@davesheffer/hunch 1.10.0 → 1.10.2

package/dist/cli/index.js

@@ -222,12 +222,26 @@ program
     if (opts.autoCommit === false) {
         const localFile = join(paths.hunch, "local.json");
         let existing = {};
-        try {
-            existing = JSON.parse(readFileSync(localFile, "utf8"));
+        if (existsSync(localFile)) {
+            // Same contract as every other writer of this file (issue #40): an
+            // unparseable or non-object local.json may hold the private-overlay
+            // pointer — rewriting it from a swallowed parse failure silently
+            // re-routes private captures into the committed public store.
+            try {
+                const parsed = JSON.parse(readFileSync(localFile, "utf8"));
+                existing = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+            }
+            catch {
+                existing = null;
+            }
+        }
+        if (existing === null) {
+            console.warn(`  ⚠ refusing to rewrite ${localFile}: it is not a JSON object and may hold your private-overlay pointer. Fix or remove it, then re-run \`hunch init --no-auto-commit\`.`);
+        }
+        else {
+            writeFileAtomic(localFile, JSON.stringify({ ...existing, autoCommit: false }, null, 2) + "\n");
+            console.log("  ✓ auto-commit OFF (captures stay uncommitted; commit .hunch/ yourself)");
         }
-        catch { /* absent/invalid → fresh */ }
-        writeFileAtomic(localFile, JSON.stringify({ ...existing, autoCommit: false }, null, 2) + "\n");
-        console.log("  ✓ auto-commit OFF (captures stay uncommitted; commit .hunch/ yourself)");
     }
     if (isGitRepo(root)) {
         const syncToOverlay = !!(opts.privateSync || opts.sharedSync);
@@ -259,7 +273,10 @@ program
         console.log(`  ⚠ skipped .mcp.json: ${e.message}`);
     }
     const cmds = writeSlashCommands(root);
-    console.log(`  ✓ wrote ${cmds.length} slash commands (/hunch-why, /hunch-fix, /hunch-fragile)`);
+    console.log(`  ✓ wrote ${cmds.written.length} slash commands (/hunch-why, /hunch-fix, /hunch-fragile, /capture, /heal, /audit)`);
+    for (const s of cmds.skipped) {
+        console.log(`  ⚠ kept your existing ${rel(root, s)} (no hunch:generated marker — delete the file and re-run init to adopt Hunch's version)`);
+    }
     const cmd = updateClaudeMd(root, store);
     console.log(`  ✓ updated ${rel(root, cmd)} with ambient Hunch context`);
     // Firmness: stamp .hunch/config.json (default advisory) so `hunch hook` reads a
@@ -374,7 +391,11 @@ program
     // commit is drafted — not per-commit, and not under --deep (an ensemble may
     // fan out to several distinct workers, each with its own configuration).
     if (!opts.deep && commits.length > 0) {
-        const ctxProvider = await selectProvider();
+        // { root }: the advisory must resolve the SAME provider the synthesis
+        // inside syncCommit resolves (persisted local.json preference included) —
+        // rootless resolution could grade a different provider and swallow the
+        // num_ctx warning for an actual Ollama run (issue #46).
+        const ctxProvider = await selectProvider({ root });
         const ctxWarning = await maybeWarnOllamaContext(ctxProvider.name, process.env);
         if (ctxWarning)
             console.log(ctxWarning);
@@ -3238,26 +3259,29 @@ program
             console.log("   Strict mode fails closed because an omitted source file could hide a semantic violation.");
         }
     }
-    if (!files.length) {
-        console.log(markdown ? renderMarkdown(emptyReport) : "No changed files to check.");
-        if (teamFreshnessFailure)
-            fail(teamFreshnessFailure);
-        if (opts.strict && semanticIssues.length)
-            process.exitCode = 1;
-        store.close();
-        return;
-    }
     // DIRECT (scope match) + NEAR (blast radius) + REGRESSION (re-added retired
     // code) + REDUNDANT (adds a symbol already defined elsewhere — advisory) + the
     // hardened strict gate + causal `why` citations — all assembled by the shared
     // store.buildCheckReport (also used by the hunch_merge_verdict tool).
-    const diff = exactCommit ? commitDiff(exactCommit, root) : opts.base ? rangeDiff(opts.base, root) : opts.working ? workingDiff(root) : stagedDiff(root);
-    const report = store.buildCheckReport(files, diff, {
-        strict: !!opts.strict,
-        lastChange: (f) => lastChangeDate(f, root),
-        publicOnly: !!opts.publicOnly,
-    });
-    if (opts.blast && !markdown) {
+    //
+    // A ZERO-FILE diff must NOT short-circuit the run: the per-file report has nothing
+    // to say, but the GRAPH-WIDE gates below (Architectural Conformance and Constitution
+    // policy) ask "does the code, right now, still satisfy recorded intent?" — a question
+    // independent of what this diff touched. Returning early here made a delete-only PR a
+    // vacuous green (deletions are excluded by the enumerators' --diff-filter=ACMR, so
+    // such a PR enumerates zero files) — including a deletion of the very symbol a
+    // blocking conformance predicate or an active policy guards.
+    const diff = files.length
+        ? (exactCommit ? commitDiff(exactCommit, root) : opts.base ? rangeDiff(opts.base, root) : opts.working ? workingDiff(root) : stagedDiff(root))
+        : "";
+    const report = files.length
+        ? store.buildCheckReport(files, diff, {
+            strict: !!opts.strict,
+            lastChange: (f) => lastChangeDate(f, root),
+            publicOnly: !!opts.publicOnly,
+        })
+        : emptyReport;
+    if (opts.blast && !markdown && files.length) {
         console.log(`Blast radius of ${files.length} changed file(s):`);
         for (const f of files) {
             const b = store.blastRadiusFiles(f);
@@ -3266,7 +3290,9 @@ program
         }
         console.log("");
     }
-    console.log(markdown ? renderMarkdown(report) : renderText(report));
+    console.log(files.length
+        ? (markdown ? renderMarkdown(report) : renderText(report))
+        : (markdown ? renderMarkdown(emptyReport) : "No changed files to check."));
     // ARCHITECTURAL CONFORMANCE: does the RESULTING code still satisfy every recorded
     // architectural invariant? This is graph-reachability, not a diff — so it catches semantic
     // violations a pattern-matcher / SAST can't express (a controller that now reaches the DB
@@ -3354,6 +3380,13 @@ const vetoCmd = program
         store.close();
         return fail(`--base ref "${opts.base}" does not resolve. In CI, fetch the base branch first (git fetch origin <branch>).`);
     }
+    // Same guard for --commit: an unfetched/mistyped sha would enumerate zero
+    // files and exit 0 — a vacuous pass where CI expects the Decision Guard
+    // to have actually looked (issue #45).
+    if (opts.commit && !revExists(opts.commit, root)) {
+        store.close();
+        return fail(`--commit sha "${opts.commit}" does not resolve. In CI, ensure the commit is fetched (git fetch --depth=... or fetch-depth: 0).`);
+    }
     store.reindex();
     const files = opts.commit ? commitFiles(opts.commit, root)
         : opts.base ? rangeFiles(opts.base, root)
@@ -3593,7 +3626,7 @@ program
         firm: "surfaces + warns on a violating edit",
         strict: "edit-time DENY + CI guard — the teeth are on",
     };
-    console.log(`\nHunch — enforcement status (${root.split("/").pop()})\n`);
+    console.log(`\nHunch — enforcement status (${basename(root)})\n`);
     console.log(`  firmness: ${firmness}   ← ${fnote[firmness] ?? ""}\n`);
     console.log(`  ✓ ARMED        ${blocking.length} confirmed blocking invariant(s) — held against every assistant`);
     if (blocking.length) {
@@ -3713,19 +3746,29 @@ program
             // When the prompt reads like a correction ("no / that's wrong / never X"),
             // nudge the agent to PERSIST it as an enforced constraint (Never Twice) —
             // not just obey it this once and forget it next session.
-            let text = looksLikeCorrection(evt.prompt) ? `${HOOK_REMINDER}\n\n${CORRECTION_NUDGE}` : HOOK_REMINDER;
+            const isCorrection = looksLikeCorrection(evt.prompt);
+            let text = isCorrection ? `${HOOK_REMINDER}\n\n${CORRECTION_NUDGE}` : HOOK_REMINDER;
+            // Payloads that must NEVER be deduped away. The dedup key hashes CONTENT, and
+            // this content is assembled from constants — so two back-to-back corrections
+            // produce byte-identical text and the second (usually the escalating one) was
+            // silently swallowed, never becoming an enforced rule. Same for the unverified
+            // nag, which is documented as the one nag that must repeat but rode the same
+            // deduped payload and so fired once per streak.
+            let mustDeliver = isCorrection;
             // Pipeline turn bookkeeping (fresh block budget) + the one nag that must
             // repeat: edits from an earlier turn still unverified.
             if (evt.session_id && pipelineEnabled()) {
                 const st = onPrompt(loadPipelineState(evt.session_id));
                 savePipelineState(evt.session_id, st);
-                if (!st.verifyAfterEdit)
+                if (!st.verifyAfterEdit) {
                     text += `\n\n${UNVERIFIED_NAG}`;
+                    mustDeliver = true;
+                }
             }
-            // Once per session is enough for the availability reminder — repeating it
-            // every prompt burns context for zero information. A correction nudge has
-            // different content, so it always comes through (dec_244397d920).
-            if (injectionMode(evt.session_id, "prompt-reminder", text) === "delta")
+            // Once per session is enough for the bare availability reminder — repeating it
+            // every prompt burns context for zero information (dec_244397d920). Only that
+            // ambient case is deduped.
+            if (!mustDeliver && injectionMode(evt.session_id, "prompt-reminder", text) === "delta")
                 return;
             emitContext(provider, "UserPromptSubmit", text);
             return;
@@ -4659,6 +4702,7 @@ program
     .option("--no-llm", "skip LLM prose; deterministic template pages only")
     .option("--prose-heal", "also LLM-rewrite each adopted copy's reconciled overview (subscription; the deterministic corrections always remain)")
     .option("--private", "render the FULL graph (private overlay included) and write the wiki into the OVERLAY repo — nothing lands in this repo")
+    .option("--private-prose", "opt in to LLM prose for a PRIVATE-split overlay wiki — this SENDS overlay records (decision text, private constraints, private bug root causes) to the configured provider. Off by default.")
     .action(async (opts) => {
     const { store, root } = storeFor();
     try {
@@ -4724,7 +4768,21 @@ program
             return fail("--prose-heal needs the LLM — drop --no-llm.");
         let prose;
         let adoptionProse;
-        if (opts.llm !== false) {
+        // A PRIVATE-SPLIT overlay's packs carry the full union (source: "all") — overlay
+        // decision context/rationale/rejected alternatives, private constraint statements,
+        // private bug root causes. Sending that to an external subscription CLI would
+        // silently break the storage-private promise every other path here enforces
+        // (public-only CI comments, public-only grounding, public-only wiki manifests), in
+        // the very command documented as the way to build the private wiki. So prose is OFF
+        // by default for that home and needs an explicit --private-prose. A SHARED overlay
+        // is deliberately excluded: there the team already routes captures through the
+        // configured provider by recorded policy.
+        const privateSplit = home.kind === "private" && store.mode === "private";
+        const proseBlockedForPrivacy = privateSplit && !opts.privateProse;
+        if (opts.llm !== false && proseBlockedForPrivacy) {
+            console.log("Private overlay: LLM prose is OFF (pages would send overlay records to the configured provider). Deterministic template pages; pass --private-prose to opt in.");
+        }
+        if (opts.llm !== false && !proseBlockedForPrivacy) {
             const provider = await selectProvider({ root });
             if (provider.draftProse) {
                 console.log(`Prose via ${provider.name}; the drift-bearing skeleton stays deterministic.`);

package/dist/core/conformance.js

@@ -1,3 +1,4 @@
+import { externalImportNodeId } from "./externalImports.js";
 function resolveSymbols(graph, ref) {
     const syms = graph.symbols;
     if (ref.startsWith("sym_"))
@@ -48,17 +49,30 @@ function evalPredicate(graph, d, p) {
         return { ...base, satisfied: false, detail: `subject "${p.subject}" not found in the graph — intent's subject is gone` };
     const wantReach = p.assert === "calls" || p.assert === "imports";
     const objects = p.object ? resolveSymbols(graph, p.object) : [];
-    if (!objects.length) {
-        // a required target gone ⇒ the link can't hold (violated); a forbidden one trivially holds.
+    // An external package is a VIRTUAL graph node (`ext_<hash>`, see core/externalImports.ts),
+    // never a Symbol record — so resolveSymbols can NEVER find one. Without this, every
+    // `not-imports <symbol> <package>` predicate fell straight into the "target not found ⇒
+    // a forbidden relation trivially holds" branch below and reported ✅ forever, while the
+    // graph right beside it recorded the violating `imports` edge. Resolve the package from
+    // the edge set instead, which is where the indexer actually puts it.
+    const externalId = p.object ? externalImportNodeId(p.object) : null;
+    const objectIds = objects.length
+        ? objects.map((o) => o.id)
+        : externalId && graph.edges.some((e) => e.to === externalId)
+            ? [externalId]
+            : [];
+    if (!objectIds.length) {
+        // a required target gone ⇒ the link can't hold (violated); a forbidden one trivially
+        // holds — nothing can reach a node the graph does not contain.
         return { ...base, satisfied: !wantReach, detail: `target "${p.object ?? ""}" not found in the graph` };
     }
     // A required relation cannot guess which same-name symbol carries the intent.
     // Force qualification instead of accidentally proving a different binding.
-    if (wantReach && (subjects.length !== 1 || objects.length !== 1)) {
+    if (wantReach && (subjects.length !== 1 || objectIds.length !== 1)) {
         return {
             ...base,
             satisfied: false,
-            detail: `ambiguous required binding (${subjects.length} subject, ${objects.length} target matches) — qualify as file:symbol; intent VIOLATED`,
+            detail: `ambiguous required binding (${subjects.length} subject, ${objectIds.length} target matches) — qualify as file:symbol; intent VIOLATED`,
         };
     }
     // A forbidden relation is conservative in the other direction: ANY matching
@@ -66,7 +80,7 @@ function evalPredicate(graph, d, p) {
     // only the first target lets a duplicate symbol hide a violation.
     const linked = subjects.some((subject) => {
         const reached = reaches(graph, subject.id, p.transitive);
-        return objects.some((object) => reached.has(object.id));
+        return objectIds.some((id) => reached.has(id));
     });
     const satisfied = wantReach ? linked : !linked;
     const via = p.transitive ? " (transitively)" : "";

package/dist/core/constraintmatch.js

@@ -25,9 +25,17 @@ export function matchForbids(f, addedDeps, scopedAdded) {
     // tripping an in-scope edit.
     const hitDeps = [];
     for (const dep of f.deps) {
-        const added = [...addedDeps].find((d) => d === dep || d.startsWith(`${dep}/`));
-        if (added && codeLines.some((l) => importsDep(l, added)))
-            hitDeps.push(added);
+        // EVERY added specifier that satisfies the forbid, not just the first: one commit
+        // can add `lodash` in an out-of-scope file and `lodash/groupBy` in the scoped one.
+        // Taking only `.find`'s first match meant the out-of-scope spelling shadowed the
+        // real in-scope violation and the blocking rule failed OPEN — with the outcome
+        // depending on diff order, i.e. on an unrelated file's name.
+        for (const added of addedDeps) {
+            if (added !== dep && !added.startsWith(`${dep}/`))
+                continue;
+            if (codeLines.some((l) => importsDep(l, added)))
+                hitDeps.push(added);
+        }
     }
     if (hitDeps.length)
         return { tier: "dep", evidence: hitDeps.map((d) => `+import ${d}`) };

package/dist/core/docscan.js

@@ -89,6 +89,16 @@ export function scanRepoDocs(decisions, root) {
             else if (superseded && current && current.id !== a.pin) {
                 issues.push(`line ${a.line}: pinned to superseded ${a.pin}; current for "${a.topic}" is ${current.id}`);
             }
+            else if (pinned.status === "rejected") {
+                // The ledger tells readers to "Trust ✅". A doc pinned to an approach the team
+                // explicitly REJECTED is the opposite of grounded — and the pre-edit hook, which
+                // only injects live decisions, already disagrees with the ✅ this used to award.
+                issues.push(`line ${a.line}: pinned to ${a.pin}, a REJECTED decision (topic "${a.topic}")${current ? `; current is ${current.id}` : ""}`);
+            }
+            else if (pinned.status === "proposed") {
+                // Roadmap intent, not an in-force answer: it neither grounds the doc nor makes
+                // it stale, so the doc falls to the honest "unverified" tier.
+            }
             else if (!superseded) {
                 groundedPins++;
             }

package/dist/core/drift.js

@@ -13,7 +13,7 @@
  *                 `hunch wiki --heal`, never a gate.
  */
 import { existsSync, readFileSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { toPosixTarget } from "./paths.js";
 import { currentForTopic, isLive } from "./topics.js";
 import { parseDocAnchors } from "./docanchors.js";
@@ -163,7 +163,10 @@ function referenceExists(store, root, decisionId, ref) {
     // A private-scoped reference is an overlay-repo-relative path, not an escape
     // hatch into arbitrary local files.
     const rel = relative(privateRoot, candidate);
-    if (rel === "" || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\\\" : "/"}`) || isAbsolute(rel))
+    // NOTE: sep, not an escaped literal — `"\\\\"` in a template is the TWO-char
+    // string `\\`, which `relative()` never produces, silently disabling the
+    // containment check on Windows (issue #31).
+    if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
         return false;
     return existsSync(candidate);
 }

package/dist/core/io.js

@@ -1,5 +1,6 @@
 /** Durable file writes for the Hunch. */
-import { linkSync, writeFileSync, renameSync, rmSync } from "node:fs";
+import { closeSync, fsyncSync, linkSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+import { dirname } from "node:path";
 let counter = 0;
 const renameRetryDelaysMs = [10, 20, 40, 80];
 const renameRetryWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
@@ -7,6 +8,13 @@ const renameRetryWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_
  * Write `data` to `file` via a temp file + rename, so an interrupted write can't
  * leave the target truncated (the symbols/edges index is the worst to half-write).
  *
+ * Durability (issue #34): the temp file is fsync'd BEFORE the rename, and the
+ * parent directory best-effort after it. A process kill was always safe (page
+ * cache preserves ordering), but on power loss / OS crash the rename's metadata
+ * could reach disk before the temp file's data blocks — leaving the target
+ * present but truncated or garbage, the exact state the atomic-write invariant
+ * (con_902759b3dc) exists to prevent.
+ *
  * Windows caveat: renameSync can't REPLACE a file another process holds open (even
  * for read) — it throws EPERM/EBUSY/EACCES, exactly when the MCP server is reading
  * while a CLI writes. Retry that atomic replacement with bounded backoff. If the
@@ -17,19 +25,42 @@ const renameRetryWaiter = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_
 export function writeFileAtomic(file, data) {
     const tmp = `${file}.tmp${process.pid}.${counter++}`;
     try {
-        writeFileSync(tmp, data);
+        const fd = openSync(tmp, "w");
+        try {
+            writeSync(fd, data);
+            fsyncSync(fd); // data blocks reach disk before the rename's metadata can
+        }
+        finally {
+            closeSync(fd);
+        }
     }
     catch (e) {
-        safeRm(tmp);
+        cleanupTmp(tmp);
         throw e;
     }
     try {
         renameWithContentionRetry(tmp, file);
     }
     catch (e) {
-        safeRm(tmp);
+        cleanupTmp(tmp);
         throw e;
     }
+    fsyncDirBestEffort(dirname(file));
+}
+/** Persist the rename itself (the directory entry). POSIX semantics; Windows
+ *  cannot open directories for fsync, so this is a silent no-op there — NTFS
+ *  journals the metadata on its own schedule. */
+function fsyncDirBestEffort(dir) {
+    try {
+        const fd = openSync(dir, "r");
+        try {
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch { /* platform without directory fsync — best effort by contract */ }
 }
 function renameWithContentionRetry(from, to) {
     for (let attempt = 0;; attempt++) {
@@ -55,7 +86,7 @@ function isRenameContention(error) {
 export function writeFileAtomicIfAbsent(file, data) {
     const tmp = `${file}.tmp${process.pid}.${counter++}`;
     try {
-        writeFileSync(tmp, data);
+        writeFileAtomicTmp(tmp, data);
         linkSync(tmp, file);
         return true;
     }
@@ -65,15 +96,39 @@ export function writeFileAtomicIfAbsent(file, data) {
         throw error;
     }
     finally {
-        safeRm(tmp);
+        // Not silently best-effort (issue #38): after linkSync succeeds the target
+        // shares the temp inode, so a swallowed unlink failure (a Windows AV scanner
+        // or indexer briefly holding tmp) leaves the published file with nlink=2 —
+        // which validateExistingFile rejects as hard-linked — plus a stray .tmp.
+        cleanupTmp(tmp);
     }
 }
-function safeRm(p) {
+/** Write + fsync a fresh temp file (shared by both atomic writers). */
+function writeFileAtomicTmp(tmp, data) {
+    const fd = openSync(tmp, "w");
+    try {
+        writeSync(fd, data);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Remove a temp file, riding out a transient external hold (AV/indexer) with one
+ *  short retry; a persistent failure is REPORTED, never swallowed — a leaked tmp
+ *  beside a hard-link-published target keeps that target at nlink=2. */
+function cleanupTmp(p) {
     try {
         rmSync(p, { force: true });
+        return;
     }
-    catch {
-        /* best effort */
+    catch { /* transient hold — retry once below */ }
+    Atomics.wait(renameRetryWaiter, 0, 0, 50);
+    try {
+        rmSync(p, { force: true });
+    }
+    catch (e) {
+        console.warn(`[hunch] temp file left behind (its published target keeps nlink=2 until it is removed): ${p} (${e.message})`);
     }
 }
 //# sourceMappingURL=io.js.map

package/dist/extractors/diff.js

@@ -131,18 +131,26 @@ export function analyzeDiff(diff) {
         }
         // ---- inside a hunk: content lines ----
         if (raw.startsWith("+")) {
-            if (!isCode(curFile))
-                continue;
-            addedLines++;
-            if (!curAdded && !curDeleted)
-                filesModified.add(curFile);
             const body = raw.slice(1);
+            // Raw added lines are captured for EVERY file, before the code-only gate:
+            // content-matched constraints and Veto tripwires are not code-only rules
+            // (a blocking invariant legitimately scopes .github/workflows/**, *.sql,
+            // Dockerfile). Skipping them here left `scopedAdded` empty, which
+            // buildCheckReport reads as "cannot prove a violation ⇒ complies" — so the
+            // pre-edit hook denied the edit while `hunch check --strict` passed the
+            // very commit that landed it. Symbol/import extraction and the churn
+            // counters below stay code-only, unchanged.
             let lines = addedLinesBy.get(curFile);
             if (!lines) {
                 lines = [];
                 addedLinesBy.set(curFile, lines);
             }
             lines.push(body);
+            if (!isCode(curFile))
+                continue;
+            addedLines++;
+            if (!curAdded && !curDeleted)
+                filesModified.add(curFile);
             const d = declOf(body);
             if (d)
                 declsFor(curFile)?.added.set(d.name, d);