@indigoai-us/hq-cloud 6.12.1 → 6.12.3

package/src/cli/reindex.test.ts

@@ -24,6 +24,11 @@ const hoisted = vi.hoisted(() => ({
   // lets a test simulate a mkdir failure at a NON-wrapper site (e.g. the
   // `.claude/skills` parent or a `core/<type>` mirror dir).
   failMkdirContaining: "" as string,
+  // HQ-CLI-4: when set, any symlink whose LINK path contains this substring
+  // throws EPERM — simulates Windows WITHOUT Developer Mode, where symlink
+  // creation is a privileged operation. Off by default so other tests see the
+  // real `symlinkSync`.
+  failSymlinkContaining: "" as string,
 }));
 vi.mock("fs", async (importOriginal) => {
   const actual = await importOriginal<typeof import("fs")>();
@@ -40,7 +45,24 @@ vi.mock("fs", async (importOriginal) => {
     }
     return (actual.mkdirSync as (p: unknown, opts: unknown) => unknown)(p, opts);
   }) as typeof actual.mkdirSync;
-  const patched = { ...actual, mkdirSync };
+  const symlinkSync = ((target: unknown, linkPath: unknown, type?: unknown) => {
+    if (
+      hoisted.failSymlinkContaining !== "" &&
+      typeof linkPath === "string" &&
+      linkPath.includes(hoisted.failSymlinkContaining)
+    ) {
+      throw Object.assign(
+        new Error(`EPERM: operation not permitted, symlink '${target}' -> '${linkPath}'`),
+        { code: "EPERM" },
+      );
+    }
+    return (actual.symlinkSync as (t: unknown, l: unknown, ty?: unknown) => unknown)(
+      target,
+      linkPath,
+      type,
+    );
+  }) as typeof actual.symlinkSync;
+  const patched = { ...actual, mkdirSync, symlinkSync };
   return { ...patched, default: patched };
 });
 
@@ -307,4 +329,49 @@ describe("reindex", () => {
     // The mirror for the failed type is skipped; skill surfacing still happened.
     expect(fs.existsSync(path.join(root, ".claude/skills/core:demo"))).toBe(true);
   });
+
+  // ── HQ-CLI-4: symlink creation is privileged on Windows. Without Developer
+  //    Mode, fs.symlinkSync throws EPERM. The HQ-B0 work guarded every mkdir
+  //    site but left the symlink sites unguarded, so `hq reindex` still aborted
+  //    on Windows. safeSymlink must degrade gracefully like safeMkdir.
+  it("does not abort reindex when a skill-wrapper symlink fails with EPERM (Windows no Developer Mode)", () => {
+    writeSkill("core/skills/demo");
+
+    hoisted.failSymlinkContaining = path.join(".claude", "skills");
+    try {
+      // Every per-file wrapper symlink throws EPERM, but reindex must still
+      // complete cleanly (exit 0) rather than crash + flood Sentry.
+      expect(reindex({ repoRoot: root }).status).toBe(0);
+    } finally {
+      hoisted.failSymlinkContaining = "";
+    }
+
+    // The wrapper DIR was still created; the symlink inside was just skipped.
+    expect(fs.existsSync(path.join(root, ".claude/skills/core:demo"))).toBe(true);
+    expect(
+      fs.existsSync(path.join(root, ".claude/skills/core:demo/SKILL.md")),
+    ).toBe(false);
+  });
+
+  it("does not abort reindex when a personal-mirror symlink fails with EPERM, and other work still runs", () => {
+    writeSkill("core/skills/demo");
+    fs.mkdirSync(path.join(root, "personal/knowledge/my-kb"), { recursive: true });
+    fs.writeFileSync(path.join(root, "personal/knowledge/my-kb/note.md"), "n\n");
+
+    // Fail ONLY the core/<type> personal-mirror symlinks; wrapper symlinks
+    // succeed, proving the skip is scoped and the reindex completes.
+    hoisted.failSymlinkContaining = path.join("core", "knowledge");
+    try {
+      expect(reindex({ repoRoot: root }).status).toBe(0);
+    } finally {
+      hoisted.failSymlinkContaining = "";
+    }
+
+    // The personal mirror was skipped (EPERM)...
+    expect(fs.existsSync(path.join(root, "core/knowledge/my-kb"))).toBe(false);
+    // ...but unaffected work still happened: the skill wrapper + its symlink.
+    expect(
+      fs.lstatSync(path.join(root, ".claude/skills/core:demo/SKILL.md")).isSymbolicLink(),
+    ).toBe(true);
+  });
 });

package/src/cli/reindex.ts

@@ -154,6 +154,31 @@ function safeMkdir(dir: string, label: string): boolean {
   }
 }
 
+// Create a symlink, tolerating platform-specific failures instead of aborting
+// the whole reindex — the symlink sibling of safeMkdir. The classic case
+// (HQ-CLI-4) is Windows WITHOUT Developer Mode (or an elevated shell), where
+// symlink creation is a privileged operation and `fs.symlinkSync` throws EPERM
+// (Win32 ERROR_PRIVILEGE_NOT_HELD). A single symlink we can't create should
+// degrade gracefully — warn with an actionable hint and skip just that link so
+// the rest of the reindex (other wrappers, mirrors, registry regen) still runs.
+// reindex is idempotent and re-run on hooks, so a later run re-creates the link
+// once the privilege is granted. Returns true on success, false on skip.
+function safeSymlink(target: string, linkPath: string, label: string): boolean {
+  try {
+    fs.symlinkSync(target, linkPath);
+    return true;
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    warn(
+      `reindex: could not create ${label} '${linkPath}' -> '${target}' ` +
+        `(${code ?? "error"}: ${(err as Error).message}); skipping. On Windows, ` +
+        `creating symlinks needs Developer Mode (Settings -> Privacy & security ` +
+        `-> For developers) or an elevated shell.`,
+    );
+    return false;
+  }
+}
+
 // --- legacy `.claude/commands/<ns>/<skill>.md` symlink matcher --------------
 // Mirrors the bash `case` patterns; `*` matches any chars (including `/`).
 function isLegacyCommandTarget(t: string): boolean {
@@ -325,7 +350,7 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
           continue;
         }
 
-        fs.symlinkSync(relativeTarget, linkPath);
+        safeSymlink(relativeTarget, linkPath, `.claude/skills/${wrapperName}/${entry}`);
       }
 
       // Prune symlinks in the wrapper whose source entry no longer exists.
@@ -424,7 +449,7 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
         continue;
       }
 
-      fs.symlinkSync(relativeTarget, linkPath);
+      safeSymlink(relativeTarget, linkPath, `core/${type}/${entry}`);
     }
   }
 

package/src/cli/share.test.ts

@@ -71,6 +71,39 @@ function makeEntityContext(overrides: Partial<EntityContext> = {}): EntityContex
   };
 }
 
+describe("wrapFilterWithIgnoreVisibility", () => {
+  it("records noteworthy base-ignore exclusions while counting all rejections", () => {
+    const hqRoot = path.join("/tmp", "hqroot");
+    const noteworthy: string[] = [];
+    let total = 0;
+    const underlying = (absPath: string): boolean =>
+      !absPath.includes(`${path.sep}repos${path.sep}`) &&
+      !absPath.includes(`${path.sep}node_modules${path.sep}`);
+    const wrapped = shareTesting.wrapFilterWithIgnoreVisibility(
+      underlying,
+      hqRoot,
+      (rel) => {
+        noteworthy.push(rel);
+      },
+      () => {
+        total++;
+      },
+    );
+
+    expect(wrapped(path.join(hqRoot, "companies/indigo/knowledge/notes.md"))).toBe(true);
+    expect(total).toBe(0);
+    expect(noteworthy).toEqual([]);
+
+    expect(wrapped(path.join(hqRoot, "companies/indigo/knowledge/repos/foo.md"))).toBe(false);
+    expect(total).toBe(1);
+    expect(noteworthy).toEqual(["companies/indigo/knowledge/repos/foo.md"]);
+
+    expect(wrapped(path.join(hqRoot, "node_modules/x"))).toBe(false);
+    expect(total).toBe(2);
+    expect(noteworthy).toEqual(["companies/indigo/knowledge/repos/foo.md"]);
+  });
+});
+
 const mockEntity = {
   uid: "cmp_01ABCDEF",
   slug: "acme",
@@ -993,6 +1026,92 @@ describe("share", () => {
     expect(putKeys).not.toContain("projects/.gitkeep");
   });
 
+  it("push surfaces an OVER-BROAD ignore exclusion via ignore-excluded instead of dropping it silently (feedback_b9dfc7ae)", async () => {
+    // Regression for the silent-drop failure mode behind DEV-1791: an
+    // over-broad ignore rule (here a deliberately un-anchored `repos/` in
+    // .hqignore) eats /discover knowledge under companies/*/knowledge/repos/.
+    // The discriminator fix stops the over-broad MATCH; this test pins the
+    // OBSERVABILITY: when an ignore rule IS over-broad, the dropped content
+    // is surfaced as a noteworthy `ignore-excluded` event (count + sample)
+    // rather than vanishing. Build noise stays unsurfaced.
+    fs.writeFileSync(path.join(tmpDir, ".hqignore"), "repos/\n");
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(path.join(companyRoot, "knowledge", "repos", "dev-docs"), { recursive: true });
+    fs.mkdirSync(path.join(companyRoot, "node_modules", "left-pad"), { recursive: true });
+    fs.writeFileSync(path.join(companyRoot, "knowledge", "overview.md"), "# kb\n");
+    fs.writeFileSync(path.join(companyRoot, "knowledge", "repos", "dev-docs", "notes.md"), "discover knowledge\n");
+    fs.writeFileSync(path.join(companyRoot, "node_modules", "left-pad", "index.js"), "module.exports = 1\n");
+
+    vi.mocked(headRemoteFile).mockResolvedValue(null);
+
+    const events: Array<{ type?: string; path?: string; count?: number; totalExcluded?: number; samplePaths?: string[] }> = [];
+    const result = await share({
+      paths: [companyRoot],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      onEvent: (e) => events.push(e as { type?: string }),
+    });
+
+    // The legitimate knowledge file uploads; the over-broadly-excluded
+    // knowledge under knowledge/repos/ does NOT.
+    const uploadedPaths = events
+      .filter((e) => e.type === "progress")
+      .map((e) => e.path)
+      .sort();
+    expect(uploadedPaths).toEqual(["knowledge/overview.md"]);
+
+    // The drop is now VISIBLE: one noteworthy path surfaced, with the
+    // knowledge/repos/ file named; node_modules counted but NOT noteworthy.
+    expect(result.filesExcludedByIgnore).toBe(1);
+    const ignoreEv = events.find((e) => e.type === "ignore-excluded") as
+      | { count: number; totalExcluded: number; samplePaths: string[] }
+      | undefined;
+    expect(ignoreEv).toBeDefined();
+    expect(ignoreEv!.count).toBe(1);
+    expect(ignoreEv!.samplePaths).toEqual(["companies/acme/knowledge/repos"]);
+    expect(ignoreEv!.totalExcluded).toBeGreaterThanOrEqual(2); // repos/ dir + node_modules/ dir
+    expect(ignoreEv!.samplePaths).not.toContain("companies/acme/node_modules");
+    // No upload for the dropped subtree, no error, clean completion.
+    const putKeys = vi.mocked(uploadFile).mock.calls.map((c) => c[2]);
+    expect(putKeys).toEqual(["knowledge/overview.md"]);
+    expect(result.aborted).toBe(false);
+    expect(events.some((e) => e.type === "error")).toBe(false);
+  });
+
+  it("default console logger prints a WARN naming the silently-excluded path (no onEvent)", async () => {
+    // The user-facing CLI surface: with no onEvent, share() falls back to the
+    // default console logger. An over-broad ignore drop must produce a visible
+    // WARN line naming the path — the whole point of "not silent". Spy on
+    // console.warn rather than passing onEvent (which would suppress it).
+    fs.writeFileSync(path.join(tmpDir, ".hqignore"), "repos/\n");
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(path.join(companyRoot, "knowledge", "repos", "dev-docs"), { recursive: true });
+    fs.writeFileSync(path.join(companyRoot, "knowledge", "overview.md"), "# kb\n");
+    fs.writeFileSync(path.join(companyRoot, "knowledge", "repos", "dev-docs", "notes.md"), "discover knowledge\n");
+
+    vi.mocked(headRemoteFile).mockResolvedValue(null);
+    // Direct monkeypatch rather than vi.spyOn — vitest's console interception
+    // can shadow a spy on console.warn, and we want to assert the REAL writes.
+    const warnings: string[] = [];
+    const originalWarn = console.warn;
+    console.warn = (...args: unknown[]) => { warnings.push(args.map(String).join(" ")); };
+    try {
+      await share({
+        paths: [companyRoot],
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        // no onEvent → defaultConsoleLogger
+      });
+    } finally {
+      console.warn = originalWarn;
+    }
+
+    expect(warnings.some((w) => w.includes("EXCLUDED from sync"))).toBe(true);
+    expect(warnings.some((w) => w.includes("companies/acme/knowledge/repos"))).toBe(true);
+  });
+
   it("scoped push defense-in-depth: a 403 on HEAD skips that key as scope-excluded without an error event", async () => {
     // Belt-and-suspenders: even if a key slips past the prefix filter (a grant
     // that changed mid-run, a pin outside the grant, prefix-coalesce
@@ -1374,6 +1493,7 @@ describe("share", () => {
           e.type === "new-files" ||
           e.type === "personal-vault-out-of-policy" ||
           e.type === "scope-excluded" ||
+          e.type === "ignore-excluded" ||
           e.type === "delete-refused-bulk-asymmetry"
         ) return;
         events.push({

package/src/cli/share.ts

@@ -35,7 +35,7 @@ import {
   PERSONAL_VAULT_JOURNAL_SLUG,
   migratePersonalVaultJournal,
 } from "../journal.js";
-import { createIgnoreFilter, isWithinSizeLimit } from "../ignore.js";
+import { createIgnoreFilter, isExpectedIgnore, isWithinSizeLimit } from "../ignore.js";
 import {
   wrapFilterWithPersonalVaultDefaults,
   type PersonalVaultExclusion,
@@ -261,6 +261,7 @@ export function isMalformedVaultKey(key: string): boolean {
 export const _testing = {
   isEphemeralPath,
   EPHEMERAL_PATH_PATTERN,
+  wrapFilterWithIgnoreVisibility,
 };
 
 /**
@@ -734,6 +735,13 @@ export interface ShareResult {
    * its in-scope subset.
    */
   filesExcludedByScope: number;
+  /**
+   * Number of distinct hq-root-relative paths skipped by the base ignore
+   * filter that look like real content rather than expected build/VCS/cache
+   * noise. Mirrors the `count` field of the `ignore-excluded` event (emitted
+   * once if this is > 0).
+   */
+  filesExcludedByIgnore: number;
   /**
    * Paths (company-relative) that were detected as push conflicts. Mirrors
    * `SyncResult.conflictPaths` so push and pull surface conflicts the same
@@ -792,6 +800,31 @@ function wrapFilterWithScope(
   };
 }
 
+/**
+ * Wrap the base ignore filter so push can observe paths it rejects before
+ * personal-vault policy or ACL scope wrappers add their own exclusions.
+ * Every base-ignore rejection increments `onAnyExcluded`; only rejections
+ * that do NOT match expected build/VCS/cache noise are tagged through
+ * `onIgnoreExcluded` for the one-shot `ignore-excluded` summary.
+ */
+export function wrapFilterWithIgnoreVisibility(
+  underlying: (absPath: string, isDir?: boolean) => boolean,
+  hqRoot: string,
+  onIgnoreExcluded: (relPath: string) => void,
+  onAnyExcluded?: () => void,
+): (absPath: string, isDir?: boolean) => boolean {
+  return (absPath: string, isDir?: boolean) => {
+    const allowed = underlying(absPath, isDir);
+    if (allowed) return true;
+
+    onAnyExcluded?.();
+    const rel = path.relative(hqRoot, absPath).split(path.sep).join("/");
+    if (rel === "" || rel.startsWith("..")) return false;
+    if (!isExpectedIgnore(rel)) onIgnoreExcluded(rel);
+    return false;
+  };
+}
+
 /**
  * Share local file(s) to the entity vault.
  */
@@ -857,6 +890,8 @@ interface PushRunContext {
   excludedSet: Set<string>;
   excludedById: Record<string, number>;
   scopeExcludedSet: Set<string>;
+  ignoreExcludedSet: Set<string>;
+  ignoreExcludedTotal: { value: number };
 }
 
 interface ShareCounters {
@@ -939,6 +974,18 @@ async function createPushRunContext(options: ShareOptions): Promise<PushRunConte
     : path.join(hqRoot, "companies", ctx.slug);
 
   const ignoreFilter = createIgnoreFilter(hqRoot);
+  const ignoreExcludedSet = new Set<string>();
+  const ignoreExcludedTotal = { value: 0 };
+  const recordedIgnoreFilter = wrapFilterWithIgnoreVisibility(
+    ignoreFilter,
+    hqRoot,
+    (rel) => {
+      ignoreExcludedSet.add(rel);
+    },
+    () => {
+      ignoreExcludedTotal.value++;
+    },
+  );
   const excludedSet = new Set<string>();
   const excludedById: Record<string, number> = {};
   const onExcluded = (rel: string, match: PersonalVaultExclusion) => {
@@ -951,8 +998,8 @@ async function createPushRunContext(options: ShareOptions): Promise<PushRunConte
     scopeExcludedSet.add(rel);
   };
   const baseFilter = options.personalMode === true
-    ? wrapFilterWithPersonalVaultDefaults(ignoreFilter, syncRoot, onExcluded)
-    : ignoreFilter;
+    ? wrapFilterWithPersonalVaultDefaults(recordedIgnoreFilter, syncRoot, onExcluded)
+    : recordedIgnoreFilter;
   const shouldSync = options.prefixSet !== undefined
     ? wrapFilterWithScope(baseFilter, syncRoot, options.prefixSet, onScopeExcluded)
     : baseFilter;
@@ -981,6 +1028,8 @@ async function createPushRunContext(options: ShareOptions): Promise<PushRunConte
     excludedSet,
     excludedById,
     scopeExcludedSet,
+    ignoreExcludedSet,
+    ignoreExcludedTotal,
   };
 }
 
@@ -1494,6 +1543,20 @@ function finalizeShareJournal(run: PushRunContext): void {
       samplePaths,
     });
   }
+
+  if (run.ignoreExcludedSet.size > 0) {
+    const samplePaths: string[] = [];
+    for (const p of run.ignoreExcludedSet) {
+      samplePaths.push(p);
+      if (samplePaths.length >= 10) break;
+    }
+    run.emit({
+      type: "ignore-excluded",
+      count: run.ignoreExcludedSet.size,
+      totalExcluded: run.ignoreExcludedTotal.value,
+      samplePaths,
+    });
+  }
 }
 
 function throwUploadWorkerErrors(workerErrors: Error[]): void {
@@ -1528,6 +1591,7 @@ function buildShareResult(
     filesSuppressedByTombstone: counters.filesSuppressedByTombstone,
     filesExcludedByPolicy: run.excludedSet.size,
     filesExcludedByScope: run.scopeExcludedSet.size,
+    filesExcludedByIgnore: run.ignoreExcludedSet.size,
     conflictPaths,
     aborted,
   };
@@ -1589,6 +1653,20 @@ function defaultConsoleLogger(event: SyncProgressEvent): void {
       `    Sample refused paths: ${event.samplePaths.slice(0, 5).join(", ")}${event.samplePaths.length > 5 ? ", …" : ""}\n` +
       `    To proceed anyway: re-run with HQ_SYNC_DELETE_BULK_OVERRIDE=1 (or propagateDeletePolicy:"all").`,
     );
+  } else if (event.type === "ignore-excluded") {
+    // The "not silent" surface: an ignore rule dropped content that doesn't
+    // look like expected build/VCS/cache noise, so it never reached the vault.
+    // Surface it as a WARN naming the paths so an over-broad exclusion is
+    // observable rather than invisible (DEV-1791 / feedback_b9dfc7ae).
+    console.warn(
+      `  ! ${event.count} path${event.count === 1 ? "" : "s"} were EXCLUDED from sync by an ignore rule and did NOT reach the vault (review in case this is unintended):`,
+    );
+    for (const p of event.samplePaths) {
+      console.warn(`    · ${p}`);
+    }
+    if (event.count > event.samplePaths.length) {
+      console.warn(`    ... and ${event.count - event.samplePaths.length} more`);
+    }
   }
 }
 

package/src/cli/sync.ts

@@ -287,6 +287,22 @@ export type SyncProgressEvent =
       count: number;
       samplePaths: string[];
     }
+  | {
+      /**
+       * Emitted at most ONCE per `share()` push leg when the base ignore
+       * filter dropped one or more NOTEWORTHY paths: content that does not
+       * match expected build/VCS/cache noise classes. Surfaces an over-broad
+       * exclusion that would otherwise drop content silently (DEV-1791).
+       *
+       * `count` is the number of distinct noteworthy paths; `totalExcluded`
+       * is all base-ignore rejections including expected noise; `samplePaths`
+       * carries up to 10 noteworthy paths. Not emitted when `count === 0`.
+       */
+      type: "ignore-excluded";
+      count: number;
+      totalExcluded: number;
+      samplePaths: string[];
+    }
   | {
       /**
        * Emitted by the PUSH leg (`share()`) once per key whose upload was
@@ -2268,5 +2284,15 @@ function defaultConsoleLogger(event: SyncProgressEvent): void {
     if (event.count > event.samplePaths.length) {
       console.log(`    ... and ${event.count - event.samplePaths.length} more`);
     }
+  } else if (event.type === "ignore-excluded") {
+    console.warn(
+      `  ! ${event.count} path${event.count === 1 ? "" : "s"} were EXCLUDED from sync by an ignore rule and did NOT reach the vault (review in case this is unintended):`,
+    );
+    for (const p of event.samplePaths) {
+      console.warn(`    · ${p}`);
+    }
+    if (event.count > event.samplePaths.length) {
+      console.warn(`    ... and ${event.count - event.samplePaths.length} more`);
+    }
   }
 }

package/src/ignore.test.ts

@@ -11,7 +11,31 @@ import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
-import { createIgnoreFilter } from "./ignore.js";
+import { createIgnoreFilter, isExpectedIgnore } from "./ignore.js";
+import { wrapFilterWithIgnoreVisibility } from "./cli/share.js";
+
+describe("isExpectedIgnore", () => {
+  it("classifies top-level HQ-managed roots as expected", () => {
+    expect(isExpectedIgnore("repos")).toBe(true);
+    expect(isExpectedIgnore("repos/private/x.ts")).toBe(true);
+    expect(isExpectedIgnore("workspace/tmp/file.md")).toBe(true);
+  });
+
+  it("classifies build, VCS, cache, and known basename noise as expected", () => {
+    expect(isExpectedIgnore("node_modules/react/index.js")).toBe(true);
+    expect(isExpectedIgnore("apps/web/node_modules/react/index.js")).toBe(true);
+    expect(isExpectedIgnore(".git/config")).toBe(true);
+    expect(isExpectedIgnore(".DS_Store")).toBe(true);
+    expect(isExpectedIgnore("x/.env")).toBe(true);
+    expect(isExpectedIgnore("a/b/.hq-sync.pid")).toBe(true);
+    expect(isExpectedIgnore("y/foo.pyc")).toBe(true);
+  });
+
+  it("keeps nested repos/workspace and ordinary content noteworthy", () => {
+    expect(isExpectedIgnore("companies/indigo/knowledge/repos/foo/notes.md")).toBe(false);
+    expect(isExpectedIgnore("companies/indigo/knowledge/overview.md")).toBe(false);
+  });
+});
 
 describe("createIgnoreFilter", () => {
   let hqRoot: string;
@@ -69,6 +93,35 @@ describe("createIgnoreFilter", () => {
     expect(shouldSync(path.join(hqRoot, "companies/indigo/notes.md"))).toBe(true);
   });
 
+  it("visibility fires on an OVER-BROAD exclusion (real filter + recorder, DEV-1791)", () => {
+    // Simulate the regressed over-broad bug: an un-anchored `repos/` in
+    // .hqignore that matches ANY nested repos segment — exactly what
+    // silently ate /discover knowledge under companies/*/knowledge/repos/
+    // before the root-anchor fix. The visibility recorder must surface the
+    // dropped knowledge as NOTEWORTHY while staying quiet on build noise.
+    fs.writeFileSync(path.join(hqRoot, ".hqignore"), "repos/\n");
+    const ignoreFilter = createIgnoreFilter(hqRoot);
+    const noteworthy: string[] = [];
+    let total = 0;
+    const recorded = wrapFilterWithIgnoreVisibility(
+      ignoreFilter,
+      hqRoot,
+      (rel) => { noteworthy.push(rel); },
+      () => { total++; },
+    );
+
+    // Knowledge under a nested repos/ is dropped by the over-broad rule and
+    // is genuine content → captured as noteworthy.
+    expect(recorded(path.join(hqRoot, "companies/indigo/knowledge/repos/foo/notes.md"))).toBe(false);
+    // Build noise is also excluded but is EXPECTED → counted, not noteworthy.
+    expect(recorded(path.join(hqRoot, "node_modules/react/index.js"))).toBe(false);
+    // Ordinary knowledge that the filter ALLOWS fires nothing.
+    expect(recorded(path.join(hqRoot, "companies/indigo/knowledge/overview.md"))).toBe(true);
+
+    expect(noteworthy).toEqual(["companies/indigo/knowledge/repos/foo/notes.md"]);
+    expect(total).toBe(2); // both exclusions counted; only one is noteworthy
+  });
+
   it("v15+ layout (core/core.yaml present): root core.yaml is ignored, nested core/core.yaml syncs", () => {
     // On v15+ the scaffold/version manifest lives at `core/core.yaml` (a real
     // project file that DOES sync). Any root-level `core.yaml` here is a stale

package/src/ignore.ts

@@ -209,6 +209,79 @@ function segmentToRegex(seg: string): RegExp {
   return new RegExp(`^${body}$`);
 }
 
+export const EXPECTED_IGNORE_SEGMENTS = new Set([
+  ".git",
+  "node_modules",
+  ".pnpm-store",
+  "dist",
+  "build",
+  ".next",
+  ".nuxt",
+  ".svelte-kit",
+  ".turbo",
+  ".parcel-cache",
+  ".vite",
+  "coverage",
+  "target",
+  "__pycache__",
+  ".pytest_cache",
+  ".mypy_cache",
+  ".ruff_cache",
+  ".venv",
+  "venv",
+  "vendor",
+  "out",
+  ".cache",
+  "tmp",
+  ".tmp",
+  ".hq",
+  ".claude",
+]);
+
+/**
+ * Classify a base-ignore rejection as expected noise vs noteworthy content.
+ *
+ * `true` means the ignored path belongs to an expected by-design exclusion
+ * class: HQ-managed top-level roots, build/VCS/cache/machine-local segments,
+ * or known generated/noise basenames. `false` means the rejected path looks
+ * like real user content and should be surfaced by push observability.
+ *
+ * Top-level `repos/` and `workspace/` are expected, but nested segments named
+ * `repos` or `workspace` are deliberately noteworthy: that is the DEV-1791
+ * regression signal this classifier exists to preserve.
+ */
+export function isExpectedIgnore(relPath: string): boolean {
+  if (
+    relPath === "repos" ||
+    relPath.startsWith("repos/") ||
+    relPath === "workspace" ||
+    relPath.startsWith("workspace/")
+  ) {
+    return true;
+  }
+
+  const segments = relPath.split("/");
+  for (const segment of segments) {
+    if (EXPECTED_IGNORE_SEGMENTS.has(segment)) return true;
+  }
+
+  const basename = segments[segments.length - 1] ?? "";
+  return (
+    basename === ".DS_Store" ||
+    basename === "Thumbs.db" ||
+    basename === "company.yaml" ||
+    basename === "INDEX.md" ||
+    basename === "modules.lock" ||
+    basename.endsWith(".pyc") ||
+    basename.endsWith(".class") ||
+    basename.endsWith(".pid") ||
+    basename.startsWith(".hq-") ||
+    basename === ".env" ||
+    basename.startsWith(".env.") ||
+    basename === ".mcp.json"
+  );
+}
+
 export function createIgnoreFilter(
   hqRoot: string,
 ): (filePath: string, isDir?: boolean) => boolean {