@davesheffer/hunch 1.12.1 → 1.12.2

package/dist/core/drift.js

@@ -29,6 +29,16 @@ export function computeDrift(store, root) {
     // anchor-stale. Keeps the doc≠graph gate's false-positive rate ~zero: a routine
     // narrowing supersession (successor lists fewer files) never flags files still governed.
     const liveFiles = new Set(decisions.filter(isLive).flatMap((d) => (d.related_files ?? []).map(toPosixTarget)));
+    // A related_files entry may name a DIRECTORY ("vscode-extension/"), which governs every
+    // file beneath it. Exact Set.has cannot see that, so a live directory-scoped decision
+    // failed to suppress anchor-stale for files it plainly covers — a false positive that
+    // only appeared on a public-only store, because an overlay decision happened to claim
+    // the same file by exact path and masked it locally.
+    const liveDirs = [...liveFiles].filter((f) => f.endsWith("/"));
+    const governedByLiveDecision = (file) => {
+        const p = toPosixTarget(file);
+        return liveFiles.has(p) || liveDirs.some((dir) => p.startsWith(dir));
+    };
     const premiseEnv = { now: new Date().toISOString(), exists: (p) => existsSync(join(root, p)) };
     for (const d of decisions) {
         // 1. DEAD-REFERENCE — only for in-force decisions; a superseded one referencing
@@ -66,7 +76,7 @@ export function computeDrift(store, root) {
             const current = currentForTopic(decisions, d.topic);
             if (current && current.id !== d.id) {
                 for (const f of d.related_files ?? []) {
-                    if (!f || f.includes("*") || liveFiles.has(toPosixTarget(f)))
+                    if (!f || f.includes("*") || governedByLiveDecision(f))
                         continue;
                     if (!referenceExists(store, root, d.id, f))
                         continue; // missing file is history → dead-ref's job

package/dist/core/publication.js

@@ -0,0 +1,196 @@
+/** Publication safety — what a record would EXPOSE if it lands in the committed store.
+ *
+ *  Context (2026-08-09, 2026-08-11): a capture defaults to the PUBLIC store, and for a
+ *  default `hunch init` user `.hunch/*.json` is git-tracked, so an unflagged
+ *  `hunch_record_*` publishes on the next push. Two leaks reached the public tree that
+ *  way. Nothing inspected what the records SAID.
+ *
+ *  Two tiers, deliberately unequal:
+ *
+ *  - STRUCTURAL hits (machine paths, overlay paths, secret material) are
+ *    domain-independent — a Windows home directory is a leak in any repository, in any
+ *    industry. These are safe to enforce in a package other people install.
+ *  - VOCABULARY hits are corpus-tuned and ship EMPTY. A term list built from one
+ *    project's strategy prose fires on another project's ordinary engineering writing
+ *    ("revenue" is a domain noun in a billing system). A repo opts in through
+ *    `.hunch/publication.json`; the package never presumes.
+ *
+ *  Nothing here throws or blocks. `con_03a0b94b2e` holds the lifecycle hook to
+ *  fail-open, and a privacy heuristic is a smoke detector, not a proof — it earns a
+ *  visible line, not a veto. */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+/** Structural kinds are the only ones a package may enforce for a stranger's repo. */
+const STRUCTURAL = new Set([
+    "machine-path",
+    "private-overlay-path",
+    "secret-material",
+]);
+export function isStructural(hit) {
+    return STRUCTURAL.has(hit.kind);
+}
+/** Placeholder home directories that documentation and tests use on purpose.
+ *  `/Users/me/repo` appears in src/integrations/claudeConfig.ts and its test as an
+ *  illustration; flagging those would train everyone to ignore the scanner. */
+const PLACEHOLDER_USER = /^(me|you|user|username|<[^>]+>|\$\{[^}]+\}|example|test|foo|bar)$/i;
+const MACHINE_PATH = [
+    /[A-Za-z]:[\\/]Users[\\/]([^\\/"'\s,)\]]+)/g,
+    /(?:^|[\s"'(])\/(?:Users|home)\/([^/"'\s,)\]]+)/g,
+];
+/** A path INTO the overlay (dir + file), not a bare mention of the feature. The
+ *  gitignore entry and the CLAUDE.md description name `.hunch-private` legitimately;
+ *  `.hunch-private/exp03-bank/cases-hunch-draft.json` names private CONTENT. */
+const OVERLAY_PATH = /\.hunch-private[\\/][A-Za-z0-9._-]+[\\/][A-Za-z0-9._-]+/g;
+/** Live credential shapes only. A bare `VSCE_PAT` / `AUTH_TOKEN` identifier is a
+ *  variable name, not a secret, and flagging it produced a false positive on
+ *  dec_cd37bf2d9a during tuning. */
+const SECRET_MATERIAL = /\b(?:gh[pousr]_[A-Za-z0-9]{16,}|sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g;
+const clip = (s, max = 120) => {
+    const flat = s.replace(/\s+/g, " ").trim();
+    return flat.length > max ? flat.slice(0, max) + "…" : flat;
+};
+/** Fields that hold human prose. Vocabulary is scanned here only — scanning raw JSON
+ *  would match ids, file paths and evidence lines and drown the signal. */
+const PROSE_KEYS = new Set([
+    "title", "context", "decision", "rationale", "statement", "rule", "observation",
+    "summary", "description", "symptom", "root_cause", "resolution", "notes",
+    "consequences", "alternatives_rejected", "steps", "why",
+]);
+function proseOf(record) {
+    const out = [];
+    if (!record || typeof record !== "object")
+        return out;
+    for (const [k, v] of Object.entries(record)) {
+        if (!PROSE_KEYS.has(k))
+            continue;
+        if (typeof v === "string")
+            out.push({ field: k, text: v });
+        else if (Array.isArray(v)) {
+            v.forEach((item, i) => {
+                if (typeof item === "string")
+                    out.push({ field: `${k}[${i}]`, text: item });
+            });
+        }
+    }
+    return out;
+}
+function readPatterns(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return [];
+    }
+    const raw = parsed?.vocabulary;
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const pattern of raw) {
+        if (typeof pattern !== "string")
+            continue;
+        try {
+            out.push(new RegExp(pattern, "gi"));
+        }
+        catch {
+            // One bad pattern must not disable the rest of a user's list.
+        }
+    }
+    return out;
+}
+/** Read a repo's opt-in term list, merged from two layers:
+ *      .hunch/publication.json        committed, shareable patterns
+ *      .hunch/publication.local.json  gitignored, per-machine patterns
+ *
+ *  The local layer exists because the list itself can be sensitive. A rule that
+ *  catches a competitor teardown has to NAME competitors, and committing that
+ *  publishes a watchlist — the exact class of content the scanner is meant to keep
+ *  out of a public repo. Patterns that would embarrass you if read belong in the
+ *  local layer; generic ones can ship.
+ *
+ *  Absent file, malformed JSON, or an invalid pattern all degrade to "no vocabulary".
+ *  A privacy heuristic that crashes a capture is worse than one that stays quiet, and
+ *  the structural tier — the part that works for everyone — never depends on this. */
+export function loadVocabulary(hunchDir) {
+    return [
+        ...readPatterns(join(hunchDir, "publication.json")),
+        ...readPatterns(join(hunchDir, "publication.local.json")),
+    ];
+}
+/** Every string VALUE in the record, with the field path that carried it.
+ *  Deliberately not `JSON.stringify` + one regex pass: the JSON encoding doubles
+ *  backslashes, so `C:\Users\x` becomes `C:\\Users\\x` and a path rule written for
+ *  real text silently stops matching on Windows — which is exactly how the first
+ *  version of this scanner passed its macOS cases and failed its Windows ones. */
+function stringValues(node, path, seen, out) {
+    if (typeof node === "string") {
+        out.push({ field: path, text: node });
+        return;
+    }
+    if (!node || typeof node !== "object")
+        return;
+    if (seen.has(node))
+        return; // cycles are input we tolerate, never throw on
+    seen.add(node);
+    if (Array.isArray(node)) {
+        node.forEach((v, i) => stringValues(v, `${path}[${i}]`, seen, out));
+        return;
+    }
+    for (const [k, v] of Object.entries(node)) {
+        stringValues(v, path === "$" ? k : `${path}.${k}`, seen, out);
+    }
+}
+/** Pure. No IO, no throw. Returns every sensitivity signal in one record. */
+export function scanRecord(record, opts = {}) {
+    const hits = [];
+    if (!record || typeof record !== "object")
+        return hits;
+    const values = [];
+    stringValues(record, "$", new WeakSet(), values);
+    for (const { field, text } of values) {
+        for (const re of MACHINE_PATH) {
+            for (const m of text.matchAll(re)) {
+                const who = m[1] ?? "";
+                if (PLACEHOLDER_USER.test(who))
+                    continue;
+                hits.push({ kind: "machine-path", field, excerpt: clip(m[0]) });
+            }
+        }
+        for (const m of text.matchAll(OVERLAY_PATH)) {
+            hits.push({ kind: "private-overlay-path", field, excerpt: clip(m[0]) });
+        }
+        for (const m of text.matchAll(SECRET_MATERIAL)) {
+            // Never echo a live credential back into a log or a tool result.
+            hits.push({ kind: "secret-material", field, excerpt: `${m[0].slice(0, 6)}… (redacted)` });
+        }
+    }
+    const vocab = opts.vocabulary ?? [];
+    if (vocab.length) {
+        for (const { field, text } of proseOf(record)) {
+            for (const re of vocab) {
+                const probe = new RegExp(re.source, re.flags.includes("g") ? re.flags : re.flags + "g");
+                for (const m of text.matchAll(probe)) {
+                    const at = m.index ?? 0;
+                    hits.push({
+                        kind: "market-vocabulary",
+                        field,
+                        excerpt: clip(text.slice(Math.max(0, at - 40), at + m[0].length + 40)),
+                    });
+                }
+            }
+        }
+    }
+    return hits;
+}
+/** One line naming what was matched and the exact remedy. The predecessor of this
+ *  message was a generic "for sensitive content use private:true" nudge, which was
+ *  present and ignored during both leaks — a warning that does not quote the offending
+ *  text reads as boilerplate. */
+export function publicationWarning(hits) {
+    if (!hits.length)
+        return "";
+    const shown = hits.slice(0, 3).map((h) => `${h.kind}${h.field === "$" ? "" : ` in ${h.field}`}: "${h.excerpt}"`);
+    const more = hits.length > shown.length ? ` (+${hits.length - shown.length} more)` : "";
+    return `\n⚠ PUBLICATION RISK — this record would publish with the repo:\n  ${shown.join("\n  ")}${more}\n  Re-record with private:true to route it to the overlay instead.`;
+}
+//# sourceMappingURL=publication.js.map

package/dist/extractors/languages.js

@@ -6,25 +6,25 @@
  * four files.
  */
 import { loadNativeTreeSitter } from "./nativeTreeSitter.js";
-const TS_QUERY = `
-  (function_declaration name: (identifier) @fn.name) @fn.def
-  (generator_function_declaration name: (identifier) @fn.name) @fn.def
-  (method_definition name: (property_identifier) @method.name) @method.def
-  (class_declaration name: (type_identifier) @class.name) @class.def
-  (interface_declaration name: (type_identifier) @iface.name) @iface.def
-  (type_alias_declaration name: (type_identifier) @type.name) @type.def
-  (variable_declarator
-     name: (identifier) @arrow.name
-     value: [(arrow_function) (function_expression)]) @arrow.def
-  (import_statement source: (string) @import.src)
-  (call_expression function: (identifier) @call.id)
-  (call_expression function: (member_expression property: (property_identifier) @call.member))
-  ;; Construction IS a call. Without these, \`new Foo()\` produced no edge at all, so
-  ;; every class in a TS/JS repo had fan_in 0: blast radius before a constructor
-  ;; change came back empty, and a \`not-calls\` conformance predicate over a class
-  ;; could never see its own counterexample.
-  (new_expression constructor: (identifier) @call.id)
-  (new_expression constructor: (member_expression property: (property_identifier) @call.member))
+const TS_QUERY = `
+  (function_declaration name: (identifier) @fn.name) @fn.def
+  (generator_function_declaration name: (identifier) @fn.name) @fn.def
+  (method_definition name: (property_identifier) @method.name) @method.def
+  (class_declaration name: (type_identifier) @class.name) @class.def
+  (interface_declaration name: (type_identifier) @iface.name) @iface.def
+  (type_alias_declaration name: (type_identifier) @type.name) @type.def
+  (variable_declarator
+     name: (identifier) @arrow.name
+     value: [(arrow_function) (function_expression)]) @arrow.def
+  (import_statement source: (string) @import.src)
+  (call_expression function: (identifier) @call.id)
+  (call_expression function: (member_expression property: (property_identifier) @call.member))
+  ;; Construction IS a call. Without these, \`new Foo()\` produced no edge at all, so
+  ;; every class in a TS/JS repo had fan_in 0: blast radius before a constructor
+  ;; change came back empty, and a \`not-calls\` conformance predicate over a class
+  ;; could never see its own counterexample.
+  (new_expression constructor: (identifier) @call.id)
+  (new_expression constructor: (member_expression property: (property_identifier) @call.member))
 `;
 const TS_BUILTIN_METHODS = new Set([
     "map", "filter", "forEach", "reduce", "find", "findIndex", "some", "every", "includes",
@@ -54,6 +54,16 @@ const TS_SHARED = {
         "iface.name": "iface.def", "type.name": "type.def", "arrow.name": "arrow.def",
     },
     builtinMethods: TS_BUILTIN_METHODS,
+    // ES2018 relaxed template literals: an INVALID escape (`\x` with no hex, `\u`
+    // short, `\u{` unterminated) is legal inside a TAGGED template — the cooked
+    // value is undefined and the raw text survives, which is the entire point of
+    // String.raw`C:\Users\x`. tree-sitter-javascript never implemented that
+    // relaxation and is identical through 0.25.0, so it emits an ERROR node inside
+    // the template_string. In an UNTAGGED template the same escape IS a syntax
+    // error, and the grammar models the two differently — a tagged template's
+    // template_string hangs off a call_expression, an untagged one off whatever
+    // consumes the value — so requiring that pair keeps genuine errors failing.
+    toleratedErrorScopes: [{ node: "template_string", parentIs: "call_expression" }],
 };
 const TYPESCRIPT = {
     ...TS_SHARED,
@@ -71,28 +81,28 @@ const TSX = {
     grammarKey: "tsx",
     loadGrammar: () => loadNativeTreeSitter().tsx,
 };
-const PY_QUERY = `
-  (class_definition
-    name: (identifier) @class.name
-    body: (block
-      [
-        (function_definition name: (identifier) @method.name) @method.def
-        (decorated_definition definition: (function_definition name: (identifier) @method.name) @method.def)
-      ])) @class.def
-  ;; Every class, including one with no directly-nested def: dataclasses, Exception
-  ;; subclasses, Enums, TypedDicts and pydantic models are method-less by design and
-  ;; were invisible to the entire graph (no symbol, no component, no edges), so
-  ;; \`hunch why\` and blast radius came back empty for exactly the classes a refactor
-  ;; breaks. parse.ts keys pendingDefs by node id and keeps the first classification,
-  ;; so a class that ALSO matches the method-bearing pattern above is not duplicated.
-  (class_definition name: (identifier) @class.name) @class.def
-  (function_definition name: (identifier) @fn.name) @fn.def
-  (import_statement name: (dotted_name) @import.src)
-  (import_statement name: (aliased_import name: (dotted_name) @import.src))
-  (import_from_statement module_name: (dotted_name) @import.src)
-  (import_from_statement module_name: (relative_import) @import.src)
-  (call function: (identifier) @call.id)
-  (call function: (attribute attribute: (identifier) @call.member))
+const PY_QUERY = `
+  (class_definition
+    name: (identifier) @class.name
+    body: (block
+      [
+        (function_definition name: (identifier) @method.name) @method.def
+        (decorated_definition definition: (function_definition name: (identifier) @method.name) @method.def)
+      ])) @class.def
+  ;; Every class, including one with no directly-nested def: dataclasses, Exception
+  ;; subclasses, Enums, TypedDicts and pydantic models are method-less by design and
+  ;; were invisible to the entire graph (no symbol, no component, no edges), so
+  ;; \`hunch why\` and blast radius came back empty for exactly the classes a refactor
+  ;; breaks. parse.ts keys pendingDefs by node id and keeps the first classification,
+  ;; so a class that ALSO matches the method-bearing pattern above is not duplicated.
+  (class_definition name: (identifier) @class.name) @class.def
+  (function_definition name: (identifier) @fn.name) @fn.def
+  (import_statement name: (dotted_name) @import.src)
+  (import_statement name: (aliased_import name: (dotted_name) @import.src))
+  (import_from_statement module_name: (dotted_name) @import.src)
+  (import_from_statement module_name: (relative_import) @import.src)
+  (call function: (identifier) @call.id)
+  (call function: (attribute attribute: (identifier) @call.member))
 `;
 const PY_BUILTIN_METHODS = new Set([
     "get", "set", "keys", "values", "items", "pop", "popitem", "update", "setdefault", "copy", "clear",

package/dist/extractors/parse.js

@@ -82,7 +82,49 @@ export function parseSource(file, source) {
         });
     }
     symbols.sort((a, b) => a.startByte - b.startByte);
-    return { symbols, imports, calls, parseable: !tree.rootNode.hasError };
+    return { symbols, imports, calls, parseable: isParseable(tree.rootNode, spec) };
+}
+/** True when every ERROR/MISSING node in the tree sits in an ancestor shape this
+ *  language declares as a known grammar limitation (LanguageSpec.toleratedErrorScopes).
+ *
+ *  This matters because `conform` is fail-CLOSED on scan completeness: one file
+ *  reporting parseable:false rejects the WHOLE architectural-conformance scan, so a
+ *  grammar false positive takes down the gate for the entire repo. Scoping the
+ *  tolerance to a declared ancestor pair — rather than downgrading unparseable files
+ *  to a warning — keeps the completeness guarantee intact for real syntax errors.
+ *
+ *  A tolerated ERROR's children are not visited: tree-sitter reports the same span
+ *  again as a nested ERROR child, and the raw text inside a template literal cannot
+ *  contain an independent error to hide. */
+function isParseable(root, spec) {
+    if (!root.hasError)
+        return true; // covers ERROR and MISSING; no walk needed
+    const scopes = spec.toleratedErrorScopes ?? [];
+    if (scopes.length === 0)
+        return false;
+    let ok = true;
+    const visit = (node) => {
+        if (!ok)
+            return;
+        if (node.type === "ERROR" || node.isMissing) {
+            if (!inToleratedScope(node, scopes))
+                ok = false;
+            return;
+        }
+        for (let i = 0; i < node.childCount; i++)
+            visit(node.child(i));
+    };
+    visit(root);
+    return ok;
+}
+function inToleratedScope(node, scopes) {
+    for (let ancestor = node.parent; ancestor; ancestor = ancestor.parent) {
+        for (const scope of scopes) {
+            if (ancestor.type === scope.node && ancestor.parent?.type === scope.parentIs)
+                return true;
+        }
+    }
+    return false;
 }
 /** Walk up to the nearest node whose type is a definition this language recognizes. */
 function ascendToDef(node, defNodeTypes) {

package/dist/integrations/providers.js

@@ -141,24 +141,44 @@ function writeJson(file, obj) {
     writeFileAtomic(file, JSON.stringify(obj, null, 2) + "\n");
     return file;
 }
+/** Quote one argv token only when it needs quoting. These commands are run by
+ * whatever shell the host assistant uses, which on Windows is PowerShell — and
+ * PowerShell parses a QUOTED first token as a string expression, not a command,
+ * so the old quote-everything form died before the hook ever ran:
+ *
+ *   "npx" "-y" "--package=…" "hunch" "hook" "--provider" "vscode"
+ *   → Unexpected token '"-y"' in expression or statement.
+ *
+ * A token of safe characters is a command/word in PowerShell, cmd AND POSIX sh,
+ * so quote-only-when-needed is the one shape all three accept. Backslash is not
+ * safe bare (sh eats it as an escape), so Windows paths still get quoted — those
+ * appear only in per-machine source-checkout installs, never in the published
+ * npx invocation that `hunch init` writes into tracked config. */
+function shellToken(part) {
+    return /^[A-Za-z0-9_@:=+.,/-]+$/.test(part) ? part : JSON.stringify(part);
+}
 /** Provider hook commands live in tracked config files, so use the structured
  * invocation (the same portable npx package reference as MCP) rather than a
- * machine-local CLI path. JSON quoting is accepted by POSIX shells and keeps
- * paths with spaces intact for source/dev installs. */
+ * machine-local CLI path. */
 function hookCommand(inv, provider) {
-    return [...[inv.command], ...inv.args, "hook", "--provider", provider].map((part) => JSON.stringify(part)).join(" ");
+    return [inv.command, ...inv.args, "hook", "--provider", provider].map(shellToken).join(" ");
 }
 function isHunchProviderHook(entry) {
     const e = entry && typeof entry === "object" ? entry : null;
     const command = typeof e?.command === "string" ? e.command : "";
-    // Anchored to the exact shape hookCommand() writes — JSON-quoted parts ending
-    // in "hook" "--provider" "<name>" — plus a Hunch launcher (the pinned npm
-    // package spec, or a quoted …/index.js|ts path for source installs). The old
-    // unanchored /index\.(js|ts)/ + /\bhook\b/ pair classified FOREIGN entries
-    // like `node ./hook/index.js` as ours and silently deleted them, violating
-    // the leave-every-foreign-hook-in-place contract (con_8460b6770f, issue #41).
-    return /(?:@davesheffer\/hunch|[\\/]index\.(?:js|ts)")/.test(command)
-        && /\s"hook"(?:\s+"--provider"\s+"[a-z]+")?\s*$/.test(command);
+    // Anchored to the shapes hookCommand() writes — a Hunch launcher (the pinned
+    // npm package spec, or a …/index.js|ts path for source installs) plus a tail
+    // of `hook --provider <name>`, tokens quoted or bare. The old unanchored
+    // /index\.(js|ts)/ + /\bhook\b/ pair classified FOREIGN entries like
+    // `node ./hook/index.js` as ours and silently deleted them, violating the
+    // leave-every-foreign-hook-in-place contract (con_8460b6770f, issue #41), so
+    // the bare tail must still carry --provider to match; only the LEGACY
+    // fully-quoted form (written before this quoting fix, and by hunch versions
+    // that predate --provider) may omit it, and its quotes keep it unambiguous.
+    const launcher = /@davesheffer\/hunch|[\\/]index\.(?:js|ts)(?=["\s]|$)/.test(command);
+    const legacyTail = /\s"hook"(?:\s+"--provider"\s+"[a-z]+")?\s*$/.test(command);
+    const tail = /\s"?hook"?\s+"?--provider"?\s+"?[a-z]+"?\s*$/.test(command);
+    return launcher && (legacyTail || tail);
 }
 /** Merge our command entries into a standard `{ hooks: { Event: [] } }` file.
  * We replace only old Hunch commands and leave every foreign hook in place. */

package/dist/mcp/server.js

@@ -33,6 +33,7 @@ import { HUNCH_VERSION } from "../core/version.js";
 import { assertCompleteRepoScan, indexRepo, scanRepo } from "../extractors/indexer.js";
 import { liveForTopic, historyForTopic, rejectedForTopic, captureConflicts } from "../core/topics.js";
 import { pendingEscalations, policyEscalations } from "../core/escalations.js";
+import { scanRecord, publicationWarning, loadVocabulary } from "../core/publication.js";
 import { premiseEscalations } from "../core/premises.js";
 import { issueCaptureToken as issueToken, consumeCaptureToken as consumeToken } from "../core/capturetoken.js";
 import { randomUUID } from "node:crypto";
@@ -53,9 +54,23 @@ const flushNote = (flush, home, mode) => flush === "pushed" ? ` (committed + pus
  *  lands in the committed store publishes on the next push, and an agent writing
  *  strategy/competitive content there is a leak nobody notices until it ships
  *  (2026-08-09: 15 roadmap records caught pre-push only by a release sweep). */
-const publicHomeNote = (home, hasPrivate) => home === "public" && hasPrivate
-    ? "\nℹ Landed in the COMMITTED PUBLIC store (publishes with the repo). For sensitive/strategy content, re-record with private:true — the overlay store."
-    : "";
+/** Repo-local term list, read once per server process. The package ships none;
+ *  `.hunch/publication.json` is how a repo opts in (see src/core/publication.ts). */
+let vocabularyCache = null;
+const publicationVocabulary = (hunchDir) => (vocabularyCache ??= loadVocabulary(hunchDir));
+const publicHomeNote = (home, hasPrivate, record, hunchDir) => {
+    if (home !== "public")
+        return "";
+    // The generic nudge below was already present during BOTH leaks and was ignored,
+    // because a warning that cannot quote the offending text reads as boilerplate.
+    // scanRecord adds the specific line: what matched, in which field.
+    const risk = record === undefined
+        ? ""
+        : publicationWarning(scanRecord(record, { vocabulary: hunchDir ? publicationVocabulary(hunchDir) : [] }));
+    if (!hasPrivate)
+        return risk;
+    return "\nℹ Landed in the COMMITTED PUBLIC store (publishes with the repo). For sensitive/strategy content, re-record with private:true — the overlay store." + risk;
+};
 // Read-side token budgets: every tool result is injected into a Claude Code
 // session, so an uncapped list pollutes the context window. Cap each list to its
 // highest-signal head (records are pre-sorted by severity/confidence) and tell the
@@ -910,7 +925,7 @@ export function buildServerWithRootControl(initialRoot) {
             // record commits+pushes its overlay repo; a public one commits .hunch/ in THIS repo
             // (commit only — it rides the user's next push, never auto-pushing their code branch).
             const flush = flushCapture(store, hunchPaths(root).hunch, !!decision.private, `hunch: capture ${id}`, startupTeamRoute ?? undefined);
-            const flushed = flushNote(flush, home, store.mode) + publicHomeNote(home, store.hasPrivate);
+            const flushed = flushNote(flush, home, store.mode) + publicHomeNote(home, store.hasPrivate, rec, hunchPaths(root).hunch);
             // Capture-session gate (staged deprecation, §9.3): the token was consumed
             // above (it also decides the provenance tier). No token still writes
             // (non-breaking) but lands as agent_recorded with a nudge toward /capture.
@@ -987,7 +1002,7 @@ export function buildServerWithRootControl(initialRoot) {
             if (home === "public" && !store.autoCommit)
                 refreshExistingGrounding(root, store); // overlay rules never render into committed grounding
             const flush = flushCapture(store, hunchPaths(root).hunch, !!input.private, `hunch: capture ${rec.id}`, startupTeamRoute ?? undefined);
-            const flushed = flushNote(flush, home, store.mode) + publicHomeNote(home, store.hasPrivate);
+            const flushed = flushNote(flush, home, store.mode) + publicHomeNote(home, store.hasPrivate, rec, hunchPaths(root).hunch);
             const enforce = rec.severity === "blocking"
                 ? "blocks a DIRECT edit to its scope at strict firmness, and fails a PR whose diff touches that scope (CI guard); blast-radius hits and lower firmness stay advisory"
                 : "flags violating edits and PRs (advisory)";
@@ -1063,7 +1078,7 @@ export function buildServerWithRootControl(initialRoot) {
             store.putCapture("findings", rec, !!finding.private);
             store.reindex();
             const flush = flushCapture(store, hunchPaths(root).hunch, !!finding.private, `hunch: capture ${id}`, startupTeamRoute ?? undefined);
-            const flushed = flushNote(flush, home, store.mode) + publicHomeNote(home, store.hasPrivate);
+            const flushed = flushNote(flush, home, store.mode) + publicHomeNote(home, store.hasPrivate, rec, hunchPaths(root).hunch);
             const where = finding.private
                 ? ` [PRIVATE overlay — not committed to this repo]${flushed}`
                 : home === "private" ? ` [SHARED store — one source of truth for the whole team]${flushed}` : flushed;

package/dist/synthesis/synthesize.js

@@ -201,8 +201,16 @@ export async function syncCommit(store, root, sha, opts = {}) {
         },
         date: meta.date, // the commit date
     };
-    // Route to the record's ONE home: the overlay when asked (--private) or in unified
-    // ("shared") mode; else the public store. Same contract as every other capture path.
+    // Route to the resolved home: the overlay when asked (--private / opts.home) or in
+    // unified ("shared") mode; else the public store.
+    //
+    // DELIBERATELY home-scoped, NOT putCapture. Synthesis keeps the public and private
+    // spines separate: a public failure must never reach through and rewrite a same-id
+    // private record, which putCapture's cross-home collision guard would either throw on
+    // or (via putWhereItLives) silently redirect. test/private-capture.test.ts pins that
+    // behaviour — "public post-promotion rewrite cannot overwrite the private collision".
+    // An earlier comment here claimed the "same contract as every other capture path",
+    // which read as an accidental bypass and invited exactly that wrong fix.
     if (home === "private")
         store.putPrivate("decisions", decision);
     else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.12.1",
+  "version": "1.12.2",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://hunch-pi.vercel.app",
-  "version": "1.12.1",
+  "version": "1.12.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.12.1",
+      "version": "1.12.2",
       "runtimeHint": "npx",
       "packageArguments": [
         {