@indigoai-us/hq-cloud 6.18.45-alpha.0 → 6.18.45

package/dist/cli/share.js

@@ -7,8 +7,6 @@
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
-import { resolveSymlinkTargetRefusalFlag } from "../sync/symlink-target-refusal-flag.js";
-import { inspectSymlinkTarget, materializedTargetMatchesWire } from "../symlink-target-policy.js";
 import { resolveEntityContext, isExpiringSoon, refreshEntityContext } from "../context.js";
 import { ensureCompanyVaultTransport } from "../company-vault-transport.js";
 import { createSyncProgressRecorder } from "../sync-progress.js";
@@ -65,7 +63,7 @@ import { directoryFoldsCase, findCaseFoldedLocalKey, foldVaultKey, } from "./cas
  * outcome. The name is derived from the relative path so concurrent probes
  * for distinct files never collide on disk.
  */
-async function remoteContentDiffers(ctx, relativePath, localHash, hqRoot, symlinkOptions) {
+async function remoteContentDiffers(ctx, relativePath, localHash, hqRoot) {
     const probeKey = crypto
         .createHash("sha256")
         .update(relativePath)
@@ -73,7 +71,7 @@ async function remoteContentDiffers(ctx, relativePath, localHash, hqRoot, symlin
         .slice(0, 16);
     const probePath = path.join(os.tmpdir(), `hq-conflict-probe-${readShortMachineId(hqRoot)}-${probeKey}.tmp`);
     try {
-        await downloadFile(ctx, relativePath, probePath, symlinkOptions);
+        await downloadFile(ctx, relativePath, probePath);
         const remoteHash = fs.lstatSync(probePath).isSymbolicLink()
             ? hashSymlinkTarget(fs.readlinkSync(probePath))
             : hashFile(probePath);
@@ -275,7 +273,6 @@ export const _testing = {
     cooperativeRowVisits: snapshotCooperativeRowVisits,
     computePushPlan,
     computePushPlanCooperatively,
-    normalizeWindowsSymlinkTarget,
 };
 /** Snapshot of `absolutePath`, or null when it is missing or not a plain file. */
 function statSnapshot(absolutePath) {
@@ -449,7 +446,7 @@ function refusesServerOwnedPush(relativePath, ontologyEntityPush, absolutePath,
     }
     return isCloudAuthoritative(relativePath);
 }
-function computePushPlan(filesToShare, journal, skipUnchanged, onHeartbeat, ontologyEntityPush = false, symlinkContext) {
+function computePushPlan(filesToShare, journal, skipUnchanged, onHeartbeat, ontologyEntityPush = false) {
     const items = [];
     let omittedSkips = 0;
     let plannedRows = 0;
@@ -476,18 +473,6 @@ function computePushPlan(filesToShare, journal, skipUnchanged, onHeartbeat, onto
             // itself "looks" identical.
             if (entry.kind === "symlink") {
                 const localHash = hashSymlinkTarget(entry.target);
-                const journalEntry = journalRows(journal).get(relativePath);
-                const portable = portablePushSymlinkTarget(absolutePath, relativePath, entry.target, journalEntry?.wireSymlinkTarget, symlinkContext);
-                if (portable.refused) {
-                    items.push({
-                        action: "refuse-unsafe-symlink",
-                        absolutePath,
-                        relativePath,
-                        classification: portable.classification,
-                        shape: portable.shape,
-                    });
-                    continue;
-                }
                 if (skipUnchanged) {
                     const existing = skipFingerprint(journal, relativePath);
                     // `!localDiverges`: see the regular-file gate below — a divergent entry
@@ -503,7 +488,7 @@ function computePushPlan(filesToShare, journal, skipUnchanged, onHeartbeat, onto
                     kind: "symlink",
                     absolutePath,
                     relativePath,
-                    target: portable.target,
+                    target: entry.target,
                     localHash,
                     size: 0,
                 });
@@ -623,107 +608,12 @@ function computePushPlan(filesToShare, journal, skipUnchanged, onHeartbeat, onto
     filesToSkip += omittedSkips;
     return { items, filesToUpload, bytesToUpload, filesToSkip, preplannedFilesSkipped: omittedSkips };
 }
-function portablePushSymlinkTarget(absolutePath, relativePath, localTarget, wireTarget, context) {
-    const pathApi = process.platform === "win32" ? path.win32 : path;
-    let scope;
-    let scopeRoot;
-    let linkPath = relativePath;
-    if (context) {
-        const skillFarmRoot = pathApi.resolve(context.hqRoot, ".claude", "skills");
-        const skillFarmRelative = pathApi.relative(skillFarmRoot, pathApi.resolve(absolutePath));
-        const isSkillFarmPath = skillFarmRelative !== ".." &&
-            !skillFarmRelative.startsWith(`..${pathApi.sep}`) && !pathApi.isAbsolute(skillFarmRelative);
-        if (isSkillFarmPath) {
-            scope = { kind: "personal" };
-            scopeRoot = context.hqRoot;
-            linkPath = `.claude/skills/${skillFarmRelative.split(pathApi.sep).join("/")}`;
-        }
-        else if (context.personalMode) {
-            scope = { kind: "personal" };
-            scopeRoot = context.syncRoot;
-            linkPath = `personal/${relativePath}`;
-        }
-        else {
-            scope = { kind: "company", companySlug: context.companySlug };
-            scopeRoot = context.syncRoot;
-            linkPath = `companies/${context.companySlug}/${relativePath}`;
-        }
-    }
-    if (wireTarget !== undefined && scope) {
-        let wireReport;
-        const wireInspection = inspectSymlinkTarget({
-            linkPath,
-            target: wireTarget,
-            scope,
-            refuse: true,
-            emit: (event) => { wireReport = event; },
-        });
-        if (wireInspection.refused) {
-            const event = wireReport ?? { classification: "escapes-scope", shape: "relative-path" };
-            process.stderr.write(`hq-cloud symlink target ${event.classification} ${event.shape}\n`);
-            return { target: "", refused: true, ...event };
-        }
-        if (materializedTargetMatchesWire(absolutePath, localTarget, wireTarget)) {
-            return { target: wireTarget, refused: false };
-        }
-    }
-    let candidate = localTarget;
-    if (path.isAbsolute(localTarget) || path.win32.isAbsolute(localTarget)) {
-        if (!scope || !scopeRoot) {
-            const event = { classification: "windows-absolute", shape: "absolute-rooted" };
-            process.stderr.write(`hq-cloud symlink target ${event.classification} ${event.shape}\n`);
-            return { target: "", refused: true, ...event };
-        }
-        const absoluteTarget = pathApi.resolve(localTarget);
-        if (scope?.kind === "company" &&
-            relativePath === "knowledge" &&
-            absoluteTarget === pathApi.resolve(scopeRoot, `../../repos/private/knowledge-${scope.companySlug}`)) {
-            return { target: `../../repos/private/knowledge-${scope.companySlug}`, refused: false };
-        }
-        const relativeToScope = pathApi.relative(scopeRoot, absoluteTarget);
-        if (relativeToScope === ".." || relativeToScope.startsWith(`..${pathApi.sep}`) || pathApi.isAbsolute(relativeToScope)) {
-            const event = { classification: "escapes-scope", shape: "absolute-outside-scope" };
-            process.stderr.write(`hq-cloud symlink target ${event.classification} ${event.shape}\n`);
-            return { target: "", refused: true, ...event };
-        }
-        candidate = pathApi.relative(pathApi.dirname(absolutePath), absoluteTarget).replaceAll("\\", "/");
-    }
-    else if (process.platform === "win32") {
-        // fs.readlink on Windows returns native separators for a relative link.
-        // The wire target is portable and must keep POSIX separators.
-        candidate = normalizeWindowsSymlinkTarget(candidate);
-    }
-    if (!scope && (path.isAbsolute(candidate) || path.win32.isAbsolute(candidate))) {
-        const event = { classification: "escapes-scope", shape: "absolute-outside-scope" };
-        process.stderr.write(`hq-cloud symlink target ${event.classification} ${event.shape}\n`);
-        return { target: "", refused: true, ...event };
-    }
-    if (!scope)
-        return { target: candidate, refused: false };
-    let report;
-    const inspection = inspectSymlinkTarget({
-        linkPath,
-        target: candidate,
-        scope,
-        refuse: true,
-        emit: (event) => { report = event; },
-    });
-    if (inspection.refused) {
-        const event = report ?? { classification: "escapes-scope", shape: "relative-path" };
-        process.stderr.write(`hq-cloud symlink target ${event.classification} ${event.shape}\n`);
-        return { target: "", refused: true, ...event };
-    }
-    return { target: candidate, refused: false };
-}
-function normalizeWindowsSymlinkTarget(target) {
-    return target.replaceAll("\\", "/");
-}
 /**
  * Build a full-pass plan in bounded row batches.  A scoped replan deliberately
  * uses the synchronous single-row planner above, so it does not add an await
  * boundary between upload admissions and collapse the transfer pool.
  */
-async function computePushPlanCooperatively(filesToShare, journal, skipUnchanged, onHeartbeat, cooperativeCheckpoint, ontologyEntityPush = false, symlinkContext) {
+async function computePushPlanCooperatively(filesToShare, journal, skipUnchanged, onHeartbeat, cooperativeCheckpoint, ontologyEntityPush = false) {
     // Keep each synchronous hash/stat slice small enough that a large backlog
     // cannot starve protocol heartbeats or watcher admission for tens of seconds.
     // This changes only scheduling granularity; plan decisions are unchanged.
@@ -736,7 +626,7 @@ async function computePushPlanCooperatively(filesToShare, journal, skipUnchanged
     const cooperativeWork = { rowsSinceYield: 0, lastYieldAt: 0 };
     for (let start = 0; start < filesToShare.length; start += rowsPerPlanningYield) {
         const slice = filesToShare.slice(start, start + rowsPerPlanningYield);
-        const plan = computePushPlan(slice, journal, skipUnchanged, onHeartbeat, ontologyEntityPush, symlinkContext);
+        const plan = computePushPlan(slice, journal, skipUnchanged, onHeartbeat, ontologyEntityPush);
         items.push(...plan.items);
         filesToUpload += plan.filesToUpload;
         bytesToUpload += plan.bytesToUpload;
@@ -787,11 +677,11 @@ function recollectPushEntry(item, reuseKnownHash = true) {
  * classified from the bytes and journal state that exist immediately before a
  * worker starts, so callers never upload with a hash captured near pass entry.
  */
-function replanPushItemAtExecution(item, journal, skipUnchanged, onHeartbeat, ontologyEntityPush = false, forceRehash = false, symlinkContext) {
+function replanPushItemAtExecution(item, journal, skipUnchanged, onHeartbeat, ontologyEntityPush = false, forceRehash = false) {
     const current = recollectPushEntry(item, !forceRehash);
     if (current === null)
         return null;
-    return computePushPlan([current], journal, skipUnchanged, onHeartbeat, ontologyEntityPush, symlinkContext).items[0] ?? null;
+    return computePushPlan([current], journal, skipUnchanged, onHeartbeat, ontologyEntityPush).items[0] ?? null;
 }
 function uploadBodyMatchesPlan(planned, current) {
     if (planned.kind !== current.kind || planned.localHash !== current.localHash) {
@@ -1242,14 +1132,6 @@ async function createPushRunContext(options) {
         ? wrapFilterWithScope(transferFilter, syncRoot, options.prefixSet, onScopeExcluded)
         : transferFilter;
     const journalSlug = options.journalSlug ?? ctx.slug;
-    const flagConfig = vaultConfig ?? privateFolderVaultConfig;
-    const symlinkTargetRefusal = flagConfig
-        ? await resolveSymlinkTargetRefusalFlag({
-            config: flagConfig,
-            companyUid: ctx.uid,
-            companySlug: ctx.slug,
-        })
-        : false;
     if (journalSlug === PERSONAL_VAULT_JOURNAL_SLUG)
         migratePersonalVaultJournal();
     // The scoped runner has not completed its narrow filesystem walk yet, so
@@ -1262,7 +1144,6 @@ async function createPushRunContext(options) {
         ontologyEntityPush: false,
         skillRegisterLandedBytes: false,
         personalConnectorSettingsSync,
-        symlinkTargetRefusal,
         skillRegistrationFallbacks: 0,
         paths,
         message,
@@ -1694,11 +1575,7 @@ async function reconcileOnePendingCompanySkill(run, entry) {
         const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-skill-metadata-"));
         const tempFile = path.join(tempDir, "SKILL.md");
         try {
-            await downloadFile(run.ctx, entry.relativePath, tempFile, {
-                refuseUnsafeSymlinkTargets: run.symlinkTargetRefusal,
-                symlinkTargetScope: { kind: "company", companySlug: run.ctx.slug },
-                symlinkTargetLinkPath: `companies/${run.ctx.slug}/${entry.relativePath}`,
-            });
+            await downloadFile(run.ctx, entry.relativePath, tempFile);
             // The reconciled bytes are the REMOTE object (a peer replaced the one
             // this marker described), not the local file, so pass no absolutePath:
             // a 409 here is recorded, not forked (see reconcileLandedCompanySkill).
@@ -2051,7 +1928,7 @@ async function buildSharePlans(run) {
     if (pushEntries.some((entry) => isOntologyEntityKey(entry.relativePath))) {
         run.ontologyEntityPush = await resolveRunOntologyEntityPush(run);
     }
-    const pushPlan = await computePushPlanCooperatively(pushEntries, run.journal, run.skipUnchanged === true, run.options.onHeartbeat, run.options.cooperativeCheckpoint, run.ontologyEntityPush, { hqRoot: run.hqRoot, syncRoot: run.syncRoot, personalMode: run.options.personalMode === true, companySlug: run.ctx.slug });
+    const pushPlan = await computePushPlanCooperatively(pushEntries, run.journal, run.skipUnchanged === true, run.options.onHeartbeat, run.options.cooperativeCheckpoint, run.ontologyEntityPush);
     const deletePlan = run.propagateDeletes === true
         ? await computeDeletePlan(run.journal, run.syncRoot, deleteScopeRoots, run.shouldSync, run.propagateDeletePolicy, run.ctx, run.options.personalMode !== true, run.skipSecretPaths)
         : { toDelete: [], toTombstone: [], refusedStale: [] };
@@ -2280,7 +2157,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
     for (const previewItem of pushPlan.items) {
         if (previewItem.action !== "upload")
             continue;
-        const item = replanPushItemAtExecution(previewItem, run.journal, run.skipUnchanged === true, run.options.onHeartbeat, run.ontologyEntityPush, false, { hqRoot: run.hqRoot, syncRoot: run.syncRoot, personalMode: run.options.personalMode === true, companySlug: run.ctx.slug });
+        const item = replanPushItemAtExecution(previewItem, run.journal, run.skipUnchanged === true, run.options.onHeartbeat, run.ontologyEntityPush);
         if (item?.action === "upload" && !isUploadSuppressedByTombstone(item)) {
             plannedUploadCandidates.push(item);
         }
@@ -2375,14 +2252,6 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
                 emitServerOwnedRefusal(run, item.relativePath);
             }
         }
-        else if (item.action === "refuse-unsafe-symlink") {
-            run.emit({
-                type: "skip-unsafe-symlink-target",
-                path: item.relativePath,
-                classification: item.classification,
-                shape: item.shape,
-            });
-        }
         else if (item.action === "skip-size-limit") {
             // A file over the size cap is a permanent, benign skip — NOT an error.
             let bytes = 0;
@@ -2430,7 +2299,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
             return;
         const { absolutePath, relativePath, localHash } = item;
         const refreshUploadItem = () => {
-            const refreshed = replanPushItemAtExecution(item, run.journal, run.skipUnchanged === true, run.options.onHeartbeat, run.ontologyEntityPush, true, { hqRoot: run.hqRoot, syncRoot: run.syncRoot, personalMode: run.options.personalMode === true, companySlug: run.ctx.slug });
+            const refreshed = replanPushItemAtExecution(item, run.journal, run.skipUnchanged === true, run.options.onHeartbeat, run.ontologyEntityPush, true);
             if (refreshed === null) {
                 counters.filesSkipped++;
                 return null;
@@ -2645,33 +2514,10 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
             let isFreshCollision = false;
             let freshContentConverged = false;
             if (!journalEntry && item.kind === "symlink") {
-                const remoteTarget = await readVerifiedRemoteSymlinkTarget(run.ctx, relativePath);
-                const localTarget = fs.readlinkSync(absolutePath);
-                if (remoteTarget !== null && materializedTargetMatchesWire(absolutePath, localTarget, remoteTarget)) {
-                    const localStat = fs.lstatSync(absolutePath);
-                    updateEntry(run.journal, relativePath, hashSymlinkTarget(localTarget), 0, "down", absolutePath, {
-                        remoteEtag: remoteMeta.etag,
-                        mtimeMs: localStat.mtimeMs,
-                        ctimeMs: localStat.ctimeMs,
-                        kind: "symlink",
-                        wireSymlinkTarget: remoteTarget,
-                    });
-                    flushShareJournal(run);
-                    counters.filesSkipped++;
-                    return;
-                }
                 isFreshCollision = true;
             }
             else if (!journalEntry && item.kind === "file") {
-                const remoteDiffers = await remoteContentDiffers(run.ctx, relativePath, localHash, run.hqRoot, {
-                    refuseUnsafeSymlinkTargets: run.symlinkTargetRefusal,
-                    symlinkTargetScope: run.options.personalMode === true
-                        ? { kind: "personal" }
-                        : { kind: "company", companySlug: run.ctx.slug },
-                    symlinkTargetLinkPath: run.options.personalMode === true
-                        ? `personal/${relativePath}`
-                        : `companies/${run.ctx.slug}/${relativePath}`,
-                });
+                const remoteDiffers = await remoteContentDiffers(run.ctx, relativePath, localHash, run.hqRoot);
                 if (remoteDiffers) {
                     isFreshCollision = true;
                 }
@@ -2985,7 +2831,6 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
                     mtimeMs,
                     ctimeMs,
                     kind: item.kind,
-                    ...(item.kind === "symlink" ? { wireSymlinkTarget: item.target } : {}),
                     skillMetadataPending: skillContentAtPut !== undefined &&
                         skillRegistrarForRun(run) !== undefined,
                 });
@@ -3308,7 +3153,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
                     continue;
                 }
                 const previewItem = queue[0];
-                const item = replanPushItemAtExecution(previewItem, run.journal, run.skipUnchanged === true, run.options.onHeartbeat, run.ontologyEntityPush, false, { hqRoot: run.hqRoot, syncRoot: run.syncRoot, personalMode: run.options.personalMode === true, companySlug: run.ctx.slug });
+                const item = replanPushItemAtExecution(previewItem, run.journal, run.skipUnchanged === true, run.options.onHeartbeat, run.ontologyEntityPush);
                 if (item === null) {
                     queue.shift();
                     counters.filesSkipped++;
@@ -3485,16 +3330,7 @@ async function probeRemoteForWinner(run, item, remoteMtime) {
     let decision;
     try {
         fs.mkdirSync(path.dirname(probeAbs), { recursive: true });
-        const downloaded = await downloadFile(run.ctx, item.relativePath, probeAbs, {
-            ...(run.options.transferPriority === "realtime" ? { bypassBandwidthGovernor: true } : {}),
-            refuseUnsafeSymlinkTargets: run.symlinkTargetRefusal,
-            symlinkTargetScope: run.options.personalMode === true
-                ? { kind: "personal" }
-                : { kind: "company", companySlug: run.ctx.slug },
-            symlinkTargetLinkPath: run.options.personalMode === true
-                ? `personal/${item.relativePath}`
-                : `companies/${run.ctx.slug}/${item.relativePath}`,
-        });
+        const downloaded = await downloadFile(run.ctx, item.relativePath, probeAbs, run.options.transferPriority === "realtime" ? { bypassBandwidthGovernor: true } : {});
         fetched = { abs: probeAbs, downloaded };
         if (item.kind === "file" && !fs.lstatSync(probeAbs).isSymbolicLink()) {
             const localStat = fs.lstatSync(item.absolutePath);
@@ -3615,16 +3451,7 @@ async function adoptRemoteOnPush(run, item, remoteHash, decision, probe) {
             downloaded = probeBody.downloaded;
         }
         else {
-            downloaded = await downloadFile(run.ctx, item.relativePath, item.absolutePath, {
-                ...(run.options.transferPriority === "realtime" ? { bypassBandwidthGovernor: true } : {}),
-                refuseUnsafeSymlinkTargets: run.symlinkTargetRefusal,
-                symlinkTargetScope: run.options.personalMode === true
-                    ? { kind: "personal" }
-                    : { kind: "company", companySlug: run.ctx.slug },
-                symlinkTargetLinkPath: run.options.personalMode === true
-                    ? `personal/${item.relativePath}`
-                    : `companies/${run.ctx.slug}/${item.relativePath}`,
-            });
+            downloaded = await downloadFile(run.ctx, item.relativePath, item.absolutePath, run.options.transferPriority === "realtime" ? { bypassBandwidthGovernor: true } : {});
         }
         remoteAdopted = true;
         const localLstat = fs.lstatSync(item.absolutePath);
@@ -3642,9 +3469,6 @@ async function adoptRemoteOnPush(run, item, remoteHash, decision, probe) {
             ctimeMs: localLstat.ctimeMs,
             ...(createdBySub !== undefined ? { createdBySub } : {}),
             kind: isLocalSymlink ? "symlink" : "file",
-            ...(isLocalSymlink && downloaded?.symlinkTarget !== undefined
-                ? { wireSymlinkTarget: downloaded.symlinkTarget }
-                : {}),
         });
         recordPushConflict(run, item, {
             detectedAt,