@davesheffer/hunch 0.12.1 → 0.13.0

package/dist/cli/index.js

@@ -17,7 +17,8 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { execFileSync, spawnSync } from "node:child_process";
 import { relative } from "node:path";
 import { Command } from "commander";
-import { hunchPaths, findRoot } from "../core/paths.js";
+import { hunchPaths, findRoot, toPosixTarget } from "../core/paths.js";
+import { looksLikeCorrection, CORRECTION_NUDGE } from "../core/correction.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { selectEmbedder } from "../store/embedder.js";
 import { indexRepo } from "../extractors/indexer.js";
@@ -55,7 +56,7 @@ function storeFor() {
 // ---- init -----------------------------------------------------------------
 program
     .command("init")
-    .description("Scaffold .hunch/, index the repo, install the git hook, and wire up Claude Code.")
+    .description("Scaffold .hunch/, index the repo, install the git hook, and wire up your coding assistants (Claude Code, Cursor, VS Code, Windsurf, Codex).")
     .option("--no-index", "skip the initial repo index")
     .option("--no-enforce", "do not install the advisory pre-commit constraint guard")
     .option("--enforce-strict", "make the pre-commit guard FAIL the commit on a direct, high-confidence, non-stale blocking invariant")
@@ -133,7 +134,7 @@ program
                 console.log(`  ⚠ skipped ${p.assistant}: ${p.error}`);
     }
     store.close();
-    console.log("\nNext: make a commit (the hook captures a decision), then ask Claude Code \"why is X built this way?\"");
+    console.log("\nNext: make a commit (the hook captures a decision), then ask your coding assistant \"why is X built this way?\"");
     console.log("Cold start? Seed from history:  hunch backfill --since 90d");
 });
 // ---- index ----------------------------------------------------------------
@@ -409,7 +410,7 @@ program
         return fail(`--severity must be one of: ${SEV.join(", ")}`);
     const { store, root } = storeFor();
     store.json.ensureDirs();
-    const scope = opts.scope.split(",").map((s) => s.trim()).filter(Boolean);
+    const scope = opts.scope.split(",").map((s) => toPosixTarget(s.trim())).filter(Boolean);
     const c = store.json.put("constraints", {
         id: constraintId(statement),
         type: opts.type,
@@ -736,7 +737,11 @@ program
         if (firmness === "off")
             return;
         if (evt.hook_event_name === "UserPromptSubmit") {
-            emitContext("UserPromptSubmit", HOOK_REMINDER);
+            // When the prompt reads like a correction ("no / that's wrong / never X"),
+            // nudge the agent to PERSIST it as an enforced constraint (Never Twice) —
+            // not just obey it this once and forget it next session.
+            const text = looksLikeCorrection(evt.prompt) ? `${HOOK_REMINDER}\n\n${CORRECTION_NUDGE}` : HOOK_REMINDER;
+            emitContext("UserPromptSubmit", text);
             return;
         }
         if (evt.hook_event_name !== "PreToolUse")

package/dist/cli/invocation.js

@@ -1,20 +1,37 @@
 /** Figures out how to re-invoke this CLI from a git hook / .mcp.json, working
  *  both when running the built dist (plain node) and in dev via tsx. */
 import { fileURLToPath } from "node:url";
+/** Published package name — used for OS-agnostic invocations (see below). */
+const PKG = "@davesheffer/hunch";
 export function resolveInvocation() {
     const entry = fileURLToPath(import.meta.url).replace(/invocation\.(js|ts)$/, "index.$1");
     const isDev = entry.endsWith(".ts");
     // JSON.stringify yields a double-quoted, backslash-escaped token /bin/sh
     // accepts — so install paths with spaces don't break the hook command.
     const q = (s) => JSON.stringify(s);
+    // Running from an installed copy (global, local, or npx cache — i.e. NOT a
+    // source checkout we're hacking on). The MCP/provider config files we write
+    // are committed and shared across a team via git, so they must NOT embed this
+    // machine's absolute path or OS-specific separators. Reference Hunch by its
+    // published package name instead, which `npx` resolves the same on any OS and
+    // any clone. The git hook lives in per-machine .git/hooks (never committed),
+    // so it keeps the PATH-robust absolute-node invocation below.
+    const installed = !isDev && entry.replace(/\\/g, "/").includes("/node_modules/");
+    if (installed) {
+        return {
+            shell: `${q(process.execPath)} ${q(entry)}`,
+            mcp: { command: "npx", args: ["-y", PKG] },
+        };
+    }
     if (isDev) {
         return {
             shell: `npx tsx ${q(entry)}`,
             mcp: { command: "npx", args: ["tsx", entry] },
         };
     }
-    // Use the absolute node binary (process.execPath) rather than a bare `node`,
-    // so the hook works even when nvm's `node` isn't on the hook's PATH.
+    // Source-checkout dist run (e.g. `node dist/cli/index.js`, npm link): inherently
+    // per-machine. Use the absolute node binary (process.execPath) rather than a bare
+    // `node`, so the hook works even when nvm's `node` isn't on the hook's PATH.
     return {
         shell: `${q(process.execPath)} ${q(entry)}`,
         mcp: { command: process.execPath, args: [entry] },

package/dist/core/correction.js

@@ -0,0 +1,79 @@
+/** "Never Twice" — turn a human correction of the agent into a first-class,
+ *  enforced Constraint (DESIGN: Correction Capture → Enforced Constraint).
+ *
+ *  Two pure, client-agnostic pieces, factored out of the MCP server and the
+ *  agent hook so they are unit-testable without spinning either up:
+ *   - looksLikeCorrection(): does a user prompt read like "no / that's wrong /
+ *     never do X" — the cue to nudge the agent to persist it.
+ *   - buildCorrectionConstraint(): mint the Constraint record (human-confirmed,
+ *     scoped conservatively) that the pre-edit hook + CI guard then enforce.
+ */
+import { constraintId } from "./ids.js";
+import { toPosixTarget } from "./paths.js";
+/** Correction cues. Deliberately conservative — anchored to imperative/rebuke
+ *  phrasing, not bare "no", so ordinary conversational negation ("no idea",
+ *  "no problem") doesn't train users to ignore the nudge (research risk #5). */
+const CORRECTION_PATTERNS = [
+    // OPENS with a rebuke — but exclude benign "no problem / no idea / no test exists…".
+    // The exclusion list guards against stateful conversational negation ("no tests pass",
+    // "no way to fix this") firing the nudge and training users to ignore it.
+    /^\s*no\b(?!\s+(problem|worries|idea|rush|need|biggie|thanks|thank|prob|clue|luck|difference|harm|reason|point|test|tests|way|ways|chance|context|functions?|method|file|files|change|changes|diff|other|more))/i,
+    /^\s*(nope|stop)\b/i,
+    /\b(that'?s|that is|this is) (wrong|incorrect|not right|not what)\b/i,
+    /\b(never|do not ever|don'?t ever) (do|use|call|add|write|put|import|commit|touch)\b/i,
+    /\b(don'?t|do not) (do|use|call|add|write|put|commit) (that|this|it)\b/i,
+    /\b(you must|must always|you should always|make sure (to|you|that you))\b/i,
+    /\b(i (already )?told you|i said|as i said|like i said)\b/i,
+    /\b(undo|revert) (that|this|it|your)\b/i,
+    /\b(not like that|don'?t do (that|this)( again)?|stop doing (that|this))\b/i,
+];
+export function looksLikeCorrection(prompt) {
+    if (!prompt || typeof prompt !== "string")
+        return false;
+    return CORRECTION_PATTERNS.some((re) => re.test(prompt));
+}
+/** One-line nudge appended to the UserPromptSubmit hook context when a prompt
+ *  reads like a correction — surfaces the write tool so the rule gets ENFORCED,
+ *  not merely remembered. Client-agnostic (no Claude-only wording). */
+export const CORRECTION_NUDGE = "This looks like a correction. If it's a rule the agent should never break again, " +
+    "call hunch_record_correction({ rule, scope_hint_file, severity, applies_to_all }) so it " +
+    "becomes an enforced, scoped constraint (held at edit-time and in CI) — not a one-off the next session forgets. " +
+    "Use severity:\"blocking\" only when the human said never/must; set applies_to_all:true only if the rule is genuinely repo-wide.";
+/**
+ * Build the Constraint a correction mints. Pure (caller passes `now`), so the
+ * scope/severity policy is testable in isolation. Key safety rule (research
+ * risk #2 — the scope footgun): a repo-wide ("**") constraint may only be
+ * BLOCKING when the caller explicitly set applies_to_all; otherwise a single
+ * mis-scoped correction would deny every edit under strict firmness, so we
+ * down-rank it to a warning.
+ */
+export function buildCorrectionConstraint(input, now) {
+    const rule = input.rule.trim();
+    if (!rule)
+        throw new Error("rule must not be empty");
+    // A blank/"." scope hint would mint a meaningless or repo-wide constraint by
+    // accident, so fall back to "**" (which the severity guard below then keeps
+    // non-blocking unless applies_to_all was explicitly set).
+    const hinted = input.scope_hint_file ? toPosixTarget(input.scope_hint_file) : "";
+    const scope = input.applies_to_all || !hinted || hinted === "." ? ["**"] : [hinted];
+    const repoWide = scope.length === 1 && scope[0] === "**";
+    let severity = input.severity ?? "warning";
+    if (severity === "blocking" && repoWide && !input.applies_to_all)
+        severity = "warning";
+    return {
+        id: constraintId(rule),
+        type: input.type ?? "correctness",
+        statement: rule,
+        scope,
+        severity,
+        enforcement: "advisory_v1",
+        rationale: input.rationale ?? "Captured from a human correction of the agent (Never Twice).",
+        source_decision: input.source_decision ?? null,
+        violations: [],
+        status: "active",
+        valid_from: now,
+        valid_to: null,
+        provenance: { source: "human_confirmed", confidence: 1, evidence: [], last_verified: now },
+    };
+}
+//# sourceMappingURL=correction.js.map

package/dist/core/ids.js

@@ -32,8 +32,10 @@ export function decisionId(seed) {
 export function bugId(seed) {
     return "bug_" + shortHash(seed);
 }
-/** Constraint id seeded by its statement. */
+/** Constraint id seeded by its statement. Trim + lowercase so trivial
+ *  whitespace/case variants of the same rule collapse to one id (idempotent
+ *  re-capture), instead of minting a duplicate constraint. */
 export function constraintId(statement) {
-    return "con_" + shortHash(statement.toLowerCase());
+    return "con_" + shortHash(statement.trim().toLowerCase());
 }
 //# sourceMappingURL=ids.js.map

package/dist/core/paths.js

@@ -3,6 +3,14 @@ import { join } from "node:path";
 import { existsSync, statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 export const HUNCH_DIR = ".hunch";
+/** Canonicalize a free-form path/target to repo-relative POSIX form. Hunch stores
+ *  every path with forward slashes (git emits "/" on all OSes), so any user- or
+ *  agent-supplied target must be normalized before comparison — otherwise a
+ *  Windows caller passing `src\auth\session.ts` never matches the stored
+ *  `src/auth/session.ts`. Safe on symbol names too: they contain no backslashes. */
+export function toPosixTarget(target) {
+    return target.replace(/\\/g, "/").replace(/^\.\//, "");
+}
 export function hunchPaths(root) {
     const hunch = join(root, HUNCH_DIR);
     return {

package/dist/integrations/scaffold.js

@@ -22,38 +22,38 @@ export function writeMcpJson(root, inv) {
     writeFileSync(file, JSON.stringify(json, null, 2) + "\n");
     return file;
 }
-const WHY_CMD = `---
-description: Explain why a file or symbol is the way it is, from Hunch
----
-Use the \`hunch_why\` MCP tool on **$ARGUMENTS** (a file path or symbol name).
-
-Then summarize, with citations:
-- the **decisions** that shaped it (id + rationale),
-- the **constraints** that must not break,
-- the **bug history** behind it (root causes).
-
-Cite record ids and their provenance/confidence. If Hunch returns nothing,
-say so plainly and suggest running \`hunch index\` or \`hunch backfill\`.
+const WHY_CMD = `---
+description: Explain why a file or symbol is the way it is, from Hunch
+---
+Use the \`hunch_why\` MCP tool on **$ARGUMENTS** (a file path or symbol name).
+
+Then summarize, with citations:
+- the **decisions** that shaped it (id + rationale),
+- the **constraints** that must not break,
+- the **bug history** behind it (root causes).
+
+Cite record ids and their provenance/confidence. If Hunch returns nothing,
+say so plainly and suggest running \`hunch index\` or \`hunch backfill\`.
 `;
-const FIX_CMD = `---
-description: Fix a bug grounded in Hunch (past root causes, constraints, blast radius)
----
-We are fixing: **$ARGUMENTS**
-
-Follow the Hunch-grounded workflow (DESIGN §5) — do NOT skip the memory lookups:
-1. \`hunch_bug_lineage("$ARGUMENTS")\` — has this class of bug happened before? what was the root cause and the fix?
-2. Identify the suspect symbol/file, then \`hunch_get_dependents(<symbol>)\` to learn the blast radius.
-3. \`hunch_check_constraints(<scope>)\` — list invariants you must preserve.
-4. Propose a fix that honors past root causes AND constraints. Apply it and run the tests.
-5. If the fix encodes a non-trivial choice, \`hunch_record_decision(...)\` so the next session is grounded in it.
+const FIX_CMD = `---
+description: Fix a bug grounded in Hunch (past root causes, constraints, blast radius)
+---
+We are fixing: **$ARGUMENTS**
+
+Follow the Hunch-grounded workflow (DESIGN §5) — do NOT skip the memory lookups:
+1. \`hunch_bug_lineage("$ARGUMENTS")\` — has this class of bug happened before? what was the root cause and the fix?
+2. Identify the suspect symbol/file, then \`hunch_get_dependents(<symbol>)\` to learn the blast radius.
+3. \`hunch_check_constraints(<scope>)\` — list invariants you must preserve.
+4. Propose a fix that honors past root causes AND constraints. Apply it and run the tests.
+5. If the fix encodes a non-trivial choice, \`hunch_record_decision(...)\` so the next session is grounded in it.
 `;
-const FRAGILE_CMD = `---
-description: Report the most fragile parts of this codebase, with evidence
----
-Ask Hunch for the fragility ranking (run \`hunch fragile\` or query Hunch),
-then produce a **fragility report with evidence**: the specific files/functions,
-the bug history behind them, their churn and fan-in, and any missing guards.
-Avoid generic advice — every claim must cite a Hunch record or metric.
+const FRAGILE_CMD = `---
+description: Report the most fragile parts of this codebase, with evidence
+---
+Ask Hunch for the fragility ranking (run \`hunch fragile\` or query Hunch),
+then produce a **fragility report with evidence**: the specific files/functions,
+the bug history behind them, their churn and fan-in, and any missing guards.
+Avoid generic advice — every claim must cite a Hunch record or metric.
 `;
 /** A settings.json hook entry is Hunch's if any of its commands ends with the
  *  Hunch CLI entry + the `hook` subcommand (e.g. `…/index.js hook`). Matching the

package/dist/mcp/server.js

@@ -9,10 +9,11 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { hunchPaths, findRoot } from "../core/paths.js";
+import { hunchPaths, findRoot, toPosixTarget } from "../core/paths.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { selectEmbedder } from "../store/embedder.js";
 import { decisionId } from "../core/ids.js";
+import { buildCorrectionConstraint } from "../core/correction.js";
 import { revParse, asOfDate } from "../extractors/git.js";
 import { formatContext } from "../core/format.js";
 const ok = (text) => ({ content: [{ type: "text", text }] });
@@ -29,6 +30,7 @@ const SEV_BUG = { critical: 4, high: 3, medium: 2, low: 1 };
 const more = (total, cap, hint = "") => total > cap ? `\n  …(+${total - cap} more${hint ? ` — ${hint}` : ""})` : "";
 /** Resolve a free-form target (symbol id / name / file path) to symbol records. */
 function resolveSymbols(store, target) {
+    target = toPosixTarget(target);
     const syms = store.json.loadAll("symbols");
     const byId = syms.find((s) => s.id === target);
     if (byId)
@@ -42,7 +44,7 @@ function resolveSymbols(store, target) {
  *  radius). Falls back to the literal target so direct-scope checks still run. */
 function resolveFiles(store, target) {
     const files = new Set(resolveSymbols(store, target).map((s) => s.file));
-    return files.size ? [...files] : [target];
+    return files.size ? [...files] : [toPosixTarget(target)];
 }
 export function buildServer(root) {
     const store = new HunchStore(hunchPaths(root));
@@ -261,7 +263,7 @@ export function buildServer(root) {
                 consequences: decision.consequences ?? [],
                 alternatives_rejected: decision.alternatives_rejected ?? [],
                 related_components: decision.related_components ?? existing?.related_components ?? [],
-                related_files: decision.related_files ?? existing?.related_files ?? [],
+                related_files: (decision.related_files ?? existing?.related_files ?? []).map(toPosixTarget),
                 supersedes: decision.supersedes ?? existing?.supersedes ?? null,
                 superseded_by: existing?.superseded_by ?? null,
                 caused_by_bug: existing?.caused_by_bug ?? null,
@@ -269,7 +271,7 @@ export function buildServer(root) {
                 valid_from: existing?.valid_from ?? now,
                 valid_to: existing?.valid_to ?? null,
                 retired: existing?.retired ?? { symbols: [], deps: [] },
-                provenance: { source, confidence: 0.95, evidence: decision.related_files ?? existing?.provenance.evidence ?? [] },
+                provenance: { source, confidence: 0.95, evidence: (decision.related_files ?? existing?.provenance.evidence ?? []).map(toPosixTarget) },
                 date: now,
             };
             store.json.put("decisions", rec);
@@ -285,6 +287,36 @@ export function buildServer(root) {
             return err(`Failed to record decision: ${e.message}`);
         }
     });
+    // -- hunch_record_correction (write-back: "Never Twice") ------------------
+    server.registerTool("hunch_record_correction", {
+        title: "Capture a correction as an enforced constraint (Never Twice)",
+        description: "When a human corrects the agent ('no, do it this way' / 'never call X here'), persist that correction as a first-class, SCOPED Constraint with provenance — so the pre-edit hook and the CI Constraint Guard hold EVERY assistant to it from now on, instead of it being forgotten next session. Writes to the shared .hunch/ graph (client-agnostic). Set severity:'blocking' only when the human said never/must; set applies_to_all:true only when the rule is genuinely repo-wide (otherwise it is scoped to scope_hint_file).",
+        inputSchema: {
+            rule: z.string().describe("The invariant in the human's words, e.g. \"never call the pay-per-token API here\"."),
+            scope_hint_file: z.string().optional().describe("A file the correction was about; scopes the constraint to it (the conservative default)."),
+            severity: z.enum(["advisory", "warning", "blocking"]).optional().describe("Default 'warning'. Use 'blocking' only for a hard never/must rule."),
+            applies_to_all: z.boolean().optional().describe("True ONLY if the rule is genuinely repo-wide (scopes to **); required to make a repo-wide rule blocking."),
+            type: z.enum(["security", "performance", "correctness", "architecture", "compliance"]).optional(),
+            rationale: z.string().optional().describe("Why it must hold."),
+            source_decision: z.string().optional().describe("id of a decision this correction derives from."),
+        },
+    }, async (input) => {
+        try {
+            if (!input.rule || !input.rule.trim())
+                return err("rule is required — state the invariant in plain words.");
+            const rec = buildCorrectionConstraint(input, new Date().toISOString());
+            const existing = store.json.get("constraints", rec.id);
+            store.json.put("constraints", rec);
+            store.reindex();
+            const enforce = rec.severity === "blocking"
+                ? "blocks a DIRECT edit to its scope at strict firmness, and fails a PR whose diff touches that scope (CI guard); blast-radius hits and lower firmness stay advisory"
+                : "flags violating edits and PRs (advisory)";
+            return ok(`${existing ? "Updated" : "Recorded"} ${rec.severity} constraint ${rec.id}: "${rec.statement}" (scope: ${rec.scope.join(", ")}). It now ${enforce}.`);
+        }
+        catch (e) {
+            return err(`Failed to record correction: ${e.message}`);
+        }
+    });
     return server;
 }
 function provLine(record) {

package/dist/store/hunchStore.js

@@ -1,3 +1,16 @@
+/**
+ * HunchStore — the read/write query layer over the JSON source of truth and the
+ * SQLite derived index. Everything the CLI and MCP server need flows through here.
+ *
+ *   - reindex():        JSON  -> SQLite (rebuild the derived index + FTS)
+ *   - search():         FTS5 ranked query (hunch_query)
+ *   - why():            decisions/bugs/constraints explaining a path/symbol
+ *   - getDependents():  recursive-CTE blast radius over the call/dep graph
+ *   - checkConstraints(): constraints whose scope matches a glob/path
+ *   - bugLineage():     bugs matching a symptom/symbol + their lineage
+ *   - fragility():      ranked fragility report with evidence
+ */
+import { toPosixTarget } from "../core/paths.js";
 import { ENTITY_KINDS } from "../core/types.js";
 import { openDb } from "./db.js";
 import { RESET_SQL, embedHash } from "./schema.js";
@@ -112,7 +125,7 @@ export class HunchStore {
         if (!match)
             return this.likeSearch(query, limit);
         try {
-            const rows = this.db.prepare(`SELECT ref, kind, title, snippet(search, 3, '[', ']', '…', 12) AS snip, bm25(search) AS score
+            const rows = this.db.prepare(`SELECT ref, kind, title, snippet(search, 3, '[', ']', '…', 12) AS snip, bm25(search) AS score
          FROM search WHERE search MATCH ? ORDER BY score LIMIT ?`).all(match, limit);
             return rows.map((r) => ({ ref: r.ref, kind: r.kind, title: r.title, snippet: r.snip, score: r.score }));
         }
@@ -124,7 +137,7 @@ export class HunchStore {
     /** Substring fallback over titles/bodies (handles non-ASCII / malformed FTS). */
     likeSearch(query, limit) {
         const like = `%${query.replace(/[%_]/g, "")}%`;
-        const rows = this.db.prepare(`SELECT ref, kind, title, substr(body,1,120) AS snip FROM search
+        const rows = this.db.prepare(`SELECT ref, kind, title, substr(body,1,120) AS snip FROM search
        WHERE title LIKE ? OR body LIKE ? LIMIT ?`).all(like, like, limit);
         return rows.map((r) => ({ ref: r.ref, kind: r.kind, title: r.title, snippet: r.snip, score: 0 }));
     }
@@ -281,6 +294,7 @@ export class HunchStore {
      *  instant — "what did we believe as of commit X?". Omit `asOf` for the full,
      *  history-inclusive view (backward-compatible default). */
     why(target, opts = {}) {
+        target = toPosixTarget(target);
         const decisions = this.json.loadAll("decisions");
         const bugs = this.json.loadAll("bugs");
         const constraints = this.json.loadAll("constraints");
@@ -308,37 +322,37 @@ export class HunchStore {
      *  walk edges BACKWARD (edges.to = current) following call/dep/import/contains. */
     getDependents(id, maxDepth = 6) {
         return this.db.prepare(
-        /* sql */ `
-      WITH RECURSIVE up(node, depth) AS (
-        SELECT ?, 0
-        UNION
-        SELECT e."from", up.depth + 1
-        FROM edges e JOIN up ON e."to" = up.node
-        WHERE e.type IN ('calls','depends_on','imports','contains') AND up.depth < ?
-      )
-      SELECT up.node AS id, MIN(up.depth) AS depth,
-             COALESCE(s.name || ' @ ' || s.file, c.name, up.node) AS via
-      FROM up
-      LEFT JOIN symbols s ON s.id = up.node
-      LEFT JOIN components c ON c.id = up.node
+        /* sql */ `
+      WITH RECURSIVE up(node, depth) AS (
+        SELECT ?, 0
+        UNION
+        SELECT e."from", up.depth + 1
+        FROM edges e JOIN up ON e."to" = up.node
+        WHERE e.type IN ('calls','depends_on','imports','contains') AND up.depth < ?
+      )
+      SELECT up.node AS id, MIN(up.depth) AS depth,
+             COALESCE(s.name || ' @ ' || s.file, c.name, up.node) AS via
+      FROM up
+      LEFT JOIN symbols s ON s.id = up.node
+      LEFT JOIN components c ON c.id = up.node
       WHERE up.node <> ? GROUP BY up.node ORDER BY depth, id`).all(id, maxDepth, id);
     }
     /** Symbols/components this id depends ON (forward walk) — used for refactor blast radius. */
     getDependencies(id, maxDepth = 6) {
         return this.db.prepare(
-        /* sql */ `
-      WITH RECURSIVE down(node, depth) AS (
-        SELECT ?, 0
-        UNION
-        SELECT e."to", down.depth + 1
-        FROM edges e JOIN down ON e."from" = down.node
-        WHERE e.type IN ('calls','depends_on','imports','contains') AND down.depth < ?
-      )
-      SELECT down.node AS id, MIN(down.depth) AS depth,
-             COALESCE(s.name || ' @ ' || s.file, c.name, down.node) AS via
-      FROM down
-      LEFT JOIN symbols s ON s.id = down.node
-      LEFT JOIN components c ON c.id = down.node
+        /* sql */ `
+      WITH RECURSIVE down(node, depth) AS (
+        SELECT ?, 0
+        UNION
+        SELECT e."to", down.depth + 1
+        FROM edges e JOIN down ON e."from" = down.node
+        WHERE e.type IN ('calls','depends_on','imports','contains') AND down.depth < ?
+      )
+      SELECT down.node AS id, MIN(down.depth) AS depth,
+             COALESCE(s.name || ' @ ' || s.file, c.name, down.node) AS via
+      FROM down
+      LEFT JOIN symbols s ON s.id = down.node
+      LEFT JOIN components c ON c.id = down.node
       WHERE down.node <> ? GROUP BY down.node ORDER BY depth, id`).all(id, maxDepth, id);
     }
     /** Files whose symbols (in)directly DEPEND ON a symbol defined in `file` — the
@@ -350,17 +364,17 @@ export class HunchStore {
         // the bare `via` take the name from the nearest-depth row. The inner JOIN drops
         // non-symbol nodes; `s.file <> ?` drops self-file dependents.
         return this.db.prepare(
-        /* sql */ `
-      WITH RECURSIVE up(node, depth) AS (
-        SELECT id, 0 FROM symbols WHERE file = ?
-        UNION
-        SELECT e."from", up.depth + 1
-        FROM edges e JOIN up ON e."to" = up.node
-        WHERE e.type IN ('calls','depends_on','imports','contains') AND up.depth < ?
-      )
-      SELECT s.file AS file, s.name AS via, MIN(up.depth) AS depth
-      FROM up JOIN symbols s ON s.id = up.node
-      WHERE up.depth > 0 AND s.file <> ?
+        /* sql */ `
+      WITH RECURSIVE up(node, depth) AS (
+        SELECT id, 0 FROM symbols WHERE file = ?
+        UNION
+        SELECT e."from", up.depth + 1
+        FROM edges e JOIN up ON e."to" = up.node
+        WHERE e.type IN ('calls','depends_on','imports','contains') AND up.depth < ?
+      )
+      SELECT s.file AS file, s.name AS via, MIN(up.depth) AS depth
+      FROM up JOIN symbols s ON s.id = up.node
+      WHERE up.depth > 0 AND s.file <> ?
       GROUP BY s.file ORDER BY depth, file`).all(file, maxDepth, file);
     }
     /** Constraints whose scope glob matches a path/glob (hunch_check_constraints).
@@ -558,6 +572,7 @@ export class HunchStore {
      *  a task on `target`, ordered by what matters most — invariants first, then the
      *  why, then blast radius and bug history — trimmed to a rough token budget. */
     assembleContext(target, budget = 1500, opts = {}) {
+        target = toPosixTarget(target);
         const w = this.why(target, opts);
         const symIds = w.symbols.map((s) => s.id);
         const blast = new Map();