@davesheffer/hunch 0.35.1 → 0.36.1

package/README.md

@@ -172,11 +172,13 @@ Plus the **Regression Guard** (re-adding deliberately-retired code) and the
 **[CI Constraint Guard](https://hunch-pi.vercel.app/docs#ci)** (`hunch ci` — a PR gate that
 comments the affected `con_`/`dec_` ids and fails on a blocking one).
 
-Give a blocking rule a content matcher — `record-constraint "…" --scope "src/**" --severity
-blocking --match "lodash"` — and it blocks the *actual* violation across the file's whole life
-(matched against added code; comments ignored) instead of relaxing to advisory after the file
-is edited again. It's a deterministic guard for the obvious/accidental violation, not a
-bypass-proof boundary.
+Name the actual violation — `record-constraint "…" --scope "src/**" --severity blocking
+--forbid-dep "lodash"` — and it blocks the *real* change across the file's whole life instead
+of relaxing to advisory after the file is edited again. The dep matcher reads the **parsed
+import**, so a comment or string naming the module can't false-positive and a submodule
+(`lodash/groupBy`) is still caught; a correction your assistant records gets the same matcher
+automatically. (`--match <regex>` remains a lint-grade textual fallback.) None of these are a
+bypass-proof boundary — deliberate indirection can still route around any rule.
 
 ## Working as a team
 

package/dist/cli/index.js

@@ -30,6 +30,7 @@ import { parseTestReport } from "../extractors/testreport.js";
 import { selectProvider } from "../synthesis/provider.js";
 import { isGitRepo, headSha, logSince, lastChangeDate, stagedFiles, commitFiles, asOfDate, stagedDiff, commitDiff, rangeFiles, rangeDiff, rangeSubjects, revExists, commitAndPushHunch, gitUntrackCached, gitCommonDir, isLinkedWorktree } from "../extractors/git.js";
 import { runbookId, decisionId } from "../core/ids.js";
+import { deriveForbids, effectiveForbids } from "../core/constraintmatch.js";
 import { extractInlineIntent } from "../extractors/comments.js";
 import { renderText, renderMarkdown, reportFailsStrict } from "../core/checkreport.js";
 import { partitionReview, READY_MIN_GROUNDED } from "../core/reviewqueue.js";
@@ -715,7 +716,7 @@ program
                 id, type: "correctness", statement: it.text, scope: [it.file],
                 // Advisory by default — an inline rule never auto-blocks a build; raise severity
                 // deliberately if you want enforcement. Keeps day-one zero false-positive rage.
-                severity: "warning", enforcement: "advisory_v1", match: null,
+                severity: "warning", enforcement: "advisory_v1", match: null, forbids: null,
                 rationale: `Captured from an inline hunch-rule comment (${it.file}:${it.line}).`,
                 source_decision: null, violations: [], status: "active",
                 valid_from: prev?.valid_from ?? now, valid_to: null,
@@ -928,7 +929,9 @@ program
     .option("--rationale <text>", "why it must hold", "")
     .option("--source-decision <id>", "decision id this derives from")
     .option("--enforcement <e>", "advisory_v1 | ci | manual", "advisory_v1")
-    .option("--match <regex>", "content matcher: block only when an ADDED line matches this regex (precise + immune to staleness, vs scope-touch)")
+    .option("--forbid-dep <names>", "comma-sep imports that BREAK the rule (parsed-import precise; e.g. lodash) — blocks the real violation, immune to staleness")
+    .option("--forbid-symbol <names>", "comma-sep identifier names that break the rule")
+    .option("--match <regex>", "textual line regex (lint-grade last resort; prefer --forbid-dep/--forbid-symbol)")
     .action((statement, opts) => {
     const SEV = ["advisory", "warning", "blocking"];
     if (!SEV.includes(opts.severity))
@@ -936,6 +939,16 @@ program
     const { store, root } = storeFor();
     store.json.ensureDirs();
     const scope = opts.scope.split(",").map((s) => toPosixTarget(s.trim())).filter(Boolean);
+    const csv = (s) => (s ? s.split(",").map((x) => x.trim()).filter(Boolean) : []);
+    const deps = csv(opts.forbidDep), symbols = csv(opts.forbidSymbol);
+    // Explicit matcher if given; else best-effort derive a dep from the statement so the
+    // common "never import X" rule is precise + staleness-immune by default, not scope-only.
+    let forbids = deps.length || symbols.length ? { deps, symbols, patterns: [] } : null;
+    let derived = false;
+    if (!forbids && !opts.match) {
+        forbids = deriveForbids(statement);
+        derived = !!forbids;
+    }
     const c = store.json.put("constraints", {
         id: constraintId(statement),
         type: opts.type,
@@ -944,6 +957,7 @@ program
         severity: opts.severity,
         enforcement: opts.enforcement,
         match: opts.match ?? null,
+        forbids,
         rationale: opts.rationale,
         source_decision: opts.sourceDecision ?? null,
         violations: [],
@@ -955,11 +969,13 @@ program
     store.reindex();
     updateClaudeMd(root, store);
     console.log(`✓ recorded ${c.severity} constraint ${c.id}: "${c.statement}" (scope: ${scope.join(", ") || "repo"})`);
-    if (c.severity === "blocking" && !c.match) {
+    if (derived && c.forbids?.deps.length)
+        console.log(`  ↳ matcher: forbids import of ${c.forbids.deps.join(", ")} (precise, immune to staleness)`);
+    if (c.severity === "blocking" && !effectiveForbids(c)) {
         // The default path's sharp edge: a scope-only blocking rule fails OPEN once any
         // file in scope is committed after today (staleness). Point the user at the fix.
         console.log(`  ⚠ scope-only — this will downgrade to advisory once a file in scope is changed after today.`);
-        console.log(`    To block the actual violation across the file's life, add a content matcher, e.g.  --match "lodash"`);
+        console.log(`    To block the actual violation across the file's life, add  --forbid-dep <pkg>  (or --forbid-symbol / --match).`);
     }
     store.close();
 });

package/dist/core/constraintmatch.js

@@ -1,38 +1,138 @@
-/** Optional CONTENT matcher for a constraint: a regex tested against the lines a
- *  diff/edit ADDS. When a constraint carries one, the gate decides a violation by
- *  CONTENT (the rule was actually broken) instead of by bare SCOPE-touch.
+/** Precise, AST-grounded matching for a constraint's content — the primitive behind
+ *  "this change actually BREAKS the rule" (dec_… content-matched constraints).
  *
- *  Why this matters: scope-touch enforcement is so blunt that strict had to fail
- *  OPEN once a guarded file changed (the "staleness" gate) or it would block every
- *  edit in scope — which silently retracts the teeth over a file's normal life
- *  (dec_e0a36efbf5). A content match is verifiable PER COMMIT, so it needs no
- *  staleness proxy: a vouched, content-matched invariant keeps blocking the actual
- *  violation across the whole life of the file, and stays quiet on edits that don't
- *  break it. Bad user/LLM regex is compiled defensively and is simply inert. */
-export function constraintMatcher(pattern) {
-    if (!pattern)
-        return null;
-    try {
-        return new RegExp(pattern);
+ *  A constraint can forbid, in precision order:
+ *   - deps:     an external import (matched against the PARSED import set, so a comment
+ *               or a string literal that merely names the module can't trip it; a
+ *               submodule import like "lodash/groupBy" is caught by "lodash").
+ *   - symbols:  an identifier added in scoped code (whole-word, comments stripped).
+ *   - patterns: a line regex (lint-grade last resort; comments stripped, strings kept).
+ *
+ *  Deciding a violation by CONTENT is verifiable per commit, so a content-matched
+ *  invariant is immune to file-change "staleness" and keeps its teeth across the file's
+ *  whole life. The same matcher backs the Veto Guard's tripwires (one matcher, audited
+ *  once) — see HunchStore.matchTripwire. */
+const EMPTY = { deps: [], symbols: [], patterns: [] };
+/** Walk the precision-first ladder against an analyzed diff/edit: dep (parsed import,
+ *  exact or submodule) > symbol (whole-word identifier in scoped code) > pattern (scoped
+ *  regex). Returns the highest-precision match, or null. */
+export function matchForbids(f, addedDeps, scopedAdded) {
+    const codeLines = scopedAdded.map(matchableCode); // comments stripped once, strings kept
+    // dep tier: a forbidden dep (or a submodule of it) must be a genuinely-new external
+    // import (addedDeps, parsed) AND actually imported on a scoped line — never a mention
+    // in a comment or string. addedDeps comes from the import parser, so it is already
+    // comment/string-immune; the scoped importsDep check stops an out-of-scope import from
+    // tripping an in-scope edit.
+    const hitDeps = [];
+    for (const dep of f.deps) {
+        const added = [...addedDeps].find((d) => d === dep || d.startsWith(`${dep}/`));
+        if (added && codeLines.some((l) => importsDep(l, added)))
+            hitDeps.push(added);
     }
-    catch {
-        return null; // malformed pattern → inert, never throws
+    if (hitDeps.length)
+        return { tier: "dep", evidence: hitDeps.map((d) => `+import ${d}`) };
+    const hitSyms = f.symbols.filter((s) => {
+        const re = new RegExp(`\\b${escapeRe(s)}\\b`);
+        return codeLines.some((l) => re.test(l));
+    });
+    if (hitSyms.length)
+        return { tier: "symbol", evidence: hitSyms.map((s) => `+${s}`) };
+    for (const p of f.patterns) {
+        const re = safeRe(p);
+        if (!re)
+            continue;
+        const hit = codeLines.find((l) => re.test(l));
+        if (hit)
+            return { tier: "pattern", evidence: [`/${p}/ matched: ${hit.trim().slice(0, 80)}`] };
+    }
+    return null;
+}
+/** A constraint's effective forbids: its structured `forbids` plus a legacy `--match`
+ *  regex folded into the pattern tier (back-compat with v0.35). null when it has none. */
+export function effectiveForbids(c) {
+    const base = c.forbids ?? EMPTY;
+    const patterns = c.match ? [...base.patterns, c.match] : base.patterns;
+    const f = { deps: base.deps, symbols: base.symbols, patterns };
+    return f.deps.length || f.symbols.length || f.patterns.length ? f : null;
+}
+/** The external import module names on a set of raw lines (for the edit-time hook,
+ *  which sees proposed lines, not a parsed diff). Relative imports are ignored. */
+export function importedDeps(lines) {
+    const out = new Set();
+    for (const raw of lines) {
+        const l = matchableCode(raw);
+        const m = l.match(/(?:^\s*import\b[^'"]*|^\s*\}?\s*from\s+|\brequire\(\s*)['"]([^'"]+)['"]/);
+        if (m && m[1] && !m[1].startsWith("."))
+            out.add(m[1]);
     }
+    return out;
+}
+/** Best-effort: derive a forbidden DEP from a natural-language rule like "never import
+ *  lodash" / "don't use the axios package" — so the seamless capture path (a human
+ *  correction → enforced constraint) mints a PRECISE matcher, not a scope-only rule that
+ *  goes stale. Conservative: only fires on an explicit import/require verb + a
+ *  module-shaped token; returns null otherwise (caller falls back to scope-only). */
+export function deriveForbids(rule) {
+    // Derive ONLY from a NEGATIVE rule with an UNAMBIGUOUS import verb. "use"/"add" are
+    // deliberately excluded: "don't use react hooks" names hooks, not react, and "never use
+    // synchronous fs" names no dependency at all — over-deriving there mints a wrong or
+    // never-firing rule on the seamless path. Under-deriving is safe (caller falls back to a
+    // scope-only rule + the "add --forbid-dep" warning); over-deriving is not.
+    if (!/\b(never|don'?t|do\s+not|avoid|stop|without|ban|banned|forbid|forbidden|prohibit|not\s+allowed|no\s+longer)\b/i.test(rule))
+        return null;
+    const m = rule.match(/\b(?:import(?:ing)?|requir(?:e|ing)|depend(?:s|ing)?\s+on)\s+(?:from\s+|the\s+)?["'`]?(@?[a-z0-9][\w.@/-]*)["'`]?/i);
+    if (!m || !m[1])
+        return null;
+    const dep = m[1].replace(/[).,;:'"`]+$/, "").toLowerCase();
+    if (!dep || dep.length < 2 || /\s/.test(dep) || STOP_TOKENS.has(dep))
+        return null;
+    return { deps: [dep], symbols: [], patterns: [] };
 }
-/** The enforceable CODE of an added line: a comment carries no invariant, so a rule
- *  must not fire on it (a `// we avoid lodash` note is not a violation). We strip
- *  comments but NOT string literals — the thing a matcher most often targets, an
- *  import specifier (`from "lodash"`), IS a string, so stripping strings would blind
- *  the matcher to the real violation. A comment-only line → "". */
+// English words a forbid-verb might grab that are never a dependency.
+const STOP_TOKENS = new Set([
+    "strict", "this", "that", "it", "them", "the", "a", "an", "any", "async", "await",
+    "const", "let", "var", "new", "type", "types", "care", "caution", "again", "anything",
+]);
+/** The enforceable CODE of an added line: a comment carries no invariant, so the lint-grade
+ *  symbol/pattern tiers must not fire on it (a `// we avoid lodash` note is not a violation).
+ *  Strips a line comment, an inline block comment, and a comment-only / JSDoc line — but NOT
+ *  string literals, since an import specifier (`from "lodash"`) is itself a string.
+ *  Single-pass and line-local, so a multi-line block-comment BODY line (no marker) is NOT
+ *  stripped: that residual false-positive is why the DEP tier — gated on the PARSED import
+ *  set, immune to any comment — is the precise path for "never import X". */
 export function matchableCode(line) {
     if (/^\s*(\/\/|\/\*|\*)/.test(line))
-        return ""; // // line, /* block, or * JSDoc-continuation
-    return line.replace(/\s+\/\/.*$/, ""); // drop a trailing inline // comment (keeps "://" in URLs/strings)
+        return "";
+    return line
+        .replace(/\/\*.*?\*\//g, "") // inline /* … */
+        .replace(/\s+\/\/.*$/, ""); // trailing // comment (keeps "://" inside strings/URLs)
 }
-/** True iff any ADDED line's CODE trips the constraint's content matcher. */
+/** Legacy: compile a constraint's `--match` regex defensively (bad regex → inert). */
+export function constraintMatcher(pattern) {
+    return safeRe(pattern);
+}
+/** True iff any added line's CODE trips a single regex (the v0.35 textual path). */
 export function contentViolates(re, addedLines) {
     if (!re)
         return false;
     return addedLines.some((l) => re.test(matchableCode(l)));
 }
+function safeRe(p) {
+    if (!p)
+        return null;
+    try {
+        return new RegExp(p);
+    }
+    catch {
+        return null;
+    }
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Does a line actually IMPORT `dep` (not merely mention it)? Covers `import x from
+ *  "dep"`, `import "dep"`, `} from "dep"`, `require("dep")`. */
+function importsDep(line, dep) {
+    return new RegExp(`(?:from|import|require\\(?)\\s*['"]${escapeRe(dep)}['"]`).test(line);
+}
 //# sourceMappingURL=constraintmatch.js.map

package/dist/core/correction.js

@@ -10,6 +10,7 @@
  */
 import { constraintId } from "./ids.js";
 import { toPosixTarget } from "./paths.js";
+import { deriveForbids } from "./constraintmatch.js";
 /** Correction cues. Deliberately conservative — anchored to imperative/rebuke
  *  phrasing, not bare "no", so ordinary conversational negation ("no idea",
  *  "no problem") doesn't train users to ignore the nudge (research risk #5). */
@@ -68,6 +69,10 @@ export function buildCorrectionConstraint(input, now) {
         severity,
         enforcement: "advisory_v1",
         match: null,
+        // Best-effort precise matcher from the rule text ("never import lodash" → forbids lodash),
+        // so the seamless capture path mints enforcement that survives file churn, not a scope-only
+        // rule that goes stale. null when nothing derivable → falls back to scope-based.
+        forbids: deriveForbids(rule),
         rationale: input.rationale ?? "Captured from a human correction of the agent (Never Twice).",
         source_decision: input.source_decision ?? null,
         violations: [],

package/dist/core/hookpolicy.js

@@ -1,4 +1,4 @@
-import { constraintMatcher, contentViolates } from "./constraintmatch.js";
+import { effectiveForbids, matchForbids, importedDeps } from "./constraintmatch.js";
 /** Return a BlockingHit if editing `file` (repo-relative) hits a blocking
  *  invariant directly or through its blast radius, else null. `proposedAddedLines`
  *  are the lines the edit would ADD: a CONTENT-MATCHED invariant (one carrying a
@@ -6,12 +6,14 @@ import { constraintMatcher, contentViolates } from "./constraintmatch.js";
  *  on edits that don't break the rule, instead of blocking every edit in scope
  *  (dec_e0a36efbf5). Scope-only invariants keep the blunt scope-touch behavior. */
 export function blockingInScope(store, file, proposedAddedLines = []) {
+    const addedDeps = importedDeps(proposedAddedLines); // parse imports out of the proposed edit
     for (const c of store.checkConstraints(file)) {
         if (c.severity !== "blocking")
             continue;
-        const re = constraintMatcher(c.match);
-        if (re && !contentViolates(re, proposedAddedLines))
-            continue; // content-matched & not tripped → allow
+        const forbids = effectiveForbids(c);
+        // content-matched & not tripped by the proposed edit → allow (don't block every edit in scope)
+        if (forbids && !matchForbids(forbids, addedDeps, proposedAddedLines))
+            continue;
         return {
             reason: `Hunch: editing ${file} would touch a BLOCKING invariant — "${c.statement}" (${c.id}). Do not proceed unless this change is meant to modify that invariant; otherwise preserve it.`,
         };
@@ -23,7 +25,7 @@ export function blockingInScope(store, file, proposedAddedLines = []) {
             // A content matcher tests the EDITED file's own added lines; it has nothing to
             // assert about a transitive dependency, so content-matched invariants don't fire
             // via blast radius — only scope-only invariants keep the blast-radius warning.
-            if (constraintMatcher(c.match))
+            if (effectiveForbids(c))
                 continue;
             return {
                 reason: `Hunch: ${file} is in the blast radius of a BLOCKING invariant — "${c.statement}" (${c.id}; via ${b.file}, ${b.via} depth ${b.depth}). Verify the invariant still holds before editing.`,

package/dist/core/types.js

@@ -169,7 +169,20 @@ export const ConstraintSchema = z.object({
     // instead of on bare scope-touch. A content-verifiable invariant is decided per
     // commit, so it is immune to file-change "staleness" and keeps its teeth across the
     // file's whole life — and stays quiet on edits that don't break it (dec_e0a36efbf5).
+    // Legacy textual tier; prefer `forbids` below, which is parsed-import precise.
     match: z.string().nullable().default(null),
+    // Precise content matcher (same ladder as a veto tripwire): a violation is a forbidden
+    // dep IMPORTED, symbol added, or pattern matched in scoped code. The dep tier is parsed
+    // from the import set, so comments/strings naming the module can't false-positive. Like
+    // `match`, a forbids-matched invariant is staleness-immune.
+    forbids: z
+        .object({
+        deps: z.array(z.string()).default([]),
+        symbols: z.array(z.string()).default([]),
+        patterns: z.array(z.string()).default([]),
+    })
+        .nullable()
+        .default(null),
     rationale: z.string().default(""),
     source_decision: z.string().nullable().default(null),
     violations: z.array(z.string()).default([]),

package/dist/store/hunchStore.js

@@ -22,7 +22,7 @@ import { gitCommonDir } from "../extractors/git.js";
 import { pathMatchesGlob } from "../core/glob.js";
 import { edgeId } from "../core/ids.js";
 import { isStrictBlocker, isVetoBlocker } from "../core/strictgate.js";
-import { constraintMatcher, contentViolates } from "../core/constraintmatch.js";
+import { effectiveForbids, matchForbids } from "../core/constraintmatch.js";
 import { analyzeDiff } from "../extractors/diff.js";
 export class HunchStore {
     paths;
@@ -654,16 +654,18 @@ export class HunchStore {
                 removedNames: new Set(an.removedSymbols.map((s) => s.name)),
             });
             const directReport = [];
+            const addedDepSet = new Set(an.addedDeps);
             for (const { c, files: fs } of direct.values()) {
-                const re = constraintMatcher(c.match);
-                if (re) {
-                    // CONTENT-MATCHED: decide by whether an ADDED line in the matched files actually
-                    // breaks the rule — not by bare scope-touch. A commit that touches the scope but
-                    // doesn't trip the matcher COMPLIES → drop it (no noise). A real hit blocks WITHOUT
-                    // the staleness gate: content is verified per commit, so file churn can't retract
-                    // the teeth (dec_e0a36efbf5). Empty diff ⇒ can't prove a violation ⇒ treat as clean.
-                    const added = fs.flatMap((f) => an.addedLinesByFile.get(f) ?? []);
-                    if (!contentViolates(re, added))
+                const forbids = effectiveForbids(c);
+                if (forbids) {
+                    // CONTENT-MATCHED: decide by whether the diff actually breaks the rule (a forbidden
+                    // dep imported / symbol added / pattern matched in scoped code) — not by bare
+                    // scope-touch. A commit that touches the scope but doesn't trip it COMPLIES → drop it
+                    // (no noise). A real hit blocks WITHOUT the staleness gate: content is verified per
+                    // commit, so file churn can't retract the teeth (dec_e0a36efbf5). Empty diff ⇒ can't
+                    // prove a violation ⇒ treat as clean.
+                    const scopedAdded = fs.flatMap((f) => an.addedLinesByFile.get(f) ?? []);
+                    if (!matchForbids(forbids, addedDepSet, scopedAdded))
                         continue;
                     const strictBlocks = isStrictBlocker(c, false);
                     directReport.push({
@@ -1050,48 +1052,11 @@ export class HunchStore {
         return ctx;
     }
 }
-/** Walk a tripwire's precision-first ladder against an analyzed diff. dep (exact
- *  set intersection) > symbol (whole-word identifier in an added line) > pattern
- *  (scoped regex). Returns the highest-precision match, or null. Bad user/LLM regex
- *  is compiled defensively and never throws (a malformed pattern is simply inert). */
+/** A tripwire matches via the shared precision ladder (dep > symbol > pattern). One
+ *  matcher backs both the Veto Guard and content-matched constraints (constraintmatch.ts),
+ *  so the parse-the-import precision is audited in exactly one place. */
 function matchTripwire(tw, addedDeps, scopedAdded) {
-    // dep tier: the forbidden dep must be a genuinely-new external import (addedDeps)
-    // AND imported in a SCOPED added line — not merely added somewhere else in the
-    // diff. Without the scoped check, axios added in an out-of-scope file plus any
-    // edit to an in-scope file would false-positive.
-    const hitDeps = tw.forbids.deps.filter((dep) => addedDeps.has(dep) && scopedAdded.some((l) => importsDep(l, dep)));
-    if (hitDeps.length)
-        return { tier: "dep", evidence: hitDeps.map((d) => `+import ${d}`) };
-    const hitSyms = tw.forbids.symbols.filter((s) => {
-        const re = new RegExp(`\\b${escapeRe(s)}\\b`);
-        return scopedAdded.some((l) => re.test(l));
-    });
-    if (hitSyms.length)
-        return { tier: "symbol", evidence: hitSyms.map((s) => `+${s}`) };
-    for (const p of tw.forbids.patterns) {
-        let re = null;
-        try {
-            re = new RegExp(p);
-        }
-        catch {
-            re = null; // malformed pattern is inert, never a thrown error in the gate
-        }
-        if (!re)
-            continue;
-        const hit = scopedAdded.find((l) => re.test(l));
-        if (hit)
-            return { tier: "pattern", evidence: [`/${p}/ matched: ${hit.trim().slice(0, 80)}`] };
-    }
-    return null;
-}
-function escapeRe(s) {
-    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-/** Does an added line actually IMPORT `dep` (not merely mention it in a string)?
- *  Covers `import x from "dep"`, `import "dep"`, `} from "dep"`, `require("dep")` —
- *  so a literal like `const m = "axios"` no longer trips the dep tier. */
-function importsDep(line, dep) {
-    return new RegExp(`(?:from|import|require\\(?)\\s*['"]${escapeRe(dep)}['"]`).test(line);
+    return matchForbids(tw.forbids, addedDeps, scopedAdded);
 }
 function sev(s) {
     return { blocking: 3, warning: 2, advisory: 1 }[s] ?? 0;

package/dist/synthesis/synthesize.js

@@ -281,6 +281,7 @@ function promoteConstraint(store, bug) {
         severity: bug.severity === "critical" ? "blocking" : "warning",
         enforcement: "advisory_v1",
         match: null,
+        forbids: null,
         rationale: `Derived from ${bug.id}: ${bug.root_cause || bug.symptom}`,
         source_decision: null,
         violations: [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "0.35.1",
+  "version": "0.36.1",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Hunch — an Engineering Memory OS: a persistent, git-native graph of the decisions, bugs, and rules behind your code, served to any MCP coding assistant (Claude Code, Cursor, Copilot, Windsurf, Codex).",