@indigoai-us/hq-cloud 6.18.95 → 6.18.97

package/dist/journal.js

@@ -605,6 +605,242 @@ export function migratePersonalVaultJournal() {
     const legacy = readJournal("personal");
     writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, legacy);
 }
+const PERSONAL_VAULT_OWNER_FORMAT = "hq-personal-vault-owner@2";
+const PERSONAL_VAULT_STASH_FORMAT = "hq-personal-vault-stash@2";
+/**
+ * Bind the personal-vault journal to the signed-in identity.
+ *
+ * feedback_447d143f / feedback_d1296824: the personal-vault journal was keyed
+ * only by `PERSONAL_VAULT_JOURNAL_SLUG`. After an identity switch on the same
+ * machine, person B's first personal sync read person A's rows, saw every one
+ * of A's files missing from B's bucket, treated them as remote deletes, and
+ * deleted them locally.
+ *
+ * Contract (hq-cloud#1028 review):
+ * - An owner record holds the person uid plus bucket, region and endpoint.
+ *   Any mismatch with the caller's identity means the slug journal is not
+ *   this caller's: its rows are stashed for the recorded owner and the caller
+ *   gets its own stash back, or an empty journal. An empty journal tracks
+ *   nothing, so it can never drive a local delete.
+ * - Fail closed: a journal with rows and no owner record is adopted only when
+ *   its pull history names the caller and nobody else. Empty or mixed pull
+ *   history, an unreadable owner record, or an owner record from an older
+ *   format are "unproven": the rows are set aside in a recovery stash, a
+ *   durable `recovery.json` is written, and the caller starts empty. A new
+ *   install (no journal, or no rows) adopts silently.
+ * - Crash safety: the outgoing owner's stash is written first while the owner
+ *   record still proves whose rows are in the slug journal, then the owner
+ *   record is marked `pending`, then the slug journal is replaced, then the
+ *   owner record names the new owner. A crash at any point leaves either the
+ *   old proven state or a `pending` record, and a `pending` record is never
+ *   used to stash the slug journal's rows under anyone.
+ *
+ * Stashes live outside the journal namespace (plain JSON under the state dir)
+ * so journal enumeration never mistakes them for a company shard.
+ */
+export function bindPersonalVaultJournalToIdentity(identity) {
+    const caller = typeof identity === "string" ? { uid: identity } : identity;
+    if (!caller.uid)
+        return {};
+    const ownerPath = personalVaultOwnerPath();
+    const read = readPersonalVaultOwner(ownerPath);
+    if (read.kind === "ok" && read.record.pending !== true && read.record.owner) {
+        const owner = read.record.owner;
+        if (identityMatches(owner, caller)) {
+            // Fill in vault coordinates the record was missing (uid-only binds).
+            const merged = mergeIdentity(owner, caller);
+            if (!sameIdentity(merged, owner))
+                writePersonalVaultOwner(ownerPath, { format: PERSONAL_VAULT_OWNER_FORMAT, owner: merged });
+            return {};
+        }
+        const current = readJournal(PERSONAL_VAULT_JOURNAL_SLUG);
+        const previousStash = personalVaultStashPath(owner.uid);
+        // Never let an empty journal overwrite the previous owner's real stash.
+        if (Object.keys(current.files).length > 0 || !fs.existsSync(previousStash)) {
+            writePersonalVaultStash(previousStash, owner, current);
+        }
+        installPersonalVaultJournal(ownerPath, caller);
+        return {};
+    }
+    if (read.kind === "ok" && read.record.pending === true) {
+        // Interrupted switch: the slug journal's rows are unproven. Every stash
+        // that mattered was written before `pending`; install the caller's own.
+        installPersonalVaultJournal(ownerPath, caller);
+        return {};
+    }
+    const current = readJournal(PERSONAL_VAULT_JOURNAL_SLUG);
+    const currentRows = Object.keys(current.files).length;
+    if (read.kind === "none") {
+        const pullOwners = new Set((current.pulls ?? [])
+            .map((pull) => pull.companyUid)
+            .filter((uid) => typeof uid === "string" && uid.length > 0));
+        if (currentRows === 0 || (pullOwners.size === 1 && pullOwners.has(caller.uid))) {
+            writePersonalVaultOwner(ownerPath, { format: PERSONAL_VAULT_OWNER_FORMAT, owner: caller });
+            return {};
+        }
+        if (pullOwners.size === 1) {
+            // Proven by pull history to belong to exactly one other person; their
+            // bucket is unknown, so the stash records the uid only.
+            const [otherUid] = [...pullOwners];
+            writePersonalVaultStash(personalVaultStashPath(otherUid), { uid: otherUid }, current);
+            installPersonalVaultJournal(ownerPath, caller);
+            return {};
+        }
+    }
+    // Unproven ownership (no pull history, mixed history, unreadable or
+    // old-format owner record): set the rows aside, never delete on them.
+    const reason = read.kind === "unreadable" ? "unreadable-owner-record" : "unproven-legacy-journal";
+    if (currentRows > 0) {
+        const stashName = `unproven-${Date.now()}-${process.pid}.json`;
+        writePersonalVaultStash(path.join(personalVaultIdentityDir(), stashName), undefined, current);
+        writeJsonAtomic(path.join(personalVaultIdentityDir(), "recovery.json"), {
+            format: "hq-personal-vault-recovery@1",
+            reason,
+            stash: stashName,
+            at: new Date().toISOString(),
+        });
+    }
+    installPersonalVaultJournal(ownerPath, caller);
+    return currentRows > 0 || read.kind === "unreadable" ? { fenced: reason } : {};
+}
+/**
+ * Explicit adoption: the caller asserts that the personal-vault journal now on
+ * disk belongs to `identity` (for example a recovery command run by the
+ * signed-in person, or a test seeding a journal). This is the only way an
+ * unmarked journal with rows is kept without proof from its pull history.
+ * It never deletes anything and clears a pending recovery record.
+ */
+export function adoptPersonalVaultJournalForIdentity(identity) {
+    if (!identity.uid)
+        throw new Error("journal: adoption needs a person uid");
+    writePersonalVaultOwner(personalVaultOwnerPath(), { format: PERSONAL_VAULT_OWNER_FORMAT, owner: identity });
+    fs.rmSync(path.join(personalVaultIdentityDir(), "recovery.json"), { force: true });
+}
+function installPersonalVaultJournal(ownerPath, caller) {
+    writePersonalVaultOwner(ownerPath, { format: PERSONAL_VAULT_OWNER_FORMAT, pending: true });
+    let next = emptyJournal();
+    const stashPath = personalVaultStashPath(caller.uid);
+    const stash = readPersonalVaultStash(stashPath);
+    // A stash recorded for a different bucket, region or endpoint is not
+    // restored; it stays on disk and the caller starts empty.
+    if (stash && (!stash.owner || identityMatches(stash.owner, caller)))
+        next = stash.journal;
+    writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, next);
+    writePersonalVaultOwner(ownerPath, {
+        format: PERSONAL_VAULT_OWNER_FORMAT,
+        owner: stash?.owner ? mergeIdentity(stash.owner, caller) : caller,
+    });
+}
+function identityMatches(recorded, caller) {
+    if (recorded.uid !== caller.uid)
+        return false;
+    for (const field of ["bucket", "region", "endpoint"]) {
+        if (recorded[field] !== undefined && caller[field] !== undefined && recorded[field] !== caller[field])
+            return false;
+    }
+    return true;
+}
+function mergeIdentity(recorded, caller) {
+    const merged = { uid: recorded.uid };
+    for (const field of ["bucket", "region", "endpoint"]) {
+        const value = recorded[field] ?? caller[field];
+        if (value !== undefined)
+            merged[field] = value;
+    }
+    return merged;
+}
+function sameIdentity(a, b) {
+    return a.uid === b.uid && a.bucket === b.bucket && a.region === b.region && a.endpoint === b.endpoint;
+}
+function personalVaultIdentityDir() {
+    return path.join(getStateDir(), "personal-vault-identities");
+}
+function personalVaultOwnerPath() {
+    return path.join(personalVaultIdentityDir(), "owner.json");
+}
+function personalVaultStashPath(identityUid) {
+    const id = crypto.createHash("sha256").update(identityUid).digest("hex").slice(0, 32);
+    return path.join(personalVaultIdentityDir(), `journal-${id}.json`);
+}
+function readPersonalVaultOwner(ownerPath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(ownerPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { kind: "none" };
+        return { kind: "unreadable" };
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || parsed.format !== PERSONAL_VAULT_OWNER_FORMAT)
+            return { kind: "unreadable" };
+        if (parsed.pending === true)
+            return { kind: "ok", record: { format: PERSONAL_VAULT_OWNER_FORMAT, pending: true } };
+        const owner = parsed.owner;
+        if (!owner || typeof owner.uid !== "string" || !owner.uid)
+            return { kind: "unreadable" };
+        return { kind: "ok", record: { format: PERSONAL_VAULT_OWNER_FORMAT, owner } };
+    }
+    catch {
+        return { kind: "unreadable" };
+    }
+}
+function writePersonalVaultOwner(ownerPath, record) {
+    writeJsonAtomic(ownerPath, record);
+}
+function writePersonalVaultStash(stashPath, owner, journal) {
+    writeJsonAtomic(stashPath, { format: PERSONAL_VAULT_STASH_FORMAT, owner, journal: plainJournalCopy(journal) });
+}
+function readPersonalVaultStash(stashPath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(stashPath, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        // Stashes from an older format carry no owner coordinates; they are not
+        // trusted and the caller starts empty (no deletes).
+        if (parsed?.format !== PERSONAL_VAULT_STASH_FORMAT)
+            return undefined;
+        const journal = parsed.journal;
+        if (!journal || typeof journal !== "object" || !journal.files || typeof journal.files !== "object")
+            return undefined;
+        migrateToV2(journal);
+        return { owner: parsed.owner, journal };
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeJsonAtomic(filePath, value) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const tmp = `${filePath}.${process.pid}.tmp`;
+    const fd = fs.openSync(tmp, "w");
+    try {
+        fs.writeSync(fd, JSON.stringify(value));
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, filePath);
+}
+function plainJournalCopy(journal) {
+    const files = {};
+    for (const [key, entry] of Object.entries(journal.files))
+        files[key] = { ...entry };
+    return {
+        version: journal.version,
+        lastSync: journal.lastSync,
+        files,
+        pulls: [...(journal.pulls ?? [])],
+    };
+}
 /**
  * Read a per-company journal from disk.
  *
@@ -619,6 +855,8 @@ export function migratePersonalVaultJournal() {
  * installs never pass through v1 on disk.
  */
 export function readJournal(slug, companyUid) {
+    if (slug === PERSONAL_VAULT_JOURNAL_SLUG && companyUid)
+        bindPersonalVaultJournalToIdentity(companyUid);
     const areaMigration = openAreaMigrationIfAuthoritative(slug);
     if (areaMigration) {
         // Area rows stay in their shared packed store. This record-compatible
@@ -647,6 +885,10 @@ export function readJournal(slug, companyUid) {
  * @internal Full-pull boundary; not a public journal record API.
  */
 export function readJournalForPass(slug, companyUid) {
+    // feedback_447d143f: a pass over the personal-vault journal must only ever
+    // see the rows of the identity it runs as.
+    if (slug === PERSONAL_VAULT_JOURNAL_SLUG && companyUid)
+        bindPersonalVaultJournalToIdentity(companyUid);
     const areaMigration = openAreaMigrationIfAuthoritative(slug);
     if (!areaMigration)
         return readJournal(slug, companyUid);