@davesheffer/hunch 0.17.1 → 0.17.3

package/README.md

@@ -160,14 +160,15 @@ per-machine fixups. → [docs](https://hunch-pi.vercel.app/docs#team)
 
 ## Private memory (public repo, private context)
 
-Open-source your code without open-sourcing your *reasoning*. Point `HUNCH_PRIVATE_DIR` at a
-separate **private repo** and Hunch unions that store into every query and guard **locally** —
-MCP and the pre-edit hook see your sensitive decisions/bugs/constraints — while your public
-`.hunch/` stays clean. It's **opt-in and default-off** (unset the var → fully inert), and
-**leak-safe by construction**: committed files and the CI PR comment render *public-only*, so a
-private record can't reach a public surface. Record sensitive items with `private: true`
-(`hunch_record_decision` / `hunch_record_correction`); `hunch doctor` shows whether the overlay
-is on. → [docs](https://hunch-pi.vercel.app/docs#private)
+Open-source your code without open-sourcing your *reasoning*. **`hunch private`** sets up a
+separate private store in one command — Hunch unions it into every query and guard **locally**
+(MCP and the pre-edit hook see your sensitive decisions/bugs/constraints) while your public
+`.hunch/` stays clean. It writes a gitignored `.hunch/local.json` so it's auto-detected — **no
+env var, no shell-profile edit** (and `HUNCH_PRIVATE_DIR` still overrides per-shell). **Opt-in,
+default-off** (no config → fully inert), and **leak-safe by construction**: committed files and
+the CI PR comment render *public-only*, so a private record can't reach a public surface. Record
+sensitive items with `private: true` (`hunch_record_decision` / `hunch_record_correction`);
+post-commit synthesis can route there too. → [docs](https://hunch-pi.vercel.app/docs#private)
 
 ## Continuous learning (CI)
 

package/dist/cli/index.js

@@ -13,14 +13,16 @@
  *   mcp       start the MCP server (Claude Code connects here)
  *   doctor    environment diagnostics
  */
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { execFileSync, spawnSync } from "node:child_process";
-import { relative, resolve } from "node:path";
+import { join, relative, resolve, isAbsolute } from "node:path";
 import { Command } from "commander";
-import { hunchPaths, findRoot, toPosixTarget } from "../core/paths.js";
+import { hunchPaths, hunchPathsForDir, findRoot, toPosixTarget } from "../core/paths.js";
+import { writeFileAtomic } from "../core/io.js";
 import { looksLikeCorrection, CORRECTION_NUDGE } from "../core/correction.js";
 import { HUNCH_VERSION } from "../core/version.js";
 import { HunchStore } from "../store/hunchStore.js";
+import { JsonStore } from "../store/jsonStore.js";
 import { selectEmbedder } from "../store/embedder.js";
 import { indexRepo } from "../extractors/indexer.js";
 import { syncCommit, recordFailure, captureTestRun } from "../synthesis/synthesize.js";
@@ -65,6 +67,7 @@ program
     .option("--no-agent-hooks", "skip installing the Claude Code agent hooks (.claude/settings.json)")
     .option("--firmness <level>", "agent-hook firmness: off | advisory | firm | strict")
     .option("--private-sync", "post-commit synthesis writes captured decisions into the private overlay (HUNCH_PRIVATE_DIR), never the public repo")
+    .option("--auto-commit", "opt-in: the post-commit hook also git add+commit+pushes the captured decision (the repo it landed in)")
     .action((opts) => {
     // Validate --firmness up front, before any side effects (indexing, git hooks,
     // .mcp.json) or opening the store — a bad value must not leave a half-init.
@@ -93,8 +96,8 @@ program
             console.log(`  ⚠ ${res.skipped} file(s) could not be parsed (skipped)`);
     }
     if (isGitRepo(root)) {
-        const h = installPostCommitHook(root, inv.shell, { private: opts.privateSync });
-        console.log(`  ✓ post-commit hook ${h.action} (learning loop)${opts.privateSync ? " — syncs to the private overlay" : ""}`);
+        const h = installPostCommitHook(root, inv.shell, { private: opts.privateSync, commit: opts.autoCommit });
+        console.log(`  ✓ post-commit hook ${h.action} (learning loop)${opts.privateSync ? " — syncs to the private overlay" : ""}${opts.autoCommit ? " — auto-commit+push on" : ""}`);
         const m = installMergeDriver(root, inv.shell);
         console.log(`  ✓ team merge driver ${m.action}`);
         // Auto-install the pre-commit guard by default (advisory: flags invariants
@@ -225,6 +228,7 @@ program
     .option("--quiet", "minimal output")
     .option("--force", "re-synthesize even if a decision already exists for the commit")
     .option("--private", "write the synthesized decision into the private overlay (HUNCH_PRIVATE_DIR), not the public repo — for a repo whose memory is kept private")
+    .option("--commit", "after a capture, also git add+commit+push the repo the decision landed in (opt-in; best-effort) — the private store under --private, else this repo")
     .action(async (sha, opts) => {
     const { store, root } = storeFor();
     if (!isGitRepo(root))
@@ -241,6 +245,20 @@ program
         // on every commit. `hunch index`/`init` refresh it intentionally instead.
         if (!opts.fromHook)
             updateClaudeMd(root, store);
+        // Opt-in: persist the captured decision in the repo it landed in (private store
+        // under --private, else this repo). Best-effort — a non-repo dir / offline push
+        // just no-ops. Stage ONLY the hunch dir (never sweep unrelated working-tree
+        // changes), and set HUNCH_SYNC=1 so the commit we create can't re-trigger this
+        // hook (no recursion, including on a manual `hunch sync --commit`).
+        const commitTarget = opts.commit ? (opts.private ? store.privateDir : hunchPaths(root).hunch) : undefined;
+        if (commitTarget) {
+            const g = (args) => { spawnSync("git", ["-C", commitTarget, ...args], { stdio: "ignore", env: { ...process.env, HUNCH_SYNC: "1" } }); };
+            g(["add", "--", "."]);
+            g(["commit", "-m", `hunch: capture ${r.decision?.id ?? "decision"}`]);
+            g(["push"]);
+            if (!opts.quiet)
+                console.log(`  ↳ committed + pushed ${r.decision?.id} (${commitTarget})`);
+        }
         if (!opts.quiet)
             console.log(`✓ captured decision ${r.decision?.id} via ${r.provider}: "${r.decision?.title}"`);
     }
@@ -249,6 +267,55 @@ program
     }
     store.close();
 });
+// ---- private (one-command setup for the private memory overlay) ------------
+program
+    .command("private [dir]")
+    .description("Enable a PRIVATE memory overlay — sensitive decisions/bugs/constraints kept in a separate location, unioned into local queries, never committed here. Writes a gitignored .hunch/local.json so it's auto-detected (no env var needed).")
+    .option("--repo <url>", "clone a private git repo to use as the store (into ./.hunch-private)")
+    .option("--no-hook", "don't switch the post-commit hook to private sync")
+    .option("--auto-commit", "opt-in: the post-commit hook also git add+commit+pushes the private repo after each capture")
+    .action((dir, opts) => {
+    const root = findRoot();
+    const paths = hunchPaths(root);
+    // 1) resolve the private store's hunch dir (holds decisions/, bugs/, …)
+    let hunchDir;
+    if (opts.repo) {
+        const dest = join(root, ".hunch-private");
+        if (!existsSync(dest)) {
+            const r = spawnSync("git", ["clone", opts.repo, dest], { stdio: "inherit" });
+            if (r.status !== 0)
+                return fail(`git clone failed for ${opts.repo}`);
+        }
+        hunchDir = join(dest, ".hunch");
+    }
+    else {
+        hunchDir = dir ? resolve(root, dir) : join(root, ".hunch-private", ".hunch");
+    }
+    // 2) create the layout (decisions/, manifest, …) so it's queryable immediately
+    new JsonStore(hunchPathsForDir(hunchDir)).ensureDirs();
+    // 3) record the path in a GITIGNORED local config — auto-detected, no env var, and
+    //    the MCP server picks it up too. Atomic write (con_902759b3dc) since it's under .hunch/.
+    mkdirSync(paths.hunch, { recursive: true }); // tolerate a repo where `hunch init` hasn't run yet
+    // Store a repo-relative POSIX path when the store lives INSIDE the repo (portable +
+    // OS-clean — survives a repo move, resolves the same on any OS); an absolute path for
+    // a store elsewhere on disk. Resolution (env || local.json) re-resolves against root.
+    const rel = relative(root, hunchDir);
+    const stored = rel && !rel.startsWith("..") && !isAbsolute(rel) ? toPosixTarget(rel) : hunchDir;
+    writeFileAtomic(join(paths.hunch, "local.json"), JSON.stringify({ privateDir: stored }, null, 2) + "\n");
+    ensureGitignore(root); // keeps .hunch/local.json + .hunch-private/ out of git
+    // 4) route post-commit synthesis to the overlay (local hook, never committed)
+    let hookNote = "";
+    if (opts.hook && isGitRepo(root)) {
+        const inv = resolveInvocation();
+        const h = installPostCommitHook(root, inv.shell, { private: true, commit: opts.autoCommit });
+        hookNote = `  ✓ post-commit hook ${h.action} — captured decisions route here${opts.autoCommit ? " (auto-commit+push on)" : ""}\n`;
+    }
+    console.log(`✓ private overlay enabled → ${hunchDir}\n` +
+        `  ✓ recorded in .hunch/local.json (gitignored) — auto-detected, no env var or shell-profile edit\n` +
+        hookNote +
+        `  record sensitive items with private:true (hunch_record_decision / hunch_record_correction)\n` +
+        `  override per-shell with HUNCH_PRIVATE_DIR; CI / public PR comments stay public-only.`);
+});
 // ---- query ----------------------------------------------------------------
 program
     .command("query")
@@ -1049,10 +1116,9 @@ program
     }
     const c = store.reindex().counts;
     console.log(`hunch:      ${c.symbols} symbols, ${c.edges} edges, ${c.components} components, ${c.decisions} decisions, ${c.bugs} bugs, ${c.constraints} constraints`);
-    const privDir = process.env.HUNCH_PRIVATE_DIR?.trim();
-    console.log(privDir
-        ? `private:    on → ${resolve(privDir)} (local overlay — unioned into queries; never committed or posted publicly)`
-        : dim(`private:    off — set HUNCH_PRIVATE_DIR to overlay a separate private memory repo for sensitive records`));
+    console.log(store.privateDir
+        ? `private:    on → ${store.privateDir} (local overlay — unioned into queries; never committed or posted publicly)`
+        : dim(`private:    off — run \`hunch private\` to keep sensitive memory in a separate repo (or set HUNCH_PRIVATE_DIR)`));
     // Semantic search is opt-in and local. Report availability + coverage without
     // loading the model (selectEmbedder only probes; embeddingStats just counts rows).
     const emb = await selectEmbedder();

package/dist/integrations/gitignore.js

@@ -19,6 +19,9 @@ const ENTRIES = [
     ".hunch/*.sqlite-wal",
     ".hunch/*.sqlite-journal",
     ".hunch/**/*.tmp*",
+    // Per-machine private-overlay pointer written by `hunch private` (holds the local
+    // path to the private store) — never committed.
+    ".hunch/local.json",
     // A local PRIVATE overlay store (HUNCH_PRIVATE_DIR) for sensitive memory — never
     // committed. This is the conventional in-repo path; point the env elsewhere for a
     // fully separate private repo.

package/dist/integrations/hooks.js

@@ -11,14 +11,16 @@ const MARK = "# >>> hunch post-commit >>>";
 const ENDMARK = "# <<< hunch post-commit <<<";
 function block(invocation, opts = {}) {
     // --private routes the auto-synthesized decision into the HUNCH_PRIVATE_DIR overlay
-    // instead of the public repo. The hook script is local (.git/hooks/), never committed,
-    // so a repo whose memory is kept private leaves no trace of this in the public tree.
+    // instead of the public repo. --commit (opt-in) also commits & pushes the repo the
+    // decision landed in (the private store under --private, else this repo). The hook
+    // script is local (.git/hooks/), never committed.
     const priv = opts.private ? " --private" : "";
+    const commit = opts.commit ? " --commit" : "";
     return [
         MARK,
         'if [ -z "$HUNCH_SYNC" ]; then',
         "  export HUNCH_SYNC=1",
-        `  ( ${invocation} sync --from-hook --quiet${priv} >/dev/null 2>&1 || true ) &`,
+        `  ( ${invocation} sync --from-hook --quiet${priv}${commit} >/dev/null 2>&1 || true ) &`,
         "fi",
         ENDMARK,
     ].join("\n");

package/dist/store/hunchStore.js

@@ -10,7 +10,8 @@
  *   - bugLineage():     bugs matching a symptom/symbol + their lineage
  *   - fragility():      ranked fragility report with evidence
  */
-import { resolve } from "node:path";
+import { resolve, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
 import { toPosixTarget, hunchPathsForDir } from "../core/paths.js";
 import { ENTITY_KINDS } from "../core/types.js";
 import { openDb } from "./db.js";
@@ -27,6 +28,9 @@ export class HunchStore {
     /** Optional PRIVATE overlay (HUNCH_PRIVATE_DIR) — a second store in a repo the
      *  user controls. Unioned into reads via recs(); never written by public paths. */
     privateJson;
+    /** The resolved private-overlay hunch dir (from env or .hunch/local.json), or undefined
+     *  when no overlay is configured. Surfaced so `hunch doctor` reflects the true state. */
+    privateDir;
     /** When true, recs() ignores the private overlay (public-only). Set transiently by
      *  buildCheckReport({publicOnly}) so any PUBLICLY-POSTED report (the CI PR comment)
      *  can never render a private record — a publicly-posted output is a leak surface
@@ -36,9 +40,28 @@ export class HunchStore {
     constructor(paths) {
         this.paths = paths;
         this.json = new JsonStore(paths);
-        const priv = process.env.HUNCH_PRIVATE_DIR?.trim();
-        if (priv)
-            this.privateJson = new JsonStore(hunchPathsForDir(resolve(priv)));
+        // Private overlay location: env (override, for CI / portability) → else a gitignored
+        // local config (.hunch/local.json) so `hunch private` enables it with NO env var, and
+        // the MCP server / hook pick it up automatically. Relative paths resolve from root.
+        const priv = process.env.HUNCH_PRIVATE_DIR?.trim() || this.localPrivateDir();
+        if (priv) {
+            this.privateDir = resolve(this.paths.root, priv);
+            this.privateJson = new JsonStore(hunchPathsForDir(this.privateDir));
+        }
+    }
+    /** The private-overlay path from the gitignored `.hunch/local.json` (per-machine,
+     *  never committed). Tolerant: undefined on missing/invalid so reads never crash. */
+    localPrivateDir() {
+        try {
+            const f = join(this.paths.hunch, "local.json");
+            if (!existsSync(f))
+                return undefined;
+            const v = JSON.parse(readFileSync(f, "utf8"));
+            return typeof v.privateDir === "string" && v.privateDir.trim() ? v.privateDir.trim() : undefined;
+        }
+        catch {
+            return undefined;
+        }
     }
     /** Merged read: public ∪ private overlay (private wins on id collision). Every
      *  QUERY / REINDEX path uses this so MCP + the guards see private memory. Public-

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "0.17.1",
+  "version": "0.17.3",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Hunch — an Engineering Memory OS: a persistent, git-native reasoning graph over a codebase, exposed to Claude Code via MCP.",