@davesheffer/hunch 1.20.1 → 1.20.2

package/README.md

@@ -171,7 +171,7 @@ repository, separate from the code repository. Hunch does not host it. Create a
 that every teammate can access, install Hunch on team machines and CI, then have one maintainer run:
 
 ```bash
-npm i -g @davesheffer/hunch@1.20.1
+npm i -g @davesheffer/hunch@1.20.2
 hunch shared --repo git@github.com:acme/project-hunch-memory.git
 git add .gitignore .hunch/team.json
 git commit -m "chore: connect shared Hunch memory"
@@ -186,7 +186,7 @@ printed by Hunch. Omit `--migrate` for a new setup.
 After the pointer commit lands, teammates need Hunch installed and Git access to the memory repo:
 
 ```bash
-npm i -g @davesheffer/hunch@1.20.1
+npm i -g @davesheffer/hunch@1.20.2
 git pull
 hunch init
 hunch doctor

package/dist/extractors/git.js

@@ -592,12 +592,27 @@ export function commitAndPushHunch(hunchDir, message, opts) {
         else {
             run(["add", "--", "."]);
         }
-        // SAFETY BACKSTOP (critical — bug_overlay_clobber): a memory sync is PURELY ADDITIVE small
-        // JSON. If the staged set contains a DELETION, rename, or any non-.json file, hunchDir is NOT
-        // a clean overlay store — most dangerously, the overlay was never its own git repo so `git -C`
-        // walked UP to the PROJECT repo. Committing/pushing there would overwrite/delete the user's
-        // code (we shipped exactly this). Refuse hard: unstage and bail without committing or pushing.
-        const staged = stagedMemoryPaths(hunchDir, env);
+        // Snapshot replacement can remove stale per-record JSON. Only a push-capable
+        // private/shared store may stage those deletions: the publication boundary
+        // above has already proved that it is a standalone repository distinct from
+        // the protected code repository. `-u` is still scoped to this exact Hunch
+        // subtree, and the staged-set guard below admits only contained JSON deletes.
+        // Public stores retain the older no-deletion rule because they live inside
+        // the user's code repository.
+        if (opts.push !== false && !run([
+            "-c", `core.attributesFile=${gitNullDevice()}`,
+            "-c", "core.autocrlf=false",
+            "add", "-u", "--", ".",
+        ])) {
+            run(["reset", "-q", "--", "."]);
+            return null;
+        }
+        // SAFETY BACKSTOP (critical — bug_overlay_clobber): only contained JSON
+        // memory bytes may be committed. Renames, copies, type changes, local.json,
+        // derived artifacts and every path outside this exact Hunch subtree remain
+        // fail-closed. A deletion is admitted only for the already-proven standalone
+        // private/shared repository above; it can never delete protected source.
+        const staged = stagedMemoryPaths(hunchDir, env, opts.push !== false);
         if (staged === null) {
             try {
                 execFileSync("git", ["-C", hunchDir, "reset", "-q", "--", "."], { stdio: "ignore", env });
@@ -608,7 +623,7 @@ export function commitAndPushHunch(hunchDir, message, opts) {
             // stays on disk and the next flush's `git add .` sweeps it up. The overlay path
             // stays loud: there it signals the escaped-to-project-repo misconfiguration.
             if (opts.push !== false) {
-                console.error(`hunch: refusing to auto-commit memory at "${hunchDir}" — the staged change includes deletions or non-memory files, so this is not a clean overlay repo. Nothing was committed or pushed. (Use \`hunch shared --repo <url>\` so the overlay is its OWN git repo.)`);
+                console.error(`hunch: refusing to auto-commit memory at "${hunchDir}" — the staged change includes an unsafe deletion or non-memory file, so this is not a clean overlay repo. Nothing was committed or pushed. (Use \`hunch shared --repo <url>\` so the overlay is its OWN git repo.)`);
             }
             return null;
         }
@@ -744,7 +759,7 @@ export function headFileContent(root, rel) {
         return null;
     }
 }
-function stagedMemoryPaths(hunchDir, env) {
+function stagedMemoryPaths(hunchDir, env, allowMemoryDeletions = false) {
     let out = "";
     let prefix = "";
     try {
@@ -755,8 +770,11 @@ function stagedMemoryPaths(hunchDir, env) {
     }
     if (!prefix)
         return null; // a Hunch layout is a scoped subdirectory, never the whole repository
+    // Snapshot ID churn is semantically one delete plus one add. Disable Git's
+    // heuristic rename presentation so the exact paths remain independently
+    // auditable against the contained-memory rules below.
     try {
-        out = execFileSync("git", ["-C", hunchDir, "diff", "--cached", "--no-ext-diff", "--no-textconv", "--name-status"], { encoding: "utf8", env });
+        out = execFileSync("git", ["-C", hunchDir, "diff", "--cached", "--no-ext-diff", "--no-textconv", "--no-renames", "--name-status"], { encoding: "utf8", env });
     }
     catch {
         return null;
@@ -772,8 +790,8 @@ function stagedMemoryPaths(hunchDir, env) {
         const path = (parts[parts.length - 1] ?? "").trim();
         if (path.includes(".hunch-commit.lock"))
             continue; // transient lock dir, never a record
-        if (!/^[AM]$/.test(status))
-            return null; // only Add / Modify — any D/R/C/T → not a memory sync
+        if (!/^[AMD]$/.test(status) || (status === "D" && !allowMemoryDeletions))
+            return null;
         const normalizedPath = path.replace(/\\/g, "/");
         if (!normalizedPath.startsWith(prefix))
             return null; // never bless another staged JSON file

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.20.1",
+  "version": "1.20.2",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://hunch-pi.vercel.app",
-  "version": "1.20.1",
+  "version": "1.20.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.20.1",
+      "version": "1.20.2",
       "runtimeHint": "npx",
       "packageArguments": [
         {