@openparachute/vault 0.7.5 → 0.7.6-rc.2

package/src/mirror-remote-guard.test.ts

@@ -18,6 +18,8 @@ import {
   sameRemoteIdentity,
   claimedRemoteOf,
   findConflictingVault,
+  findUnrelatedRemoteHistory,
+  unrelatedHistoryMessage,
 } from "./mirror-remote-guard.ts";
 import { writeMirrorConfigForVault, defaultMirrorConfig } from "./mirror-config.ts";
 import { writeCredentials } from "./mirror-credentials.ts";
@@ -267,3 +269,160 @@ describe("findConflictingVault", () => {
     expect(findConflictingVault("b", "   ")).toBeNull();
   });
 });
+
+// ---------------------------------------------------------------------------
+// vault#823 — unrelated-history guard, against REAL git repos.
+//
+// The failure being guarded is deterministic and reproduces in plain git:
+// give a remote some history, `git init` a fresh mirror beside it, bind, push
+// → `! [rejected] (non-fast-forward)`, forever. These tests build exactly that
+// on disk rather than mocking the object database, because the whole claim is
+// about what git does with two roots.
+// ---------------------------------------------------------------------------
+
+function git(cwd: string, ...args: string[]): void {
+  const proc = Bun.spawnSync(["git", ...args], {
+    cwd,
+    stdout: "ignore",
+    stderr: "ignore",
+    env: {
+      ...process.env,
+      GIT_AUTHOR_NAME: "t",
+      GIT_AUTHOR_EMAIL: "t@example.com",
+      GIT_COMMITTER_NAME: "t",
+      GIT_COMMITTER_EMAIL: "t@example.com",
+      GIT_CONFIG_GLOBAL: "/dev/null",
+      GIT_CONFIG_SYSTEM: "/dev/null",
+    },
+  });
+  if (!proc.success) throw new Error(`git ${args.join(" ")} failed in ${cwd}`);
+}
+
+function headShasOf(repo: string): string[] {
+  const proc = Bun.spawnSync(["git", "ls-remote", repo], { stdout: "pipe", stderr: "ignore" });
+  return new TextDecoder()
+    .decode(proc.stdout)
+    .split("\n")
+    .map((l) => l.split("\t")[0])
+    .filter((s) => /^[0-9a-f]{40}$/.test(s));
+}
+
+describe("findUnrelatedRemoteHistory (vault#823)", () => {
+  test("fresh mirror + non-empty remote → flagged, and the real push really is rejected", async () => {
+    const root = tmp("pv-unrelated-");
+    const remote = path.join(root, "remote.git");
+    fs.mkdirSync(remote, { recursive: true });
+    git(remote, "init", "-q", "--bare");
+
+    // Seed the remote with history, the way a prior machine's mirror would.
+    const seed = path.join(root, "seed");
+    fs.mkdirSync(seed);
+    git(seed, "init", "-q", "-b", "main");
+    fs.writeFileSync(path.join(seed, "n1.md"), "note one");
+    git(seed, "add", "-A");
+    git(seed, "commit", "-qm", "vault export 1");
+    git(seed, "push", "-q", remote, "HEAD:main");
+
+    // The imported box: notes came across, the mirror is a fresh `git init`.
+    const mirror = path.join(root, "mirror");
+    fs.mkdirSync(mirror);
+    git(mirror, "init", "-q", "-b", "main");
+    fs.writeFileSync(path.join(mirror, "n1.md"), "note one");
+    git(mirror, "add", "-A");
+    git(mirror, "commit", "-qm", "vault mirror seed");
+
+    const heads = headShasOf(remote);
+    expect(heads.length).toBeGreaterThan(0);
+
+    const found = await findUnrelatedRemoteHistory({
+      mirrorPath: mirror,
+      remoteUrl: `https://github.com/a/b.git`,
+      remoteHeads: heads,
+    });
+    expect(found).not.toBeNull();
+    expect(found?.mirrorIsFresh).toBe(false); // the dir exists, it's just unrelated
+
+    // And the thing the guard is predicting actually happens.
+    const push = Bun.spawnSync(["git", "push", remote, "HEAD:main"], {
+      cwd: mirror,
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+    expect(push.success).toBe(false);
+    expect(new TextDecoder().decode(push.stderr)).toContain("rejected");
+  });
+
+  test("mirror cloned FROM the remote → not flagged (re-bind after token rotation)", async () => {
+    const root = tmp("pv-related-");
+    const remote = path.join(root, "remote.git");
+    fs.mkdirSync(remote, { recursive: true });
+    git(remote, "init", "-q", "--bare");
+    const seed = path.join(root, "seed");
+    fs.mkdirSync(seed);
+    git(seed, "init", "-q", "-b", "main");
+    fs.writeFileSync(path.join(seed, "n1.md"), "note one");
+    git(seed, "add", "-A");
+    git(seed, "commit", "-qm", "vault export 1");
+    git(seed, "push", "-q", remote, "HEAD:main");
+
+    const mirror = path.join(root, "mirror");
+    git(root, "clone", "-q", remote, mirror);
+
+    const found = await findUnrelatedRemoteHistory({
+      mirrorPath: mirror,
+      remoteUrl: "https://github.com/a/b.git",
+      remoteHeads: headShasOf(remote),
+    });
+    expect(found).toBeNull();
+  });
+
+  test("empty remote → not flagged (the ordinary fresh-repo setup)", async () => {
+    const root = tmp("pv-emptyremote-");
+    const mirror = path.join(root, "mirror");
+    fs.mkdirSync(mirror, { recursive: true });
+    git(mirror, "init", "-q", "-b", "main");
+    const found = await findUnrelatedRemoteHistory({
+      mirrorPath: mirror,
+      remoteUrl: "https://github.com/a/b.git",
+      remoteHeads: [],
+    });
+    expect(found).toBeNull();
+  });
+
+  test("no mirror on disk yet + non-empty remote → flagged as fresh", async () => {
+    const root = tmp("pv-nomirror-");
+    const found = await findUnrelatedRemoteHistory({
+      mirrorPath: path.join(root, "does-not-exist"),
+      remoteUrl: "https://github.com/a/b.git",
+      remoteHeads: ["a".repeat(40)],
+    });
+    expect(found).not.toBeNull();
+    expect(found?.mirrorIsFresh).toBe(true);
+  });
+
+  test("null mirrorPath + non-empty remote → flagged as fresh", async () => {
+    const found = await findUnrelatedRemoteHistory({
+      mirrorPath: null,
+      remoteUrl: "https://github.com/a/b.git",
+      remoteHeads: ["b".repeat(40)],
+    });
+    expect(found?.mirrorIsFresh).toBe(true);
+  });
+
+  test("message names the repo, the cause, and never leaks a token", () => {
+    const msg = unrelatedHistoryMessage({
+      remoteIdentity: "github.com/aaron/my-vault",
+      mirrorIsFresh: true,
+    });
+    expect(msg).toContain("github.com/aaron/my-vault");
+    expect(msg).toContain("non-fast-forward");
+    expect(msg).toContain("override=true");
+
+    // Unparseable URL falls back to a userinfo-stripped form, not the raw one.
+    const leaky = unrelatedHistoryMessage({
+      remoteIdentity: "not a url",
+      mirrorIsFresh: false,
+    });
+    expect(leaky).not.toContain("@");
+  });
+});

package/src/mirror-remote-guard.ts

@@ -271,3 +271,127 @@ export function remoteConflictMessage(conflict: RemoteConflict): string {
     `If you're sure (e.g. you just moved the repo between vaults), pass override=true to proceed anyway.`
   );
 }
+
+// ---------------------------------------------------------------------------
+// Unrelated-history guard (vault#823).
+//
+// Field report: a vault imported from a git repo, then armed Sync against that
+// same repo, and every push for five days was refused as non-fast-forward.
+// `mirror-import.ts` clones to a TEMP dir, imports notes into the store, and
+// deletes the temp dir — it never touches the mirror dir. The mirror is then
+// stood up fresh by `bootstrapInternalMirror` (`git init` + seed commit), so
+// its root commit has no relationship to anything on the remote. Two histories,
+// no common ancestor, and no push can ever land. It is deterministic, not a
+// race: ANY import onto a non-empty remote produces a mirror that can never
+// push.
+//
+// The cross-vault guard above answers "is someone else using this repo?". This
+// one answers a different question about the SAME bind: "can my history reach
+// theirs at all?" — and it is the one the import path needs, because on that
+// path the remote is not a stranger's repo, it is the repo we just cloned FROM.
+//
+// Detection, without a fetch: ask the remote for its head shas (`ls-remote`,
+// already run at the PAT bind point), then ask the mirror whether it HOLDS any
+// of those objects (`git cat-file -e`). A mirror that was cloned from — or has
+// ever pushed to — the remote holds them. A freshly-`git init`ed one does not.
+// ---------------------------------------------------------------------------
+
+/** A detected unrelated-history bind — the mirror can never push to this remote. */
+export interface UnrelatedHistory {
+  /** Normalized repo identity, or the raw URL when it can't be parsed. */
+  remoteIdentity: string;
+  /** True when the mirror dir doesn't exist / holds no commits yet. */
+  mirrorIsFresh: boolean;
+}
+
+/**
+ * Does `mirrorPath` hold at least one of `remoteHeads`?
+ *
+ * `git cat-file -e <sha>^{commit}` is a local object-database lookup — no
+ * network, no fetch, no working-tree touch. Fails closed to `false` (we do not
+ * hold it) on any spawn error, which routes into "unrelated" and therefore into
+ * a warning rather than a silent arm. That is the safe direction: the cost of a
+ * false warning is one confused operator; the cost of a false all-clear is five
+ * days with no backup.
+ */
+async function mirrorHoldsAnyRemoteHead(
+  mirrorPath: string,
+  remoteHeads: string[],
+  spawnImpl: typeof Bun.spawn = Bun.spawn,
+): Promise<boolean> {
+  for (const sha of remoteHeads) {
+    if (!/^[0-9a-f]{7,64}$/.test(sha)) continue;
+    try {
+      const proc = spawnImpl(["git", "cat-file", "-e", `${sha}^{commit}`], {
+        cwd: mirrorPath,
+        stdout: "ignore",
+        stderr: "ignore",
+      });
+      if ((await proc.exited) === 0) return true;
+    } catch {
+      // git missing / path unreadable — treat as "not held" and keep going.
+    }
+  }
+  return false;
+}
+
+/**
+ * Detect a bind whose pushes can never land: a non-empty remote whose history
+ * the local mirror cannot reach.
+ *
+ * Returns null (bind is fine) when:
+ *   - the remote is EMPTY — nothing to conflict with; the first push defines
+ *     the history. This is the ordinary "fresh repo" setup and must not warn.
+ *   - the mirror already holds one of the remote's heads — it was cloned from
+ *     there, or has pushed there before. Re-binding after a token rotation
+ *     lands here and must not warn.
+ *
+ * Returns a struct (bind will never push) when the remote has refs and the
+ * mirror holds none of them — including the case where the mirror does not
+ * exist yet, because what gets created will be a fresh `git init`.
+ */
+export async function findUnrelatedRemoteHistory(opts: {
+  mirrorPath: string | null;
+  remoteUrl: string;
+  /** Head shas from `git ls-remote` — empty array means an empty remote. */
+  remoteHeads: string[];
+  /** Test seam. */
+  spawnImpl?: typeof Bun.spawn;
+}): Promise<UnrelatedHistory | null> {
+  const { mirrorPath, remoteUrl, remoteHeads, spawnImpl } = opts;
+  // An empty remote can't conflict — the first push establishes the history.
+  if (remoteHeads.length === 0) return null;
+
+  const remoteIdentity = normalizeRemoteIdentity(remoteUrl) ?? redactUrlForMessage(remoteUrl);
+
+  // No mirror on disk yet → whatever gets bootstrapped will be a fresh root.
+  if (mirrorPath === null || !existsSync(join(mirrorPath, ".git"))) {
+    return { remoteIdentity, mirrorIsFresh: true };
+  }
+  if (await mirrorHoldsAnyRemoteHead(mirrorPath, remoteHeads, spawnImpl)) return null;
+  return { remoteIdentity, mirrorIsFresh: false };
+}
+
+/**
+ * Strip any userinfo from a remote URL so an unparseable one can still be
+ * named in an operator-facing message without leaking a token.
+ */
+function redactUrlForMessage(remote: string): string {
+  return remote.replace(/\/\/[^@/]*@/, "//");
+}
+
+/**
+ * Operator-facing message for a refused arm. Says what is wrong, why it can
+ * never self-correct, and what the three real options are — deliberately
+ * concrete, because "non-fast-forward" is exactly the error an operator cannot
+ * act on without knowing the histories are unrelated.
+ */
+export function unrelatedHistoryMessage(found: UnrelatedHistory): string {
+  return (
+    `${found.remoteIdentity} already has commits that this vault's backup history doesn't share, ` +
+    `so every push would be rejected (non-fast-forward) and it would never recover on its own. ` +
+    `Importing brings your notes across but not the old backup history, which is why they don't line up. ` +
+    `Either back up to a new empty repo, or replace the repo's contents with this vault's history on purpose. ` +
+    `If you know they should be joined, pass override=true to arm Sync anyway.`
+  );
+}

package/src/mirror-routes.test.ts

@@ -22,6 +22,7 @@ import {
   type MirrorDeps,
 } from "./mirror-manager.ts";
 import {
+  enableSyncToImportedRepo,
   _resetDeviceFlowSessionsForTest,
   handleAuthDelete,
   handleAuthGet,
@@ -2310,6 +2311,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as {
@@ -2355,6 +2358,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as {
@@ -2391,6 +2396,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as {
@@ -2435,6 +2442,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as {
@@ -2470,6 +2479,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as { sync_enabled: boolean };
@@ -2516,6 +2527,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as {
@@ -2569,6 +2582,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as {
@@ -2626,6 +2641,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as { sync_enabled: boolean };
@@ -2673,6 +2690,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as {
@@ -2722,6 +2741,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as {
@@ -2766,6 +2787,8 @@ describe("handleMirrorImport — auto-enable sync (vault#416)", () => {
       spawnCloneSuccess(fixture),
       undefined,
       manager,
+      // vault#823: hermetic probe — reachable, empty remote (no guard fire).
+      async () => ({ ok: true, heads: [] }),
     );
     expect(res.status).toBe(200);
     const body = (await res.json()) as {
@@ -3165,3 +3188,127 @@ describe("cross-vault remote-clobber guard (vault#482)", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// vault#823 — enableSyncToImportedRepo must consult the unrelated-history
+// guard, not just contain a call to it.
+//
+// The lesson from hub#820, applied before shipping rather than after: proving
+// `findUnrelatedRemoteHistory` returns a struct proves nothing about whether
+// the arm path reads it. Mutating `if (unrelated)` to `if (false && unrelated)`
+// left the whole vault suite green, which is how this test came to exist.
+// ---------------------------------------------------------------------------
+
+describe("enableSyncToImportedRepo — unrelated-history guard (vault#823)", () => {
+  /** Minimal manager stand-in: the guard branch only reads `mirror_path`. */
+  function stubManager(mirrorPath: string | null): MirrorManager {
+    return {
+      getStatus: () => ({ mirror_path: mirrorPath }),
+    } as unknown as MirrorManager;
+  }
+
+  test("non-empty remote + fresh mirror → sync NOT armed, and the reason is stated", async () => {
+    const res = await enableSyncToImportedRepo({
+      vaultName: "solo",
+      remoteUrl: "https://github.com/aaron/my-vault.git",
+      auth: { kind: "none" },
+      manager: stubManager(null), // nothing bootstrapped yet — the import case
+      probeOverride: async () => ({ ok: true, heads: ["a".repeat(40)] }),
+    });
+    expect(res.sync_enabled).toBe(false);
+    expect(res.warning).toContain("github.com/aaron/my-vault");
+    expect(res.warning).toContain("non-fast-forward");
+    // It must not be mistaken for the "no credential" refusal further down —
+    // that one fires for auth.kind === "none" and would also return false.
+    expect(res.warning).not.toContain("write credentials");
+  });
+
+  test("empty remote → guard stays out of the way (falls through to the credential check)", async () => {
+    const res = await enableSyncToImportedRepo({
+      vaultName: "solo",
+      remoteUrl: "https://github.com/aaron/fresh.git",
+      auth: { kind: "none" },
+      manager: stubManager(null),
+      probeOverride: async () => ({ ok: true, heads: [] }),
+    });
+    expect(res.sync_enabled).toBe(false);
+    // Reached the NEXT refusal, which proves the history guard declined to fire.
+    expect(res.warning).toContain("write credentials");
+  });
+
+  test("override=true skips the guard entirely", async () => {
+    const res = await enableSyncToImportedRepo({
+      vaultName: "solo",
+      remoteUrl: "https://github.com/aaron/my-vault.git",
+      auth: { kind: "none" },
+      manager: stubManager(null),
+      override: true,
+      probeOverride: async () => ({ ok: true, heads: ["a".repeat(40)] }),
+    });
+    expect(res.warning).toContain("write credentials");
+    expect(res.warning).not.toContain("non-fast-forward");
+  });
+
+  test("unreachable remote fails OPEN — a network blip must not block setup", async () => {
+    const res = await enableSyncToImportedRepo({
+      vaultName: "solo",
+      remoteUrl: "https://github.com/aaron/my-vault.git",
+      auth: { kind: "none" },
+      manager: stubManager(null),
+      probeOverride: async () => ({ ok: false, error: "could not resolve host" }),
+    });
+    expect(res.warning).toContain("write credentials");
+    expect(res.warning).not.toContain("non-fast-forward");
+  });
+
+  test("a skipped check is SAID, not silent — the advisory rides on a successful arm", async () => {
+    // Uni's catch on #646: this guard runs at BIND time and there may be no
+    // next bind. An operator arms Sync once and walks away, so a probe blip
+    // that silently skips the check reproduces the exact five-day silence the
+    // guard exists to prevent. Failing open is still right; failing open
+    // WITHOUT saying so is not.
+    let armed = false;
+    const manager = {
+      getStatus: () => (armed ? { mirror_path: "/tmp/m", enabled: true } : { mirror_path: null }),
+      getEffectiveConfig: () => ({ enabled: false, auto_push: false, location: "internal" }),
+      reload: async () => {
+        armed = true;
+      },
+    } as unknown as MirrorManager;
+
+    const res = await enableSyncToImportedRepo({
+      vaultName: "solo",
+      remoteUrl: "https://github.com/aaron/my-vault.git",
+      auth: { kind: "pat", token: "ghp_x" },
+      manager,
+      probeOverride: async () => ({ ok: false, error: "could not resolve host" }),
+    });
+    expect(res.sync_enabled).toBe(true);
+    expect(res.warning).toContain("couldn't reach the repo");
+    // Points at a surface that works TODAY — the vault's own Git remote
+    // section, which renders status.last_push_error. Naming the hub account
+    // tile instead would make hub#820 a precondition for text a user reads.
+    expect(res.warning).toContain("Git remote section");
+    expect(res.warning).not.toContain("account page");
+  });
+
+  test("a probe that succeeded adds no advisory", async () => {
+    let armed = false;
+    const manager = {
+      getStatus: () => (armed ? { mirror_path: "/tmp/m", enabled: true } : { mirror_path: null }),
+      getEffectiveConfig: () => ({ enabled: false, auto_push: false, location: "internal" }),
+      reload: async () => {
+        armed = true;
+      },
+    } as unknown as MirrorManager;
+
+    const res = await enableSyncToImportedRepo({
+      vaultName: "solo",
+      remoteUrl: "https://github.com/aaron/fresh.git",
+      auth: { kind: "pat", token: "ghp_x" },
+      manager,
+      probeOverride: async () => ({ ok: true, heads: [] }),
+    });
+    expect(res.sync_enabled).toBe(true);
+    expect(res.warning ?? "").not.toContain("couldn't reach");
+  });
+});