@davesheffer/hunch 1.21.0 → 1.21.1

package/README.md

@@ -174,7 +174,7 @@ repository, separate from the code repository. Hunch does not host it. Create a
 that every teammate can access, install Hunch on team machines and CI, then have one maintainer run:
 
 ```bash
-npm i -g @davesheffer/hunch@1.21.0
+npm i -g @davesheffer/hunch@1.21.1
 hunch shared --repo git@github.com:acme/project-hunch-memory.git
 git add .gitignore .hunch/team.json
 git commit -m "chore: connect shared Hunch memory"
@@ -189,7 +189,7 @@ printed by Hunch. Omit `--migrate` for a new setup.
 After the pointer commit lands, teammates need Hunch installed and Git access to the memory repo:
 
 ```bash
-npm i -g @davesheffer/hunch@1.21.0
+npm i -g @davesheffer/hunch@1.21.1
 git pull
 hunch init
 hunch doctor

package/dist/cli/index.js

@@ -309,7 +309,7 @@ program
     // Claude's native hooks run alongside provider-specific hooks below. Every
     // adapter reads firmness at run time, so changing it needs no config rewrite.
     if (opts.agentHooks !== false) {
-        const a = installClaudeHooks(root, `${inv.shell} hook`);
+        const a = installClaudeHooks(root, `${inv.agentHookShell} hook`);
         console.log(`  ✓ Claude Code agent hooks ${a.action} (firmness: ${firmness} — change with \`hunch firmness <level>\`)`);
     }
     // Multi-assistant compatibility: MCP + grounding + lifecycle adapters share

package/dist/cli/invocation.js

@@ -16,6 +16,13 @@ export function dim(s) {
 export function publishedMcpInvocation() {
     return { command: "npx", args: ["-y", `--package=${HUNCH_NPX_PACKAGE_SPEC}`, "hunch"] };
 }
+/** Render a structured invocation for the host shell. Safe tokens stay bare so
+ *  PowerShell can execute the first token; paths and other unsafe tokens use
+ *  JSON string quoting, which is accepted by PowerShell, cmd, and POSIX sh. */
+export function shellInvocation(inv) {
+    const token = (part) => /^[A-Za-z0-9_@:=+.,/-]+$/.test(part) ? part : JSON.stringify(part);
+    return [inv.command, ...inv.args].map(token).join(" ");
+}
 /** The doctor command's synthesis-status line(s) for a resolved provider.
  *  Exported for testing — the previous version (a bare provider-name switch,
  *  before the resolveSynthesisProvider preference system existed) had zero
@@ -77,23 +84,29 @@ export function resolveInvocation() {
     // absolute-node invocation below.
     const installed = !isDev && entry.replace(/\\/g, "/").includes("/node_modules/");
     if (installed) {
+        const mcp = publishedMcpInvocation();
         return {
             shell: `${q(process.execPath)} ${q(entry)}`,
-            mcp: publishedMcpInvocation(),
+            agentHookShell: shellInvocation(mcp),
+            mcp,
         };
     }
     if (isDev) {
+        const mcp = { command: "npx", args: ["tsx", entry] };
         return {
             shell: `npx tsx ${q(entry)}`,
-            mcp: { command: "npx", args: ["tsx", entry] },
+            agentHookShell: shellInvocation(mcp),
+            mcp,
         };
     }
     // Source-checkout dist run (e.g. `node dist/cli/index.js`, npm link): inherently
     // per-machine. Use the absolute node binary (process.execPath) rather than a bare
     // `node`, so the hook works even when nvm's `node` isn't on the hook's PATH.
+    const mcp = { command: process.execPath, args: [entry] };
     return {
         shell: `${q(process.execPath)} ${q(entry)}`,
-        mcp: { command: process.execPath, args: [entry] },
+        agentHookShell: shellInvocation(mcp),
+        mcp,
     };
 }
 //# sourceMappingURL=invocation.js.map

package/dist/integrations/scaffold.js

@@ -101,14 +101,25 @@ Reconcile decision-grounding drift for **$ARGUMENTS** (or the whole repo).
 3. Only if I explicitly say "the DECISION is stale, not the doc" (Heal B): run /capture to record a superseding decision, then return to step 2 — the prose re-derives from the new decision as a separate confirm.
 4. Report: healed (Heal A), superseded (Heal B), skipped. Never touch the graph except via an explicit Heal B capture.
 `;
-/** A settings.json hook entry is Hunch's if any of its commands ends with the
- *  Hunch CLI entry + the `hook` subcommand (e.g. `…/index.js hook`). Matching the
- *  command TAIL — not the absolute path — makes re-init idempotent AND survives a
- *  repo-folder rename (the path before index.js changes; the tail does not). The
- *  leading path separator (`/` or `\`) requires `index` to be a full path segment,
- *  so a foreign tool's `…/myindex.js hook` isn't mistaken for ours and clobbered. */
+/** A settings.json hook entry is Hunch's if any of its commands is either the
+ *  native/source CLI entry (`…/index.js hook`) or the exact published-package
+ *  launcher written by older Hunch versions (`npx --package=…@davesheffer/hunch…
+ *  hunch hook`). Matching both generations makes an upgrade idempotent instead
+ *  of leaving the portable old hook alongside the new native invocation. The
+ *  source form still requires `index` to be a full path segment, and the npx form
+ *  requires both the scoped package and the `hunch hook` tail, so foreign hooks
+ *  are preserved. */
 function isHunchHook(entry) {
-    return !!entry.hooks?.some((h) => typeof h.command === "string" && /[\\/]index\.(js|ts)"?\s+hook\s*$/.test(h.command));
+    return !!entry.hooks?.some((h) => {
+        if (typeof h.command !== "string")
+            return false;
+        const command = h.command;
+        const nativeOrSource = /[\\/]index\.(js|ts)"?\s+hook\s*$/.test(command);
+        const publishedNpx = /^\s*"?npx(?:\.cmd)?"?\s+/i.test(command)
+            && /--package=(?:hunch-exact@npm:)?@davesheffer\/hunch(?:@[^"\s]+)?/.test(command)
+            && /\s"?hunch"?\s+"?hook"?\s*$/.test(command);
+        return nativeOrSource || publishedNpx;
+    });
 }
 /**
  * Install the Claude Code AGENT hooks into `.claude/settings.json` so the agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.21.0",
+  "version": "1.21.1",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://hunch-pi.vercel.app",
-  "version": "1.21.0",
+  "version": "1.21.1",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.21.0",
+      "version": "1.21.1",
       "runtimeHint": "npx",
       "packageArguments": [
         {