@indigoai-us/hq-cloud 6.3.3 → 6.3.5

package/src/journal.test.ts

@@ -17,6 +17,7 @@ import {
   writeJournal,
   updateEntry,
   migrateToV2,
+  normalizeJournalKeys,
   appendPullRecord,
   lastPullRecord,
   tombstoneEntry,
@@ -208,6 +209,125 @@ describe("journal", () => {
       expect(raw.version).toBe("2");
       expect(raw.pulls).toEqual([]);
     });
+
+    it("normalizes backslash keys even on an already-v2 journal", () => {
+      // The landmine predates the v2 bump, so a poisoned journal can be v2.
+      // migrateToV2's early-return must not skip normalization.
+      const j: SyncJournal = {
+        version: "2",
+        lastSync: "",
+        files: {
+          "projects\\forecast\\x.csv": {
+            hash: "h",
+            size: 1,
+            syncedAt: "2026-06-10",
+            direction: "down",
+          },
+        },
+        pulls: [],
+      };
+      migrateToV2(j);
+      expect(j.files["projects\\forecast\\x.csv"]).toBeUndefined();
+      expect(j.files["projects/forecast/x.csv"]).toBeDefined();
+    });
+  });
+
+  describe("normalizeJournalKeys (Windows backslash-key landmine — ridge data loss)", () => {
+    // Regression for feedback_b8d09d0f: pre-5.47.2 Windows clients stamped
+    // journal keys with path.sep ("\\"). Those keys never match the
+    // forward-slash remote LIST, so the cross-machine delete planner classed
+    // live local files as remote-deleted and path.join collapsed the key back
+    // onto the real file — deleting ~36 live files in a single pull. The
+    // canonical defense is rewriting every key to POSIX form on load.
+    it("rewrites backslash keys to POSIX form and reports the count", () => {
+      const j: SyncJournal = {
+        version: "2",
+        lastSync: "",
+        files: {
+          "projects\\forecast-development\\forecasts\\sean-frank.csv": {
+            hash: "h1",
+            size: 10,
+            syncedAt: "2026-06-10",
+            direction: "down",
+          },
+          "docs\\notes.md": {
+            hash: "h2",
+            size: 5,
+            syncedAt: "2026-06-10",
+            direction: "down",
+          },
+        },
+        pulls: [],
+      };
+      const rewritten = normalizeJournalKeys(j);
+      expect(rewritten).toBe(2);
+      expect(
+        j.files["projects/forecast-development/forecasts/sean-frank.csv"],
+      ).toBeDefined();
+      expect(j.files["docs/notes.md"]).toBeDefined();
+      // No malformed keys survive.
+      expect(
+        Object.keys(j.files).some((k) => k.includes("\\")),
+      ).toBe(false);
+      // Entry payload is preserved verbatim under the new key.
+      expect(j.files["docs/notes.md"]?.hash).toBe("h2");
+    });
+
+    it("leaves a clean (all-POSIX) journal untouched and returns 0", () => {
+      const j: SyncJournal = {
+        version: "2",
+        lastSync: "",
+        files: {
+          "docs/a.md": { hash: "h", size: 1, syncedAt: "x", direction: "down" },
+        },
+        pulls: [],
+      };
+      const before = JSON.stringify(j);
+      const rewritten = normalizeJournalKeys(j);
+      expect(rewritten).toBe(0);
+      expect(JSON.stringify(j)).toBe(before);
+    });
+
+    it("prefers an existing POSIX twin and drops the malformed duplicate", () => {
+      // When both forms exist, the POSIX entry is authoritative (it round-
+      // tripped through an up-to-date client). The malformed dup is discarded.
+      const j: SyncJournal = {
+        version: "2",
+        lastSync: "",
+        files: {
+          "docs/a.md": {
+            hash: "posix-wins",
+            size: 1,
+            syncedAt: "x",
+            direction: "down",
+          },
+          "docs\\a.md": {
+            hash: "backslash-loses",
+            size: 2,
+            syncedAt: "x",
+            direction: "down",
+          },
+        },
+        pulls: [],
+      };
+      normalizeJournalKeys(j);
+      expect(j.files["docs\\a.md"]).toBeUndefined();
+      expect(j.files["docs/a.md"]?.hash).toBe("posix-wins");
+    });
+
+    it("is idempotent — a second pass rewrites nothing", () => {
+      const j: SyncJournal = {
+        version: "2",
+        lastSync: "",
+        files: {
+          "a\\b\\c.txt": { hash: "h", size: 1, syncedAt: "x", direction: "down" },
+        },
+        pulls: [],
+      };
+      expect(normalizeJournalKeys(j)).toBe(1);
+      expect(normalizeJournalKeys(j)).toBe(0);
+      expect(j.files["a/b/c.txt"]).toBeDefined();
+    });
   });
 
   describe("generatePullId", () => {

package/src/journal.ts

@@ -18,6 +18,7 @@ import * as os from "os";
 import * as path from "path";
 import * as crypto from "crypto";
 import type { SyncJournal, JournalEntry, PullRecord } from "./types.js";
+import { toPosixKey } from "./s3.js";
 
 /** Tombstone retention. 30 days in milliseconds — roughly two release cycles. */
 export const TOMBSTONE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
@@ -134,6 +135,42 @@ export function readJournal(slug: string): SyncJournal {
   return { version: JOURNAL_VERSION_CURRENT, lastSync: "", files: {}, pulls: [] };
 }
 
+/**
+ * Defuse the pre-5.47.2 Windows backslash-key landmine in a journal's `files`
+ * map. Such clients stamped keys with the OS path separator ("\\"), e.g.
+ * `projects\\forecast-development\\x.csv`. A backslash key is a live data-loss
+ * hazard for the cross-machine delete planner (Bug #9): it never matches the
+ * forward-slash remote LIST, so the planner classifies the still-present local
+ * file as remote-deleted, and `path.join(companyRoot, key)` collapses the
+ * backslashes back onto the REAL POSIX file — which the executor then unlinks
+ * (ridge incident, feedback_b8d09d0f: a single pull deleted ~36 live files,
+ * with 587 backslash keys left in the journal as a recurring landmine).
+ *
+ * Rewriting every key to its canonical POSIX form on load removes the hazard
+ * idempotently — a clean (all-POSIX) journal is returned untouched. Merge rule:
+ * if a key's POSIX twin already exists, the POSIX entry is authoritative (it
+ * round-tripped through an up-to-date client) and the malformed duplicate is
+ * dropped; otherwise the entry is moved to its POSIX key. Returns the number of
+ * keys rewritten (0 for a clean journal) for telemetry and test assertions.
+ */
+export function normalizeJournalKeys(journal: SyncJournal): number {
+  if (!journal.files) return 0;
+  let rewritten = 0;
+  // Snapshot keys up front — we mutate journal.files during the walk.
+  for (const key of Object.keys(journal.files)) {
+    const posix = toPosixKey(key);
+    if (posix === key) continue; // already canonical (no backslash)
+    const entry = journal.files[key];
+    delete journal.files[key];
+    rewritten++;
+    // POSIX twin already present → it wins; drop the malformed duplicate.
+    if (!(posix in journal.files)) {
+      journal.files[posix] = entry;
+    }
+  }
+  return rewritten;
+}
+
 /**
  * Coerce any-version journal into a v2 shape. Idempotent for v2 inputs.
  * Mutates the input and returns it for chainable use. Call this immediately
@@ -145,6 +182,10 @@ export function readJournal(slug: string): SyncJournal {
  * "all" in the scope-shrink algorithm).
  */
 export function migrateToV2(journal: SyncJournal): SyncJournal {
+  // Backslash-key normalization runs UNCONDITIONALLY — a poisoned journal can
+  // already carry version "2" (the landmine predates the schema bump), so this
+  // must precede the v2 early-return or already-v2 journals stay poisoned.
+  normalizeJournalKeys(journal);
   if (journal.version === "2" && Array.isArray(journal.pulls)) {
     return journal;
   }

package/src/personal-vault.test.ts

@@ -319,4 +319,31 @@ describe("personal-vault helpers", () => {
     expect(out).toContain(path.join("companies", "foo"));
     expect(out).not.toContain(path.join("companies", "team-acme"));
   });
+
+  it("manifest: stray `manifest.yaml.conflict-*` litter is never enumerated as a company", () => {
+    // Regression guard for DEV-1719's secondary symptom: when the personal
+    // push accumulated `companies/manifest.yaml.conflict-<ts>.yaml` mirror
+    // files, those FILES must never be mis-counted as company subdirs (they
+    // are not directories) nor leak into the push set. The real manifest.yaml
+    // is still included; the conflict litter is not.
+    fs.mkdirSync(path.join(hqRoot, "companies"));
+    fs.writeFileSync(
+      path.join(hqRoot, "companies", "manifest.yaml"),
+      "companies: {}\n",
+    );
+    fs.writeFileSync(
+      path.join(hqRoot, "companies", "manifest.yaml.conflict-2026-06-08T10-00-00Z-ab12cd.yaml"),
+      "companies: {}\n",
+    );
+
+    // Not treated as a company subdir (only directories are eligible).
+    expect(computePersonalCompanySubdirs(hqRoot)).toEqual([]);
+
+    // Push set carries the real manifest, never the conflict litter.
+    const out = rel(computePersonalVaultPaths(hqRoot, { includeLocalCompanies: true }));
+    expect(out).toContain(path.join("companies", "manifest.yaml"));
+    expect(
+      out.some((p) => p.includes("manifest.yaml.conflict-")),
+    ).toBe(false);
+  });
 });

package/src/personal-vault.ts

@@ -30,10 +30,12 @@
  * INCLUDED as of user directive 2026-05-13. `core/` ships the hq-core
  * scaffold — policies/, settings/, skills/, workers/, plus the rules
  * manifest at core/core.yaml. `data/` and `personal/` carry per-user data,
- * policies, hooks, and skills that follow the user across machines. The
- * hq-root identity marker `core.yaml` (at hq_root, distinct from
- * `core/core.yaml`) is filtered separately by the root-anchored
- * `/core.yaml` DEFAULT_IGNORES rule.
+ * policies, hooks, and skills that follow the user across machines. A
+ * root-level `core.yaml` (at hq_root, distinct from `core/core.yaml`) is
+ * filtered layout-aware in `createIgnoreFilter`: excluded only when
+ * `core/core.yaml` exists (v15+, where root core.yaml is a stale duplicate);
+ * on v12–v14 roots with no `core/core.yaml`, the root `core.yaml` IS the
+ * scaffold/version manifest and round-trips like any other top-level file.
  */
 
 import * as fs from "fs";