@indigoai-us/hq-cloud 6.4.0 → 6.6.0

package/dist/cli/rescue-classify-ordering.test.js

@@ -0,0 +1,241 @@
+/**
+ * Integration tests for the rescue classifier's fail-safe ordering and its
+ * handling of nested directory symlinks (src/cli/rescue-core.ts).
+ *
+ * Regression for DEV-1767 (feedback_aa768683): `hq rescue` choked on a
+ * symlinked DIRECTORY under core/ — a reindex artifact such as
+ * `core/knowledge/ad-creative-engine -> ../../personal/knowledge/...` — throwing
+ * `Error: Path is a directory` mid-pass *after* it had already deleted ~10 core
+ * scaffold files, leaving HQ half-applied. `--check` classified the same tree
+ * cleanly, so the dry-run gave false confidence.
+ *
+ * Two invariants are locked here:
+ *   1. A directory symlink under core/ is classified as a droppable reindex
+ *      symlink (never followed, never file-read, never a crash) — exactly like
+ *      a file symlink. The personal/ target it points at is left untouched.
+ *   2. Classification is read-only and runs to completion BEFORE any destructive
+ *      apply. A classifier exception therefore deletes NOTHING (no half-applied
+ *      wipe), and the same classify code path backs both the live run and the
+ *      `--dry-run` plan (parity).
+ *
+ * Like the sibling rescue tests, the source clone is shimmed to a local fixture
+ * repo and the rescue runs in-process so we can assert its on-disk effects.
+ */
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { runRescue } from "./rescue-core.js";
+function hasGit() {
+    try {
+        execFileSync("git", ["--version"], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const gitAvailable = hasGit();
+function runRescueCapture(argv, env) {
+    let stdout = "";
+    let stderr = "";
+    const origOut = process.stdout.write.bind(process.stdout);
+    const origErr = process.stderr.write.bind(process.stderr);
+    process.stdout.write = ((chunk) => {
+        stdout += String(chunk);
+        return true;
+    });
+    process.stderr.write = ((chunk) => {
+        stderr += String(chunk);
+        return true;
+    });
+    let status;
+    let threw;
+    try {
+        status = runRescue(argv, { env }).status;
+    }
+    catch (e) {
+        threw = e;
+    }
+    finally {
+        process.stdout.write = origOut;
+        process.stderr.write = origErr;
+    }
+    return { status, stdout, stderr, threw };
+}
+const lexists = (p) => {
+    try {
+        fs.lstatSync(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+describe.skipIf(!gitAvailable)("rescue classify-before-delete + dir-symlink handling", () => {
+    let workDir;
+    let upstream;
+    let shimDir;
+    let floorSha;
+    let baseEnv;
+    let caseSeq = 0;
+    const git = (cwd, ...args) => execFileSync("git", args, {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: {
+            ...process.env,
+            GIT_AUTHOR_NAME: "t",
+            GIT_AUTHOR_EMAIL: "t@t",
+            GIT_COMMITTER_NAME: "t",
+            GIT_COMMITTER_EMAIL: "t@t",
+        },
+    })
+        .toString()
+        .trim();
+    beforeAll(() => {
+        workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-ordering-"));
+        // Upstream: floor has core/a.md="v1"; HEAD advances it to "v2". core/b.md is
+        // stable across both. The symlink fixtures never appear upstream — they only
+        // exist in the local HQ root as reindex artifacts.
+        upstream = path.join(workDir, "upstream");
+        fs.mkdirSync(path.join(upstream, "core"), { recursive: true });
+        git(workDir, "init", "-b", "main", "upstream");
+        fs.writeFileSync(path.join(upstream, "core/a.md"), "v1\n");
+        fs.writeFileSync(path.join(upstream, "core/b.md"), "beta\n");
+        git(upstream, "add", "-A");
+        git(upstream, "commit", "-m", "floor");
+        floorSha = git(upstream, "rev-parse", "HEAD");
+        fs.writeFileSync(path.join(upstream, "core/a.md"), "v2\n");
+        git(upstream, "add", "-A");
+        git(upstream, "commit", "-m", "head");
+        const realGit = execFileSync("bash", ["-lc", "command -v git"]).toString().trim() || "/usr/bin/git";
+        shimDir = path.join(workDir, "shim");
+        fs.mkdirSync(shimDir, { recursive: true });
+        const shim = `#!/usr/bin/env bash
+if [ "$1" = "clone" ]; then
+  args=()
+  for a in "$@"; do
+    case "$a" in
+      https://github.com/*) a=${JSON.stringify(upstream)} ;;
+    esac
+    args+=("$a")
+  done
+  exec ${JSON.stringify(realGit)} "\${args[@]}"
+fi
+exec ${JSON.stringify(realGit)} "$@"
+`;
+        fs.writeFileSync(path.join(shimDir, "git"), shim, { mode: 0o755 });
+        baseEnv = { ...process.env, PATH: `${shimDir}:${process.env.PATH ?? ""}` };
+    });
+    afterAll(() => {
+        if (workDir)
+            fs.rmSync(workDir, { recursive: true, force: true });
+    });
+    /**
+     * Fresh HQ root per case (live runs mutate). core/a.md matches the floor
+     * (unchanged vs baseline, differs from HEAD -> "delete + replace"); core/b.md
+     * is byte-identical to upstream ("unchanged, preserved in place"). The caller
+     * adds whatever symlink/extra files the case needs.
+     */
+    function makeHqRoot() {
+        caseSeq += 1;
+        const hqRoot = path.join(workDir, `hq-${caseSeq}`);
+        fs.mkdirSync(path.join(hqRoot, "core"), { recursive: true });
+        fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
+        fs.mkdirSync(path.join(hqRoot, "personal/knowledge"), { recursive: true });
+        fs.writeFileSync(path.join(hqRoot, "core/a.md"), "v1\n");
+        fs.writeFileSync(path.join(hqRoot, "core/b.md"), "beta\n");
+        return hqRoot;
+    }
+    const liveArgs = (hqRoot, extra = []) => [
+        "--hq-root", hqRoot,
+        "--source", "test/repo",
+        "--ref", "main",
+        "--floor-sha", floorSha,
+        "--paths", "core",
+        "--yes",
+        "--no-backup",
+        ...extra,
+    ];
+    it("drops a DIRECTORY symlink under core/ as a reindex artifact (no crash, no half-apply)", () => {
+        const hqRoot = makeHqRoot();
+        // The exact DEV-1767 shape: a directory symlink nested under core/ pointing
+        // into personal/. Its target exists and must survive untouched.
+        const target = path.join(hqRoot, "personal/knowledge/ad-creative-engine");
+        fs.mkdirSync(target, { recursive: true });
+        fs.writeFileSync(path.join(target, "keep.md"), "owned by personal\n");
+        fs.mkdirSync(path.join(hqRoot, "core/knowledge"), { recursive: true });
+        const link = path.join(hqRoot, "core/knowledge/ad-creative-engine");
+        fs.symlinkSync("../../personal/knowledge/ad-creative-engine", link);
+        const r = runRescueCapture(liveArgs(hqRoot), baseEnv);
+        const out = `${r.stdout}\n${r.stderr}`;
+        expect(r.threw, out).toBeUndefined();
+        expect(r.status, out).toBe(0);
+        // The bash-era failure signature must never appear.
+        expect(out).not.toMatch(/Path is a directory/);
+        expect(out).not.toMatch(/EISDIR/);
+        // Classified + dropped as exactly one reindex symlink.
+        expect(out).toMatch(/reindex symlinks dropped:\s+1 entries/);
+        // Symlink itself is gone; its personal/ target is untouched.
+        expect(lexists(link)).toBe(false);
+        expect(fs.readFileSync(path.join(target, "keep.md"), "utf-8")).toBe("owned by personal\n");
+        // Real core files still classified correctly around it.
+        expect(fs.existsSync(path.join(hqRoot, "core/a.md"))).toBe(true);
+        expect(fs.existsSync(path.join(hqRoot, "core/b.md"))).toBe(true);
+    });
+    it("drops a FILE symlink under core/ the same way (file-symlink behavior unchanged)", () => {
+        const hqRoot = makeHqRoot();
+        fs.writeFileSync(path.join(hqRoot, "personal/knowledge/note.md"), "personal note\n");
+        const link = path.join(hqRoot, "core/note.md");
+        fs.symlinkSync("../personal/knowledge/note.md", link);
+        const r = runRescueCapture(liveArgs(hqRoot), baseEnv);
+        const out = `${r.stdout}\n${r.stderr}`;
+        expect(r.threw, out).toBeUndefined();
+        expect(r.status, out).toBe(0);
+        expect(out).toMatch(/reindex symlinks dropped:\s+1 entries/);
+        expect(lexists(link)).toBe(false);
+        expect(fs.readFileSync(path.join(hqRoot, "personal/knowledge/note.md"), "utf-8")).toBe("personal note\n");
+    });
+    it("a classifier exception deletes NOTHING (classify fully before any destructive apply)", () => {
+        const hqRoot = makeHqRoot();
+        // core/a.md is classified BEFORE core/zzz.md (sorted walk) as a
+        // "delete + replace". core/zzz.md then throws during classification. If the
+        // wipe were interleaved (old behavior), a.md would already be gone.
+        fs.writeFileSync(path.join(hqRoot, "core/zzz.md"), "trigger\n");
+        const r = runRescueCapture(liveArgs(hqRoot), {
+            ...baseEnv,
+            HQ_RESCUE_FAULT_AT_REL: "core/zzz.md",
+        });
+        const out = `${r.stdout}\n${r.stderr}`;
+        // The injected classifier fault aborts the run.
+        expect(r.threw, out).toBeDefined();
+        expect(String(r.threw)).toMatch(/fault injected at core\/zzz\.md/);
+        // Crucially: the file that was already classified for deletion still exists,
+        // untouched — no half-applied wipe.
+        expect(fs.existsSync(path.join(hqRoot, "core/a.md"))).toBe(true);
+        expect(fs.readFileSync(path.join(hqRoot, "core/a.md"), "utf-8")).toBe("v1\n");
+        expect(fs.existsSync(path.join(hqRoot, "core/b.md"))).toBe(true);
+        expect(fs.existsSync(path.join(hqRoot, "core/zzz.md"))).toBe(true);
+    });
+    it("dry-run classifies the dir-symlink identically to the live run and changes nothing", () => {
+        const hqRoot = makeHqRoot();
+        const target = path.join(hqRoot, "personal/knowledge/ad-creative-engine");
+        fs.mkdirSync(target, { recursive: true });
+        fs.mkdirSync(path.join(hqRoot, "core/knowledge"), { recursive: true });
+        const link = path.join(hqRoot, "core/knowledge/ad-creative-engine");
+        fs.symlinkSync("../../personal/knowledge/ad-creative-engine", link);
+        const r = runRescueCapture(liveArgs(hqRoot, ["--dry-run"]), baseEnv);
+        const out = `${r.stdout}\n${r.stderr}`;
+        expect(r.threw, out).toBeUndefined();
+        expect(r.status, out).toBe(0);
+        // Dry-run surfaces the SAME classification the live pass acts on.
+        expect(out).toContain("drop reindex symlink: core/knowledge/ad-creative-engine");
+        expect(out).toMatch(/reindex symlinks dropped:\s+1 entries/);
+        expect(out).toMatch(/DRY RUN complete\. No filesystem changes made\./);
+        // ...but touches nothing: the symlink (and everything else) is still on disk.
+        expect(lexists(link)).toBe(true);
+        expect(fs.existsSync(path.join(hqRoot, "core/a.md"))).toBe(true);
+    });
+});
+//# sourceMappingURL=rescue-classify-ordering.test.js.map

package/dist/cli/rescue-classify-ordering.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rescue-classify-ordering.test.js","sourceRoot":"","sources":["../../src/cli/rescue-classify-ordering.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,SAAS,MAAM;IACb,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;AAE9B,SAAS,gBAAgB,CAAC,IAAc,EAAE,GAAsB;IAC9D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE;QACzC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC,CAAgC,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE;QACzC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC,CAAgC,CAAC;IAClC,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE;IAC5B,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,QAAQ,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,sDAAsD,EAAE,GAAG,EAAE;IAC1F,IAAI,OAAe,CAAC;IACpB,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAgB,CAAC;IACrB,IAAI,OAA0B,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAG,IAAc,EAAE,EAAE,CAC7C,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QACxB,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,eAAe,EAAE,GAAG;YACpB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,GAAG;YACvB,mBAAmB,EAAE,KAAK;SAC3B;KACF,CAAC;SACC,QAAQ,EAAE;SACV,IAAI,EAAE,CAAC;IAEZ,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAExE,6EAA6E;QAC7E,6EAA6E;QAC7E,mDAAmD;QACnD,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC/C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7D,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3B,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACvC,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3B,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEtC,MAAM,OAAO,GACX,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,cAAc,CAAC;QACtF,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG;;;;;gCAKe,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;;SAI/C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;OAEzB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;CAC7B,CAAC;QACE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE;QACZ,IAAI,OAAO;YAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,SAAS,UAAU;QACjB,OAAO,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC;QACnD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,QAAkB,EAAE,EAAE,EAAE,CAAC;QACzD,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,WAAW;QACvB,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,QAAQ;QACvB,SAAS,EAAE,MAAM;QACjB,OAAO;QACP,aAAa;QACb,GAAG,KAAK;KACT,CAAC;IAEF,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,4EAA4E;QAC5E,gEAAgE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;QAC1E,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,qBAAqB,CAAC,CAAC;QACtE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;QACpE,EAAE,CAAC,WAAW,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC;QAEpE,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAEvC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,oDAAoD;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClC,uDAAuD;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QAC7D,6DAA6D;QAC7D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC3F,wDAAwD;QACxD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC/C,EAAE,CAAC,WAAW,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;QAEtD,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAEvC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACpF,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,gEAAgE;QAChE,4EAA4E;QAC5E,oEAAoE;QACpE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;QAEhE,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;YAC3C,GAAG,OAAO;YACV,sBAAsB,EAAE,aAAa;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAEvC,gDAAgD;QAChD,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QACnE,6EAA6E;QAC7E,oCAAoC;QACpC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9E,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;QAC1E,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;QACpE,EAAE,CAAC,WAAW,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC;QAEpE,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAEvC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,kEAAkE;QAClE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,yDAAyD,CAAC,CAAC;QACjF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC;QACvE,8EAA8E;QAC9E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/rescue-core.js

@@ -609,6 +609,7 @@ function doRescue(cfg, env, out, err, setTmp) {
         unchangedList,
         appendLog,
         out,
+        actions: [],
     };
     // --- Pre-operation safety snapshot (BEFORE any destructive op) ---
     let backupDir = "";
@@ -636,7 +637,17 @@ function doRescue(cfg, env, out, err, setTmp) {
         }
         out(`    snapshot complete (restore any file: cp "${backupDir}/<relpath>" "${hqRoot}/<relpath>")\n`);
     }
-    // --- Walk + classify ---
+    // --- Walk + classify (PHASE 1: read-only) ---
+    // Classification mutates nothing on disk: every destructive op (delete,
+    // rescue-move, conflict-quarantine, symlink-drop) is recorded as a deferred
+    // closure in `ctx.actions` and executed later (PHASE 2). This is the
+    // ordering-safety invariant: if classification throws partway through the
+    // wipe set (e.g. an unreadable entry, a future unhandled file shape), it
+    // aborts HERE — before a single file has been touched — instead of leaving a
+    // half-applied wipe like the pre-port bash classifier did (DEV-1767:
+    // `Error: Path is a directory` on a nested dir-symlink, thrown after ~10 core
+    // files were already deleted). Dry-run runs this exact same pass and then
+    // returns, so the `--check` plan can never miss a condition the live pass hits.
     out("\n");
     if (wipeToplevel.length === 0) {
         out("==> Wipe set is empty; nothing to process or overlay.\n");
@@ -708,6 +719,13 @@ function doRescue(cfg, env, out, err, setTmp) {
         out("==> DRY RUN complete. No filesystem changes made.\n");
         return { status: 0 };
     }
+    // --- Apply classified actions (PHASE 2: destructive) ---
+    // The full wipe set classified without throwing, so it is now safe to mutate.
+    // Actions run in classification (walk) order — the same order the old
+    // interleaved walk mutated in — so per-file output and on-disk results are
+    // unchanged versus before the two-phase split.
+    for (const act of ctx.actions)
+        act();
     // --- Back up preserve-subpaths to a mktemp shuttle ---
     const shuttle = path.join(tmpdir, "preserve");
     fs.mkdirSync(shuttle, { recursive: true });
@@ -1139,10 +1157,21 @@ function conflictOne(ctx, rel) {
     ctx.appendLog(`conflicted\t${rel}\t-> ${destRel}\n`);
 }
 // --- classify + act on one file (the per-file workhorse) ---
+//
+// Read-only by contract: this records intent (counts + dry-run plan lines +
+// deferred `ctx.actions` closures) but never mutates the filesystem itself. The
+// closures are run later by the PHASE 2 apply loop, only once the whole wipe
+// set has classified without throwing. Keep it that way — a stray `fs.rmSync`
+// here re-opens the half-applied-wipe hole this split closed (DEV-1767).
 function processOne(ctx, rel) {
     const { cfg } = ctx;
     const localPath = path.join(ctx.hqRoot, rel);
     const srcPath = path.join(ctx.srcDir, rel);
+    // Test-only fault seam: prove the classify-before-delete ordering invariant
+    // by forcing a classifier throw at a chosen entry. Never set in production.
+    if (ctx.env.HQ_RESCUE_FAULT_AT_REL && rel === ctx.env.HQ_RESCUE_FAULT_AT_REL) {
+        throw new Error(`rescue classifier fault injected at ${rel} (HQ_RESCUE_FAULT_AT_REL)`);
+    }
     if (isUnderPreserve(cfg, rel))
         return;
     // Conflict-resolution artifacts (`<name>.conflict-<ts>-<peer>.<ext>`).
@@ -1152,7 +1181,7 @@ function processOne(ctx, rel) {
             ctx.out(`    drop conflict artifact: ${rel}\n`);
         }
         else {
-            fs.rmSync(localPath, { force: true });
+            ctx.actions.push(() => fs.rmSync(localPath, { force: true }));
         }
         return;
     }
@@ -1162,7 +1191,7 @@ function processOne(ctx, rel) {
             ctx.out(`    skip script-managed (rewrites at stamp step): ${rel}\n`);
         }
         else {
-            fs.rmSync(localPath, { force: true });
+            ctx.actions.push(() => fs.rmSync(localPath, { force: true }));
         }
         return;
     }
@@ -1182,8 +1211,10 @@ function processOne(ctx, rel) {
                 ctx.out(`    drop reindex symlink: ${rel}  ->  ${tgt}\n`);
             }
             else {
-                fs.rmSync(localPath, { force: true });
-                ctx.appendLog(`symlink-dropped\t${rel}\t(reindex regenerable)\n`);
+                ctx.actions.push(() => {
+                    fs.rmSync(localPath, { force: true });
+                    ctx.appendLog(`symlink-dropped\t${rel}\t(reindex regenerable)\n`);
+                });
             }
         }
         return;
@@ -1233,8 +1264,10 @@ function processOne(ctx, rel) {
             ctx.out(`    cloud-symlink reconciled (unchanged): ${rel}  (hq-symlink: marker matches upstream target)\n`);
         }
         else {
-            fs.rmSync(localPath, { force: true });
-            ctx.appendLog(`cloud-symlink-reconciled\t${rel}\t(hq-symlink: marker matches upstream target; overlay re-lays symlink)\n`);
+            ctx.actions.push(() => {
+                fs.rmSync(localPath, { force: true });
+                ctx.appendLog(`cloud-symlink-reconciled\t${rel}\t(hq-symlink: marker matches upstream target; overlay re-lays symlink)\n`);
+            });
         }
         return;
     }
@@ -1245,8 +1278,10 @@ function processOne(ctx, rel) {
             ctx.out(`    drift reconciled (identical to upstream HEAD; no rescue): ${rel}\n`);
         }
         else {
-            fs.rmSync(localPath, { force: true });
-            ctx.appendLog(`drift-reconciled\t${rel}\t(identical to upstream HEAD; drifted from floor only — no personal/ copy)\n`);
+            ctx.actions.push(() => {
+                fs.rmSync(localPath, { force: true });
+                ctx.appendLog(`drift-reconciled\t${rel}\t(identical to upstream HEAD; drifted from floor only — no personal/ copy)\n`);
+            });
         }
         return;
     }
@@ -1271,18 +1306,20 @@ function processOne(ctx, rel) {
         }
         else {
             if (rel === ".claude/CLAUDE.md") {
-                rescueOne(ctx, rel);
+                ctx.actions.push(() => rescueOne(ctx, rel));
             }
             else if (isOverwriteSafe(rel)) {
-                fs.rmSync(localPath, { force: true });
-                ctx.counts.userOverwrite += 1;
-                ctx.appendLog(`overwritten\t${rel}\t(overwrite-safe; upstream wins, no copy preserved)\n`);
+                ctx.actions.push(() => {
+                    fs.rmSync(localPath, { force: true });
+                    ctx.counts.userOverwrite += 1;
+                    ctx.appendLog(`overwritten\t${rel}\t(overwrite-safe; upstream wins, no copy preserved)\n`);
+                });
             }
             else if (isConflictClass(rel)) {
-                conflictOne(ctx, rel);
+                ctx.actions.push(() => conflictOne(ctx, rel));
             }
             else {
-                rescueOne(ctx, rel);
+                ctx.actions.push(() => rescueOne(ctx, rel));
             }
         }
     }
@@ -1294,8 +1331,10 @@ function processOne(ctx, rel) {
                 ctx.out(`    unchanged (preserved in place): ${rel}\n`);
             }
             else {
-                fs.appendFileSync(ctx.unchangedList, `/${rel}\n`);
-                ctx.appendLog(`unchanged\t${rel}\t(identical to upstream; left in place, mtime preserved)\n`);
+                ctx.actions.push(() => {
+                    fs.appendFileSync(ctx.unchangedList, `/${rel}\n`);
+                    ctx.appendLog(`unchanged\t${rel}\t(identical to upstream; left in place, mtime preserved)\n`);
+                });
             }
         }
         else {
@@ -1303,8 +1342,10 @@ function processOne(ctx, rel) {
                 ctx.out(`    unchanged (delete + replace): ${rel}\n`);
             }
             else {
-                fs.rmSync(localPath, { force: true });
-                ctx.appendLog(`deleted\t${rel}\t(unchanged vs baseline; re-laid by overlay if still upstream)\n`);
+                ctx.actions.push(() => {
+                    fs.rmSync(localPath, { force: true });
+                    ctx.appendLog(`deleted\t${rel}\t(unchanged vs baseline; re-laid by overlay if still upstream)\n`);
+                });
             }
         }
     }
@@ -1321,7 +1362,10 @@ function walkAndProcess(ctx, rootRel) {
             ctx.out("    wholesale-replace: companies/_template (template carve-out)\n");
         }
         else {
-            fs.rmSync(path.join(ctx.hqRoot, "companies", "_template"), { recursive: true, force: true });
+            ctx.actions.push(() => fs.rmSync(path.join(ctx.hqRoot, "companies", "_template"), {
+                recursive: true,
+                force: true,
+            }));
         }
         return;
     }
@@ -1341,8 +1385,10 @@ function walkAndProcess(ctx, rootRel) {
                 ctx.out(`    drop reindex symlink: ${rootRel}  ->  ${tgt}\n`);
             }
             else {
-                fs.rmSync(rootAbs, { force: true });
-                ctx.appendLog(`symlink-dropped\t${rootRel}\t(reindex regenerable)\n`);
+                ctx.actions.push(() => {
+                    fs.rmSync(rootAbs, { force: true });
+                    ctx.appendLog(`symlink-dropped\t${rootRel}\t(reindex regenerable)\n`);
+                });
             }
         }
         return;