@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/scripts/vault-rebaseline.sh

@@ -1,323 +0,0 @@
-#!/usr/bin/env bash
-# vault-rebaseline.sh — overlay hq-core@vX.Y.Z baseline content onto a vault.
-#
-# For vaults that pre-date core/core.yaml (pre-v15 partial cloud snapshots
-# missing the companies/ + personal/ structure). `replace-rescue.sh` refuses
-# to operate on those vaults because its safety gate requires HQ-root layout;
-# this script provides a narrower, additive alternative: push the v15
-# baseline tree (.claude/, .agents/, .codex/, core/, companies/_template/,
-# personal/, etc.) into the vault, preserving everything the user already
-# has there. Symlinks are serialized to `hq-symlink:<target>` markers so
-# they round-trip cleanly through hq-sync's protocol.
-#
-# Purely additive by default — no `--delete`. Their v14-era root files
-# (CHANGELOG.md, RELEASE-NOTES-v14.0.0.md, etc.) remain in S3 until they
-# either upgrade locally (menubar Update HQ) or we run a follow-up cleanup.
-# Pass `--delete-v14-cruft` to remove a hardcoded set of known v14-only
-# root files in the same run.
-#
-# Usage:
-#
-#   vault-rebaseline.sh --prs <prs_*> [--version X.Y.Z] [opts...]
-#
-# Required:
-#   --prs <prs_*>          Entity UID. Bucket = hq-vault-<lower-uid-w/-dashes>.
-#
-# Optional:
-#   --version <X.Y.Z>      Default 15.0.4 (current latest release).
-#   --source <owner/repo>  Default indigoai-us/hq-core. Override e.g. with
-#                          indigoai-us/hq-core-staging (would use --ref main
-#                          when version is not a tag).
-#   --dry-run              Show plan, don't push.
-#   --keep-tmp             Preserve the baseline clone + staging dirs.
-#   --delete-v14-cruft     Also delete a known set of v14 root files
-#                          (CHANGELOG.md, README.md, LICENSE, setup.sh,
-#                          RELEASE-NOTES-v14.0.0.md, MIGRATION-v11.md,
-#                          USER-GUIDE.md, CONTRIBUTING.md) so their
-#                          local install drops them on next sync.
-#   --profile/--region     AWS config. Default $HQ_VAULT_AWS_PROFILE /
-#                          us-east-1.
-#
-# Auth: uses the operator's standing AWS S3 perms directly. Operator/admin
-# only — vault-service STS vending is bypassed.
-
-set -euo pipefail
-
-PRS=""
-VERSION="15.0.4"
-SOURCE_REPO="indigoai-us/hq-core"
-DRY_RUN=0
-KEEP_TMP=0
-DELETE_CRUFT=0
-AWS_PROFILE_OVERRIDE="${HQ_VAULT_AWS_PROFILE:-}"
-AWS_REGION_OVERRIDE="${HQ_VAULT_AWS_REGION:-us-east-1}"
-
-usage() {
-  sed -n '2,40p' "$0"
-  exit 2
-}
-
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --prs)               PRS="$2"; shift 2 ;;
-    --version)           VERSION="$2"; shift 2 ;;
-    --source)            SOURCE_REPO="$2"; shift 2 ;;
-    --dry-run)           DRY_RUN=1; shift ;;
-    --keep-tmp)          KEEP_TMP=1; shift ;;
-    --delete-v14-cruft)  DELETE_CRUFT=1; shift ;;
-    --profile)           AWS_PROFILE_OVERRIDE="$2"; shift 2 ;;
-    --region)            AWS_REGION_OVERRIDE="$2"; shift 2 ;;
-    -h|--help)           usage ;;
-    *) echo "unknown arg: $1" >&2; usage ;;
-  esac
-done
-
-[ -n "$PRS" ] || { echo "error: --prs is required" >&2; usage; }
-case "$PRS" in
-  prs_*) ;;
-  *) echo "error: --prs must look like prs_*; got '$PRS'" >&2; exit 2 ;;
-esac
-
-BUCKET="hq-vault-$(printf '%s' "$PRS" | tr '[:upper:]' '[:lower:]' | tr '_' '-')"
-
-# Construct git ref. Tagged releases live in hq-core as v<version>; staging
-# uses main and treats --version as informational.
-case "$SOURCE_REPO" in
-  *hq-core-staging) REF="main" ;;
-  *)                REF="v$VERSION" ;;
-esac
-
-AWS_ARGS=()
-[ -n "$AWS_PROFILE_OVERRIDE" ] && AWS_ARGS+=(--profile "$AWS_PROFILE_OVERRIDE")
-AWS_ARGS+=(--region "$AWS_REGION_OVERRIDE")
-
-command -v jq >/dev/null || {
-  echo "error: jq is required to preserve existing S3 metadata during hq-mode repair" >&2
-  exit 2
-}
-
-# Tmp dirs.
-BASELINE="$(mktemp -d -t hq-rebaseline-baseline-XXXXXX)"
-STAGING="$(mktemp -d -t hq-rebaseline-stage-XXXXXX)"
-
-cleanup() {
-  local rc="${1:-$?}"
-  if [ "$KEEP_TMP" = "1" ]; then
-    echo "==> --keep-tmp set; preserving $BASELINE and $STAGING" >&2
-  else
-    rm -rf "${BASELINE:-}" "${STAGING:-}"
-  fi
-  return $rc
-}
-trap cleanup EXIT
-
-cat <<EOF
-==> vault-rebaseline
-    prs:         $PRS
-    bucket:      s3://$BUCKET
-    baseline:    $SOURCE_REPO @ $REF (version $VERSION)
-    baseline tmp: $BASELINE
-    staging tmp: $STAGING
-    dry-run:     $([ "$DRY_RUN" = "1" ] && echo "ON" || echo "off")
-    delete v14:  $([ "$DELETE_CRUFT" = "1" ] && echo "ON" || echo "off")
-    keep-tmp:    $([ "$KEEP_TMP" = "1" ] && echo "yes" || echo "no")
-EOF
-
-# ---------- phase 1: clone baseline ----------
-echo "" >&2
-echo "==> [1/3] clone $SOURCE_REPO@$REF (depth=1)" >&2
-git clone --quiet --depth 1 --branch "$REF" "https://github.com/$SOURCE_REPO.git" "$BASELINE" 2>&1 | tail -3 || {
-  echo "error: clone failed. Is $SOURCE_REPO@$REF a valid ref?" >&2
-  exit 1
-}
-echo "==> clone done. baseline files: $(find "$BASELINE" -type f | wc -l | tr -d ' ') (excl .git)" >&2
-
-# ---------- phase 2: stage with symlink serialization ----------
-echo "" >&2
-echo "==> [2/3] stage baseline tree (serialize symlinks → hq-symlink: markers)" >&2
-
-n_files=0; n_syms=0
-SYMLIST="$STAGING.symlinks.txt"
-: > "$SYMLIST"
-
-while IFS= read -r -d '' src; do
-  rel="${src#"$BASELINE/"}"
-  [ "$rel" = "$src" ] && continue
-  [ -z "$rel" ] && continue
-
-  # Skip the clone's .git directory (we're shipping just the tree, not the repo).
-  case "$rel" in
-    .git|.git/*) continue ;;
-  esac
-
-  dest="$STAGING/$rel"
-  mkdir -p "$(dirname "$dest")"
-
-  if [ -L "$src" ]; then
-    # Read the symlink's literal target string (apps/hq-cloud/src/s3.ts:417).
-    target="$(readlink "$src")"
-    printf 'hq-symlink:%s' "$target" > "$dest"
-    printf '%s\n' "$rel" >> "$SYMLIST"
-    n_syms=$((n_syms + 1))
-  elif [ -f "$src" ]; then
-    cp -p "$src" "$dest"
-    n_files=$((n_files + 1))
-  fi
-done < <(find "$BASELINE" \( -type d -name .git -prune \) -o \( \( -type f -o -type l \) -print0 \))
-
-echo "    staged: $n_files files, $n_syms symlinks" >&2
-
-# Strip files from staging that are KNOWN user-state — baseline ships
-# default values for these but the vault almost certainly has the user's
-# own customizations. Overwriting them would clobber config that lives
-# nowhere else (the menubar's hq-cloud/ignore.ts excludes some of these
-# from cloud sync, but earlier vault versions uploaded them).
-#
-# Each entry is a relative path inside the staging tree. Removed BEFORE
-# `aws s3 sync` runs so the file is not even a candidate for upload.
-PRESERVE_USER_STATE=(
-  # Company registry — user-owned, registers their connected companies'
-  # cloud_uid + bucket_name. v15 baseline ships an empty stub.
-  "companies/manifest.yaml"
-  # Claude Code prefs — user-customized model, env vars, hooks. v15 ships
-  # opinionated defaults that would overwrite e.g. MAX_THINKING_TOKENS,
-  # CLAUDE_CODE_SUBAGENT_MODEL, hook routing.
-  ".claude/settings.json"
-  # Obsidian UI state — pane layout, bookmarks, graph view. v15 ships
-  # defaults; users with active Obsidian have their own.
-  ".obsidian/workspace.json"
-  ".obsidian/graph.json"
-  ".obsidian/bookmarks.json"
-  ".obsidian/app.json"
-  ".obsidian/appearance.json"
-  ".obsidian/core-plugins.json"
-)
-n_preserved=0
-for rel in "${PRESERVE_USER_STATE[@]}"; do
-  if [ -f "$STAGING/$rel" ]; then
-    rm -f "$STAGING/$rel"
-    n_preserved=$((n_preserved + 1))
-    echo "    preserving user state (skipped from upload): $rel" >&2
-  fi
-done
-
-# ---------- phase 3: push ----------
-echo "" >&2
-echo "==> [3/3] aws s3 sync $STAGING/ → s3://$BUCKET/" >&2
-
-# `--size-only` because staging mtime is fresh and S3 LastModified reflects
-# original upload time. Default mtime-based comparison would re-upload every
-# content-stable file (same problem as vault-rescue.sh's push phase).
-#
-# No `--delete` by default. v14 baseline files coexist with v15 in S3 until
-# either the user upgrades locally (menubar Update HQ) or --delete-v14-cruft
-# is passed (handled below as a separate rm pass for a narrow allowlist).
-SYNC_ARGS=("s3" "sync" "$STAGING/" "s3://$BUCKET/" "--size-only")
-[ "$DRY_RUN" = "1" ] && SYNC_ARGS+=("--dryrun")
-
-aws "${AWS_ARGS[@]}" "${SYNC_ARGS[@]}"
-
-# `aws s3 sync` carries bytes but does not derive hq-cloud's per-file hq-mode
-# metadata. Re-upload ONLY regular objects that lack a valid mode, taking the
-# permission bits from this freshly cloned release tree (the canonical git
-# manifest). This is the one-time repair for legacy objects: a fresh pull can
-# now restore shipped hooks/scripts from metadata rather than guessing from
-# content. Existing user metadata is retained, including created-by fields.
-n_mode_backfilled=0
-MODE_META_DIR="$(mktemp -d -t hq-rebaseline-mode-meta-XXXXXX)"
-cleanup_mode_meta() { rm -rf "${MODE_META_DIR:-}"; }
-trap 'rc=$?; cleanup_mode_meta; cleanup "$rc"' EXIT
-mode_index=0
-while IFS= read -r -d '' src; do
-  rel="${src#"$STAGING/"}"
-  # Symlink records intentionally have no hq-mode (their mode is OS-owned).
-  grep -Fqx -- "$rel" "$SYMLIST" && continue
-
-  mode="$(stat -c '%a' "$src")"
-  head_json="$MODE_META_DIR/$mode_index.head.json"
-  metadata_json="$MODE_META_DIR/$mode_index.metadata.json"
-  mode_index=$((mode_index + 1))
-  aws "${AWS_ARGS[@]}" s3api head-object \
-    --bucket "$BUCKET" --key "$rel" --output json > "$head_json"
-  existing_mode="$(jq -r '.Metadata["hq-mode"] // empty' "$head_json")"
-  if [[ "$existing_mode" =~ ^[0-7]{1,4}$ ]]; then
-    continue
-  fi
-
-  jq -c --arg mode "$mode" \
-    '(.Metadata // {}) + {"hq-mode": $mode}' \
-    "$head_json" > "$metadata_json"
-  content_type="$(jq -r '.ContentType // empty' "$head_json")"
-  if [ "$DRY_RUN" = "1" ]; then
-    echo "    would backfill hq-mode=$mode: $rel" >&2
-  else
-    PUT_ARGS=(s3api put-object --bucket "$BUCKET" --key "$rel" --body "$src" --metadata "file://$metadata_json")
-    [ -n "$content_type" ] && PUT_ARGS+=(--content-type "$content_type")
-    aws "${AWS_ARGS[@]}" "${PUT_ARGS[@]}" >/dev/null
-    echo "    backfilled hq-mode=$mode: $rel" >&2
-  fi
-  n_mode_backfilled=$((n_mode_backfilled + 1))
-done < <(find "$STAGING" -type f -print0)
-
-# Stamp the hq-symlink-target metadata header on every marker so the menubar
-# pull materializes them as real symlinks (apps/hq-cloud/src/s3.ts:466-468
-# prefers header detection; body sniff is fallback).
-n_stamped=0
-if [ "$DRY_RUN" = "0" ] && [ -s "$SYMLIST" ]; then
-  echo "" >&2
-  echo "    stamping hq-symlink-target metadata on $(wc -l < "$SYMLIST" | tr -d ' ') markers" >&2
-  while IFS= read -r rel; do
-    [ -z "$rel" ] && continue
-    aws "${AWS_ARGS[@]}" s3api put-object \
-      --bucket "$BUCKET" \
-      --key "$rel" \
-      --body "$STAGING/$rel" \
-      --metadata "hq-symlink-target=1" \
-      --content-type "text/plain" \
-      >/dev/null
-    n_stamped=$((n_stamped + 1))
-  done < "$SYMLIST"
-  echo "    stamped: $n_stamped" >&2
-fi
-
-# Optional: delete v14-era root files that don't exist in v15. Narrow
-# allowlist — files we can confidently say were always release-shipped and
-# would never be user-customized. Everything else stays.
-n_deleted=0
-if [ "$DELETE_CRUFT" = "1" ]; then
-  echo "" >&2
-  echo "    deleting v14 root-file cruft" >&2
-  V14_CRUFT=(
-    "CHANGELOG.md"
-    "README.md"
-    "LICENSE"
-    "setup.sh"
-    "RELEASE-NOTES-v14.0.0.md"
-    "MIGRATION-v11.md"
-    "USER-GUIDE.md"
-    "CONTRIBUTING.md"
-  )
-  for key in "${V14_CRUFT[@]}"; do
-    # Probe first — only delete if it actually exists.
-    if aws "${AWS_ARGS[@]}" s3api head-object --bucket "$BUCKET" --key "$key" >/dev/null 2>&1; then
-      if [ "$DRY_RUN" = "1" ]; then
-        echo "    would delete: $key" >&2
-      else
-        aws "${AWS_ARGS[@]}" s3api delete-object --bucket "$BUCKET" --key "$key" >/dev/null
-        echo "    deleted: $key" >&2
-      fi
-      n_deleted=$((n_deleted + 1))
-    fi
-  done
-fi
-
-echo "" >&2
-echo "==> vault-rebaseline complete." >&2
-echo "    bucket:        s3://$BUCKET" >&2
-echo "    version:       $VERSION ($SOURCE_REPO@$REF)" >&2
-echo "    pushed:        $n_files files, $n_syms symlinks (gross — preserved excluded)" >&2
-echo "    user-state preserved: $n_preserved files" >&2
-echo "    stamped:       $n_stamped" >&2
-echo "    hq-mode backfilled: $n_mode_backfilled" >&2
-echo "    deleted:       $n_deleted (v14 cruft)" >&2
-exit 0

package/scripts/vault-rescue.sh

@@ -1,332 +0,0 @@
-#!/usr/bin/env bash
-# vault-rescue.sh — end-to-end vault rescue for a single HQ user.
-#
-# Pulls the user's S3 vault to a tmp dir, runs the hq-sync rescue script
-# against it at a target hq-core version, and pushes the result back to
-# S3 with the hq-symlink:<target> wire protocol intact. The whole flow
-# replicates what the menubar app would do if the user clicked "Update HQ"
-# locally — except the operator runs it remotely against any vault they
-# have AWS S3 access to.
-#
-# Usage:
-#
-#   vault-rescue.sh --prs <prs_*> --version <hq-version> [opts...]
-#
-# Required:
-#   --prs <prs_*>          Entity UID (e.g. prs_01KQ7NTBRY8X2QAA4S8AAF26W6).
-#                          Bucket name resolves to hq-vault-<lower-uid-w/-dashes>.
-#   --version <X.Y.Z>      Target hq-core version. Becomes --ref v<X.Y.Z>.
-#
-# Optional:
-#   --source <owner/repo>  Default: indigoai-us/hq-core (release repo, tagged).
-#                          Override with indigoai-us/hq-core-staging for staging
-#                          builds (no v-prefix; passes --ref main with the
-#                          version used only for logging / future floor lookup).
-#   --dry-run              Don't actually mutate S3. Pull still happens (so you
-#                          can inspect the tmp dir), rescue runs --dry-run, push
-#                          runs --dryrun. Combine with --keep-tmp to inspect
-#                          what the rescue would have produced.
-#   --keep-tmp             Don't delete the tmp dir on exit (useful for diffing).
-#   --rescue-script <path> Override path to hq-sync's replace-rescue.sh.
-#                          Default resolves via $HQ_RESCUE_SCRIPT, then
-#                          <this-script>/../../hq-sync/scripts/replace-rescue.sh.
-#   --profile <name>       AWS profile. Default: $HQ_VAULT_AWS_PROFILE.
-#   --region <name>        AWS region. Default: us-east-1.
-#   --tmp-dir <dir>        Override the tmp dir path. Default: mktemp under /tmp.
-#   --floor-sha <40-hex>   Forwarded to replace-rescue.sh; bypasses the
-#                          vault's stamped last_sync_sha.
-#
-# Auth: uses the caller's AWS profile directly. The menubar app vends
-# short-lived STS creds via vault-service; this script does not — it
-# requires standing S3 perms on the target bucket. Operator/admin only.
-#
-# Output: live logs from each phase, plus a final summary. The pre-update
-# safety snapshot from replace-rescue.sh lands at
-# ~/.hq/backups/pre-update-<ts>/ on the OPERATOR's machine, not the user's.
-
-set -euo pipefail
-
-PRS=""
-VERSION=""
-SOURCE_REPO="indigoai-us/hq-core"
-DRY_RUN=0
-KEEP_TMP=0
-RESCUE_SCRIPT="${HQ_RESCUE_SCRIPT:-}"
-AWS_PROFILE_OVERRIDE="${HQ_VAULT_AWS_PROFILE:-}"
-AWS_REGION_OVERRIDE="${HQ_VAULT_AWS_REGION:-us-east-1}"
-TMP_DIR_OVERRIDE=""
-FLOOR_SHA=""
-
-# Default rescue script: discover relative to this file's location. Works
-# when hq-cloud and hq-sync are sibling apps under hq-workspace; falls back
-# to the env var when checked out elsewhere.
-if [ -z "$RESCUE_SCRIPT" ]; then
-  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-  CANDIDATE="$SCRIPT_DIR/../../hq-sync/scripts/replace-rescue.sh"
-  [ -f "$CANDIDATE" ] && RESCUE_SCRIPT="$CANDIDATE"
-fi
-
-usage() {
-  sed -n '2,45p' "$0"
-  exit 2
-}
-
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --prs)            PRS="$2"; shift 2 ;;
-    --version)        VERSION="$2"; shift 2 ;;
-    --source)         SOURCE_REPO="$2"; shift 2 ;;
-    --dry-run)        DRY_RUN=1; shift ;;
-    --keep-tmp)       KEEP_TMP=1; shift ;;
-    --rescue-script)  RESCUE_SCRIPT="$2"; shift 2 ;;
-    --profile)        AWS_PROFILE_OVERRIDE="$2"; shift 2 ;;
-    --region)         AWS_REGION_OVERRIDE="$2"; shift 2 ;;
-    --tmp-dir)        TMP_DIR_OVERRIDE="$2"; shift 2 ;;
-    --floor-sha)      FLOOR_SHA="$2"; shift 2 ;;
-    -h|--help)        usage ;;
-    *) echo "unknown arg: $1" >&2; usage ;;
-  esac
-done
-
-[ -n "$PRS" ]     || { echo "error: --prs is required" >&2; usage; }
-[ -n "$VERSION" ] || { echo "error: --version is required" >&2; usage; }
-[ -n "$RESCUE_SCRIPT" ] || {
-  echo "error: replace-rescue.sh not found. Pass --rescue-script <path> or set HQ_RESCUE_SCRIPT." >&2
-  exit 2
-}
-[ -f "$RESCUE_SCRIPT" ] || {
-  echo "error: --rescue-script '$RESCUE_SCRIPT' is not a file" >&2
-  exit 2
-}
-
-case "$PRS" in
-  prs_*) ;;
-  *) echo "error: --prs must look like prs_*; got '$PRS'" >&2; exit 2 ;;
-esac
-
-# Bucket name convention (matches s3.ts entity → bucket mapping):
-#   prs_01ABC...  →  hq-vault-prs-01abc...
-BUCKET="hq-vault-$(printf '%s' "$PRS" | tr '[:upper:]' '[:lower:]' | tr '_' '-')"
-
-# Construct rescue --ref. Tagged releases live in hq-core as v<version>;
-# rolling staging uses main and treats --version as informational.
-case "$SOURCE_REPO" in
-  *hq-core-staging) REF="main" ;;
-  *)                REF="v$VERSION" ;;
-esac
-
-# AWS CLI prefix.
-AWS_ARGS=()
-[ -n "$AWS_PROFILE_OVERRIDE" ] && AWS_ARGS+=(--profile "$AWS_PROFILE_OVERRIDE")
-AWS_ARGS+=(--region "$AWS_REGION_OVERRIDE")
-
-command -v jq >/dev/null || {
-  echo "error: jq is required to preserve existing S3 metadata during hq-mode repair" >&2
-  exit 2
-}
-
-# Tmp dir setup.
-if [ -n "$TMP_DIR_OVERRIDE" ]; then
-  TMP_DIR="$TMP_DIR_OVERRIDE"
-  mkdir -p "$TMP_DIR"
-else
-  TMP_DIR="$(mktemp -d -t hq-vault-rescue-XXXXXX)"
-fi
-
-# Trap MUST reference an unconditional global with default-empty fallback
-# (set -u trips on undef refs in the trap body otherwise).
-cleanup() {
-  local rc=$?
-  if [ "$KEEP_TMP" = "1" ]; then
-    echo "==> --keep-tmp set; preserving $TMP_DIR" >&2
-  elif [ -n "${TMP_DIR:-}" ] && [ -d "$TMP_DIR" ]; then
-    rm -rf "$TMP_DIR"
-  fi
-  return $rc
-}
-trap cleanup EXIT
-
-cat <<EOF
-==> vault-rescue
-    prs:           $PRS
-    bucket:        s3://$BUCKET
-    target:        $SOURCE_REPO @ $REF  (version $VERSION)
-    rescue script: $RESCUE_SCRIPT
-    tmp dir:       $TMP_DIR
-    dry-run:       $([ "$DRY_RUN" = "1" ] && echo "ON (no S3 mutation, no tmp mutation past pull)" || echo "off")
-    keep-tmp:      $([ "$KEEP_TMP" = "1" ] && echo "yes" || echo "no")
-EOF
-
-# ---------- phase 1: pull ----------
-echo "" >&2
-echo "==> [1/3] pull s3://$BUCKET/  ->  $TMP_DIR/" >&2
-aws "${AWS_ARGS[@]}" s3 sync "s3://$BUCKET/" "$TMP_DIR/" --quiet
-echo "==> pull done. files: $(find "$TMP_DIR" -type f | wc -l | tr -d ' ')" >&2
-
-# ---------- phase 2: rescue ----------
-echo "" >&2
-echo "==> [2/3] rescue: $RESCUE_SCRIPT --source $SOURCE_REPO --ref $REF --cloud-update" >&2
-
-RESCUE_ARGS=(
-  --hq-root "$TMP_DIR"
-  --source "$SOURCE_REPO"
-  --ref "$REF"
-  --cloud-update
-  --no-backup
-  --yes
-)
-# --no-backup is intentional: replace-rescue.sh's own pre-update snapshot
-# would land at ~/.hq/backups/ on the OPERATOR's machine, not the vault
-# owner's — so it doesn't help the user we're rescuing. Phase 1 already
-# leaves the pulled tmp tree on disk (preserved with --keep-tmp), which IS
-# the meaningful pre-rescue snapshot. Operators who want a hardened
-# backup tarball it themselves before invoking this script.
-# Requires hq-sync ≥0.6.4 (indigoai-us/hq-sync#170 — earlier versions
-# return exit 1 on the --no-backup branch and kill us mid-flight).
-[ "$DRY_RUN" = "1" ] && RESCUE_ARGS+=(--dry-run)
-[ -n "$FLOOR_SHA" ] && RESCUE_ARGS+=(--floor-sha "$FLOOR_SHA")
-
-bash "$RESCUE_SCRIPT" "${RESCUE_ARGS[@]}"
-echo "==> rescue done." >&2
-
-if [ "$DRY_RUN" = "1" ]; then
-  echo "" >&2
-  echo "==> [3/3] push: SKIPPED (--dry-run; rescue ran --dry-run too, no tmp mutation to push)" >&2
-  echo "==> vault-rescue complete (dry-run). Inspect $TMP_DIR." >&2
-  KEEP_TMP=1
-  exit 0
-fi
-
-# ---------- phase 3: push ----------
-echo "" >&2
-echo "==> [3/3] push $TMP_DIR/  ->  s3://$BUCKET/" >&2
-
-# Build a staging tree: regular files copied verbatim; local symlinks
-# serialized as hq-symlink:<target> marker files (no trailing newline,
-# per apps/hq-cloud/src/s3.ts:417). Skip a minimal denylist that should
-# never round-trip through S3.
-STAGING="$(mktemp -d -t hq-vault-rescue-stage-XXXXXX)"
-MODE_META_DIR="$(mktemp -d -t hq-vault-rescue-mode-meta-XXXXXX)"
-add_staging_cleanup() {
-  rm -rf "${STAGING:-}" "${MODE_META_DIR:-}"
-}
-# Chain cleanup: existing trap removes TMP_DIR; we also need STAGING gone.
-trap '{ add_staging_cleanup; cleanup; }' EXIT
-
-echo "    staging at $STAGING" >&2
-
-# Denylist (path prefixes that should never push back). This is INTENTIONALLY
-# smaller than apps/hq-cloud/src/ignore.ts — the vault we just pulled IS the
-# source of truth, so over-filtering would cause spurious deletes.
-deny_path() {
-  case "$1" in
-    .git|.git/*) return 0 ;;
-    node_modules|node_modules/*) return 0 ;;
-    target|target/*) return 0 ;;
-    dist|dist/*) return 0 ;;
-    build|build/*) return 0 ;;
-    __pycache__|__pycache__/*) return 0 ;;
-    .venv|.venv/*|venv|venv/*) return 0 ;;
-    .DS_Store|*/.DS_Store) return 0 ;;
-    .env|.env.*) return 0 ;;
-    *.pyc|*.class) return 0 ;;
-  esac
-  return 1
-}
-
-n_files=0; n_symlinks=0; n_skipped=0
-SYMLINK_LIST="$STAGING.symlinks.txt"
-: > "$SYMLINK_LIST"
-
-while IFS= read -r -d '' src; do
-  rel="${src#"$TMP_DIR/"}"
-  [ "$rel" = "$src" ] && continue
-  [ -z "$rel" ] && continue
-  if deny_path "$rel"; then
-    n_skipped=$((n_skipped + 1))
-    continue
-  fi
-  dest="$STAGING/$rel"
-  mkdir -p "$(dirname "$dest")"
-  if [ -L "$src" ]; then
-    target="$(readlink "$src")"
-    printf 'hq-symlink:%s' "$target" > "$dest"
-    printf '%s\n' "$rel" >> "$SYMLINK_LIST"
-    n_symlinks=$((n_symlinks + 1))
-  elif [ -f "$src" ]; then
-    cp -p "$src" "$dest"
-    n_files=$((n_files + 1))
-  fi
-done < <(find "$TMP_DIR" \( -type d \( -name node_modules -o -name .git -o -name target -o -name dist -o -name build \) -prune \) -o \( \( -type f -o -type l \) -print0 \))
-
-echo "    staged files=$n_files symlinks=$n_symlinks skipped=$n_skipped" >&2
-
-# Sync to S3 — `--size-only` because staging mtime=now (fresh write) and
-# S3 LastModified reflects original upload, so the default mtime-based
-# comparator would treat every staging file as newer and re-upload it.
-echo "    aws s3 sync $STAGING/ -> s3://$BUCKET/ --size-only --delete" >&2
-aws "${AWS_ARGS[@]}" s3 sync "$STAGING/" "s3://$BUCKET/" --size-only --delete
-
-# The AWS CLI moves bytes without hq-cloud's hq-mode metadata. Re-upload only
-# regular objects that need the one-time repair, preserving existing S3 user
-# metadata. For release-shipped files the rescue overlay supplied these modes
-# from the trusted hq-core git tree, so a fresh pull restores hooks/scripts
-# from canonical metadata instead of trying to infer executability from bytes.
-n_mode_backfilled=0
-mode_index=0
-while IFS= read -r -d '' src; do
-  rel="${src#"$STAGING/"}"
-  # Symlink records intentionally have no hq-mode (their mode is OS-owned).
-  grep -Fqx -- "$rel" "$SYMLINK_LIST" && continue
-
-  mode="$(stat -c '%a' "$src")"
-  head_json="$MODE_META_DIR/$mode_index.head.json"
-  metadata_json="$MODE_META_DIR/$mode_index.metadata.json"
-  mode_index=$((mode_index + 1))
-  aws "${AWS_ARGS[@]}" s3api head-object \
-    --bucket "$BUCKET" --key "$rel" --output json > "$head_json"
-  existing_mode="$(jq -r '.Metadata["hq-mode"] // empty' "$head_json")"
-  if [[ "$existing_mode" =~ ^[0-7]{1,4}$ ]]; then
-    continue
-  fi
-
-  jq -c --arg mode "$mode" \
-    '(.Metadata // {}) + {"hq-mode": $mode}' \
-    "$head_json" > "$metadata_json"
-  content_type="$(jq -r '.ContentType // empty' "$head_json")"
-  PUT_ARGS=(s3api put-object --bucket "$BUCKET" --key "$rel" --body "$src" --metadata "file://$metadata_json")
-  [ -n "$content_type" ] && PUT_ARGS+=(--content-type "$content_type")
-  aws "${AWS_ARGS[@]}" "${PUT_ARGS[@]}" >/dev/null
-  echo "    backfilled hq-mode=$mode: $rel" >&2
-  n_mode_backfilled=$((n_mode_backfilled + 1))
-done < <(find "$STAGING" -type f -print0)
-
-# Stamp the hq-symlink metadata header on every symlink-marker object so
-# the menubar pull materializes them as real symlinks (apps/hq-cloud/src/
-# s3.ts:466-468 prefers header detection; body-sniff is fallback).
-n_stamped=0
-if [ -s "$SYMLINK_LIST" ]; then
-  echo "    stamping hq-symlink-target metadata on $(wc -l < "$SYMLINK_LIST" | tr -d ' ') objects" >&2
-  while IFS= read -r rel; do
-    [ -z "$rel" ] && continue
-    aws "${AWS_ARGS[@]}" s3api put-object \
-      --bucket "$BUCKET" \
-      --key "$rel" \
-      --body "$STAGING/$rel" \
-      --metadata "hq-symlink-target=1" \
-      --content-type "text/plain" \
-      >/dev/null
-    n_stamped=$((n_stamped + 1))
-  done < "$SYMLINK_LIST"
-fi
-echo "    stamped: $n_stamped" >&2
-
-echo "" >&2
-echo "==> vault-rescue complete." >&2
-echo "    bucket:    s3://$BUCKET" >&2
-echo "    version:   $VERSION ($SOURCE_REPO@$REF)" >&2
-echo "    files:     $n_files" >&2
-echo "    symlinks:  $n_symlinks" >&2
-echo "    stamped:   $n_stamped" >&2
-echo "    hq-mode backfilled: $n_mode_backfilled" >&2
-echo "    skipped:   $n_skipped" >&2