@indigoai-us/hq-cloud 6.14.50 → 6.15.1

package/.github/workflows/unreleased-commits-nag.yml

@@ -1,256 +0,0 @@
-name: Nag unreleased commits on main
-
-# Two weekly release nags for hq-cloud:
-#
-#   nag      — `main` is carrying work nobody has released (below).
-#   pin-lag  — the latest hq-cloud release is not pinned by hq-cli and
-#              hq-desktop-app `main`. See that job's own header.
-#
-# A commit counts as UNRELEASED when it is reachable from `main` but not from
-# any STABLE tag. Stable means `vMAJOR.MINOR.PATCH` with no prerelease suffix —
-# `-rc.N`, `-beta.N` and `-alpha.N` tags deliberately do NOT silence the nag,
-# because a prerelease is not a release.
-#
-# Release sync-back commits (`chore(release): …`) are ignored. The publish
-# workflow pushes them to `main` *after* cutting the tag, so they are
-# unreachable from that tag by construction and would nag forever otherwise.
-#
-# Releasing this repo is one command — `git push origin v<next>` — so the fix
-# for a nag is always to cut the tag (or to say out loud why you are holding).
-#
-# Requires repo secret SLACK_BOT_TOKEN_RELEASE_MANAGER (the same release-manager
-# bot hq-core's `release-pr-nag.yml` uses). The bot MUST be a member of #hq-dev.
-# Without the secret the job logs a warning and exits 0 rather than failing.
-
-on:
-  schedule:
-    # Mondays 15:00 UTC (~08:00 PT). Staggered against the sibling repos'
-    # nags so all four do not land in #hq-dev in the same second.
-    - cron: '10 15 * * 1'
-  workflow_dispatch:
-    inputs:
-      threshold_hours:
-        description: 'Age of the OLDEST unreleased commit, in hours, before nagging (default 24)'
-        required: false
-        default: '24'
-
-permissions:
-  contents: read
-
-jobs:
-  nag:
-    name: Nag when main has unreleased commits
-    if: github.repository == 'indigoai-us/hq-cloud'
-    runs-on: ubuntu-latest
-    env:
-      SLACK_TOKEN: ${{ secrets.SLACK_BOT_TOKEN_RELEASE_MANAGER }}
-      SLACK_CHANNEL: '#hq-dev'
-      THRESHOLD: ${{ github.event.inputs.threshold_hours || '24' }}
-    steps:
-      - name: Check out full history and tags
-        uses: actions/checkout@v4
-        with:
-          ref: main
-          fetch-depth: 0
-
-      - name: Find unreleased commits on main and nag
-        run: |
-          set -euo pipefail
-
-          if [ -z "${SLACK_TOKEN:-}" ]; then
-            echo "::warning::SLACK_BOT_TOKEN_RELEASE_MANAGER is not set on this repository; cannot post the nag."
-            exit 0
-          fi
-
-          git fetch --force --tags --quiet origin main
-
-          # Newest stable tag reachable from main — display only.
-          LAST_TAG="$(git tag --list 'v*' --merged origin/main --sort=-v:refname \
-            | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1 || true)"
-
-          # Commits on main not reachable from ANY stable tag. `--exclude` applies
-          # to the `--tags` glob that follows it, so `v*-*` drops every prerelease.
-          git log origin/main --format='%H%x09%ct%x09%s' \
-            --not --exclude='v*-*' --tags='v*' > /tmp/unreleased_all.tsv
-
-          # Drop the post-tag release sync-back commits.
-          awk -F'\t' '$3 !~ /^chore\(release\)/' /tmp/unreleased_all.tsv > /tmp/unreleased.tsv
-
-          COUNT="$(wc -l < /tmp/unreleased.tsv | tr -d ' ')"
-          echo "Last stable tag: ${LAST_TAG:-<none>}"
-          echo "Unreleased commits on main: ${COUNT}"
-
-          if [ "$COUNT" -eq 0 ]; then
-            echo "main is fully released. Nothing to nag about."
-            exit 0
-          fi
-
-          OLDEST_TS="$(tail -1 /tmp/unreleased.tsv | cut -f2)"
-          NOW="$(date -u +%s)"
-          AGE_H=$(( (NOW - OLDEST_TS) / 3600 ))
-          echo "Oldest unreleased commit age: ${AGE_H}h (threshold ${THRESHOLD}h)"
-
-          if [ "$AGE_H" -lt "$THRESHOLD" ]; then
-            echo "Under threshold. Skipping."
-            exit 0
-          fi
-
-          REPO_NAME="${GITHUB_REPOSITORY##*/}"
-          DAYS=$(( AGE_H / 24 ))
-          if [ -n "$LAST_TAG" ]; then
-            LINK="https://github.com/${GITHUB_REPOSITORY}/compare/${LAST_TAG}...main"
-            TAG_LABEL="\`${LAST_TAG}\`"
-          else
-            LINK="https://github.com/${GITHUB_REPOSITORY}/commits/main"
-            TAG_LABEL="_never released_"
-          fi
-
-          # Oldest-first sample of what is waiting, capped at 5 lines.
-          SAMPLE="$(tail -5 /tmp/unreleased.tsv | tac | cut -f3 | sed 's/^/• /')"
-          if [ "$COUNT" -gt 5 ]; then
-            SAMPLE="${SAMPLE}"$'\n'"• …and $(( COUNT - 5 )) more"
-          fi
-
-          TEXT=":package: *\`${REPO_NAME}\`: ${COUNT} commit(s) have been sitting unreleased on \`main\` for ~${AGE_H}h (${DAYS}d).* Last stable release: ${TAG_LABEL} — prereleases don't count. Shipping is one command: \`git push origin v<next>\`. <${LINK}|See what's waiting>."$'\n'"${SAMPLE}"
-
-          RESP="$(curl -s -X POST \
-            -H "Authorization: Bearer ${SLACK_TOKEN}" \
-            -H 'Content-type: application/json; charset=utf-8' \
-            --data "$(jq -nc --arg c "$SLACK_CHANNEL" --arg t "$TEXT" '{channel:$c,text:$t,unfurl_links:false}')" \
-            https://slack.com/api/chat.postMessage)"
-          OK="$(echo "$RESP" | jq -r '.ok')"
-          echo "Slack post ok=${OK} err=$(echo "$RESP" | jq -r '.error // "-"')"
-          if [ "$OK" != "true" ]; then
-            echo "::error::Slack rejected the nag: $(echo "$RESP" | jq -r '.error // "unknown"')"
-            exit 1
-          fi
-
-  pin-lag:
-    name: Nag when consumers lag the latest hq-cloud release
-    # hq-cloud ships the sync runner that hq-cli and hq-desktop-app spawn. A
-    # release nobody has pinned is a release nobody is running, so this job
-    # compares the newest STABLE hq-cloud tag against the version each
-    # consumer's `main` actually declares:
-    #
-    #   hq-cli          pnpm-lock.yaml -> resolved @indigoai-us/hq-cloud version
-    #   hq-desktop-app  crates/hq-desktop-core/src/hq_cloud.rs -> HQ_CLOUD_VERSION
-    #
-    # Comparison is EXACT on the version string (the desktop pin's leading `~`
-    # is stripped first). A tilde range like `~6.14.47` does resolve to 6.14.48
-    # at npx spawn time, so this will flag a pin that is already functionally
-    # current — that is deliberate: the written pin is kept literally in step
-    # with the latest release.
-    #
-    # Reading the two sibling repos needs a cross-repo token, so this mints an
-    # installation token from the hq-audit-bot App (same pattern as
-    # hq-core's promote-to-hq-core.yml). The App must be installed on
-    # indigoai-us/hq-cli and indigoai-us/hq-desktop-app with `contents: read`.
-    if: github.repository == 'indigoai-us/hq-cloud'
-    runs-on: ubuntu-latest
-    env:
-      SLACK_TOKEN: ${{ secrets.SLACK_BOT_TOKEN_RELEASE_MANAGER }}
-      SLACK_CHANNEL: '#hq-dev'
-      HQ_AUDIT_BOT_APP_ID: ${{ secrets.HQ_AUDIT_BOT_APP_ID }}
-      HQ_AUDIT_BOT_PRIVATE_KEY: ${{ secrets.HQ_AUDIT_BOT_PRIVATE_KEY }}
-    steps:
-      - name: Check out full history and tags
-        uses: actions/checkout@v4
-        with:
-          ref: main
-          fetch-depth: 0
-
-      - name: Preflight credentials
-        id: pre
-        run: |
-          set -euo pipefail
-          if [ -z "${SLACK_TOKEN:-}" ]; then
-            echo "::warning::SLACK_BOT_TOKEN_RELEASE_MANAGER is not set on this repository; cannot post the nag."
-            echo "ready=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          if [ -z "${HQ_AUDIT_BOT_APP_ID:-}" ] || [ -z "${HQ_AUDIT_BOT_PRIVATE_KEY:-}" ]; then
-            echo "::warning::hq-audit-bot App credentials are not set; cannot read hq-cli / hq-desktop-app main."
-            echo "ready=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "ready=true" >> "$GITHUB_OUTPUT"
-
-      - name: Mint installation token for the consumer repos
-        id: app-token
-        if: steps.pre.outputs.ready == 'true'
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ env.HQ_AUDIT_BOT_APP_ID }}
-          private-key: ${{ env.HQ_AUDIT_BOT_PRIVATE_KEY }}
-          owner: indigoai-us
-          repositories: |
-            hq-cli
-            hq-desktop-app
-
-      - name: Compare consumer pins against the latest hq-cloud release
-        if: steps.pre.outputs.ready == 'true'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          set -euo pipefail
-
-          git fetch --force --tags --quiet origin main
-
-          LATEST_TAG="$(git tag --list 'v*' --merged origin/main --sort=-v:refname \
-            | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1 || true)"
-          if [ -z "$LATEST_TAG" ]; then
-            echo "No stable hq-cloud release yet; nothing to compare against."
-            exit 0
-          fi
-          LATEST="${LATEST_TAG#v}"
-          echo "Latest stable hq-cloud release: ${LATEST}"
-
-          # --- hq-cli: resolved version in the lockfile's importers section ---
-          gh api "repos/indigoai-us/hq-cli/contents/pnpm-lock.yaml?ref=main" \
-            -H 'Accept: application/vnd.github.raw' > /tmp/hq-cli-lock.yaml
-          CLI_PIN="$(grep -A2 "^      '@indigoai-us/hq-cloud':" /tmp/hq-cli-lock.yaml \
-            | awk '/^        version:/{print $2; exit}' | sed 's/(.*//')"
-          if [ -z "$CLI_PIN" ]; then
-            echo "::error::Could not read the resolved @indigoai-us/hq-cloud version from hq-cli's pnpm-lock.yaml. The lockfile layout changed — fix this parser rather than letting the check pass silently."
-            exit 1
-          fi
-          echo "hq-cli pins: ${CLI_PIN}"
-
-          # --- hq-desktop-app: HQ_CLOUD_VERSION constant, tilde stripped ---
-          gh api "repos/indigoai-us/hq-desktop-app/contents/crates/hq-desktop-core/src/hq_cloud.rs?ref=main" \
-            -H 'Accept: application/vnd.github.raw' > /tmp/hq_cloud.rs
-          DESK_RAW="$(grep -oP 'HQ_CLOUD_VERSION\s*:\s*&str\s*=\s*"\K[^"]+' /tmp/hq_cloud.rs | head -1)"
-          if [ -z "$DESK_RAW" ]; then
-            echo "::error::Could not read HQ_CLOUD_VERSION from hq-desktop-app's crates/hq-desktop-core/src/hq_cloud.rs. The constant moved or was renamed — fix this parser rather than letting the check pass silently."
-            exit 1
-          fi
-          DESK_PIN="${DESK_RAW#\~}"
-          DESK_PIN="${DESK_PIN#^}"
-          echo "hq-desktop-app pins: ${DESK_RAW} (compared as ${DESK_PIN})"
-
-          LAGGARDS=""
-          if [ "$CLI_PIN" != "$LATEST" ]; then
-            LAGGARDS="${LAGGARDS}"$'\n'"• \`hq-cli\` is on \`${CLI_PIN}\` (pnpm-lock.yaml)"
-          fi
-          if [ "$DESK_PIN" != "$LATEST" ]; then
-            LAGGARDS="${LAGGARDS}"$'\n'"• \`hq-desktop-app\` is on \`${DESK_RAW}\` (HQ_CLOUD_VERSION)"
-          fi
-
-          if [ -z "$LAGGARDS" ]; then
-            echo "Both consumers are pinned to ${LATEST}. Nothing to nag about."
-            exit 0
-          fi
-
-          TEXT=":link: *hq-cloud \`${LATEST}\` is released but not pinned everywhere.* A runner nobody pins is a runner nobody runs:${LAGGARDS}"$'\n'"Bump the pin(s) to \`${LATEST}\` and ship. <https://github.com/indigoai-us/hq-cloud/releases/tag/${LATEST_TAG}|Release ${LATEST_TAG}>."
-
-          RESP="$(curl -s -X POST \
-            -H "Authorization: Bearer ${SLACK_TOKEN}" \
-            -H 'Content-type: application/json; charset=utf-8' \
-            --data "$(jq -nc --arg c "$SLACK_CHANNEL" --arg t "$TEXT" '{channel:$c,text:$t,unfurl_links:false}')" \
-            https://slack.com/api/chat.postMessage)"
-          OK="$(echo "$RESP" | jq -r '.ok')"
-          echo "Slack post ok=${OK} err=$(echo "$RESP" | jq -r '.error // "-"')"
-          if [ "$OK" != "true" ]; then
-            echo "::error::Slack rejected the nag: $(echo "$RESP" | jq -r '.error // "unknown"')"
-            exit 1
-          fi

package/eslint.config.js

@@ -1,67 +0,0 @@
-import js from "@eslint/js";
-import tseslint from "typescript-eslint";
-
-const nodeGlobals = {
-  AbortController: "readonly",
-  Buffer: "readonly",
-  clearInterval: "readonly",
-  clearTimeout: "readonly",
-  console: "readonly",
-  fetch: "readonly",
-  process: "readonly",
-  setInterval: "readonly",
-  setTimeout: "readonly",
-  structuredClone: "readonly",
-  URL: "readonly",
-};
-
-const vitestGlobals = {
-  afterEach: "readonly",
-  beforeEach: "readonly",
-  describe: "readonly",
-  expect: "readonly",
-  it: "readonly",
-  vi: "readonly",
-};
-
-export default tseslint.config(
-  {
-    ignores: [
-      "coverage/**",
-      "dist/**",
-      "node_modules/**",
-      "pnpm-lock.yaml",
-      "*.config.js",
-      "*.config.mjs",
-      "*.config.cjs",
-      "generated/**",
-      "**/*.generated.*",
-    ],
-  },
-  {
-    files: ["src/**/*.ts", "test/**/*.ts"],
-    extends: [js.configs.recommended, ...tseslint.configs.recommended],
-    languageOptions: {
-      ecmaVersion: 2022,
-      sourceType: "module",
-      globals: {
-        ...nodeGlobals,
-        ...vitestGlobals,
-      },
-    },
-    rules: {
-      "@typescript-eslint/no-explicit-any": "warn",
-      "@typescript-eslint/no-unused-vars": [
-        "error",
-        {
-          argsIgnorePattern: "^_",
-          caughtErrorsIgnorePattern: "^_",
-          destructuredArrayIgnorePattern: "^_",
-          varsIgnorePattern: "^_",
-        },
-      ],
-      "no-useless-assignment": "off",
-      "preserve-caught-error": "off",
-    },
-  },
-);

package/pnpm-workspace.yaml

@@ -1,2 +0,0 @@
-allowBuilds:
-  esbuild: true

package/scripts/presign-transport-e2e.mjs

@@ -1,250 +0,0 @@
-/**
- * Live E2E for the presigned-URL transport (hq-cloud feat/presign-transport).
- *
- * Drives the real s3.ts primitives through the PRESIGN factory against
- * production (hqapi.hq.computer), exercising the exact code path that
- * @getindigo.ai sync sessions will use: VaultClient.presign/listFiles +
- * PresignObjectIO + fetch. Creates a scratch object under a clearly-marked
- * prefix, round-trips it (put → list → head → get → symlink → delete), and
- * deletes everything it created. Read-only on all real vault data.
- *
- * Run from the worktree root after `pnpm build`:
- *   node scripts/presign-transport-e2e.mjs
- */
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { VaultClient } from "../dist/vault-client.js";
-import {
-  setObjectIOFactory,
-  presignObjectIOFactory,
-} from "../dist/object-io.js";
-import {
-  uploadFile,
-  uploadSymlink,
-  downloadFile,
-  listRemoteFiles,
-  headRemoteFile,
-  deleteRemoteFile,
-} from "../dist/s3.js";
-
-const API = process.env.HQ_VAULT_API_URL ?? "https://hqapi.hq.computer";
-
-const results = [];
-function check(name, cond, detail = "") {
-  results.push({ name, ok: !!cond, detail });
-  console.log(`${cond ? "✓" : "✗"} ${name}${detail ? ` — ${detail}` : ""}`);
-}
-
-function loadAccessToken() {
-  const p = path.join(os.homedir(), ".hq", "cognito-tokens.json");
-  const t = JSON.parse(fs.readFileSync(p, "utf-8"));
-  const at = t.accessToken;
-  if (!at) throw new Error("no accessToken in cognito-tokens.json");
-  return at;
-}
-
-async function main() {
-  const token = loadAccessToken();
-  const vault = new VaultClient({ apiUrl: API, authToken: token });
-
-  // Resolve a company the caller can write to (owner/admin role).
-  const memberships = await vault.listMyMemberships();
-  const writable = memberships.find(
-    (m) => m.role === "owner" || m.role === "admin",
-  );
-  if (!writable) {
-    throw new Error(
-      `no owner/admin membership found (roles: ${memberships.map((m) => m.role).join(",") || "none"})`,
-    );
-  }
-  const companyUid = writable.companyUid;
-  let slug = companyUid;
-  try {
-    slug = (await vault.entity.get(companyUid)).slug ?? companyUid;
-  } catch {
-    /* display only */
-  }
-  console.log(`\nTarget: ${slug} (${companyUid}), role=${writable.role}\n`);
-
-  // Install the presign transport — the same selection runRunner makes for a
-  // @getindigo.ai session. ctx.credentials/bucketName/region are UNUSED on the
-  // presign path (only ctx.uid → companyUid matters), so dummy values are fine.
-  setObjectIOFactory(presignObjectIOFactory(vault));
-  const ctx = {
-    uid: companyUid,
-    slug,
-    bucketName: "(presign-unused)",
-    region: "us-east-1",
-    credentials: { accessKeyId: "x", secretAccessKey: "x", sessionToken: "x" },
-    expiresAt: "2099-01-01T00:00:00.000Z",
-  };
-
-  const stamp = Date.now().toString(36);
-  const prefix = `shared/_presign_e2e_${stamp}/`;
-  const fileKey = `${prefix}hooks/presign-e2e-hook.sh`;
-  const legacyKey = `${prefix}hooks/legacy-e2e-hook.sh`;
-  const linkKey = `${prefix}link`;
-  const author = { userSub: "e2e-probe-sub", email: "hassaan@getindigo.ai" };
-
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "presign-e2e-"));
-  const localUp = path.join(tmp, "presign-e2e-hook.sh");
-  const localDown = path.join(tmp, "downloaded-hook.sh");
-  const legacyDown = path.join(tmp, "legacy-hook.sh");
-  const localLink = path.join(tmp, "link");
-  const content = `#!/usr/bin/env bash\n# presign-transport probe ${stamp}\n${"x".repeat(2000)}`;
-  fs.writeFileSync(localUp, content);
-  fs.chmodSync(localUp, 0o755);
-
-  let allCreated = [];
-  try {
-    // ---- PUT (presigned, with metadata signed in) -----------------------
-    const up = await uploadFile(ctx, localUp, fileKey, author);
-    allCreated.push(fileKey);
-    check("uploadFile returns an etag", !!up.etag, up.etag);
-
-    // ---- LIST (presigned list, etag is load-bearing) --------------------
-    const listed = await listRemoteFiles(ctx, prefix);
-    const row = listed.find((o) => o.key === fileKey);
-    check("listRemoteFiles finds the uploaded key", !!row);
-    check(
-      "listed object carries a non-empty etag (#269)",
-      !!row && typeof row.etag === "string" && row.etag.length > 0,
-      row?.etag,
-    );
-    check(
-      "listed size matches uploaded bytes",
-      !!row && row.size === Buffer.byteLength(content),
-      `${row?.size} vs ${Buffer.byteLength(content)}`,
-    );
-
-    // ---- HEAD (presigned GET + header read) -----------------------------
-    const head = await headRemoteFile(ctx, fileKey);
-    check("headRemoteFile returns metadata", !!head && !!head.metadata);
-    check(
-      "metadata.created-by round-trips (signed PUT meta)",
-      head?.metadata?.["created-by"] === author.email,
-      head?.metadata?.["created-by"],
-    );
-    check(
-      "metadata.hq-mode round-trips as 755",
-      head?.metadata?.["hq-mode"] === "755",
-      head?.metadata?.["hq-mode"],
-    );
-    check(
-      "head etag matches list etag",
-      !!head && !!row && head.etag === row.etag,
-      `${head?.etag} vs ${row?.etag}`,
-    );
-
-    // ---- GET (presigned download to an empty destination, bytes + mode) --
-    const dl = await downloadFile(ctx, fileKey, localDown);
-    const got = fs.readFileSync(localDown, "utf-8");
-    check("downloadFile bytes match upload", got === content);
-    check(
-      "downloaded hook mode is 0755 (hq-mode applied)",
-      (fs.lstatSync(localDown).mode & 0o777) === 0o755,
-      "0" + (fs.lstatSync(localDown).mode & 0o777).toString(8),
-    );
-    check(
-      "downloadFile surfaces created-by metadata",
-      dl?.metadata?.["created-by"] === author.email,
-    );
-
-    // ---- Legacy hq-mode fallback ----------------------------------------
-    // Create a pre-hq-mode object through the same real presigned PUT
-    // endpoint, deliberately omitting metadata. A legacy remote overwrite
-    // must retain the known-good local executable mode instead of silently
-    // replacing the hook with the receiver's usual 0644 umask default.
-    const legacyPresign = await vault.presign({
-      companyUid,
-      op: "put",
-      keys: [{ key: legacyKey, op: "put", contentType: "text/x-shellscript" }],
-    });
-    const legacyPut = legacyPresign.results[0];
-    if (!legacyPut?.url) throw new Error("legacy PUT presign was not returned");
-    const legacyPutResponse = await fetch(legacyPut.url, {
-      method: "PUT",
-      headers: legacyPut.headers,
-      body: "#!/usr/bin/env bash\necho legacy hook\n",
-    });
-    if (!legacyPutResponse.ok) {
-      throw new Error(`legacy presigned PUT failed: ${legacyPutResponse.status}`);
-    }
-    allCreated.push(legacyKey);
-    const legacyHead = await headRemoteFile(ctx, legacyKey);
-    check(
-      "legacy object deliberately has no hq-mode metadata",
-      legacyHead?.metadata?.["hq-mode"] === undefined,
-      legacyHead?.metadata?.["hq-mode"],
-    );
-    fs.writeFileSync(legacyDown, "#!/usr/bin/env bash\necho prior hook\n");
-    fs.chmodSync(legacyDown, 0o755);
-    const legacyDownload = await downloadFile(ctx, legacyKey, legacyDown);
-    check(
-      "legacy hook fallback retains existing 0755 mode (not 0644)",
-      (fs.lstatSync(legacyDown).mode & 0o777) === 0o755,
-      "0" + (fs.lstatSync(legacyDown).mode & 0o777).toString(8),
-    );
-    check(
-      "legacy hq-mode fallback is surfaced for repair telemetry",
-      legacyDownload.modeWarnings?.some(
-        (warning) =>
-          warning.reason === "missing-hq-mode" &&
-          warning.fallback === "preserved-local-mode",
-      ) === true,
-    );
-
-    // ---- SYMLINK round-trip --------------------------------------------
-    const ln = await uploadSymlink(ctx, "../target/path.txt", linkKey, author);
-    allCreated.push(linkKey);
-    check("uploadSymlink returns an etag", !!ln.etag);
-    await downloadFile(ctx, linkKey, localLink);
-    const st = fs.lstatSync(localLink);
-    check("downloaded symlink is a symlink", st.isSymbolicLink());
-    check(
-      "symlink target round-trips",
-      st.isSymbolicLink() && fs.readlinkSync(localLink) === "../target/path.txt",
-      st.isSymbolicLink() ? fs.readlinkSync(localLink) : "(not a link)",
-    );
-
-    // ---- DELETE (presigned) --------------------------------------------
-    await deleteRemoteFile(ctx, fileKey);
-    await deleteRemoteFile(ctx, legacyKey);
-    await deleteRemoteFile(ctx, linkKey);
-    allCreated = [];
-    const afterFile = await headRemoteFile(ctx, fileKey);
-    check("headRemoteFile is null after delete", afterFile === null);
-    const afterList = await listRemoteFiles(ctx, prefix);
-    check(
-      "listRemoteFiles empty after delete",
-      afterList.filter((o) => o.key.startsWith(prefix)).length === 0,
-      `${afterList.length} remaining`,
-    );
-  } finally {
-    // Best-effort cleanup of anything left if an assertion threw mid-run.
-    for (const k of allCreated) {
-      try {
-        await deleteRemoteFile(ctx, k);
-      } catch {
-        /* ignore */
-      }
-    }
-    fs.rmSync(tmp, { recursive: true, force: true });
-  }
-
-  const failed = results.filter((r) => !r.ok);
-  console.log(
-    `\n${results.length - failed.length}/${results.length} checks passed`,
-  );
-  if (failed.length > 0) {
-    console.log("FAILED:", failed.map((f) => f.name).join("; "));
-    process.exit(1);
-  }
-  console.log("ALL GREEN");
-}
-
-main().catch((err) => {
-  console.error("E2E error:", err);
-  process.exit(2);
-});