@davesheffer/hunch 1.17.0 → 1.18.0

package/dist/extractors/parse.js

@@ -15,10 +15,27 @@ function bundleFor(spec) {
     return b;
 }
 const STR_QUOTES = /^['"`]|['"`]$/g;
+/** Cap on a stored symbol's bodyText — large enough for review context, small
+ *  enough that a huge function/file doesn't bloat every JSON symbol record. */
+export const MAX_BODY_TEXT_CHARS = 4000;
 export function parseSource(file, source) {
     const spec = languageFor(file);
     if (!spec)
         return null;
+    // Templated text (Helm chart / Jinja CI config) isn't {spec.id} yet — a real
+    // grammar correctly reports ERROR nodes for the delimiters. Still run the
+    // parse below (a well-formed anchor elsewhere in the file still contributes
+    // a real symbol, same as any other YAML file) — just don't let those
+    // expected errors fail-close the whole-repo scan on content that was never
+    // meant to stand alone (#33). Heavy top-level templating can break error
+    // recovery badly enough that even the whole-file root node never forms
+    // (root.type becomes "ERROR", not "stream") — the fallback-symbol synthesis
+    // below covers that case so the file doesn't vanish from the component graph.
+    // String.prototype.search ignores lastIndex (unlike RegExp.test with a /g or
+    // /y flag), so a future templatingMarkers entry can't introduce cross-call
+    // statefulness here even if it forgets to keep its pattern flag-free.
+    const templated = (spec.alwaysTemplatedExtensions?.some((ext) => file.endsWith(ext)) ?? false)
+        || (spec.templatingMarkers?.some((marker) => source.search(marker) !== -1) ?? false);
     const { parser, query } = bundleFor(spec);
     // The native binding caps its scratch buffer at 32 KB unless bufferSize is
     // given — without this, any source >= 32768 bytes throws "Invalid argument"
@@ -72,17 +89,34 @@ export function parseSource(file, source) {
         }
     }
     for (const { kind, def, name } of pendingDefs.values()) {
-        if (!name)
+        const resolvedName = name ?? spec.fallbackDefName?.(file);
+        if (!resolvedName)
             continue;
         const loc = def.endPosition.row - def.startPosition.row + 1;
         symbols.push({
-            name, kind,
+            name: resolvedName, kind,
             startByte: def.startIndex, endByte: def.endIndex, loc,
-            bodyText: def.text.slice(0, 4000),
+            bodyText: def.text.slice(0, MAX_BODY_TEXT_CHARS),
+        });
+    }
+    // Every other successfully-parsed YAML file gets at least a file-root symbol
+    // (fallbackDefName). If templating broke error recovery badly enough that
+    // the doc.def capture never fired, synthesize the same fallback here rather
+    // than let the file silently drop out of the component graph. Push it before
+    // the sort below — parse()'s callers (indexer.ts) rely on symbols staying in
+    // start-byte order.
+    if (templated && spec.fallbackDefName && !symbols.some((s) => s.kind === "file")) {
+        symbols.push({
+            name: spec.fallbackDefName(file),
+            kind: "file",
+            startByte: 0,
+            endByte: source.length,
+            loc: source.split("\n").length,
+            bodyText: source.slice(0, MAX_BODY_TEXT_CHARS),
         });
     }
     symbols.sort((a, b) => a.startByte - b.startByte);
-    return { symbols, imports, calls, parseable: isParseable(tree.rootNode, spec) };
+    return { symbols, imports, calls, parseable: templated || isParseable(tree.rootNode, spec) };
 }
 /** True when every ERROR/MISSING node in the tree sits in an ancestor shape this
  *  language declares as a known grammar limitation (LanguageSpec.toleratedErrorScopes).
@@ -137,25 +171,35 @@ function ascendToDef(node, defNodeTypes) {
     return null;
 }
 /** Map each call site to the innermost symbol whose byte-range contains it.
- *  Keyed by the symbol's `startByte` (a stable per-symbol identity within the
- *  file) rather than its name, so two same-named symbols in one file don't merge
- *  their call sets. The value maps callee name -> `memberOnly` (true iff every
- *  occurrence was a `x.foo()` member call, never a direct `foo()`), so the
- *  indexer can resolve member calls conservatively. */
+ *  Keyed by the symbol's position (index) in `parsed.symbols` — NOT its
+ *  startByte, which is not a reliable per-symbol identity: a language whose
+ *  extractor merges a synthetic whole-file symbol with independently-derived
+ *  symbols (e.g. YAML's fallback-root synthetic symbol alongside Helm's
+ *  regex-derived `define` blocks) can produce two distinct symbols that both
+ *  start at byte 0. Indexing by array position is unique by construction,
+ *  regardless of byte overlap — the caller must consume the exact same
+ *  `parsed.symbols` array (or an equivalently-ordered copy) to look up a
+ *  symbol by the index this function returns. The value maps callee name ->
+ *  `memberOnly` (true iff every occurrence was a `x.foo()` member call, never
+ *  a direct `foo()`), so the indexer can resolve member calls conservatively. */
 export function attributeCalls(parsed) {
     const out = new Map();
     for (const call of parsed.calls) {
         let best = null;
-        for (const s of parsed.symbols) {
+        let bestIndex = -1;
+        for (let i = 0; i < parsed.symbols.length; i++) {
+            const s = parsed.symbols[i];
             if (call.atByte >= s.startByte && call.atByte < s.endByte) {
-                if (!best || s.endByte - s.startByte < best.endByte - best.startByte)
+                if (!best || s.endByte - s.startByte < best.endByte - best.startByte) {
                     best = s;
+                    bestIndex = i;
+                }
             }
         }
         if (best && best.name !== call.callee) {
-            if (!out.has(best.startByte))
-                out.set(best.startByte, new Map());
-            const m = out.get(best.startByte);
+            if (!out.has(bestIndex))
+                out.set(bestIndex, new Map());
+            const m = out.get(bestIndex);
             const prev = m.get(call.callee);
             m.set(call.callee, prev === undefined ? call.member : prev && call.member);
         }

package/dist/mcp/server.js

@@ -73,10 +73,21 @@ const flushNote = (flush, home, mode) => flush === "pushed" ? ` (committed + pus
  *  lands in the committed store publishes on the next push, and an agent writing
  *  strategy/competitive content there is a leak nobody notices until it ships
  *  (2026-08-09: 15 roadmap records caught pre-push only by a release sweep). */
-/** Repo-local term list, read once per server process. The package ships none;
- *  `.hunch/publication.json` is how a repo opts in (see src/core/publication.ts). */
-let vocabularyCache = null;
-const publicationVocabulary = (hunchDir) => (vocabularyCache ??= loadVocabulary(hunchDir));
+/** Repo-local term list, read once per STORE. The package ships none;
+ *  `.hunch/publication.json` is how a repo opts in (see src/core/publication.ts).
+ *  Keyed by hunchDir: the previous scalar memoized the FIRST store's vocabulary
+ *  and served it to every store in the process, so a multi-store consumer would
+ *  leak-scan project B's records against project A's terms — a wrong answer in
+ *  the exact subsystem whose job is catching leaks (GATE-P1-UPSTREAM.md). */
+const vocabularyCache = new Map();
+export const publicationVocabulary = (hunchDir) => {
+    let vocab = vocabularyCache.get(hunchDir);
+    if (!vocab) {
+        vocab = loadVocabulary(hunchDir);
+        vocabularyCache.set(hunchDir, vocab);
+    }
+    return vocab;
+};
 const publicHomeNote = (home, hasPrivate, record, hunchDir) => {
     if (home !== "public")
         return "";
@@ -280,6 +291,9 @@ function prepareRoot(root, explicitOverlay, requireIndex) {
     ensureTeamOverlay(root);
     const store = new HunchStore(hunchPaths(root));
     try {
+        const overlayWarning = store.overlayResolutionWarning(explicitOverlay && existsSync(teamFile));
+        if (overlayWarning)
+            console.error(`[hunch-mcp] ⚠ ${overlayWarning}`);
         if (teamAdvertised && (store.mode !== "shared"
             || !store.privateDir
             || !existsSync(store.privateDir)

package/dist/store/hunchStore.js

@@ -55,6 +55,13 @@ export class HunchStore {
     /** The resolved private-overlay hunch dir (from env or .hunch/local.json), or undefined
      *  when no overlay is configured. Surfaced so `hunch doctor` reflects the true state. */
     privateDir;
+    /** How privateDir was selected. Multi-store consumers can use this instead of
+     *  inferring process-global routing from process.env. */
+    overlaySource;
+    /** Present only when HUNCH_PRIVATE_DIR redirects this store away from the
+     *  repo/worktree-local pointer. Precedence is compatibility-sensitive and stays
+     *  env-first; making the redirection queryable removes the silent footgun. */
+    overlayOverride;
     /** Whether captures auto-commit the store they land in — ON by default in EVERY mode;
      *  `--no-auto-commit` (hunch init/private/shared) persists `autoCommit: false` in
      *  local.json to opt out. Read by the MCP write tools and `hunch sync`. */
@@ -84,7 +91,36 @@ export class HunchStore {
         // local config (.hunch/local.json) so `hunch private` enables it with NO env var, and
         // the MCP server / hook pick it up automatically. Relative paths resolve from root.
         const local = this.localConfig();
-        const priv = process.env.HUNCH_PRIVATE_DIR?.trim() || local.privateDir;
+        const environmentDir = process.env.HUNCH_PRIVATE_DIR?.trim();
+        const configuredDir = local.privateDir
+            ? resolve(this.paths.root, local.privateDir)
+            : undefined;
+        const resolvedEnvironmentDir = environmentDir
+            ? resolve(this.paths.root, environmentDir)
+            : undefined;
+        const priv = resolvedEnvironmentDir || configuredDir;
+        this.overlaySource = resolvedEnvironmentDir
+            ? "environment"
+            : configuredDir
+                ? "local-config"
+                : null;
+        if (resolvedEnvironmentDir && configuredDir) {
+            const canonical = (path) => {
+                try {
+                    return realpathSync(path);
+                }
+                catch {
+                    return resolve(path);
+                }
+            };
+            const comparable = (path) => process.platform === "win32" ? canonical(path).toLowerCase() : canonical(path);
+            if (comparable(resolvedEnvironmentDir) !== comparable(configuredDir)) {
+                this.overlayOverride = {
+                    configuredDir: canonical(configuredDir),
+                    environmentDir: canonical(resolvedEnvironmentDir),
+                };
+            }
+        }
         if (priv) {
             const candidate = resolve(this.paths.root, priv);
             const canonical = (path) => { try {
@@ -118,6 +154,21 @@ export class HunchStore {
         this.mode = priv ? (local.mode ?? "private") : "public";
         this.unified = this.mode === "shared" && !!this.privateJson;
     }
+    /** Human-facing warning for the compatibility-preserving env-first resolution.
+     *  Callers decide where it is safe to emit (CLI/MCP stderr, doctor output); the
+     *  store constructor stays side-effect-free for hooks and embedded consumers. */
+    overlayResolutionWarning(teamConfigBypassed = false) {
+        if (this.overlayOverride) {
+            const effect = this.mode === "shared"
+                ? "all memory reads and captures in this process use the environment path"
+                : "private-overlay reads and private captures in this process use the environment path; public captures remain in the repo";
+            return `HUNCH_PRIVATE_DIR redirects this repo from its configured ${this.mode} memory at ${this.overlayOverride.configuredDir} to ${this.overlayOverride.environmentDir}; ${effect} (routing mode remains ${this.mode}). Unset HUNCH_PRIVATE_DIR to use the configured store.`;
+        }
+        if (this.overlaySource === "environment" && teamConfigBypassed && this.privateDir) {
+            return `HUNCH_PRIVATE_DIR bypasses .hunch/team.json and selects ${this.privateDir} in ${this.mode} mode; team-store auto-discovery is disabled for this process. Unset HUNCH_PRIVATE_DIR to use the advertised team store.`;
+        }
+        return null;
+    }
     /** Where a capture belongs: an explicit private:true always goes to the overlay
      *  (putPrivate throws rather than silently landing public when none is configured);
      *  otherwise the overlay in unified ("shared") mode, else the public store. ONE home
@@ -313,11 +364,35 @@ export class HunchStore {
                 fts(c.id, "components", c.name, `${c.responsibility} ${c.paths.join(" ")}`);
             }
             counts.components = comps.length;
+            const resources = this.recs("resources");
+            const insResource = db.prepare(`INSERT INTO resources VALUES (@id,@schema,@kind,@name,@scope,@locator,@lifecycle,@criticality,@contract_version,@currentness,@metadata,@ps,@pc,@pe,@created_at,@updated_at)`);
+            for (const resource of resources) {
+                insResource.run({
+                    id: resource.id, schema: resource.schema, kind: resource.kind, name: resource.name,
+                    scope: JSON.stringify(resource.scope), locator: resource.locator, lifecycle: resource.lifecycle,
+                    criticality: resource.criticality ?? null, contract_version: resource.contract_version ?? null,
+                    currentness: JSON.stringify(resource.currentness), metadata: JSON.stringify(resource.metadata),
+                    ps: resource.provenance.source, pc: resource.provenance.confidence,
+                    pe: JSON.stringify(resource.provenance.evidence), created_at: resource.created_at, updated_at: resource.updated_at,
+                });
+                fts(resource.id, "resources", resource.name, `${resource.kind} ${resource.scope.join(" ")} ${resource.locator ?? ""} ${resource.lifecycle} ${resource.contract_version ?? ""}`);
+            }
+            counts.resources = resources.length;
             const edges = this.recs("edges");
             const insEdge = db.prepare(`INSERT INTO edges VALUES (@id,@from,@to,@type,@reason,@strength,@ps,@pc,@pe)`);
+            const insResourceRelationship = db.prepare(`INSERT INTO resource_relationships VALUES (@id,@schema,@from,@to,@type,@reason,@strength,@currentness,@environment,@criticality,@contract_version,@metadata,@ps,@pc,@pe)`);
             for (const e of edges) {
                 insEdge.run({ id: e.id, from: e.from, to: e.to, type: e.type, reason: e.reason, strength: e.strength,
                     ps: e.provenance.source, pc: e.provenance.confidence, pe: JSON.stringify(e.provenance.evidence) });
+                if (e.schema === "hunch.resource-relationship/1") {
+                    insResourceRelationship.run({
+                        id: e.id, schema: e.schema, from: e.from, to: e.to, type: e.type, reason: e.reason,
+                        strength: e.strength, currentness: JSON.stringify(e.currentness), environment: e.environment,
+                        criticality: e.criticality ?? null, contract_version: e.contract_version ?? null,
+                        metadata: JSON.stringify(e.metadata), ps: e.provenance.source, pc: e.provenance.confidence,
+                        pe: JSON.stringify(e.provenance.evidence),
+                    });
+                }
             }
             counts.edges = edges.length;
             const syms = this.recs("symbols");
@@ -1324,6 +1399,7 @@ export class HunchStore {
         };
         json.put("decisions", closed);
         const edge = {
+            schema: "hunch.edge/1",
             id: edgeId(by.id, oldId, "supersedes"),
             from: by.id,
             to: oldId,
@@ -1331,6 +1407,8 @@ export class HunchStore {
             reason: `${by.id} supersedes ${oldId}`,
             strength: 1,
             provenance: { source: "derived", confidence: 1, evidence: [by.id, oldId] },
+            environment: null,
+            metadata: {},
         };
         json.put("edges", edge);
         return closed;

package/dist/store/jsonStore.js

@@ -12,7 +12,14 @@ import { writeFileAtomic } from "../core/io.js";
  *  index.json array — there can be thousands, and one file per edge would create
  *  enormous git noise. Curated, low-volume entities (components, decisions, bugs,
  *  constraints) are one file per record so they're cleanly reviewable in PRs. */
-const SINGLE_FILE = { symbols: "index.json", edges: "index.json" };
+const SINGLE_FILE = {
+    symbols: "index.json",
+    edges: "index.json",
+    // Resource ids remain readable kind-qualified identities (and may contain '/'),
+    // so the canonical array avoids lossy filename encoding while keeping Git diffs
+    // deterministic through id sorting.
+    resources: "index.json",
+};
 const encode = (v) => JSON.stringify(v, null, 2) + "\n";
 // Sleep primitive for the single-file RMW lock's bounded spin (issue #35);
 // same idiom as core/io.ts's rename backoff.

package/dist/store/schema.js

@@ -29,6 +29,17 @@ CREATE TABLE IF NOT EXISTS components (
   created_at TEXT, updated_at TEXT
 );
 
+CREATE TABLE IF NOT EXISTS resources (
+  id TEXT PRIMARY KEY,
+  schema TEXT, kind TEXT, name TEXT, scope TEXT, locator TEXT,
+  lifecycle TEXT, criticality TEXT, contract_version TEXT,
+  currentness TEXT, metadata TEXT,
+  prov_source TEXT, prov_confidence REAL, prov_evidence TEXT,
+  created_at TEXT, updated_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_resources_kind ON resources(kind);
+CREATE INDEX IF NOT EXISTS idx_resources_lifecycle ON resources(lifecycle);
+
 CREATE TABLE IF NOT EXISTS edges (
   id TEXT PRIMARY KEY,
   "from" TEXT, "to" TEXT, type TEXT, reason TEXT, strength REAL,
@@ -38,6 +49,18 @@ CREATE INDEX IF NOT EXISTS idx_edges_from ON edges("from");
 CREATE INDEX IF NOT EXISTS idx_edges_to ON edges("to");
 CREATE INDEX IF NOT EXISTS idx_edges_type ON edges(type);
 
+-- A rebuildable projection over the subset of the existing edge graph carrying
+-- the resource-relationship contract. JSON edges remain the one authority.
+CREATE TABLE IF NOT EXISTS resource_relationships (
+  id TEXT PRIMARY KEY,
+  schema TEXT, "from" TEXT, "to" TEXT, type TEXT, reason TEXT, strength REAL,
+  currentness TEXT, environment TEXT, criticality TEXT, contract_version TEXT,
+  metadata TEXT, prov_source TEXT, prov_confidence REAL, prov_evidence TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_resource_relationships_from ON resource_relationships("from");
+CREATE INDEX IF NOT EXISTS idx_resource_relationships_to ON resource_relationships("to");
+CREATE INDEX IF NOT EXISTS idx_resource_relationships_type ON resource_relationships(type);
+
 CREATE TABLE IF NOT EXISTS symbols (
   id TEXT PRIMARY KEY,
   file TEXT, name TEXT, kind TEXT, signature_hash TEXT,
@@ -89,7 +112,7 @@ CREATE TABLE IF NOT EXISTS embeddings (
 export const FTS_SEARCH_SCHEMA_SQL = /* sql */ `
 CREATE VIRTUAL TABLE IF NOT EXISTS search USING fts5(
   ref UNINDEXED,   -- entity id
-  kind UNINDEXED,  -- components | edges | symbols | decisions | bugs | constraints | runbooks | findings
+  kind UNINDEXED,  -- components | resources | edges | symbols | decisions | bugs | constraints | runbooks | findings
   title,
   body,
   tokenize = 'porter unicode61'
@@ -110,7 +133,7 @@ CREATE INDEX IF NOT EXISTS idx_search_kind ON search(kind);
 /** Drop derived data (used before a full reindex). NOTE: embeddings is omitted on
  *  purpose — see the embeddings table comment above. */
 export const RESET_SQL = /* sql */ `
-DELETE FROM components; DELETE FROM edges; DELETE FROM symbols;
+DELETE FROM components; DELETE FROM resources; DELETE FROM edges; DELETE FROM resource_relationships; DELETE FROM symbols;
 DELETE FROM decisions; DELETE FROM bugs; DELETE FROM constraints;
 DELETE FROM search;
 `;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
@@ -71,11 +71,12 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@tree-sitter-grammars/tree-sitter-yaml": "^0.6.1",
     "commander": "^15.0.0",
     "tree-sitter": "0.21.1",
     "tree-sitter-go": "^0.23.4",
-    "tree-sitter-python": "^0.23.2",
+    "tree-sitter-python": "0.23.4",
     "tree-sitter-typescript": "^0.23.2",
     "zod": "^4.4.3"
   },

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://hunch-pi.vercel.app",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.17.0",
+      "version": "1.18.0",
       "runtimeHint": "npx",
       "packageArguments": [
         {