@davesheffer/hunch 0.1.0 → 0.4.0

package/README.md

@@ -110,13 +110,14 @@ The MCP tools Claude calls under the hood: `hunch_why`, `hunch_query`,
 | `hunch backfill --since 90d` | replay git history → seed decisions |
 | `hunch sync [sha]` | turn a commit into a Decision (run automatically by the hook) |
 | `hunch record-bug --test <id> --message <m>` | capture a Bug from a failing test |
+| `hunch test [cmd…]` | run the suite (default `npm test`); auto-capture failures as Bugs (suspects + recurrence→Constraints), mark passing tests' bugs fixed |
 | `hunch why <path\|symbol>` | decisions / bugs / constraints explaining a target (flags `⚠STALE`) |
 | `hunch query "<q>" [--semantic]` | full-text + graph search (`--semantic` blends in local embeddings) |
 | `hunch embed` | generate local embeddings for semantic recall (opt-in; needs `@huggingface/transformers`) |
 | `hunch context <path\|symbol>` | minimal relevant slice for a task: invariants → decisions → bugs → blast radius |
 | `hunch fragile` | ranked fragility report with evidence |
-| `hunch check [--staged\|--commit <sha>] [--strict]` | guardrail: flag changes touching a do-not-break invariant |
-| `hunch stale` | drift: records whose files changed after they were last verified |
+| `hunch check [--staged\|--commit <sha>] [--strict] [--blast]` | guardrail: flag changes touching a do-not-break invariant **directly or via blast radius** (a guarded file that depends on what you changed); `--blast` prints the dependency fan-out |
+| `hunch stale [--resync]` | drift: records whose files changed after last verification (`--resync` regenerates stale decisions from their commits) |
 | `hunch review [--accept <id>\|--reject <id>]` | curate: triage / promote / drop low-confidence drafts |
 | `hunch migrate` | upgrade `.hunch/` records to the current schema version |
 | `hunch compact [--apply]` | prune low-value drafts to bound growth (dry-run by default) |
@@ -135,6 +136,12 @@ hunch embed                                     # embed your records (first run
 hunch query --semantic "auth token expiry"      # hybrid keyword + semantic recall
 ```
 
+> **Install it where `hunch` runs.** The runtime is resolved from `hunch`'s own
+> `node_modules`, so match the install scope: a globally-installed `hunch` needs the
+> global (`-g`) install above; running from a source checkout needs it in the repo
+> (`npm i @huggingface/transformers` there). If `hunch embed` reports the model "present
+> but failed to load," the scopes don't match. `hunch doctor` shows the active mode.
+
 Embeddings are **local and free** (no API — consistent with the subscription-only synthesis
 rule) and **opt-in** (the base install stays lean). The long-lived MCP server picks them up
 automatically once present. Vectors live in the derived SQLite index and are reconciled by
@@ -160,6 +167,33 @@ concurrent edits to the graph merge **by record id** instead of throwing conflic
 committed `.gitattributes`; the per-clone driver definition is set up by each teammate's
 `hunch init`.
 
+## Continuous learning (CI)
+
+The decision half of the loop is automatic (the post-commit hook). Light up the **bug /
+constraint half** by wrapping your test run with `hunch test`:
+
+```bash
+hunch test                       # runs `npm test`; capture failures → Bugs, resolve fixed ones
+hunch test -- pytest -q          # any runner: pass the command after `--`
+```
+
+It parses TAP and the `node:test` spec reporter, captures each failing test as a **Bug**
+(ranked suspects; a recurrence or substantiated high-severity failure auto-promotes a
+do-not-break **Constraint**), and marks a previously-open bug **fixed** once its test passes
+again. It preserves the runner's exit code, so it's a drop-in CI step:
+
+```yaml
+# .github/workflows/ci.yml
+- run: npm ci
+- run: npx hunch test            # exits non-zero on failure, just like the suite
+- run: |                         # persist what was learned (optional)
+    git add .hunch && git commit -m "chore(hunch): capture test run" || true
+    git push || true
+```
+
+Repair drift after refactors with **`hunch stale --resync`** (re-synthesizes stale decisions
+from their commits via the LLM).
+
 ## Maintenance
 
 - **`hunch doctor`** — is git healthy? are you on the subscription path or the offline

package/dist/cli/index.js

@@ -9,17 +9,19 @@
  *   why       decisions/bugs/constraints explaining a file/symbol
  *   fragile   ranked fragility report with evidence
  *   record-bug  capture a Bug from a (failing) test
+ *   test      run the suite, auto-capture failures as Bugs, resolve fixed ones
  *   mcp       start the MCP server (Claude Code connects here)
  *   doctor    environment diagnostics
  */
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { Command } from "commander";
 import { hunchPaths, findRoot } from "../core/paths.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { selectEmbedder } from "../store/embedder.js";
 import { indexRepo } from "../extractors/indexer.js";
-import { syncCommit, recordFailure } from "../synthesis/synthesize.js";
+import { syncCommit, recordFailure, captureTestRun } from "../synthesis/synthesize.js";
+import { parseTestReport } from "../extractors/testreport.js";
 import { selectProvider } from "../synthesis/provider.js";
 import { isGitRepo, headSha, logSince, lastChangeDate, stagedFiles, commitFiles } from "../extractors/git.js";
 import { installPostCommitHook, installPreCommitHook } from "../integrations/hooks.js";
@@ -177,11 +179,11 @@ program
     let hits;
     let how = "";
     if (opts.semantic) {
-        // Resolve once; if semantic isn't actually usable, say so and degrade to FTS
-        // (rather than silently returning identical keyword results under a flag).
+        // Same gate hybridSearch uses internally (store.semanticReady), so the flag's
+        // messaging can't drift from what actually runs. If unusable, say so and use FTS
+        // rather than silently returning identical keyword results under the flag.
         const emb = await selectEmbedder();
-        const cov = emb ? store.embeddingStats(emb.id) : null;
-        if (!emb || !cov || cov.embedded === 0) {
+        if (!store.semanticReady(emb)) {
             console.log("· semantic search isn't enabled yet — run `hunch embed` (using keyword search for now).\n");
             hits = store.search(q, 12);
         }
@@ -228,13 +230,25 @@ program
         return;
     }
     process.stdout.write(`Embedding ${todo} doc(s) with ${embedder.id} (first run downloads the model ~90MB, one time)…\n`);
-    const res = await store.embedAll(embedder, {
-        batch: Number(opts.batch),
-        onProgress: (done, total) => process.stdout.write(`\r  ${done}/${total} embedded   `),
-    });
-    process.stdout.write("\n");
-    console.log(`✓ embedded ${res.embedded} doc(s) (${res.skipped} already current). Model: ${embedder.id}.`);
-    console.log(`  Try:  hunch query --semantic "<question>"   — the MCP server uses it automatically.`);
+    try {
+        const res = await store.embedAll(embedder, {
+            batch: Number(opts.batch),
+            onProgress: (done, total) => process.stdout.write(`\r  ${done}/${total} embedded   `),
+        });
+        process.stdout.write("\n");
+        console.log(`✓ embedded ${res.embedded} doc(s) (${res.skipped} already current). Model: ${embedder.id}.`);
+        console.log(`  Try:  hunch query --semantic "<question>"   — the MCP server uses it automatically.`);
+    }
+    catch (e) {
+        // The availability probe (createRequire.resolve) can succeed while the
+        // runtime ESM import/model load fails — e.g. the package is only
+        // resolvable via NODE_PATH, or a native backend is missing. Degrade with
+        // an actionable hint instead of a stack trace; queries stay on keyword search.
+        process.stdout.write("\n");
+        console.log("Semantic model is present but failed to load — staying on keyword (FTS) search.");
+        console.log(`  reason: ${e.message.split("\n")[0]}`);
+        console.log("  Install @huggingface/transformers where hunch actually runs (a global `hunch` needs a global install; running from source needs it in the repo's node_modules).");
+    }
     store.close();
 });
 // ---- why ------------------------------------------------------------------
@@ -306,24 +320,108 @@ program
         console.log(`  ↳ promoted constraint ${r.constraint.id} [${r.constraint.severity}]: ${r.constraint.statement}`);
     store.close();
 });
+// ---- test (failure-learning loop) -----------------------------------------
+program
+    .command("test")
+    .description("Run the test suite; capture failures as Bugs (suspects + recurrence → Constraints), mark passing tests' bugs fixed.")
+    .argument("[cmd...]", "test command to run (default: `npm test`)")
+    .option("--dry-run", "show what would be captured without writing")
+    .action(async (cmd, opts) => {
+    const { store, root } = storeFor();
+    store.json.ensureDirs();
+    // Run as a shell string (not argv) so the npm/test-runner shim resolves on
+    // Windows and avoids Node's DEP0190 args+shell warning — same lesson as the
+    // claude CLI fix. The command is operator-supplied, so a shell is expected.
+    const cmdStr = cmd.length ? cmd.join(" ") : "npm test";
+    console.log(`▶ running: ${cmdStr}\n`);
+    const run = spawnSync(cmdStr, {
+        cwd: root,
+        shell: true,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+        windowsHide: true,
+    });
+    const output = `${run.stdout ?? ""}\n${run.stderr ?? ""}`;
+    const report = parseTestReport(output);
+    if (opts.dryRun) {
+        const willFallback = !report.recognized && run.status !== 0;
+        const n = willFallback ? 1 : report.failures.length;
+        console.log(`DRY RUN — exit ${run.status}, ${report.passed.length} passed, ${n} failure(s)${willFallback ? " (fallback: output not TAP/spec)" : ""}:`);
+        for (const f of report.failures)
+            console.log(`  ✗ ${f.test}`);
+        if (willFallback)
+            console.log(`  ✗ ${cmdStr} (whole-suite)`);
+        store.close();
+        return;
+    }
+    const cap = await captureTestRun(store, root, { report, status: run.status, cmd: cmdStr, output });
+    for (const { bug, constraint } of cap.results) {
+        if (constraint)
+            console.log(`  ⚠ ${bug.id} "${bug.title}" → promoted constraint ${constraint.id} [${constraint.severity}]`);
+        else
+            console.log(`  ✗ ${bug.id} "${bug.title}" [${bug.severity}]${bug.lineage.recurrence_of ? ` ↳ recurrence of ${bug.lineage.recurrence_of}` : ""}`);
+    }
+    for (const b of cap.fixed)
+        console.log(`  ✓ ${b.id} "${b.title}" → fixed (test passing)`);
+    store.reindex();
+    store.close();
+    const recurrences = cap.results.filter((r) => r.bug.lineage.recurrence_of).length;
+    const promoted = cap.results.filter((r) => r.constraint).length;
+    console.log(`\n${run.status === 0 ? "✓ suite passed" : "✗ suite failed"} — ` +
+        `${cap.results.length} bug(s) captured (${recurrences} recurrence, ${promoted} constraint), ${cap.fixed.length} resolved.`);
+    if (run.status !== 0)
+        process.exitCode = 1; // preserve CI semantics
+});
 // ---- stale (drift detection) ----------------------------------------------
 program
     .command("stale")
     .description("List decisions/constraints whose files changed after they were last verified (drift).")
-    .action(() => {
+    .option("--resync", "re-synthesize stale decisions from their commit via the LLM (drift repair)")
+    .action(async (opts) => {
     const { store, root } = storeFor();
     const stale = store.staleness((f) => lastChangeDate(f, root));
     if (!stale.length) {
         console.log("✓ No drift detected — every verified decision/constraint is current.");
+        store.close();
+        return;
     }
-    else {
+    if (!opts.resync) {
         console.log(`⚠ ${stale.length} record(s) may be stale (a file in scope changed after last verification):\n`);
         for (const s of stale) {
             console.log(`  ${s.kind} ${s.id}\n      verified ${s.last_verified.slice(0, 10)} · changed ${s.changed_at.slice(0, 10)} · ${s.files.join(", ")}`);
         }
-        console.log(`\nRe-validate with: hunch review --accept <id>  (or edit the record).`);
+        console.log(`\nRepair: hunch stale --resync  (re-synthesize from commits)  ·  or  hunch review --accept <id>`);
+        store.close();
+        return;
+    }
+    // --resync: regenerate each stale DECISION from its commit. Constraints have no
+    // commit to replay, so they're reported as needing manual review instead.
+    let resynced = 0, skipped = 0;
+    for (const s of stale) {
+        if (!s.kind.startsWith("decision")) {
+            skipped++;
+            console.log(`  · ${s.kind} ${s.id} — manual (no commit to replay)`);
+            continue;
+        }
+        const d = store.json.get("decisions", s.id);
+        if (!d?.commit) {
+            skipped++;
+            console.log(`  · ${s.id} — skipped (no source commit)`);
+            continue;
+        }
+        const r = await syncCommit(store, root, d.commit, { force: true });
+        if (r.status === "written") {
+            resynced++;
+            console.log(`  ↻ ${s.id} ← ${d.commit.slice(0, 8)} (${r.provider})`);
+        }
+        else {
+            skipped++;
+            console.log(`  · ${s.id} — skipped: ${r.reason}`);
+        }
     }
+    store.reindex();
     store.close();
+    console.log(`\n✓ re-synthesized ${resynced} stale decision(s), ${skipped} left for manual review.`);
 });
 // ---- check (constraint enforcement) ---------------------------------------
 program
@@ -331,40 +429,76 @@ program
     .description("Flag changes that touch a do-not-break invariant's scope (guardrail).")
     .option("--staged", "check git staged files (default)")
     .option("--commit <sha>", "check a specific commit's files")
-    .option("--strict", "exit non-zero if a blocking constraint is in scope")
+    .option("--strict", "exit non-zero if a blocking constraint is in scope (direct OR near)")
+    .option("--blast", "also print the dependency blast radius of the changed files")
     .action((opts) => {
     if (opts.commit && opts.staged)
         return fail("--staged and --commit are mutually exclusive");
     const { store, root } = storeFor();
+    store.reindex(); // blast radius walks the edge graph — make the index current
     const files = opts.commit ? commitFiles(opts.commit, root) : stagedFiles(root);
     if (!files.length) {
         console.log("No changed files to check.");
         store.close();
         return;
     }
-    const hits = new Map();
+    const mark = (s) => (s === "blocking" ? "⛔" : s === "warning" ? "⚠" : "·");
+    // 1) DIRECT — a changed file matches a constraint's scope.
+    const direct = new Map();
     for (const f of files) {
         for (const c of store.checkConstraints(f)) {
-            const e = hits.get(c.id) ?? { constraint: c, files: [] };
+            const e = direct.get(c.id) ?? { c, files: [] };
             e.files.push(f);
-            hits.set(c.id, e);
+            direct.set(c.id, e);
+        }
+    }
+    // 2) NEAR — a changed file's blast radius reaches a file an invariant guards:
+    //    you didn't touch the invariant, but you touched something it depends on.
+    const near = new Map();
+    for (const f of files) {
+        for (const b of store.blastRadiusFiles(f)) {
+            for (const c of store.checkConstraints(b.file)) {
+                if (direct.has(c.id))
+                    continue; // already reported as a direct hit
+                const e = near.get(c.id) ?? { c, via: [] };
+                e.via.push(`${f} → ${b.file} (${b.via}, depth ${b.depth})`);
+                near.set(c.id, e);
+            }
         }
     }
-    if (!hits.size) {
-        console.log(`✓ ${files.length} changed file(s) touch no recorded invariants.`);
+    if (opts.blast) {
+        console.log(`Blast radius of ${files.length} changed file(s):`);
+        for (const f of files) {
+            const b = store.blastRadiusFiles(f);
+            const list = b.length ? `: ${b.slice(0, 8).map((x) => x.file).join(", ")}${b.length > 8 ? " …" : ""}` : "";
+            console.log(`  ${f} → ${b.length} dependent file(s)${list}`);
+        }
+        console.log("");
+    }
+    if (!direct.size && !near.size) {
+        console.log(`✓ ${files.length} changed file(s) touch no recorded invariants (directly or via blast radius).`);
         store.close();
         return;
     }
     let blocking = 0;
-    console.log(`Changes touch ${hits.size} invariant(s):\n`);
-    for (const { constraint: c, files: fs } of hits.values()) {
-        if (c.severity === "blocking")
-            blocking++;
-        const mark = c.severity === "blocking" ? "⛔" : c.severity === "warning" ? "⚠" : "·";
-        console.log(`  ${mark} [${c.severity}] ${c.statement}\n      ${c.id} · in: ${fs.join(", ")}\n      rationale: ${c.rationale || "—"}`);
+    if (direct.size) {
+        console.log(`Directly touches ${direct.size} invariant(s):\n`);
+        for (const { c, files: fs } of direct.values()) {
+            if (c.severity === "blocking")
+                blocking++;
+            console.log(`  ${mark(c.severity)} [${c.severity}] ${c.statement}\n      ${c.id} · in: ${fs.join(", ")}\n      rationale: ${c.rationale || "—"}`);
+        }
+    }
+    if (near.size) {
+        console.log(`${direct.size ? "\n" : ""}Near ${near.size} invariant(s) via blast radius (a guarded dependency changed — review):\n`);
+        for (const { c, via } of near.values()) {
+            if (c.severity === "blocking")
+                blocking++;
+            console.log(`  ${mark(c.severity)} [${c.severity}] ${c.statement}\n      ${c.id}\n      ${via.slice(0, 4).join("\n      ")}${via.length > 4 ? `\n      …+${via.length - 4} more path(s)` : ""}`);
+        }
     }
     if (opts.strict && blocking) {
-        console.log(`\n✗ ${blocking} blocking invariant(s) in scope — review before committing.`);
+        console.log(`\n✗ ${blocking} blocking invariant(s) in scope (direct or near) — review before committing.`);
         process.exitCode = 1;
     }
     else {

package/dist/core/ids.js

@@ -3,7 +3,7 @@
  *  git diff of `.hunch/` stays minimal. Decisions/bugs use a content hash too,
  *  so the learning loop is idempotent for the same commit. */
 import { createHash } from "node:crypto";
-function shortHash(input, len = 10) {
+export function shortHash(input, len = 10) {
     return createHash("sha1").update(input).digest("hex").slice(0, len);
 }
 /** Full sha1 (used for signature_hash etc.). */

package/dist/extractors/testreport.js

@@ -0,0 +1,87 @@
+/**
+ * Parse a test run's output into pass/fail signals for the failure-learning loop
+ * (`hunch test`). Test-framework-agnostic: it recognizes both common shapes that
+ * `node:test` (this repo), mocha, ava, vitest, jest, and `prove` emit:
+ *
+ *  - TAP:  `ok 12 - name` / `not ok 3 - name`, with an optional indented YAML
+ *          diagnostic block (error + stack) under a failure.
+ *  - spec: node:test's default non-TTY reporter — `✔ name (1.2ms)` /
+ *          `✖ name (1.2ms)`, failures followed by an indented error block.
+ *          (Also accepts ✓/✗.)
+ *
+ * Design choices:
+ *  - A failure's `message` is the test name plus its indented diagnostic block —
+ *    exactly the context recordFailure() feeds the synthesizer for root-cause and
+ *    suspect ranking.
+ *  - If NEITHER shape is recognized, we return empty lists + recognized=false so
+ *    the caller falls back to a coarse "the suite failed" bug from the raw tail —
+ *    never silently reports success.
+ *  - Results are deduped by name (a spec reporter can echo a failing test in its
+ *    end-of-run recap).
+ */
+// TAP: `ok 12 - desc` / `not ok 3 - desc` (the "- " separator is optional).
+const TAP = /^(not ok|ok)\s+\d+\s*-?\s*(.*)$/;
+// spec: `✔ desc (1.2ms)` (pass) or `✖ desc (1.2ms)` (fail). ✓/✗ accepted too.
+const SPEC = /^([✔✓✖✗])\s+(.*)$/;
+const DURATION = /\s+\(\d+(?:\.\d+)?ms\)\s*$/; // trailing " (1.2ms)" spec suffix
+const DIRECTIVE = /#\s*(SKIP|TODO)\b/i;
+/** Parse TAP-or-spec text. Pure + synchronous so it's trivially unit-testable. */
+export function parseTestReport(output) {
+    const lines = output.split(/\r?\n/);
+    const failMap = new Map();
+    const passSet = new Set();
+    let recognized = false;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        const tap = TAP.exec(trimmed);
+        const spec = tap ? null : SPEC.exec(trimmed);
+        if (!tap && !spec)
+            continue;
+        recognized = true;
+        const isFail = tap ? tap[1] === "not ok" : (spec[1] === "✖" || spec[1] === "✗");
+        let name = (tap ? tap[2] : spec[2]) ?? "";
+        name = name.replace(DURATION, "").trim();
+        if (!name)
+            name = `test #${i + 1}`;
+        if (DIRECTIVE.test(name))
+            continue; // skipped/todo — neither pass nor fail
+        name = stripDirective(name);
+        if (!isFail) {
+            passSet.add(name);
+            continue;
+        }
+        if (failMap.has(name))
+            continue; // dedupe recap echoes
+        // Collect the following more-indented diagnostic block as the message.
+        const baseIndent = leadingSpaces(raw);
+        const block = [];
+        for (let j = i + 1; j < lines.length; j++) {
+            const ln = lines[j];
+            if (ln.trim() === "") {
+                block.push("");
+                continue;
+            }
+            if (leadingSpaces(ln) <= baseIndent)
+                break;
+            block.push(ln.slice(baseIndent + 1));
+        }
+        const diag = block.join("\n").trim();
+        failMap.set(name, { test: name, message: diag ? `${name}\n${diag}` : name });
+    }
+    // A test can legitimately appear as both (flaky retry) — trust the failure.
+    for (const name of failMap.keys())
+        passSet.delete(name);
+    return { failures: [...failMap.values()], passed: [...passSet], recognized };
+}
+function leadingSpaces(s) {
+    let n = 0;
+    while (n < s.length && s[n] === " ")
+        n++;
+    return n;
+}
+function stripDirective(name) {
+    const hash = name.indexOf("#");
+    return (hash === -1 ? name : name.slice(0, hash)).trim();
+}
+//# sourceMappingURL=testreport.js.map

package/dist/store/embedder.js

@@ -32,36 +32,36 @@ function installedPackage() {
     }
     return null;
 }
-/** Run `fn` with stray stdout writes rerouted to stderr. transformers.js / its
- *  backends may log during model load; on the MCP stdio channel a single stray
- *  byte on stdout corrupts JSON-RPC. The guard is active only for the duration of
- *  `fn` (model load), which is the only noisy phase. */
-async function withStdoutGuarded(fn) {
-    const orig = process.stdout.write.bind(process.stdout);
-    const toErr = process.stderr.write.bind(process.stderr);
-    process.stdout.write = toErr;
-    try {
-        return await fn();
-    }
-    finally {
-        process.stdout.write = orig;
-    }
-}
 export class TransformersEmbedder {
     dim = 384;
     id = "all-MiniLM-L6-v2";
     extractor = null;
     load() {
         if (!this.extractor) {
-            this.extractor = withStdoutGuarded(async () => {
+            const p = (async () => {
                 const pkg = installedPackage();
                 if (!pkg)
                     throw new Error("transformers.js not installed");
                 // String var (not a literal) so tsc doesn't require the optional dep to be
                 // present to typecheck/build, and the import resolves at runtime when it is.
+                // transformers.js logs only via an opt-in progress_callback (which we never
+                // pass) and onnxruntime warns to stderr, so the model load never writes to
+                // stdout — safe for the MCP JSON-RPC stdio channel without redirecting it.
                 const mod = (await import(pkg));
-                return (await mod.pipeline("feature-extraction", HF_MODEL));
-            });
+                // Pin dtype to fp32 (the lib's default for this model): silences the
+                // "dtype not specified … using the default dtype (fp32)" line the lib
+                // prints to stderr on every load (it leaked into `hunch query` output),
+                // and guarantees the numbers stay consistent with vectors already
+                // persisted under this model id — changing dtype would shift them.
+                return (await mod.pipeline("feature-extraction", HF_MODEL, { dtype: "fp32" }));
+            })();
+            this.extractor = p;
+            // Never cache a REJECTED load: a transient failure (network blip during the
+            // first model download, a missing/incompatible native backend) must not poison
+            // the embedder for the rest of a long-lived (MCP) process. Reset so the next
+            // call retries from scratch.
+            p.catch(() => { if (this.extractor === p)
+                this.extractor = null; });
         }
         return this.extractor;
     }

package/dist/store/hunchStore.js

@@ -135,6 +135,11 @@ export class HunchStore {
      *  (doc_hash mismatch). Model-free and cheap; run at the end of every reindex()
      *  so vectors track the JSON truth without ever being reset. Returns the count. */
     pruneStaleEmbeddings() {
+        // Lean-install fast path: no vectors → nothing to reconcile. This runs at the
+        // end of EVERY reindex() (a hot path), so skip the full doc scan + per-doc hash
+        // unless embeddings actually exist.
+        if (this.db.prepare(`SELECT count(*) c FROM embeddings`).get().c === 0)
+            return 0;
         const live = new Map(); // ref -> current doc_hash
         for (const d of this.searchDocs())
             live.set(d.ref, embedHash(d.title, d.body));
@@ -157,6 +162,12 @@ export class HunchStore {
         const embedded = this.db.prepare(`SELECT count(*) c FROM embeddings WHERE model = ?`).get(model).c;
         return { embedded, total };
     }
+    /** The SINGLE gate for "can semantic search run right now": an embedder exists and
+     *  it has at least one stored vector. Used by both hybridSearch and the CLI so the
+     *  definition can't drift between them. */
+    semanticReady(embedder) {
+        return !!embedder && this.db.prepare(`SELECT count(*) c FROM embeddings WHERE model = ?`).get(embedder.id).c > 0;
+    }
     /** Generate/refresh embeddings for every doc missing an up-to-date vector for
      *  this embedder's model. Batched + flushed per batch so a Ctrl-C leaves a
      *  coherent partial index that a re-run resumes. Assumes reindex() ran first. */
@@ -170,22 +181,25 @@ export class HunchStore {
         const todo = docs.filter((d) => current.get(d.ref) !== d.hash);
         const ins = this.db.prepare(`INSERT OR REPLACE INTO embeddings (ref, kind, model, dim, doc_hash, vec) VALUES (?,?,?,?,?,?)`);
         const batchSize = opts.batch ?? 32;
-        let done = 0;
+        let embedded = 0; // ACTUAL rows written (a batch may yield fewer vectors than docs)
+        let attempted = 0;
         for (let i = 0; i < todo.length; i += batchSize) {
             const slice = todo.slice(i, i + batchSize);
             const vecs = await embedder.embed(slice.map((d) => `${d.title}\n${d.body}`));
             const tx = this.db.transaction(() => {
                 slice.forEach((d, j) => {
                     const v = vecs[j];
-                    if (v)
+                    if (v) {
                         ins.run(d.ref, d.kind, model, embedder.dim, d.hash, vecToBlob(v));
+                        embedded++;
+                    }
                 });
             });
             tx();
-            done += slice.length;
-            opts.onProgress?.(done, todo.length);
+            attempted += slice.length;
+            opts.onProgress?.(attempted, todo.length);
         }
-        return { embedded: todo.length, skipped: docs.length - todo.length, total: docs.length };
+        return { embedded, skipped: docs.length - todo.length, total: docs.length };
     }
     /** Hybrid search (hunch_query / `hunch query --semantic`): FTS bm25 fused with
      *  cosine over stored embeddings via Reciprocal Rank Fusion. Degrades to pure
@@ -194,40 +208,54 @@ export class HunchStore {
      *  `embedder: null` to FORCE FTS-only without auto-selecting. */
     async hybridSearch(query, limit = 12, opts = {}) {
         const embedder = opts.embedder !== undefined ? opts.embedder : await selectEmbedder();
-        if (!embedder)
-            return this.search(query, limit);
-        const count = this.db.prepare(`SELECT count(*) c FROM embeddings WHERE model = ?`).get(embedder.id).c;
-        if (count === 0)
+        if (!this.semanticReady(embedder))
             return this.search(query, limit);
         const fts = this.search(query, Math.max(limit, 50));
-        let qvec;
         try {
-            [qvec] = await embedder.embed([query]);
+            // The whole semantic leg (query embedding + decode + cosine + fuse) is guarded:
+            // any failure — model load, a corrupt/dim-mismatched vector — degrades to the
+            // lexical results rather than failing the query.
+            const [qvec] = await embedder.embed([query]);
+            if (!qvec)
+                return fts.slice(0, limit);
+            const sem = this.cosineRank(qvec, embedder.id, 50);
+            return this.rrfFuse(fts, sem, limit);
         }
         catch {
-            return fts.slice(0, limit); // embedding failed at query time → lexical only
-        }
-        if (!qvec)
             return fts.slice(0, limit);
-        const sem = this.cosineRank(qvec, embedder.id, 50);
-        return this.rrfFuse(fts, sem, limit);
+        }
     }
     /** Brute-force exact cosine top-n over stored vectors for one model. Vectors are
-     *  pre-normalized, so cosine == dot product. */
+     *  pre-normalized, so cosine == dot product. Scoped to `dim = qvec.length` so a
+     *  row stored at a different dimension (model id reused at a new dim) can never
+     *  drive an out-of-bounds BLOB read; any with an unexpected byte length are
+     *  skipped defensively rather than crashing the query. */
     cosineRank(qvec, model, n) {
-        const rows = this.db.prepare(`SELECT ref, kind, vec FROM embeddings WHERE model = ?`).all(model);
         const dim = qvec.length;
-        const scored = rows.map((r) => {
+        const rows = this.db.prepare(`SELECT ref, kind, vec FROM embeddings WHERE model = ? AND dim = ?`).all(model, dim);
+        const scored = [];
+        for (const r of rows) {
+            if (r.vec.byteLength !== dim * 4)
+                continue; // corrupt/legacy row — skip, don't read past it
             const v = blobToVec(r.vec, dim);
             let dot = 0;
             for (let i = 0; i < dim; i++)
                 dot += qvec[i] * v[i];
-            return { ref: r.ref, kind: r.kind, score: dot };
-        });
+            scored.push({ ref: r.ref, kind: r.kind, score: dot });
+        }
         scored.sort((a, b) => b.score - a.score);
-        return scored.slice(0, n).map((s) => {
-            const row = this.db.prepare(`SELECT title, body FROM search WHERE ref = ?`).get(s.ref);
-            return { ref: s.ref, kind: s.kind, title: row?.title ?? s.ref, snippet: (row?.body ?? "").slice(0, 120), score: s.score };
+        const top = scored.slice(0, n);
+        // Hydrate title/snippet for the top-n in ONE query (not a per-row SELECT).
+        const meta = new Map();
+        if (top.length) {
+            const placeholders = top.map(() => "?").join(",");
+            for (const row of this.db.prepare(`SELECT ref, title, body FROM search WHERE ref IN (${placeholders})`).all(...top.map((s) => s.ref))) {
+                meta.set(row.ref, { title: row.title, body: row.body });
+            }
+        }
+        return top.map((s) => {
+            const m = meta.get(s.ref);
+            return { ref: s.ref, kind: s.kind, title: m?.title ?? s.ref, snippet: (m?.body ?? "").slice(0, 120), score: s.score };
         });
     }
     /** Rank-based Reciprocal Rank Fusion of the FTS and semantic lists. Ranks (not
@@ -309,6 +337,26 @@ export class HunchStore {
         }
         return id;
     }
+    /** Files whose symbols (in)directly DEPEND ON a symbol defined in `file` — the
+     *  blast radius of editing `file`, collapsed to file granularity (nearest depth
+     *  wins per file). Powers `hunch check` near-violation detection and `--blast`. */
+    blastRadiusFiles(file, maxDepth = 4) {
+        const syms = this.db.prepare(`SELECT id FROM symbols WHERE file = ?`).all(file);
+        const out = new Map();
+        for (const s of syms) {
+            for (const dep of this.getDependents(s.id, maxDepth)) {
+                if (!dep.id.startsWith("sym_"))
+                    continue;
+                const r = this.db.prepare(`SELECT name, file FROM symbols WHERE id=?`).get(dep.id);
+                if (!r || r.file === file)
+                    continue; // ignore self-file dependents
+                const prev = out.get(r.file);
+                if (!prev || dep.depth < prev.depth)
+                    out.set(r.file, { file: r.file, via: r.name, depth: dep.depth });
+            }
+        }
+        return [...out.values()].sort((a, b) => a.depth - b.depth || a.file.localeCompare(b.file));
+    }
     /** Constraints whose scope glob matches a path/glob (hunch_check_constraints). */
     checkConstraints(scope) {
         const all = this.json.loadAll("constraints");

package/dist/store/schema.js

@@ -6,95 +6,96 @@
  * — we only need them indexed where we query them. Search is a single unified
  * FTS5 table; the graph is plain tables walked with recursive CTEs.
  */
-import { createHash } from "node:crypto";
+import { shortHash } from "../core/ids.js";
 /** Canonical content hash of the exact title+body that fed both FTS and the
  *  embedding for a doc. Stored in `embeddings.doc_hash` so reindex can tell, with
  *  NO model loaded, whether a stored vector is stale (its source text changed).
- *  The NUL separator keeps the title/body boundary unambiguous. */
+ *  The NUL separator keeps the title/body boundary unambiguous. Reuses the shared
+ *  sha1-truncate idiom from core/ids so the hashing scheme lives in one place. */
 export function embedHash(title, body) {
-    return createHash("sha1").update(title).update("\x00").update(body ?? "").digest("hex").slice(0, 16);
+    return shortHash(`${title}\x00${body ?? ""}`, 16);
 }
-export const SCHEMA_SQL = /* sql */ `
-PRAGMA journal_mode = WAL;
-PRAGMA foreign_keys = OFF;
-
-CREATE TABLE IF NOT EXISTS components (
-  id TEXT PRIMARY KEY,
-  kind TEXT, name TEXT, responsibility TEXT,
-  paths TEXT, status TEXT, owners TEXT,
-  fragility REAL,
-  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT,
-  created_at TEXT, updated_at TEXT
-);
-
-CREATE TABLE IF NOT EXISTS edges (
-  id TEXT PRIMARY KEY,
-  "from" TEXT, "to" TEXT, type TEXT, reason TEXT, strength REAL,
-  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT
-);
-CREATE INDEX IF NOT EXISTS idx_edges_from ON edges("from");
-CREATE INDEX IF NOT EXISTS idx_edges_to ON edges("to");
-CREATE INDEX IF NOT EXISTS idx_edges_type ON edges(type);
-
-CREATE TABLE IF NOT EXISTS symbols (
-  id TEXT PRIMARY KEY,
-  file TEXT, name TEXT, kind TEXT, signature_hash TEXT,
-  calls TEXT, called_by TEXT,
-  loc INTEGER, churn_90d INTEGER, bug_count INTEGER, fan_in INTEGER, fan_out INTEGER,
-  last_changed TEXT
-);
-CREATE INDEX IF NOT EXISTS idx_symbols_file ON symbols(file);
-CREATE INDEX IF NOT EXISTS idx_symbols_name ON symbols(name);
-
-CREATE TABLE IF NOT EXISTS decisions (
-  id TEXT PRIMARY KEY,
-  title TEXT, status TEXT, context TEXT, decision TEXT,
-  consequences TEXT, alternatives_rejected TEXT,
-  related_components TEXT, related_files TEXT,
-  supersedes TEXT, caused_by_bug TEXT, "commit" TEXT,
-  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT,
-  date TEXT
-);
-
-CREATE TABLE IF NOT EXISTS bugs (
-  id TEXT PRIMARY KEY,
-  title TEXT, symptom TEXT, root_cause TEXT, severity TEXT, status TEXT,
-  affected_files TEXT, affected_symbols TEXT, lineage TEXT,
-  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT
-);
-
-CREATE TABLE IF NOT EXISTS constraints (
-  id TEXT PRIMARY KEY,
-  type TEXT, statement TEXT, scope TEXT, severity TEXT, enforcement TEXT,
-  rationale TEXT, source_decision TEXT, violations TEXT,
-  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT
-);
-
--- Unified full-text search across every entity. Rebuilt on index; bm25-ranked.
-CREATE VIRTUAL TABLE IF NOT EXISTS search USING fts5(
-  ref UNINDEXED,   -- entity id
-  kind UNINDEXED,  -- components | edges | symbols | decisions | bugs | constraints
-  title,
-  body,
-  tokenize = 'porter unicode61'
-);
-
--- Local semantic-search vectors (opt-in; written by \`hunch embed\`). One row per
--- (ref, model); vec is a Float32 BLOB. DELIBERATELY NOT in RESET_SQL: reindex()
--- runs RESET on nearly every path (MCP startup, every query/context), so resetting
--- embeddings here would wipe them constantly and make the feature a no-op. Staleness
--- is tracked by doc_hash and reconciled by pruneStaleEmbeddings() instead. Recall is
--- exact brute-force cosine in JS (graphs are small); sqlite-vec only past ~100k rows.
-CREATE TABLE IF NOT EXISTS embeddings (
-  ref TEXT, kind TEXT, model TEXT, dim INTEGER, doc_hash TEXT, vec BLOB,
-  PRIMARY KEY (ref, model)
-);
+export const SCHEMA_SQL = /* sql */ `
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = OFF;
+
+CREATE TABLE IF NOT EXISTS components (
+  id TEXT PRIMARY KEY,
+  kind TEXT, name TEXT, responsibility TEXT,
+  paths TEXT, status TEXT, owners TEXT,
+  fragility REAL,
+  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT,
+  created_at TEXT, updated_at TEXT
+);
+
+CREATE TABLE IF NOT EXISTS edges (
+  id TEXT PRIMARY KEY,
+  "from" TEXT, "to" TEXT, type TEXT, reason TEXT, strength REAL,
+  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_edges_from ON edges("from");
+CREATE INDEX IF NOT EXISTS idx_edges_to ON edges("to");
+CREATE INDEX IF NOT EXISTS idx_edges_type ON edges(type);
+
+CREATE TABLE IF NOT EXISTS symbols (
+  id TEXT PRIMARY KEY,
+  file TEXT, name TEXT, kind TEXT, signature_hash TEXT,
+  calls TEXT, called_by TEXT,
+  loc INTEGER, churn_90d INTEGER, bug_count INTEGER, fan_in INTEGER, fan_out INTEGER,
+  last_changed TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_symbols_file ON symbols(file);
+CREATE INDEX IF NOT EXISTS idx_symbols_name ON symbols(name);
+
+CREATE TABLE IF NOT EXISTS decisions (
+  id TEXT PRIMARY KEY,
+  title TEXT, status TEXT, context TEXT, decision TEXT,
+  consequences TEXT, alternatives_rejected TEXT,
+  related_components TEXT, related_files TEXT,
+  supersedes TEXT, caused_by_bug TEXT, "commit" TEXT,
+  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT,
+  date TEXT
+);
+
+CREATE TABLE IF NOT EXISTS bugs (
+  id TEXT PRIMARY KEY,
+  title TEXT, symptom TEXT, root_cause TEXT, severity TEXT, status TEXT,
+  affected_files TEXT, affected_symbols TEXT, lineage TEXT,
+  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT
+);
+
+CREATE TABLE IF NOT EXISTS constraints (
+  id TEXT PRIMARY KEY,
+  type TEXT, statement TEXT, scope TEXT, severity TEXT, enforcement TEXT,
+  rationale TEXT, source_decision TEXT, violations TEXT,
+  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT
+);
+
+-- Unified full-text search across every entity. Rebuilt on index; bm25-ranked.
+CREATE VIRTUAL TABLE IF NOT EXISTS search USING fts5(
+  ref UNINDEXED,   -- entity id
+  kind UNINDEXED,  -- components | edges | symbols | decisions | bugs | constraints
+  title,
+  body,
+  tokenize = 'porter unicode61'
+);
+
+-- Local semantic-search vectors (opt-in; written by \`hunch embed\`). One row per
+-- (ref, model); vec is a Float32 BLOB. DELIBERATELY NOT in RESET_SQL: reindex()
+-- runs RESET on nearly every path (MCP startup, every query/context), so resetting
+-- embeddings here would wipe them constantly and make the feature a no-op. Staleness
+-- is tracked by doc_hash and reconciled by pruneStaleEmbeddings() instead. Recall is
+-- exact brute-force cosine in JS (graphs are small); sqlite-vec only past ~100k rows.
+CREATE TABLE IF NOT EXISTS embeddings (
+  ref TEXT, kind TEXT, model TEXT, dim INTEGER, doc_hash TEXT, vec BLOB,
+  PRIMARY KEY (ref, model)
+);
 `;
 /** Drop derived data (used before a full reindex). NOTE: embeddings is omitted on
  *  purpose — see the embeddings table comment above. */
-export const RESET_SQL = /* sql */ `
-DELETE FROM components; DELETE FROM edges; DELETE FROM symbols;
-DELETE FROM decisions; DELETE FROM bugs; DELETE FROM constraints;
-DELETE FROM search;
+export const RESET_SQL = /* sql */ `
+DELETE FROM components; DELETE FROM edges; DELETE FROM symbols;
+DELETE FROM decisions; DELETE FROM bugs; DELETE FROM constraints;
+DELETE FROM search;
 `;
 //# sourceMappingURL=schema.js.map

package/dist/synthesis/provider.js

@@ -16,11 +16,86 @@
  * Every provider returns the same shape so the rest of the system never knows
  * (or cares) which one ran.
  */
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import { spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { summarizeDiff } from "../extractors/diff.js";
-const pexec = promisify(execFile);
+const IS_WIN = process.platform === "win32";
+/**
+ * Run a command, optionally feeding `input` to its stdin, and resolve its
+ * stdout. Uses spawn (not execFile) so we can:
+ *   1. Pass untrusted content (the prompt/diff) via STDIN, never as an argv
+ *      element — so a `shell:true` resolution can't shell-interpret it.
+ *   2. Resolve Windows shims: the npm `claude` is a `.cmd`/`.ps1`, which
+ *      `execFile` (CreateProcess, *.exe only) cannot launch → it threw ENOENT
+ *      and made the CLI provider look unavailable on Windows. `shell:true` on
+ *      win32 routes through cmd.exe so the shim resolves. Safe here because
+ *      every argv we pass is a trusted, space-free flag (the prompt is stdin).
+ */
+export function pexecIn(cmd, args, opts = {}) {
+    return new Promise((resolve, reject) => {
+        // Windows: launch through cmd.exe so the `claude` .cmd/.ps1 shim resolves,
+        // and pass the whole line as ONE shell string (args are trusted, space-free
+        // flags) — avoids Node's DEP0190 warning for `args + shell:true`. The prompt
+        // is never here; it goes via stdin below. POSIX: no shell, argv as-is.
+        const child = IS_WIN
+            ? spawn([cmd, ...args].join(" "), {
+                shell: true,
+                env: opts.env,
+                cwd: opts.cwd,
+                windowsHide: true,
+            })
+            : spawn(cmd, args, {
+                env: opts.env,
+                cwd: opts.cwd,
+                windowsHide: true,
+            });
+        const max = opts.maxBuffer ?? 16 * 1024 * 1024;
+        let out = "";
+        let err = "";
+        let outLen = 0;
+        let settled = false;
+        const done = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            fn();
+        };
+        const timer = opts.timeout
+            ? setTimeout(() => {
+                child.kill();
+                done(() => reject(new Error(`"${cmd}" timed out after ${opts.timeout}ms`)));
+            }, opts.timeout)
+            : null;
+        child.on("error", (e) => done(() => reject(e)));
+        child.stdout.on("data", (d) => {
+            outLen += d.length;
+            if (outLen > max) {
+                child.kill();
+                done(() => reject(new Error(`"${cmd}" exceeded maxBuffer (${max} bytes)`)));
+                return;
+            }
+            out += d.toString();
+        });
+        child.stderr.on("data", (d) => {
+            err += d.toString();
+        });
+        child.on("close", (code) => {
+            done(() => {
+                if (code === 0)
+                    resolve({ stdout: out });
+                else
+                    reject(new Error(`"${cmd}" exited ${code}: ${err.slice(0, 300)}`));
+            });
+        });
+        // Feed stdin (the prompt) then close it; commands with no input just get EOF.
+        if (opts.input != null)
+            child.stdin.write(opts.input);
+        child.stdin.on("error", () => { }); // ignore EPIPE if the child exits early
+        child.stdin.end();
+    });
+}
 const SYSTEM = `You are the synthesis engine of an Engineering Memory OS. You turn raw
 developer activity (a git commit diff, or a test failure) into a single structured
 "why" record. Be precise and evidence-grounded; never invent facts not supported by
@@ -66,7 +141,7 @@ class ClaudeCliProvider {
     model = process.env.HUNCH_SYNTH_MODEL || "haiku";
     async available() {
         try {
-            await pexec("claude", ["--version"], { timeout: 8000 });
+            await pexecIn("claude", ["--version"], { timeout: 8000 });
             return true;
         }
         catch {
@@ -87,8 +162,11 @@ class ClaudeCliProvider {
         // repo's own hunch MCP server / CLAUDE.md on every commit (cheaper, and no
         // risk of the synthesis call recursing through the Hunch). Auth lives in the
         // user's home config, not cwd, so this doesn't affect subscription billing.
-        const args = ["-p", prompt, "--output-format", "json", "--model", this.model, "--max-turns", "1"];
-        const { stdout } = await pexec("claude", args, {
+        // Prompt goes via STDIN (-p reads piped stdin), never argv — keeps untrusted
+        // diff content out of any shell the spawn helper uses on Windows.
+        const args = ["-p", "--output-format", "json", "--model", this.model, "--max-turns", "1"];
+        const { stdout } = await pexecIn("claude", args, {
+            input: prompt,
             env: childEnv,
             cwd: tmpdir(),
             maxBuffer: 16 * 1024 * 1024,

package/dist/synthesis/synthesize.js

@@ -165,6 +165,43 @@ export async function recordFailure(store, root, failure) {
     raiseFragility(store, affectedFiles);
     return { status: "written", bug, constraint, provider: provider.name };
 }
+/** Orchestrate one `hunch test` run into graph writes: capture each failing test
+ *  as a Bug (recordFailure → suspects / recurrence / Constraint promotion), and
+ *  resolve any open Bug whose test now passes. Kept free of console I/O so the
+ *  whole capture→resolve→promote loop is unit-testable. Does NOT reindex — the
+ *  caller does, once. `status` is the runner's exit code (null if unknown). */
+export async function captureTestRun(store, root, input) {
+    const { report, status } = input;
+    // Unrecognized output that still failed → one coarse bug from the tail, rather
+    // than silently reporting success (the worst failure mode for a learning loop).
+    let failures = report.failures;
+    let fallback = false;
+    if (!report.recognized && status !== 0) {
+        const tail = input.output.trim().split(/\r?\n/).slice(-40).join("\n");
+        failures = [{ test: input.cmd, message: `Test run failed (exit ${status}); output not TAP/spec.\n${tail}` }];
+        fallback = true;
+    }
+    const results = [];
+    for (const f of failures) {
+        const r = await recordFailure(store, root, f);
+        results.push({ bug: r.bug, constraint: r.constraint });
+    }
+    let sha = null;
+    try {
+        sha = headSha(root);
+    }
+    catch { /* not a git repo / no HEAD — leave null */ }
+    const fixed = [];
+    for (const name of report.passed) {
+        const b = store.json.get("bugs", bugId(name));
+        if (b && b.status === "open") {
+            const resolved = { ...b, status: "fixed", lineage: { ...b.lineage, fixed_commit: sha } };
+            store.json.put("bugs", resolved);
+            fixed.push(resolved);
+        }
+    }
+    return { results, fixed, fallback };
+}
 /** Whether a bug should auto-promote a regression Constraint (a do-not-break
  *  invariant). A recurrence always does. Otherwise it must be high/critical AND
  *  substantiated by a real root cause — a bare severity label with no analysis

package/package.json

@@ -1,68 +1,68 @@
-{
-  "name": "@davesheffer/hunch",
-  "version": "0.1.0",
-  "license": "MIT",
-  "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
-  "description": "Hunch — an Engineering Memory OS: a persistent, git-native reasoning graph over a codebase, exposed to Claude Code via MCP.",
-  "homepage": "https://hunch.sh",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/davesheffer/hunch.git"
-  },
-  "bugs": {
-    "url": "https://github.com/davesheffer/hunch/issues"
-  },
-  "type": "module",
-  "bin": {
-    "hunch": "dist/cli/index.js"
-  },
-  "files": [
-    "dist/**/*.js"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": [
-    "claude-code",
-    "mcp",
-    "engineering-memory",
-    "knowledge-graph",
-    "code-intelligence",
-    "ai",
-    "developer-tools"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "scripts": {
-    "clean": "node --input-type=commonjs -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
-    "dev": "tsx src/cli/index.ts",
-    "hunch": "tsx src/cli/index.ts",
-    "test": "tsx --test test/*.test.ts",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "better-sqlite3": "12.9.0",
-    "commander": "^15.0.0",
-    "tree-sitter": "0.21.1",
-    "tree-sitter-typescript": "^0.23.2",
-    "zod": "^4.4.3"
-  },
-  "devDependencies": {
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^20.19.0",
-    "tsx": "^4.22.4",
-    "typescript": "^5.9.3"
-  },
-  "peerDependencies": {
-    "@huggingface/transformers": ">=3"
-  },
-  "peerDependenciesMeta": {
-    "@huggingface/transformers": {
-      "optional": true
-    }
-  }
-}
+{
+  "name": "@davesheffer/hunch",
+  "version": "0.4.0",
+  "license": "MIT",
+  "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
+  "description": "Hunch — an Engineering Memory OS: a persistent, git-native reasoning graph over a codebase, exposed to Claude Code via MCP.",
+  "homepage": "https://hunch.sh",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/davesheffer/hunch.git"
+  },
+  "bugs": {
+    "url": "https://github.com/davesheffer/hunch/issues"
+  },
+  "type": "module",
+  "bin": {
+    "hunch": "dist/cli/index.js"
+  },
+  "files": [
+    "dist/**/*.js"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "claude-code",
+    "mcp",
+    "engineering-memory",
+    "knowledge-graph",
+    "code-intelligence",
+    "ai",
+    "developer-tools"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "clean": "node --input-type=commonjs -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "dev": "tsx src/cli/index.ts",
+    "hunch": "tsx src/cli/index.ts",
+    "test": "tsx --test test/*.test.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "better-sqlite3": "12.9.0",
+    "commander": "^15.0.0",
+    "tree-sitter": "0.21.1",
+    "tree-sitter-typescript": "^0.23.2",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^20.19.0",
+    "tsx": "^4.22.4",
+    "typescript": "^5.9.3"
+  },
+  "peerDependencies": {
+    "@huggingface/transformers": ">=3"
+  },
+  "peerDependenciesMeta": {
+    "@huggingface/transformers": {
+      "optional": true
+    }
+  }
+}