@davesheffer/hunch 0.36.2 → 0.37.0

package/dist/cli/index.js

@@ -968,7 +968,7 @@ program
         provenance: { source: "human_confirmed", confidence: 1, evidence: [], last_verified: new Date().toISOString() },
     });
     store.reindex();
-    updateClaudeMd(root, store);
+    refreshExistingGrounding(root, store); // keep EVERY assistant's grounding current, not just CLAUDE.md
     console.log(`✓ recorded ${c.severity} constraint ${c.id}: "${c.statement}" (scope: ${scope.join(", ") || "repo"})`);
     if (derived && c.forbids?.deps.length)
         console.log(`  ↳ matcher: forbids import of ${c.forbids.deps.join(", ")} (precise, immune to staleness)`);
@@ -1309,6 +1309,45 @@ program
     const next = writeConfig(paths, { firmness: level }).firmness;
     console.log(`✓ firmness set to ${next} (takes effect on the next edit — no Claude Code restart needed).`);
 });
+// ---- status (enforcement readiness at a glance) ---------------------------
+program
+    .command("status")
+    .description("Enforcement readiness at a glance: what's enforcing, what's waiting to confirm, what went stale.")
+    .action(() => {
+    const { store, root } = storeFor();
+    const firmness = readConfig(hunchPaths(root)).firmness;
+    const vouchedSrc = (s) => !!s && (s.includes("human_confirmed") || s === "derived");
+    const blocking = store.recs("constraints").filter((c) => c.status === "active" && c.severity === "blocking" && vouchedSrc(c.provenance?.source));
+    const precise = blocking.filter((c) => !!effectiveForbids(c));
+    const scopeOnly = blocking.filter((c) => !effectiveForbids(c));
+    const drafts = store.json.loadAll("decisions").filter((d) => d.status === "proposed" || d.provenance.confidence < 0.6);
+    const { ready, scrutiny } = partitionReview(drafts, READY_MIN_GROUNDED);
+    const stale = store.staleness((f) => lastChangeDate(f, root)).filter((s) => s.kind === "constraint");
+    const fnote = {
+        off: "not enforcing — `hunch firmness advisory` to start",
+        advisory: "surfaces context to the agent; never blocks",
+        firm: "surfaces + warns on a violating edit",
+        strict: "edit-time DENY + CI guard — the teeth are on",
+    };
+    console.log(`\nHunch — enforcement status (${root.split("/").pop()})\n`);
+    console.log(`  firmness: ${firmness}   ← ${fnote[firmness] ?? ""}\n`);
+    console.log(`  ✓ ARMED        ${blocking.length} confirmed blocking invariant(s) — held against every assistant`);
+    if (blocking.length) {
+        console.log(`       ${precise.length} precise (block the actual violation, immune to staleness)`);
+        console.log(`       ${scopeOnly.length} scope-only (relax to advisory once the file changes)${scopeOnly.length ? "  → harden with --forbid-dep" : ""}`);
+    }
+    if (ready.length || scrutiny.length) {
+        console.log(`\n  ⏳ TO CONFIRM   ${ready.length} ready · ${scrutiny.length} need scrutiny   → hunch review${ready.length ? " --accept-verified" : ""}`);
+    }
+    if (stale.length) {
+        console.log(`\n  ♻ STALE        ${stale.length} rule(s) whose guarded code moved since last verified   → re-confirm to keep the teeth`);
+    }
+    if (firmness !== "strict" && precise.length) {
+        console.log(`\n  ⚡ ${precise.length} precise rule(s) are armed but firmness is "${firmness}" — set \`hunch firmness strict\` to hard-block them.`);
+    }
+    console.log("");
+    store.close();
+});
 // ---- hook (Claude Code agent-hook handler) --------------------------------
 program
     .command("hook")
@@ -1446,7 +1485,7 @@ program
         }
         const { source, armed } = acceptDecision(store, d);
         store.reindex();
-        updateClaudeMd(root, store);
+        refreshExistingGrounding(root, store); // confirming a rule must reach EVERY assistant's grounding
         console.log(`✓ accepted ${opts.accept} (now ${source}, confidence 0.95${armed ? `, ${armed} tripwire(s) now blocking` : ""})`);
     }
     else if (opts.reject) {
@@ -1467,7 +1506,7 @@ program
             for (const it of ready)
                 armedTotal += acceptDecision(store, it.d).armed;
             store.reindex();
-            updateClaudeMd(root, store);
+            refreshExistingGrounding(root, store); // batch-confirm must reach EVERY assistant's grounding
             console.log(`✓ accepted ${ready.length} verified draft(s); ${armedTotal} tripwire(s) now blocking.`);
             for (const it of ready)
                 console.log(`   ${it.d.id}  grounded=${it.synth.grounded ?? "?"}  ${it.d.title}`);
@@ -1557,7 +1596,7 @@ program
             if (store.json.delete(c.kind, c.id))
                 removed++;
         store.reindex();
-        updateClaudeMd(root, store);
+        refreshExistingGrounding(root, store); // removing records must reach EVERY assistant's grounding
         console.log(`\n✓ Removed ${removed} record(s).`);
     }
     else {

package/dist/eval/guards.js

@@ -1,5 +1,6 @@
 import { verdict } from "../core/checkreport.js";
 import { pathMatchesGlob } from "../core/glob.js";
+import { effectiveForbids } from "../core/constraintmatch.js";
 const surfaced = (v) => v === "block" || v === "warn";
 const matches = (expect, got) => (expect === "catch" ? surfaced(got) : got === expect);
 /** Parse + validate a hand-authored golden set. */
@@ -47,7 +48,18 @@ export function generateGuardCases(store) {
         .recs("constraints")
         .filter((c) => c.status === "active" && c.severity === "blocking" && c.scope.length && isVouched(c.provenance?.source));
     for (const c of blocking) {
-        cases.push({ name: `CATCH · ${c.statement.slice(0, 56)}`, files: [pathForGlob(c.scope[0])], expect: "catch" });
+        const file = pathForGlob(c.scope[0]);
+        const line = violatingLine(c);
+        if (line) {
+            // CONTENT-MATCHED (dep/symbol): synthesize the REAL violation in scoped code and require a
+            // hard BLOCK — content is verified per commit, so a vouched matcher must block (not just warn).
+            cases.push({ name: `BLOCK · ${c.statement.slice(0, 56)}`, files: [file], diff: addLineDiff(file, line), expect: "block" });
+        }
+        else {
+            // scope-only (or pattern-only, which we can't synthesize): a change in scope must at least be
+            // SURFACED (block or warn) — staleness/firmness decides which.
+            cases.push({ name: `CATCH · ${c.statement.slice(0, 56)}`, files: [file], expect: "catch" });
+        }
     }
     for (const p of ["docs/__eval__notes.md", "scripts/__eval__.txt", ".github/__eval__.yml"]) {
         if (!blocking.some((c) => c.scope.some((g) => pathMatchesGlob(p, g)))) {
@@ -56,6 +68,21 @@ export function generateGuardCases(store) {
     }
     return cases;
 }
+/** A line of scoped code that actually trips a constraint's matcher — an import of the
+ *  forbidden dep, or a call to the forbidden symbol. null when there's no synthesizable
+ *  violation (scope-only, or a free-form regex we can't reverse). */
+function violatingLine(c) {
+    const f = effectiveForbids(c);
+    if (f?.deps.length)
+        return `import _x from "${f.deps[0]}";`;
+    if (f?.symbols.length)
+        return `const _v = ${f.symbols[0]}();`;
+    return null;
+}
+/** A minimal unified diff that ADDS `line` to a (code) file, for a synthetic eval case. */
+function addLineDiff(file, line) {
+    return `diff --git a/${file} b/${file}\n--- a/${file}\n+++ b/${file}\n@@ -1,1 +1,2 @@\n const __base = 1;\n+${line}\n`;
+}
 const isVouched = (source) => !!source && (source.includes("human_confirmed") || source === "derived");
 /** A concrete path that matches a scope glob, for a synthetic case. Exact-file scopes pass
  *  through; wildcard scopes get a representative file inside them. */

package/dist/mcp/server.js

@@ -15,6 +15,7 @@ import { selectEmbedder } from "../store/embedder.js";
 import { decisionId } from "../core/ids.js";
 import { buildCorrectionConstraint } from "../core/correction.js";
 import { knownRepoDeps } from "../synthesis/tripwires.js";
+import { refreshExistingGrounding } from "../integrations/providers.js";
 import { revParse, asOfDate, revExists, lastChangeDate, rangeFiles, rangeDiff, commitFiles, commitDiff, stagedFiles, stagedDiff, commitAndPushHunch, pullHunch } from "../extractors/git.js";
 import { formatContext } from "../core/format.js";
 import { compareCandidates } from "../core/compare.js";
@@ -370,6 +371,12 @@ export function buildServer(root) {
             else
                 store.json.put("constraints", rec);
             store.reindex();
+            // Propagate the new rule to EVERY assistant's ambient grounding (Cursor/Copilot/
+            // Windsurf/AGENTS.md/CLAUDE.md), so a correction captured in one assistant is held
+            // by all of them. Public only — a private rule must never render into committed
+            // grounding. Refresh-only: it never scaffolds a doc the project opted out of.
+            if (!input.private)
+                refreshExistingGrounding(root, store);
             let flushed = "";
             if (input.private && store.privateAutoCommit && store.privateDir) {
                 commitAndPushHunch(store.privateDir, `hunch: capture ${rec.id}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "0.36.2",
+  "version": "0.37.0",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Hunch — an Engineering Memory OS: a persistent, git-native graph of the decisions, bugs, and rules behind your code, served to any MCP coding assistant (Claude Code, Cursor, Copilot, Windsurf, Codex).",