@davesheffer/hunch 0.36.2 → 0.36.3

package/dist/eval/guards.js

@@ -1,5 +1,6 @@
 import { verdict } from "../core/checkreport.js";
 import { pathMatchesGlob } from "../core/glob.js";
+import { effectiveForbids } from "../core/constraintmatch.js";
 const surfaced = (v) => v === "block" || v === "warn";
 const matches = (expect, got) => (expect === "catch" ? surfaced(got) : got === expect);
 /** Parse + validate a hand-authored golden set. */
@@ -47,7 +48,18 @@ export function generateGuardCases(store) {
         .recs("constraints")
         .filter((c) => c.status === "active" && c.severity === "blocking" && c.scope.length && isVouched(c.provenance?.source));
     for (const c of blocking) {
-        cases.push({ name: `CATCH · ${c.statement.slice(0, 56)}`, files: [pathForGlob(c.scope[0])], expect: "catch" });
+        const file = pathForGlob(c.scope[0]);
+        const line = violatingLine(c);
+        if (line) {
+            // CONTENT-MATCHED (dep/symbol): synthesize the REAL violation in scoped code and require a
+            // hard BLOCK — content is verified per commit, so a vouched matcher must block (not just warn).
+            cases.push({ name: `BLOCK · ${c.statement.slice(0, 56)}`, files: [file], diff: addLineDiff(file, line), expect: "block" });
+        }
+        else {
+            // scope-only (or pattern-only, which we can't synthesize): a change in scope must at least be
+            // SURFACED (block or warn) — staleness/firmness decides which.
+            cases.push({ name: `CATCH · ${c.statement.slice(0, 56)}`, files: [file], expect: "catch" });
+        }
     }
     for (const p of ["docs/__eval__notes.md", "scripts/__eval__.txt", ".github/__eval__.yml"]) {
         if (!blocking.some((c) => c.scope.some((g) => pathMatchesGlob(p, g)))) {
@@ -56,6 +68,21 @@ export function generateGuardCases(store) {
     }
     return cases;
 }
+/** A line of scoped code that actually trips a constraint's matcher — an import of the
+ *  forbidden dep, or a call to the forbidden symbol. null when there's no synthesizable
+ *  violation (scope-only, or a free-form regex we can't reverse). */
+function violatingLine(c) {
+    const f = effectiveForbids(c);
+    if (f?.deps.length)
+        return `import _x from "${f.deps[0]}";`;
+    if (f?.symbols.length)
+        return `const _v = ${f.symbols[0]}();`;
+    return null;
+}
+/** A minimal unified diff that ADDS `line` to a (code) file, for a synthetic eval case. */
+function addLineDiff(file, line) {
+    return `diff --git a/${file} b/${file}\n--- a/${file}\n+++ b/${file}\n@@ -1,1 +1,2 @@\n const __base = 1;\n+${line}\n`;
+}
 const isVouched = (source) => !!source && (source.includes("human_confirmed") || source === "derived");
 /** A concrete path that matches a scope glob, for a synthetic case. Exact-file scopes pass
  *  through; wildcard scopes get a representative file inside them. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "0.36.2",
+  "version": "0.36.3",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Hunch — an Engineering Memory OS: a persistent, git-native graph of the decisions, bugs, and rules behind your code, served to any MCP coding assistant (Claude Code, Cursor, Copilot, Windsurf, Codex).",