@davesheffer/hunch 1.32.3 → 1.32.5

package/README.md

@@ -61,7 +61,7 @@ hunch integrations check --harness codex --require context,edit-blocking
 
 Capabilities are reported as **verified**, **advisory-only**, **unsupported** or **untested**. `--require` fails unless every named capability is verified. `mcp` is verified by a fresh-server probe; hook capabilities become verified only from lifecycle events actually delivered to Hunch's hook on the expected version within the last 30 days (machine-local evidence, the same trust level as the served ledger), so a repository whose agent has actually run shows it, and one that only has configuration does not.
 
-The Codex integration currently supplies MCP and instructions, with no native lifecycle adapter. The opt-in `--probe` verifies a fresh MCP process, not whether an existing host session or model actually followed the memory.
+Codex CLI 0.153+ gets a native lifecycle adapter (`.codex/hooks.json`: session orientation, prompt task IDs from `turn_id`, `apply_patch` pre-edit grounding and strict denial, Stop cards); project-layer hooks load only for a trusted project and must be trusted once in Codex with `/hooks`. The opt-in `--probe` verifies a fresh MCP process, not whether an existing host session or model actually followed the memory.
 
 Use `hunch integrations check` in CI to prevent pin drift; add `--require` for capabilities your workflow cannot operate without.
 

package/dist/cli/index.js

@@ -31,6 +31,7 @@ import { registerUpdateCommand } from "./update.js";
 import { registerReviewMemoryCommands } from "./reviewMemory.js";
 import { detectInitiator, normalizeInitiator } from "../synthesis/initiator.js";
 import { inspectIntegrations, formatIntegrationHealth, integrationHealthFails, integrationSessionWarning } from "../integrations/health.js";
+import { publishedStatus } from "../integrations/registry.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { JsonStore } from "../store/jsonStore.js";
 import { selectEmbedder } from "../store/embedder.js";
@@ -4451,15 +4452,21 @@ program
     .option("--provider <provider>", "hook event dialect: claude | vscode | cursor | windsurf | antigravity", "claude")
     .action(async (opts) => {
     // A hook MUST NEVER break the agent: on ANY error or unrecognized input we
-    // emit nothing and exit 0 (the action defers to Claude Code's normal flow).
+    // exit 0 and never deny (the action defers to the host's normal flow).
+    // Unrecognized input stays silent; an error after the event was recognized
+    // says "grounding unavailable" in one context line — see the catch below.
     let store = null;
+    // Hoisted so the fail-open catch below can still say which grounding was lost.
+    let provider = null;
+    let eventName = null;
     try {
-        const provider = hookProvider(opts.provider);
+        provider = hookProvider(opts.provider);
         if (!provider)
             return;
         const evt = normalizeHookEvent(JSON.parse(await readStdin()), provider);
         if (!evt)
             return;
+        eventName = evt.hook_event_name;
         const root = findRoot();
         // The host delivered this event: runtime evidence for `hunch integrations check`,
         // recorded before any policy decision so firmness never hides delivery itself.
@@ -4769,15 +4776,16 @@ program
         }
         // Pre-edit grounding must resolve the same advertised graph as every CLI
         // and MCP consumer. Any unavailable/mismatched team route falls through to
-        // the outer fail-open catch and emits nothing, preserving the hook's
-        // non-blocking invariant without false-passing against public/stale memory.
+        // the outer fail-open catch: one "grounding unavailable" line, never a deny,
+        // never grounding from public/stale memory (dec_77d99014e0).
         const opened = openTeamStore(root, { requireFreshTeamMemory: firmness === "strict" });
         store = opened.store;
         if (firmness === "strict" && opened.teamPullStatus
             && opened.teamPullStatus !== "updated" && opened.teamPullStatus !== "current") {
             // A strict deny is only trustworthy when it includes the latest team
             // rules. Offline/busy/unconfigured team memory is unavailable, so the
-            // non-blocking hook emits nothing instead of denying from stale state.
+            // non-blocking hook says so instead of denying from stale state.
+            emitContext(provider, "PreToolUse", `Hunch grounding unavailable for this edit; it proceeds ungrounded (team memory is ${opened.teamPullStatus}; strict mode never denies from stale rules). Run \`hunch doctor\`.`);
             return;
         }
         // strict: refuse an edit that hits a BLOCKING invariant (direct OR via blast
@@ -4900,8 +4908,18 @@ program
         }
         emitContext(provider, "PreToolUse", text + reportNotice, recalled ?? undefined);
     }
-    catch {
-        // swallow — never block an edit on a hook failure
+    catch (e) {
+        // Never block an edit on a hook failure — and never go silent either: an
+        // ungrounded edit that looks grounded gets diagnosed as model flakiness.
+        // One context line, exit 0 (the launcher itself failing stays out of reach).
+        const reason = e instanceof Error ? e.message.split("\n")[0] : "unknown error";
+        if (provider && (eventName === "PreToolUse" || eventName === "SessionStart" || eventName === "UserPromptSubmit")) {
+            const what = eventName === "PreToolUse" ? "for this edit; it proceeds ungrounded" : "for this session";
+            try {
+                emitContext(provider, eventName, `Hunch grounding unavailable ${what} (${reason}). Run \`hunch doctor\`.`);
+            }
+            catch { /* stdout gone */ }
+        }
     }
     finally {
         store?.close();
@@ -6626,6 +6644,21 @@ program
     .action(async () => {
     const integrations = inspectIntegrations(findRoot());
     console.log(formatIntegrationHealth(integrations));
+    // A pin npm cannot serve kills every npx launcher (hooks and MCP) before Hunch
+    // runs, and the hosts report nothing. Name it here; bounded, offline-safe.
+    const published = new Map();
+    for (const v of new Set([integrations.expectedVersion, ...integrations.pins.map(p => p.version)]))
+        published.set(v, publishedStatus(v));
+    const expectedUnpublished = published.get(integrations.expectedVersion) === "unpublished";
+    for (const pin of integrations.pins) {
+        if (published.get(pin.version) !== "unpublished")
+            continue;
+        console.log(`ERROR ${pin.file}: pins Hunch ${pin.version}, which npm cannot serve (ETARGET) — every hook run and MCP launch from this file fails before Hunch starts, silently. Run \`hunch integrations repair-pins\`${expectedUnpublished ? " once the release publishes" : ""}.`);
+        process.exitCode = 1;
+    }
+    if (expectedUnpublished && integrations.pins.every(p => p.version !== integrations.expectedVersion)) {
+        console.log(`note: package.json says ${integrations.expectedVersion}, which is not on npm yet; machine-local pins stay on the last published release until it is (then run \`hunch integrations repair-pins\`).`);
+    }
     // A shared-memory or CLI-only checkout may intentionally have no local
     // assistant config. The explicit integrations check still fails that case.
     if (integrations.harnesses.length > 0 && integrationHealthFails(integrations))

package/dist/cli/taskReport.js

@@ -1,7 +1,8 @@
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { findRoot } from "../core/paths.js";
 import { writeFileAtomic } from "../core/io.js";
-import { finishReportTask, forgetReportTask, listReportTasks, pruneReportHistory, readTaskReport, readLessonHistory, startReportTask } from "../core/taskReport.js";
+import { finishReportTask, forgetReportTask, listReportTasks, listTaskSummaries, pruneReportHistory, readTaskReport, readLessonHistory, renderTaskStatusLine, startReportTask, summarizeTaskReport, taskReportStats } from "../core/taskReport.js";
+import { promptTaskId } from "../core/taskReportHook.js";
 import { DEFAULT_CHECK_TIMEOUT_MS, MAX_CHECK_TIMEOUT_MS, reportSourceSnapshot, runReportCheck, runReportConformance } from "../core/taskReportEvidence.js";
 import { renderTaskReport, writeTaskReportHtml } from "../core/taskReportRender.js";
 import { assertReportPath } from "../core/taskReportPaths.js";
@@ -40,6 +41,72 @@ export function registerTaskReportCommands(program, openStore) {
         finishReportTask(root, id, opts.interrupted ? "interrupted" : "completed");
         console.log(renderTaskReport(readTaskReport(root, id, reportSourceSnapshot(root).hash)));
     });
+    task.command("list").description("Recent tasks observed in this repository with what Hunch delivered, saved, guarded, and checked")
+        .option("--limit <n>", "how many recent tasks (max 30)", "30")
+        .option("--json", "machine-readable summaries (consumed by the VS Code Contribution view)")
+        .action((opts) => {
+        const root = findRoot();
+        const summaries = listTaskSummaries(root, Number(opts.limit) || 30, reportSourceSnapshot(root).hash);
+        if (opts.json) {
+            console.log(JSON.stringify(summaries, null, 2));
+            return;
+        }
+        if (!summaries.length) {
+            console.log("No task activity observed yet.");
+            return;
+        }
+        for (const s of summaries)
+            console.log(`${s.task.started_at.slice(0, 16).replace("T", " ")}  ${s.task.task_id}  ${s.task.state.padEnd(11)} ${renderTaskStatusLine(s) || "nothing observed"}`);
+    });
+    task.command("stats").description("Adherence over a window: how many prompts Hunch reached (delivery), checked, saved, or guarded — from the ledger, never from agent claims")
+        .option("--days <days>", "window in days", "7")
+        .option("--json", "machine-readable")
+        .action((opts) => {
+        const stats = taskReportStats(findRoot(), Number(opts.days) || 7);
+        if (opts.json) {
+            console.log(JSON.stringify(stats, null, 2));
+            return;
+        }
+        const pct = (n) => stats.tasks ? `${Math.round((n / stats.tasks) * 100)}%` : "–";
+        console.log(`Hunch adherence, last ${Number(opts.days) || 7} day(s): ${stats.tasks} task(s), ${stats.completed} completed`);
+        console.log(`  reached by memory (delivery)  ${stats.with_delivery}  ${pct(stats.with_delivery)}`);
+        console.log(`  independent check recorded    ${stats.with_check}  ${pct(stats.with_check)}`);
+        console.log(`  application claimed by agent  ${stats.with_claim}  ${pct(stats.with_claim)}`);
+        console.log(`  memory saved                  ${stats.with_save}  ${pct(stats.with_save)}`);
+        console.log(`  edit denied                   ${stats.with_refusal}  ${pct(stats.with_refusal)}`);
+        console.log(`  nothing observed              ${stats.empty}  ${pct(stats.empty)}`);
+    });
+    task.command("status").description("One line for a terminal status line: the current prompt's task when Claude Code's status-line JSON arrives on stdin, otherwise the most recent task here")
+        .option("--json", "machine-readable summary")
+        .action(async (opts) => {
+        const input = process.stdin.isTTY ? "" : await readStdinText();
+        let root = findRoot();
+        let taskId = null;
+        try {
+            const host = input.trim() ? JSON.parse(input) : {};
+            const dir = host.workspace?.current_dir ?? host.cwd;
+            if (dir)
+                root = findRoot(dir);
+            if (host.session_id && host.prompt_id)
+                taskId = promptTaskId(root, host.session_id, host.prompt_id);
+        }
+        catch { /* a malformed host payload falls back to the most recent task */ }
+        let summary = null;
+        try {
+            const snapshot = reportSourceSnapshot(root).hash;
+            summary = taskId ? summarizeTaskReport(root, taskId, snapshot) : listTaskSummaries(root, 1, snapshot)[0] ?? null;
+        }
+        catch {
+            summary = null;
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(summary));
+            return;
+        }
+        const line = renderTaskStatusLine(summary);
+        if (line)
+            console.log(line);
+    });
     task.command("forget <id>").description("Delete this closed task's local observations and generated report; retains project memory")
         .action((id) => { forgetReportTask(findRoot(), id); console.log("Task report history removed; project memory retained."); });
     task.command("prune").description("Delete local report history for tasks closed more than the retention period ago")
@@ -125,4 +192,16 @@ export function registerTaskReportCommands(program, openStore) {
         console.log(opts.json ? JSON.stringify(report, null, 2) : renderTaskReport(report));
     });
 }
+function readStdinText() {
+    return new Promise(resolve => {
+        let data = "";
+        const done = () => resolve(data);
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", chunk => { data += chunk; });
+        process.stdin.on("end", done);
+        process.stdin.on("error", done);
+        // A host that opened stdin but never writes must not hang the status line.
+        setTimeout(done, 1500).unref();
+    });
+}
 //# sourceMappingURL=taskReport.js.map

package/dist/constitution/behaviorEvaluator.js

@@ -130,7 +130,7 @@ export function evaluateExecutableBehaviorPolicy(root, policy, opts = {}) {
         // longer match the commit's dependency inputs. Name each with its recovery;
         // both stay `error`, never a coerced pass.
         if (!existsSync(join(root, ".hunch-cache", "behavior-deps"))) {
-            return evaluation(policy, commit, { ...baseExecution, commit, error_code: "dependency-snapshot-cache-absent" }, "error", "no dependency snapshot cache exists on this machine (.hunch-cache/behavior-deps); executable behavior is unevaluated here, not failed — provision the policy's snapshots (hunch constitution bootstrap --behavior-deps <candidate>) or evaluate where they were built");
+            return evaluation(policy, commit, { ...baseExecution, commit, error_code: "dependency-snapshot-cache-absent" }, "error", "no dependency snapshot cache exists on this machine (.hunch-cache/behavior-deps); executable behavior is unevaluated here, not failed — provision the policy's snapshots (hunch constitution g2 --behavior-deps <candidate> --behavior-review-hash <hash>) or evaluate where they were built");
         }
         return evaluation(policy, commit, { ...baseExecution, commit, error_code: "dependency-snapshot-unavailable" }, "error", `no unique exact dependency snapshot matches this commit's package.json/package-lock.json among the policy's pinned ids (${assertion.dependency_snapshot_ids.join(", ")}); dependency inputs changed since compilation — re-plan and re-prove the policy (rb_g2_stale_policy_01)`);
     }

package/dist/constitution/repository.d.ts

@@ -9,6 +9,7 @@ export declare class PolicyRepository {
     private readonly privateHome?;
     constructor(root: string, store: HunchStore);
     private dir;
+    private ensureDir;
     private policiesIn;
     private proofsIn;
     private evidenceIn;

package/dist/constitution/repository.js

@@ -1,6 +1,7 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
 import { writeFileAtomic, writeFileAtomicIfAbsent } from "../core/io.js";
+import { readStoreArtifact, storeArtifactPath } from "../core/storeArtifact.js";
 import { shortHash } from "../core/ids.js";
 import { canonicalHash, policySemanticHash, proofPlanContentHash } from "./canonical.js";
 import { proofCorpusContentHash } from "./corpus.js";
@@ -9,13 +10,40 @@ import { assertCompositionBinding, compositionDescendants, policyProofHash } fro
 import { currentShadowDispositions, policyEvaluationContentHash, shadowDispositionContentHash, shadowDispositionJudgmentHash, shadowEvaluationContentHash, shadowEvaluationIdentityHash, } from "./shadow.js";
 import { HistoryDispositionSchema, ProofCorpusSchema, PolicyProofSchema, ProofPlanSchema, PolicySpecSchema, ShadowRecordSchema, EvidenceEventSchema, } from "./schema.js";
 const encode = (value) => JSON.stringify(value, null, 2) + "\n";
+const MAX_POLICY_ARTIFACT_BYTES = 8 * 1024 * 1024;
+function assertPolicyArtifactSize(data) {
+    if (Buffer.byteLength(data, "utf8") > MAX_POLICY_ARTIFACT_BYTES) {
+        throw new Error(`policy artifact exceeds the ${MAX_POLICY_ARTIFACT_BYTES}-byte limit`);
+    }
+}
+function artifactFile(dir, name) {
+    return storeArtifactPath(dir, name);
+}
+function writeArtifact(dir, name, data) {
+    assertPolicyArtifactSize(data);
+    const file = artifactFile(dir, name);
+    writeFileAtomic(file, data);
+    artifactFile(dir, name);
+}
+function writeArtifactIfAbsent(dir, name, data) {
+    assertPolicyArtifactSize(data);
+    const file = artifactFile(dir, name);
+    const created = writeFileAtomicIfAbsent(file, data);
+    if (created)
+        artifactFile(dir, name);
+    return created;
+}
 function loadRecords(dir, parse, label) {
-    if (!existsSync(dir))
+    const safeDir = storeArtifactPath(dirname(dir), basename(dir));
+    if (!existsSync(safeDir))
         return [];
     const out = [];
-    for (const name of readdirSync(dir).filter((n) => n.endsWith(".json")).sort()) {
+    for (const name of readdirSync(safeDir).filter((n) => n.endsWith(".json")).sort()) {
         try {
-            out.push(parse(JSON.parse(readFileSync(join(dir, name), "utf8"))));
+            const raw = readStoreArtifact(safeDir, [name], MAX_POLICY_ARTIFACT_BYTES);
+            if (raw === null)
+                throw new Error("record disappeared while it was being read");
+            out.push(parse(JSON.parse(raw)));
         }
         catch (e) {
             // A policy store can control CI. Skipping a corrupt record would turn an
@@ -41,7 +69,12 @@ export class PolicyRepository {
         const base = home === "private" ? this.privateHome : this.publicHome;
         if (!base)
             throw new Error("No private Hunch overlay is configured; refusing to write a private policy.");
-        return join(base, kind);
+        return storeArtifactPath(base, kind);
+    }
+    ensureDir(home, kind) {
+        const dir = this.dir(home, kind);
+        mkdirSync(dir, { recursive: true });
+        return storeArtifactPath(dirname(dir), basename(dir));
     }
     policiesIn(home) {
         if (home === "private" && !this.privateHome)
@@ -200,9 +233,9 @@ export class PolicyRepository {
         return dispositions.sort((left, right) => left.id.localeCompare(right.id));
     }
     homeOfPolicy(id) {
-        if (this.privateHome && existsSync(join(this.dir("private", "policies"), `${id}.json`)))
+        if (this.privateHome && existsSync(artifactFile(this.dir("private", "policies"), `${id}.json`)))
             return "private";
-        if (existsSync(join(this.dir("public", "policies"), `${id}.json`)))
+        if (existsSync(artifactFile(this.dir("public", "policies"), `${id}.json`)))
             return "public";
         return undefined;
     }
@@ -213,9 +246,8 @@ export class PolicyRepository {
             throw new Error(`refusing to write ${parsed.data_class} policy ${parsed.id} into its existing public home; migrate it to the private overlay first`);
         }
         const home = opts.private ? "private" : existing ?? (parsed.data_class !== "public" || this.store.unified ? "private" : "public");
-        const dir = this.dir(home, "policies");
-        mkdirSync(dir, { recursive: true });
-        writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
+        const dir = this.ensureDir(home, "policies");
+        writeArtifact(dir, `${parsed.id}.json`, encode(parsed));
         return parsed;
     }
     /** Publish a new policy lifecycle record without overwriting a concurrent
@@ -238,9 +270,8 @@ export class PolicyRepository {
             return { policy: existing, created: false };
         if (otherHome)
             throw new Error(`policy ${parsed.id} already exists in the ${home === "public" ? "private" : "public"} home`);
-        const dir = this.dir(home, "policies");
-        mkdirSync(dir, { recursive: true });
-        if (writeFileAtomicIfAbsent(join(dir, `${parsed.id}.json`), encode(parsed))) {
+        const dir = this.ensureDir(home, "policies");
+        if (writeArtifactIfAbsent(dir, `${parsed.id}.json`, encode(parsed))) {
             const racedOtherHome = this.getPolicy(parsed.id, home === "public" ? { privateOnly: true } : { publicOnly: true });
             if (racedOtherHome)
                 throw new Error(`policy ${parsed.id} was published concurrently in both public and private homes`);
@@ -277,9 +308,8 @@ export class PolicyRepository {
                 assertCompositionBinding(policy, composition, plan.composition);
             }
         }
-        const dir = this.dir(home, "proofs");
-        mkdirSync(dir, { recursive: true });
-        writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
+        const dir = this.ensureDir(home, "proofs");
+        writeArtifact(dir, `${parsed.id}.json`, encode(parsed));
         return parsed;
     }
     /** Publish an immutable proof without replacing a concurrent writer. */
@@ -315,9 +345,8 @@ export class PolicyRepository {
                 throw new Error(`proof ${parsed.id} already exists with different immutable content`);
             return { proof: existing, created: false };
         }
-        const dir = this.dir(home, "proofs");
-        mkdirSync(dir, { recursive: true });
-        if (writeFileAtomicIfAbsent(join(dir, `${parsed.id}.json`), encode(parsed)))
+        const dir = this.ensureDir(home, "proofs");
+        if (writeArtifactIfAbsent(dir, `${parsed.id}.json`, encode(parsed)))
             return { proof: parsed, created: true };
         const winner = this.getProof(parsed.id, homeOpts);
         if (!winner)
@@ -346,9 +375,8 @@ export class PolicyRepository {
             if (parsed.policy_candidate_hash !== policyProofHash(policy, composition))
                 throw new Error(`composite plan ${parsed.id} policy hash mismatch`);
         }
-        const dir = this.dir(home, "plans");
-        mkdirSync(dir, { recursive: true });
-        writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
+        const dir = this.ensureDir(home, "plans");
+        writeArtifact(dir, `${parsed.id}.json`, encode(parsed));
         return parsed;
     }
     /** Publish an immutable proof plan without replacing a concurrent writer. */
@@ -378,9 +406,8 @@ export class PolicyRepository {
                 throw new Error(`proof plan ${parsed.id} already exists with different immutable content`);
             return { plan: existing, created: false };
         }
-        const dir = this.dir(home, "plans");
-        mkdirSync(dir, { recursive: true });
-        if (writeFileAtomicIfAbsent(join(dir, `${parsed.id}.json`), encode(parsed)))
+        const dir = this.ensureDir(home, "plans");
+        if (writeArtifactIfAbsent(dir, `${parsed.id}.json`, encode(parsed)))
             return { plan: parsed, created: true };
         const winner = this.getPlan(parsed.id, homeOpts);
         if (!winner)
@@ -400,9 +427,8 @@ export class PolicyRepository {
         if (!policy || parsed.data_class !== policy.data_class || parsed.policy_hash !== policySemanticHash(policy)) {
             throw new Error(`corpus ${parsed.id} does not match policy ${policyId} semantics/data class`);
         }
-        const dir = this.dir(home, "corpora");
-        mkdirSync(dir, { recursive: true });
-        writeFileAtomic(join(dir, `${policyId}.json`), encode(parsed));
+        const dir = this.ensureDir(home, "corpora");
+        writeArtifact(dir, `${policyId}.json`, encode(parsed));
         return parsed;
     }
     putEvidence(event, opts = {}) {
@@ -413,9 +439,8 @@ export class PolicyRepository {
         if (home === "public" && parsed.data_class !== "public") {
             throw new Error(`refusing to write ${parsed.data_class} evidence ${parsed.id} into the public home`);
         }
-        const dir = this.dir(home, "evidence");
-        mkdirSync(dir, { recursive: true });
-        writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
+        const dir = this.ensureDir(home, "evidence");
+        writeArtifact(dir, `${parsed.id}.json`, encode(parsed));
         return parsed;
     }
     putDisposition(disposition, policyId) {
@@ -451,9 +476,8 @@ export class PolicyRepository {
         if (!current && parsed.supersedes)
             throw new Error(`history disposition ${parsed.id} supersedes no current disposition for this proof hit`);
         currentHistoryDispositions([...records, parsed]);
-        const dir = this.dir(home, "dispositions");
-        mkdirSync(dir, { recursive: true });
-        writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
+        const dir = this.ensureDir(home, "dispositions");
+        writeArtifact(dir, `${parsed.id}.json`, encode(parsed));
         return parsed;
     }
     putShadowEvaluation(evaluation, policyId) {
@@ -483,9 +507,8 @@ export class PolicyRepository {
         const existing = this.listShadowEvaluations(homeOpts).find((record) => shadowEvaluationIdentityHash(record) === shadowEvaluationIdentityHash(parsed));
         if (existing)
             return existing;
-        const dir = this.dir(home, "shadow");
-        mkdirSync(dir, { recursive: true });
-        writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
+        const dir = this.ensureDir(home, "shadow");
+        writeArtifact(dir, `${parsed.id}.json`, encode(parsed));
         return parsed;
     }
     putShadowDisposition(disposition, policyId) {
@@ -521,9 +544,8 @@ export class PolicyRepository {
         if (!current && parsed.supersedes)
             throw new Error(`shadow disposition ${parsed.id} supersedes no current disposition for this evaluation`);
         currentShadowDispositions([...records, parsed]);
-        const dir = this.dir(home, "shadow");
-        mkdirSync(dir, { recursive: true });
-        writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
+        const dir = this.ensureDir(home, "shadow");
+        writeArtifact(dir, `${parsed.id}.json`, encode(parsed));
         return parsed;
     }
 }
@@ -653,14 +675,18 @@ export function movePolicyArtifactsToPrivate(publicHunchDir, privateHunchDir) {
         }
     }
     for (const { kind, from, to, pub, priv, keyFor } of staged) {
+        storeArtifactPath(dirname(from), basename(from));
         if (!pub.length && !existsSync(from))
             continue;
+        storeArtifactPath(dirname(to), basename(to));
         mkdirSync(to, { recursive: true });
+        storeArtifactPath(dirname(to), basename(to));
         for (const rec of pub) {
             const key = keyFor(rec);
             if (!priv.has(key))
-                writeFileAtomic(join(to, `${key}.json`), encode(rec));
+                writeArtifact(to, `${key}.json`, encode(rec));
         }
+        storeArtifactPath(dirname(from), basename(from));
         rmSync(from, { recursive: true, force: true });
         counts[kind] = pub.length;
     }

package/dist/core/agenthook.d.ts

@@ -5,7 +5,7 @@
  * fields or tools. Keep that variability here so the policy engine receives
  * the same small, fail-open shape regardless of the assistant that emitted it.
  */
-export declare const HOOK_PROVIDERS: readonly ["claude", "vscode", "windsurf", "antigravity", "cursor"];
+export declare const HOOK_PROVIDERS: readonly ["claude", "codex", "vscode", "windsurf", "antigravity", "cursor"];
 export type HookProvider = (typeof HOOK_PROVIDERS)[number];
 export type HunchHookEvent = "PreToolUse" | "PostToolUse" | "PostToolUseFailure" | "UserPromptSubmit" | "SessionStart" | "SubagentStart" | "PreCompact" | "Stop";
 export interface HunchToolInput {

package/dist/core/agenthook.js

@@ -5,7 +5,7 @@
  * fields or tools. Keep that variability here so the policy engine receives
  * the same small, fail-open shape regardless of the assistant that emitted it.
  */
-export const HOOK_PROVIDERS = ["claude", "vscode", "windsurf", "antigravity", "cursor"];
+export const HOOK_PROVIDERS = ["claude", "codex", "vscode", "windsurf", "antigravity", "cursor"];
 function obj(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
@@ -49,10 +49,28 @@ function edits(value) {
         .map((item) => ({ new_string: stringAt(item, "new_string", "newString", "ReplacementContent", "replacementContent") }));
     return normalized.length ? normalized : undefined;
 }
-function normalizeToolInput(value) {
+/** Codex edits files through `apply_patch`, whose input is the patch text itself
+ * (`*** Update File: path`). The first touched path becomes the edit target so the
+ * per-file pre-edit gate applies; the whole patch stands in for the new content. */
+const PATCH_FILE = /^\*\*\* (?:Update|Add|Delete) File: (.+?)\s*$/m;
+function applyPatchInput(raw) {
+    const patch = [raw.input, raw.patch, raw.content].find((v) => typeof v === "string" && /\*\*\* Begin Patch/.test(v));
+    if (!patch)
+        return undefined;
+    const file = PATCH_FILE.exec(patch)?.[1];
+    return file ? { file_path: file, content: patch } : undefined;
+}
+function normalizeToolInput(value, allowPatch = false) {
     const raw = obj(value);
     if (!raw)
         return undefined;
+    // Only Codex's apply_patch tool carries patch text in a generic `input`,
+    // `patch`, or `content` field. A normal Write can contain documentation or
+    // examples with these markers; interpreting those as a patch would retarget
+    // policy to the first file named in the prose.
+    const patched = allowPatch ? applyPatchInput(raw) : undefined;
+    if (patched)
+        return patched;
     const replacementChunks = Array.isArray(raw.ReplacementChunks) ? raw.ReplacementChunks : raw.replacementChunks;
     const chunkEdits = Array.isArray(replacementChunks)
         ? replacementChunks.map((chunk) => obj(chunk)).filter((chunk) => !!chunk)
@@ -63,7 +81,9 @@ function normalizeToolInput(value) {
         new_string: stringAt(raw, "new_string", "newString", "ReplacementContent", "replacementContent", "TargetContent", "targetContent"),
         content: stringAt(raw, "content", "contents", "CodeContent", "codeContent"),
         edits: edits(raw.edits) ?? edits(raw.files) ?? chunkEdits,
-        command: stringAt(raw, "command", "commandLine", "CommandLine", "cmd"),
+        // Codex's shell tools carry argv arrays (["bash", "-lc", "…"]); policies read one string.
+        command: stringAt(raw, "command", "commandLine", "CommandLine", "cmd")
+            ?? (Array.isArray(raw.command) && raw.command.every(p => typeof p === "string") ? raw.command.join(" ") : undefined),
         skill: stringAt(raw, "skill", "skillName", "name"),
     };
     return Object.values(out).some((v) => v !== undefined) ? out : undefined;
@@ -189,13 +209,17 @@ export function normalizeHookEvent(raw, provider) {
     const event = eventName(input.hook_event_name ?? input.hookEventName ?? input.event, provider);
     if (!event)
         return null;
-    const toolInput = normalizeToolInput(input.tool_input ?? input.toolInput);
+    const rawToolName = stringAt(input, "tool_name", "toolName");
+    const toolInput = normalizeToolInput(input.tool_input ?? input.toolInput, provider === "codex" && /^(?:apply_patch|patch)$/i.test(rawToolName ?? ""));
     const toolOutcome = normalizeToolOutcome(input, event);
     return {
         hook_event_name: event,
         session_id: stringAt(input, "session_id", "sessionId", "conversation_id", "conversationId"),
-        ...(provider === "claude" ? Object.fromEntries(["prompt_id", "cwd", "agent_id"].filter(key => input[key] !== undefined).map(key => [key, typeof input[key] === "string" ? input[key] : ""])) : {}),
-        tool_name: hunchToolName(stringAt(input, "tool_name", "toolName"), toolInput ?? {}),
+        // Codex delivers the same lifecycle payload with `turn_id` where Claude Code
+        // says `prompt_id`; both are native per-prompt identities, never synthesized.
+        ...(provider === "codex" && input.prompt_id === undefined && input.turn_id !== undefined ? { prompt_id: typeof input.turn_id === "string" ? input.turn_id : "" } : {}),
+        ...(provider === "claude" || provider === "codex" ? Object.fromEntries(["prompt_id", "cwd", "agent_id"].filter(key => input[key] !== undefined).map(key => [key, typeof input[key] === "string" ? input[key] : ""])) : {}),
+        tool_name: hunchToolName(rawToolName, toolInput ?? {}),
         tool_input: toolInput,
         ...(toolOutcome ? { tool_outcome: toolOutcome } : {}),
         prompt: stringAt(input, "prompt", "user_prompt", "userPrompt"),

package/dist/core/checkreport.js

@@ -200,7 +200,7 @@ export function renderMarkdown(r) {
             r.regBlocking ? `${r.regBlocking} blocking-linked regression(s)` : "",
             r.vetoBlocking ? `${r.vetoBlocking} reversed-decision veto(es)` : "",
         ].filter(Boolean).join(" + ");
-        out.push(`❌ **This PR breaks ${reasons}.** Resolve or supersede the decision before merge.`);
+        out.push(`❌ **Merge requires review: ${reasons}.** Check the cited evidence and verify that the recorded requirements still hold before merging.`);
     }
     else if (r.strict) {
         out.push(`ℹ️ Nothing here is a direct, high-confidence, non-stale blocking invariant — **not blocking** this PR.`);

package/dist/core/config.d.ts

@@ -11,6 +11,9 @@ export declare const FIRMNESS_LEVELS: readonly Firmness[];
 export declare const DEFAULT_FIRMNESS: Firmness;
 export interface HunchConfig {
     firmness: Firmness;
+    /** MCP tool groups beyond the everyday set: `all`, `core`, or `core,nuryel`
+     *  (see src/mcp/toolset.ts). Undefined = decide from the root's contents. */
+    mcp_tools?: string;
 }
 export declare function isFirmness(v: unknown): v is Firmness;
 /** Read `.hunch/config.json`. A missing/unparseable file, or an unknown firmness

package/dist/core/config.js

@@ -19,7 +19,10 @@ export function readConfig(paths) {
         return defaults();
     try {
         const raw = JSON.parse(readFileSync(paths.config, "utf8"));
-        return { firmness: isFirmness(raw.firmness) ? raw.firmness : DEFAULT_FIRMNESS };
+        return {
+            firmness: isFirmness(raw.firmness) ? raw.firmness : DEFAULT_FIRMNESS,
+            ...(typeof raw.mcp_tools === "string" && raw.mcp_tools.trim() ? { mcp_tools: raw.mcp_tools.trim() } : {}),
+        };
     }
     catch {
         return defaults();

package/dist/core/events.js

@@ -16,8 +16,9 @@
  *  assert — those are conformance-only predicates checked by a different gate
  *  (`hunch conform`), not the edit hook. This schema records only what each gate
  *  actually knows; it never fabricates the conformance shape for a plain block. */
-import { appendFileSync, readFileSync } from "node:fs";
+import { appendFileSync, closeSync, constants, fstatSync, lstatSync, openSync } from "node:fs";
 import { join } from "node:path";
+import { readStoreArtifact, storeArtifactPath } from "./storeArtifact.js";
 export function eventsLogPath(paths) {
     return join(paths.hunch, "events.log");
 }
@@ -25,19 +26,34 @@ export function eventsLogPath(paths) {
  *  call site is the edit hook, which MUST NEVER break an agent on failure
  *  (con_03a0b94b2e). A dropped catch-log line is an acceptable loss. */
 export function appendEvent(paths, event) {
+    let fd;
     try {
-        appendFileSync(eventsLogPath(paths), `${JSON.stringify(event)}\n`);
+        const file = storeArtifactPath(paths.hunch, "events.log");
+        fd = openSync(file, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW);
+        const opened = fstatSync(fd);
+        const current = lstatSync(storeArtifactPath(paths.hunch, "events.log"));
+        if (!opened.isFile() || opened.nlink !== 1 || opened.dev !== current.dev || opened.ino !== current.ino)
+            return;
+        appendFileSync(fd, `${JSON.stringify(event)}\n`);
     }
     catch {
         /* best effort — a lost audit line must never surface to the agent */
     }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* logging remains best effort on close failure too */ }
+        }
+    }
 }
 /** Read + parse the catch-log. Malformed lines are skipped, not fatal (the log is
  *  derived; one bad line never poisons the aggregation). Missing log → []. */
 export function readEvents(paths) {
     let raw;
     try {
-        raw = readFileSync(eventsLogPath(paths), "utf8");
+        raw = readStoreArtifact(paths.hunch, ["events.log"]) ?? "";
     }
     catch {
         return []; // no catches recorded yet