@indigoai-us/hq-cloud 6.14.50 → 6.15.1

package/test/e2e/sync/skill-telemetry-oversized-transcript.test.ts

@@ -1,124 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { promises as fs } from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { spawn } from "node:child_process";
-import { pathToFileURL } from "node:url";
-
-type ChildResult = {
-  code: number | null;
-  signal: NodeJS.Signals | null;
-  stdout: string;
-  stderr: string;
-};
-
-function runNode(scriptPath: string, env: NodeJS.ProcessEnv): Promise<ChildResult> {
-  return new Promise((resolve, reject) => {
-    const child = spawn(process.execPath, [scriptPath], {
-      env,
-      stdio: ["ignore", "pipe", "pipe"],
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.setEncoding("utf-8");
-    child.stderr.setEncoding("utf-8");
-    child.stdout.on("data", (chunk: string) => {
-      stdout += chunk;
-    });
-    child.stderr.on("data", (chunk: string) => {
-      stderr += chunk;
-    });
-    child.once("error", reject);
-    child.once("close", (code, signal) => {
-      resolve({ code, signal, stdout, stderr });
-    });
-  });
-}
-
-describe("built sync runner — oversized skill transcript", () => {
-  it("drains a multi-budget transcript in a child process without a fatal abort", async () => {
-    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "hqcloud-skill-e2e-"));
-    try {
-      const home = path.join(tmp, "home");
-      const hqRoot = path.join(home, "hq");
-      const sessionDir = path.join(home, ".claude", "projects", "-hq");
-      await fs.mkdir(sessionDir, { recursive: true });
-      await fs.mkdir(hqRoot, { recursive: true });
-
-      // Five 1.5 MiB JSONL records exceed the runner's default 4 MiB source
-      // budget. The normal runner entrypoint must therefore advance over three
-      // bounded passes instead of allocating/decoding the whole transcript.
-      const filler = "x".repeat(1_500_000);
-      const expectedSkills = Array.from({ length: 5 }, (_, i) => `deploy-${i}`);
-      const transcript = expectedSkills
-        .map((skill, i) =>
-          JSON.stringify({
-            type: "user",
-            sessionId: "oversized-session",
-            timestamp: `2026-08-02T12:0${i}:00.000Z`,
-            cwd: hqRoot,
-            uuid: `oversized-${i}`,
-            message: {
-              role: "user",
-              content: `<command-name>/${skill}</command-name><command-args>${filler}</command-args>`,
-            },
-          }),
-        )
-        .join("\n") + "\n";
-      const transcriptPath = path.join(sessionDir, "oversized.jsonl");
-      await fs.writeFile(transcriptPath, transcript, "utf-8");
-
-      const runnerUrl = pathToFileURL(
-        path.join(process.cwd(), "dist", "bin", "sync-runner.js"),
-      ).href;
-      const wrapperPath = path.join(tmp, "run-built-telemetry.mjs");
-      await fs.writeFile(
-        wrapperPath,
-        `import { promises as fs } from "node:fs";
-         import path from "node:path";
-         import { defaultCollectTelemetry } from ${JSON.stringify(runnerUrl)};
-         const hqRoot = process.env.TEST_HQ_ROOT;
-         const cursorPath = path.join(process.env.HOME, ".hq", "skill-telemetry-cursor.json");
-         const postedSkills = [];
-         const client = {
-           entity: { listByType: async () => [{ uid: "prs_skill_telemetry_e2e", type: "person", slug: "skill-telemetry-e2e", status: "active", bucketName: "hq-vault-prs_skill_telemetry_e2e", createdAt: "2026-08-02T00:00:00Z" }] },
-           getTelemetryOptIn: async () => ({ enabled: true, updatedAt: null }),
-           postUsage: async () => ({ ok: true, written: 0, skipped: [] }),
-           postSkillInvocations: async (batch) => { postedSkills.push(...batch.events.map((event) => event.skill)); return { ok: true, written: batch.events.length, skipped: [] }; },
-           postOutcomeEvents: async () => ({ ok: true, written: 0, skipped: [] }),
-         };
-         const offsets = [];
-         for (let pass = 0; pass < 3; pass += 1) {
-           await defaultCollectTelemetry(client, false, hqRoot);
-           const cursor = JSON.parse(await fs.readFile(cursorPath, "utf-8"));
-           offsets.push(cursor.files[process.env.TEST_TRANSCRIPT_PATH]?.offset ?? 0);
-         }
-         process.stdout.write(JSON.stringify({ offsets, postedSkills }));\n`,
-        "utf-8",
-      );
-
-      const result = await runNode(wrapperPath, {
-        ...process.env,
-        HOME: home,
-        TEST_HQ_ROOT: hqRoot,
-        TEST_TRANSCRIPT_PATH: transcriptPath,
-      });
-
-      expect(result.signal).toBeNull();
-      expect(result.code).toBe(0);
-      expect(result.stderr).not.toContain("Fatal error");
-      expect(result.stderr).not.toContain("Check failed: i::kMaxInt >= len");
-      const output = JSON.parse(result.stdout) as {
-        offsets: number[];
-        postedSkills: string[];
-      };
-      expect(output.offsets[0]).toBeGreaterThan(0);
-      expect(output.offsets[0]).toBeLessThan(output.offsets[1]);
-      expect(output.offsets[1]).toBeLessThan(output.offsets[2]);
-      expect(output.offsets[2]).toBe(Buffer.byteLength(transcript, "utf-8"));
-      expect(output.postedSkills).toEqual(expectedSkills);
-    } finally {
-      await fs.rm(tmp, { recursive: true, force: true });
-    }
-  }, 30_000);
-});

package/test/e2e/sync/transient-company-leg.test.ts

@@ -1,384 +0,0 @@
-/**
- * Artifact-level regression for HQ-SYNC-X.
- *
- * This starts the compiled runner as a child process. The local vault stub
- * completes authentication, membership discovery, entity lookup, and the
- * normal company-vault list. Only the personal vault's direct-S3 endpoint uses
- * an unresolvable `.invalid` host. That makes the real sync function reject
- * from its fanout leg, rather than synthesizing a per-file error or failing at
- * the initial GET /membership/me boundary (which already returns 75).
- */
-
-import { createServer, type Server } from "node:http";
-import { once } from "node:events";
-import { access, mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { spawn } from "node:child_process";
-
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-
-const repoRoot = fileURLToPath(new URL("../../../", import.meta.url));
-const artifactPath = process.env.HQ_CLOUD_E2E_ARTIFACT
-  ? path.resolve(process.env.HQ_CLOUD_E2E_ARTIFACT)
-  : path.join(repoRoot, "dist", "bin", "sync-runner.js");
-
-const companyUid = "cmp_clean_e2e";
-const companySlug = "clean-e2e";
-const personalUid = "prs_transient_e2e";
-const invalidS3Endpoint = "http://hq-vault-transient-company-leg.invalid";
-
-let fixtureRoot: string | undefined;
-let hqRoot: string;
-let testHome: string;
-let server: Server | undefined;
-let vaultUrl: string;
-let stsCredentialExpiration: string;
-const requests: string[] = [];
-let personListReads = 0;
-
-function json(response: import("node:http").ServerResponse, body: unknown): void {
-  response.writeHead(200, { "content-type": "application/json" });
-  response.end(JSON.stringify(body));
-}
-
-async function ensureArtifact(): Promise<void> {
-  try {
-    await access(artifactPath);
-    return;
-  } catch (err) {
-    // An explicit artifact path is used only by the base-commit proof. Do not
-    // hide a bad path there by building the candidate artifact instead.
-    if (process.env.HQ_CLOUD_E2E_ARTIFACT) throw err;
-  }
-
-  await new Promise<void>((resolve, reject) => {
-    const npm = process.platform === "win32" ? "npm.cmd" : "npm";
-    const child = spawn(npm, ["run", "build"], {
-      cwd: repoRoot,
-      stdio: "inherit",
-    });
-    child.once("error", reject);
-    child.once("close", (code) => {
-      if (code === 0) resolve();
-      else reject(new Error(`npm run build exited ${code ?? "without a status"}`));
-    });
-  });
-  await access(artifactPath);
-}
-
-async function runArtifact(): Promise<{
-  code: number | null;
-  stdout: string;
-  stderr: string;
-}> {
-  return new Promise((resolve, reject) => {
-    const child = spawn(
-      process.execPath,
-      [artifactPath, "--companies", "--hq-root", hqRoot, "--json"],
-      {
-        cwd: path.dirname(artifactPath),
-        env: {
-          ...process.env,
-          HOME: testHome,
-          HQ_MACHINE_ID: "e2e-transient-company-leg",
-          HQ_QMD_REINDEX_ON_SYNC: "0",
-          HQ_STATE_DIR: path.join(testHome, ".hq"),
-          HQ_VAULT_API_URL: vaultUrl,
-          AWS_ENDPOINT_URL: invalidS3Endpoint,
-        },
-        stdio: ["ignore", "pipe", "pipe"],
-      },
-    );
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (chunk: Buffer) => {
-      stdout += chunk.toString();
-    });
-    child.stderr.on("data", (chunk: Buffer) => {
-      stderr += chunk.toString();
-    });
-    const timeout = setTimeout(() => {
-      child.kill("SIGTERM");
-      reject(new Error("compiled sync runner did not exit within 15 seconds"));
-    }, 15_000);
-    child.once("error", (err) => {
-      clearTimeout(timeout);
-      reject(err);
-    });
-    child.once("close", (code) => {
-      clearTimeout(timeout);
-      resolve({ code, stdout, stderr });
-    });
-  });
-}
-
-async function runWatchArtifact(): Promise<{
-  code: number | null;
-  signal: NodeJS.Signals | null;
-  stdout: string;
-  stderr: string;
-}> {
-  return new Promise((resolve, reject) => {
-    const child = spawn(
-      process.execPath,
-      [
-        artifactPath,
-        "--companies",
-        "--hq-root",
-        hqRoot,
-        "--json",
-        "--watch",
-        "--poll-remote-ms",
-        "25",
-      ],
-      {
-        cwd: path.dirname(artifactPath),
-        env: {
-          ...process.env,
-          HOME: testHome,
-          HQ_MACHINE_ID: "e2e-transient-company-leg",
-          HQ_QMD_REINDEX_ON_SYNC: "0",
-          HQ_STATE_DIR: path.join(testHome, ".hq"),
-          HQ_VAULT_API_URL: vaultUrl,
-          AWS_ENDPOINT_URL: invalidS3Endpoint,
-        },
-        stdio: ["ignore", "pipe", "pipe"],
-      },
-    );
-    let stdout = "";
-    let stderr = "";
-    let stopping = false;
-    const stop = () => {
-      if (stopping || child.exitCode !== null) return;
-      stopping = true;
-      child.kill("SIGTERM");
-    };
-    const timeout = setTimeout(() => {
-      stop();
-      reject(new Error("watching compiled sync runner did not complete two polls within 20 seconds"));
-    }, 20_000);
-    child.stdout.on("data", (chunk: Buffer) => {
-      stdout += chunk.toString();
-      const completePasses = (stdout.match(/"type":"all-complete"/g) ?? []).length;
-      if (completePasses >= 2) stop();
-    });
-    child.stderr.on("data", (chunk: Buffer) => {
-      stderr += chunk.toString();
-    });
-    child.once("error", (err) => {
-      clearTimeout(timeout);
-      reject(err);
-    });
-    child.once("close", (code, signal) => {
-      clearTimeout(timeout);
-      resolve({ code, signal, stdout, stderr });
-    });
-  });
-}
-
-beforeEach(async () => {
-  await ensureArtifact();
-  const expiry = new Date();
-  expiry.setUTCFullYear(expiry.getUTCFullYear() + 100);
-  stsCredentialExpiration = expiry.toISOString();
-  fixtureRoot = await mkdtemp(path.join(tmpdir(), "hqcloud-transient-company-leg-e2e-"));
-  hqRoot = path.join(fixtureRoot, "hq");
-  testHome = path.join(fixtureRoot, "home");
-  await mkdir(path.join(hqRoot, "companies", companySlug), { recursive: true });
-  await mkdir(path.join(testHome, ".hq"), { recursive: true });
-  const fakeJwtPayload = Buffer.from(
-    JSON.stringify({ sub: "e2e-subject", exp: Math.floor(Date.now() / 1000) + 3600 }),
-  ).toString("base64url");
-  await writeFile(
-    path.join(testHome, ".hq", "cognito-tokens.json"),
-    JSON.stringify({
-      accessToken: `header.${fakeJwtPayload}.signature`,
-      idToken: `header.${fakeJwtPayload}.signature`,
-      refreshToken: "e2e-only",
-      expiresAt: Date.now() + 60 * 60 * 1000,
-      tokenType: "Bearer",
-    }),
-  );
-
-  requests.length = 0;
-  personListReads = 0;
-  server = createServer((request, response) => {
-    const url = new URL(request.url ?? "/", "http://127.0.0.1");
-    requests.push(`${request.method} ${url.pathname}`);
-    if (request.method === "GET" && url.pathname === "/membership/me") {
-      json(response, { memberships: [{ companyUid }] });
-      return;
-    }
-    if (request.method === "GET" && url.pathname === `/entity/${companyUid}`) {
-      json(response, {
-        entity: {
-          uid: companyUid,
-          slug: companySlug,
-          type: "company",
-          bucketName: "hq-vault-e2e",
-          status: "active",
-        },
-      });
-      return;
-    }
-    if (request.method === "GET" && url.pathname === `/entity/${personalUid}`) {
-      json(response, {
-        entity: {
-          uid: personalUid,
-          slug: "personal-e2e",
-          type: "person",
-          bucketName: "hq-vault-e2e-personal",
-          status: "active",
-        },
-      });
-      return;
-    }
-    if (request.method === "GET" && url.pathname === "/v1/files/list") {
-      json(response, {
-        objects: [],
-        cursor: null,
-        truncated: false,
-      });
-      return;
-    }
-    if (request.method === "POST" && url.pathname === "/sts/vend-self") {
-      json(response, {
-        credentials: {
-          accessKeyId: "e2e-access-key",
-          secretAccessKey: "e2e-secret-key",
-          sessionToken: "e2e-session-token",
-          expiration: stsCredentialExpiration,
-        },
-        expiresAt: stsCredentialExpiration,
-      });
-      return;
-    }
-    if (request.method === "GET" && url.pathname === "/entity/by-type/person") {
-      personListReads += 1;
-      json(response, {
-        entities:
-          personListReads % 2 === 1
-            ? [
-                {
-                  uid: personalUid,
-                  slug: "personal-e2e",
-                  type: "person",
-                  bucketName: "hq-vault-e2e-personal",
-                  status: "active",
-                },
-              ]
-            : [],
-      });
-      return;
-    }
-    if (request.method === "GET" && url.pathname === "/membership/pending-by-email") {
-      json(response, { invites: [] });
-      return;
-    }
-    if (request.method === "POST") {
-      json(response, { ok: true, written: 0, skipped: [] });
-      return;
-    }
-    response.writeHead(404, { "content-type": "application/json" });
-    response.end(JSON.stringify({ error: `unexpected ${request.method} ${url.pathname}` }));
-  });
-  server.listen(0, "127.0.0.1");
-  await once(server, "listening");
-  const address = server.address();
-  if (!address || typeof address === "string") {
-    throw new Error("e2e vault stub did not bind a TCP port");
-  }
-  vaultUrl = `http://127.0.0.1:${address.port}`;
-});
-
-afterEach(async () => {
-  if (server?.listening) {
-    server.close();
-    await once(server, "close");
-  }
-  if (fixtureRoot) {
-    await rm(fixtureRoot, { recursive: true, force: true });
-  }
-});
-
-describe("compiled sync runner transient company leg (HQ-SYNC-X)", () => {
-  it(
-    "returns 75 and emits transient-network when only the personal vault S3 leg cannot resolve",
-    async () => {
-      const result = await runArtifact();
-
-      expect(
-        result.code,
-        `stdout=${result.stdout}\nstderr=${result.stderr}`,
-      ).toBe(75);
-      expect(requests).toEqual(
-        expect.arrayContaining([
-          "GET /membership/me",
-          `GET /entity/${companyUid}`,
-          "GET /v1/files/list",
-          "POST /sts/vend-self",
-        ]),
-      );
-      const stdoutEvents = result.stdout
-        .trim()
-        .split("\n")
-        .filter(Boolean)
-        .map((line) => JSON.parse(line) as Record<string, unknown>);
-      expect(
-        stdoutEvents.filter((event) => event.type === "transient-network"),
-      ).toEqual([
-        expect.objectContaining({
-          company: "personal",
-          path: "(company)",
-          message: expect.stringContaining("ENOTFOUND"),
-        }),
-      ]);
-      expect(
-        stdoutEvents.some(
-          (event) => event.type === "error" && event.path === "(company)",
-        ),
-      ).toBe(false);
-      expect(stdoutEvents.find((event) => event.type === "all-complete")).toEqual(
-        expect.objectContaining({
-          errors: [],
-          transient: [expect.objectContaining({ company: "personal" })],
-        }),
-      );
-      expect(result.stderr).not.toContain('"path":"(company)"');
-    },
-    30_000,
-  );
-
-  it(
-    "stays alive through two transient company-leg passes until SIGTERM stops it",
-    async () => {
-      const result = await runWatchArtifact();
-      expect(
-        { code: result.code, signal: result.signal },
-        `stdout=${result.stdout}\nstderr=${result.stderr}`,
-      ).toEqual({ code: null, signal: "SIGTERM" });
-
-      const stdoutEvents = result.stdout
-        .trim()
-        .split("\n")
-        .filter(Boolean)
-        .map((line) => JSON.parse(line) as Record<string, unknown>);
-      expect(
-        stdoutEvents.filter((event) => event.type === "all-complete"),
-      ).toHaveLength(2);
-      expect(
-        stdoutEvents.filter(
-          (event) =>
-            event.type === "transient-network" && event.company === "personal",
-        ),
-      ).toHaveLength(2);
-      expect(result.stderr).toContain(
-        "watch pass skipped — transient network failure; retrying next poll",
-      );
-      expect(result.stderr).not.toContain('"path":"(company)"');
-    },
-    30_000,
-  );
-});

package/test/e2e/sync/windows-unreadable-link-leg.test.ts

@@ -1,191 +0,0 @@
-/**
- * Artifact-level regression for the Windows EINVAL reparse-point failure.
- *
- * The Linux test runner cannot create the production reparse-point shape, so
- * the fs seam makes a real symlink's readlink raise EINVAL while the actual
- * runner → company fanout → share walk executes over a temp HQ tree.
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import * as fs from "fs";
-import * as path from "path";
-import {
-  runRunner,
-  type RunnerDeps,
-  type RunnerEvent,
-  type VaultClientSurface,
-} from "../../../src/bin/sync-runner.js";
-import { share } from "../../../src/cli/share.js";
-import type { EntityContext, EntityInfo } from "../../../src/types.js";
-import { uploadFile, uploadSymlink } from "../../../src/s3.js";
-
-vi.mock("fs", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("fs")>();
-  return { ...actual };
-});
-
-vi.mock("../../../src/s3.js", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("../../../src/s3.js")>();
-  return {
-    ...actual,
-    uploadFile: vi.fn().mockResolvedValue({ etag: '"upload-etag"' }),
-    uploadSymlink: vi.fn().mockResolvedValue({ etag: '"symlink-etag"' }),
-    headRemoteFile: vi.fn().mockResolvedValue(null),
-    primeObjectTransport: vi.fn().mockResolvedValue(undefined),
-    primeUploads: vi.fn().mockResolvedValue(undefined),
-  };
-});
-
-function errnoError(code: string): NodeJS.ErrnoException {
-  const err = new Error(`${code}: invalid argument, readlink`) as NodeJS.ErrnoException;
-  err.code = code;
-  return err;
-}
-
-function makeWriter(): {
-  write: (chunk: string) => boolean;
-  events: () => RunnerEvent[];
-} {
-  let output = "";
-  return {
-    write: (chunk) => {
-      output += chunk;
-      return true;
-    },
-    events: () =>
-      output
-        .split("\n")
-        .filter(Boolean)
-        .map((line) => JSON.parse(line) as RunnerEvent),
-  };
-}
-
-let hqRoot: string;
-let stateDir: string;
-let unreadableLink: string;
-
-beforeEach(() => {
-  // Keep fixture roots inside the checkout so operator runs never create a
-  // scratch HQ tree outside the task worktree.
-  hqRoot = fs.mkdtempSync(path.join(process.cwd(), ".hqcloud-einval-e2e-"));
-  stateDir = fs.mkdtempSync(path.join(process.cwd(), ".hqcloud-einval-state-"));
-  process.env.HQ_STATE_DIR = stateDir;
-  const companyRoot = path.join(hqRoot, "companies", "acme");
-  const policiesDir = path.join(companyRoot, "policies");
-  const targetDir = path.join(hqRoot, "outside", "target");
-  fs.mkdirSync(policiesDir, { recursive: true });
-  fs.mkdirSync(targetDir, { recursive: true });
-  fs.writeFileSync(path.join(policiesDir, "safe.md"), "safe bytes");
-  fs.writeFileSync(path.join(targetDir, "must-not-upload.md"), "target bytes");
-  unreadableLink = path.join(policiesDir, "unreadable-link");
-  fs.symlinkSync(targetDir, unreadableLink, "dir");
-});
-
-afterEach(() => {
-  vi.restoreAllMocks();
-  fs.rmSync(hqRoot, { recursive: true, force: true });
-  fs.rmSync(stateDir, { recursive: true, force: true });
-  delete process.env.HQ_STATE_DIR;
-});
-
-describe("sync runner unreadable Windows link", () => {
-  it("keeps the leg complete and emits the offending relative path", async () => {
-    const stdout = makeWriter();
-    const stderr = makeWriter();
-    const entityContext: EntityContext = {
-      uid: "cmp_acme",
-      slug: "acme",
-      bucketName: "hq-vault-acme-test",
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: "test-key",
-        secretAccessKey: "test-secret",
-        sessionToken: "test-session",
-      },
-      expiresAt: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
-    };
-    const client = {
-      listMyMemberships: async () => [{ companyUid: "cmp_acme" }],
-      listMyPendingInvitesByEmail: async () => [],
-      claimPendingInvitesByEmail: async () => undefined,
-      ensureMyPersonEntity: async () => ({}) as EntityInfo,
-      entity: {
-        get: async (uid: string) => ({
-          uid,
-          type: "company",
-          slug: "acme",
-          bucketName: "hq-vault-acme-test",
-          status: "active",
-        }) as EntityInfo,
-        listByType: async () => [],
-      },
-    } as unknown as VaultClientSurface;
-    const realReadlinkSync = fs.readlinkSync;
-    const readlinkSpy = vi
-      .spyOn(fs, "readlinkSync")
-      .mockImplementation(((candidate: fs.PathLike) => {
-        if (candidate === unreadableLink) throw errnoError("EINVAL");
-        return realReadlinkSync(candidate);
-      }) as typeof fs.readlinkSync);
-    const deps: RunnerDeps = {
-      stdout,
-      stderr,
-      getAccessToken: async () => "test-access-token",
-      getIdTokenClaims: () => null,
-      createVaultClient: () => client,
-      share: async (options) => {
-        const { vaultConfig: _vaultConfig, ...shareOptions } = options;
-        return share({ ...shareOptions, entityContext });
-      },
-      reindex: () => ({ status: 0 }) as ReturnType<NonNullable<RunnerDeps["reindex"]>>,
-      qmdReindex: () => ({
-        qmdAvailable: true,
-        collectionsAdded: [],
-        pathDriftDetected: [],
-        collectionsRepaired: [],
-        updated: false,
-        embedded: false,
-        pendingDirty: false,
-        lockBusy: false,
-        timedOut: false,
-        corruptionQuarantined: false,
-        corruptionQuarantineFailed: false,
-        indexDir: null,
-      }) as ReturnType<NonNullable<RunnerDeps["qmdReindex"]>>,
-      reconcileManifest: async () => ({
-        written: false,
-        added: [],
-        updated: [],
-        skipped: [],
-      }) as Awaited<ReturnType<NonNullable<RunnerDeps["reconcileManifest"]>>>,
-      collectTelemetry: async () => undefined,
-    };
-
-    try {
-      const code = await runRunner(
-        ["--companies", "--direction", "push", "--hq-root", hqRoot],
-        deps,
-      );
-
-      expect(code).toBe(0);
-      expect(stdout.events()).toContainEqual({
-        type: "not-shipped",
-        company: "acme",
-        reason: "unreadable-link",
-        count: 1,
-        samplePaths: ["policies/unreadable-link"],
-      });
-      expect(stdout.events()).toContainEqual(
-        expect.objectContaining({
-          type: "all-complete",
-          errors: [],
-          partial: false,
-        }),
-      );
-      expect(stderr.events()).toEqual([]);
-      expect(uploadFile).toHaveBeenCalledTimes(1);
-      expect(uploadSymlink).not.toHaveBeenCalled();
-    } finally {
-      readlinkSpy.mockRestore();
-    }
-  });
-});