@davesheffer/hunch 1.35.0 → 1.36.0

package/dist/cli/index.js

@@ -66,6 +66,7 @@ import { scaffoldProviders, regenerateGrounding, refreshExistingGrounding, refre
 import { healClaudeConfigCaseSplit } from "../integrations/claudeConfig.js";
 import { formatSearchHit, formatStructure } from "../core/format.js";
 import { isStateKind, renderStateLine, stateSupplements } from "../core/stateDelivery.js";
+import { taskSupplements } from "../core/taskDelivery.js";
 import { diagnoseIssueCorrectionStage, formatCorrectionStageDiagnostic } from "../core/correctionStage.js";
 import { compileVerifiedEvidenceMap, formatVerifiedEvidenceMap } from "../core/evidenceMap.js";
 import { collectCorrectionStageSources } from "../extractors/correctionSources.js";
@@ -4210,7 +4211,7 @@ program
         decisionCorpus: store.recs("decisions"),
         historical: !!asOf,
         profile: opts.profile,
-        supplements: stateGrounding,
+        supplements: [...stateGrounding, ...(asOf ? [] : taskSupplements(store.tasksFor(target, 3), target))],
     });
     process.stdout.write(envelope.text);
     if (opts.task) {
@@ -4880,6 +4881,7 @@ program
         // from this file. No diff exists yet, so this is context — "don't re-add X" —
         // not a block; the commit-time `hunch check` does the actual gating.
         const retired = store.retiredForFile(target).filter((r) => r.symbols.length || r.deps.length);
+        const recentTasks = taskSupplements(store.tasksFor(target, 3), target);
         const hasContent = ctx.constraints.length ||
             ctx.decisions.length ||
             ctx.bugs.length ||
@@ -4888,6 +4890,7 @@ program
             ctx.landscape?.resources.length ||
             ctx.landscape?.relationships.length ||
             retired.length ||
+            recentTasks.length ||
             docGround;
         if (!hasContent)
             return; // no noise on files Hunch hasn't learned yet
@@ -4905,6 +4908,7 @@ program
                         text: `⚠ Deliberately RETIRED from this file — do not re-introduce without cause: ${retired.map((r) => `${[...r.symbols, ...r.deps].join(", ")} (${r.decision})`).join("; ")}.`,
                     }] : []),
                 ...(docGround ? [{ id: "doc-grounding", kind: "doc-grounding", priority: 100, text: docGround }] : []),
+                ...recentTasks,
             ],
         });
         const text = envelope.text.trim();

package/dist/core/spawnCommand.d.ts

@@ -0,0 +1,14 @@
+export interface ResolvedSpawn {
+    file: string;
+    args: string[];
+    /** Set when a batch launcher runs through cmd.exe and the line is pre-quoted. */
+    windowsVerbatimArguments?: boolean;
+    how: "direct" | "npm-cli" | "pathext" | "cmd-shim";
+}
+export interface SpawnResolveOptions {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    execPath?: string;
+    exists?: (path: string) => boolean;
+}
+export declare function resolveSpawnCommand(command: readonly string[], options?: SpawnResolveOptions): ResolvedSpawn;

package/dist/core/spawnCommand.js

@@ -0,0 +1,61 @@
+/** Resolve a user-supplied argv into something `spawn` can run without a shell.
+ *
+ * On POSIX the argv is already right. On Windows, `spawn("npx", ...)` with
+ * `shell: false` fails: the launcher is `npx.cmd`, and Node refuses to run
+ * `.cmd`/`.bat` files directly. The verification runner used to swallow that
+ * as `exit_code: null`, so every contribution card on Windows said "no
+ * independent command result". This keeps `shell: false` for real
+ * executables and only routes batch launchers through `cmd.exe`, with the
+ * npm/npx launchers run as plain Node scripts (no shell at all). */
+import { existsSync } from "node:fs";
+import { posix, win32 } from "node:path";
+/** cmd.exe quoting for one argument: wrap when it has whitespace or shell
+ * metacharacters; double embedded quotes. Good for test/build commands; a
+ * deliberately hostile argument still cannot escape because the whole line is
+ * passed as one `/s /c "..."` token. */
+function quoteForCmd(arg) {
+    if (arg === "")
+        return '""';
+    if (!/[\s"&|<>^()%!]/.test(arg))
+        return arg;
+    return `"${arg.replace(/"/g, '""')}"`;
+}
+export function resolveSpawnCommand(command, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const [cmd = "", ...args] = command;
+    if (platform !== "win32")
+        return { file: cmd, args, how: "direct" };
+    const env = options.env ?? process.env;
+    const exists = options.exists ?? existsSync;
+    const execPath = options.execPath ?? process.execPath;
+    // Resolve Windows paths with Windows semantics even when the resolution is
+    // exercised (tested) on another platform; the host's default `path` is POSIX there.
+    const { join, dirname } = platform === "win32" ? win32 : posix;
+    // npm / npx: run the CLI script with this same Node. No shim, no shell.
+    if (/^(npm|npx)$/i.test(cmd)) {
+        const script = join(dirname(execPath), "node_modules", "npm", "bin", `${cmd.toLowerCase()}-cli.js`);
+        if (exists(script))
+            return { file: execPath, args: [script, ...args], how: "npm-cli" };
+    }
+    // A path or an explicit executable extension: spawn as given.
+    if (/[\\/]/.test(cmd) || /\.(exe|com)$/i.test(cmd))
+        return { file: cmd, args, how: "direct" };
+    const pathExt = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.trim()).filter(Boolean);
+    const dirs = (env.PATH ?? env.Path ?? "").split(";").map((d) => d.trim()).filter(Boolean);
+    for (const dir of dirs) {
+        for (const ext of ["", ...pathExt]) {
+            const candidate = join(dir, cmd + ext);
+            if (!exists(candidate))
+                continue;
+            if (/\.(cmd|bat)$/i.test(candidate)) {
+                const line = [candidate, ...args].map(quoteForCmd).join(" ");
+                return { file: env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", `"${line}"`], windowsVerbatimArguments: true, how: "cmd-shim" };
+            }
+            if (ext === "" && !/\.(exe|com)$/i.test(candidate))
+                continue; // an extensionless file is not runnable on Windows
+            return { file: candidate, args, how: "pathext" };
+        }
+    }
+    return { file: cmd, args, how: "direct" };
+}
+//# sourceMappingURL=spawnCommand.js.map

package/dist/core/taskDelivery.d.ts

@@ -0,0 +1,15 @@
+/** Recent finished tasks as delivered context.
+ *
+ * Task records (`.hunch/tasks/`) say what earlier agent work did around a file:
+ * which lessons it received, what it applied, saved and checked, and whether a
+ * rule was violated. Delivering the newest few next to the invariants lets the
+ * next agent build on verified work instead of rediscovering it. Supplements
+ * share the brief's budget and are advisory: a task line is history, never a
+ * rule, and never an instruction to repeat or skip anything. */
+import type { DeliverySupplement } from "./delivery.js";
+import type { TaskRecord } from "./types.js";
+export declare const TASK_SUPPLEMENT_LIMIT = 3;
+/** One bounded line for a task: identity, when, what reached it, what it did. */
+export declare function describeTaskRecord(t: TaskRecord): string;
+/** Newest first, bounded. Empty input yields no supplement at all (no header noise). */
+export declare function taskSupplements(tasks: readonly TaskRecord[], target: string, limit?: number): DeliverySupplement[];

package/dist/core/taskDelivery.js

@@ -0,0 +1,38 @@
+export const TASK_SUPPLEMENT_LIMIT = 3;
+function clip(text, max) {
+    return text.length <= max ? text : `${text.slice(0, max - 1).trimEnd()}…`;
+}
+/** One bounded line for a task: identity, when, what reached it, what it did. */
+export function describeTaskRecord(t) {
+    const when = t.finished_at.slice(0, 10);
+    const lessons = t.lessons.length
+        ? `${t.lessons.length} lesson(s): ${t.lessons.slice(0, 3).map((l) => l.record_id).join(", ")}${t.lessons.length > 3 ? "…" : ""}`
+        : "no memory delivered";
+    const applied = t.applied.length
+        ? `applied ${t.applied.length} (${t.applied.some((a) => a.supported_by) ? "rule-supported" : "agent-reported"})`
+        : null;
+    const saved = t.saved.length ? `saved ${t.saved.slice(0, 3).map((s) => s.record_id).join(", ")}${t.saved.length > 3 ? "…" : ""}` : null;
+    const last = t.checks.at(-1);
+    const check = last ? `check "${clip(last.label, 40)}" ${last.state}` : "no check recorded";
+    const violated = t.conformance.some((c) => c.outcome === "violated") ? "RULE VIOLATED" : null;
+    const denied = t.refusals ? `${t.refusals} edit(s) denied` : null;
+    const files = t.files.length ? `files ${t.files.slice(0, 4).join(", ")}${t.files.length > 4 ? "…" : ""}` : null;
+    return `${t.id} · ${when} · ${t.state} · "${clip(t.title, 80)}" — ${[lessons, applied, saved, check, violated, denied, files].filter(Boolean).join(" · ")}`;
+}
+/** Newest first, bounded. Empty input yields no supplement at all (no header noise). */
+export function taskSupplements(tasks, target, limit = TASK_SUPPLEMENT_LIMIT) {
+    const recent = [...tasks]
+        .sort((a, b) => b.finished_at.localeCompare(a.finished_at) || a.id.localeCompare(b.id))
+        .slice(0, Math.max(1, limit));
+    if (!recent.length)
+        return [];
+    const older = tasks.length - recent.length;
+    return [
+        {
+            id: "recent-tasks", kind: "recent-tasks", priority: 415,
+            text: `RECENT TASKS on ${target} — earlier agent work here, from graph memory (advisory history, not rules): build on what was verified instead of redoing it blind.${older > 0 ? ` ${older} older task(s) not shown; hunch task list.` : ""}`,
+        },
+        ...recent.map((t, i) => ({ id: t.id, kind: "recent-task", priority: 414 - i, text: describeTaskRecord(t) })),
+    ];
+}
+//# sourceMappingURL=taskDelivery.js.map

package/dist/core/taskReportEvidence.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { lstatSync, readFileSync, readlinkSync, realpathSync } from "node:fs";
 import { canonicalReportRoot } from "./taskReportPaths.js";
+import { resolveSpawnCommand } from "./spawnCommand.js";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { analyzeDiff } from "../extractors/diff.js";
 import { workingDiff, workingFiles } from "../extractors/git.js";
@@ -209,7 +210,11 @@ export async function runReportCheck(root, taskId, command, label, timeoutMs = 1
     ReportCheckSchema.parse({ label, command, exit_code: null, output_hash: reportHash(""), before_snapshot: before.hash, after_snapshot: null, snapshot_limitations: before.limitations, timed_out: false, source: "local-command-runner" });
     const checkId = beginReportCheck(root, taskId, label);
     const result = await new Promise((resolveResult) => {
-        const child = spawn(command[0], command.slice(1), { cwd: root, shell: false, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, detached: process.platform !== "win32" });
+        // Windows launchers (npx.cmd, npm.cmd, other .cmd/.bat shims) cannot be spawned
+        // without a shell; resolve them first so a check actually runs instead of
+        // silently recording exit_code null (fnd: every Windows card said "no result").
+        const resolved = resolveSpawnCommand(command);
+        const child = spawn(resolved.file, resolved.args, { cwd: root, shell: false, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, detached: process.platform !== "win32", windowsVerbatimArguments: resolved.windowsVerbatimArguments === true });
         const stdout = createHash("sha256"), stderr = createHash("sha256");
         let timedOut = false, cancelled = false, settled = false;
         let cleanupTimer;
@@ -258,7 +263,16 @@ export async function runReportCheck(root, taskId, command, label, timeoutMs = 1
             stderr.update(chunk);
             options.onStderr?.(chunk);
         } });
-        child.once("error", () => settle(null));
+        child.once("error", (error) => {
+            // A launch failure is a result the user must see (ENOENT is the common
+            // one); it is hashed like any other stderr and streamed to the caller.
+            const message = Buffer.from(`hunch: could not start ${JSON.stringify(command[0])}: ${error.message}\n`);
+            if (!settled) {
+                stderr.update(message);
+                options.onStderr?.(message);
+            }
+            settle(null);
+        });
         child.once("close", code => settle(code));
         options.signal?.addEventListener("abort", cancel, { once: true });
         if (options.signal?.aborted)

package/dist/core/taskReportHook.js

@@ -1,6 +1,5 @@
 /** Native lifecycle coverage is independent of whether a model follows reporting
  * instructions. Only an authoritative prompt identity may join its evidence. */
-import { pathToFileURL } from "node:url";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { findRoot } from "./paths.js";
@@ -8,7 +7,7 @@ import { canonicalReportRoot } from "./taskReportPaths.js";
 import { isCredentialFreeText } from "./types.js";
 import { isEmptyTaskReport, readTaskReport, recordReportRefusal, reportHash, reportPresentationEnabled, startReportTask } from "./taskReport.js";
 import { reportSourceSnapshot } from "./taskReportEvidence.js";
-import { renderTaskReport, writeTaskReportHtml } from "./taskReportRender.js";
+import { renderTaskReport } from "./taskReportRender.js";
 /** The exact task identity a native host prompt maps to. */
 export function promptTaskId(root, sessionId, promptId, agentId = null, provider = "claude") {
     return `htask_${reportHash([canonicalReportRoot(root), provider, sessionId, promptId, agentId]).slice(7, 31)}`;
@@ -131,13 +130,10 @@ export function stopHookReport(root, provider, event) {
         const report = readTaskReport(root, id, reportSourceSnapshot(root).hash);
         if (isEmptyTaskReport(report))
             return null;
-        let card = renderTaskReport(report);
-        try {
-            const file = writeTaskReportHtml(root, id);
-            card = card.replace(/^Evidence .*$/m, `Evidence  ${pathToFileURL(file).href}`);
-        }
-        catch { /* exact CLI evidence link remains available */ }
-        return { systemMessage: card };
+        // The HTML evidence view is a rendering of the local ledger, generated on
+        // demand (`hunch report <id> --html`, or a click in the VS Code view). The
+        // graph record is the durable memory; no file is written per prompt.
+        return { systemMessage: renderTaskReport(report) };
     }
     catch {
         return { systemMessage: `Hunch report unavailable for ${id}. Contribution is unverified; inspect with hunch report ${id}.` };

package/dist/integrations/claudemd.js

@@ -75,7 +75,7 @@ export function renderHunchSection(store, root) {
     lines.push("- When running a relevant check, use the exact verification_argv launcher returned by hunch_task start, followed by the check command and its arguments, from this worktree. It runs `hunch task verify <task_id> -- <command> [arguments]` using the same installation as MCP, avoiding stale global binaries. This retains the actual exit result and source snapshot; raw output is not stored. Do not rerun an expensive check solely for reporting; missing evidence stays unverified.");
     lines.push("- Include the current task_id when calling hunch_record_decision, hunch_record_correction, or hunch_record_finding. The save path records its actual memory home and verifies exact Git revisions when committing or pushing; never infer publication from a successful capture alone.");
     lines.push("- Before claiming an application, call `hunch_report(task_id)` and copy the exact occurrence_id, record_id and content_hash from application_references, adding an action you actually took. Never derive an occurrence ID by replacing a receipt prefix or use the task's scope hash as a record hash. If you did not apply a lesson, omit applications.");
-    lines.push("- Call `hunch_task(action: \"finish\", task_id, applications?)` and include the returned contribution_card in your final response without the user asking. Render its Markdown evidence link outside any code block so it remains clickable. Copy the card with its evidence link and agent-reported label intact; the structured result contains the card even when the host hides text blocks. Do not replace it with a generic claim that Hunch helped. If presentation_enabled is false, omit the card. A delivered lesson or passing command alone does not prove causal impact.");
+    lines.push("- Call `hunch_task(action: \"finish\", task_id, applications?)` and include the returned contribution_card in your final response without the user asking. Copy the card verbatim, including its Evidence line (the command that renders the local report on demand) and the agent-reported label; the structured result contains the card even when the host hides text blocks. Do not replace it with a generic claim that Hunch helped. If presentation_enabled is false, omit the card. A delivered lesson or passing command alone does not prove causal impact.");
     lines.push("- If interrupted, finish with `outcome: \"interrupted\"` when possible. `hunch_report(task_id, html: true)` opens the evidence trail by generating a local file; it may contain private memory and is not a public export. If report tools are unavailable after an update, say so and reconnect the host rather than inventing a report.");
     lines.push("");
     lines.push("**Build the Constitution review queue:**");

package/dist/mcp/server.js

@@ -32,6 +32,7 @@ import { withWriteLock } from "../serve/writelock.js";
 import { advertisedTeamRemoteContract, ensureTeamOverlay, overlayMatchesTeamRemote, readTeamConfig, teamRemoteContract, teamSharedRef } from "../integrations/team.js";
 import { formatSearchHit, formatStructure } from "../core/format.js";
 import { isStateKind, stateSupplements } from "../core/stateDelivery.js";
+import { taskSupplements } from "../core/taskDelivery.js";
 import { diagnoseIssueCorrectionStage, formatCorrectionStageDiagnostic } from "../core/correctionStage.js";
 import { compileVerifiedEvidenceMap, EvidenceExecutionSchema, EvidenceInterventionSchema, EvidenceProbeSchema, formatVerifiedEvidenceMap, VerifiedEvidenceReceiptSchema, } from "../core/evidenceMap.js";
 import { collectCorrectionStageSources } from "../extractors/correctionSources.js";
@@ -1101,6 +1102,9 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
         // latest receipts whose subject/text matches the target — bounded, ordered, sharing the
         // brief's budget as supplements. Withheld on time-travel: state records carry no as-of view.
         const stateGrounding = asOf ? [] : stateSupplements(store.stateSlice(target), target);
+        // Recent finished tasks that touched the target: what earlier agent work did
+        // here, from graph memory. Advisory history sharing the brief's budget.
+        const recentTasks = asOf ? [] : taskSupplements(store.tasksFor(target, 3), target);
         const options = {
             root,
             symbols: store.recs("symbols"),
@@ -1108,7 +1112,7 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
             decisionCorpus: store.recs("decisions"),
             historical: !!asOf,
             profile: profile ?? "builder",
-            supplements: [...(dnaSupplement ? [dnaSupplement] : []), ...stateGrounding, ...(asOf ? [] : conventionSupplements(store.recs("conventions")))],
+            supplements: [...(dnaSupplement ? [dnaSupplement] : []), ...stateGrounding, ...recentTasks, ...(asOf ? [] : conventionSupplements(store.recs("conventions")))],
         };
         // Task-phrase input ("improve retrieval ranking") resolves no file/symbol and
         // used to return an empty brief while the graph held the answer — fall back to
@@ -1136,6 +1140,7 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
                     supplements: [
                         ...(dnaSupplement ? [dnaSupplement] : []),
                         ...stateGrounding,
+                        ...recentTasks,
                         ...hits
                             // State hits are delivered through the State section above, not as raw search lines.
                             .filter((hit) => !["constraints", "decisions", "bugs", "findings"].includes(hit.kind) && !isStateKind(hit.kind))

package/dist/mcp/taskReportTools.js

@@ -121,13 +121,10 @@ export function registerTaskReportTools(server, getRoot, getStore) {
             }
             const report = readTaskReport(root, task_id, reportSourceSnapshot(root).hash);
             const show = reportPresentationEnabled(root);
-            let file = null;
-            try {
-                file = writeTaskReportHtml(root, task_id);
-            }
-            catch { /* retained report remains inspectable through MCP */ }
-            const card = (file ? renderTaskReport(report).replace(/^Evidence .*$/m, `Evidence  [Open local report](<${file}>)`) : renderTaskReport(report)) + graphNote;
-            return { content: [{ type: "text", text: show ? card : "Task report retained. Automatic presentation is disabled; omit the contribution card from the final response." }], structuredContent: { ...boundedTaskReportForHost(report), presentation_enabled: show, contribution_card: show ? card : null, report_path: file, graph_record: graph } };
+            // The HTML evidence view is rendered on demand (hunch_report(html: true),
+            // `hunch report <id> --html`, or the VS Code view); finish writes no file.
+            const card = renderTaskReport(report) + graphNote;
+            return { content: [{ type: "text", text: show ? card : "Task report retained. Automatic presentation is disabled; omit the contribution card from the final response." }], structuredContent: { ...boundedTaskReportForHost(report), presentation_enabled: show, contribution_card: show ? card : null, report_path: null, graph_record: graph } };
         }
         catch (error) {
             const message = `Task report unavailable: ${error.message}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.35.0",
+  "version": "1.36.0",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.35.0",
+  "version": "1.36.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.35.0",
+      "version": "1.36.0",
       "runtimeHint": "npx",
       "packageArguments": [
         {