@davesheffer/hunch 1.12.1 → 1.13.0

package/dist/store/hunchStore.js

@@ -19,7 +19,7 @@ import { RESET_SQL, embedHash } from "./schema.js";
 import { selectEmbedder } from "./embedder.js";
 import { JsonStore } from "./jsonStore.js";
 import { gitCommonDir, gitWorktreeRoot, sameGitPublication } from "../extractors/git.js";
-import { pathMatchesGlob } from "../core/glob.js";
+import { pathMatchesGlob, pathsRelated } from "../core/glob.js";
 import { currentForTopic, isInForce } from "../core/topics.js";
 import { edgeId } from "../core/ids.js";
 import { isStrictBlocker, isVetoBlocker } from "../core/strictgate.js";
@@ -819,14 +819,14 @@ export class HunchStore {
         const symbols = this.recs("symbols");
         const components = this.recs("components");
         const asOf = opts.asOf;
-        // pathRelated, not bare endsWith: "scenario.ts".endsWith("io.ts") is true,
+        // pathsRelated, not bare endsWith: "scenario.ts".endsWith("io.ts") is true,
         // so an unanchored suffix pulled unrelated files' records into why()/the
         // pre-edit grounding block (issue #32). Segment-anchored matching only.
-        const matchedSymbols = symbols.filter((s) => s.file === target || s.name === target || s.id === target || pathRelated(s.file, target));
+        const matchedSymbols = symbols.filter((s) => s.file === target || s.name === target || s.id === target || pathsRelated(s.file, target));
         const symIds = new Set(matchedSymbols.map((s) => s.id));
         const fileSet = new Set(matchedSymbols.map((s) => s.file));
         const isPath = target.includes("/") || target.includes(".");
-        const fileMatch = (files) => files.some((f) => f === target || (isPath && pathRelated(f, target)) || fileSet.has(f));
+        const fileMatch = (files) => files.some((f) => f === target || (isPath && pathsRelated(f, target)) || fileSet.has(f));
         return {
             target,
             decisions: decisions.filter((d) => (fileMatch(d.related_files) || d.related_components.some((c) => components.find((x) => x.id === c && fileMatch(x.paths))))
@@ -1057,7 +1057,7 @@ export class HunchStore {
         const live = (f) => f.triage === "open" || f.triage === "accepted-risk" || f.triage === "scheduled";
         return this.recs("findings")
             .filter(live)
-            .filter((f) => f.affected_files.some((af) => pathMatchesGlob(t, af) || pathMatchesGlob(af, t) || pathRelated(toPosixTarget(af), t))
+            .filter((f) => f.affected_files.some((af) => pathMatchesGlob(t, af) || pathMatchesGlob(af, t) || pathsRelated(toPosixTarget(af), t))
             || f.affected_symbols.some((s) => s === scope))
             .sort((a, b) => (SEV_FINDING[b.severity] ?? 0) - (SEV_FINDING[a.severity] ?? 0) || a.id.localeCompare(b.id));
     }
@@ -1294,7 +1294,7 @@ export class HunchStore {
         const addedDeps = new Set(added.deps);
         if (!addedSyms.size && !addedDeps.size)
             return [];
-        const fileRelevant = (related) => related.some((f) => files.some((x) => pathRelated(x, f)));
+        const fileRelevant = (related) => related.some((f) => files.some((x) => pathsRelated(x, f)));
         const decisions = this.recs("decisions");
         // decisions tied to an active blocking constraint via source_decision
         const blockingDec = new Set(this.recs("constraints")
@@ -1416,7 +1416,7 @@ export class HunchStore {
                 continue;
             if (!d.retired.symbols.length && !d.retired.deps.length)
                 continue;
-            if (!d.related_files.some((f) => pathRelated(f, file)))
+            if (!d.related_files.some((f) => pathsRelated(f, file)))
                 continue;
             out.push({ decision: d.id, title: d.title, symbols: d.retired.symbols, deps: d.retired.deps });
         }
@@ -1558,9 +1558,6 @@ const SEV_FINDING = { critical: 4, high: 3, medium: 2, low: 1 };
 /** Do two repo paths refer to the same file? Exact match, or one is a trailing
  *  path-SEGMENT suffix of the other (e.g. "x.ts" vs "src/x.ts") — anchored at a
  *  "/" boundary so "re.ts" never matches "store.ts" (the bare-endsWith hazard). */
-function pathRelated(a, b) {
-    return a === b || a.endsWith("/" + b) || b.endsWith("/" + a);
-}
 function inWindow(valid_from, valid_to, asOf) {
     if (!asOf)
         return true;

package/dist/synthesis/synthesize.js

@@ -201,8 +201,16 @@ export async function syncCommit(store, root, sha, opts = {}) {
         },
         date: meta.date, // the commit date
     };
-    // Route to the record's ONE home: the overlay when asked (--private) or in unified
-    // ("shared") mode; else the public store. Same contract as every other capture path.
+    // Route to the resolved home: the overlay when asked (--private / opts.home) or in
+    // unified ("shared") mode; else the public store.
+    //
+    // DELIBERATELY home-scoped, NOT putCapture. Synthesis keeps the public and private
+    // spines separate: a public failure must never reach through and rewrite a same-id
+    // private record, which putCapture's cross-home collision guard would either throw on
+    // or (via putWhereItLives) silently redirect. test/private-capture.test.ts pins that
+    // behaviour — "public post-promotion rewrite cannot overwrite the private collision".
+    // An earlier comment here claimed the "same contract as every other capture path",
+    // which read as an accidental bypass and invited exactly that wrong fix.
     if (home === "private")
         store.putPrivate("decisions", decision);
     else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.12.1",
+  "version": "1.13.0",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://hunch-pi.vercel.app",
-  "version": "1.12.1",
+  "version": "1.13.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.12.1",
+      "version": "1.13.0",
       "runtimeHint": "npx",
       "packageArguments": [
         {