@davesheffer/hunch 0.20.0 → 0.21.1

package/README.md

@@ -179,6 +179,13 @@ the CI PR comment render *public-only*, so a private record can't reach a public
 sensitive items with `private: true` (`hunch_record_decision` / `hunch_record_correction`);
 post-commit synthesis can route there too, and `hunch private --auto-commit` (opt-in)
 auto-commits + pushes each capture to the private repo — recursion-safe, staging only `.hunch/`.
+
+Already published a repo *with* its `.hunch/` memory and want it private after the fact?
+`hunch private --repo <url> --migrate` does it in one shot: it **moves** your existing public
+records into the overlay (union by id — nothing is lost), empties the public store, untracks +
+gitignores the `.hunch/` memory tree, and regenerates the assistant grounding (CLAUDE.md, AGENTS.md,
+…) so the repo becomes **code-only**. It commits the private overlay for you and prints the one
+`git` command to commit the now-clean public repo.
 → [docs](https://hunch-pi.vercel.app/docs#private)
 
 ## Continuous learning (CI)

package/dist/cli/index.js

@@ -28,16 +28,16 @@ import { indexRepo } from "../extractors/indexer.js";
 import { syncCommit, recordFailure, captureTestRun } from "../synthesis/synthesize.js";
 import { parseTestReport } from "../extractors/testreport.js";
 import { selectProvider } from "../synthesis/provider.js";
-import { isGitRepo, headSha, logSince, lastChangeDate, stagedFiles, commitFiles, asOfDate, stagedDiff, commitDiff, rangeFiles, rangeDiff, revExists, commitAndPushHunch } from "../extractors/git.js";
+import { isGitRepo, headSha, logSince, lastChangeDate, stagedFiles, commitFiles, asOfDate, stagedDiff, commitDiff, rangeFiles, rangeDiff, revExists, commitAndPushHunch, gitUntrackCached } from "../extractors/git.js";
 import { renderText, renderMarkdown, reportFailsStrict } from "../core/checkreport.js";
 import { partitionReview, READY_MIN_GROUNDED } from "../core/reviewqueue.js";
 import { installPostCommitHook, installPreCommitHook } from "../integrations/hooks.js";
 import { installMergeDriver } from "../integrations/mergeDriver.js";
-import { ensureGitignore } from "../integrations/gitignore.js";
+import { ensureGitignore, ignoreHunchMemory, HUNCH_MEMORY_DIRS } from "../integrations/gitignore.js";
 import { writeCiWorkflow } from "../integrations/ciAction.js";
 import { updateClaudeMd } from "../integrations/claudemd.js";
 import { writeMcpJson, writeSlashCommands, installClaudeHooks } from "../integrations/scaffold.js";
-import { scaffoldProviders } from "../integrations/providers.js";
+import { scaffoldProviders, regenerateGrounding } from "../integrations/providers.js";
 import { healClaudeConfigCaseSplit } from "../integrations/claudeConfig.js";
 import { formatContext } from "../core/format.js";
 import { readConfig, writeConfig, FIRMNESS_LEVELS, isFirmness } from "../core/config.js";
@@ -46,6 +46,8 @@ import { draftTripwires, knownRepoDeps } from "../synthesis/tripwires.js";
 import { constraintId } from "../core/ids.js";
 import { readManifest, writeManifest, SCHEMA_VERSION } from "../core/migrate.js";
 import { mergeHunchJson } from "../store/merge.js";
+import { movePublicMemoryToPrivate } from "../store/privateMigrate.js";
+import { ENTITY_KINDS } from "../core/types.js";
 import { planCompaction } from "../store/compact.js";
 import { resolveInvocation } from "./invocation.js";
 const program = new Command();
@@ -288,6 +290,7 @@ program
     .option("--no-hook", "don't switch the post-commit hook to private sync")
     .option("--auto-commit", "opt-in: also git add+commit+push the private repo after each capture (post-commit hook AND MCP private writes)")
     .option("--sync", "flush the configured private store now (git add+commit+push) — catches records made via MCP between commits")
+    .option("--migrate", "ONE-TIME: move this repo's EXISTING public .hunch memory into the overlay, then make the public repo code-only — untrack + gitignore the memory tree and regenerate grounding so no memory is published here")
     .action((dir, opts) => {
     const root = findRoot();
     if (opts.sync) {
@@ -334,9 +337,36 @@ program
         const h = installPostCommitHook(root, inv.shell, { private: true, commit: opts.autoCommit });
         hookNote = `  ✓ post-commit hook ${h.action} — captured decisions route here${opts.autoCommit ? " (auto-commit+push on)" : ""}\n`;
     }
+    // 5) one-time migration: MOVE existing public memory INTO the overlay, then make
+    //    THIS repo code-only. Records are absorbed (union by id) BEFORE the public
+    //    store is emptied, so an interrupted run never loses memory.
+    let migrateNote = "";
+    if (opts.migrate) {
+        const pub = new JsonStore(paths);
+        const priv = new JsonStore(hunchPathsForDir(hunchDir));
+        const res = movePublicMemoryToPrivate(pub, priv);
+        for (const kind of ENTITY_KINDS)
+            pub.dropAll(kind); // public store now empty on disk
+        if (isGitRepo(root))
+            gitUntrackCached(root, HUNCH_MEMORY_DIRS); // stop publishing it
+        ignoreHunchMemory(root);
+        const gstore = new HunchStore(paths); // public store is empty → grounding shows no memory
+        const grounding = regenerateGrounding(root, gstore);
+        gstore.close();
+        commitAndPushHunch(hunchDir, "hunch: absorb public memory into private overlay"); // durable
+        const breakdown = Object.entries(res.moved).map(([k, n]) => `${n} ${k}`).join(", ") || "0 records";
+        migrateNote =
+            `  ✓ migrated public memory → overlay (${breakdown}); public store emptied\n` +
+                `  ✓ untracked + gitignored the .hunch memory tree — this repo is now CODE-ONLY\n` +
+                `  ✓ regenerated ${grounding.length} grounding file(s) (CLAUDE.md, AGENTS.md, …) — no public memory shown\n` +
+                `  ✓ committed + pushed the private overlay (best-effort)\n` +
+                `  next: review, then commit the PUBLIC repo:\n` +
+                `      git add -A && git commit -m "chore: move engineering memory to a private overlay" && git push\n`;
+    }
     console.log(`✓ private overlay enabled → ${hunchDir}\n` +
         `  ✓ recorded in .hunch/local.json (gitignored) — auto-detected, no env var or shell-profile edit\n` +
         hookNote +
+        migrateNote +
         `  record sensitive items with private:true (hunch_record_decision / hunch_record_correction)\n` +
         `  override per-shell with HUNCH_PRIVATE_DIR; CI / public PR comments stay public-only.`);
 });

package/dist/core/types.js

@@ -79,7 +79,7 @@ export const RetiredSignalSchema = z.object({
  *  existed in code, so its prose is turned into a testable set/regex. Carries its
  *  OWN provenance, separate from the decision's: an LLM may DRAFT a tripwire
  *  (advisory only); only a `human_confirmed` tripwire may BLOCK a commit — for every
- *  tier. One predictable rule (dec_a466655539). See docs/veto.md. */
+ *  tier. One predictable rule (dec_a466655539). */
 export const RejectedTripwireSchema = z.object({
     alternative: z.string().describe("the rejected approach's human text — printed verbatim in the receipt"),
     scope: z.array(z.string()).default([]).describe("glob(s) it applies to, e.g. vscode-extension/**"),

package/dist/extractors/git.js

@@ -39,6 +39,18 @@ export function commitAndPushHunch(hunchDir, message) {
 export function headSha(cwd) {
     return gitSafe(["rev-parse", "HEAD"], cwd);
 }
+/** Stop tracking `paths` in git (remove from the INDEX only — keep the working-tree
+ *  files). Used by `hunch private --migrate` to un-publish the .hunch memory tree
+ *  without deleting it locally. `--ignore-unmatch` makes an already-untracked path a
+ *  no-op rather than an error; best-effort (a non-repo dir just no-ops). */
+export function gitUntrackCached(cwd, paths) {
+    if (paths.length === 0)
+        return;
+    try {
+        execFileSync("git", ["-C", cwd, "rm", "-r", "--cached", "--quiet", "--ignore-unmatch", "--", ...paths], { stdio: "ignore" });
+    }
+    catch { /* best-effort: not a repo / nothing tracked */ }
+}
 /** Resolve any commit-ish (short sha / HEAD / branch) to a canonical full sha.
  *  Returns the input unchanged if it can't be resolved (e.g. not a git repo). */
 export function revParse(ref, cwd) {

package/dist/integrations/gitignore.js

@@ -27,24 +27,54 @@ const ENTRIES = [
     // fully separate private repo.
     ".hunch-private/",
 ];
-export function ensureGitignore(root) {
+// `hunch private --migrate` makes the repo CODE-ONLY: the engineering-memory tree
+// (one curated subdir per kind) moves to a private overlay and must stop being
+// published here. The derived index + pointer are already covered by the block
+// above; this is a SEPARATE marked block so re-running `private` doesn't have to
+// re-touch the block above, and so the two concerns read clearly in the file.
+const MEM_MARK = "# >>> hunch private-only (engineering memory kept in a private overlay; not published here) >>>";
+const MEM_END = "# <<< hunch private-only <<<";
+const MEM_ENTRIES = [
+    ".hunch/decisions/",
+    ".hunch/bugs/",
+    ".hunch/constraints/",
+    ".hunch/components/",
+    ".hunch/symbols/",
+    ".hunch/edges/",
+];
+/** Idempotent + merge-safe append of one marked block (con_8460b6770f): never
+ *  rewrites the user's existing entries, and re-running is a no-op once the block
+ *  (or an equivalent hand-written set of the same patterns) is present. */
+function appendBlock(root, mark, entries, end) {
     const path = join(root, ".gitignore");
-    const block = [MARK, ...ENTRIES, END].join("\n");
+    const block = [mark, ...entries, end].join("\n");
     if (!existsSync(path)) {
         writeFileSync(path, block + "\n");
         return { path, action: "created" };
     }
     const cur = readFileSync(path, "utf8");
-    if (cur.includes(MARK))
+    if (cur.includes(mark))
         return { path, action: "unchanged" }; // already managed
     // Already covered by the user's OWN entries (e.g. a hand-written, commented
     // section listing the same patterns)? Don't append a redundant managed block —
     // that would leave two copies of every ignore. Keep the .gitignore clean.
     const lines = new Set(cur.split("\n").map((l) => l.trim()));
-    if (ENTRIES.every((e) => lines.has(e)))
+    if (entries.every((e) => lines.has(e)))
         return { path, action: "unchanged" };
     const sep = cur.endsWith("\n") || cur.length === 0 ? "" : "\n";
     writeFileSync(path, `${cur}${sep}${block}\n`);
     return { path, action: "appended" };
 }
+export function ensureGitignore(root) {
+    return appendBlock(root, MARK, ENTRIES, END);
+}
+/** Ignore the engineering-memory tree so a private-migrated repo stays code-only.
+ *  The kind subdirs the user's records live in (decisions/, bugs/, …) move to the
+ *  private overlay; this stops git from re-publishing them. The `.hunch/` dir, its
+ *  manifest, and the local.json pointer are left tracked/managed elsewhere. */
+export function ignoreHunchMemory(root) {
+    return appendBlock(root, MEM_MARK, MEM_ENTRIES, MEM_END);
+}
+/** The .hunch memory subdirs un-published by a private migration (git pathspecs). */
+export const HUNCH_MEMORY_DIRS = MEM_ENTRIES.map((e) => e.replace(/\/$/, ""));
 //# sourceMappingURL=gitignore.js.map

package/dist/integrations/providers.js

@@ -19,7 +19,7 @@
  */
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { renderHunchSection, upsertSection } from "./claudemd.js";
+import { renderHunchSection, upsertSection, updateClaudeMd } from "./claudemd.js";
 /** Strip // line and block comments + trailing commas (JSONC → JSON). String-aware
  *  (double-quoted, with escapes) so a // inside a value isn't mangled. VS Code's
  *  .vscode/mcp.json is JSONC, so we must tolerate comments. */
@@ -226,6 +226,21 @@ export function writeWindsurfRule(root, store) {
     writeFileSync(file, body);
     return file;
 }
+/** Rewrite the auto-maintained Hunch section in EVERY assistant grounding doc
+ *  (CLAUDE.md, AGENTS.md, Copilot instructions, Cursor + Windsurf rules) from the
+ *  current store — without touching the MCP/provider config files. `hunch private
+ *  --migrate` calls this AFTER emptying the public store so the committed public
+ *  docs reflect that no engineering memory is published here (renderHunchSection
+ *  reads the public store only, so private records never leak into them). */
+export function regenerateGrounding(root, store) {
+    return [
+        updateClaudeMd(root, store),
+        writeAgentsMd(root, store),
+        writeCopilotInstructions(root, store),
+        writeCursorRule(root, store),
+        writeWindsurfRule(root, store),
+    ];
+}
 /** Scaffold MCP config + grounding for all supported assistants. Returns a
  *  per-assistant summary for `hunch init` to print. Each assistant is isolated:
  *  a writer that refuses to clobber a malformed file degrades to a warning rather

package/dist/mcp/server.js

@@ -288,9 +288,13 @@ export function buildServer(root) {
             else
                 store.json.put("decisions", rec);
             // Invalidate, don't delete: closing the superseded decision's valid-time window
-            // (+ a supersedes edge) preserves the why-it-changed trail. Supersede operates on
-            // the public store, so skip it for a private record (a v1 limitation, not a leak).
-            const superseded = decision.supersedes && !decision.private ? store.supersede(decision.supersedes, rec) : null;
+            // (+ a supersedes edge) preserves the why-it-changed trail. Route the close to the
+            // same store the new record landed in — a private decision supersedes within the
+            // private overlay; a public one in the committed store. A private write never
+            // mutates the public store.
+            const superseded = decision.supersedes
+                ? (decision.private ? store.supersedePrivate(decision.supersedes, rec) : store.supersede(decision.supersedes, rec))
+                : null;
             store.reindex();
             // Auto-flush the private repo when configured (hunch private --auto-commit), so a
             // record made via MCP between public commits is committed+pushed immediately.

package/dist/store/hunchStore.js

@@ -615,7 +615,22 @@ export class HunchStore {
      *  and write a `supersedes` edge. Returns the updated old decision, or null if it
      *  doesn't exist. All writes are atomic via json.put (con_902759b3dc). */
     supersede(oldId, by) {
-        const old = this.json.get("decisions", oldId);
+        return this.supersedeIn(this.json, oldId, by);
+    }
+    /** Private-overlay counterpart of `supersede`: close + link the old decision inside
+     *  the HUNCH_PRIVATE_DIR store, so a PRIVATE decision can supersede another private
+     *  one (the MCP record path is private→private). A private write never mutates the
+     *  committed public store. Returns null if no private store is configured or the old
+     *  record isn't in it. */
+    supersedePrivate(oldId, by) {
+        if (!this.privateJson)
+            return null;
+        this.privateJson.ensureDirs();
+        return this.supersedeIn(this.privateJson, oldId, by);
+    }
+    /** Shared body for supersede / supersedePrivate against a specific store. */
+    supersedeIn(json, oldId, by) {
+        const old = json.get("decisions", oldId);
         if (!old || old.id === by.id)
             return null;
         const closed = {
@@ -624,7 +639,7 @@ export class HunchStore {
             superseded_by: by.id,
             valid_to: old.valid_to ?? by.valid_from ?? null,
         };
-        this.json.put("decisions", closed);
+        json.put("decisions", closed);
         const edge = {
             id: edgeId(by.id, oldId, "supersedes"),
             from: by.id,
@@ -634,7 +649,7 @@ export class HunchStore {
             strength: 1,
             provenance: { source: "derived", confidence: 1, evidence: [by.id, oldId] },
         };
-        this.json.put("edges", edge);
+        json.put("edges", edge);
         return closed;
     }
     /** Regression Guard: detect a change RE-INTRODUCING something an in-force
@@ -690,7 +705,7 @@ export class HunchStore {
      *  never did. Precision-first ladder (dep > symbol > pattern); the semantic tier is
      *  advisory and lives elsewhere. A hit `blocks` only when isVetoBlocker passes (a
      *  human-confirmed tripwire on an in-force, non-stale decision — dec_a466655539).
-     *  Read-only; shared by buildCheckReport. See docs/veto.md. */
+     *  Read-only; shared by buildCheckReport. */
     vetoHits(an, files, staleDecisions = new Set()) {
         const addedDeps = new Set(an.addedDeps);
         const out = [];

package/dist/store/jsonStore.js

@@ -229,6 +229,24 @@ export class JsonStore {
         this.invalidate(kind);
         return true;
     }
+    /** Remove EVERY record of a kind from disk (the kind dir's JSON files), keeping
+     *  the dir itself so the layout/manifest survive. Used by `hunch private --migrate`
+     *  to empty the PUBLIC store after its records have been moved into the private
+     *  overlay. Returns the number of files removed. Invalidates the memoized load. */
+    dropAll(kind) {
+        const dir = this.paths.dir(kind);
+        if (!existsSync(dir))
+            return 0;
+        let n = 0;
+        for (const name of readdirSync(dir)) {
+            if (name.endsWith(".json")) {
+                rmSync(join(dir, name));
+                n++;
+            }
+        }
+        this.invalidate(kind);
+        return n;
+    }
     /** Persist a schema migration: rewrite every LOADABLE record in its current shape.
      *  A record that still fails validation after migration is kept untouched (never
      *  deleted) and counted as `skipped`, so migration can't lose data. The caller

package/dist/store/privateMigrate.js

@@ -0,0 +1,39 @@
+/**
+ * Move a repo's PUBLIC engineering memory into its PRIVATE overlay, for
+ * `hunch private --migrate` (turn a public-by-default repo into a code-only public
+ * repo whose memory lives in a separate private store).
+ *
+ * The merge is a UNION BY ID: every public record is absorbed into the private
+ * store, and a record that already exists on both sides (e.g. a decision present
+ * in both) is resolved by the same precedence the merge driver uses (human-confirmed
+ * › higher confidence › more recent › deterministic tiebreak). Private-only records
+ * are preserved untouched. This NEVER deletes from the public store — the CLI empties
+ * it separately (JsonStore.dropAll) only after this returns, so an interrupted move
+ * can't lose records.
+ */
+import { ENTITY_KINDS } from "../core/types.js";
+import { mergeRecordsById } from "./merge.js";
+/** Union every public record into `priv` (by id). Returns what was absorbed.
+ *  Idempotent: re-running with the same input rewrites identical content. */
+export function movePublicMemoryToPrivate(pub, priv) {
+    priv.ensureDirs();
+    const moved = {};
+    let total = 0;
+    for (const kind of ENTITY_KINDS) {
+        const pubRecs = pub.loadAll(kind);
+        if (pubRecs.length === 0)
+            continue;
+        const privRecs = priv.loadAll(kind);
+        // base=[] so both sides' records are treated as additions; collisions resolved
+        // by pickWinner. Public is "theirs", private "ours" — order is irrelevant since
+        // pickWinner is symmetric for equal-provenance records.
+        const merged = mergeRecordsById([], privRecs, pubRecs);
+        // replaceAll re-validates each record against its schema (records loaded here
+        // are already current-schema), and writes atomically per file (con_902759b3dc).
+        priv.replaceAll(kind, merged);
+        moved[kind] = pubRecs.length;
+        total += pubRecs.length;
+    }
+    return { moved, total };
+}
+//# sourceMappingURL=privateMigrate.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "0.20.0",
+  "version": "0.21.1",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Hunch — an Engineering Memory OS: a persistent, git-native reasoning graph over a codebase, exposed to Claude Code via MCP.",