@indigoai-us/hq-cloud 6.18.52 → 6.18.55-alpha.0

package/dist/cli/share.js

@@ -8,7 +8,7 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import { resolveSymlinkTargetRefusalFlag } from "../sync/symlink-target-refusal-flag.js";
-import { inspectSymlinkTarget, materializedTargetMatchesWire, personalSymlinkTargetLinkPath, } from "../symlink-target-policy.js";
+import { inspectLocalSymlinkScope, inspectSymlinkTarget, materializedTargetMatchesWire, personalSymlinkTargetLinkPath, } from "../symlink-target-policy.js";
 import { resolveEntityContext, isExpiringSoon, refreshEntityContext } from "../context.js";
 import { ensureCompanyVaultTransport } from "../company-vault-transport.js";
 import { createSyncProgressRecorder } from "../sync-progress.js";
@@ -17,7 +17,7 @@ import { uploadFile, uploadSymlink, toPosixKey, headRemoteFile, readVerifiedRemo
 import * as crypto from "crypto";
 import { bindObjectIOToContext, PresignObjectIO, RateLimitedError, resolveObjectIO, S3SdkObjectIO, } from "../object-io.js";
 import { primePrivateFolderUpload } from "../private-folder-transport.js";
-import { isUnderAnyRoot, readJournalForPass, readJournalScoped, writeJournal, setJournalSnapshotQuarantineListener, hashFile, hashSymlinkTarget, journalRows, journalEntryMatchesStat, journalFingerprintMatchesStat, dropJournalDecodeWindow, timestampsTooCoarseToTrust, updateEntry, PrematureJournalEntryError, removeEntry, isTombstone, normalizeEtag, PERSONAL_VAULT_JOURNAL_SLUG, migratePersonalVaultJournal, migrateToV2, } from "../journal.js";
+import { isUnderAnyRoot, readJournalForPass, readJournalScoped, readQuarantinedJournalPaths, writeJournal, setJournalSnapshotQuarantineListener, hashFile, hashSymlinkTarget, journalRows, journalEntryMatchesStat, journalFingerprintMatchesStat, dropJournalDecodeWindow, timestampsTooCoarseToTrust, updateEntry, PrematureJournalEntryError, removeEntry, isTombstone, normalizeEtag, PERSONAL_VAULT_JOURNAL_SLUG, migratePersonalVaultJournal, migrateToV2, } from "../journal.js";
 import { createIgnoreFilter, hasControlCharacters, isExpectedIgnore, isSecretPatternIgnore, isWithinSizeLimit, } from "../ignore.js";
 import { wrapFilterWithPersonalVaultDefaults, } from "../personal-vault-exclusions.js";
 import { isSecretBearingVaultPath, isSkipSecretPathsEnabled, } from "../sync/secret-path-policy.js";
@@ -29,7 +29,7 @@ import { compileScopeMatcher, } from "../prefix-coalesce.js";
 import { hasRemoteChanged, isAccessDenied, resolveActiveCompany, resolveTransferConcurrency, resolveUploadByteBudget, readHostLoad, } from "../sync-core.js";
 import { buildConflictBackupPath, buildConflictId, buildConflictProbePath, readShortMachineId, } from "../lib/conflict-file.js";
 import { appendConflictEntry } from "../lib/conflict-index.js";
-import { isCloudAuthoritative } from "../lib/cloud-authoritative.js";
+import { isLocallyIneligibleForPush } from "../lib/cloud-authoritative.js";
 import { isOntologyEntityKey, ONTOLOGY_MULTI_WRITER_FLAG, resolveOntologyEntityPush, } from "../lib/ontology-entity-push.js";
 import { entityIsFreshForCreate, outboxAllowsEntityPush, readOntologyOutbox, } from "../lib/ontology-outbox.js";
 import { resolveSkillRegisterLandedBytes } from "../lib/skill-register-landed-bytes.js";
@@ -447,7 +447,7 @@ function refusesServerOwnedPush(relativePath, ontologyEntityPush, absolutePath,
             return false;
         return !outboxAllowsEntityPush(ontologyEntityPush, relativePath, absolutePath, plannedHash);
     }
-    return isCloudAuthoritative(relativePath);
+    return isLocallyIneligibleForPush(relativePath, { boardClientOwned: true });
 }
 function computePushPlan(filesToShare, journal, skipUnchanged, onHeartbeat, ontologyEntityPush = false, symlinkContext) {
     const items = [];
@@ -658,6 +658,22 @@ function portablePushSymlinkTarget(absolutePath, relativePath, localTarget, wire
             linkPath = `companies/${context.companySlug}/${relativePath}`;
         }
     }
+    if (scope && scopeRoot) {
+        const localInspection = inspectLocalSymlinkScope({
+            absoluteLinkPath: absolutePath,
+            linkPath,
+            scopeRoot,
+            scope,
+        });
+        if (localInspection.refused) {
+            const event = {
+                classification: localInspection.classification,
+                shape: localInspection.shape,
+            };
+            reportRefusal(event);
+            return { target: "", refused: true, ...event };
+        }
+    }
     const reuseMatchingWireTarget = () => {
         if (wireTarget === undefined || !scope || !materializedTargetMatchesWire(absolutePath, localTarget, wireTarget)) {
             return undefined;
@@ -988,6 +1004,17 @@ async function shareOnce(options) {
     const conflictPaths = [];
     const pathResults = [];
     const plans = await buildSharePlans(run);
+    if (options.preflightOnly === true) {
+        const result = buildShareResult(run, counters, filesRefusedStalePaths, conflictPaths, pathResults, false);
+        result.preflightCounts = {
+            pushes: plans.pushPlan.filesToUpload,
+            remoteDeletes: plans.deletePlan.toDelete.length + plans.decommissionPlan.length,
+        };
+        return result;
+    }
+    if (run.quarantinedPaths.size > 0) {
+        run.emit({ type: "journal-quarantine-unresolved", count: run.quarantinedPaths.size });
+    }
     const serverOwnedRefusals = plans.pushPlan.items.filter((item) => item.action === "refuse-server-owned");
     if (serverOwnedRefusals.length > 0 &&
         serverOwnedRefusals.length === plans.pushPlan.items.length &&
@@ -1261,6 +1288,7 @@ async function createPushRunContext(options) {
         ? wrapFilterWithScope(transferFilter, syncRoot, options.prefixSet, onScopeExcluded)
         : transferFilter;
     const journalSlug = options.journalSlug ?? ctx.slug;
+    const quarantinedPaths = readQuarantinedJournalPaths(journalSlug);
     const flagConfig = vaultConfig ?? privateFolderVaultConfig;
     const symlinkTargetRefusal = flagConfig
         ? await resolveSymlinkTargetRefusalFlag({
@@ -1275,7 +1303,7 @@ async function createPushRunContext(options) {
     // defer its keyed journal read until the exact K upload/delete keys are
     // known. Full/cadence callers retain the complete snapshot here.
     const scopedJournal = options.scopedJournal === true;
-    const journal = scopedJournal ? emptyJournalForScopedPass() : readJournalForPass(journalSlug);
+    const journal = scopedJournal ? emptyJournalForScopedPass() : readJournalForPass(journalSlug, ctx.uid);
     return {
         options,
         ontologyEntityPush: false,
@@ -1303,6 +1331,7 @@ async function createPushRunContext(options) {
         durableShouldSync: baseFilter,
         skipSecretPaths,
         journalSlug,
+        quarantinedPaths,
         journal,
         scopedJournal,
         excludedSet,
@@ -1967,7 +1996,7 @@ async function reconcileLandedCompanySkill(run, relativePath, content, absoluteP
     }
 }
 async function buildSharePlans(run) {
-    const collected = await collectFiles(run.paths, run.hqRoot, run.syncRoot, run.shouldSync, {
+    const collectedAll = await collectFiles(run.paths, run.hqRoot, run.syncRoot, run.shouldSync, {
         onUnreachablePath: (namedPath, reason) => {
             // First reason wins: a path is named once, and re-adding would only
             // churn the map ordering the error message and event sample rely on.
@@ -1979,6 +2008,7 @@ async function buildSharePlans(run) {
         onHeartbeat: run.options.onHeartbeat,
         cooperativeCheckpoint: run.options.cooperativeCheckpoint,
     });
+    const collected = collectedAll.filter((entry) => !run.quarantinedPaths.has(entry.relativePath));
     // Ask #2 of feedback_a51cb63d: "error, not warn-skip, when the named file
     // exists locally but is unreachable by the resolver". This is the throw that
     // makes it true end-to-end — the CLI's push handler already turns a thrown
@@ -1995,7 +2025,7 @@ async function buildSharePlans(run) {
     const deleteScopeRoots = run.propagateDeletes === true
         ? resolveDeleteScopeRoots(run.paths, run.hqRoot, run.syncRoot, run.options.deleteScopeRoots)
         : [];
-    await refreshPushJournalAfterWalk(run, collected.map((entry) => entry.relativePath), deleteScopeRoots);
+    await refreshPushJournalAfterWalk(run, [...collected.map((entry) => entry.relativePath), ...run.quarantinedPaths], deleteScopeRoots);
     // Control-character key filter (macOS Finder Icon\r incident). A key
     // containing a control character can never be stored — validateVaultUploadKey
     // rejects it with INVALID_KEY_CONTROL_CHARS — so planning an upload for one
@@ -2070,6 +2100,9 @@ async function buildSharePlans(run) {
     // push, so ordinary passes make no flag request.
     if (pushEntries.some((entry) => isOntologyEntityKey(entry.relativePath))) {
         run.ontologyEntityPush = await resolveRunOntologyEntityPush(run);
+        if (run.options.personalMode !== true) {
+            run.options.onCatchupOntologyPush?.(run.ctx.slug, run.ontologyEntityPush !== false);
+        }
     }
     const pushPlan = await computePushPlanCooperatively(pushEntries, run.journal, run.skipUnchanged === true, run.options.onHeartbeat, run.options.cooperativeCheckpoint, run.ontologyEntityPush, {
         hqRoot: run.hqRoot,
@@ -2079,11 +2112,15 @@ async function buildSharePlans(run) {
         reportedUnsafeSymlinkPaths: run.reportedUnsafeSymlinkPaths,
     });
     const deletePlan = run.propagateDeletes === true
-        ? await computeDeletePlan(run.journal, run.syncRoot, deleteScopeRoots, run.shouldSync, run.propagateDeletePolicy, run.ctx, run.options.personalMode !== true, run.skipSecretPaths)
+        ? await computeDeletePlan(run.journal, run.syncRoot, deleteScopeRoots, run.shouldSync, run.propagateDeletePolicy, run.ctx, run.options.personalMode !== true, run.skipSecretPaths, run.quarantinedPaths)
         : { toDelete: [], toTombstone: [], refusedStale: [] };
     const decommissionPlan = !run.scopedJournal && (run.options.decommissionPrefixes ?? []).length > 0
         ? computeDecommissionPlan(run.journal, run.options.decommissionPrefixes ?? [], run.propagateDeletePolicy, new Set([...deletePlan.toDelete.map((item) => item.key), ...deletePlan.toTombstone]), run.skipSecretPaths)
         : [];
+    for (let index = decommissionPlan.length - 1; index >= 0; index--) {
+        if (run.quarantinedPaths.has(decommissionPlan[index]))
+            decommissionPlan.splice(index, 1);
+    }
     const remoteDeleteKeys = [
         ...deletePlan.toDelete.map((item) => item.key),
         ...decommissionPlan,
@@ -2179,7 +2216,7 @@ async function refreshPushJournalAfterWalk(run, collectedKeys = [], deleteScopeR
     }
     run.journal = migrateToV2(run.scopedJournal
         ? readJournalScoped(run.journalSlug, collectedKeys, deleteScopeRoots)
-        : readJournalForPass(run.journalSlug));
+        : readJournalForPass(run.journalSlug, run.ctx.uid));
     run.checkpoint.baselineLastSync = run.journal.lastSync;
     run.checkpoint.threshold = checkpointThresholdFor(run.journal, run.options.durableFullPassProgress === true);
     // Purge classifies every journal row and decommission plans likewise scan
@@ -2334,13 +2371,17 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
             hadUploadFailure: false,
         };
     }
-    await primeUploads(run.ctx, initiallyPlannedUploads.map((it) => ({
-        key: it.relativePath,
-        localPath: it.absolutePath,
-        isSymlink: it.kind === "symlink",
-        ...(it.kind === "file" ? { contentHash: it.localHash } : {}),
-        author: run.options.author,
-    })));
+    await primeUploads(run.ctx, initiallyPlannedUploads.map((it) => {
+        const baselineEtag = journalRows(run.journal).get(it.relativePath)?.remoteEtag;
+        return {
+            key: it.relativePath,
+            localPath: it.absolutePath,
+            isSymlink: it.kind === "symlink",
+            ...(it.kind === "file" ? { contentHash: it.localHash } : {}),
+            ...(baselineEtag ? { ifMatch: baselineEtag } : {}),
+            author: run.options.author,
+        };
+    }));
     // Warm the GET presigns the per-item conflict HEAD (remoteMeta) reuses, so a
     // large upload set doesn't mint one presign per HEAD and burst/trip the
     // presign breaker. Mirrors the new-files + tombstone pre-primes on the pull.
@@ -2401,8 +2442,38 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
         }
         planLimitPauses.save(now);
     };
+    let catchupSkipStatWarningReported = false;
+    const recordCatchupSkip = (relativePath, absolutePath, reason) => {
+        const record = run.options.onCatchupSkip;
+        if (!record)
+            return;
+        try {
+            const stat = fs.lstatSync(absolutePath);
+            if (!stat.isFile() && !stat.isSymbolicLink())
+                return;
+            record({
+                company: run.options.personalMode === true ? "personal" : run.ctx.slug,
+                path: relativePath,
+                reason,
+                size: stat.size,
+                mtimeMs: stat.mtimeMs,
+                ...(run.options.catchupGrantVersion
+                    ? { grantVersion: run.options.catchupGrantVersion }
+                    : {}),
+            });
+        }
+        catch (error) {
+            // A path that vanished or became unreadable cannot suppress a later warm-up candidate.
+            if (!catchupSkipStatWarningReported) {
+                catchupSkipStatWarningReported = true;
+                process.stderr.write(`hq-cloud: catch-up skip metadata unavailable; leaving path eligible: ${error instanceof Error ? error.message : String(error)}\n`);
+            }
+        }
+    };
     const settleFreshSkip = (item) => {
         if (item.action === "refuse-server-owned") {
+            // Server-owned paths share the local cloud-authoritative predicate with
+            // warm-up. They never enter the host-local remote-refusal skip store.
             if (run.options.serverOwnedPathPolicy !== "skip") {
                 emitServerOwnedRefusal(run, item.relativePath);
             }
@@ -2496,8 +2567,10 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
         // than for the `localDiverges` recovery. The two cases need different write
         // fences — see the precondition block below.
         let fenceOnObservedRemote = false;
+        let remoteChangedSinceJournal = false;
         // Cloud-authoritative paths (server-regenerated: company-brief.md, board.json,
-        // ontology/ signals/ sources/) are PULL-WINS and server-owned. The push leg must
+        // pipeline-owned ontology/, signals/, and sources/) are PULL-WINS and server-owned.
+        // The push leg must
         // NEVER upload the local copy over them — not just on a two-sided conflict, but on
         // ANY divergence, including a one-sided local change. A stale local mirror (e.g. a
         // second HQ root that shares this machine's sync journal) would otherwise read as
@@ -2528,6 +2601,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
         catch (headErr) {
             if (isAccessDenied(headErr)) {
                 run.scopeExcludedSet.add(relativePath);
+                recordCatchupSkip(relativePath, absolutePath, "access-denied");
                 return;
             }
             throw headErr;
@@ -2539,6 +2613,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
         if (remoteMeta &&
             !journalRows(run.journal).has(relativePath) &&
             isArchivedSessionLog(relativePath, remoteMeta)) {
+            recordCatchupSkip(relativePath, absolutePath, "archived-session-log");
             run.emit({ type: "skip-archived-session-log", path: relativePath });
             counters.filesSkipped++;
             return;
@@ -2634,6 +2709,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
             const remoteContentHash = item.kind === "file" ? publishedContentHash(remoteMeta.metadata) : undefined;
             const remoteChanged = !!journalEntry &&
                 hasRemoteChanged({ ...remoteMeta, contentHash: remoteContentHash }, journalEntry);
+            remoteChangedSinceJournal = remoteChanged;
             // A matching published digest is a content no-op even when SSE-KMS gave
             // this object a fresh ETag. Reconcile the journal to that version without
             // a needless PUT or a phantom two-sided conflict.
@@ -2677,6 +2753,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
             // ordinary journaled edit whose remote is unchanged still uploads.
             const needsRemoteBody = !journalEntry || (localChanged && remoteChanged) || !!journalEntry.localDiverges;
             if (needsRemoteBody && isArchivedSessionLog(relativePath, remoteMeta)) {
+                recordCatchupSkip(relativePath, absolutePath, "archived-session-log");
                 run.emit({ type: "skip-archived-session-log", path: relativePath });
                 counters.filesSkipped++;
                 return;
@@ -2802,7 +2879,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
                 let winnerProbe;
                 let resolution;
                 if (versionAware) {
-                    winnerProbe = await probeRemoteForWinner(run, item, remoteMeta.lastModified);
+                    winnerProbe = await probeRemoteForWinner(run, item, remoteMeta.lastModified, remoteChangedSinceJournal);
                     resolution = "keep";
                 }
                 else {
@@ -3069,6 +3146,11 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
                     settleLandedReconcile(run, relativePath, outcome);
                     checkpointShareJournal(run);
                 }
+                run.options.onAuditPathEvent?.({
+                    path: relativePath,
+                    contentHash: localHash,
+                    bytes: size,
+                });
                 if (alreadyCurrent) {
                     run.emit({ type: "reconciled", path: relativePath, direction: "push" });
                 }
@@ -3127,7 +3209,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
                     // pass starts over); remote winning adopts it exactly as the
                     // pre-flight conflict path would have.
                     const latest = await headRemoteFile(run.ctx, relativePath);
-                    const probe = await probeRemoteForWinner(run, item, latest?.lastModified ?? null);
+                    const probe = await probeRemoteForWinner(run, item, latest?.lastModified ?? null, true);
                     const decision = probe.decision;
                     run.emit({
                         type: "conflict",
@@ -3511,7 +3593,7 @@ function isArchivedSessionLog(relativePath, remoteMeta) {
  * either side, probe failure); the caller then falls back to the historical
  * `keep` outcome (adopt the remote). Session-level auth refusals propagate.
  */
-async function probeRemoteForWinner(run, item, remoteMtime) {
+async function probeRemoteForWinner(run, item, remoteMtime, remoteChangedSinceJournal = false) {
     const probeAbs = buildConflictProbePath(run.hqRoot);
     let parked = false;
     let fetched;
@@ -3565,6 +3647,7 @@ async function probeRemoteForWinner(run, item, remoteMtime) {
                 remoteBytes: fs.readFileSync(probeAbs),
                 localMtime: localStat.mtime,
                 remoteMtime,
+                remoteChangedSinceJournal,
             });
         }
     }
@@ -3871,6 +3954,12 @@ async function executeDeletes(run, deletePlan, decommissionPlan, counters, files
             await deleteRemoteFile(run.ctx, relativePath);
             removeEntry(run.journal, relativePath);
             counters.filesDeleted++;
+            run.options.onAuditPathEvent?.({
+                path: relativePath,
+                ...(entry?.remoteEtag ? { etag: entry.remoteEtag } : {}),
+                bytes: size,
+                deleted: true,
+            });
             run.emit({
                 type: "progress",
                 path: relativePath,
@@ -3941,9 +4030,9 @@ async function executeDeletes(run, deletePlan, decommissionPlan, counters, files
     }
     for (const relativePath of deletePlan.toTombstone) {
         const localPath = localPathForVaultKey(run.syncRoot, relativePath);
+        const entry = journalRows(run.journal).get(relativePath);
         try {
             const lstat = fs.lstatSync(localPath);
-            const entry = journalRows(run.journal).get(relativePath);
             if (lstat.isFile()) {
                 const localHash = hashFile(localPath);
                 if (entry?.hash && entry.hash !== localHash) {
@@ -3994,6 +4083,12 @@ async function executeDeletes(run, deletePlan, decommissionPlan, counters, files
         }
         removeEntry(run.journal, relativePath);
         counters.filesTombstoned++;
+        run.options.onAuditPathEvent?.({
+            path: relativePath,
+            ...(entry?.remoteEtag ? { etag: entry.remoteEtag } : {}),
+            bytes: 0,
+            deleted: true,
+        });
         run.emit({
             type: "progress",
             path: relativePath,
@@ -5327,7 +5422,7 @@ async function computeDeletePlan(journal, syncRoot, scopeRoots, shouldSync, poli
 // True for a COMPANY-scoped push (personalMode !== true). This distinguishes
 // the canonical knowledge-marker layout from the personal-vault layout; it
 // does not reinterpret ordinary vault-relative path segments.
-companyScoped = true, skipSecretPaths = false) {
+companyScoped = true, skipSecretPaths = false, excludedPaths = new Set()) {
     const plan = { toDelete: [], toTombstone: [], refusedStale: [] };
     if (scopeRoots.length === 0)
         return plan;
@@ -5369,6 +5464,8 @@ companyScoped = true, skipSecretPaths = false) {
     const scopeRootSet = new Set(scopeRoots);
     const everyRowInScope = scopeRootSet.has("");
     for (const [relativeKey, entry] of journalRows(journal).entries()) {
+        if (excludedPaths.has(relativeKey))
+            continue;
         const inScope = everyRowInScope || isUnderAnyRoot(relativeKey, scopeRootSet);
         if (!inScope)
             continue;