@davesheffer/hunch 0.36.0 → 0.36.2

package/dist/cli/index.js

@@ -946,7 +946,8 @@ program
     let forbids = deps.length || symbols.length ? { deps, symbols, patterns: [] } : null;
     let derived = false;
     if (!forbids && !opts.match) {
-        forbids = deriveForbids(statement);
+        const deps = knownRepoDeps(root);
+        forbids = deriveForbids(statement, deps.length ? deps : undefined);
         derived = !!forbids;
     }
     const c = store.json.put("constraints", {

package/dist/core/constraintmatch.js

@@ -72,16 +72,32 @@ export function importedDeps(lines) {
  *  correction → enforced constraint) mints a PRECISE matcher, not a scope-only rule that
  *  goes stale. Conservative: only fires on an explicit import/require verb + a
  *  module-shaped token; returns null otherwise (caller falls back to scope-only). */
-export function deriveForbids(rule) {
-    // Only derive a FORBID from a NEGATIVE rule — "always use react" must not forbid react.
+export function deriveForbids(rule, knownDeps) {
+    // Derive ONLY from a NEGATIVE rule with an UNAMBIGUOUS import verb. "use"/"add" are
+    // deliberately excluded: "don't use react hooks" names hooks, not react, and "never use
+    // synchronous fs" names no dependency at all — over-deriving there mints a wrong or
+    // never-firing rule on the seamless path. Under-deriving is safe (caller falls back to a
+    // scope-only rule + the "add --forbid-dep" warning); over-deriving is not.
     if (!/\b(never|don'?t|do\s+not|avoid|stop|without|ban|banned|forbid|forbidden|prohibit|not\s+allowed|no\s+longer)\b/i.test(rule))
         return null;
-    const m = rule.match(/\b(?:import(?:ing)?|requir(?:e|ing)|us(?:e|ing)|add|adopt|depend(?:s|ing)?\s+on)\s+(?:from\s+|the\s+)?["'`]?(@?[a-z0-9][\w.@/-]*)["'`]?/i);
+    const m = rule.match(/\b(?:import(?:ing)?|requir(?:e|ing)|depend(?:s|ing)?\s+on)\s+(?:from\s+|the\s+)?["'`]?(@?[a-z0-9][\w.@/-]*)["'`]?/i);
     if (!m || !m[1])
         return null;
-    let dep = m[1].replace(/[).,;:'"`]+$/, "").toLowerCase();
+    const dep = m[1].replace(/[).,;:'"`]+$/, "").toLowerCase();
     if (!dep || dep.length < 2 || /\s/.test(dep) || STOP_TOKENS.has(dep))
         return null;
+    // When the caller can supply the repo's real dependencies, only auto-mint a matcher for a
+    // dep that ACTUALLY exists — so a typo or a non-dependency concept ("never import the old
+    // helper") doesn't silently create a never-firing rule. Submodule-aware both ways. No list
+    // supplied (no/unreadable package.json) → skip validation rather than reject everything.
+    if (knownDeps && knownDeps.length) {
+        const ok = knownDeps.some((d) => {
+            const k = d.toLowerCase();
+            return k === dep || dep.startsWith(`${k}/`) || k.startsWith(`${dep}/`);
+        });
+        if (!ok)
+            return null;
+    }
     return { deps: [dep], symbols: [], patterns: [] };
 }
 // English words a forbid-verb might grab that are never a dependency.

package/dist/core/correction.js

@@ -71,8 +71,9 @@ export function buildCorrectionConstraint(input, now) {
         match: null,
         // Best-effort precise matcher from the rule text ("never import lodash" → forbids lodash),
         // so the seamless capture path mints enforcement that survives file churn, not a scope-only
-        // rule that goes stale. null when nothing derivable → falls back to scope-based.
-        forbids: deriveForbids(rule),
+        // rule that goes stale. Validated against the repo's real deps when supplied → never mints a
+        // never-firing rule for a non-dependency. null when nothing derivable → falls back to scope.
+        forbids: deriveForbids(rule, input.knownDeps),
         rationale: input.rationale ?? "Captured from a human correction of the agent (Never Twice).",
         source_decision: input.source_decision ?? null,
         violations: [],

package/dist/mcp/server.js

@@ -14,6 +14,7 @@ import { HunchStore } from "../store/hunchStore.js";
 import { selectEmbedder } from "../store/embedder.js";
 import { decisionId } from "../core/ids.js";
 import { buildCorrectionConstraint } from "../core/correction.js";
+import { knownRepoDeps } from "../synthesis/tripwires.js";
 import { revParse, asOfDate, revExists, lastChangeDate, rangeFiles, rangeDiff, commitFiles, commitDiff, stagedFiles, stagedDiff, commitAndPushHunch, pullHunch } from "../extractors/git.js";
 import { formatContext } from "../core/format.js";
 import { compareCandidates } from "../core/compare.js";
@@ -360,7 +361,7 @@ export function buildServer(root) {
         try {
             if (!input.rule || !input.rule.trim())
                 return err("rule is required — state the invariant in plain words.");
-            const rec = buildCorrectionConstraint(input, new Date().toISOString());
+            const rec = buildCorrectionConstraint({ ...input, knownDeps: knownRepoDeps(root) }, new Date().toISOString());
             // Private corrections go to the overlay (enforced locally via the merged read,
             // never rendered into the public CI comment, which is public-only by construction).
             const existing = input.private ? undefined : store.json.get("constraints", rec.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "0.36.0",
+  "version": "0.36.2",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Hunch — an Engineering Memory OS: a persistent, git-native graph of the decisions, bugs, and rules behind your code, served to any MCP coding assistant (Claude Code, Cursor, Copilot, Windsurf, Codex).",