CQS_API_BASE | (none) | LLM API base URL (legacy alias for CQS_LLM_API_BASE) |
CQS_BATCH_AUDIT_RELOAD_SECS | 30 | TTL (seconds) for the batch/daemon audit_state reload cache. .cqs/audit-mode.json toggles take effect within this window without a daemon restart. Lower = faster pickup of cqs audit-mode on/off, more file reads. |
CQS_BATCH_CONFIG_RELOAD_SECS | 300 | TTL (seconds) for the batch/daemon config reload cache. .cqs/config.toml edits (splade_alpha, ef_search, …) take effect within this window without a daemon restart. |
CQS_BATCH_DATA_IDLE_MINUTES | 30 | Minutes of inactivity before cqs batch / cqs chat evicts heavy data caches (HNSW, SPLADE index, call graph, test chunks, file set, refs). Independent of the ONNX-session sweep above. 0 disables. |
CQS_BATCH_IDLE_MINUTES | 5 | Minutes of inactivity before cqs batch / cqs chat clears ONNX sessions (0 disables eviction). |
CQS_BATCH_STALENESS_CHECK_MS | 100 | Minimum interval (milliseconds) between batch/daemon staleness probes (index.db mtime + PRAGMA data_version). Caps the probe rate so store() on every handler hop doesn't re-probe; reindex-detection latency stays under this much. |
CQS_BRUTE_FORCE_BATCH_SIZE | (auto) | Cursor-based brute-force search batch size. Default scales by query embedding dim via dim_scaled_batch(5000, dim, 500, 50_000) so a 4096-dim model holds ~20 MB per batch instead of 80 MB. v1.36.2 SHL-V1.36-3 — pinned override wins verbatim. |
CQS_BUSY_TIMEOUT_MS | 30000 (30 s) | SQLite busy timeout in milliseconds. Override applies to all SQLite pools. When unset, defaults are context-specific: 30 s for the main/overlay store (busy_timeout_from_env(30_000)) and the embedding cache, 15 s for the query cache. |
CQS_CACHE_MAX_SIZE | 1073741824 (1 GB) | Global embedding cache size limit |
CQS_CAGRA_GRAPH_DEGREE | 64 | CAGRA output graph degree at build time (cuVS default 64; higher → better recall, longer build) |
CQS_CHAT_HISTORY | 1 | Set to 0 to disable disk-persisted cqs chat REPL history. |
CQS_MAX_DAEMON_CLIENTS | 16 | Max concurrent in-flight handlers in the daemon socket loop. ~2 MiB stack each → default budget ~32 MiB. Read once at daemon startup. |
CQS_QUERY_CACHE_MAX_SIZE | 104857600 (100 MiB) | Disk-cap on the embedding query cache. Best-effort prune past the cap; default is 100 MiB. |
CQS_TELEMETRY_REDACT_QUERY | 1 | Set to 0 to log raw query strings in telemetry. Default redacts so search queries containing secrets/snippets aren't persisted. |
CQS_CALL_GRAPH_MAX_EDGES | 500000 | Max function_calls rows loaded into the in-memory call graph (cqs impact, cqs trace, cqs related). Bump for very large monorepos that exceed 500K edges. |
CQS_CAGRA_INTERMEDIATE_GRAPH_DEGREE | 128 | CAGRA pruned-input graph degree at build time (cuVS default 128) |
CQS_CAGRA_ITOPK_MAX | (log₂(n)·32 clamped 128-4096) | Upper clamp on CAGRA itopk_size. Default scales with corpus size (1k→320, 100k→532, 1M→640). Raise for better recall on large indexes at the cost of search latency. |
CQS_CAGRA_ITOPK_MIN | 128 | Lower clamp on CAGRA itopk_size. itopk_size = (k*2).clamp(min, max). |
CQS_CAGRA_MAX_BYTES | (auto) | Max GPU memory for CAGRA index |
CQS_CAGRA_PERSIST | 1 | Persist the CAGRA graph to {cqs_dir}/index.cagra after build and reload it on restart. Set to 0 to disable (daemon rebuilds from scratch every startup). |
CQS_CAGRA_STREAM_BATCH_SIZE | 10000 | Embedding rows streamed per batch during CAGRA index construction. At dim=1024 this is ~40 MB/batch; raise/lower to fit a per-batch byte budget for non-default-dim models. (P3-15 / SHL-V1.33-9) |
CQS_CAGRA_THRESHOLD | 5000 | Min chunks to trigger CAGRA over HNSW |
CQS_TIERED_INDEX | 0 | Opt into the cuVS tiered index backend (requires the tiered-index build feature). When 1 and eligible, it shadows CAGRA and retires the periodic HNSW rebuild. Unset/0 → CAGRA/HNSW as before. |
CQS_TIERED_THRESHOLD | 5000 | Min chunks to trigger the tiered backend over HNSW (falls back to CQS_CAGRA_THRESHOLD then the policy table). |
CQS_TIERED_MIN_ANN_ROWS | 5000 | Rows the tiered brute-force tier accumulates before cuVS builds the CAGRA ANN tier. Below it, search is pure brute-force. |
CQS_CENTROID_ALPHA_FLOOR | 0.7 | Minimum α when the centroid classifier overrides the rule-based classifier. Caps downside of wrong-category alpha routing. |
CQS_CENTROID_CLASSIFIER | 1 | Embedding-centroid query classifier — fills Unknown gaps from the rule-based classifier with embedding-space matching. Enabled by default; set to 0 to opt out. |
CQS_CAGRA_MAX_GPU_BYTES | (unset) | Hard cap (bytes) on GPU memory the CAGRA index is allowed to allocate. When set, exceeding the cap aborts the build with a clear error rather than OOM-ing the GPU. P2.42. |
CQS_CENTROID_THRESHOLD | 0.01 | Minimum cosine margin (top1 − top2) for the centroid classifier to commit to a category. Below this, falls back to the rule-based classifier. |
CQS_CONVERT_MAX_FILE_SIZE | 104857600 (100 MiB) | Max bytes a single-file converter (HTML, Markdown passthrough) will read. Shared across cqs convert <file.html> and markdown passthrough. Bump for pathologically large single-file docs; the cap exists as a malicious-input guard, not a normal-case constraint. |
CQS_CONVERT_MAX_PAGES | 1000 | Max HTML pages processed from a single CHM archive or web-help directory by cqs convert. Excess pages are dropped with a warn. Bump for multi-thousand-page vendor docs. |
CQS_CONVERT_MAX_WALK_DEPTH | 50 | Max recursion depth for cqs convert <dir>'s walkdir. Entries deeper than this are silently dropped by walkdir; depth-cap-hit emits a warn so you can detect the truncation. |
CQS_CONVERT_PAGE_BYTES | 10485760 (10 MiB) | Max bytes read per page from CHM and web-help archives. A pathological archive with one huge HTML page can't OOM the process. A file that hits the cap is truncated with a warn; bump for vendor docs with unusually large single pages. |
| (no env var) | 52428800 (50 MiB) | The merged-output cap for cqs convert <webhelp-dir> is a fixed 50 MB constant (src/convert/webhelp.rs), not configurable. Concatenation past this bound truncates with a warn; it guards against runaway concatenation, not a normal-case workload. To bound web-help input instead, use the real knobs CQS_CONVERT_MAX_PAGES (page count) and CQS_CONVERT_PAGE_BYTES (per-page bytes). |
CQS_DAEMON_MAX_RESPONSE_BYTES | 16777216 (16 MiB) | Max response bytes the CLI accepts from the daemon socket before falling back to direct execution. Larger gather/task outputs need this lifted. |
CQS_DAEMON_PERIODIC_GC | 1 | Set to 0 to disable the daemon's idle-time periodic GC (#1024). When on, every 30 min of idle the daemon prunes a bounded batch of missing-file and gitignored chunks so the index stays close to a fresh cqs index --force over long sessions. |
CQS_DAEMON_PERIODIC_GC_CAP | 1000 | Max distinct origins examined per periodic-GC tick. Lower = shorter write transactions; higher = faster convergence on a polluted index. |
CQS_DAEMON_PERIODIC_GC_IDLE_SECS | 60 | Minimum idle gap (seconds) between the last file event and a periodic-GC tick. Prevents GC from running mid-burst during long edit sequences. |
CQS_DAEMON_PERIODIC_GC_INTERVAL_SECS | 1800 (30 min) | Idle-time periodic GC interval (seconds). A tick fires only once this many seconds have passed since the previous sweep; combined with CQS_DAEMON_PERIODIC_GC_IDLE_SECS, keeps GC off the hot path. |
CQS_DAEMON_STARTUP_GC | 1 | Set to 0 to skip the daemon's startup GC pass (#1024). The startup pass drops chunks for files no longer on disk and chunks whose path is now matched by .gitignore. Synchronous, runs once when cqs watch --serve starts. |
CQS_DAEMON_TIMEOUT_MS | 2000 | Daemon client connect/read timeout in milliseconds (CLI → daemon) |
CQS_DAEMON_WORKER_THREADS | min(num_cpus, 4) | Worker threads for the daemon's shared tokio runtime (replaces three per-struct runtimes). Bump on large hosts where the default cap leaves cores idle under heavy concurrent client load. |
CQS_DIFF_EMBEDDING_BATCH_SIZE | 64 | Batch size for embedding cqs review --diff / cqs impact --diff chunks. Default scales to ~12 MB at 1024-dim; override for larger models or tight memory budgets. |
CQS_DISABLE_BASE_INDEX | (none) | Set to 1 to force queries through the enriched HNSW only, skipping the base (non-enriched) HNSW. Used to A/B the dual-index router during config testing. |
CQS_DISABLE_CPU_WARM | (none) | Set to 1 to keep the CPU embedder thread from competing with GPU for fresh batches. CPU still drains GPU-failed batches as fault-tolerance, but if GPU handles every batch the CPU ONNX session never lazy-inits — saves the per-session mmap (~30 GB for 8B FP32 models). Trade-off: if a transient GPU failure does occur, the first failed batch pays the CPU session-init latency. Useful when running large (>2 GB) models on host-RAM-constrained setups, e.g. WSL2 with default memory caps. Surfaced 2026-05-03 by the Qwen3-Embedding-8B ceiling probe (#1392). |
CQS_DISABLE_TENSORRT | (none) | Set to 1 to skip the TensorRT execution-provider probe in detect_provider, falling through to CUDA. Useful when a model's ONNX graph uses ops TensorRT can't compile — e.g. EmbeddingGemma's bidirectional-attention head emits a plugin op TRT 10 doesn't recognise, and create_session fails at engine build time. CUDA's op coverage is broader (it falls back to ORT's own kernel for unknown ops) at the cost of TRT's perf wins. |
CQS_FORCE_TENSORRT | (none) | Set to 1 to override the per-model TRT-incompatibility blocklist (#1576). By default, models known to SIGFPE the TRT engine compiler at session creation time (currently: any path containing gemma) are auto-downgraded to CUDA EP regardless of detect_provider's pick. Set this when running a custom export that fixed the contrib ops upstream. |
CQS_EMBED_BATCH_SIZE | 64 | ONNX inference batch size (reduce if GPU OOM) |
CQS_EMBED_CHANNEL_DEPTH | 64 | Embedding pipeline channel depth (bounds memory) |
CQS_EMBEDDING_DIM | (auto) | Override embedding dimension for custom ONNX models |
CQS_EMBEDDING_MODEL | embeddinggemma-300m | Embedding model preset (embeddinggemma-300m, bge-large, bge-large-ft, v9-200k, e5-base, nomic-coderank, qwen3-embedding-4b, qwen3-embedding-8b) or custom HF repo. See src/embedder/models.rs for the full preset list and per-preset trade-offs. |
CQS_EVAL_FRESH_BUDGET_CEILING | 600 | Ceiling (seconds) for cqs eval --require-fresh-secs. The flag is silently capped at this value so a misconfigured budget can't pin the eval harness for hours. On a slow indexer doing a fresh full-reindex of a 100k-chunk repo, embedder warmup + index build can exceed 10 min — bump to e.g. 1800 to avoid spurious "freshness budget exceeded" failures. The wait_for_fresh defense-in-depth at 86,400 s still bounds the absolute upper limit. v1.38: SHL-V1.38-2 / #1463. |
CQS_EVAL_OUTPUT | (none) | Path to write per-query eval diagnostics JSON (used by eval harness) |
CQS_EVAL_REQUIRE_FRESH | 1 | Set to 0/false/no/off to disable the freshness gate that cqs eval applies before running (#1182). When on, the eval harness blocks until the running cqs watch --serve daemon reports state == fresh, or errors out if the daemon isn't reachable — prevents silent stale-index runs that look like 5-25pp R@K regressions. Pass --no-require-fresh for the same effect on a single invocation. |
CQS_EVAL_TIMEOUT_SECS | 300 | Per-query timeout in seconds inside evals/run_ablation.py |
CQS_FILE_BATCH_SIZE | 5000 | Files per parse batch in pipeline |
CQS_FORCE_BASE_INDEX | (none) | Set to 1 to force search via the base (non-enriched) HNSW index |
CQS_FTS_NORMALIZE_MAX | 16384 | Max bytes of normalize_for_fts output per chunk. Truncation is emitted at warn level; bump if FTS recall on long chunks (large generated tables, monolithic functions) is degraded. |
CQS_GATHER_MAX_NODES | 200 | Max BFS nodes in gather context assembly |
CQS_HNSW_EF_CONSTRUCTION | corpus-tiered: 100/200/400 | HNSW construction-time search width (see HNSW Index Tuning) |
CQS_DISTANCE_METRIC | cosine | Distance metric at index build (cosine, dot). Stored per-generation in the HNSW manifest; a conflicting value at load is a typed error. Upgrading a pre-manifest index re-resolves the metric from this env var (the retired .hnsw.meta header is not honored) — set it before the first post-upgrade index/rebuild if you built with a non-default metric |
CQS_HNSW_EF_SEARCH | corpus-tiered: 50/100/200 | HNSW query-time search width (see HNSW Index Tuning) |
CQS_HNSW_BATCH_SIZE | 10000 | Vectors per HNSW build batch |
CQS_HNSW_M | corpus-tiered: 16/24/32 | HNSW connections per node (see HNSW Index Tuning) |
CQS_HNSW_MAX_DATA_BYTES | 1073741824 (1 GB) | Max HNSW data file size |
CQS_HNSW_MAX_GRAPH_BYTES | 524288000 (500 MB) | Max HNSW graph file size |
CQS_HNSW_MAX_ID_MAP_BYTES | 524288000 (500 MB) | Max HNSW ID map file size |
CQS_HEALTH_HOTSPOT_COUNT | auto (log₂(n) clamped [5, 50]) | Number of top hotspots cqs health reports. Default scales with corpus size (1k→10, 100k→17, 1M→20). SHL-V1.29-7. |
CQS_HOTSPOT_MIN_CALLERS | auto (log₂(n)·0.7 clamped [5, 50]) | Minimum caller count for "untested hotspot" / "high risk" detectors. Default scales with corpus size (1k→5, 100k→11, 1M→14). SHL-V1.29-7. |
CQS_DEAD_CLUSTER_MIN_SIZE | auto (log₂(n)·0.7 clamped [5, 50]) | Minimum dead functions in a single file to flag as a "dead code cluster" in cqs suggest. Scales with corpus size. SHL-V1.29-7. |
CQS_SUGGEST_HOTSPOT_POOL | auto (4× hotspot count, clamped [20, 200]) | Pool size cqs suggest evaluates for risk patterns. SHL-V1.29-7. |
CQS_SUMMARY_FLUSH_INTERVAL_MS | 200 | Time-based flush threshold (ms) for the in-memory summary queue. An idle workload that pushed one row this many milliseconds ago auto-flushes. Bump (e.g. 500) to coalesce more on slow disks. v1.38: SHL-V1.38-9 / #1463. |
CQS_SUMMARY_FLUSH_ROWS | 64 | Row-count threshold for auto-flush of the summary queue. Bump (e.g. 256) on a saturated local-LLM pipeline to reduce per-flush transaction overhead. v1.38: SHL-V1.38-9 / #1463. |
CQS_SUMMARY_HARD_CAP_ROWS | 10000 | Hard cap on summary-queue depth — the next push runs a synchronous flush before enqueueing once at the cap (backpressure). Defensive: must exceed CQS_SUMMARY_FLUSH_ROWS (clamped at runtime). v1.38: SHL-V1.38-9 / #1463. |
CQS_SUMMARY_VALIDATION | loose | LLM summary validation strictness. strict: drop summaries matching injection patterns; loose: log + keep matches; off: skip. Length cap (1500 chars) is always enforced via deterministic truncation. (#1170) |
CQS_RISK_HIGH | 5.0 | Risk score threshold above which a function is "High" risk. Drives cqs review CI gating; override on monorepos where the default classifies too aggressively. SHL-V1.29-8. |
CQS_RISK_MEDIUM | 2.0 | Risk score threshold above which a function is "Medium" risk. SHL-V1.29-8. |
CQS_BLAST_LOW_MAX | 2 | Inclusive upper bound on caller count for "Low" blast radius (callers 0..=N). SHL-V1.29-8. |
CQS_BLAST_HIGH_MIN | 11 | Inclusive lower bound on caller count for "High" blast radius (callers N..). Medium sits between CQS_BLAST_LOW_MAX and this. SHL-V1.29-8. |
CQS_HYDE_MAX_TOKENS | (config) | Max tokens for HyDE query prediction |
CQS_IDLE_TIMEOUT_SECS | 30 | SQLite connection idle timeout in seconds |
CQS_INTEGRITY_CHECK | 0 | Set to 1 to enable PRAGMA quick_check on write-mode store opens |
CQS_IMPACT_MAX_CHANGED_FUNCTIONS | 500 | Cap on changed functions processed by impact --diff / review --diff. Excess is dropped and surfaced as summary.truncated_functions in JSON. |
CQS_IMPACT_MAX_NODES | 10000 | Max BFS nodes in impact analysis |
CQS_LLM_ALLOW_INSECURE | 0 | Set to 1 to permit CQS_LLM_API_BASE to use cleartext http://. Without it, any http:// base is rejected so the API key isn't sent in the clear. Localhost-testing escape hatch only. |
CQS_LLM_API_BASE | https://api.anthropic.com/v1 | LLM API base URL. Required when CQS_LLM_PROVIDER=local; set to e.g. http://localhost:8080/v1. |
CQS_LLM_API_KEY | (none) | Optional bearer token for CQS_LLM_PROVIDER=local. Sent as Authorization: Bearer $CQS_LLM_API_KEY. Ignored by the anthropic provider (which uses ANTHROPIC_API_KEY). |
CQS_LLM_MAX_BATCH_SIZE | 10000 | Max chunks per LLM batch (summary or doc-comment). Clamped to [1, 100_000]. When the cap is reached, remaining chunks are picked up on the next run. |
CQS_LLM_MAX_CONTENT_CHARS | 8000 | Max content chars in LLM prompts |
CQS_LLM_MAX_TOKENS | 100 | Max tokens for LLM summary generation |
CQS_LLM_PASS_PAGE_SIZE | 500 | SQLite page size for the LLM-pass paginators (cqs index --llm-summaries and --improve-docs). Smaller (50-100) reduces peak heap on large repos; larger (1000+) reduces SQLite round-trip overhead on fast SSDs. v1.38: SHL-V1.38-7 / #1463. |
CQS_LLM_MODEL | claude-haiku-4-5 | LLM model name for summaries. Required when CQS_LLM_PROVIDER=local; must match a model your server exposes. |
CQS_LLM_PROVIDER | anthropic | LLM provider: anthropic (Messages Batches API) or local (any OpenAI-compat /v1/chat/completions endpoint — llama.cpp, vLLM, Ollama, LMStudio). |
CQS_LLM_RETRY_BACKOFFS_MS | 500,1000,2000,4000 | Comma-separated millisecond backoff schedule for the local provider's per-item retries. Schedule length sets the max-attempts count (default 4). Bump for saturated local vLLM serving where transient 5xx bursts exceed the 7.5s default window — e.g. 500,1000,2000,4000,8000,16000 for a 31.5s window with 6 attempts. v1.38: SHL-V1.38-10 / #1463. |
CQS_LOAD_SPARSE_BATCH | 1000 | Distinct chunk_ids fetched per page when loading sparse (SPLADE) vectors into the in-memory index (load_all_sparse_vectors, run on daemon startup + each watch reload). Smaller = lower peak RAM per batch; larger = fewer SQLite round-trips. |
CQS_LOCAL_LLM_CONCURRENCY | 4 | Worker pool size for CQS_LLM_PROVIDER=local. Clamped to [1, 64]. |
CQS_LOCAL_LLM_MAX_BODY_BYTES | 4194304 (4 MiB) | Max response body bytes accepted from a CQS_LLM_PROVIDER=local server. Larger bodies are a sign of a misbehaving or hostile endpoint and abort with a clear error rather than OOMing the daemon. Must be > 0. |
CQS_LOCAL_LLM_TIMEOUT_SECS | 120 | Per-request timeout (seconds) for CQS_LLM_PROVIDER=local. Local inference can be slow, so the default is 2× the Anthropic 60s ceiling. |
CQS_MAX_CONNECTIONS | 4 | SQLite write-pool max connections |
CQS_MAX_REFERENCES | 20 | Max number of reference indexes loaded from [references] blocks. Each reference holds a separate SQLite DB + HNSW index (~50-100 MB RAM each). Hit on a cqs ref-heavy workspace? Bump it; 0/garbage falls back to default. SHL-V1.30-6. |
CQS_GATHER_DEPTH | 2 (task fallback) | BFS expansion depth fallback for the task pipeline when CQS_TASK_GATHER_DEPTH is unset. cqs gather itself takes its depth from the --depth flag, not this env var. SHL-V1.30-4. |
CQS_TASK_GATHER_DEPTH | 2 | BFS expansion depth used inside cqs task (number of call-graph hops from each modify target). Takes precedence over CQS_GATHER_DEPTH for the task pipeline only. SHL-V1.30-4. |
CQS_TASK_WATERFALL_SCOUT | 0.15 | Fraction of cqs task --max-tokens allocated to the scout section (file groups + chunk roles). Operators packing more code or impact info can shift weight via this knob. Bounded 0.0..=1.0. v1.38: EX-V1.38-5 / #1463. |
CQS_TASK_WATERFALL_CODE | 0.50 | Fraction of cqs task --max-tokens allocated to the code section (gathered chunks). v1.38: EX-V1.38-5 / #1463. |
CQS_TASK_WATERFALL_IMPACT | 0.15 | Fraction of cqs task --max-tokens allocated to the impact section (risk + tests). v1.38: EX-V1.38-5 / #1463. |
CQS_TASK_WATERFALL_PLACEMENT | 0.10 | Fraction of cqs task --max-tokens allocated to the placement section (where to add). The notes section gets the remainder (default 0.10). v1.38: EX-V1.38-5 / #1463. |
CQS_ONBOARD_CALLEE_FETCH | 30 | Max callees cqs onboard fetches content for after BFS. Excess callees are surfaced as summary.callees_truncated in JSON and a tracing::warn!. SHL-V1.30-5. |
CQS_ONBOARD_CALLER_FETCH | 15 | Max callers cqs onboard fetches content for. Truncation surfaces as summary.callers_truncated. SHL-V1.30-5. |
CQS_ONBOARD_KEY_TYPES | 50 | Max key-type dependencies cqs onboard renders for the entry point. Excess (post-COMMON_TYPES-filter) types are dropped and surfaced as summary.key_types_truncated in JSON, a "showing N of M" header in text, and a tracing::warn!. #1784. |
CQS_READ_TYPE_DEPS | 50 | Max type-dependency fragments cqs read --focus renders. Excess (post-COMMON_TYPES-filter) type definitions are dropped and surfaced as a warnings[] entry in JSON, a // [cqs] ... marker in the body, and a tracing::warn!. #1784. |
CQS_NOTES_MAX_FILE_SIZE | 10485760 (10 MiB) | Max size of notes.toml accepted by both read and rewrite paths. A larger file is rejected with InvalidData. Bump on workspaces with very large note collections. SHL-V1.30-7. |
CQS_NOTES_MAX_ENTRIES | 10000 | Max number of notes parsed from a single notes.toml. Excess entries are dropped with a tracing::warn! (previously silent). SHL-V1.30-7. |
CQS_ENRICHMENT_PAGE_SIZE | 500 | Chunks per page during the second-pass enrichment loop. Smaller = lower per-batch RAM (callers/callees maps), larger = fewer SQLite round-trips. SHL-V1.30-8. |
CQS_WATCH_PRUNE_SIZE_THRESHOLD | 5000 | Size threshold that triggers the watch loop's last_indexed_mtime recency prune. Larger maps (e.g. cqs ref-heavy projects) need this lifted to keep dedup working past the default. SHL-V1.30-9. |
CQS_BATCH_MAX_LINE_LEN | 52428800 (50 MiB) | Max bytes per batch-mode line (cqs batch stdin and the daemon socket request). Aligned with CQS_MAX_DIFF_BYTES so batch-routed diffs aren't capped 50× sooner than the CLI path. |
CQS_MAX_CONTRASTIVE_CHUNKS | 30000 | Max chunks for contrastive summary matrix (memory = NN4 bytes) |
CQS_MAX_DIFF_BYTES | 52428800 (50 MiB) | Max bytes accepted on stdin (cqs review --stdin, cqs impact --diff) and from git diff subprocess. Long-running feature branches with multi-MB diffs need this lifted. |
CQS_MAX_DISPLAY_FILE_SIZE | 10485760 (10 MiB) | Max file size that read_context_lines (snippet extraction for search results) will open. |
CQS_MAX_FILE_SIZE | 1048576 (1 MB) | Per-file size cap (bytes) for indexing. Files above this are skipped with an info! log; bump for generated code (bindings.rs, compiled TS, migrations). |
CQS_MAX_QUERY_BYTES | 32768 | Max query input bytes for embedding |
CQS_MAX_SEQ_LENGTH | (auto) | Override max sequence length for custom ONNX models |
CQS_MCP_ENABLE_MUTATIONS | (unset = off) | Operator opt-in for the cqs mcp bridge's gated mutation channel (Phase 2a). When unset, tools/list exposes only the read tools and the daemon rejects notes-mutation requests. Set to 1 to additionally expose cqs_notes_add / cqs_notes_update / cqs_notes_remove (which write docs/notes.toml; the watch loop reindexes). The destructive set (gc, slot remove, index --force, model swap, cache clear) is withheld unconditionally — no value of this flag re-enables it. Read by both the bridge (tool surface) and the daemon (dispatch enforcement). |
CQS_MCP_HTTP_TOKEN | (unset) | Bearer token for the cqs mcp --http Streamable HTTP listener (opt-in mcp-http build). Auth is unconditional — the listener refuses to start without a token from this var or, preferred, --token-file. This env var is the discouraged source: it is visible in the process environment to other same-UID processes and can leak into shells and logs; --token-file adds an ownership + mode check. The token value itself is never logged. |
CQS_MD_MAX_SECTION_LINES | 150 | Max markdown section lines before overflow split |
CQS_MD_MIN_SECTION_LINES | 30 | Min markdown section lines (smaller sections merge) |
CQS_MIGRATE_KEEP_BACKUPS | 3 | Number of version-tagged migration backups retained in the DB's parent directory; older ones are pruned after every successful migrate. 3 = the current run's backup plus the two prior runs'. 0 is honored verbatim (prune all after a successful migrate) for tight-quota mounts. |
CQS_MIGRATE_REQUIRE_BACKUP | 1 | Migration-time DB backup is required by default; a backup failure aborts the migration with StoreError::Io so the destructive v18→v19 rebuild never runs without a recovery snapshot. Set to 0 to downgrade to a warn! and proceed without a snapshot (accept data-loss risk on a subsequent commit failure). |
CQS_HF_CACHE_TRUSTED | (none) | Set to 1 to opt into env-supplied HF cache paths (HF_HOME / HUGGINGFACE_HUB_CACHE) that would otherwise be flagged as suspicious — under /tmp, /var/tmp, /dev/shm, ~/Downloads, ~/Desktop, or outside both $HOME and the system cache dir. Without this, suspicious paths get a tracing::warn! and the loader falls through to the default cache so a hostile env var can't redirect ONNX model loads. SEC-V1.33-8 / #1339. |
CQS_MMAP_SIZE | 268435456 (256 MB) | SQLite memory-mapped I/O size |
CQS_NO_ANSI_STRIP | (none) | Set to 1 to disable terminal-control sanitization on chunk content. By default cqs (text mode) replaces ESC / DEL / C0+C1 control bytes from chunk-derived strings before println! to defend against ANSI / OSC 8 / DCS payloads embedded in the indexed corpus or a poisoned reference index — the shell-version of indirect-prompt-injection. Tab / LF / CR are preserved so source layout still renders. Opt out when displaying chunks of code whose own string literals legitimately contain escape sequences being analyzed. SEC-V1.33-5 / #1341. |
CQS_NO_DAEMON | (none) | Set to 1 to force CLI mode (skip daemon connection attempt) |
CQS_ONNX_DIR | (auto) | Custom ONNX model directory (must contain model.onnx + tokenizer.json) |
CQS_OUTPUT_FORMAT | v2 (bare payload, as of 2026-05-08) | Wire-format selector for the CLI direct (emit_json) success path, and the only output-format knob. Default v2 (bare payload on stdout, no envelope wrap) — restores the high-SNR baseline that the 79% → 6% search-rate decline measured. Set to v1 to opt back into the legacy full envelope shape {data, error: null, version: 1, _meta: {...}} (consumer-migration hedge for scripts that haven't migrated to bare-payload assertions). Batch / daemon JSONL is not affected — it always uses the slim {"data": ...} / {"error": {...}} shape (the JSONL contract requires self-describing lines). |
CQS_OVERLAYS_LRU_SIZE | 4 | Slots in the daemon's worktree-overlay LRU cache (one built overlay per worktree root). Each overlay is ~1-10 MB (a few hundred dirty-delta chunks), so the cap sits higher than CQS_REFS_LRU_SIZE's 2. Bump for many concurrent lanes; clamped to at least 1. |
CQS_OVERLAY_FP_DEBOUNCE_MS | 2000 | Debounce window (milliseconds) for revalidating a cached worktree overlay's fingerprint. Within this window after a validation, a cached overlay is reused without re-running git (two git spawns + content hashing); past it, the fingerprint is recomputed and the overlay rebuilt on a mismatch. Bounds worst-case overlay staleness at ~this much while collapsing a query burst to one git check. Zero re-validates every query. |
CQS_OVERLAY_MAX_FILES | 500 | Max files in a worktree's dirty delta before the search overlay is skipped (skipped-delta-too-large) and the parent index is served unchanged. A lane this far from main is a rebase problem, not an overlay problem. Zero falls back to the default. |
CQS_WORKTREE_OVERLAY | (unset = default-on in worktrees) | Tri-state control for the cqs search worktree overlay (results reflect this checkout's committed+uncommitted delta on top of the parent index, instead of main's state). 1 = force on (env-var equivalent of --overlay); 0 = force off (equivalent of --no-overlay); unset = default-on when run from a worktree, off in the main checkout (#1855). Opt-out (0 / --no-overlay) wins over every opt-in signal. Overlays build on the daemon path only — a CLI-direct search (no daemon) serves the parent index with _meta.worktree_overlay = "skipped-no-daemon" (default activations degrade quietly; explicit --overlay warns). The overlay now reaches beyond cqs search (#1858): scout/gather/task overlay their seed search, and callers/callees/impact/dead/review reflect the worktree's edits, each surfaced via a _meta.overlay_graph marker (full / callers-only for impact+review / seed-only / absent). |
CQS_PARSE_CHANNEL_DEPTH | 256 | Parse pipeline channel depth (lowered from 512 in v1.38; SHL-V1.38-6) |
CQS_PARSER_MAX_CHUNK_BYTES | 100000 (100 KiB) | Per-chunk byte cap inside the parser. Chunks above this are dropped before windowing sees them; per-file warn summarises the count. Distinct from CQS_MAX_FILE_SIZE (file-discovery gate) so per-stage knobs stay independent. |
CQS_PARSER_MAX_FILE_SIZE | 52428800 (50 MiB) | Per-file size cap inside the parser. Files above this are skipped with a warn. Distinct from CQS_MAX_FILE_SIZE (which gates file enumeration before the parser even runs). |
CQS_PARSER_MAX_WALK_DEPTH | 800 | Max recursion depth for the Pass-2 relationship-extraction tree-walks. Bounds an adversarial deeply-nested file (a passive-hostile DoS) from overflowing the parser worker stack: past the cap the walk stops descending and the file degrades gracefully rather than aborting cqs index/the daemon. ~100× any real nesting; sized to fit within the parser pool's worker stack (floored at 2 MiB) driven through the real parse entry. Clamped to [1, 800] — an override can only lower the rail (a tighter bound); a value above 800 clamps back down with a warn, since 800 is a depth the 2 MiB floor stack provably holds through the real parse entry and panic = abort makes a stack overflow uncatchable. |
CQS_PARSER_STACK_SIZE | 2097152 (2 MiB) | Worker-thread stack size (bytes) for the dedicated rayon pool the index parse stage runs on. The depth-800 rail (CQS_PARSER_MAX_WALK_DEPTH) needs a 2 MiB stack to stay safe through the real parse entry (a 1 MiB stack overflows at 800 in a debug build); 2 MiB is therefore both the default and the floor. Clamped to [2 MiB, 256 MiB] so an override can never shrink the stack below what the depth rail needs. |
CQS_PARSER_TIMEOUT_MS | 5000 | Per-file wall-clock parse budget. tree-sitter has no internal time bound; a pathological token stream can stall a parse for minutes. On timeout the file is skipped-with-warn. 0 disables the timeout. |
CQS_PDF_MAX_BYTES | 104857600 (100 MiB) | Max stdout bytes captured from the pdf_to_md.py subprocess invocation. v1.36.2: previously unbounde |
