@davesheffer/hunch 1.30.0 → 1.31.1

package/dist/synthesis/provider.js

@@ -4,11 +4,10 @@
  * LLM synthesis is driven by the user's chosen coding-assistant subscription
  * CLI or an explicitly configured OpenAI-compatible endpoint. Claude Code,
  * Codex, and Cursor use different auth surfaces, but every provider returns the
- * same shape. When more than one non-deterministic provider is available, Hunch
- * deliberately does NOT guess which one to use: the user chooses once with
- * `hunch provider <name>` (stored locally)
- * or overrides per shell with HUNCH_SYNTH_PROVIDER. Ambiguous auto mode stays
- * deterministic and free.
+ * same shape. An agent-initiated operation stays with its initiating provider,
+ * including verification and deep sampling. CLI availability never establishes
+ * origin. Explicit env/local preferences remain for human terminal invocations;
+ * unknown/ambiguous agent origins stay deterministic and free.
  *
  * Subscription, not API: provider-specific API credentials are removed from the
  * child env wherever the CLI would otherwise prefer them. There is intentionally
@@ -32,6 +31,8 @@ import { dirname, join } from "node:path";
 import { writeFileAtomic } from "../core/io.js";
 import { summarizeDiff } from "../extractors/diff.js";
 import { languageFor } from "../extractors/languages.js";
+import { assertInitiatorProvider, currentInitiator, initiatorChildEnv } from "./initiator.js";
+import { discoverAgentClis, readAgentCliConfig } from "./cliAdapter.js";
 const IS_WIN = process.platform === "win32";
 /**
  * Run a command, optionally feeding `input` to its stdin, and resolve its
@@ -53,12 +54,12 @@ export function pexecIn(cmd, args, opts = {}) {
         const child = IS_WIN
             ? spawn([cmd, ...args].join(" "), {
                 shell: true,
-                env: opts.env,
+                env: initiatorChildEnv(opts.env ?? process.env),
                 cwd: opts.cwd,
                 windowsHide: true,
             })
             : spawn(cmd, args, {
-                env: opts.env,
+                env: initiatorChildEnv(opts.env ?? process.env),
                 cwd: opts.cwd,
                 windowsHide: true,
             });
@@ -124,15 +125,16 @@ export function pexecIn(cmd, args, opts = {}) {
     });
 }
 /** Every selectable synthesis mode. `auto` is a preference value rather than a
- * provider: it uses a subscription only when exactly one usable CLI is found.
+ * provider: it resolves the invocation's origin without choosing by availability.
  * "openai-compat" is the opt-in local/self-hosted HTTP provider (Ollama, vLLM,
  * LM Studio, ...) — not a subscription, but explicitly selectable like one. */
-export const SYNTH_PROVIDER_NAMES = ["claude-cli", "codex-cli", "cursor-agent", "openai-compat", "deterministic"];
+export const SYNTH_PROVIDER_NAMES = ["claude-cli", "codex-cli", "cursor-agent", "kimi-cli", "openai-compat", "deterministic"];
 export const SYNTH_PREFERENCES = ["auto", ...SYNTH_PROVIDER_NAMES];
 const PROVIDER_INFO = {
     "claude-cli": { label: "Claude Code", subscription: "Claude subscription" },
     "codex-cli": { label: "Codex", subscription: "ChatGPT subscription" },
     "cursor-agent": { label: "Cursor Agent", subscription: "Cursor subscription" },
+    "kimi-cli": { label: "Kimi CLI", subscription: null },
     "openai-compat": { label: "Self-hosted / local model (Ollama, vLLM, LM Studio, ...)", subscription: null },
     deterministic: { label: "Deterministic local fallback", subscription: null },
 };
@@ -210,7 +212,8 @@ class PromptSynthProvider {
     /** Run a CLI with the prompt on stdin, stripping API-key env vars so the tool
      *  falls through to its SUBSCRIPTION credentials. Shared by codex/cursor. */
     async runCli(bin, args, stripEnv, prompt, timeoutMs = 120_000) {
-        const env = { ...process.env };
+        assertInitiatorProvider(this.name);
+        const env = initiatorChildEnv();
         for (const k of stripEnv)
             delete env[k];
         const { stdout } = await pexecIn(bin, args, {
@@ -223,6 +226,7 @@ class PromptSynthProvider {
         return stdout;
     }
     async draftDecision(input) {
+        assertInitiatorProvider(this.name);
         const text = await this.run(`${SYSTEM}\n\n${commitPrompt(input)}\n\n${jsonInstruction(DECISION_TOOL.input_schema)}`, "json");
         const draft = decisionDraftFromText(text, input.subject);
         // No usable LLM JSON (truncation, refusal, prose-only, or a CLI whose output
@@ -238,6 +242,7 @@ class PromptSynthProvider {
         return draft;
     }
     async draftBug(input) {
+        assertInitiatorProvider(this.name);
         const text = await this.run(`${SYSTEM}\n\n${failurePrompt(input)}\n\n${jsonInstruction(BUG_TOOL.input_schema)}`, "json");
         const draft = bugDraftFromText(text, input.test, input.message);
         if (!draft)
@@ -248,6 +253,7 @@ class PromptSynthProvider {
      *  mode required by the record mappers. Throws on empty output so the caller
      *  falls back to its deterministic template page. */
     async draftProse(prompt) {
+        assertInitiatorProvider(this.name);
         const text = (await this.run(prompt, "text")).trim();
         if (!text)
             throw new Error(`${this.name}: empty prose output`);
@@ -258,6 +264,7 @@ class PromptSynthProvider {
      *  Throws on unusable output so verifyDecisionSafe degrades to the un-audited
      *  draft (a verifier failure must never lose the draft — dec_18a81c8291). */
     async verifyDecision(input, draft) {
+        assertInitiatorProvider(this.name);
         const text = await this.run(`${VERIFY_SYSTEM}\n\n${verifyPrompt(input, draft)}\n\n${jsonInstruction(VERIFY_TOOL.input_schema)}`, "json");
         const verdict = verdictFromText(text);
         if (!verdict)
@@ -268,6 +275,7 @@ class PromptSynthProvider {
      *  Uses the provider's guarded transport. Throws on unusable
      *  output so the caller can degrade to a keep-for-human verdict. */
     async judgeDraft(draft, existing) {
+        assertInitiatorProvider(this.name);
         const text = await this.run(`${RELEVANCE_SYSTEM}\n\n${relevancePrompt(draft, existing)}\n\n${jsonInstruction(RELEVANCE_TOOL.input_schema)}`, "json");
         const verdict = relevanceFromText(text);
         if (!verdict)
@@ -690,13 +698,31 @@ export function extractCodexText(out) {
         return agentTexts[agentTexts.length - 1];
     return texts.length ? texts[texts.length - 1] : out;
 }
-// This registry is deliberately NOT a priority order. Auto mode only spends a
-// subscription when it can identify exactly one usable CLI; see
-// resolveSynthesisProvider below.
+// This registry is not a priority order: invocation origin selects the provider.
+class AdapterCliProvider extends PromptSynthProvider {
+    name;
+    adapters;
+    worker;
+    constructor(name, adapters = []) {
+        super();
+        this.name = name;
+        this.adapters = adapters;
+    }
+    async available() {
+        this.worker = discoverAgentClis(this.adapters, this.name).find(p => p.name === this.name);
+        return !!this.worker;
+    }
+    async run(prompt) {
+        if (!this.worker?.draftProse)
+            throw new Error(`Initiating CLI ${this.name} is unavailable`);
+        return this.worker.draftProse(prompt);
+    }
+}
 const PROVIDERS = [
     new ClaudeCliProvider(),
     new CodexCliProvider(),
     new CursorCliProvider(),
+    new AdapterCliProvider("kimi-cli"),
     new OpenAICompatProvider(),
     new DeterministicProvider(),
 ];
@@ -795,9 +821,8 @@ async function statusesFor(providers) {
     }
     return statuses;
 }
-/** Resolve the provider without ever inferring which of several installed products is
- * the one the user intends to spend. Precedence is deliberate: a one-shell override,
- * then a per-user local preference, then safe auto-detection. */
+/** Respect offline mode, then bind to invocation origin. Explicit terminal preferences
+ * apply only without an agent origin; installed executables never select an account. */
 export async function resolveSynthesisProvider(opts = {}) {
     const providers = opts.providers ?? PROVIDERS;
     const env = opts.env ?? process.env;
@@ -809,6 +834,30 @@ export async function resolveSynthesisProvider(opts = {}) {
         return provider && await isAvailable(provider) ? provider : undefined;
     };
     const environment = normalizeProviderName(env.HUNCH_SYNTH_PROVIDER?.trim());
+    // Explicit offline/privacy mode always wins: origin binding must never turn it into a model call.
+    if (environment === "deterministic")
+        return { provider: fallback, source: "environment", preference: "deterministic", statuses };
+    if ((!environment || environment === "auto") && opts.root && readSynthesisPreference(opts.root) === "deterministic") {
+        return { provider: fallback, source: "local", preference: "deterministic", statuses };
+    }
+    const origin = currentInitiator(env);
+    if (origin.provider) {
+        let provider = providers.find(p => p.name === origin.provider);
+        const config = opts.cliConfig ?? env.HUNCH_CLI_CONFIG ?? env.HUNCH_REVIEW_CLI_CONFIG;
+        if (!provider && !opts.providers && config) {
+            const adapters = readAgentCliConfig(config);
+            if (adapters.some(a => a.name === origin.provider))
+                provider = new AdapterCliProvider(origin.provider, adapters);
+        }
+        if (provider && await isAvailable(provider)) {
+            return { provider, source: "initiator", preference: "auto", statuses, initiator: origin.provider };
+        }
+        return { provider: fallback, source: "unavailable-initiator", preference: "auto", statuses, initiator: origin.provider };
+    }
+    // An MCP request with unknown identity must not inherit the launching terminal's preferences.
+    if (origin.source === "ambiguous" || origin.source === "client" || env.HUNCH_INITIATOR === "unknown") {
+        return { provider: fallback, source: "unknown-initiator", preference: "auto", statuses, initiator: null };
+    }
     if (environment && isSynthPreference(environment) && environment !== "auto") {
         const selected = await usable(environment);
         if (selected)
@@ -827,14 +876,9 @@ export async function resolveSynthesisProvider(opts = {}) {
         return { provider: fallback, source: "unavailable-preference", preference, statuses };
     }
     const available = statuses.filter((status) => status.name !== "deterministic" && status.available);
-    if (available.length === 1) {
-        const selected = await usable(available[0].name);
-        if (selected)
-            return { provider: selected, source: "single-available", preference, statuses };
-    }
     return {
         provider: fallback,
-        source: available.length > 1 ? "ambiguous" : "none",
+        source: available.length > 1 ? "ambiguous" : available.length ? "unknown-initiator" : "none",
         preference,
         statuses,
     };
@@ -844,26 +888,14 @@ export async function resolveSynthesisProvider(opts = {}) {
 export async function selectProvider(opts = {}) {
     return (await resolveSynthesisProvider(opts)).provider;
 }
-// ---- Deep Synthesis: ensemble of subscription CLIs (+ opt-in openai-compat) ----
-// Opt-in (backfill/sync --deep): fan a commit out to EVERY available worker —
-// the subscription CLIs (ANTHROPIC_API_KEY stripping inherited from them) plus the
-// opt-in openai-compat HTTP provider when configured, which is outside that
-// stripping scope entirely (con_2ce3f2a547 governs the Anthropic API specifically,
-// not a user-configured self-hosted endpoint) — drop failures, reconcile the
-// drafts. NEVER used on the guard path; confidence is capped below the strict gate
-// so output stays advisory.
-/** All available subscription-CLI workers (claude/codex/cursor, plus the opt-in
- *  openai-compat), excluding the deterministic fallback — the pool Deep Synthesis
- *  fans a commit out to. */
+// ---- Deep Synthesis: repeated samples from the same initiating provider ----
+// Opt-in (backfill/sync --deep): sample the initiating provider repeatedly, drop
+// failures and reconcile drafts. Never used on the guard path; confidence remains
+// capped below the strict gate so output stays advisory.
+/** Only the resolved origin-bound worker. No cross-account fan-out. */
 export async function selectWorkers(opts = {}) {
-    const out = [];
-    for (const p of opts.providers ?? PROVIDERS) {
-        if (p.name === "deterministic")
-            continue; // workers are real LLM providers only
-        if (await isAvailable(p))
-            out.push(p);
-    }
-    return out;
+    const { provider } = await resolveSynthesisProvider(opts);
+    return provider.name === "deterministic" ? [] : [provider];
 }
 const tokens = (d) => new Set(`${d.title} ${d.decision}`.toLowerCase().match(/[a-z0-9_]{3,}/g) ?? []);
 /** Mean pairwise Jaccard overlap of the drafts' identifying text (0..1) — how much the
@@ -907,9 +939,7 @@ export function mergeDecisionDrafts(drafts) {
         agreement: Math.round(agreement * 100) / 100,
     };
 }
-// Default self-consistency depth when only ONE LLM provider is available (the
-// common case): sample it this many times and reconcile, so single-provider users get
-// ensemble-like robustness. Tunable per-call via `--samples`.
+// Sample the initiating provider this many times and reconcile. Tunable via --samples.
 const DEFAULT_SAMPLES = 2;
 export class EnsembleProvider {
     workers;
@@ -917,6 +947,8 @@ export class EnsembleProvider {
     samples;
     constructor(workers, opts = {}) {
         this.workers = workers;
+        for (const worker of workers)
+            assertInitiatorProvider(worker.name);
         // Default 1 (single worker → passthrough); the self-consistency policy default
         // lives at the selection layer (selectEnsemble). Coerce to a finite integer in a
         // sane 1..5 band — a NaN here would make decisionTasks build ZERO tasks and throw,
@@ -925,8 +957,8 @@ export class EnsembleProvider {
         this.samples = Number.isFinite(n) ? Math.max(1, Math.min(5, n)) : 1;
     }
     async available() { return this.workers.length > 0; }
-    /** The draft tasks to fan out: one per distinct CLI when several are installed
-     *  (cross-model ensemble), else N self-consistency samples of the single CLI. */
+    /** Production selection supplies one origin-bound worker with N samples.
+     * Direct callers can also supply multiple workers subject to origin checks. */
     decisionTasks(input) {
         if (this.workers.length >= 2)
             return this.workers.map((w) => () => w.draftDecision(input));

package/dist/synthesis/synthesize.js

@@ -131,7 +131,7 @@ export async function syncCommit(store, root, sha, opts = {}) {
     const provider = localOnly
         ? new DeterministicProvider()
         : opts.deep
-            ? (await selectEnsemble({ samples: opts.samples })) ?? await selectProvider({ root })
+            ? (await selectEnsemble({ root, samples: opts.samples })) ?? await selectProvider({ root })
             : opts.force || opts.verify || isSignificant(meta, analysis, substantiveFiles)
                 ? await selectProvider({ root })
                 : new DeterministicProvider();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.30.0",
+  "version": "1.31.1",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
@@ -94,6 +94,7 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@tree-sitter-grammars/tree-sitter-yaml": "^0.6.1",
     "commander": "^15.0.0",
+    "cross-spawn": "^7.0.6",
     "smol-toml": "1.8.0",
     "tree-sitter": "0.21.1",
     "tree-sitter-go": "^0.23.4",
@@ -103,6 +104,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@types/cross-spawn": "^6.0.6",
     "@types/node": "^22.13.0",
     "tsx": "^4.22.4",
     "typescript": "^5.9.3"

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.30.0",
+  "version": "1.31.1",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.30.0",
+      "version": "1.31.1",
       "runtimeHint": "npx",
       "packageArguments": [
         {