dirsql 0.3.58__tar.gz → 0.3.59__tar.gz

{dirsql-0.3.58 → dirsql-0.3.59}/Cargo.lock

@@ -500,7 +500,7 @@ dependencies = [
 
 [[package]]
 name = "dirsql-py-ext"
-version = "0.3.58"
+version = "0.3.59"
 dependencies = [
  "dirsql",
  "pyo3",

{dirsql-0.3.58 → dirsql-0.3.59}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dirsql
-Version: 0.3.58
+Version: 0.3.59
 Requires-Dist: pytest>=8 ; extra == 'dev'
 Requires-Dist: pytest-describe>=2 ; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23 ; extra == 'dev'

{dirsql-0.3.58 → dirsql-0.3.59}/docs/cli/config.md

@@ -244,6 +244,13 @@ file is skipped (it contributes no rows) and a one-line warning naming the file
 and the error is written to stderr. One bad file never aborts the scan; the
 other files' rows are indexed normally.
 
+**Timeout.** Each run is bounded by the default 30-second timeout. When a
+command legitimately needs longer — it downloads a model on first run, or calls
+a rate-limited API — raise the bound with the global
+[`[dirsql].hook-timeout`](#command-execution) key (positive whole seconds). A
+run exceeding the bound is killed and handled with the per-file error isolation
+above (the file is skipped with a stderr warning).
+
 See [Command execution](#command-execution) for the full contract (argv
 splitting, injection safety, cwd, environment, timeout, and output framing).
 
@@ -279,7 +286,8 @@ key and the `{"sql": …}` contract returns.
 **On failure** — a non-zero exit, a timeout, or a spawn error — the request
 returns `500 Internal Server Error` with the command's stderr tail in the JSON
 `error` body. The command runs in the config file's directory and is bounded by
-a fixed **30-second** timeout.
+a **30-second** timeout by default; a slow translator (e.g. LLM-backed) can
+raise it with the global [`[dirsql].hook-timeout`](#command-execution) key.
 
 #### The hook owns SQL safety
 
@@ -361,7 +369,8 @@ returns.
 **On failure** — a non-zero exit, a timeout, or a spawn error — the request
 returns `500 Internal Server Error` with the command's stderr tail in the JSON
 `error` body. The command runs in the config file's directory and is bounded by
-a fixed **30-second** timeout.
+a **30-second** timeout by default; raise it with the global
+[`[dirsql].hook-timeout`](#command-execution) key.
 
 See [Command execution](#command-execution) for the full contract (argv
 splitting, injection safety, cwd, environment, timeout, and output framing).
@@ -409,9 +418,18 @@ Config keys that run an external command — today `on-file`, `pre-query`, and
 - **Output framing.** The command's result is the **last non-empty line of
   stdout**; any log/chatter lines above it are ignored. stderr is never data —
   it is captured only to enrich error messages.
-- **Timeout.** Each command run is bounded by a fixed **30-second** timeout (no
-  per-table override yet); a command that exceeds it is killed and treated as a
-  failure.
+- **Timeout.** Each command run is bounded by a **30-second** timeout by
+  default; a command that exceeds it is killed and treated as a failure. Raise
+  (or tighten) it for **all** hooks — `on-file`, `pre-query`, and `post-query`
+  alike — with a single global `[dirsql].hook-timeout` key, in positive whole
+  seconds:
+
+  ```toml
+  [dirsql]
+  hook-timeout = 300
+  ```
+
+  Zero and negative values are rejected as a config error.
 - **Errors.** A non-zero exit, a timeout, a spawn failure, or output that does
   not parse as expected is a per-file failure: the file is skipped with a
   stderr warning and the scan continues.

{dirsql-0.3.58 → dirsql-0.3.59}/packages/python/Cargo.toml

@@ -4,7 +4,7 @@ name = "dirsql-py-ext"
 # pypi/maturin handler can rewrite it via `write-version` before
 # `maturin build`. `pyproject.toml` declares `dynamic = ["version"]`
 # and maturin reads this field. Mirrors `packages/rust/Cargo.toml`.
-version = "0.3.58"
+version = "0.3.59"
 edition.workspace = true
 publish = false
 readme = "README.md"

{dirsql-0.3.58/packages/rust → dirsql-0.3.59/packages/python}/docs/cli/config.md

@@ -244,6 +244,13 @@ file is skipped (it contributes no rows) and a one-line warning naming the file
 and the error is written to stderr. One bad file never aborts the scan; the
 other files' rows are indexed normally.
 
+**Timeout.** Each run is bounded by the default 30-second timeout. When a
+command legitimately needs longer — it downloads a model on first run, or calls
+a rate-limited API — raise the bound with the global
+[`[dirsql].hook-timeout`](#command-execution) key (positive whole seconds). A
+run exceeding the bound is killed and handled with the per-file error isolation
+above (the file is skipped with a stderr warning).
+
 See [Command execution](#command-execution) for the full contract (argv
 splitting, injection safety, cwd, environment, timeout, and output framing).
 
@@ -279,7 +286,8 @@ key and the `{"sql": …}` contract returns.
 **On failure** — a non-zero exit, a timeout, or a spawn error — the request
 returns `500 Internal Server Error` with the command's stderr tail in the JSON
 `error` body. The command runs in the config file's directory and is bounded by
-a fixed **30-second** timeout.
+a **30-second** timeout by default; a slow translator (e.g. LLM-backed) can
+raise it with the global [`[dirsql].hook-timeout`](#command-execution) key.
 
 #### The hook owns SQL safety
 
@@ -361,7 +369,8 @@ returns.
 **On failure** — a non-zero exit, a timeout, or a spawn error — the request
 returns `500 Internal Server Error` with the command's stderr tail in the JSON
 `error` body. The command runs in the config file's directory and is bounded by
-a fixed **30-second** timeout.
+a **30-second** timeout by default; raise it with the global
+[`[dirsql].hook-timeout`](#command-execution) key.
 
 See [Command execution](#command-execution) for the full contract (argv
 splitting, injection safety, cwd, environment, timeout, and output framing).
@@ -409,9 +418,18 @@ Config keys that run an external command — today `on-file`, `pre-query`, and
 - **Output framing.** The command's result is the **last non-empty line of
   stdout**; any log/chatter lines above it are ignored. stderr is never data —
   it is captured only to enrich error messages.
-- **Timeout.** Each command run is bounded by a fixed **30-second** timeout (no
-  per-table override yet); a command that exceeds it is killed and treated as a
-  failure.
+- **Timeout.** Each command run is bounded by a **30-second** timeout by
+  default; a command that exceeds it is killed and treated as a failure. Raise
+  (or tighten) it for **all** hooks — `on-file`, `pre-query`, and `post-query`
+  alike — with a single global `[dirsql].hook-timeout` key, in positive whole
+  seconds:
+
+  ```toml
+  [dirsql]
+  hook-timeout = 300
+  ```
+
+  Zero and negative values are rejected as a config error.
 - **Errors.** A non-zero exit, a timeout, a spawn failure, or output that does
   not parse as expected is a per-file failure: the file is skipped with a
   stderr warning and the scan continues.

{dirsql-0.3.58 → dirsql-0.3.59}/packages/python/e2e-attestation.json

@@ -1,6 +1,6 @@
 {
   "command": "uv run python -m pytest tests/e2e/ -x -q",
-  "ran_at": 1783118080,
+  "ran_at": 1783120355,
   "exit_code": 0,
-  "commit": "b45791b9ad04fbac360618f3ff885e5f84a8289e"
+  "commit": "c460b738d83c83b4c76b10cd967e3641cbe35c7c"
 }

{dirsql-0.3.58/packages/python → dirsql-0.3.59/packages/rust}/docs/cli/config.md

@@ -244,6 +244,13 @@ file is skipped (it contributes no rows) and a one-line warning naming the file
 and the error is written to stderr. One bad file never aborts the scan; the
 other files' rows are indexed normally.
 
+**Timeout.** Each run is bounded by the default 30-second timeout. When a
+command legitimately needs longer — it downloads a model on first run, or calls
+a rate-limited API — raise the bound with the global
+[`[dirsql].hook-timeout`](#command-execution) key (positive whole seconds). A
+run exceeding the bound is killed and handled with the per-file error isolation
+above (the file is skipped with a stderr warning).
+
 See [Command execution](#command-execution) for the full contract (argv
 splitting, injection safety, cwd, environment, timeout, and output framing).
 
@@ -279,7 +286,8 @@ key and the `{"sql": …}` contract returns.
 **On failure** — a non-zero exit, a timeout, or a spawn error — the request
 returns `500 Internal Server Error` with the command's stderr tail in the JSON
 `error` body. The command runs in the config file's directory and is bounded by
-a fixed **30-second** timeout.
+a **30-second** timeout by default; a slow translator (e.g. LLM-backed) can
+raise it with the global [`[dirsql].hook-timeout`](#command-execution) key.
 
 #### The hook owns SQL safety
 
@@ -361,7 +369,8 @@ returns.
 **On failure** — a non-zero exit, a timeout, or a spawn error — the request
 returns `500 Internal Server Error` with the command's stderr tail in the JSON
 `error` body. The command runs in the config file's directory and is bounded by
-a fixed **30-second** timeout.
+a **30-second** timeout by default; raise it with the global
+[`[dirsql].hook-timeout`](#command-execution) key.
 
 See [Command execution](#command-execution) for the full contract (argv
 splitting, injection safety, cwd, environment, timeout, and output framing).
@@ -409,9 +418,18 @@ Config keys that run an external command — today `on-file`, `pre-query`, and
 - **Output framing.** The command's result is the **last non-empty line of
   stdout**; any log/chatter lines above it are ignored. stderr is never data —
   it is captured only to enrich error messages.
-- **Timeout.** Each command run is bounded by a fixed **30-second** timeout (no
-  per-table override yet); a command that exceeds it is killed and treated as a
-  failure.
+- **Timeout.** Each command run is bounded by a **30-second** timeout by
+  default; a command that exceeds it is killed and treated as a failure. Raise
+  (or tighten) it for **all** hooks — `on-file`, `pre-query`, and `post-query`
+  alike — with a single global `[dirsql].hook-timeout` key, in positive whole
+  seconds:
+
+  ```toml
+  [dirsql]
+  hook-timeout = 300
+  ```
+
+  Zero and negative values are rejected as a config error.
 - **Errors.** A non-zero exit, a timeout, a spawn failure, or output that does
   not parse as expected is a per-file failure: the file is skipped with a
   stderr warning and the scan continues.

{dirsql-0.3.58 → dirsql-0.3.59}/packages/rust/src/bin/dirsql.rs

@@ -228,9 +228,14 @@ fn load_pre_query(cli: &Cli) -> Option<PreQuery> {
         return None;
     }
     let resolved = config_path.canonicalize().ok()?;
-    let command = dirsql::config::load_config(&resolved).ok()?.pre_query?;
+    let config = dirsql::config::load_config(&resolved).ok()?;
+    let command = config.pre_query?;
     let config_dir = resolved.parent()?.to_path_buf();
-    Some(PreQuery::new(command, config_dir))
+    let mut pre_query = PreQuery::new(command, config_dir);
+    if let Some(timeout) = config.hook_timeout {
+        pre_query = pre_query.with_timeout(timeout);
+    }
+    Some(pre_query)
 }
 
 /// Extract the server-wide `post-query` hook from the config, if any.
@@ -245,9 +250,14 @@ fn load_post_query(cli: &Cli) -> Option<PostQuery> {
         return None;
     }
     let resolved = config_path.canonicalize().ok()?;
-    let command = dirsql::config::load_config(&resolved).ok()?.post_query?;
+    let config = dirsql::config::load_config(&resolved).ok()?;
+    let command = config.post_query?;
     let config_dir = resolved.parent()?.to_path_buf();
-    Some(PostQuery::new(command, config_dir))
+    let mut post_query = PostQuery::new(command, config_dir);
+    if let Some(timeout) = config.hook_timeout {
+        post_query = post_query.with_timeout(timeout);
+    }
+    Some(post_query)
 }
 
 /// Zero-config fallback. When no `.dirsql.toml` is found, dirsql indexes the

{dirsql-0.3.58 → dirsql-0.3.59}/packages/rust/src/cli/mod.rs

@@ -27,6 +27,7 @@ use tokio::task::JoinError;
 use tokio::task::JoinHandle;
 
 use crate::DirSQL;
+use crate::command::DEFAULT_COMMAND_TIMEOUT;
 
 pub mod init;
 pub mod router;
@@ -51,16 +52,29 @@ pub struct PreQuery {
     pub command: String,
     /// The command's working directory — the config file's parent.
     pub config_dir: PathBuf,
+    /// Per-run timeout. Defaults to the shared 30-second
+    /// [`DEFAULT_COMMAND_TIMEOUT`]; override it via [`Self::with_timeout`]
+    /// (the CLI wires the global `[dirsql].hook-timeout` here, #351).
+    pub timeout: Duration,
 }
 
 impl PreQuery {
-    /// Build a [`PreQuery`] from a command template and its working directory.
+    /// Build a [`PreQuery`] from a command template and its working directory,
+    /// with the default 30-second timeout.
     pub fn new(command: impl Into<String>, config_dir: impl Into<PathBuf>) -> Self {
         Self {
             command: command.into(),
             config_dir: config_dir.into(),
+            timeout: DEFAULT_COMMAND_TIMEOUT,
         }
     }
+
+    /// Override the per-run timeout (from the global `[dirsql].hook-timeout`).
+    /// A run exceeding it is killed and the request returns 500.
+    pub fn with_timeout(mut self, timeout: Duration) -> Self {
+        self.timeout = timeout;
+        self
+    }
 }
 
 /// A server-wide `post-query` command hook, carrying the command template plus
@@ -76,16 +90,29 @@ pub struct PostQuery {
     pub command: String,
     /// The command's working directory — the config file's parent.
     pub config_dir: PathBuf,
+    /// Per-run timeout. Defaults to the shared 30-second
+    /// [`DEFAULT_COMMAND_TIMEOUT`]; override it via [`Self::with_timeout`]
+    /// (the CLI wires the global `[dirsql].hook-timeout` here, #351).
+    pub timeout: Duration,
 }
 
 impl PostQuery {
-    /// Build a [`PostQuery`] from a command template and its working directory.
+    /// Build a [`PostQuery`] from a command template and its working directory,
+    /// with the default 30-second timeout.
     pub fn new(command: impl Into<String>, config_dir: impl Into<PathBuf>) -> Self {
         Self {
             command: command.into(),
             config_dir: config_dir.into(),
+            timeout: DEFAULT_COMMAND_TIMEOUT,
         }
     }
+
+    /// Override the per-run timeout (from the global `[dirsql].hook-timeout`).
+    /// A run exceeding it is killed and the request returns 500.
+    pub fn with_timeout(mut self, timeout: Duration) -> Self {
+        self.timeout = timeout;
+        self
+    }
 }
 
 /// Configure how the server binds. Defaults to `localhost:7117` with a
@@ -258,10 +285,17 @@ mod tests {
     #[test]
     fn pre_query_constructor_carries_command_and_dir() {
         // `PreQuery::new` is pure data plumbing: the command template and the
-        // working directory it will run in.
+        // working directory it will run in, with the shared default timeout.
         let pq = PreQuery::new("to_sql.py {args}", "/proj");
         assert_eq!(pq.command, "to_sql.py {args}");
         assert_eq!(pq.config_dir, PathBuf::from("/proj"));
+        assert_eq!(pq.timeout, Duration::from_secs(30));
+    }
+
+    #[test]
+    fn pre_query_with_timeout_overrides_the_default() {
+        let pq = PreQuery::new("cmd {args}", "/proj").with_timeout(Duration::from_secs(60));
+        assert_eq!(pq.timeout, Duration::from_secs(60));
     }
 
     #[test]
@@ -275,10 +309,17 @@ mod tests {
     #[test]
     fn post_query_constructor_carries_command_and_dir() {
         // `PostQuery::new` is pure data plumbing: the command template and the
-        // working directory it will run in.
+        // working directory it will run in, with the shared default timeout.
         let pq = PostQuery::new("jq '{results: .}'", "/proj");
         assert_eq!(pq.command, "jq '{results: .}'");
         assert_eq!(pq.config_dir, PathBuf::from("/proj"));
+        assert_eq!(pq.timeout, Duration::from_secs(30));
+    }
+
+    #[test]
+    fn post_query_with_timeout_overrides_the_default() {
+        let pq = PostQuery::new("reshape {args}", "/proj").with_timeout(Duration::from_secs(60));
+        assert_eq!(pq.timeout, Duration::from_secs(60));
     }
 
     #[test]

{dirsql-0.3.58 → dirsql-0.3.59}/packages/rust/src/cli/router.rs

@@ -21,15 +21,6 @@ use super::{AppState, PostQuery, PreQuery};
 use crate::command::{Placeholder, run_command};
 use crate::{DirSQL, DirSqlError};
 
-/// Fixed timeout for a server-wide `pre-query` command. There is no override
-/// key yet; this module constant is the documented current default (mirrors
-/// `on-file`'s `ON_FILE_TIMEOUT`).
-const PRE_QUERY_TIMEOUT: Duration = Duration::from_secs(30);
-
-/// Fixed timeout for a server-wide `post-query` command (mirrors
-/// `PRE_QUERY_TIMEOUT`).
-const POST_QUERY_TIMEOUT: Duration = Duration::from_secs(30);
-
 /// Cap on the serialized result payload passed as the `{args}` argv token.
 /// Beyond this, `{args}` is emptied and the operator is directed to stdin
 /// (which always carries the full payload) — comfortably under Linux's 128 KiB
@@ -155,15 +146,17 @@ fn parse_sql_body(body: &str) -> Result<String, Response> {
 async fn run_pre_query(pq: &PreQuery, raw_body: String) -> Result<String, Response> {
     let command = pq.command.clone();
     let config_dir = pq.config_dir.clone();
+    let timeout = pq.timeout;
     // `run_command` is blocking — it spawns a child and joins drain threads —
-    // so run it off the async runtime. It enforces `PRE_QUERY_TIMEOUT`
-    // internally, so no outer `tokio::time::timeout` is needed.
+    // so run it off the async runtime. It enforces the hook's timeout
+    // (the global `[dirsql].hook-timeout`, default 30s) internally, so no outer
+    // `tokio::time::timeout` is needed.
     let outcome = tokio::task::spawn_blocking(move || {
         run_command(
             &command,
             &[Placeholder::new("args", &raw_body)],
             &config_dir,
-            PRE_QUERY_TIMEOUT,
+            timeout,
             None,
         )
     })
@@ -198,9 +191,11 @@ async fn run_post_query(
         .map_err(|err| error_response(StatusCode::INTERNAL_SERVER_ERROR, err.to_string()))?;
     let command = pq.command.clone();
     let config_dir = pq.config_dir.clone();
+    let timeout = pq.timeout;
     // `run_command` is blocking — it spawns a child and joins drain threads —
-    // so run it off the async runtime. It enforces `POST_QUERY_TIMEOUT`
-    // internally, so no outer `tokio::time::timeout` is needed.
+    // so run it off the async runtime. It enforces the hook's timeout
+    // (the global `[dirsql].hook-timeout`, default 30s) internally, so no outer
+    // `tokio::time::timeout` is needed.
     let outcome = tokio::task::spawn_blocking(move || {
         let args_value = if payload.len() <= POST_QUERY_ARGS_MAX {
             payload.clone()
@@ -217,7 +212,7 @@ async fn run_post_query(
             &command,
             &[Placeholder::new("args", &args_value)],
             &config_dir,
-            POST_QUERY_TIMEOUT,
+            timeout,
             Some(payload.as_bytes()),
         )
     })

{dirsql-0.3.58 → dirsql-0.3.59}/packages/rust/src/command.rs

@@ -36,6 +36,11 @@ use std::time::Duration;
 
 use wait_timeout::ChildExt;
 
+/// The default timeout for every command-backed event (`on-file`,
+/// `pre-query`, `post-query`) when the config declares no override
+/// (`[dirsql].hook-timeout`, positive whole seconds).
+pub const DEFAULT_COMMAND_TIMEOUT: Duration = Duration::from_secs(30);
+
 /// A named placeholder substituted into a command's argv.
 ///
 /// `name` is the bare identifier (no braces): a `name` of `path` matches the

{dirsql-0.3.58 → dirsql-0.3.59}/packages/rust/src/config.rs

@@ -1,4 +1,5 @@
 use std::path::{Path, PathBuf};
+use std::time::Duration;
 
 use serde::Deserialize;
 
@@ -20,6 +21,9 @@ pub enum ConfigError {
     #[error("Field '{0}' must not be empty")]
     EmptyField(&'static str),
 
+    #[error("Field '{field}' must be a positive number of seconds, got {value}")]
+    InvalidTimeout { field: &'static str, value: i64 },
+
     #[error("Cannot combine an empty list of configs")]
     NoConfigs,
 
@@ -70,7 +74,7 @@ impl std::fmt::Display for Source {
 /// returned unchanged. List-shaped config (`[[table]]`, `[[dirsql.extension]]`,
 /// `ignore`) concatenates in input order. A table-name collision anywhere in
 /// the combined set errors, naming both sources. Single-valued keys (`root`,
-/// `persist`, `persist_path`, `pre-query`, `post-query`) defined by more than
+/// `persist`, `persist_path`, `pre-query`, `post-query`, `hook-timeout`) defined by more than
 /// one config error, naming both sources — no silent shadowing, no precedence;
 /// defined in exactly one config they merge through unchanged. (`persist`
 /// counts as defined only when `true`: the parsed [`Config`] cannot
@@ -100,6 +104,7 @@ pub fn combine_configs(configs: &[(Source, Config)]) -> Result<Config> {
     let mut persist_path: Option<(&Source, PathBuf)> = None;
     let mut pre_query: Option<(&Source, String)> = None;
     let mut post_query: Option<(&Source, String)> = None;
+    let mut hook_timeout: Option<(&Source, Duration)> = None;
 
     for (source, config) in configs {
         for table in &config.tables {
@@ -136,6 +141,12 @@ pub fn combine_configs(configs: &[(Source, Config)]) -> Result<Config> {
             config.post_query.as_ref(),
             source,
         )?;
+        merge_single(
+            "hook-timeout",
+            &mut hook_timeout,
+            config.hook_timeout.as_ref(),
+            source,
+        )?;
         if config.persist {
             if let Some(prior) = persist {
                 return Err(ConfigError::ConflictingKey {
@@ -157,6 +168,7 @@ pub fn combine_configs(configs: &[(Source, Config)]) -> Result<Config> {
         extensions,
         pre_query: pre_query.map(|(_, value)| value),
         post_query: post_query.map(|(_, value)| value),
+        hook_timeout: hook_timeout.map(|(_, value)| value),
     })
 }
 
@@ -216,6 +228,11 @@ pub struct Config {
     /// the rows as-is. See `dirsql::command` for the execution contract. Only
     /// the CLI server consults this; the SDK ignores it.
     pub post_query: Option<String>,
+    /// Optional timeout for every command-backed hook — `on-file`, `pre-query`,
+    /// and `post-query` alike (`[dirsql].hook-timeout`, positive seconds). One
+    /// global bound rather than a per-hook knob. When absent, hooks fall back to
+    /// the shared 30-second default ([`crate::command::DEFAULT_COMMAND_TIMEOUT`]).
+    pub hook_timeout: Option<Duration>,
 }
 
 /// A SQLite extension to load at startup.
@@ -265,7 +282,7 @@ struct RawConfig {
     table: Option<Vec<RawTable>>,
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Default)]
 struct RawDirsql {
     root: Option<PathBuf>,
     ignore: Option<Vec<String>>,
@@ -276,6 +293,8 @@ struct RawDirsql {
     pre_query: Option<String>,
     #[serde(rename = "post-query")]
     post_query: Option<String>,
+    #[serde(rename = "hook-timeout")]
+    hook_timeout: Option<i64>,
 }
 
 #[derive(Deserialize)]
@@ -303,19 +322,16 @@ pub fn load_config(path: &Path) -> Result<Config> {
 pub fn load_config_str(content: &str) -> Result<Config> {
     let raw: RawConfig = toml::from_str(content)?;
 
-    let (root, ignore, persist, persist_path, raw_extensions, raw_pre_query, raw_post_query) =
-        match raw.dirsql {
-            Some(d) => (
-                d.root,
-                d.ignore.unwrap_or_default(),
-                d.persist.unwrap_or(false),
-                d.persist_path,
-                d.extension.unwrap_or_default(),
-                d.pre_query,
-                d.post_query,
-            ),
-            None => (None, Vec::new(), false, None, Vec::new(), None, None),
-        };
+    // A missing `[dirsql]` section behaves as an all-defaults one.
+    let d = raw.dirsql.unwrap_or_default();
+    let root = d.root;
+    let ignore = d.ignore.unwrap_or_default();
+    let persist = d.persist.unwrap_or(false);
+    let persist_path = d.persist_path;
+    let raw_extensions = d.extension.unwrap_or_default();
+    let raw_pre_query = d.pre_query;
+    let raw_post_query = d.post_query;
+    let hook_timeout = parse_timeout_secs("hook-timeout", d.hook_timeout)?;
 
     // A present-but-empty `pre-query = ""` is as unusable as a missing key:
     // reject it at parse time rather than spawning an empty command later
@@ -384,9 +400,23 @@ pub fn load_config_str(content: &str) -> Result<Config> {
         extensions,
         pre_query,
         post_query,
+        hook_timeout,
     })
 }
 
+/// Validate an optional timeout config value (whole seconds) and convert it
+/// to a [`Duration`]. Zero and negative values are as unusable as a garbage
+/// string — reject them at parse time with the offending field's name rather
+/// than silently producing a command that can never run (`0`) or a bogus
+/// cast (negative).
+fn parse_timeout_secs(field: &'static str, raw: Option<i64>) -> Result<Option<Duration>> {
+    match raw {
+        Some(secs) if secs <= 0 => Err(ConfigError::InvalidTimeout { field, value: secs }),
+        Some(secs) => Ok(Some(Duration::from_secs(secs as u64))),
+        None => Ok(None),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1141,6 +1171,79 @@ glob = "c/*.json"
         );
     }
 
+    #[test]
+    fn hook_timeout_parses_to_duration_seconds() {
+        let toml = r#"
+[dirsql]
+hook-timeout = 300
+"#;
+        let config = load_config_str(toml).unwrap();
+        assert_eq!(config.hook_timeout, Some(Duration::from_secs(300)));
+    }
+
+    #[test]
+    fn hook_timeout_absent_is_none() {
+        let toml = r#"
+[[table]]
+ddl = "CREATE TABLE t (x TEXT)"
+glob = "*.json"
+"#;
+        let config = load_config_str(toml).unwrap();
+        assert!(config.hook_timeout.is_none());
+    }
+
+    #[test]
+    fn hook_timeout_zero_errors() {
+        let toml = r#"
+[dirsql]
+hook-timeout = 0
+"#;
+        let err = load_config_str(toml).unwrap_err();
+        assert!(
+            matches!(
+                err,
+                ConfigError::InvalidTimeout {
+                    field: "hook-timeout",
+                    value: 0
+                }
+            ),
+            "got: {err:?}"
+        );
+    }
+
+    #[test]
+    fn hook_timeout_negative_errors() {
+        let toml = r#"
+[dirsql]
+hook-timeout = -5
+"#;
+        let err = load_config_str(toml).unwrap_err();
+        assert!(
+            matches!(
+                err,
+                ConfigError::InvalidTimeout {
+                    field: "hook-timeout",
+                    value: -5
+                }
+            ),
+            "got: {err:?}"
+        );
+    }
+
+    #[test]
+    fn invalid_timeout_error_names_the_field_and_value() {
+        // The message is the user's only pointer to the bad key — it must name
+        // both the field and the offending value.
+        let err = ConfigError::InvalidTimeout {
+            field: "hook-timeout",
+            value: -1,
+        };
+        assert_eq!(
+            err.to_string(),
+            "Field 'hook-timeout' must be a positive number of seconds, got -1"
+        );
+    }
+
     #[test]
     fn extension_empty_path_errors() {
         // An empty `path = ""` is as unusable as a missing key — it must be

{dirsql-0.3.58 → dirsql-0.3.59}/packages/rust/src/lib.rs

@@ -1457,10 +1457,6 @@ fn relative_path(root: &Path, path: &Path) -> String {
         .to_string()
 }
 
-/// Fixed timeout for an `on-file` command. There is no per-table timeout key
-/// yet (#327); this module constant is the documented current default.
-const ON_FILE_TIMEOUT: Duration = Duration::from_secs(30);
-
 /// Build [`Table`] objects from a parsed config.
 ///
 /// A plain config-defined table produces one row per matched file built
@@ -1475,13 +1471,17 @@ const ON_FILE_TIMEOUT: Duration = Duration::from_secs(30);
 /// array of row objects on stdout, which becomes the file's rows (filesystem
 /// facts are still merged on top, user values winning). `config_dir` is the
 /// command's working directory (the config file's parent) and `root` is the
-/// resolved index root used to compute the `{path}` placeholder.
+/// resolved index root used to compute the `{path}` placeholder. Each run is
+/// bounded by the global `[dirsql].hook-timeout` key when present (#351),
+/// falling back to the shared 30-second default
+/// ([`command::DEFAULT_COMMAND_TIMEOUT`]).
 fn build_tables_from_config(
     cfg: &config::Config,
     config_dir: &Path,
     root: &Path,
 ) -> Result<Vec<Table>> {
     let mut tables = Vec::with_capacity(cfg.tables.len());
+    let timeout = cfg.hook_timeout.unwrap_or(command::DEFAULT_COMMAND_TIMEOUT);
 
     for table_cfg in &cfg.tables {
         let mut table = match &table_cfg.on_file {
@@ -1495,7 +1495,9 @@ fn build_tables_from_config(
                 Table::new(
                     table_cfg.ddl.clone(),
                     table_cfg.glob.clone(),
-                    move |abs_path: &str| run_on_file(&command, abs_path, &config_dir, &root),
+                    move |abs_path: &str| {
+                        run_on_file(&command, abs_path, &config_dir, &root, timeout)
+                    },
                 )
             }
             None => Table::new(
@@ -1527,8 +1529,15 @@ fn build_tables_from_config(
 /// Per-file isolation: any failure — a spawn/exit/timeout error from
 /// [`command::run_command`], or output that is not a JSON array of objects —
 /// is logged to stderr and yields no rows (`vec![]`). Returning `Err` here
-/// would abort the whole scan, so it never does.
-fn run_on_file(command: &str, abs_path: &str, config_dir: &Path, root: &Path) -> Vec<Row> {
+/// would abort the whole scan, so it never does. `timeout` bounds the run —
+/// the table's configured value, or the shared default.
+fn run_on_file(
+    command: &str,
+    abs_path: &str,
+    config_dir: &Path,
+    root: &Path,
+    timeout: Duration,
+) -> Vec<Row> {
     let abs = Path::new(abs_path);
     let rel = abs
         .strip_prefix(root)
@@ -1540,7 +1549,7 @@ fn run_on_file(command: &str, abs_path: &str, config_dir: &Path, root: &Path) ->
         Placeholder::new("root", root.to_string_lossy().into_owned()),
     ];
 
-    match command::run_command(command, &placeholders, config_dir, ON_FILE_TIMEOUT, None) {
+    match command::run_command(command, &placeholders, config_dir, timeout, None) {
         Ok(output) => match parse_command_rows(&output.payload) {
             Ok(rows) => rows,
             Err(message) => {
@@ -3097,6 +3106,7 @@ mod internal_tests {
             &abs.to_string_lossy(),
             dir.path(),
             dir.path(),
+            command::DEFAULT_COMMAND_TIMEOUT,
         );
         assert_eq!(rows.len(), 1);
         assert_eq!(rows[0]["n"], Value::Integer(1));
@@ -3112,6 +3122,7 @@ mod internal_tests {
             "/outside/f.txt",
             dir.path(),
             dir.path(),
+            command::DEFAULT_COMMAND_TIMEOUT,
         );
         assert!(rows.is_empty());
     }
@@ -3120,7 +3131,13 @@ mod internal_tests {
     #[test]
     fn run_on_file_returns_no_rows_on_non_json_output() {
         let dir = TempDir::new().unwrap();
-        let rows = run_on_file("echo not-json", "/outside/f.txt", dir.path(), dir.path());
+        let rows = run_on_file(
+            "echo not-json",
+            "/outside/f.txt",
+            dir.path(),
+            dir.path(),
+            command::DEFAULT_COMMAND_TIMEOUT,
+        );
         assert!(rows.is_empty());
     }