fix(cli): trust GitHub release asset redirects

Co-authored-by: Cursor <cursoragent@cursor.com>

memhub/scripts/build-release-assets.mjs

@@ -8,7 +8,6 @@ import {
   mkdir,
   readdir,
   readFile,
-  readlink,
   realpath,
   rm,
   stat,
@@ -321,12 +320,6 @@ async function distributionBytes(source) {
 
 async function sha256File(file) {
   const digest = createHash("sha256");
-  const info = await lstat(file);
-  if (info.isSymbolicLink()) {
-    digest.update("symlink\0");
-    digest.update(await readlink(file));
-    return digest.digest("hex");
-  }
   for await (const chunk of createReadStream(file)) digest.update(chunk);
   return digest.digest("hex");
 }

memhub/scripts/build-release-assets.test.mjs

@@ -6,7 +6,6 @@ import {
   readdir,
   readFile,
   rm,
-  symlink,
   writeFile,
 } from "node:fs/promises";
 import os from "node:os";
@@ -122,35 +121,6 @@ test("builds versioned Runtime archives, checksums and a downloader-compatible m
   }
 });
 
-test("verifies Runtime symlinks with the same identity rule as the installer", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "memhub-release-assets-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const source = await distribution(root, "linux", "x64");
-  const link = "memhub";
-  await symlink(link, path.join(source, "bin", "node"));
-  const manifestPath = path.join(source, "manifest.json");
-  const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
-  manifest.files["bin/node"] = sha256(`symlink\0${link}`);
-  await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
-
-  const release = await buildReleaseAssets({
-    output: path.join(root, "release"),
-    version: "0.1.0-internal.1",
-    channel: "prerelease",
-    assetBaseUrl: "https://git.example.test/release/downloads/",
-    distributions: [source],
-  });
-
-  assert.ok(
-    release.artifacts.some(
-      (artifact) =>
-        artifact.kind === "runtime" &&
-        artifact.platform === "linux" &&
-        artifact.arch === "x64",
-    ),
-  );
-});
-
 test("refuses version, build and duplicate target drift", async (t) => {
   const root = await mkdtemp(path.join(os.tmpdir(), "memhub-release-assets-"));
   t.after(() => rm(root, { recursive: true, force: true }));