@indigoai-us/hq-cli 5.111.2 → 5.113.0

package/dist/command-registration-plan.d.ts

@@ -0,0 +1,394 @@
+import type { Command } from "commander";
+/**
+ * The one authoritative registration plan for eager validation and lazy
+ * invocation. Multi-module roots keep the old registration order here.
+ */
+export declare const REGISTRATION_PLAN: readonly [{
+    readonly type: "group";
+    readonly root: "modules";
+    readonly id: "modules";
+    readonly name: "modules";
+    readonly description: "Module management commands";
+}, {
+    readonly type: "registrar";
+    readonly root: "modules";
+    readonly parent: "modules";
+    readonly module: "./commands/add.js";
+    readonly exportName: "registerAddCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "modules";
+    readonly parent: "modules";
+    readonly module: "./commands/sync.js";
+    readonly exportName: "registerSyncCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "modules";
+    readonly parent: "modules";
+    readonly module: "./commands/list.js";
+    readonly exportName: "registerListCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "modules";
+    readonly parent: "modules";
+    readonly module: "./commands/update.js";
+    readonly exportName: "registerUpdateCommand";
+}, {
+    readonly type: "group";
+    readonly root: "packages";
+    readonly id: "packages";
+    readonly name: "packages";
+    readonly description: "Package management commands";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/pkg-install.js";
+    readonly exportName: "registerPackageInstallCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/pkg-remove.js";
+    readonly exportName: "registerPackageRemoveCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/pkg-update.js";
+    readonly exportName: "registerPackageUpdateCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/pkg-list.js";
+    readonly exportName: "registerPackageListCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/packs.js";
+    readonly exportName: "registerPacksCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packs";
+    readonly parent: "program";
+    readonly module: "./commands/packs.js";
+    readonly exportName: "registerPacksCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "install";
+    readonly parent: "program";
+    readonly module: "./commands/pkg-install.js";
+    readonly exportName: "registerPackageInstallCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "remove";
+    readonly parent: "program";
+    readonly module: "./commands/pkg-remove.js";
+    readonly exportName: "registerPackageRemoveCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "publish";
+    readonly parent: "program";
+    readonly module: "./commands/publish.js";
+    readonly exportName: "registerPublishCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "creators";
+    readonly parent: "program";
+    readonly module: "./commands/creators.js";
+    readonly exportName: "registerCreatorsCommand";
+}, {
+    readonly type: "group";
+    readonly root: "sync";
+    readonly id: "sync";
+    readonly name: "sync";
+    readonly description: "Cloud sync commands — sync HQ to S3 for mobile access";
+}, {
+    readonly type: "registrar";
+    readonly root: "sync";
+    readonly parent: "sync";
+    readonly module: "./commands/cloud.js";
+    readonly exportName: "registerCloudCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "sync";
+    readonly parent: "sync";
+    readonly module: "./commands/sync-mode.js";
+    readonly exportName: "registerSyncModeCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "sync";
+    readonly parent: "sync";
+    readonly module: "./commands/sync-narrow.js";
+    readonly exportName: "registerSyncNarrowCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "sync";
+    readonly parent: "sync";
+    readonly module: "./commands/sync-manifest.js";
+    readonly exportName: "registerSyncManifestCommand";
+}, {
+    readonly type: "group";
+    readonly root: "cloud";
+    readonly id: "cloud";
+    readonly name: "cloud";
+    readonly description: "Cloud commands — provision entities and manage cloud-backed companies";
+}, {
+    readonly type: "registrar";
+    readonly root: "cloud";
+    readonly parent: "cloud";
+    readonly module: "./commands/cloud-provision.js";
+    readonly exportName: "registerCloudProvisionCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "cloud";
+    readonly parent: "cloud";
+    readonly module: "./commands/cloud-demote.js";
+    readonly exportName: "registerCloudDemoteCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "team-sync";
+    readonly parent: "program";
+    readonly module: "./commands/team-sync.js";
+    readonly exportName: "registerTeamSyncCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "login";
+    readonly parent: "program";
+    readonly module: "./commands/login.js";
+    readonly exportName: "registerLoginCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "logout";
+    readonly parent: "program";
+    readonly module: "./commands/logout.js";
+    readonly exportName: "registerLogoutCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "whoami";
+    readonly parent: "program";
+    readonly module: "./commands/whoami.js";
+    readonly exportName: "registerWhoamiCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "auth";
+    readonly parent: "program";
+    readonly module: "./commands/auth.js";
+    readonly exportName: "registerAuthCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "secrets";
+    readonly parent: "program";
+    readonly module: "./commands/secrets.js";
+    readonly exportName: "registerSecretsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "db";
+    readonly parent: "program";
+    readonly module: "./commands/db.js";
+    readonly exportName: "registerDbCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "api-keys";
+    readonly parent: "program";
+    readonly module: "./commands/api-keys.js";
+    readonly exportName: "registerApiKeysCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "run";
+    readonly parent: "program";
+    readonly module: "./commands/run.js";
+    readonly exportName: "registerRunCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "groups";
+    readonly parent: "program";
+    readonly module: "./commands/groups.js";
+    readonly exportName: "registerGroupsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "workers";
+    readonly parent: "program";
+    readonly module: "./commands/workers.js";
+    readonly exportName: "registerWorkersCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "group-grants";
+    readonly parent: "program";
+    readonly module: "./commands/group-grants.js";
+    readonly exportName: "registerGroupGrantsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "files";
+    readonly parent: "program";
+    readonly module: "./commands/files.js";
+    readonly exportName: "registerFilesCommand";
+    readonly result: "files";
+}, {
+    readonly type: "registrar";
+    readonly root: "files";
+    readonly parent: "files";
+    readonly module: "./commands/files-browse.js";
+    readonly exportName: "registerFilesBrowseCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "access";
+    readonly parent: "program";
+    readonly module: "./commands/access.js";
+    readonly exportName: "registerAccessCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "skill";
+    readonly parent: "program";
+    readonly module: "./commands/skill.js";
+    readonly exportName: "registerSkillCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "members";
+    readonly parent: "program";
+    readonly module: "./commands/members.js";
+    readonly exportName: "registerMembersCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "people";
+    readonly parent: "program";
+    readonly module: "./commands/people.js";
+    readonly exportName: "registerPeopleCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "dm";
+    readonly parent: "program";
+    readonly module: "./commands/dm.js";
+    readonly exportName: "registerDmCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "channels";
+    readonly parent: "program";
+    readonly module: "./commands/channels.js";
+    readonly exportName: "registerChannelsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "onboard";
+    readonly parent: "program";
+    readonly module: "./commands/onboard.js";
+    readonly exportName: "registerOnboardCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "feedback";
+    readonly parent: "program";
+    readonly module: "./commands/feedback.js";
+    readonly exportName: "registerFeedbackCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "meetings";
+    readonly parent: "program";
+    readonly module: "./commands/meetings.js";
+    readonly exportName: "registerMeetingsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "sources";
+    readonly parent: "program";
+    readonly module: "./commands/sources.js";
+    readonly exportName: "registerSourcesCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "signals";
+    readonly parent: "program";
+    readonly module: "./commands/signals.js";
+    readonly exportName: "registerSignalsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "integrations";
+    readonly parent: "program";
+    readonly module: "./commands/integrations.js";
+    readonly exportName: "registerIntegrationsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "reindex";
+    readonly parent: "program";
+    readonly module: "./commands/reindex.js";
+    readonly exportName: "registerReindexCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "rescue";
+    readonly parent: "program";
+    readonly module: "./commands/rescue.js";
+    readonly exportName: "registerRescueCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "mcp";
+    readonly parent: "program";
+    readonly module: "./commands/mcp-status.js";
+    readonly exportName: "registerMcpCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "crm";
+    readonly parent: "program";
+    readonly module: "./commands/crm.js";
+    readonly exportName: "registerCrmCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "company";
+    readonly parent: "program";
+    readonly module: "./commands/company.js";
+    readonly exportName: "registerCompanyCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "agents";
+    readonly parent: "program";
+    readonly module: "./commands/agents.js";
+    readonly exportName: "registerAgentsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "outposts";
+    readonly parent: "program";
+    readonly module: "./commands/outposts.js";
+    readonly exportName: "registerOutpostsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "billing";
+    readonly parent: "program";
+    readonly module: "./commands/billing.js";
+    readonly exportName: "registerBillingCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "core";
+    readonly parent: "program";
+    readonly module: "./commands/core.js";
+    readonly exportName: "registerCoreCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "search";
+    readonly parent: "program";
+    readonly module: "./commands/search.js";
+    readonly exportName: "registerSearchCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "index";
+    readonly parent: "program";
+    readonly module: "./commands/index-cmd.js";
+    readonly exportName: "registerIndexCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "doctor";
+    readonly parent: "program";
+    readonly module: "./commands/doctor.js";
+    readonly exportName: "registerDoctorCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "mesh";
+    readonly parent: "program";
+    readonly module: "./commands/mesh.js";
+    readonly exportName: "registerMeshCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "bot";
+    readonly parent: "program";
+    readonly module: "./commands/bot.js";
+    readonly exportName: "registerBotCommand";
+}];
+export declare function registerAllCommands(program: Command): Promise<void>;
+export declare function registerCommandRoot(program: Command, root: string): Promise<boolean>;
+//# sourceMappingURL=command-registration-plan.d.ts.map

package/dist/command-registration-plan.js

@@ -0,0 +1,103 @@
+/**
+ * The one authoritative registration plan for eager validation and lazy
+ * invocation. Multi-module roots keep the old registration order here.
+ */
+export const REGISTRATION_PLAN = [
+    { type: "group", root: "modules", id: "modules", name: "modules", description: "Module management commands" },
+    { type: "registrar", root: "modules", parent: "modules", module: "./commands/add.js", exportName: "registerAddCommand" },
+    { type: "registrar", root: "modules", parent: "modules", module: "./commands/sync.js", exportName: "registerSyncCommand" },
+    { type: "registrar", root: "modules", parent: "modules", module: "./commands/list.js", exportName: "registerListCommand" },
+    { type: "registrar", root: "modules", parent: "modules", module: "./commands/update.js", exportName: "registerUpdateCommand" },
+    { type: "group", root: "packages", id: "packages", name: "packages", description: "Package management commands" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/pkg-install.js", exportName: "registerPackageInstallCommand" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/pkg-remove.js", exportName: "registerPackageRemoveCommand" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/pkg-update.js", exportName: "registerPackageUpdateCommand" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/pkg-list.js", exportName: "registerPackageListCommand" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/packs.js", exportName: "registerPacksCommand" },
+    { type: "registrar", root: "packs", parent: "program", module: "./commands/packs.js", exportName: "registerPacksCommand" },
+    { type: "registrar", root: "install", parent: "program", module: "./commands/pkg-install.js", exportName: "registerPackageInstallCommand" },
+    { type: "registrar", root: "remove", parent: "program", module: "./commands/pkg-remove.js", exportName: "registerPackageRemoveCommand" },
+    { type: "registrar", root: "publish", parent: "program", module: "./commands/publish.js", exportName: "registerPublishCommand" },
+    { type: "registrar", root: "creators", parent: "program", module: "./commands/creators.js", exportName: "registerCreatorsCommand" },
+    { type: "group", root: "sync", id: "sync", name: "sync", description: "Cloud sync commands — sync HQ to S3 for mobile access" },
+    { type: "registrar", root: "sync", parent: "sync", module: "./commands/cloud.js", exportName: "registerCloudCommands" },
+    { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-mode.js", exportName: "registerSyncModeCommand" },
+    { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-narrow.js", exportName: "registerSyncNarrowCommand" },
+    { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-manifest.js", exportName: "registerSyncManifestCommand" },
+    { type: "group", root: "cloud", id: "cloud", name: "cloud", description: "Cloud commands — provision entities and manage cloud-backed companies" },
+    { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-provision.js", exportName: "registerCloudProvisionCommands" },
+    { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-demote.js", exportName: "registerCloudDemoteCommands" },
+    { type: "registrar", root: "team-sync", parent: "program", module: "./commands/team-sync.js", exportName: "registerTeamSyncCommand" },
+    { type: "registrar", root: "login", parent: "program", module: "./commands/login.js", exportName: "registerLoginCommand" },
+    { type: "registrar", root: "logout", parent: "program", module: "./commands/logout.js", exportName: "registerLogoutCommand" },
+    { type: "registrar", root: "whoami", parent: "program", module: "./commands/whoami.js", exportName: "registerWhoamiCommand" },
+    { type: "registrar", root: "auth", parent: "program", module: "./commands/auth.js", exportName: "registerAuthCommands" },
+    { type: "registrar", root: "secrets", parent: "program", module: "./commands/secrets.js", exportName: "registerSecretsCommand" },
+    { type: "registrar", root: "db", parent: "program", module: "./commands/db.js", exportName: "registerDbCommand" },
+    { type: "registrar", root: "api-keys", parent: "program", module: "./commands/api-keys.js", exportName: "registerApiKeysCommand" },
+    { type: "registrar", root: "run", parent: "program", module: "./commands/run.js", exportName: "registerRunCommand" },
+    { type: "registrar", root: "groups", parent: "program", module: "./commands/groups.js", exportName: "registerGroupsCommand" },
+    { type: "registrar", root: "workers", parent: "program", module: "./commands/workers.js", exportName: "registerWorkersCommand" },
+    { type: "registrar", root: "group-grants", parent: "program", module: "./commands/group-grants.js", exportName: "registerGroupGrantsCommand" },
+    { type: "registrar", root: "files", parent: "program", module: "./commands/files.js", exportName: "registerFilesCommand", result: "files" },
+    { type: "registrar", root: "files", parent: "files", module: "./commands/files-browse.js", exportName: "registerFilesBrowseCommands" },
+    { type: "registrar", root: "access", parent: "program", module: "./commands/access.js", exportName: "registerAccessCommand" },
+    { type: "registrar", root: "skill", parent: "program", module: "./commands/skill.js", exportName: "registerSkillCommand" },
+    { type: "registrar", root: "members", parent: "program", module: "./commands/members.js", exportName: "registerMembersCommand" },
+    { type: "registrar", root: "people", parent: "program", module: "./commands/people.js", exportName: "registerPeopleCommand" },
+    { type: "registrar", root: "dm", parent: "program", module: "./commands/dm.js", exportName: "registerDmCommand" },
+    { type: "registrar", root: "channels", parent: "program", module: "./commands/channels.js", exportName: "registerChannelsCommand" },
+    { type: "registrar", root: "onboard", parent: "program", module: "./commands/onboard.js", exportName: "registerOnboardCommand" },
+    { type: "registrar", root: "feedback", parent: "program", module: "./commands/feedback.js", exportName: "registerFeedbackCommand" },
+    { type: "registrar", root: "meetings", parent: "program", module: "./commands/meetings.js", exportName: "registerMeetingsCommand" },
+    { type: "registrar", root: "sources", parent: "program", module: "./commands/sources.js", exportName: "registerSourcesCommand" },
+    { type: "registrar", root: "signals", parent: "program", module: "./commands/signals.js", exportName: "registerSignalsCommand" },
+    { type: "registrar", root: "integrations", parent: "program", module: "./commands/integrations.js", exportName: "registerIntegrationsCommand" },
+    { type: "registrar", root: "reindex", parent: "program", module: "./commands/reindex.js", exportName: "registerReindexCommand" },
+    { type: "registrar", root: "rescue", parent: "program", module: "./commands/rescue.js", exportName: "registerRescueCommand" },
+    { type: "registrar", root: "mcp", parent: "program", module: "./commands/mcp-status.js", exportName: "registerMcpCommand" },
+    { type: "registrar", root: "crm", parent: "program", module: "./commands/crm.js", exportName: "registerCrmCommand" },
+    { type: "registrar", root: "company", parent: "program", module: "./commands/company.js", exportName: "registerCompanyCommand" },
+    { type: "registrar", root: "agents", parent: "program", module: "./commands/agents.js", exportName: "registerAgentsCommand" },
+    { type: "registrar", root: "outposts", parent: "program", module: "./commands/outposts.js", exportName: "registerOutpostsCommand" },
+    { type: "registrar", root: "billing", parent: "program", module: "./commands/billing.js", exportName: "registerBillingCommand" },
+    { type: "registrar", root: "core", parent: "program", module: "./commands/core.js", exportName: "registerCoreCommands" },
+    { type: "registrar", root: "search", parent: "program", module: "./commands/search.js", exportName: "registerSearchCommand" },
+    { type: "registrar", root: "index", parent: "program", module: "./commands/index-cmd.js", exportName: "registerIndexCommand" },
+    { type: "registrar", root: "doctor", parent: "program", module: "./commands/doctor.js", exportName: "registerDoctorCommand" },
+    { type: "registrar", root: "mesh", parent: "program", module: "./commands/mesh.js", exportName: "registerMeshCommand" },
+    { type: "registrar", root: "bot", parent: "program", module: "./commands/bot.js", exportName: "registerBotCommand" },
+];
+async function executePlan(program, steps) {
+    const parents = new Map([["program", program]]);
+    for (const step of steps) {
+        if (step.type === "group") {
+            parents.set(step.id, program.command(step.name).description(step.description));
+            continue;
+        }
+        const parent = parents.get(step.parent);
+        if (!parent)
+            throw new Error(`Missing command parent '${step.parent}' for '${step.exportName}'`);
+        const imported = await import(step.module);
+        const register = imported[step.exportName];
+        if (!register)
+            throw new Error(`Missing command registrar '${step.exportName}' from '${step.module}'`);
+        const result = register(parent);
+        if (step.result) {
+            if (!result)
+                throw new Error(`Command registrar '${step.exportName}' did not return '${step.result}'`);
+            parents.set(step.result, result);
+        }
+    }
+}
+export async function registerAllCommands(program) {
+    await executePlan(program, REGISTRATION_PLAN);
+}
+export async function registerCommandRoot(program, root) {
+    const steps = REGISTRATION_PLAN.filter((step) => step.root === root);
+    if (steps.length === 0)
+        return false;
+    await executePlan(program, steps);
+    return true;
+}
+//# sourceMappingURL=command-registration-plan.js.map

package/dist/commands/core.js

@@ -46,6 +46,7 @@ import { archiveOldThreads } from "../lib/core-utils/archive-old-threads.js";
 import { qmdReindexAfterSync } from "../lib/core-utils/qmd-reindex-after-sync.js";
 import { softTimeoutCommand } from "../lib/core-utils/soft-timeout.js";
 import { timeoutGuardCommand } from "../lib/core-utils/timeout-guard.js";
+import { readSentryReportStdin, reportSentryEvent } from "../lib/core-utils/sentry-report.js";
 /**
  * These commands are now native implementations. Their retained shell assets
  * are deliberately claimed in SCAFFOLD_ONLY_ASSETS: loose HQ trees still ship
@@ -457,6 +458,23 @@ export function registerCoreCommands(program) {
         if (code !== 0)
             process.exit(code);
     });
+    // `hq core sentry report` — constrained, stderr-diagnostic-only transport
+    // for hook health events. Event data is accepted only on stdin so it never
+    // appears in the process list shared by the fleet.
+    core
+        .command("sentry")
+        .description("Constrained diagnostics transport for HQ hooks")
+        .command("report")
+        .description("Report one validated hook diagnostic from stdin")
+        .option("--dry-run", "validate and print the scrubbed Sentry event projection without sending")
+        .option("--timeout-ms <milliseconds>", "bounded Sentry flush budget (1-5000ms)")
+        .action(async (options) => {
+        const stdin = await readSentryReportStdin(process.stdin);
+        const timeoutMs = options.timeoutMs === undefined ? undefined : Number(options.timeoutMs);
+        const result = await reportSentryEvent(stdin ?? "", { dryRun: options.dryRun, timeoutMs });
+        if (result.code !== 0)
+            process.exitCode = result.code;
+    });
     return core;
 }
 //# sourceMappingURL=core.js.map

package/dist/commands/index-cmd.d.ts

@@ -3,6 +3,8 @@ import { type RunQmdOptions, type SearchCollection, type QmdProcessResult } from
 import { type BackgroundDependencies, type BackgroundResult, type BackgroundStatus } from '../lib/search-index/background.js';
 export type SearchIndexDependencies = {
     reconcileCollections: (hqRoot: string) => unknown;
+    /** Apply the per-document size cap to qmd's config before the update reads anything. */
+    applyIndexSizeLimit: (hqRoot: string) => unknown;
     deriveCollections: (hqRoot: string) => SearchCollection[];
     listRegisteredCollections: (hqRoot: string, options?: RunQmdOptions) => Set<string>;
     resolveQmdBin: () => string;

package/dist/commands/index-cmd.js

@@ -1,6 +1,7 @@
 import { Option } from 'commander';
 import { deriveCollections, listRegisteredCollections, packageLocalBin, reconcileCollections, resolveQmdBin, resolveQmdVersion, runQmd, } from '../lib/search-index/index.js';
 import { backgroundStatus, defaultBackgroundDependencies, runBackgroundLauncher, runBackgroundWorker, } from '../lib/search-index/background.js';
+import { applyIndexSizeLimit } from '../lib/search-index/max-doc-bytes.js';
 import { findHqRoot } from '../utils/manifest.js';
 import { QMD_NATIVE_BINDING_REMEDY, isQmdNativeBindingError, } from '../utils/qmd-native-binding-error.js';
 import { isQmdStoreMissingError, qmdStoreMissingMessage, } from '../utils/qmd-store-missing-error.js';
@@ -8,6 +9,7 @@ import { isQmdStoreUnopenableError, qmdStoreUnopenableMessage, } from '../utils/
 import { isQmdWorkdirMissingError, qmdWorkdirMissingMessage, } from '../utils/qmd-workdir-missing-error.js';
 const defaults = {
     reconcileCollections,
+    applyIndexSizeLimit,
     deriveCollections,
     listRegisteredCollections,
     resolveQmdBin,
@@ -20,6 +22,18 @@ const defaults = {
 /** Incrementally update qmd, embedding only when an operator explicitly asks. */
 export function syncSearchIndex(hqRoot, embed, dependencies = defaults) {
     dependencies.reconcileCollections(hqRoot);
+    // Must precede the update: an oversized file is skipped at glob time or not
+    // at all, so capping after the update would still have paid to read it.
+    //
+    // Best-effort, matching the background worker. The cap writes to qmd's config
+    // and to `.hq/`, either of which can be read-only on a locked-down box. An
+    // index that is merely uncapped is far better than no `qmd update` at all.
+    try {
+        dependencies.applyIndexSizeLimit(hqRoot);
+    }
+    catch {
+        /* capping is an optimisation; indexing is the job */
+    }
     dependencies.runQmd(['update'], { cwd: hqRoot });
     if (embed)
         dependencies.runQmd(['embed'], { cwd: hqRoot });
@@ -32,6 +46,7 @@ function makeBackgroundDependencies(hqRoot, dependencies) {
         ...defaultBackgroundDependencies(hqRoot),
         resolveQmdBin: dependencies.resolveQmdBin,
         reconcileCollections: dependencies.reconcileCollections,
+        applyIndexSizeLimit: dependencies.applyIndexSizeLimit,
         runQmd: dependencies.runQmd,
     };
 }