@davesheffer/hunch 1.10.4 → 1.10.5

package/dist/store/db.js

@@ -59,22 +59,60 @@ function createDb(sqlitePath) {
     db.exec("PRAGMA busy_timeout = 5000");
     return db;
 }
+/** Does this error mean the derived index FILE itself is unusable?
+ *
+ *  Matched narrowly, on SQLite's own corruption signatures only. An environment failure —
+ *  a permission denial, a full disk, a locked file — must still propagate: deleting the
+ *  file would not fix it and would destroy a cache the user may still be able to keep.
+ *  `SQLITE_CANTOPEN` ("unable to open database file") is deliberately NOT here for that
+ *  reason: it usually means a permissions or path problem, not corruption. */
+function isCorruptIndexFile(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /database disk image is malformed|file is not a database|file is encrypted or is not a database|malformed database schema|database corruption/i.test(message);
+}
+function discardDerivedIndex(sqlitePath) {
+    for (const path of [sqlitePath, `${sqlitePath}-wal`, `${sqlitePath}-shm`])
+        rmSync(path, { force: true });
+}
 export function openDb(sqlitePath) {
     mkdirSync(dirname(sqlitePath), { recursive: true });
-    let db = createDb(sqlitePath);
+    // A corrupt file can fail at OPEN as well as at schema init (node:sqlite opens lazily,
+    // so "file is not a database" typically surfaces on the first statement — but not always).
+    let db;
+    try {
+        db = createDb(sqlitePath);
+    }
+    catch (error) {
+        if (!isCorruptIndexFile(error))
+            throw error;
+        discardDerivedIndex(sqlitePath);
+        db = createDb(sqlitePath);
+    }
     try {
         initializeSchema(db);
         return db;
     }
     catch (error) {
-        if (!(error instanceof RebuildDerivedIndex)) {
+        // The ENTIRE database is derived from the Git-native JSON in .hunch/ — it is a cache,
+        // and a cache that cannot be read should be rebuilt, not fatal. That reasoning was
+        // already written here, but it was wired to exactly ONE trigger: RebuildDerivedIndex,
+        // thrown only when an fts5 index meets a runtime without the FTS5 module. Every other
+        // error propagated as a raw SQLite string, so a corrupt file took out `hunch index`,
+        // `query`, `check` and `doctor` at once — and, because the pre-edit hook must emit
+        // nothing and exit 0 on any failure (con_03a0b94b2e), it also went SILENTLY blind,
+        // permanently, with no command left that could repair it.
+        if (!(error instanceof RebuildDerivedIndex) && !isCorruptIndexFile(error)) {
             db.close();
             throw error;
         }
-        db.close();
-        for (const path of [sqlitePath, `${sqlitePath}-wal`, `${sqlitePath}-shm`])
-            rmSync(path, { force: true });
+        try {
+            db.close();
+        }
+        catch { /* a corrupt handle may refuse to close; the file goes anyway */ }
+        discardDerivedIndex(sqlitePath);
         db = createDb(sqlitePath);
+        // Deliberately NOT wrapped in another rebuild attempt: if a freshly created file also
+        // fails, the problem is the environment, not the cache, and it must surface.
         initializeSchema(db);
         return db;
     }

package/dist/store/merge.js

@@ -95,9 +95,49 @@ export function pickWinner(ours, theirs) {
     const tr = recency(theirs);
     if (orr !== tr)
         return orr > tr ? ours : theirs;
+    // A merge must never silently UNDO recorded progress. Closing a bug does not touch
+    // `provenance` or `date` — captureTestRun writes
+    // `{ ...bug, status: "fixed", lineage: { ...lineage, fixed_commit: sha } }` — so
+    // recency() TIES against the still-open side and control always reached the
+    // lexicographic tiebreak below. That tiebreak then picked the LESS-resolved record,
+    // twice over: `"fixed_commit":null` sorts above `"fixed_commit":"<sha>"` (n > "), and
+    // `"status":"open"` sorts above `"status":"fixed"` (o > f). So a clean merge reverted
+    // the closure every time, in the subsystem whose entire job is not losing state.
+    //
+    // Prefer the side carrying more one-way lifecycle evidence. Deterministic and
+    // side-independent (a pure function of each record), so A-merges-B and B-merges-A
+    // still agree.
+    const oe = closureEvidence(ours);
+    const te = closureEvidence(theirs);
+    if (oe !== te)
+        return oe > te ? ours : theirs;
     // Deterministic, side-independent tiebreak so A-merges-B and B-merges-A agree.
     return canon(ours) >= canon(theirs) ? ours : theirs;
 }
+/** Count the one-way lifecycle facts a record carries: a fix commit, a spawned
+ *  decision/constraint, a supersession, an end of validity. Each is something that
+ *  HAPPENED and was recorded — never something a merge should quietly discard.
+ *
+ *  Deliberately counts EVIDENCE fields rather than reading `status`: a status string can
+ *  be moved in either direction (a reopened bug goes fixed -> open), but a recorded
+ *  `fixed_commit` is a fact about history. Ranking on evidence means a genuine reopen —
+ *  which clears the commit — is still allowed to win, while a merge can no longer drop a
+ *  closure that nobody reopened. */
+function closureEvidence(r) {
+    let n = 0;
+    const lineage = r.lineage;
+    if (isRec(lineage)) {
+        for (const key of ["fixed_commit", "spawned_decision", "spawned_constraint"]) {
+            if (typeof lineage[key] === "string" && lineage[key].length > 0)
+                n += 1;
+        }
+    }
+    for (const key of ["superseded_by", "valid_to"]) {
+        if (typeof r[key] === "string" && r[key].length > 0)
+            n += 1;
+    }
+    return n;
+}
 function parseSide(text) {
     const trimmed = (text ?? "").trim();
     if (!trimmed)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.10.4",
+  "version": "1.10.5",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Engineering memory and a deterministic Change Gate for AI-assisted codebases: decisions, rejected approaches, constraints, and bug lineage become portable context and opt-in enforcement for every MCP assistant.",