@davesheffer/hunch 1.32.5 → 1.32.7

package/README.md

@@ -61,7 +61,7 @@ hunch integrations check --harness codex --require context,edit-blocking
 
 Capabilities are reported as **verified**, **advisory-only**, **unsupported** or **untested**. `--require` fails unless every named capability is verified. `mcp` is verified by a fresh-server probe; hook capabilities become verified only from lifecycle events actually delivered to Hunch's hook on the expected version within the last 30 days (machine-local evidence, the same trust level as the served ledger), so a repository whose agent has actually run shows it, and one that only has configuration does not.
 
-Codex CLI 0.153+ gets a native lifecycle adapter (`.codex/hooks.json`: session orientation, prompt task IDs from `turn_id`, `apply_patch` pre-edit grounding and strict denial, Stop cards); project-layer hooks load only for a trusted project and must be trusted once in Codex with `/hooks`. The opt-in `--probe` verifies a fresh MCP process, not whether an existing host session or model actually followed the memory.
+Codex CLI 0.153+ gets a native lifecycle adapter (`.codex/hooks.json`: session orientation, prompt task IDs from `turn_id`, `apply_patch` pre-edit grounding and strict denial, native `Bash`/`PowerShell` post-tool observation, Stop cards); project-layer hooks load only for a trusted project and must be trusted once in Codex with `/hooks`. Failure capture is certified only by an explicit failed-tool lifecycle event; a successful `PostToolUse` observation does not prove it. The opt-in `--probe` verifies a fresh MCP process, not whether an existing host session or model actually followed the memory.
 
 Use `hunch integrations check` in CI to prevent pin drift; add `--require` for capabilities your workflow cannot operate without.
 
@@ -288,4 +288,4 @@ See the [changelog](CHANGELOG.md) for release detail and the [roadmap](ROADMAP.m
 - [Architecture benchmark](bench/architectural-conformance.md)
 - [Contributing](CONTRIBUTING.md)
 
-Apache-2.0
+Apache-2.0

package/dist/cli/index.js

@@ -4470,7 +4470,7 @@ program
         const root = findRoot();
         // The host delivered this event: runtime evidence for `hunch integrations check`,
         // recorded before any policy decision so firmness never hides delivery itself.
-        recordHookObservation(root, provider, evt.hook_event_name);
+        recordHookObservation(root, provider, evt.hook_event_name, evt.tool_outcome?.status);
         const paths = hunchPaths(root);
         const firmness = readConfig(paths).firmness;
         if (firmness === "off")

package/dist/core/agenthook.js

@@ -107,6 +107,38 @@ function toolOutput(value) {
         return "";
     }
 }
+function explicitToolOutcome(response) {
+    const raw = obj(response);
+    if (!raw)
+        return typeof response === "string" && response.trim() ? "success" : "unknown";
+    if (raw.success === false || raw.is_error === true || raw.isError === true || (raw.error !== undefined && raw.error !== null))
+        return "failure";
+    const status = raw.status;
+    if (typeof status === "string") {
+        if (/^(?:failure|failed|error|errored)$/i.test(status.trim()))
+            return "failure";
+    }
+    let explicitSuccess = raw.success === true || raw.is_error === false || raw.isError === false;
+    for (const key of ["exit_code", "exitCode", "return_code", "returnCode"]) {
+        const value = raw[key];
+        const numeric = typeof value === "number" ? value : typeof value === "string" && /^-?\d+$/.test(value.trim()) ? Number(value) : undefined;
+        if (numeric === undefined || !Number.isFinite(numeric))
+            continue;
+        if (numeric !== 0)
+            return "failure";
+        explicitSuccess = true;
+    }
+    if (typeof status === "string" && /^(?:success|succeeded|ok|completed)$/i.test(status.trim()))
+        explicitSuccess = true;
+    if (explicitSuccess)
+        return "success";
+    // Common successful tool-result shapes carry output fields even when the
+    // output is empty. An unstructured empty string (Codex's native failure
+    // payload) remains unknown until the host supplies an explicit status.
+    if (["stdout", "stderr", "output", "content"].some(key => Object.prototype.hasOwnProperty.call(raw, key)))
+        return "success";
+    return "unknown";
+}
 function normalizeToolOutcome(input, event) {
     if (event !== "PostToolUse" && event !== "PostToolUseFailure")
         return undefined;
@@ -114,11 +146,7 @@ function normalizeToolOutcome(input, event) {
     return {
         // Claude Code splits successful and failed calls into separate lifecycle
         // events. Providers without that split may expose an explicit result flag.
-        status: event === "PostToolUseFailure"
-            ? "failure"
-            : obj(response)?.success === false || obj(response)?.is_error === true || obj(response)?.isError === true
-                ? "failure"
-                : "success",
+        status: event === "PostToolUseFailure" ? "failure" : explicitToolOutcome(response),
         output: event === "PostToolUseFailure"
             ? toolOutput(input.error ?? response)
             : toolOutput(response),

package/dist/core/hookObservations.d.ts

@@ -1,9 +1,12 @@
+export type HookOutcomeEvidence = "success" | "failure" | "unknown";
 export interface HookObservation {
     provider: string;
     event: string;
     at: string;
     version: string;
+    /** Present for observations recorded after outcome tracking was added. */
+    outcome?: HookOutcomeEvidence | null;
 }
 /** Never throws (con_03a0b94b2e): a missing ledger costs evidence, not the edit. */
-export declare function recordHookObservation(root: string, provider: string, event: string): void;
+export declare function recordHookObservation(root: string, provider: string, event: string, outcome?: HookOutcomeEvidence): void;
 export declare function readHookObservations(root: string): HookObservation[];

package/dist/core/hookObservations.js

@@ -9,15 +9,28 @@ import { HUNCH_VERSION } from "./version.js";
 function ensureTable(db) {
     db.exec(`CREATE TABLE IF NOT EXISTS hook_observations (
     provider TEXT NOT NULL, event TEXT NOT NULL, at TEXT NOT NULL, version TEXT NOT NULL,
+    outcome TEXT,
     PRIMARY KEY (provider, event)
   )`);
+    // Existing machine ledgers predate outcome tracking. Their rows remain
+    // intentionally unknown until a later hook delivery supplies a result.
+    const columns = db.prepare("PRAGMA table_info(hook_observations)").all();
+    if (!columns.some(column => column.name === "outcome"))
+        db.exec("ALTER TABLE hook_observations ADD COLUMN outcome TEXT");
 }
 /** Never throws (con_03a0b94b2e): a missing ledger costs evidence, not the edit. */
-export function recordHookObservation(root, provider, event) {
+export function recordHookObservation(root, provider, event, outcome) {
     try {
         withServedDatabase(root, db => {
             ensureTable(db);
-            db.prepare("INSERT OR REPLACE INTO hook_observations VALUES (?, ?, ?, ?)").run(provider, event, new Date().toISOString(), HUNCH_VERSION);
+            const evidence = outcome === "failure" || outcome === "success" ? outcome : null;
+            const at = new Date().toISOString();
+            db.prepare(`INSERT INTO hook_observations (provider, event, at, version, outcome)
+        VALUES (?, ?, ?, ?, ?)
+        ON CONFLICT(provider, event) DO UPDATE SET
+          at = CASE WHEN excluded.outcome = 'failure' OR hook_observations.outcome IS NULL OR hook_observations.outcome != 'failure' THEN excluded.at ELSE hook_observations.at END,
+          version = CASE WHEN excluded.outcome = 'failure' OR hook_observations.outcome IS NULL OR hook_observations.outcome != 'failure' THEN excluded.version ELSE hook_observations.version END,
+          outcome = CASE WHEN excluded.outcome = 'failure' OR hook_observations.outcome = 'failure' THEN 'failure' ELSE excluded.outcome END`).run(provider, event, at, HUNCH_VERSION, evidence);
         });
     }
     catch { /* evidence is optional; the hook response is not */ }
@@ -27,7 +40,7 @@ export function readHookObservations(root) {
         return [];
     return withServedDatabase(root, db => {
         ensureTable(db);
-        return db.prepare("SELECT provider, event, at, version FROM hook_observations ORDER BY at DESC").all();
+        return db.prepare("SELECT provider, event, at, version, outcome FROM hook_observations ORDER BY at DESC").all();
     });
 }
 //# sourceMappingURL=hookObservations.js.map

package/dist/extractors/git.js

@@ -1769,7 +1769,11 @@ function waitForCommitLockHandoff(lock, first, timeoutMs) {
     while (Date.now() < deadline) {
         if (attempt.state === "acquired")
             return true;
-        if (attempt.state !== "held-live" || attempt.ownerPid === process.pid)
+        // Once the first snapshot proved a live owner, an owner-less snapshot can be
+        // the normal release window: recursive cleanup removes owner-<pid> before
+        // removing the outer lock directory. Keep the bounded handoff wait through
+        // that transient state instead of reporting a false busy/no-op result.
+        if (attempt.state === "held-live" && attempt.ownerPid === process.pid)
             return false;
         Atomics.wait(sleeper, 0, 0, Math.min(25, deadline - Date.now()));
         attempt = acquireCommitLock(lock);

package/dist/integrations/health.js

@@ -14,6 +14,8 @@ import { readHookObservations } from "../core/hookObservations.js";
 const CAPABILITY_EVIDENCE = {
     context: ["SessionStart", "UserPromptSubmit"],
     "edit-blocking": ["PreToolUse"],
+    // A successful PostToolUse only proves that the post hook ran. A provider
+    // may instead include an explicit failure status in that same event.
     "failure-capture": ["PostToolUseFailure", "PostToolUse"],
     compaction: ["PreCompact"],
 };
@@ -34,6 +36,15 @@ const object = (v) => {
         throw new Error("expected a configuration object");
     return v;
 };
+function evidenceFor(capability, harness, observed, expectedVersion) {
+    const matches = observed.filter(o => o.provider === harness && (capability !== "failure-capture"
+        ? CAPABILITY_EVIDENCE[capability].includes(o.event)
+        : o.event === "PostToolUseFailure" || (o.event === "PostToolUse" && o.outcome === "failure")));
+    // A stale row must not hide a fresh result recorded by a newer hook. Keep a
+    // matching stale row as the fallback so the caller can explain why it is not
+    // verified rather than treating the evidence as absent.
+    return matches.find(o => o.version === expectedVersion && Date.now() - Date.parse(o.at) <= OBSERVATION_FRESH_MS) ?? matches[0];
+}
 function strings(value) {
     if (typeof value === "string")
         return [value];
@@ -192,7 +203,7 @@ export function inspectIntegrations(root, selected) {
             else {
                 // Verified only by an event the host actually delivered, on the expected
                 // version, recently. Matchers and tool coverage beyond that event stay unproven.
-                const hit = observed.find(o => o.provider === harness && CAPABILITY_EVIDENCE[capability].includes(o.event));
+                const hit = evidenceFor(capability, harness, observed, report.expectedVersion);
                 const fresh = hit !== undefined && Date.now() - Date.parse(hit.at) <= OBSERVATION_FRESH_MS;
                 if (hit && fresh && hit.version === report.expectedVersion) {
                     status.status = "verified";
@@ -201,6 +212,9 @@ export function inspectIntegrations(root, selected) {
                 else if (hit) {
                     status.detail = `${event} configured; last observed ${hit.at} on Hunch ${hit.version}${hit.version === report.expectedVersion ? " (stale)" : `, not the expected ${report.expectedVersion}`}`;
                 }
+                else if (capability === "failure-capture" && observed.some(o => o.provider === harness && o.event === "PostToolUse")) {
+                    status.detail = `${event} configured; PostToolUse was observed, but no explicit failed-tool event was delivered, so failure capture remains untested`;
+                }
                 else {
                     status.detail = `${event} configured; host delivery, matchers, and tool coverage are not verified`;
                 }

package/dist/integrations/providers.js

@@ -345,7 +345,9 @@ export function writeCodexHooks(root, inv) {
         SessionStart: [entry()],
         UserPromptSubmit: [entry()],
         PreToolUse: [entry("apply_patch")],
-        PostToolUse: [entry("apply_patch|shell|local_shell")],
+        // Codex's native command tool arrives as `Bash` (or `PowerShell` on
+        // Windows), while older hosts may expose shell/local_shell names.
+        PostToolUse: [entry("apply_patch|Bash|PowerShell|shell|local_shell")],
         Stop: [entry()],
         PreCompact: [entry()],
         SubagentStart: [entry()],

package/dist/mcp/server.js

@@ -1753,7 +1753,11 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
                 spawned_decision: finding.spawned_decision ?? existing?.spawned_decision ?? null,
                 observed_at: existing?.observed_at ?? now, // first observation wins — updates re-verify, not re-date
                 resolved_commit: finding.resolved_commit ?? existing?.resolved_commit ?? null,
-                provenance: { source: "human_confirmed", confidence: 0.95, evidence: finding.evidence ?? existing?.provenance.evidence ?? [], last_verified: now },
+                // Findings have no authenticated capture front door. Calling this MCP tool is
+                // agent testimony, even when the observation is updating a record that a human
+                // confirmed previously; only an explicit human-authored path may mint the
+                // human_confirmed tier.
+                provenance: { source: "agent_recorded", confidence: 0.75, evidence: finding.evidence ?? existing?.provenance.evidence ?? [], last_verified: now },
             };
             const stored = store.putCapture("findings", rec, !!finding.private);
             const observed = observeReportCapture(root, task_id, "findings", stored, home, !!existing, home === "private" ? store.privateDir ?? undefined : hunchPaths(root).hunch);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.32.5",
+  "version": "1.32.7",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.32.5",
+  "version": "1.32.7",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.32.5",
+      "version": "1.32.7",
       "runtimeHint": "npx",
       "packageArguments": [
         {