@davesheffer/hunch 0.35.0 → 0.35.1

package/README.md

@@ -172,6 +172,12 @@ Plus the **Regression Guard** (re-adding deliberately-retired code) and the
 **[CI Constraint Guard](https://hunch-pi.vercel.app/docs#ci)** (`hunch ci` — a PR gate that
 comments the affected `con_`/`dec_` ids and fails on a blocking one).
 
+Give a blocking rule a content matcher — `record-constraint "…" --scope "src/**" --severity
+blocking --match "lodash"` — and it blocks the *actual* violation across the file's whole life
+(matched against added code; comments ignored) instead of relaxing to advisory after the file
+is edited again. It's a deterministic guard for the obvious/accidental violation, not a
+bypass-proof boundary.
+
 ## Working as a team
 
 The `.hunch/` JSON is the **source of truth** — diffable, reviewable in PRs, synced for free

package/dist/cli/index.js

@@ -955,6 +955,12 @@ program
     store.reindex();
     updateClaudeMd(root, store);
     console.log(`✓ recorded ${c.severity} constraint ${c.id}: "${c.statement}" (scope: ${scope.join(", ") || "repo"})`);
+    if (c.severity === "blocking" && !c.match) {
+        // The default path's sharp edge: a scope-only blocking rule fails OPEN once any
+        // file in scope is committed after today (staleness). Point the user at the fix.
+        console.log(`  ⚠ scope-only — this will downgrade to advisory once a file in scope is changed after today.`);
+        console.log(`    To block the actual violation across the file's life, add a content matcher, e.g.  --match "lodash"`);
+    }
     store.close();
 });
 // ---- test (failure-learning loop) -----------------------------------------

package/dist/core/constraintmatch.js

@@ -19,10 +19,20 @@ export function constraintMatcher(pattern) {
         return null; // malformed pattern → inert, never throws
     }
 }
-/** True iff any ADDED line trips the constraint's content matcher. */
+/** The enforceable CODE of an added line: a comment carries no invariant, so a rule
+ *  must not fire on it (a `// we avoid lodash` note is not a violation). We strip
+ *  comments but NOT string literals — the thing a matcher most often targets, an
+ *  import specifier (`from "lodash"`), IS a string, so stripping strings would blind
+ *  the matcher to the real violation. A comment-only line → "". */
+export function matchableCode(line) {
+    if (/^\s*(\/\/|\/\*|\*)/.test(line))
+        return ""; // // line, /* block, or * JSDoc-continuation
+    return line.replace(/\s+\/\/.*$/, ""); // drop a trailing inline // comment (keeps "://" in URLs/strings)
+}
+/** True iff any ADDED line's CODE trips the constraint's content matcher. */
 export function contentViolates(re, addedLines) {
     if (!re)
         return false;
-    return addedLines.some((l) => re.test(l));
+    return addedLines.some((l) => re.test(matchableCode(l)));
 }
 //# sourceMappingURL=constraintmatch.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Hunch — an Engineering Memory OS: a persistent, git-native graph of the decisions, bugs, and rules behind your code, served to any MCP coding assistant (Claude Code, Cursor, Copilot, Windsurf, Codex).",