === source &&
-                String(to).includes(`${path.sep}preserve${path.sep}`)) {
-                throw errnoError("ENOSPC", "preserve shuttle is full");
-            }
-            return realCopyFileSync(from, to, mode);
-        }));
-        const result = captureRescue([...updateArgs(), "--preserve-subpath", "core/release.txt"], env);
-        expect(result.status).toBeUndefined();
-        expect(result.threw).toMatchObject({ code: "ENOSPC" });
-        expect(readManifest(snapshotDir()).status).toBe("failed-pre-mutation");
-    });
-    it("rolls back a file link from its snapshot file-copy representation without Windows symlink privilege", () => {
-        fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
-        fs.writeFileSync(path.join(hqRoot, "personal", "linked.txt"), "linked data\n");
-        const link = path.join(hqRoot, "core", "a-link");
-        fs.symlinkSync("../personal/linked.txt", link);
-        vi.spyOn(fs, "symlinkSync").mockImplementation(() => {
-            throw errnoError("EPERM", "operation not permitted, symlink");
-        });
-        const result = withPlatform("win32", () => captureRescue(updateArgs(), {
-            ...env,
-            HQ_RESCUE_FAULT_BEFORE_APPLY_REL: "core/release.txt",
-            HQ_RESCUE_FAULT_BEFORE_APPLY_KIND: "directory",
-        }));
-        expect(result.threw, `${result.stdout}\n${result.stderr}`).toBeInstanceOf(Error);
-        expect(result.stdout).toContain("Rolled back 1 prior action path");
-        const snapshot = snapshotDir();
-        expect(readManifest(snapshot).symlinks).toEqual([
-            {
-                path: "core/a-link",
-                target: "../personal/linked.txt",
-                representation: "file-copy",
-            },
-        ]);
-        expect(fs.lstatSync(link).isFile()).toBe(true);
-        expect(fs.readFileSync(link, "utf8")).toBe("linked data\n");
-        fs.rmSync(path.join(hqRoot, "core"), { recursive: true, force: true });
-        const restored = captureRescue([...recoveryArgs(), "--restore-snapshot", path.basename(snapshot)], env);
-        expect(restored.status, `${restored.stdout}\n${restored.stderr}`).toBe(0);
-        expect(fs.lstatSync(link).isFile()).toBe(true);
-        expect(fs.readFileSync(link, "utf8")).toBe("linked data\n");
-        const verified = captureRescue([...recoveryArgs(), "--verify-restored-snapshot", path.basename(snapshot)], env);
-        expect(verified.status, `${verified.stdout}\n${verified.stderr}`).toBe(0);
-    });
-    it("verifies a no-privilege Windows directory junction by its resolved target", () => {
-        fs.mkdirSync(path.join(hqRoot, "personal", "linked-dir"), { recursive: true });
-        const link = path.join(hqRoot, "core", "a-link");
-        fs.symlinkSync("../personal/linked-dir", link);
-        const realSymlinkSync = fs.symlinkSync;
-        vi.spyOn(fs, "symlinkSync").mockImplementation(((target, destination, type) => {
-            if (type === "junction") {
-                return realSymlinkSync(target, destination);
-            }
-            throw errnoError("EPERM", "operation not permitted, symlink");
-        }));
-        const failed = withPlatform("win32", () => captureRescue(updateArgs(), {
-            ...env,
-            HQ_RESCUE_FAULT_BEFORE_APPLY_REL: "core/release.txt",
-            HQ_RESCUE_FAULT_BEFORE_APPLY_KIND: "directory",
-        }));
-        expect(failed.threw).toBeInstanceOf(Error);
-        const snapshot = snapshotDir();
-        fs.rmSync(path.join(hqRoot, "core"), { recursive: true, force: true });
-        const restoreSnapshotPath = rescueCore.restoreSnapshotPath;
-        expect(restoreSnapshotPath).toBeTypeOf("function");
-        withPlatform("win32", () => restoreSnapshotPath(snapshot, fs.realpathSync(hqRoot), "core", readManifest(snapshot)));
-        expect(fs.readlinkSync(link)).toBe(path.join(fs.realpathSync(hqRoot), "personal", "linked-dir"));
-        const verified = captureRescue([...recoveryArgs(), "--verify-restored-snapshot", path.basename(snapshot)], env);
-        expect(verified.status, `${verified.stdout}\n${verified.stderr}`).toBe(0);
-        expect(verified.stdout).toContain("Verified restored snapshot");
-    });
-    it("materializes manifest-recorded symlinks with the explicit recovery restore command", () => {
-        fs.symlinkSync("release.txt", path.join(hqRoot, "core", "linked-release"));
-        const updated = captureRescue(updateArgs(), env);
-        expect(updated.status, `${updated.stdout}\n${updated.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const manifestPath = path.join(snapshot, SNAPSHOT_FILE);
-        fs.writeFileSync(manifestPath, JSON.stringify({ ...readManifest(snapshot), status: "recovery-required" }));
-        fs.rmSync(path.join(hqRoot, "core"), { recursive: true, force: true });
-        const restored = captureRescue([...recoveryArgs(), "--restore-snapshot", path.basename(snapshot)], env);
-        expect(restored.status, `${restored.stdout}\n${restored.stderr}`).toBe(0);
-        expect(restored.stdout).toContain("Restored every captured root");
-        expect(fs.readFileSync(path.join(hqRoot, "core", "release.txt"), "utf8")).toBe("old release\n");
-        expect(fs.readlinkSync(path.join(hqRoot, "core", "linked-release"))).toBe("release.txt");
-    });
-    it("refuses a manifest symlink nested beneath another recorded symlink before writing", () => {
-        const updated = captureRescue(updateArgs(), env);
-        expect(updated.status, `${updated.stdout}\n${updated.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
-        const victim = path.join(hqRoot, "personal", "victim");
-        fs.writeFileSync(victim, "do not touch\n");
-        const manifest = {
-            ...readManifest(snapshot),
-            symlinks: [
-                { path: "core/a", target: "../personal" },
-                { path: "core/a/victim", target: "release.txt" },
-            ],
-        };
-        const restoreSnapshotPath = rescueCore.restoreSnapshotPath;
-        expect(() => restoreSnapshotPath(snapshot, hqRoot, "core", manifest)).toThrow("beneath recorded symlink");
-        expect(fs.readFileSync(victim, "utf8")).toBe("do not touch\n");
-    });
-    it("rejects object symlink metadata during recovery verification and restore", () => {
-        const updated = captureRescue(updateArgs(), env);
-        expect(updated.status, `${updated.stdout}\n${updated.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const manifest = writeMalformedRecoveryManifest(snapshot, {
-            "core/a": "release.txt",
-        });
-        expectMalformedRecoverySnapshotToBeRetained(snapshot);
-        expect(() => restoreSnapshotPath()(snapshot, hqRoot, "core", manifest)).toThrow("snapshot manifest symlinks is not an array");
-    });
-    it("rejects numeric symlink metadata during recovery verification and restore", () => {
-        const updated = captureRescue(updateArgs(), env);
-        expect(updated.status, `${updated.stdout}\n${updated.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const manifest = writeMalformedRecoveryManifest(snapshot, 42);
-        expectMalformedRecoverySnapshotToBeRetained(snapshot);
-        expect(() => restoreSnapshotPath()(snapshot, hqRoot, "core", manifest)).toThrow("snapshot manifest symlinks is not an array");
-    });
-    it("rejects invalid symlink entries during recovery verification and restore", () => {
-        const updated = captureRescue(updateArgs(), env);
-        expect(updated.status, `${updated.stdout}\n${updated.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        const manifest = writeMalformedRecoveryManifest(snapshot, [
-            { path: "core/a", target: "release.txt", representation: "junction-copy" },
-        ]);
-        expectMalformedRecoverySnapshotToBeRetained(snapshot);
-        expect(() => restoreSnapshotPath()(snapshot, hqRoot, "core", manifest)).toThrow("snapshot manifest has an invalid recorded symlink");
-    });
-    it("keeps copied restore data when chmod metadata preservation fails", () => {
-        const updated = captureRescue(updateArgs(), env);
-        expect(updated.status, `${updated.stdout}\n${updated.stderr}`).toBe(0);
-        const snapshot = snapshotDir();
-        fs.rmSync(path.join(hqRoot, "core"), { recursive: true, force: true });
-        const destination = path.join(hqRoot, "core", "release.txt");
-        const realChmodSync = fs.chmodSync;
-        vi.spyOn(fs, "chmodSync").mockImplementation(((target, mode) => {
-            if (path.resolve(String(target)) === destination) {
-                throw errnoError("EPERM", "metadata update denied");
-            }
-            return realChmodSync(target, mode);
-        }));
-        const restoreSnapshotPath = rescueCore.restoreSnapshotPath;
-        expect(() => restoreSnapshotPath(snapshot, hqRoot, "core", readManifest(snapshot))).not.toThrow();
-        expect(fs.readFileSync(destination, "utf8")).toBe("old release\n");
-    });
-});
-//# sourceMappingURL=rescue-snapshot-copy.test.js.map