@indigoai-us/hq-cloud 5.48.4 → 6.0.0

package/scripts/{master-sync.sh → reindex.sh}

@@ -1,16 +1,16 @@
 #!/bin/bash
-# master-sync.sh — surfaces namespace skills as Claude Code skills under
+# reindex.sh — surfaces namespace skills as Claude Code skills under
 # .claude/skills/<ns>:<skill>/ with every file in the source skill folder
 # mirrored as a symlink. Also mirrors personal/{knowledge,policies,workers,
 # settings}/* into core/<type>/<name>.
 #
 # This script ships inside the @indigoai-us/hq-cloud package and is invoked via
-# `hq master-sync` (which passes the HQ root as $1). It is idempotent and cheap
+# `hq reindex` (which passes the HQ root as $1). It is idempotent and cheap
 # to re-run, so it doesn't gate on whether personal/ was actually touched. Real
 # files/dirs already at the link path are left untouched.
 #
 # REPO_ROOT resolution (in priority order):
-#   1. $1                — passed by `hq master-sync` (the HQ root)
+#   1. $1                — passed by `hq reindex` (the HQ root)
 #   2. $HQ_REPO_ROOT     — env override
 #   3. $PWD              — fallback when invoked directly
 #
@@ -40,7 +40,7 @@ set -uo pipefail
 
 REPO_ROOT="${1:-${HQ_REPO_ROOT:-$PWD}}"
 if [ ! -d "$REPO_ROOT" ]; then
-  echo "master-sync: REPO_ROOT '$REPO_ROOT' is not a directory" >&2
+  echo "reindex: REPO_ROOT '$REPO_ROOT' is not a directory" >&2
   exit 1
 fi
 REPO_ROOT="$(cd "$REPO_ROOT" && pwd)"
@@ -128,7 +128,7 @@ while [ "$i" -lt "${#namespaces[@]}" ]; do
     fi
   done
   if [ "$already" -eq 1 ]; then
-    echo "master-sync: namespace '$ns' already claimed by an earlier source; skipping $src_rel" >&2
+    echo "reindex: namespace '$ns' already claimed by an earlier source; skipping $src_rel" >&2
     continue
   fi
   seen+=("$ns")
@@ -147,7 +147,7 @@ while [ "$i" -lt "${#namespaces[@]}" ]; do
 
     # If something non-directory occupies the slot, bail.
     if [ -e "$wrapper" ] && [ ! -L "$wrapper" ] && [ ! -d "$wrapper" ]; then
-      echo "master-sync: $wrapper exists and is not a directory; skipping" >&2
+      echo "reindex: $wrapper exists and is not a directory; skipping" >&2
       continue
     fi
     # If it's a symlink (e.g. legacy directory-symlink form from earlier
@@ -171,10 +171,10 @@ while [ "$i" -lt "${#namespaces[@]}" ]; do
         if [ "$current" = "$relative_target" ]; then
           continue
         fi
-        echo "master-sync: .claude/skills/$wrapper_name/$entry already points to '$current' (expected '$relative_target'); leaving alone" >&2
+        echo "reindex: .claude/skills/$wrapper_name/$entry already points to '$current' (expected '$relative_target'); leaving alone" >&2
         continue
       elif [ -e "$link_path" ]; then
-        echo "master-sync: $link_path already exists and is not a symlink; skipping" >&2
+        echo "reindex: $link_path already exists and is not a symlink; skipping" >&2
         continue
       fi
 
@@ -298,10 +298,10 @@ for type in knowledge policies workers settings; do
       if [ "$current" = "$relative_target" ]; then
         continue
       fi
-      echo "master-sync: core/$type/$entry already points to '$current' (expected '$relative_target'); leaving alone" >&2
+      echo "reindex: core/$type/$entry already points to '$current' (expected '$relative_target'); leaving alone" >&2
       continue
     elif [ -e "$link_path" ]; then
-      echo "master-sync: core/$type/$entry already exists and is not a symlink; skipping" >&2
+      echo "reindex: core/$type/$entry already exists and is not a symlink; skipping" >&2
       continue
     fi
 

package/scripts/replace-rescue.sh

@@ -77,7 +77,7 @@
 #   not a customization — saving it under personal/ or .hq-conflicts/ just
 #   accumulates noise.
 #
-# Symlinks generated by `master-sync.sh` (targets resolving into
+# Symlinks generated by `reindex.sh` (targets resolving into
 # `personal/`) are DELETED during the walk rather than preserved. They
 # rebuild deterministically on the next Stop-hook pass — keeping the old
 # link risks shadowing the upstream file the overlay writes at the same
@@ -245,7 +245,7 @@ BACKUP_DIR=""   # resolved at snapshot time (BACKUP_ROOT/pre-update-<RUN_TS>)
 # personal + installed-pack workers. Its content is a function of the
 # user's install state, not the upstream tree, so an overlay that
 # replaces it produces a registry that doesn't match what's on disk
-# (and `master-sync` regenerates it on the next Stop hook anyway).
+# (and `reindex` regenerates it on the next Stop hook anyway).
 # Shuttling preserves the up-to-date local version across the rescue.
 # Why .claude/settings.local.json: per-user local settings (denied paths,
 # env vars, allow-listed tool patterns) authored by the user via the CLI
@@ -436,7 +436,7 @@ if [ "${#PRESERVE_SUBPATHS[@]}" -ne 0 ]; then
     fi
   done
 fi
-echo "==> Drift policy: rescue user-edited files to personal/; route .agents|.codex|.obsidian|MIGRATION.md user-edits to .hq-conflicts/rescue-$RUN_TS/; silently overwrite AGENTS.md|USER-GUIDE.md|core/policies/_digest.md (regenerable); leave user-only files untouched; drop master-sync symlinks (regenerated by master-sync.sh)"
+echo "==> Drift policy: rescue user-edited files to personal/; route .agents|.codex|.obsidian|MIGRATION.md user-edits to .hq-conflicts/rescue-$RUN_TS/; silently overwrite AGENTS.md|USER-GUIDE.md|core/policies/_digest.md (regenerable); leave user-only files untouched; drop reindex symlinks (regenerated by reindex.sh)"
 if [ "$CLOUD_UPDATE" = "1" ]; then
   echo "==> Cloud-update mode: ON  (recognize \`hq-symlink:<target>\` flat files as upstream-symlink-equivalent — reconciled as UNCHANGED)"
 fi
@@ -459,7 +459,7 @@ if [ "$ASSUME_YES" != "1" ] && [ "$DRY_RUN" != "1" ]; then
   if [ "$CLOUD_UPDATE" = "1" ]; then
     _cloud_line="\n  * reconcile \`hq-symlink:<target>\` flat files against upstream symlinks (cloud-update mode),"
   fi
-  printf "\nThis will:\n%s\n  * rescue user-edited files (vs the last sync) into personal/,\n  * route user-edited .agents/.codex/.obsidian/MIGRATION.md into .hq-conflicts/rescue-%s/ for review,\n  * silently overwrite AGENTS.md / USER-GUIDE.md / core/policies/_digest.md (regenerable from upstream or master-sync — no copy preserved),%b\n  * drop master-sync-generated symlinks (regenerated by master-sync.sh on next Stop hook),\n  * leave user-only files (not in upstream) untouched,\n  * delete upstream files unchanged since last sync, then unpack %s@%s on top.\nType 'yes' to proceed: " "$_backup_line" "$RUN_TS" "$_cloud_line" "$SOURCE_REPO" "$REF"
+  printf "\nThis will:\n%s\n  * rescue user-edited files (vs the last sync) into personal/,\n  * route user-edited .agents/.codex/.obsidian/MIGRATION.md into .hq-conflicts/rescue-%s/ for review,\n  * silently overwrite AGENTS.md / USER-GUIDE.md / core/policies/_digest.md (regenerable from upstream or reindex — no copy preserved),%b\n  * drop reindex-generated symlinks (regenerated by reindex.sh on next Stop hook),\n  * leave user-only files (not in upstream) untouched,\n  * delete upstream files unchanged since last sync, then unpack %s@%s on top.\nType 'yes' to proceed: " "$_backup_line" "$RUN_TS" "$_cloud_line" "$SOURCE_REPO" "$REF"
   read -r confirm
   [ "$confirm" = "yes" ] || { echo "Aborted."; exit 4; }
 fi
@@ -767,7 +767,7 @@ rescue_one() {
 #
 # Routing them to .hq-conflicts/rescue-<RUN_TS>/<rel> keeps them quarantined
 # under a timestamped bucket the user can inspect and discard, without
-# polluting the personal/ overlay tree (where master-sync would then try
+# polluting the personal/ overlay tree (where reindex would then try
 # to re-mirror them into core/).
 is_conflict_class() {
   local rel="$1"
@@ -814,7 +814,7 @@ conflict_one() {
 #   core/docs/hq/USER-GUIDE.md   — current release doc; always re-shipped.
 #   core/policies/_digest.md     — generated by `core/scripts/build-policy-digest.sh`
 #                                   from the union of policy files; rebuilt on
-#                                   the next Stop-hook master-sync pass.
+#                                   the next Stop-hook reindex pass.
 #                                   Same rationale as core/workers/registry.yaml,
 #                                   minus the carve-out (digest is small + cheap
 #                                   to regenerate, so just let the overlay win).
@@ -894,11 +894,11 @@ is_cloud_flattened_symlink_equiv() {
   [ "$local_target" = "$upstream_target" ]
 }
 
-# True when $local_path is a symlink generated by master-sync.sh — those
+# True when $local_path is a symlink generated by reindex.sh — those
 # point into personal/ (e.g. `core/<type>/<entry>` -> `../../personal/...`,
 # `.claude/skills/<ns>:<entry>` -> `../../../personal/skills/<entry>/...`,
 # `.claude/commands/<ns>/<entry>.md` -> `../../../personal/skills/<entry>/SKILL.md`).
-# They are deterministically rebuilt on the next master-sync.sh run, so the
+# They are deterministically rebuilt on the next reindex.sh run, so the
 # safe move during rescue is to delete rather than preserve — a leftover
 # symlink can shadow an overlaid-from-upstream real file at the same path.
 is_master_sync_symlink() {
@@ -958,20 +958,20 @@ process_one() {
       ;;
   esac
 
-  # Symlinks (mid-tree). master-sync.sh deterministically rebuilds the
+  # Symlinks (mid-tree). reindex.sh deterministically rebuilds the
   # personal/-targeted ones on its next Stop-hook pass, so the safe move
   # here is to delete them — a leftover symlink at a path the overlay
   # also writes to creates an ambiguous "is this the symlink or the
-  # overlaid file?" state on disk. Non-master-sync symlinks (user-created,
+  # overlaid file?" state on disk. Non-reindex symlinks (user-created,
   # absolute targets, or targets outside personal/) are left alone.
   if [ -L "$local_path" ]; then
     if is_master_sync_symlink "$local_path"; then
       COUNT_SYMLINK_DROPPED=$((COUNT_SYMLINK_DROPPED + 1))
       if [ "$DRY_RUN" = "1" ]; then
-        echo "    drop master-sync symlink: $rel  ->  $(readlink "$local_path" 2>/dev/null || true)"
+        echo "    drop reindex symlink: $rel  ->  $(readlink "$local_path" 2>/dev/null || true)"
       else
         rm -f "$local_path"
-        printf 'symlink-dropped\t%s\t(master-sync regenerable)\n' "$rel" >> "$RESCUE_LOG" 2>/dev/null || true
+        printf 'symlink-dropped\t%s\t(reindex regenerable)\n' "$rel" >> "$RESCUE_LOG" 2>/dev/null || true
       fi
     fi
     return 0
@@ -1038,7 +1038,7 @@ process_one() {
 
   # Convergence guard: in history_floor mode a file is flagged USER-EDIT when
   # its blob differs from the *old* baseline (the floor). But HQ's own Stop
-  # hooks (master-sync symlinking personal/->core/, autocommit, registry/
+  # hooks (reindex symlinking personal/->core/, autocommit, registry/
   # _digest/core.yaml regeneration) rewrite scaffold files every session, so a
   # file routinely drifts from the floor yet lands byte-for-byte identical to
   # the *new* upstream HEAD this overlay is about to write. Rescuing it into
@@ -1123,16 +1123,16 @@ walk_and_process() {
   # convenience aliases the overlay overwrites cleanly (rsync -a preserves
   # link semantics from source). Master-sync personal-overlay symlinks at
   # the top level — rare but possible — are dropped here so the overlay
-  # can land a real file at the same path without ambiguity; master-sync
+  # can land a real file at the same path without ambiguity; reindex
   # regenerates the link on its next Stop-hook pass.
   if [ -L "$root_abs" ]; then
     if is_master_sync_symlink "$root_abs"; then
       COUNT_SYMLINK_DROPPED=$((COUNT_SYMLINK_DROPPED + 1))
       if [ "$DRY_RUN" = "1" ]; then
-        echo "    drop master-sync symlink: $root_rel  ->  $(readlink "$root_abs" 2>/dev/null || true)"
+        echo "    drop reindex symlink: $root_rel  ->  $(readlink "$root_abs" 2>/dev/null || true)"
       else
         rm -f "$root_abs"
-        printf 'symlink-dropped\t%s\t(master-sync regenerable)\n' "$root_rel" >> "$RESCUE_LOG" 2>/dev/null || true
+        printf 'symlink-dropped\t%s\t(reindex regenerable)\n' "$root_rel" >> "$RESCUE_LOG" 2>/dev/null || true
       fi
     fi
     return 0
@@ -1146,7 +1146,7 @@ walk_and_process() {
 
   # Top-level directory: walk recursively, pruning node_modules + nested
   # .git (v0.1.103 perf + correctness guard). Symlinks are surfaced via
-  # `-type l` so master-sync-generated links (targets resolving into
+  # `-type l` so reindex-generated links (targets resolving into
   # personal/) can be dropped — see process_one + is_master_sync_symlink.
   # Under -P (the default), find does not descend INTO directory symlinks,
   # which keeps the walk bounded even when those links exist.
@@ -1217,7 +1217,7 @@ if [ "$DRY_RUN" = "1" ]; then
   echo "  user-edit (overwrite-safe):       $COUNT_USER_OVERWRITE files"
   echo "  cloud-symlink reconciled:         $COUNT_CLOUD_SYMLINK_RECONCILED files"
   echo "  drift reconciled (== upstream):   $COUNT_DRIFT_RECONCILED files"
-  echo "  master-sync symlinks dropped:     $COUNT_SYMLINK_DROPPED entries"
+  echo "  reindex symlinks dropped:     $COUNT_SYMLINK_DROPPED entries"
   if [ "$COUNT_CLAUDE_DIFF_APPEND" -gt 0 ]; then
     echo "    of which .claude/CLAUDE.md would diff-append to personal/CLAUDE.md"
   fi
@@ -1361,7 +1361,7 @@ echo "    user-edits (conflict quarantine): $COUNT_USER_CONFLICT files"
 echo "    user-edits (overwrite-safe):      $COUNT_USER_OVERWRITE files"
 echo "    cloud-symlink reconciled:         $COUNT_CLOUD_SYMLINK_RECONCILED files"
 echo "    drift reconciled (== upstream):   $COUNT_DRIFT_RECONCILED files"
-echo "    master-sync symlinks dropped:     $COUNT_SYMLINK_DROPPED entries"
+echo "    reindex symlinks dropped:     $COUNT_SYMLINK_DROPPED entries"
 if [ "$COUNT_CLAUDE_DIFF_APPEND" -gt 0 ]; then
   echo "      of which .claude/CLAUDE.md diff-appended to personal/CLAUDE.md"
 fi
@@ -1396,7 +1396,7 @@ if [ "$DO_BACKUP" = "1" ] && [ -n "$BACKUP_DIR" ] && [ -d "$BACKUP_DIR" ]; then
     echo "  user-edit  (overwrite-safe):             $COUNT_USER_OVERWRITE"
     echo "  cloud-symlink reconciled:                $COUNT_CLOUD_SYMLINK_RECONCILED"
     echo "  drift reconciled (== upstream HEAD):     $COUNT_DRIFT_RECONCILED"
-    echo "  master-sync symlinks dropped:            $COUNT_SYMLINK_DROPPED"
+    echo "  reindex symlinks dropped:            $COUNT_SYMLINK_DROPPED"
     if [ "$COUNT_USER_CONFLICT" -gt 0 ]; then
       echo "  conflict bucket: .hq-conflicts/rescue-$RUN_TS/"
     fi

package/src/cli/index.ts

@@ -25,9 +25,9 @@ export { promote } from "./promote.js";
 export type { PromoteOptions, PromoteResult } from "./promote.js";
 
 // Skill/personal-overlay mirroring + workers-registry regen (formerly the
-// hq-core master-sync.sh hook).
-export { masterSync, masterSyncScriptPath } from "./master-sync.js";
-export type { MasterSyncOptions, MasterSyncResult } from "./master-sync.js";
+// hq-core master-sync.sh hook; `hq reindex`).
+export { reindex, reindexScriptPath } from "./reindex.js";
+export type { ReindexOptions, ReindexResult } from "./reindex.js";
 
 // Drift-preserving HQ-core re-sync (formerly bundled only inside the HQ Sync
 // menubar app). Now shared between the app and `hq rescue`.

package/src/cli/{master-sync.test.ts → reindex.test.ts}

@@ -1,9 +1,9 @@
 /**
- * Unit tests for `hq master-sync` (the formerly-bash hq-core hook, now shipped
+ * Unit tests for `hq reindex` (the formerly-bash hq-core hook, now shipped
  * in this package and invoked via the CLI).
  *
- * The logic itself lives in scripts/master-sync.sh; these tests exercise it via
- * the masterSync() wrapper against a temp HQ tree, asserting the observable
+ * The logic itself lives in scripts/reindex.sh; these tests exercise it via
+ * the reindex() wrapper against a temp HQ tree, asserting the observable
  * filesystem outcomes (skill wrappers, personal-overlay mirroring) rather than
  * re-deriving the bash internals.
  */
@@ -12,17 +12,17 @@ import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
-import { masterSync, masterSyncScriptPath } from "./master-sync.js";
+import { reindex, reindexScriptPath } from "./reindex.js";
 
-describe("masterSyncScriptPath", () => {
+describe("reindexScriptPath", () => {
   it("resolves to the bundled script and the file exists", () => {
-    const p = masterSyncScriptPath();
-    expect(p.endsWith(path.join("scripts", "master-sync.sh"))).toBe(true);
+    const p = reindexScriptPath();
+    expect(p.endsWith(path.join("scripts", "reindex.sh"))).toBe(true);
     expect(fs.existsSync(p)).toBe(true);
   });
 });
 
-describe("masterSync", () => {
+describe("reindex", () => {
   let root: string;
 
   beforeEach(() => {
@@ -44,7 +44,7 @@ describe("masterSync", () => {
     fs.writeFileSync(path.join(root, "core/skills/demo/helper.md"), "h\n");
     writeSkill("companies/acme/skills/widget");
 
-    const { status } = masterSync({ repoRoot: root });
+    const { status } = reindex({ repoRoot: root });
     expect(status).toBe(0);
 
     const coreWrapper = path.join(root, ".claude/skills/core:demo");
@@ -65,7 +65,7 @@ describe("masterSync", () => {
     fs.mkdirSync(path.join(root, "personal/policies"), { recursive: true });
     fs.writeFileSync(path.join(root, "personal/policies/myrule.md"), "rule\n");
 
-    const { status } = masterSync({ repoRoot: root });
+    const { status } = reindex({ repoRoot: root });
     expect(status).toBe(0);
 
     const link = path.join(root, "core/policies/myrule.md");
@@ -75,18 +75,18 @@ describe("masterSync", () => {
 
   it("prunes orphan managed wrappers when the source skill disappears", () => {
     writeSkill("core/skills/demo");
-    masterSync({ repoRoot: root });
+    reindex({ repoRoot: root });
     expect(fs.existsSync(path.join(root, ".claude/skills/core:demo"))).toBe(true);
 
     fs.rmSync(path.join(root, "core/skills/demo"), { recursive: true, force: true });
-    masterSync({ repoRoot: root });
+    reindex({ repoRoot: root });
     expect(fs.existsSync(path.join(root, ".claude/skills/core:demo"))).toBe(false);
   });
 
   it("is idempotent — a second run is a no-op", () => {
     writeSkill("core/skills/demo");
-    expect(masterSync({ repoRoot: root }).status).toBe(0);
-    expect(masterSync({ repoRoot: root }).status).toBe(0);
+    expect(reindex({ repoRoot: root }).status).toBe(0);
+    expect(reindex({ repoRoot: root }).status).toBe(0);
     expect(
       fs.readlinkSync(path.join(root, ".claude/skills/core:demo/SKILL.md")),
     ).toBe("../../../core/skills/demo/SKILL.md");

package/src/cli/reindex.ts

@@ -0,0 +1,57 @@
+/**
+ * hq reindex — surfaces namespaced skills as Claude Code skill wrappers,
+ * mirrors personal/{knowledge,policies,workers,settings} into core/, prunes
+ * orphan wrappers, and regenerates the workers registry.
+ *
+ * The implementation lives in scripts/reindex.sh, shipped with this package.
+ * This module resolves that script relative to the package (dist/cli → package
+ * root) and execs it against the caller's HQ root. Historically the script ran
+ * directly as a Claude Code hook inside hq-core (named "master-sync"); it now
+ * lives here so a single copy is maintained, and the hq-core hook is a thin
+ * shim over `hq reindex`.
+ */
+import { spawnSync } from "child_process";
+import { fileURLToPath } from "url";
+import path from "path";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+/**
+ * Absolute path to the bundled reindex.sh. From the compiled module at
+ * dist/cli/reindex.js, the package root is two levels up; the script lives
+ * at <package-root>/scripts/reindex.sh.
+ */
+export function reindexScriptPath(): string {
+  return path.resolve(__dirname, "..", "..", "scripts", "reindex.sh");
+}
+
+export interface ReindexOptions {
+  /** HQ root to operate on. Defaults to process.cwd(). */
+  repoRoot?: string;
+}
+
+export interface ReindexResult {
+  /** Exit status of the underlying script (0 = success). */
+  status: number;
+}
+
+/**
+ * Run reindex against an HQ root. Synchronous — the script is cheap and
+ * idempotent, and callers (the hook shim, sync/rescue, tests) want the exit
+ * status. stdout/stderr from the script are forwarded to stderr so the
+ * caller's stdout stays clean (hooks must not emit stdout that the agent
+ * interprets).
+ */
+export function reindex(opts: ReindexOptions = {}): ReindexResult {
+  const repoRoot = opts.repoRoot ?? process.cwd();
+  const script = reindexScriptPath();
+  const res = spawnSync("bash", [script, repoRoot], {
+    stdio: ["ignore", "inherit", "inherit"],
+  });
+  if (res.error) {
+    process.stderr.write(`reindex: failed to run ${script}: ${res.error.message}\n`);
+    return { status: 1 };
+  }
+  return { status: res.status ?? 1 };
+}

package/src/cli/rescue.reindex.test.ts

@@ -0,0 +1,46 @@
+/**
+ * Wiring tests: `rescue()` runs `reindex()` after a successful, non-dry-run
+ * rescue so the generated skill wrappers / personal mirrors / workers registry
+ * are refreshed once core/ has been re-laid-down.
+ *
+ * child_process is mocked so the real replace-rescue.sh never runs, and
+ * ./reindex.js is mocked to a spy so we assert the call without spawning.
+ */
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("child_process", () => ({
+  spawnSync: vi.fn(() => ({ status: 0 })),
+}));
+vi.mock("./reindex.js", () => ({
+  reindex: vi.fn(() => ({ status: 0 })),
+}));
+
+import { spawnSync } from "child_process";
+import { reindex } from "./reindex.js";
+import { rescue } from "./rescue.js";
+
+describe("rescue → reindex", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    (spawnSync as unknown as ReturnType<typeof vi.fn>).mockReturnValue({ status: 0 });
+  });
+
+  it("refreshes via reindex after a successful rescue", () => {
+    const r = rescue({ hqRoot: "/tmp/hq", assumeYes: true });
+    expect(r.status).toBe(0);
+    expect(reindex).toHaveBeenCalledTimes(1);
+    expect(reindex).toHaveBeenCalledWith({ repoRoot: "/tmp/hq" });
+  });
+
+  it("does NOT run reindex on a dry-run", () => {
+    rescue({ hqRoot: "/tmp/hq", dryRun: true });
+    expect(reindex).not.toHaveBeenCalled();
+  });
+
+  it("does NOT run reindex when the rescue script fails", () => {
+    (spawnSync as unknown as ReturnType<typeof vi.fn>).mockReturnValueOnce({ status: 1 });
+    const r = rescue({ hqRoot: "/tmp/hq", assumeYes: true });
+    expect(r.status).toBe(1);
+    expect(reindex).not.toHaveBeenCalled();
+  });
+});

package/src/cli/rescue.ts

@@ -17,6 +17,7 @@
 import { spawnSync } from "child_process";
 import { fileURLToPath } from "url";
 import path from "path";
+import { reindex } from "./reindex.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -118,5 +119,18 @@ export function rescue(opts: RescueOptions = {}): RescueResult {
     process.stderr.write(`rescue: failed to run ${script}: ${res.error.message}\n`);
     return { status: 1 };
   }
-  return { status: res.status ?? 1 };
+  const status = res.status ?? 1;
+  // A successful, non-dry-run rescue re-lays-down core/, so refresh the
+  // generated skill wrappers, personal-overlay mirrors, and workers registry.
+  // Best-effort + idempotent — never overrides the rescue's own exit status.
+  // repoRoot falls back to process.cwd() (reindex's default) when hqRoot is
+  // omitted, matching the rescue script's own cwd-based default.
+  if (status === 0 && !opts.dryRun) {
+    try {
+      reindex({ repoRoot: opts.hqRoot });
+    } catch {
+      // best-effort
+    }
+  }
+  return { status };
 }

package/src/cli/share.test.ts

@@ -2290,7 +2290,7 @@ describe("share", () => {
     // target's bytes under the link's key while a nested symlink was
     // silently dropped from every push. The link topology never survived a
     // round trip — fresh-machine pulls landed in a state where overlay
-    // symlinks just didn't exist until master-sync.sh recreated them
+    // symlinks just didn't exist until reindex.sh recreated them
     // locally. The fix detects symlinks via lstat / Dirent.isSymbolicLink
     // and routes them to a new uploadSymlink primitive that PUTs a
     // zero-byte object with x-amz-meta-hq-symlink-target carrying the
@@ -2334,7 +2334,7 @@ describe("share", () => {
       const realPolicy = path.join(policiesDir, "real.md");
       fs.writeFileSync(realPolicy, "real content");
       const linkPolicy = path.join(policiesDir, "link.md");
-      // Mirrors the master-sync.sh overlay shape: relative target pointing
+      // Mirrors the reindex.sh overlay shape: relative target pointing
       // to a sibling in the same dir.
       fs.symlinkSync("real.md", linkPolicy);
 

package/src/cli/sync.test.ts

@@ -36,8 +36,15 @@ vi.mock("../s3.js", async () => {
   };
 });
 
+// Mock the post-sync refresh so tests neither spawn the real reindex.sh nor
+// mutate the temp hqRoot, and we can assert the wiring directly.
+vi.mock("./reindex.js", () => ({
+  reindex: vi.fn(() => ({ status: 0 })),
+}));
+
 import { sync } from "./sync.js";
 import * as s3Module from "../s3.js";
+import { reindex } from "./reindex.js";
 
 const mockConfig: VaultServiceConfig = {
   apiUrl: "https://vault-api.test",
@@ -114,6 +121,22 @@ describe("sync", () => {
     delete process.env.HQ_STATE_DIR;
   });
 
+  it("runs reindex against hqRoot after a sync that downloaded files", async () => {
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+    expect(reindex).toHaveBeenCalledWith({ repoRoot: tmpDir });
+  });
+
+  it("skips reindex when skipReindex is set", async () => {
+    const result = await sync({
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      skipReindex: true,
+    });
+    expect(result.filesDownloaded).toBe(2);
+    expect(reindex).not.toHaveBeenCalled();
+  });
+
   it("downloads remote files under companies/{slug}/ so two companies don't collide", async () => {
     const result = await sync({
       company: "acme",

package/src/cli/sync.ts

@@ -49,6 +49,7 @@ import {
   readShortMachineId,
 } from "../lib/conflict-file.js";
 import { appendConflictEntry } from "../lib/conflict-index.js";
+import { reindex } from "./reindex.js";
 
 /**
  * Per-file events emitted by `sync()` as it progresses.
@@ -329,6 +330,15 @@ export interface SyncOptions {
    * tombstoned. Mirrors `hq sync narrow --force`.
    */
   forceScopeShrink?: boolean;
+  /**
+   * Skip the post-sync `reindex()` refresh (skill wrappers + personal overlay
+   * mirrors + workers registry). By default, when a sync changes on-disk
+   * sources (downloads, tombstones, or scope-orphan removals), `sync()`
+   * re-runs reindex so the generated `.claude/skills/<ns>:<skill>` wrappers
+   * stay in sync. An orchestrator syncing many companies in one pass can set
+   * this and run `reindex()` once itself instead of per-company.
+   */
+  skipReindex?: boolean;
 }
 
 export interface SyncResult {
@@ -1263,6 +1273,23 @@ export async function sync(options: SyncOptions): Promise<SyncResult> {
   journal.lastSync = new Date().toISOString();
   writeJournal(journalSlug, journal);
 
+  // When the pull actually changed on-disk sources (new files, tombstoned
+  // removals, or scope-orphan cleanups), refresh the generated skill wrappers,
+  // personal-overlay mirrors, and workers registry. reindex is idempotent and
+  // best-effort — it must never fail a sync, and is skipped on no-op syncs
+  // (the common daemon case) and when the caller opts out via skipReindex.
+  const changedOnDisk =
+    filesDownloaded > 0 ||
+    filesTombstoned > 0 ||
+    shrinkResult.cleanRemoved > 0;
+  if (!options.skipReindex && changedOnDisk) {
+    try {
+      reindex({ repoRoot: hqRoot });
+    } catch {
+      // best-effort: a post-sync refresh failure never fails the sync
+    }
+  }
+
   return {
     filesDownloaded,
     bytesDownloaded,

package/src/index.ts

@@ -212,9 +212,9 @@ export type { AcceptOptions, AcceptResult } from "./cli/index.js";
 export { promote } from "./cli/index.js";
 export type { PromoteOptions, PromoteResult } from "./cli/index.js";
 
-// Skill/personal-overlay mirroring + workers-registry regen (`hq master-sync`).
-export { masterSync, masterSyncScriptPath } from "./cli/index.js";
-export type { MasterSyncOptions, MasterSyncResult } from "./cli/index.js";
+// Skill/personal-overlay mirroring + workers-registry regen (`hq reindex`).
+export { reindex, reindexScriptPath } from "./cli/index.js";
+export type { ReindexOptions, ReindexResult } from "./cli/index.js";
 
 // Drift-preserving HQ-core re-sync — shared by the HQ Sync app and `hq rescue`.
 export { rescue, rescueScriptPath, buildRescueArgs } from "./cli/index.js";

package/dist/cli/master-sync.d.ts

@@ -1,22 +0,0 @@
-/**
- * Absolute path to the bundled master-sync.sh. From the compiled module at
- * dist/cli/master-sync.js, the package root is two levels up; the script lives
- * at <package-root>/scripts/master-sync.sh.
- */
-export declare function masterSyncScriptPath(): string;
-export interface MasterSyncOptions {
-    /** HQ root to operate on. Defaults to process.cwd(). */
-    repoRoot?: string;
-}
-export interface MasterSyncResult {
-    /** Exit status of the underlying script (0 = success). */
-    status: number;
-}
-/**
- * Run master-sync against an HQ root. Synchronous — the script is cheap and
- * idempotent, and callers (the hook shim, tests) want the exit status.
- * stdout/stderr from the script are forwarded to stderr so the caller's stdout
- * stays clean (hooks must not emit stdout that the agent interprets).
- */
-export declare function masterSync(opts?: MasterSyncOptions): MasterSyncResult;
-//# sourceMappingURL=master-sync.d.ts.map

package/dist/cli/master-sync.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"master-sync.d.ts","sourceRoot":"","sources":["../../src/cli/master-sync.ts"],"names":[],"mappings":"AAmBA;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,iBAAsB,GAAG,gBAAgB,CAWzE"}

package/dist/cli/master-sync.js

@@ -1,44 +0,0 @@
-/**
- * hq master-sync — surfaces namespaced skills as Claude Code skill wrappers,
- * mirrors personal/{knowledge,policies,workers,settings} into core/, prunes
- * orphan wrappers, and regenerates the workers registry.
- *
- * The implementation lives in scripts/master-sync.sh, shipped with this
- * package. This module resolves that script relative to the package (dist/cli
- * → package root) and execs it against the caller's HQ root. Historically the
- * script ran directly as a Claude Code hook inside hq-core; it now lives here
- * so a single copy is maintained, and the hq-core hook is a thin shim over
- * `hq master-sync`.
- */
-import { spawnSync } from "child_process";
-import { fileURLToPath } from "url";
-import path from "path";
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-/**
- * Absolute path to the bundled master-sync.sh. From the compiled module at
- * dist/cli/master-sync.js, the package root is two levels up; the script lives
- * at <package-root>/scripts/master-sync.sh.
- */
-export function masterSyncScriptPath() {
-    return path.resolve(__dirname, "..", "..", "scripts", "master-sync.sh");
-}
-/**
- * Run master-sync against an HQ root. Synchronous — the script is cheap and
- * idempotent, and callers (the hook shim, tests) want the exit status.
- * stdout/stderr from the script are forwarded to stderr so the caller's stdout
- * stays clean (hooks must not emit stdout that the agent interprets).
- */
-export function masterSync(opts = {}) {
-    const repoRoot = opts.repoRoot ?? process.cwd();
-    const script = masterSyncScriptPath();
-    const res = spawnSync("bash", [script, repoRoot], {
-        stdio: ["ignore", "inherit", "inherit"],
-    });
-    if (res.error) {
-        process.stderr.write(`master-sync: failed to run ${script}: ${res.error.message}\n`);
-        return { status: 1 };
-    }
-    return { status: res.status ?? 1 };
-}
-//# sourceMappingURL=master-sync.js.map

package/dist/cli/master-sync.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"master-sync.js","sourceRoot":"","sources":["../../src/cli/master-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;AAC1E,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B,EAAE;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;QAChD,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACrF,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;AACrC,CAAC"}