@indigoai-us/hq-cloud 6.14.28 → 6.14.29

package/src/bin/sync-runner.ts

@@ -107,6 +107,7 @@ import {
 import { HQ_CLOUD_VERSION } from "../version.js";
 import { collectAndSendTelemetry } from "../telemetry.js";
 import { collectAndSendSkillTelemetry } from "../skill-telemetry.js";
+import { collectAndSendOutcomeTelemetry } from "../outcome-telemetry.js";
 import { emitCloudTelemetry } from "../telemetry-events.js";
 import { reindexAfterSync } from "../qmd-reindex.js";
 import type { ReindexOptions as QmdReindexOptions } from "../qmd-reindex.js";
@@ -644,13 +645,12 @@ interface IdTokenClaims {
   given_name?: string;
   family_name?: string;
   /**
-   * Entity-bound machine-identity claims. A headless agent box authenticates
-   * with machine creds (username `machine-agt_*`); its idToken carries the
-   * agent's own entity binding here. The vault authorizer reads these to
-   * resolve the caller AS the agent. The runner reads them to drive
-   * agent-aware `--personal` target resolution: when `custom:entityType ===
-   * "agent"`, the personal slot resolves to the agent's OWN entity
-   * (`custom:entityUid`, `agt_*`) instead of the person-only canonical pick.
+   * Entity-bound machine-principal claims. A headless agent or Outpost
+   * authenticates with machine credentials; its idToken carries the machine's
+   * own entity binding here. The runner preserves those authenticated claims
+   * during planning. Agent claims additionally drive `--personal` target
+   * resolution to the agent's OWN entity (`custom:entityUid`, `agt_*`) instead
+   * of the person-only canonical pick.
    */
   "custom:entityType"?: string;
   "custom:entityUid"?: string;
@@ -725,6 +725,8 @@ export interface RunnerPassResult {
     operation: "delete" | "tombstone";
     reason?: string;
   }>;
+  /** Company legs that threw before finishing their push/pull work. */
+  companyFailures?: Array<{ company: string; message: string }>;
 }
 
 export interface RunnerPassOutcome {
@@ -1176,6 +1178,37 @@ export async function defaultCollectTelemetry(
     });
     // Fire-and-forget; nothing escapes the boundary.
   }
+
+  // Outcome telemetry runs as an independent pass (own cursor, own endpoint,
+  // outcome-leaderboard US-004) so a failure here can never affect token or
+  // skill telemetry above. It diffs prd.json story `passes` + board.json project
+  // `status` transitions against a local cursor and POSTs story-completed /
+  // project-shipped events. No machineId/installerVersion — the /v1/outcome-events
+  // contract accepts only { events }.
+  try {
+    await collectAndSendOutcomeTelemetry({
+      client: client as unknown as Parameters<typeof collectAndSendOutcomeTelemetry>[0]["client"],
+      // Scan <hqRoot>/companies/* for prd.json/board.json and resolve each
+      // project's owning company via <hqRoot>/companies/manifest.yaml.
+      hqRoot,
+      log: (message) =>
+        reportDiagnostic({
+          component: "telemetry",
+          event: "runner.telemetry.outcome_nonfatal",
+          message,
+          context: { hqRoot },
+        }),
+    });
+  } catch (err) {
+    reportDiagnostic({
+      component: "telemetry",
+      event: "runner.telemetry.outcome_failed",
+      message: "outcome telemetry collector threw",
+      err,
+      context: { hqRoot },
+    });
+    // Fire-and-forget; nothing escapes the boundary.
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -1285,19 +1318,22 @@ export async function runRunner(
   // Resolved here (not inside `parsed.companies`) so single-company runs also
   // get author attribution. `null` is fine — share() simply omits the metadata.
   const getClaims = deps.getIdTokenClaims ?? defaultGetIdTokenClaims;
-  // A machine token is minted immediately above and is an ID token. Make its
-  // entity binding authoritative for this run: a stale human token cache can
-  // otherwise make an authenticated agent look like a person during fanout
-  // planning, which drops the agent's own personal-vault target. Human callers
-  // still retain the cache as their primary claims source because their bearer
-  // is normally an access token without the full ID-token profile.
+  // A machine-principal token is minted immediately above and is an ID token.
+  // Make its entity binding authoritative for this run: a stale human token
+  // cache can otherwise make an authenticated machine look like a person
+  // during fanout planning. Human callers still retain the cache as their
+  // primary claims source because their bearer is normally an access token
+  // without the full ID-token profile.
   const authenticatedClaims = decodeJwtClaims(initialAuthToken);
-  const authenticatedMachineClaims =
-    authenticatedClaims?.["custom:entityType"] === "agent" &&
+  const authenticatedMachinePrincipalClaims =
+    authenticatedClaims &&
+    (authenticatedClaims["custom:entityType"] === "agent" ||
+      authenticatedClaims["custom:entityType"] === "outpost") &&
     typeof authenticatedClaims["custom:entityUid"] === "string"
       ? authenticatedClaims
       : null;
-  const claims = authenticatedMachineClaims ?? getClaims() ?? authenticatedClaims;
+  const claims =
+    authenticatedMachinePrincipalClaims ?? getClaims() ?? authenticatedClaims;
   const uploadAuthor: UploadAuthor | undefined =
     claims?.sub && claims?.email
       ? { userSub: claims.sub, email: claims.email }
@@ -1513,7 +1549,10 @@ export async function runRunner(
     throw err;
   }
   const { errors, allConflicts, meaningfulOutcomeCount } = fanout;
-  deps.onPassResult?.({ pushPathResults: fanout.pushPathResults });
+  deps.onPassResult?.({
+    pushPathResults: fanout.pushPathResults,
+    companyFailures: fanout.companyFailures,
+  });
   const rollup = rollupAllComplete(plan, fanout.stateByCompany);
 
   // The personal-vault target runs last and can pull an older copy of the
@@ -1758,9 +1797,15 @@ export async function runRunner(
             changedCount: qmdChangedPaths.length,
             qmdState: qmdResult.qmdAvailable ? "available" : "unavailable",
             collectionsAddedCount: qmdResult.collectionsAdded.length,
+            pathDriftDetectedCount: qmdResult.pathDriftDetected?.length ?? 0,
+            collectionsRepairedCount: qmdResult.collectionsRepaired?.length ?? 0,
             updateState: qmdResult.updated ? "updated" : "unchanged",
             embedState: qmdResult.embedded ? "embedded" : "not_embedded",
             dirtyState: qmdResult.pendingDirty ? "pending_dirty" : "clean",
+            lockBusy: qmdResult.lockBusy === true ? 1 : 0,
+            timedOut: qmdResult.timedOut === true ? 1 : 0,
+            corruptionQuarantined: qmdResult.corruptionQuarantined === true ? 1 : 0,
+            corruptionQuarantineFailed: qmdResult.corruptionQuarantineFailed === true ? 1 : 0,
           },
         },
         {

package/src/cli/doctor.ts

@@ -191,7 +191,9 @@ async function listSkillObjects(
       prefix: SKILLS_KEY_PREFIX,
       continuationToken,
     });
-    objects.push(...page.objects);
+    for (const object of page.objects) {
+      objects.push(object);
+    }
     continuationToken = page.nextContinuationToken;
   } while (continuationToken);
   return objects;

package/src/cli/reindex.ts

@@ -377,22 +377,34 @@ function copyCodexSessionLogs(root: string, destBase: string): void {
   }
 }
 
-// Recursively collect every regular file under `dir` (absolute paths). Symlinks
-// are not followed (lstat gate) so a stray link can't escape the tree or loop.
-// Missing/unreadable dirs yield []. Best-effort — mirrors globEntries' tolerance.
+// Collect every regular file under `dir` (absolute paths) in depth-first order.
+// Symlinks are not followed (lstat gate) so a stray link can't escape the tree
+// or loop. Missing/unreadable dirs yield []. Best-effort — mirrors
+// globEntries' tolerance.
 function walkFiles(dir: string): string[] {
   const out: string[] = [];
-  let names: string[];
-  try {
-    names = fs.readdirSync(dir);
-  } catch {
-    return out;
-  }
-  for (const name of names) {
-    const abs = path.join(dir, name);
+  const stack: Array<{ names: string[]; index: number; dir: string }> = [];
+  const enterDirectory = (currentDir: string): void => {
+    try {
+      stack.push({ names: fs.readdirSync(currentDir), index: 0, dir: currentDir });
+    } catch {
+      // Missing and unreadable children are ignored just like the recursive
+      // walker did when its nested call returned an empty list.
+    }
+  };
+
+  enterDirectory(dir);
+  while (stack.length > 0) {
+    const frame = stack[stack.length - 1];
+    if (frame.index >= frame.names.length) {
+      stack.pop();
+      continue;
+    }
+    const name = frame.names[frame.index++];
+    const abs = path.join(frame.dir, name);
     const st = lstatOrNull(abs);
     if (!st) continue;
-    if (st.isDirectory()) out.push(...walkFiles(abs));
+    if (st.isDirectory()) enterDirectory(abs);
     else if (st.isFile()) out.push(abs);
   }
   return out;

package/src/cli/rescue-core.ts

@@ -1432,7 +1432,9 @@ function writeApplyFailureManifest(
   lines.push(`Error: ${message}`);
   lines.push("");
   lines.push("## Completed Before Failure");
-  lines.push(...completedLines);
+  for (const line of completedLines) {
+    lines.push(line);
+  }
   lines.push("");
   lines.push("## Failed Action Paths");
   if (failedAction.affectedRels.length > 0) {

package/src/cli/share.test.ts

@@ -9,6 +9,13 @@ import * as os from "os";
 import { clearContextCache } from "../context.js";
 import type { VaultServiceConfig } from "../types.js";
 
+// Re-export node:fs as a mutable module so the large-tree regression can
+// replace only readdirSync; normal tests retain the real implementation.
+vi.mock("fs", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("fs")>();
+  return { ...actual };
+});
+
 // Mock s3 module at the top level. uploadFile resolves to a synthetic ETag
 // so share() can record it on the journal entry — the real PutObject
 // response shape is `{ ETag: '"<hex>"' }`. uploadSymlink is the symlink-
@@ -259,6 +266,59 @@ describe("share", () => {
     expect(result.filesUploaded).toBe(2);
   });
 
+  it("walks a very large directory without using its entries as call arguments", () => {
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    const nestedDir = path.join(companyRoot, "nested");
+    fs.mkdirSync(nestedDir);
+    const entryCount = 150_000;
+    const fileEntry = (name: string) => ({
+      name,
+      isDirectory: () => false,
+      isFile: () => true,
+      isSymbolicLink: () => false,
+    });
+    const rootEntries = [
+      fileEntry("before.md"),
+      {
+        name: "nested",
+        isDirectory: () => true,
+        isFile: () => false,
+        isSymbolicLink: () => false,
+      },
+      ...Array.from(
+        { length: entryCount - 2 },
+        (_, index) => fileEntry(`entry-${index}.md`),
+      ),
+    ] as unknown as fs.Dirent[];
+    const nestedEntries = [fileEntry("child.md")] as unknown as fs.Dirent[];
+    const readdirSpy = vi
+      .spyOn(fs, "readdirSync")
+      .mockImplementation(
+        ((dir: fs.PathLike) =>
+          path.resolve(String(dir)) === nestedDir ? nestedEntries : rootEntries) as unknown as typeof fs.readdirSync,
+      );
+
+    try {
+      const collected = shareTesting.collectFiles(
+        [companyRoot],
+        tmpDir,
+        companyRoot,
+        () => true,
+      );
+
+      expect(collected).toHaveLength(entryCount);
+      expect(collected[0]).toMatchObject({ relativePath: "before.md" });
+      expect(collected[1]).toMatchObject({ relativePath: "nested/child.md" });
+      expect(collected[2]).toMatchObject({ relativePath: "entry-0.md" });
+      expect(collected.at(-1)).toMatchObject({
+        relativePath: `entry-${entryCount - 3}.md`,
+      });
+    } finally {
+      readdirSpy.mockRestore();
+    }
+  });
+
   it("keys nested paths relative to the company root, not hqRoot", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(path.join(companyRoot, "knowledge"), { recursive: true });

package/src/cli/share.ts

@@ -270,6 +270,7 @@ export const _testing = {
   isEphemeralPath,
   EPHEMERAL_PATH_PATTERN,
   wrapFilterWithIgnoreVisibility,
+  collectFiles,
 };
 
 /**
@@ -1965,7 +1966,7 @@ function collectFiles(
 
     if (lstat.isDirectory()) {
       if (!filter(absolutePath, true)) continue;
-      results.push(...walkDir(absolutePath, syncRoot, filter));
+      walkDir(absolutePath, syncRoot, filter, results);
     } else if (lstat.isFile()) {
       const relativePath = vaultKeyForLocalPath(syncRoot, absolutePath);
       if (filter(absolutePath)) {
@@ -1981,18 +1982,35 @@ function walkDir(
   dir: string,
   syncRoot: string,
   filter: (p: string, isDir?: boolean) => boolean,
-): CollectedEntry[] {
-  const results: CollectedEntry[] = [];
-  if (!fs.existsSync(dir)) return results;
+  results: CollectedEntry[],
+): void {
+  // A frame per open directory preserves the recursive walk's depth-first
+  // ordering without turning a completed subtree into one giant call argument
+  // list. This matters for both operator-visible plan ordering and large trees.
+  const stack: Array<{ dir: string; entries: fs.Dirent[]; index: number }> = [];
+  const enterDirectory = (currentDir: string): void => {
+    if (!fs.existsSync(currentDir)) return;
+    stack.push({
+      dir: currentDir,
+      entries: fs.readdirSync(currentDir, { withFileTypes: true }),
+      index: 0,
+    });
+  };
 
-  const entries = fs.readdirSync(dir, { withFileTypes: true });
-  for (const entry of entries) {
+  enterDirectory(dir);
+  while (stack.length > 0) {
+    const frame = stack[stack.length - 1];
+    if (frame.index >= frame.entries.length) {
+      stack.pop();
+      continue;
+    }
+    const entry = frame.entries[frame.index++];
     // Ephemeral artifacts (conflict mirrors) are local-only safety backups
     // that MUST NEVER round-trip to S3. Check basename here so the filter
     // applies regardless of which company root contains them. See
     // EPHEMERAL_PATH_PATTERN doc for the full rationale.
     if (isEphemeralPath(entry.name)) continue;
-    const absolutePath = path.join(dir, entry.name);
+    const absolutePath = path.join(frame.dir, entry.name);
     const isDir = entry.isDirectory();
 
     // Symlinks need their own filter probe BEFORE the regular gate.
@@ -2028,7 +2046,7 @@ function walkDir(
     if (!filter(absolutePath, isDir)) continue;
 
     if (isDir) {
-      results.push(...walkDir(absolutePath, syncRoot, filter));
+      enterDirectory(absolutePath);
     } else if (entry.isFile()) {
       results.push({
         kind: "file",
@@ -2037,8 +2055,6 @@ function walkDir(
       });
     }
   }
-
-  return results;
 }
 
 function isWithin(parent: string, child: string): boolean {
@@ -2658,7 +2674,9 @@ async function computeDeletePlan(
   // delete loop tombstones each key identically (DeleteObject + remove from
   // journal). Merged at the end so the bulk-asymmetry breaker above had its
   // chance to NOT include litter in either the numerator or the sweep.
-  plan.toDelete.push(...litterToDelete.map((key) => ({ key, intentVersion: null })));
+  for (const key of litterToDelete) {
+    plan.toDelete.push({ key, intentVersion: null });
+  }
 
   return plan;
 }

package/src/ignore.test.ts

@@ -57,6 +57,16 @@ describe("createIgnoreFilter", () => {
     expect(shouldSync(path.join(hqRoot, ".env"))).toBe(false);
   });
 
+  it("permissive mode: project-local .qmd index is ignored by default", () => {
+    // feedback_332c7ccc / sqlite-vec#297 — never round-trip a project-local
+    // qmd index through the vault.
+    const shouldSync = createIgnoreFilter(hqRoot);
+    expect(shouldSync(path.join(hqRoot, ".qmd"), true)).toBe(false);
+    expect(shouldSync(path.join(hqRoot, ".qmd/index.sqlite"))).toBe(false);
+    expect(shouldSync(path.join(hqRoot, ".qmd/index.sqlite-wal"))).toBe(false);
+    expect(isExpectedIgnore(".qmd/index.sqlite")).toBe(true);
+  });
+
   it("permissive mode: pnpm content-addressed store is ignored by default", () => {
     // .pnpm-store/ is pnpm's content-addressed package store. Like
     // node_modules/ it is large and machine-local and must never sync — a

package/src/ignore.ts

@@ -79,6 +79,10 @@ export const DEFAULT_IGNORES = [
 
   // Generic caches / temp
   ".cache/",
+  // Project-local qmd index (qmd init). Must never round-trip through the vault —
+  // sqlite-vec vec0 tables corrupt when copied across machines (feedback_332c7ccc /
+  // sqlite-vec#297). Default global index at ~/.cache/qmd is already outside hqRoot.
+  ".qmd/",
   "tmp/",
   ".tmp/",
 
@@ -263,6 +267,7 @@ export const EXPECTED_IGNORE_SEGMENTS = new Set([
   "vendor",
   "out",
   ".cache",
+  ".qmd",
   "tmp",
   ".tmp",
   ".hq",