@wei840222/qmd 2026.8.23 → 2026.8.28

package/CHANGELOG.md

@@ -4,30 +4,70 @@
 
 ### Added
 
-- Added Oxlint lint fence.
-- Added a bundled Traditional Chinese Jieba dictionary that deterministically
-  combines the node-rs base dictionary, APCLab's Taiwan dictionary, and
-  zhtw-mcp technical terms. `pnpm dict:sync` verifies pinned source hashes;
-  `pnpm dict:sync --update-pins` refreshes the upstream pins.
-- Added CJK-aware lexical retrieval with independent character, Jieba word, and
-  bigram FTS5 channels, versioned rank fusion and explain traces. The bundled
-  reviewed Traditional Chinese technical dictionary records its pinned source
-  and MIT attribution in `THIRD_PARTY_NOTICES.md`.
-- Added typed local/OpenAI embedding providers, provider-qualified vector
-  identities, resumable chunk persistence, build leases, remote preflight and
-  acknowledgement, request-purpose guards, safe OpenAI errors, and additive
-  diagnostics in CLI, SDK, and MCP. Local embedding remains the default.
-- Added `OPENAI_BASE_URL` for routing OpenAI-compatible embedding requests
-  through a self-hosted proxy while retaining the existing remote-consent flow.
-- Added the native `@node-rs/jieba` dependency and package smoke coverage for its
-  Node/Bun runtime loading and packaged dictionary data.
+- **Disable HyDE Expansion Control**: Added `--no-hyde` CLI option for `qmd query` and `qmd vsearch`, `includeHyde` parameter to SDK (`store.search`, `store.expandQuery`) and MCP `query` tool, allowing users to disable generating hypothetical document embeddings during query expansion.
+
+## [2026.8.23-1] - 2026-08-23
+
+### Added
+
+- **Pure Node.js + pnpm Standardized Toolchain**: Completely standardized the project on
+  Node.js (>=22) and pnpm (`pnpm@11.15.1`). Removed all Bun-specific runtime abstractions,
+  lockfile heuristics, and dual-runtime test preloads.
+- **Oxlint & Code Quality Fences**: Added Oxlint static analysis rules (`oxlint`) and anti-slop
+  guardrails across the codebase.
+- **CJK 3-Way Lexical Retrieval**: Added CJK-aware lexical retrieval with independent character,
+  Jieba word, and bigram FTS5 shadow channels, versioned reciprocal rank fusion (RRF), and
+  explain traces.
+- **Bundled Traditional Chinese Jieba Dictionary**: Added a bundled Traditional Chinese dictionary
+  deterministically combining `@node-rs/jieba` (`2.0.2`), APCLab's Taiwan dictionary, and
+  `sysprog21/zhtw-mcp` technical terms. Pinned sources and hashes are recorded in
+  `src/search/zh-dict.sources.json` and `THIRD_PARTY_NOTICES.md`.
+- **Custom User Dictionary Support**: Added `user_dict` configuration supporting custom
+  user dictionaries with automatic analyzer fingerprint updates.
+- **Typed Remote OpenAI-Compatible Embedding Provider**: Added typed `OpenAIEmbeddingProvider`,
+  provider-qualified vector identities, resumable chunk persistence, build leases, remote
+  preflight, chunk byte budgeting, and safe OpenAI error handling.
+- **Remote LLM Query Expansion & Chat Reranking**: Supported OpenAI-compatible
+  `/v1/chat/completions` API endpoints for remote query expansion and reranking with XML-structured
+  prompts and current timestamp injection.
+- **Vector Table Collection Column**: Added `collection` column to vector indexes with automatic
+  schema migration and collection-scoped filtering.
+- **Single-Item Batch Embedding Fallback**: Added single-item fallback to gracefully handle and
+  recover from oversized batch chunks during embedding and vector repair.
+- **Agent Skill Query Syntax Reference**: Added `skills/qmd/references/query-syntax.md` detailing
+  formal EBNF grammar, search operators, and structured MCP JSON payloads, linked directly from
+  `skills/qmd/SKILL.md`.
+- **Automated Jules PR Code Reviews**: Integrated Google Jules PR review GitHub Actions workflow
+  (`.github/workflows/jules-pr-review.yml`) with automatic `git diff` fallback for large diffs (>20k lines).
+- **Trivy Vulnerability Scanner & Fast CI Checks**: Integrated Trivy filesystem and dependency security
+  scanner, TypeScript type checking (`pnpm run test:types`), and Tree-sitter WASM grammars smoke
+  (`pnpm run smoke:package-grammars`) in `.github/workflows/ci.yml`.
 
 ### Changed
 
-- Chat-completions reranking now prioritizes explicit query constraints such as
-  entities, locations, versions, time, and negations. Valid empty rerank results
-  no longer fall back to neutral scores, and parsed chat rerank output is sorted
-  by descending relevance score.
+- **Runtime Standardization & Bun Deprecation**: Standardized database layer on `better-sqlite3`
+  and `sqlite-vec`. Streamlined `bin/qmd` launcher to a pure Node.js / `tsx` trampoline.
+  Replaced all `bun` / `bunx` scripts with `node`, `pnpm`, `tsx`, and `npx`.
+- **Unified `models` Configuration Block**: Replaced disjointed embedding and expand configurations
+  with a unified `models:` configuration block supporting `embed`, `generate`, and `rerank`
+  endpoints/models.
+- **Generic MCP Client Documentation**: Generalized MCP server configuration instructions across
+  `README.md` and `skills/qmd/references/mcp-setup.md` to support all MCP-compatible clients
+  (Cursor, Claude Desktop, Zed, OpenClaw, etc.).
+- **Standardized Multi-Holder MIT License**: Updated `LICENSE` to the standard multi-holder copyright
+  formatting (Tobi Lutke and Wan, Jiun Wei) for full compatibility with automated license scanners.
+- **Test Suite Semver Suffix Support**: Updated CLI `--version` test in `test/esm-ambiguous-module.test.ts`
+  to support Semver prerelease/build suffixes (e.g. `2026.8.23-1`).
+- **Remote LLM Prompt Architecture & Hardening**: Remote query expansion and chat-completions
+  reranking now use consistent XML prompt structures, escape untrusted prompt data, preserve
+  cross-language technical terms, and discard low-confidence chat rerank scores below `0.1`.
+- **Direct Remote Authorization**: Streamlined remote embedding and execution by removing
+  legacy interactive remote consent prompts while enforcing strict identity fingerprinting.
+- **Database Performance Optimizations**: Skipped redundant database write transactions when
+  configuration state remains unchanged.
+- **Dependency Upgrades**: Upgraded `@node-rs/jieba` to `2.0.2` and updated package scope to
+  `@wei840222/qmd`.
+
 - Remote query expansion and chat-completions reranking now use a consistent
   Gemini-style XML prompt structure in both system and user messages, separating
   role, instructions, constraints, output format, context, task, and final
@@ -102,6 +142,18 @@
   reopen, keep CLI update/include settings synchronized, and use atomic durable
   YAML replacement.
 
+### Removed
+
+- Removed Nix flake configurations (`flake.nix`, `flake.lock`) and related CI jobs.
+- Removed `bun.lock`, `src/test-preload.ts`, and `test/launcher-detection.test.sh`.
+- Removed legacy interactive remote embedding consent workflows in favor of direct configuration-based authorization.
+
+### Security
+
+- Added Trivy filesystem and dependency security scanning in CI workflows.
+- Bound MCP HTTP server explicitly to `127.0.0.1`.
+- Sanitized remote LLM error handling to prevent leaking credentials or headers.
+
 ### Compatibility
 
 - `vectors_vec` still supports one embedding dimension at a time. Switching

package/LICENSE

@@ -1,29 +1,6 @@
 MIT License
 
 Copyright (c) 2024-2026 Tobi Lutke
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
----
-
-MIT License
-
 Copyright (c) 2026 Wan, Jiun Wei
 
 Permission is hereby granted, free of charge, to any person obtaining a copy

package/README.md

@@ -28,14 +28,13 @@ You can read more about QMD's progress in the [CHANGELOG](CHANGELOG.md).
 ## Quick Start (Local Embedding Default)
 
 ```sh
-# Install globally (Node or Bun)
+# Install globally
 npm install -g @wei840222/qmd
 # or
-bun install -g @wei840222/qmd
+pnpm add -g @wei840222/qmd
 
 # Or run directly
 npx @wei840222/qmd ...
-bunx @wei840222/qmd ...
 
 # Create collections for your notes, docs, and meeting transcripts
 qmd collection add ~/notes --name notes
@@ -96,27 +95,9 @@ Although the tool works perfectly fine when you just tell your agent to use it o
 - `multi_get` — Batch retrieve by glob pattern, comma-separated list, or docids
 - `status` — Index health and collection info
 
-**Claude Desktop configuration** (`~/Library/Application Support/Claude/claude_desktop_config.json`):
+#### Stdio Transport (Default)
 
-```json
-{
-  "mcpServers": {
-    "qmd": {
-      "command": "qmd",
-      "args": ["mcp"]
-    }
-  }
-}
-```
-
-**Claude Code** — Install the plugin (recommended):
-
-```bash
-claude plugin marketplace add tobi/qmd
-claude plugin install qmd@qmd
-```
-
-Or configure MCP manually in `~/.claude/settings.json`:
+Add QMD to your MCP client configuration (e.g. Cursor, Claude Desktop, Zed, or other MCP-compatible clients):
 
 ```json
 {
@@ -211,7 +192,7 @@ results seem unscoped. The HTTP `/query` and `/search` endpoints return
 
 ### SDK / Library Usage
 
-Use QMD as a library in your own Node.js or Bun applications.
+Use QMD as a library in your own Node.js applications.
 
 #### Installation
 
@@ -552,7 +533,6 @@ The `query` command uses **Reciprocal Rank Fusion (RRF)** with position-aware bl
 ### System Requirements
 
 - **Node.js** >= 22
-- **Bun** >= 1.0.0
 - **macOS**: Homebrew SQLite (for extension support)
   ```sh
   brew install sqlite
@@ -729,16 +709,16 @@ Review the resulting pin and dictionary diff before committing an update.
 ```sh
 npm install -g @wei840222/qmd
 # or
-bun install -g @wei840222/qmd
+pnpm add -g @wei840222/qmd
 ```
 
 ### Development
 
 ```sh
-git clone https://github.com/tobi/qmd
+git clone https://github.com/wei840222/qmd
 cd qmd
-bun install
-bun link
+pnpm install
+npm link
 ```
 
 ## Usage
@@ -811,7 +791,7 @@ opt in. Run `qmd status` to verify which grammars are available.
 
 > **Note:** Tree-sitter grammars are optional dependencies. If they are not
 > installed, `--chunk-strategy auto` falls back to regex-only chunking
-> automatically. Tested on both Node.js and Bun.
+> automatically.
 
 ### Context Management
 
@@ -1002,6 +982,7 @@ and `deep-search` (→ `query`).
 --index <name>     # Use named index
 --intent "<text>"  # Legacy CLI alias for rerank context (e.g. "web page load times")
 --no-rerank        # Skip LLM reranking (RRF scores only; faster on CPU)
+--no-hyde          # Disable HyDE in query expansion (only lex and vec expansions)
 -C, --candidate-limit <n>  # Max candidates to rerank (default: 40)
 --full-path        # Emit on-disk filesystem paths instead of qmd:// URIs
                    # (a result whose file has moved or been deleted since

package/THIRD_PARTY_NOTICES.md

@@ -4,9 +4,9 @@
 
 The bundled Traditional Chinese Jieba dictionary combines the following MIT-licensed sources:
 
-- `@node-rs/jieba` 2.0.1 (`dict.txt`), Copyright (c) LongYinan.
+- `@node-rs/jieba` 2.0.2 (`dict.txt`), Copyright (c) LongYinan.
 - `APCLab/jieba-tw` (`jieba/dict.txt`) at commit `2bd4c0913cdadc865879b21a00c78e28ef1ba2c5`, Copyright (c) 2013 Sun Junyi.
-- `sysprog21/zhtw-mcp` (`assets/ruleset.json`) at commit `2e0f4e4912a8ffdacf7fa3a155cb20c29cba043b`, Copyright (c) 2026 National Cheng Kung University, Taiwan.
+- `sysprog21/zhtw-mcp` (`assets/ruleset.json`) at commit `40e669a769bfcafc5f21f9ca6e2f5152b54c8831`, Copyright (c) 2026 National Cheng Kung University, Taiwan.
 
 The source pins and content fingerprints are recorded in `src/search/zh-dict.sources.json` in the qmd source distribution. qmd has no runtime source dependency on these upstream repositories.
 

package/bin/qmd

@@ -1,19 +1,16 @@
 #!/usr/bin/env node
-// 2>/dev/null; if command -v node >/dev/null 2>&1; then exec node "$0" "$@"; else exec bun "$0" "$@"; fi
+// 2>/dev/null; exec node "$0" "$@"
 // Cross-platform launcher for qmd.
 //
-// Previously this was a POSIX shell script with `#!/bin/sh`, which meant npm
-// on Windows generated shims that tried to route through `/bin/sh` — a path
-// that doesn't exist on Windows, so `qmd` failed immediately after a global
-// install. Rewriting the launcher in Node.js lets npm generate native
+// Rewriting the launcher in Node.js lets npm/pnpm generate native
 // cmd/ps1/sh shims that invoke `node` directly on every platform.
 
-import { spawn, spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
-import { dirname, resolve, sep } from "node:path";
+import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-// Resolve symlinks so global installs (npm link / npm install -g) can find
+// Resolve symlinks so global installs (npm link / npm install -g / pnpm add -g) can find
 // the actual package directory instead of the global bin directory.
 const self = realpathSync(fileURLToPath(import.meta.url));
 const pkgDir = resolve(dirname(self), "..");
@@ -22,7 +19,7 @@ const tsEntry = resolve(pkgDir, "src/cli/qmd.ts");
 
 // MCP stdio reserves stdout exclusively for JSON-RPC frames. node-llama-cpp
 // / llama.cpp / ggml can write native logs directly to stdout before JS-level
-// log handlers are attached, so seed the native quiet env before Node/Bun imports
+// log handlers are attached, so seed the native quiet env before Node imports
 // the CLI and its LLM modules. Preserve explicit user values when provided.
 if (process.argv[2] === "mcp") {
   process.env.LLAMA_LOG_LEVEL = process.env.LLAMA_LOG_LEVEL || "error";
@@ -36,145 +33,49 @@ if (process.argv[2] === "mcp") {
 // residency set is empty (ggml-org/llama.cpp#22593); the keep_alive hasn't
 // expired by exit, so the assertion fails and ggml_abort dumps a multi-kB
 // stack trace to stderr even when the user-visible results were already
-// emitted correctly. No JS-side dispose can prevent it because the static
-// destructor runs in __cxa_finalize_ranges, after every JS-reachable cleanup.
+// emitted correctly.
 //
 // For QMD's short-lived CLI workflow, residency sets provide no observable
-// performance benefit (subsequent requests don't reuse the warm mapping —
-// measured: identical wall time with and without on M3 Pro), so disable them
-// by default on darwin. The env var must be set BEFORE the native llama.cpp
-// binding loads, which is why it lives here in the launcher rather than in
-// the JS entry point. Opt back in with QMD_METAL_KEEP_RESIDENCY=1 if you
-// run long-lived qmd processes (the MCP daemon may benefit on hot reload)
-// or are triaging an upstream Metal teardown fix.
+// performance benefit, so disable them by default on darwin.
 if (process.platform === "darwin" && process.env.QMD_METAL_KEEP_RESIDENCY !== "1") {
   process.env.GGML_METAL_NO_RESIDENCY = process.env.GGML_METAL_NO_RESIDENCY || "1";
 }
 
-function hasBun() {
-  try {
-    const res = spawnSync("bun", ["--version"], { stdio: "ignore", shell: process.platform === "win32" });
-    return res.status === 0;
-  } catch {
-    return false;
-  }
-}
-
 // In published packages, bin/qmd must run dist/. In a git checkout, however,
 // dist/ is often ignored and can be stale after git reset or branch switches.
 // Prefer source mode only for checkouts so ./bin/qmd reflects the checked-out
 // source without changing packaged/runtime behavior.
-//
-// Critical: source-mode detection must NOT trigger when a package manager
-// installed us. `pnpm install -g .` (and `npm install -g .`) copy the entire
-// working tree — including .git/, bun.lock, package-lock.json, src/, and even
-// node_modules/ — into <prefix>/node_modules/@tobilu/qmd/, so .git and a
-// lockfile being present is not a reliable "this is a working tree" signal.
-// What IS reliable: a package-manager install always lands the package
-// directory inside a `node_modules/` segment; a bare working-tree checkout
-// (with `bun link` or a direct path invocation) does not. Gate source mode
-// on that. Allow QMD_SOURCE_MODE=1 / =0 as an explicit override for the
-// rare case where the heuristic disagrees with the user.
 const sourceOverride = process.env.QMD_SOURCE_MODE;
 const looksInstalled = pkgDir.split("/").includes("node_modules");
 const sourceAllowed = sourceOverride === "1"
   || (sourceOverride !== "0" && !looksInstalled);
 
 let useSourceMode = false;
-let sourceRunner = null;
-let sourceArgs = [];
+let runnerArgs = [];
 
 if (sourceAllowed && existsSync(resolve(pkgDir, ".git")) && existsSync(tsEntry)) {
-  // Lockfile-driven runner selection — mirror the dist-mode logic below so
-  // source mode picks the same runtime the user's deps were installed for.
-  // package-lock.json wins over bun.lock when both are present: pnpm/npm
-  // installs ship the Node-ABI native modules (better-sqlite3, sqlite-vec),
-  // and running Bun against them produces ABI mismatches. This also fixes
-  // pnpm-global installs, which copy the whole working tree — including .git
-  // and bun.lock — into the install dir and used to route through Bun even
-  // when the user installed via npm/pnpm.
-  const hasNpmLock = existsSync(resolve(pkgDir, "package-lock.json"));
-  const hasBunLock = existsSync(resolve(pkgDir, "bun.lock")) || existsSync(resolve(pkgDir, "bun.lockb"));
   const tsxEntry = resolve(pkgDir, "node_modules/tsx/dist/cli.mjs");
-  const tsxAvailable = existsSync(tsxEntry);
-
-  if (hasNpmLock && tsxAvailable) {
-    useSourceMode = true;
-    sourceRunner = "node";
-    sourceArgs = [tsxEntry, tsEntry, ...process.argv.slice(2)];
-  } else if (hasBunLock && hasBun()) {
+  if (existsSync(tsxEntry)) {
     useSourceMode = true;
-    sourceRunner = "bun";
-    sourceArgs = [tsEntry, ...process.argv.slice(2)];
-  } else if (tsxAvailable) {
-    useSourceMode = true;
-    sourceRunner = "node";
-    sourceArgs = [tsxEntry, tsEntry, ...process.argv.slice(2)];
+    runnerArgs = [tsxEntry, tsEntry, ...process.argv.slice(2)];
   }
 }
 
 if (!useSourceMode && !existsSync(jsEntry)) {
   console.error(`qmd is not built: missing ${jsEntry}`);
-  console.error("Run: bun install && bun run build");
+  console.error("Run: pnpm install && pnpm run build");
   console.error("Or:  npm install && npm run build");
   console.error("After building, run: qmd doctor");
   process.exit(1);
 }
 
-// Detect the package manager that installed dependencies by checking lockfiles.
-// $BUN_INSTALL is intentionally NOT checked — it only indicates that bun exists
-// on the system, not that it was used to install this package (see #361).
-//
-// package-lock.json takes priority: if it exists, npm installed the native
-// modules for Node. The repo ships bun.lock, so without this check, source
-// builds that use npm would be incorrectly routed to bun, causing ABI
-// mismatches with better-sqlite3 / sqlite-vec (see #381).
-//
-// Package-manager installs keep their lockfile at the install root, above
-// node_modules/ — never inside the package directory itself. A bun global
-// install writes $BUN_INSTALL/install/global/bun.lock while the package
-// lands in .../install/global/node_modules/@tobilu/qmd/, so the package-dir
-// checks below can't match and qmd would run under whatever node is first
-// on PATH. The native modules were built by the installing runtime; after
-// the next Node major upgrade they fail to load (ERR_DLOPEN_FAILED,
-// NODE_MODULE_VERSION mismatch). Apply the same npm-priority rule at the
-// install root when the package directory itself has no lockfile.
-const pathParts = pkgDir.split(sep);
-const nodeModulesIndex = pathParts.lastIndexOf("node_modules");
-const installRoot = nodeModulesIndex === -1 ? null : pathParts.slice(0, nodeModulesIndex).join(sep);
-const hasRootNpmLock = installRoot !== null && existsSync(resolve(installRoot, "package-lock.json"));
-const hasRootBunLock = installRoot !== null
-  && (existsSync(resolve(installRoot, "bun.lock")) || existsSync(resolve(installRoot, "bun.lockb")));
-
-let runnerName = "node";
-if (existsSync(resolve(pkgDir, "package-lock.json"))) {
-  runnerName = "node";
-} else if (existsSync(resolve(pkgDir, "bun.lock")) || existsSync(resolve(pkgDir, "bun.lockb"))) {
-  runnerName = "bun";
-} else if (hasRootNpmLock) {
-  runnerName = "node";
-} else if (hasRootBunLock) {
-  runnerName = "bun";
-} else {
-  runnerName = "node";
-}
-
-const selected = useSourceMode ? sourceRunner : (runnerName === "node" ? "node" : "bun");
 // Pin Node to the binary that launched this trampoline. Native addons
-// (better-sqlite3) are compiled for that install's ABI; spawning PATH
-// `node` picks up nvm/fnm/mise shims in the project directory and fails
-// with NODE_MODULE_VERSION / ERR_DLOPEN_FAILED (leftover from #577; #319).
-// If the trampoline itself is running under bun (`bun bin/qmd`), keep
-// PATH `node` so we don't load Node-ABI addons into bun.
-const runner = selected === "node" && typeof process.versions.bun !== "string"
-  ? process.execPath
-  : selected;
-const args = useSourceMode ? sourceArgs : [jsEntry, ...process.argv.slice(2)];
-const needsShell = (runner === "bun") && process.platform === "win32";
+// (better-sqlite3) are compiled for that install's ABI.
+const runner = process.execPath;
+const args = useSourceMode ? runnerArgs : [jsEntry, ...process.argv.slice(2)];
 
 const child = spawn(runner, args, {
   stdio: "inherit",
-  shell: needsShell,
 });
 
 child.on("exit", (code, signal) => {
@@ -186,7 +87,6 @@ child.on("exit", (code, signal) => {
 });
 
 child.on("error", (err) => {
-  const name = useSourceMode ? sourceRunner : runnerName;
-  console.error(`qmd: failed to launch ${name}: ${err.message}`);
+  console.error(`qmd: failed to launch node: ${err.message}`);
   process.exit(1);
 });

package/dist/ast.js

@@ -58,7 +58,7 @@ export function formatGrammarLoadError(language, err) {
     const grammar = GRAMMAR_MAP[language];
     const detail = err instanceof Error ? err.message : String(err);
     return `${grammar.pkg}/${grammar.wasm} failed to load (${detail}); falling back to regex chunking. ` +
-        `Repair a broken global install with: bun add ${grammar.pkg}@${grammar.version}`;
+        `Repair a broken global install with: pnpm add ${grammar.pkg}@${grammar.version}`;
 }
 // =============================================================================
 // Per-Language Query Definitions

package/dist/cli/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "f7e2cfc",
-  "builtAt": "2026-08-23T03:21:48.505Z"
+  "commit": "7cbc570",
+  "builtAt": "2026-08-28T11:16:06.495Z"
 }

package/dist/cli/qmd.d.ts

@@ -37,7 +37,7 @@ type FinishSuccessfulCliCommandOptions = {
  * order, and the process exits cleanly. The `GGML_METAL_NO_RESIDENCY=1` env
  * var that `bin/qmd` exports is a defense-in-depth safety net for paths
  * that still call `process.exit()` after loading the native binding
- * (signal handlers, error paths, `bun test`).
+ * (signal handlers, error paths, test runners).
  *
  * If the caller passes an explicit `exit` for testability, we honor it —
  * the lifecycle tests verify the legacy flush → cleanup → exit ordering.

package/dist/cli/qmd.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { isBun, openDatabase, loadSqliteVec } from "../db.js";
+import { openDatabase, loadSqliteVec } from "../db.js";
 import fastGlob from "fast-glob";
 import { spawn as nodeSpawn } from "child_process";
 import { isQmdMcpPid, mcpDaemonStateFiles } from "./mcp-pid.js";
@@ -270,7 +270,7 @@ async function flushWritable(stream) {
  * order, and the process exits cleanly. The `GGML_METAL_NO_RESIDENCY=1` env
  * var that `bin/qmd` exports is a defense-in-depth safety net for paths
  * that still call `process.exit()` after loading the native binding
- * (signal handlers, error paths, `bun test`).
+ * (signal handlers, error paths, test runners).
  *
  * If the caller passes an explicit `exit` for testability, we honor it —
  * the lifecycle tests verify the legacy flush → cleanup → exit ordering.
@@ -2674,6 +2674,7 @@ async function vectorSearch(query, opts, _model = DEFAULT_EMBED_MODEL) {
             limit: opts.all ? 500 : (opts.limit || 10),
             minScore: opts.minScore || 0.3,
             expansionContext: opts.intent,
+            includeHyde: opts.includeHyde,
             hooks: {
                 onExpand: (original, expanded) => {
                     logExpansionTree(original, expanded);
@@ -2766,6 +2767,7 @@ async function querySearch(query, opts, _embedModel = DEFAULT_EMBED_MODEL, _rera
                 explain: !!opts.explain,
                 rerankContext: intent,
                 expansion: opts.expansion,
+                includeHyde: opts.includeHyde,
                 chunkStrategy: opts.chunkStrategy,
                 hooks: {
                     onExpansionDecision: (decision) => {
@@ -2884,6 +2886,7 @@ function parseCLI() {
             // Query options
             "candidate-limit": { type: "string", short: "C" },
             "no-rerank": { type: "boolean", default: false },
+            "no-hyde": { type: "boolean", default: false },
             expand: { type: "boolean", default: false },
             "no-gpu": { type: "boolean", default: false },
             intent: { type: "string" },
@@ -2960,6 +2963,7 @@ function parseCLI() {
         lineNumbers: !!values["line-numbers"],
         candidateLimit: values["candidate-limit"] ? parseInt(String(values["candidate-limit"]), 10) : undefined,
         skipRerank: !!values["no-rerank"],
+        includeHyde: !values["no-hyde"],
         explain: !!values.explain,
         intent: values.intent,
         expansion: values.expand ? "force" : "auto",
@@ -3459,6 +3463,7 @@ function showHelp() {
     console.log("  --chunk-strategy <auto|regex> - Chunking mode (default: regex; auto uses AST for code files)");
     console.log("  --timeout <minutes>          - Embed session cap in minutes (0 = no limit; default 30)");
     console.log("  --expand                    - Force query expansion (auto is the default; lex: skips)");
+    console.log("  --no-hyde                   - Disable HyDE (hypothetical document) in query expansion");
     console.log("");
     console.log("Embedding providers & disclosure:");
     console.log("  - Local embedding is the default. OpenAI requires explicit provider configuration and OPENAI_API_KEY.");
@@ -3933,7 +3938,7 @@ async function showDoctor() {
     const nextSteps = [];
     console.log(`${c.bold}QMD Doctor${c.reset}\n`);
     console.log(`Index: ${getDbPath()}`);
-    console.log(`Runtime: ${isBun ? "bun:sqlite" : "better-sqlite3"}`);
+    console.log(`Runtime: better-sqlite3`);
     try {
         const row = db.prepare(`SELECT sqlite_version() AS version`).get();
         doctorCheck("SQLite runtime", true, row.version);
@@ -4632,11 +4637,8 @@ if (isMain) {
                     const selfPath = fileURLToPath(import.meta.url);
                     const indexArgs = cli.values.index ? ["--index", String(cli.values.index)] : [];
                     const hostArgs = host ? ["--host", host] : [];
-                    const isBunRuntime = typeof process.versions.bun === "string";
                     const spawnArgs = selfPath.endsWith(".ts")
-                        ? isBunRuntime
-                            ? [selfPath, ...indexArgs, "mcp", "--http", "--port", String(port), ...hostArgs]
-                            : ["--import", pathJoin(dirname(selfPath), "..", "..", "node_modules", "tsx", "dist", "esm", "index.mjs"), selfPath, ...indexArgs, "mcp", "--http", "--port", String(port), ...hostArgs]
+                        ? ["--import", pathJoin(dirname(selfPath), "..", "..", "node_modules", "tsx", "dist", "esm", "index.mjs"), selfPath, ...indexArgs, "mcp", "--http", "--port", String(port), ...hostArgs]
                         : [selfPath, ...indexArgs, "mcp", "--http", "--port", String(port), ...hostArgs];
                     const child = nodeSpawn(process.execPath, spawnArgs, {
                         stdio: ["ignore", logFd, logFd],

package/dist/db.d.ts

@@ -1,27 +1,19 @@
 /**
- * db.ts - Cross-runtime SQLite compatibility layer
+ * db.ts - SQLite database connection and extension management
  *
- * Provides a unified Database export that works under both Bun (bun:sqlite)
- * and Node.js (better-sqlite3). The APIs are nearly identical — the main
- * difference is the import path.
- *
- * On macOS, Apple's system SQLite is compiled with SQLITE_OMIT_LOAD_EXTENSION,
- * which prevents loading native extensions like sqlite-vec. When running under
- * Bun we call Database.setCustomSQLite() to swap in Homebrew's full-featured
- * SQLite build before creating any database instances.
+ * Provides Database export and connection management using better-sqlite3
+ * and sqlite-vec.
  */
-export declare const isBun: boolean;
+import BetterSqlite3 from "better-sqlite3";
 export type SQLiteValue = string | number | bigint | Buffer | Uint8Array | Float32Array | null;
 export type SQLiteParams = readonly SQLiteValue[];
 /**
- * Open a SQLite database. Works with both bun:sqlite and better-sqlite3.
+ * Open a SQLite database using better-sqlite3.
  *
- * `bun:sqlite` and `better-sqlite3` both default `busy_timeout` to 0, so
- * concurrent writers throw `SQLITE_BUSY` instead of waiting. WAL improves
- * read-while-write concurrency but does not serialise writers. Setting the
- * timeout at connection open makes parallel processes (e.g. an `update` or
- * `query` racing a long `embed`, or a first-open schema migration racing any
- * routine command) queue at batch boundaries instead of failing on contact.
+ * `better-sqlite3` defaults `busy_timeout` to 0, so concurrent writers throw
+ * `SQLITE_BUSY` instead of waiting. WAL improves read-while-write concurrency
+ * but does not serialise writers. Setting the timeout at connection open makes
+ * parallel processes queue at batch boundaries instead of failing on contact.
  *
  * WAL is enabled here too (with a bounded retry) so connection-level pragmas
  * live in one place and the cold-database journal migration survives concurrent
@@ -29,37 +21,19 @@ export type SQLiteParams = readonly SQLiteValue[];
  *
  * Default 120_000 ms outlasts the worst-case batch commit on a multi-GB
  * index. Override with `QMD_SQLITE_BUSY_TIMEOUT` (value in milliseconds; `0`
- * restores the upstream fail-fast behaviour). See
- * https://bun.sh/docs/api/sqlite#busy-timeout.
+ * restores the upstream fail-fast behaviour).
  */
 export declare function openDatabase(path: string): Database;
 /** Open an existing database without changing journal mode, schema, or user data. */
 export declare function openReadOnlyDatabase(path: string): Database;
 /**
- * Common subset of the Database interface used throughout QMD.
+ * Database and Statement types used throughout QMD.
  */
-export interface Database {
-    exec(sql: string): void;
-    prepare(sql: string): Statement;
-    loadExtension(path: string): void;
-    transaction<T extends (...args: SQLiteValue[]) => unknown>(fn: T): T & {
-        immediate: T;
-    };
-    close(): void;
-}
-export interface Statement {
-    run(...params: SQLiteValue[]): {
-        changes: number;
-        lastInsertRowid: number | bigint;
-    };
-    get<T = unknown>(...params: SQLiteValue[]): T | undefined;
-    all<T = unknown>(...params: SQLiteValue[]): T[];
-    iterate<T = unknown>(...params: SQLiteValue[]): IterableIterator<T>;
-}
+export type Database = BetterSqlite3.Database;
+export type Statement<T extends SQLiteParams = SQLiteParams> = BetterSqlite3.Statement<T>;
 /**
  * Load the sqlite-vec extension into a database.
  *
- * Throws with platform-specific fix instructions when the extension is
- * unavailable.
+ * Throws with fix instructions when the extension is unavailable.
  */
 export declare function loadSqliteVec(db: Database): void;