@davesheffer/hunch 0.14.0 → 0.14.1

package/README.md

@@ -109,8 +109,10 @@ The MCP tools Claude calls under the hood: `hunch_why`, `hunch_query`,
 `hunch_check_constraints`, `hunch_get_dependents` (blast radius), `hunch_blast_radius`
 (dependent files + near-violations a change could break indirectly), `hunch_bug_lineage`,
 `hunch_context` (surgical minimal slice for a task), `hunch_timeline` (a target's decision
-history over time), `hunch_record_decision` (write-back). `hunch_why` and `hunch_context`
-take an optional `as_of` (commit/tag/branch) to **time-travel** the graph to a past state.
+history over time), `hunch_merge_verdict` (a cited BLOCK/WARN/PASS over a diff — see below),
+and the write-backs `hunch_record_decision`, `hunch_record_correction` (turn a correction into
+an enforced invariant — see below). `hunch_why` and `hunch_context` take an optional `as_of`
+(commit/tag/branch) to **time-travel** the graph to a past state.
 
 ### Works with any MCP assistant
 

package/dist/synthesis/provider.js

@@ -177,6 +177,18 @@ class CliSynthProvider {
         return draft;
     }
 }
+// A model id comes from a HUNCH_*_MODEL env var and ends up as an argv token that,
+// on Windows, pexecIn joins into the cmd.exe line (shell:true, to resolve the npm
+// `.cmd` shim). The untrusted prompt always travels via stdin — never argv — so the
+// ONLY non-literal token reaching that shell line is this model id. Reject anything
+// with whitespace or a cmd.exe metacharacter so a poisoned env var can't smuggle
+// `& evil.exe` into the line; fall back to the provider default rather than crash on
+// a mere typo. (pexecIn itself stays general — callers may legitimately pass a
+// pre-quoted path token — so the guard lives here, at the untrusted-input source.)
+const MODEL_RE = /^[A-Za-z0-9._:/-]+$/;
+export function safeModel(v, fallback) {
+    return v && MODEL_RE.test(v) ? v : fallback;
+}
 // --------------------------------------------------------------------------
 // Provider A: headless `claude -p` CLI — billed to the user's Claude subscription
 // --------------------------------------------------------------------------
@@ -184,7 +196,7 @@ class ClaudeCliProvider extends CliSynthProvider {
     name = "claude-cli";
     // Default to the `haiku` alias (cheap/fast, and survives model retirements)
     // rather than a pinned dated id; override with HUNCH_SYNTH_MODEL if needed.
-    model = process.env.HUNCH_SYNTH_MODEL || "haiku";
+    model = safeModel(process.env.HUNCH_SYNTH_MODEL, "haiku");
     async available() {
         try {
             await pexecIn("claude", ["--version"], { timeout: 8000 });
@@ -242,7 +254,7 @@ class ClaudeCliProvider extends CliSynthProvider {
 // --------------------------------------------------------------------------
 class CodexCliProvider extends CliSynthProvider {
     name = "codex-cli";
-    model = process.env.HUNCH_CODEX_MODEL; // omit → codex uses its configured default
+    model = safeModel(process.env.HUNCH_CODEX_MODEL, undefined); // omit → codex uses its configured default
     async available() {
         try {
             await pexecIn("codex", ["--version"], { timeout: 8000 });
@@ -266,7 +278,7 @@ class CodexCliProvider extends CliSynthProvider {
 // --------------------------------------------------------------------------
 class CursorCliProvider extends CliSynthProvider {
     name = "cursor-agent";
-    model = process.env.HUNCH_CURSOR_MODEL;
+    model = safeModel(process.env.HUNCH_CURSOR_MODEL, undefined);
     async available() {
         try {
             await pexecIn("cursor-agent", ["--version"], { timeout: 8000 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "license": "MIT",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Hunch — an Engineering Memory OS: a persistent, git-native reasoning graph over a codebase, exposed to Claude Code via MCP.",
@@ -20,7 +20,8 @@
     "dist/**/*.js"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "keywords": [
     "claude-code",